last executing test programs: 5.250605963s ago: executing program 1 (id=18076): r0 = socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) unshare(0x6a040000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newsa={0x154, 0x10, 0x1, 0x0, 0x0, {{@in6=@private1, @in=@private}, {@in6=@dev={0xfe, 0x80, '\x00', 0x1d}, 0x4d5, 0x32}, @in6=@private1, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}, 0xfffffffffffffe8a}}, @replay_esn_val={0x1c}]}, 0x154}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000180)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x26020480) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100"], &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000f40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad6706000002000000070200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f750000000000006154000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56600a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8ddaf2cdad3d1a74a2f078aa6402483856a6e495408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae06e394c9639564f000fc3cdd05a157544d0200000000000000ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f88e80ef80c6ed3e1ff91ff111000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcbacec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0ddd932d838ff651023853d42210642986f8bbc7340bc8393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d68124674478186edd036f15bf847c33f79e1a0ad3d2b5080ecb01420c9f1b534e969fce97ffff07000009000000bfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a823e28f359608ea326c77a1aa17318f392a0ec6c188916f4149c503027feccfd68ec826da90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8e68f076c659f56d6c7f97a94d604f45cfe88b30c170000000001000000ef931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f0400000000000000d23b48bb38b31a14ffcddd92ce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f1300007d6072f0cf120ad2ba519afdd43a14000000000000000000000000007ef2f3c58d045f0700000094069acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d000000000000000000007758b1267669ded883b5867c5916a74843b784955108f750c57744c76a09629dd0aaca5cb0f14f49db80a1aa2692c18fbb31cbdb3f2e138e6d5ba3491fc3617b511f24bad26466407e39000000000000d7a1bf4624d31c13a6840f45a7f4e01a50d790132abb36915e35b1ac35bf3921357f638684bba17b8fe1e2123153ecd6d1f76820d4f8fa0b96b50c457ae8d5f2351cdb7bc8170380557bc11cf6ee3395974e37018a2a7473312cb32affb8ff72a253e0d36099e460f13694b9891af526d9608271838e83d17103887f34210dd4c0cf60dec608b4ca5ba2f3037bf381e7b5d5b27820000000000000000000000b719bd34f3244730f708fdd532640edc6b82dd4ad72ecbaccafef806f5447aba2246d56a601bbd8c24ba1e16dda3296ce10de683000"/1782], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x1) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r6, 0x1, 0x200000010, &(0x7f0000000000)=0x9, 0x4) sendto$unix(r5, &(0x7f0000000080)="008e", 0x2, 0xd1, 0x0, 0x0) recvfrom$unix(r6, 0x0, 0x0, 0x10102, 0x0, 0x0) splice(r3, 0x0, r4, 0x0, 0xfffd, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000080)={0x9, 0xffff, 0x1, 0xb5}, 0x10) r7 = socket$inet(0x2, 0x2, 0x11) sendmsg$kcm(r4, &(0x7f0000000480)={&(0x7f0000000240)=@l2={0x1f, 0xedac, @any, 0x67e, 0x2}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000140)="6894aa565e4313f8c2", 0x9}], 0x1, &(0x7f0000000800)=[{0x78, 0x111, 0x4a1b, "c4bad8406bae9460e2333d3c28e9063a98ed306a9e84c90655cd4c447de5804a063b30a09cf06e1cb2b9c98164d1aa1bf42cc701e3d033c24d91e5872974bbec14829924619f9f2ac73c059d6e5ef169e1d703b33060f934abfa0db50af9180ca8c9"}, {0x10, 0x10c, 0x985a}, {0x48, 0x103, 0x6, "1f34e3229119533ddf83e448d8193374c9949dfed27e365805ac7ab5652bcb067d2639fe41c37a93a2236a4d36ad9cbd1a42c94953"}, {0x108, 0x114, 0x2, "668a7b94d20d3200b8415bc06d771799fb59809ee63c89f1e5781041edbd28018082ec60132e3bd41c504350840a0a4abf9fc6fedeb50dfd4ee8fce1e0966271a8f053f24c8ac62c48f7cecd1e0b74a6facae11cb40354def9d4528e4ba4a5f7708ae5662e0ca717a63fcc1a60d81e769734190e8cec8e68438d3d0d65d36033656c946b3a42c0f0050829e98cf17b4ba38a57767f69d80a970e25db5d400553d16ce046fdb73d181eb8a29d41506ea81d3d5a7804c707aa0eefc6926e2f641775617bde98cf60da72ed9a070c7edbda4e81b1c4cf812614a8cbfed4d971ecbaa1e9b64c2af788dadb15954fe14448eb235ac1b7ba451d48"}, {0x48, 0x115, 0x3, "0fcf07cf35cb711e56e8956e3e8f55e95fc67a2614dc19f32b6d5ab38986d11a0260237427d45528f38cc23bfcd1fa994aa3a92e716adf3e"}], 0x220}, 0x10) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r7, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) recvmmsg(r7, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000300)="2e00000010008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000100020400bf050005001201", 0x2e}, {&(0x7f0000000000)="35f940c5132a20d296437117f747ed23cfc03e0cbc65998456358e456c0e81df29605860d88f3d86", 0x28}, {&(0x7f0000000040)="cfce412fe9066dbf67930c190748db46efa9bd892f188cf9ddfe99f5ae399103e1074665406fc1cffccc1d71ba460e1a7b35197a4ddf", 0x36}], 0x3}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x700, 0x7, 0x4, 0xfffffffd, {{0x19, 0x4, 0x3, 0x4, 0x64, 0x68, 0x0, 0x0, 0x2f, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0x23, 0x65, [@loopback, @private=0xa010101, @broadcast, @rand_addr=0x64010100, @multicast2, @dev={0xac, 0x14, 0x14, 0x3b}, @empty, @empty]}, @timestamp={0x44, 0x4, 0xba, 0x0, 0x4}, @cipso={0x86, 0x27, 0x1, [{0x0, 0x11, "7c804d3ea8f819c7b6491b422e0a21"}, {0x6, 0x10, "269cd0e1c8c92317362ca4693252"}]}]}}}}}) 3.009648596s ago: executing program 2 (id=18094): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000040000000000000e0300000000000000000000000000000504000000000000000000000b04000000000000000000000b02000000000000"], 0x0, 0x52}, 0x28) 2.881866458s ago: executing program 2 (id=18097): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'rose0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x0, 0x0}) 2.749898045s ago: executing program 4 (id=18099): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r2 = gettid() sendmmsg$unix(r0, &(0x7f0000003380)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x33fe0, 0x10}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=[@rights={{0x14, 0x1, 0x1, [r1]}}, @cred={{0x1c, 0x1, 0x2, {r2}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x50, 0x40800}}], 0x2, 0x4012412) 2.698700439s ago: executing program 2 (id=18100): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x20005}, 0x4000894) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x3) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$int_in(r1, 0x5452, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000280)={r2, 0x7, 0x104, 0x7ff}) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100)=0x80, 0x4) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x1000000, 0x0, 0x24044000}, 0x24040840) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="140000001000010000000000000030000000000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300d67a8527f76ec11542b6fcd728b981a405106c720a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}}, 0x4008014) 2.64795484s ago: executing program 4 (id=18101): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r1, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xffffffa9}, {&(0x7f00000002c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)}, {0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000003c0)="96e6e14d06cd2cd1dc6969313336a9017d94"}, {&(0x7f0000000400)="499b7fee4035c5b8beb1f70453870f0783c185665f5661dc54c5a1a1ad65e127a695fb29eb758e857595e5277fdfcd8246da633a7d6ed7e05fe75f4f36c670e755ca5142914fdc83650da6c01c7a06ebf495fbe36b151a4c207d9347308484a5891ad7c14310bd"}, {&(0x7f0000000640)="7caba4f81ffec1c44c4691773da226d91a54e9721f1f4c8f4d4f19a73292612c8ad72d40ac83e55148f6700815e6d140cfab03adc719caee1f3feed087bc616c3bc19a510350d0befe495457b7d16c139c6e6850f1e32a661bd7cc91e333472aae3e3eb8815a38aa8fea91788c44336c8437a86f885f3546456df377a81b43b22f543cad111ff0d0"}], 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="00000000000000001701000004000000040000000000000000000000000000001701000003000000000000000000000000000000000000001701000002000000000000008db6ba8669d9e3af336c9db7d7b600000000000067ab9dfade50263fca68064513414d4a7812c38b4c70753e9ef9f941ff7c1ebcfd79c64a594b41dd41b329d3cc14c29fa008f5c24363ad52e2bafeba6e55ac24ad2a44cbeacd365353b6541f21789daab56174ca2941b64022d67061ec8e2b1fa1eed6e9d4"], 0x0, 0x40088c0}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0xc000) 2.099207641s ago: executing program 2 (id=18103): pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000015c0)=[{&(0x7f0000001340)='(', 0x1}], 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x2000000002ffff, 0x0) 1.963282139s ago: executing program 2 (id=18104): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r0, &(0x7f0000000640)={0xa, 0x0, 0x80, @local, 0x46}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="80003724090008ce", 0x8, 0x0, &(0x7f0000000180)={0xa, 0x4e23, 0xfffffffc, @remote, 0x10000003}, 0x1c) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000048000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a6000000850000005000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x10, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="91100d000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1000000004000000040000000200000000000000", @ANYRES32, @ANYBLOB="00498f000000000047c3f3d466fe70fd5ccb06a8af4f03400000000000000100000000c51d999b2c76447267230000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x7d}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r3, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) socket$netlink(0x10, 0x3, 0x0) socket(0x80000000000000a, 0x2, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x4) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x4000002, 0x3032, 0xffffffffffffffff, 0x2a1cf000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r6, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) 1.902629971s ago: executing program 0 (id=18106): openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000180)={0x28, 0x0, 0x0, @local}, 0x10) connect$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0xffffec77, @hyper}, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000340), r0) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="02002abd7000fddbdf25030000000500010001000000140000000200000072703100000000000000000000002a6c10d1c791c62868bfe676000000000000000000cca974d69ed0e6bef50b13e4c6eb6940b1b2"], 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x40000) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r5, @in6={{0xa, 0x3, 0x4, @dev={0xfe, 0x80, '\x00', 0x1e}}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000100)={r6, 0x86}, &(0x7f0000000180)=0x8) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r8, 0x89f3, &(0x7f0000000640)={'ip6gre0\x00', &(0x7f00000006c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x5, 0x0, 0xde47, 0xc, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x7, 0x4, 0x3}}) syz_genetlink_get_family_id$nl802154(&(0x7f0000000500), r7) r9 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r9, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r9, 0x1, 0x25, &(0x7f0000000840)=0x473e, 0x4) sendmmsg$inet(r9, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) clock_gettime(0x0, &(0x7f0000003300)) recvmmsg(r9, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/213, 0x6f}], 0x1, 0x0, 0xffffffffffffff6e}, 0x75}, {{0x0, 0x0, 0x0, 0xab}, 0x3ff}], 0x2, 0x2100, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000540)={'wpan1\x00'}) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r7, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x48}, 0x1) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000280), r0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44000}, 0x0) 1.695222154s ago: executing program 1 (id=18108): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x401, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0xffffffffffffff58, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6}, @IFLA_GRE_ENCAP_FLAGS={0x6}]}}}]}, 0x48}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000400)={0x28, 0x0, 0x0, @host}, 0x10) getsockopt$nfc_llcp(r2, 0x118, 0x4, &(0x7f0000000340)=""/92, 0x5c) ioctl$PPPIOCSACTIVE(r1, 0x40047459, &(0x7f0000000080)={0xfffffffffffffe43, 0x0}) ppoll(&(0x7f0000000000)=[{r1, 0x20}], 0x1, 0x0, 0x0, 0x0) write$ppp(r1, &(0x7f0000000200)="bc72", 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x68, 0x2, 0x6, 0x3, 0xe4340000, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x50}, @IPSET_ATTR_SIZE={0x8, 0x17, 0x1, 0x0, 0x8}]}]}, 0x68}}, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000080)={0x4c}, 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000140)={r5, 0x0, 0x25, 0x14, @void}, 0x10) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000001900)=ANY=[@ANYBLOB="400000001000030428bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0800000000000000140012800b00010067726574617000"], 0x40}}, 0xc080) 1.588496919s ago: executing program 4 (id=18110): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'rose0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x60, 0x8, 0x1}]}) 1.517886473s ago: executing program 0 (id=18111): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000b40)=ANY=[@ANYBLOB="00008100ffffffffffffaaaaaaaaaa438100020008004500fdea4000e0000333"], 0x32) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)={0x30, 0x3e, 0x107, 0x70bd2b, 0x0, {0x1, 0x7c}, [@nested={0x4, 0xfc}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x5, 0x6, 0x0, 0x0, @str='\x00'}]}, @nested={0x4, 0x2}, @typed={0x8, 0x7, 0x0, 0x0, @fd=r0}]}, 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 1.444445137s ago: executing program 3 (id=18112): syz_80211_join_ibss(&(0x7f0000000240)='wlan1\x00', 0x0, 0x0, 0x80c001) 1.37724094s ago: executing program 3 (id=18113): r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000080)={&(0x7f00000000c0)=@in6={0xa, 0x4e23, 0x40000000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x9}, 0xffffffffffffff69, &(0x7f00000023c0)=[{&(0x7f0000000040)='\b', 0x1}], 0x1, 0x0, 0x0, 0x24040000}, 0xc0) sendmsg$inet_sctp(r0, &(0x7f0000000140)={&(0x7f0000000700)=@in={0x2, 0x4e1d, @loopback}, 0x10, &(0x7f0000000100)=[{&(0x7f0000000740)="1931ab5cab8ab678bf0d9ba57399dc0f485423d397033e074e1cffebaa38e2f9f66b654542624f60853fa2de3115ca8b4089319cc0861c0b55b8e6da745418d5355a4f6856b7e152099a32179a07a890d9dc3bcd3894addf7aa162f46f9d2b6e9ba1c58053710662ff0cf416d3152976535ce959d7907c87b6182c1ee01d7b6b4cc1807f39421ca79342432a680c1b2af2357c61d782d124665b9a2faa50e5dfb8f1987a4cda683f6b6fe77065a398eb343d8b64940ab3f8eb924609adf6b5bc7c3a78a5099df2699aed90f0abb42a93bd6b9637aa0591ba309c8c985d5e29b302715b65b2f12c0dc9a431e7d17677bcfac755cf190d4b1cb2160a6cbe2a364d8676bca552ec6855c6f27a010eb22155681b067164b39a1a9f5955980c2cc86a5e67d7093ab41ece096c705b7cb3133d892b82dbbe0fe19e7b509c2a497dd58ade63af3da7de68e6cd0aa381fb3575c73f40327fd54638a8903f35b3c25b2f57a91739356f26602994471367eeadf360ca85c97711377edc9e15af990c83f8f6d3dbbb03c52cdb0097b8a9e1ad5e85a3926cadf1b5eb1aaadae7828d800d26801feb32700f13368e75d254c50253b23df6dba1179ae2588879c2779b23fc42d955ab39377089e97d6ae83751fe96fc761a336b27f8ca50c99dae1b257261586a2ba1c1d7d19f225947a910d96b26363ff60f315de424ff99f0812fd9c162bb1bf36440782e253ef9859d5410e78b4fdd0d02df79abd28f98ca31b8c2f23aacb6f2d5886f7b8e2b41158417bfd697b006d907eed3d9b394d17fe32394e1fcb24a9abb2dfa2d0b54d23097cae2b5d1b0a186579770769b623072bdf240376d238ff8ea9dde0a8cbef8b52be4a84c9e6a77acccebd139ae2eaf459332bea0d0a6eacb30ca0cd96097031c41f4e1afd70e397f05787c89e13731b97e921d35c533bbfee2d403a8973e24440dff1c95299d005d5bb86b05bdf3b130d8c6c3632dc24edfbc5cf589a14558946ed94ab14d7295363e0411c7ec119f959707176e790249379ab3a56a1472e40be0d883318e8c4ba0a8029959a3c388b5e1d8ba295105ef308f897d384d646a08d8f2947d5a4df0587ec9d483e11d298ccca701069c47cc1785a8e9169d3b2a865b2163761ccd6922880d32740d495bdea21d741d004bb378356da1c505c05d75b0cbf50a59b9ad12f08a4607792807e93a04890dec1e371842fcea5ddef02822ecbf00f358c28baafe5b0191a5a75d510ac4f1d41508c8df83d62586577d381bb6efaf71b30e2f154d0b891bbbff1254b96b3d5f8561ed9d2f421f5bf1c7053b5dff8e53ab8c72fb3062aa49e13fce6379c0c178c48147179691289266e687f8443fb570568d8cd3a9346d2c077de46d4307e6ceaa434671f241c93da3eda8583f79b475f31d95b5e48c699084bf4ccb8e6e5990570fab36d21812ad9032395b09a7db0ddc8ffc", 0x410}], 0x1, 0x0, 0x0, 0x24040100}, 0x4000050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f0000000240)={0x11, 0xc, 0x0, 0x1, 0x48, 0x6, @local}, 0x14) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)=ANY=[], 0xfdef) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000004dc0)=0x2, 0x4) 1.362405228s ago: executing program 4 (id=18114): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r1) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fedbdf250500000008000200ea"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000040)=0x1c, 0x4) sendmsg$netlink(r0, &(0x7f0000002b40)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)={0x20, 0x1e, 0x723, 0x0, 0x0, "", [@nested={0x10, 0xa9, 0x0, 0x1, [@typed={0x8, 0x126, 0x0, 0x0, @ipv4=@rand_addr=0x64010102}, @typed={0x4, 0xf}]}]}, 0x20}], 0x1, 0x0, 0x0, 0x24008015}, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xc}, 0x15, 0x3, 'fo\x00', 0x20, 0x4, 0x8}, 0x2c) r4 = socket$kcm(0xa, 0x2, 0x0) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @multicast2, 0x4e21, 0x3, 'ovf\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000c18000)="ad0000000400000284cd329200000000000000014c90c200", 0x18) setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r7 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r7, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f00000007c0)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}], 0x10) sendmmsg$inet6(r7, &(0x7f0000002580)=[{{&(0x7f00000004c0)={0xa, 0x4e21, 0xffffffff, @rand_addr=' \x01\x00'}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000380)="98", 0x1}], 0x1}}], 0x1, 0x4000040) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x439, 0x70bd2c, 0xffffffea, {0x0, 0x0, 0xe403, 0x0, 0x40083, 0x715cb}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, @IFLA_IPTUN_PROTO={0x5}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x4000040) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(0xffffffffffffffff, 0x84, 0x80, 0x0, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) sendto$inet6(r9, &(0x7f0000000180)='\x00', 0x1, 0x24000010, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r9, &(0x7f0000000c80)="7cffa9061b2f8b082b6f69ae50430c8a8b6aa3162ba083c4a52e1ab0ac50ed4a19b1a69988000d5bed4433daaa4932dbb1cb3550dee8b23579d76ce37d574b43fca1eed8ebd38d1303240ed0d84517692128dd5aef5c4d60a6659952a1437c6f0ac3ed75806011ccbaa504f41a7e0abcf8823bc4a71ef8c52c2b297b539eaf752c56ebfe9b0542543069257dafcbf76c958d4cbf4eaaa67c5c2bd9e6518be34b56add7613ab83d389724b664e62c154e1a5aac073a53a0e8cadcf51ef495ebbcc77d5e36ff24c3f282289cc077374b714e08fbfecbdc8f14ef3fd409af4caf6fcb7d663beab335f239a1e9", 0xeb, 0xbcff, 0x0, 0x0) writev(r9, &(0x7f0000001300)=[{&(0x7f0000000100)='^', 0xfdef}], 0x1) 1.169153569s ago: executing program 0 (id=18115): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000014c0)=@delchain={0x24, 0x5f, 0xf31, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xc, 0x2}, {0x0, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0xc0) write$rfkill(r1, &(0x7f0000000200)={0x6, 0x8, 0x3, 0x0, 0x1}, 0x8) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x68, 0x2, 0x6, 0x5, 0x0, 0x3000000, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x6d23}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x68}}, 0x0) 1.058980202s ago: executing program 3 (id=18116): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@allocspi={0x104, 0x16, 0x401, 0x70bd2d, 0x0, {{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4, 0xfffe, 0x0, 0x0, 0xa, 0x80, 0x20}, {@in=@multicast1, 0x1ffffffe, 0x33}, @in=@dev={0xac, 0x14, 0x14, 0x21}, {0x4, 0xfffffffffffffffe, 0x8, 0x6, 0x80000}, {0x2, 0x80000, 0x1900, 0x4}, {0x1c, 0x400, 0x3}, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0xd0}, 0x8, 0x8e}, [@sec_ctx={0xc, 0x8e, {0x8, 0x8, 0x1, 0xe}}]}, 0x104}, 0x1, 0x0, 0x0, 0x8801}, 0x6484c) 813.751975ms ago: executing program 3 (id=18117): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000000700)={@broadcast, @random="4ccb9831e888", @void, {@llc_tr={0x11, {@llc={0xaa, 0x0, 'o', "4cddd689f527e6cafe5005ed64e6"}}}}}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f00000001c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x56) connect$unix(r1, &(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a30000000030a0102000084e600000000030000020900010073797a3100000000080007006e617400080005400000000054000000030a01040000000000000000010000000900030073797a31000000000900010073797a310000000028000480080002405a7dff630800014000000005140003006d61637674617030000000000000000024000000000a050000000000000000000100000808000240000000020800024000000001140000001100010000000000000000000000000a"], 0xd0}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0xe, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="91107f000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26}, 0x94) sendmsg$NFNL_MSG_ACCT_DEL(r3, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x20, 0x3, 0x7, 0x201, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x44) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8923, &(0x7f0000000140)={'wg2\x00', @local}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r6) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010025bd7000fc357b252e00000005002b000100000005002e00060000000c00050000000000000000000a0400007770616e3000000081d90dcc235b684c6f06265d6ea6f3324d0682ea62bd51d3ea58916c4488314605d1e046659779aacac7eac4b9529440b390970b142aeb5f7a6c614f3dc2dcf71a5b00d9124dd1f714d4644d648f47b5f70154e6032277f4abcc1956d766117ce1c45ba4f1fd7d3e6230c600270ca97f6be9d511aad1b71e909a32f825441774"], 0x3c}, 0x1, 0x0, 0x0, 0x24008000}, 0x814) r8 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NET_DM_CMD_STOP(r6, &(0x7f0000000e80)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000008c0)={&(0x7f0000000880)={0x14, 0x0, 0x300, 0x70bd25, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004014}, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r11, @ANYBLOB="0c000280060001"], 0x24}}, 0x0) r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000ec0)=ANY=[@ANYRESOCT=r7, @ANYRESOCT=r0, @ANYBLOB="010100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000300000005000000000020000000000000000000000000009ee330199e01fab7f2815291950d68581387e88335f73a0300"/67], 0x50) r14 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1b00000000000000000000000010000000000000", @ANYRES32, @ANYBLOB="0400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000040000000100"/28], 0x50) r15 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB="1b0000000000000000000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="0200000008000000000000000700000000000000de102cfa5fbf62ca6e8c6050730789f0473bff09729bc8f63a536889f8f4d64302e214110d718555091160a609122a95f6b2fd6ae5de53b3d0082affbf76537cd606f0f84029b0dd0f3962e78d1ee0e4017f1c7c7ddc00e46b658798cf69cd0aa3f6ea342149627742fec52f75bb5b255e54426104a5fe58303af29c9d2bab6da9cd74fccaed03ac3a1e875f06d108665a879754a433d1077b080000000000008fb2c1b495726faf0064830040741c8394541d2cfa0f573e461062a5b217b72756d554e0771aa0f082f2aac8b49eb338b11fc4f9cc973f9cb9d144714e8a31267dd1c656302f1d673fca7be4b3794f7038e4618056d435d53d0c7351cd9fd56996ec0740e92100f513cd67d496da9fa08bdeff1c980b38e5e8f73730ee037cfe4aa0ca9200"/324, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="05000000030000000300"/28, @ANYRES64=r12, @ANYBLOB="13fd102fefa6fd8016a250b37bdc3900b5be6bfe49de8f2128b5acd4139d34d43fc691dce56a595a3369b98c98c70c46d00f0ad4331ae43faecec62639dfa48b6b9f8f8b8ff2783545c69d93e2e1a628573b3e26766fdaeae52d0999aaa99869f46bddc4cceffa549092f37ee0493079ff6569e7468834cd24ec199c7cdfa1f949d67027a565ee7a67da3272f13924fd0669a8bbcfe1d27f74fee1d3f635758752d6bfad863770", @ANYRES8=r14, @ANYRESOCT=r2, @ANYRES8, @ANYRESDEC, @ANYRES8=r14, @ANYBLOB="0b389bd162620104a303a28666255524711a7d5578495ca05b4de48ca481f52d674ca35100aec72b509396bdb6f27d4a8fae19c3113893c5c710f383d2e7f31980deedce5efa1b65948fd125d6b3cd4227c032d58cc08f2d81dab2bb4412b27673274ac3343fd33914a35f31f6c59866ea86d028cb5b15a7b47f328849407373b28c19da0f4025fd734e1e5893c4b3477b42e1630417ba4ed4bf139f17e7c6fee1b2b766f1c6d7b4601fb2fa53911552049c06943e5f361c10f49794"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000009c0)={0x6, 0x3, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x1}}, &(0x7f0000000580)='syzkaller\x00', 0x7fff, 0xbf, &(0x7f0000000dc0)=""/191, 0x40f00, 0x3a, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000740)={0x5, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000900)=[r13, r14, r15], &(0x7f0000000940)=[{0x4, 0x3, 0xc, 0x2}, {0x3, 0x2, 0x3, 0xc}, {0x5, 0x4, 0xc, 0x3}, {0x5, 0x7, 0xe, 0x4}, {0x3, 0x5, 0xc, 0xb}, {0x0, 0x4, 0xf, 0x8}], 0x10, 0x5}, 0x94) sendmsg$NLBL_UNLABEL_C_ACCEPT(r6, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, r8, 0x11, 0x70bd29, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x38}}, @NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000080}, 0x20044084) 745.650574ms ago: executing program 0 (id=18118): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xffffffffffff0500, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r1, 0x80089419, &(0x7f0000000540)) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x44010}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x4, 0xa}, {}, {0xd, 0x2}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r8, {0xc, 0xc}, {0x0, 0xfff1}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4041080) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c801}, 0x4048094) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x19, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {{0x18, 0x1, 0x1, 0x0, r9}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r10, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x2642, 0x0) socket(0x400000000010, 0x3, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 649.21817ms ago: executing program 1 (id=18119): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0x0, 0x1}, 0x6) write(r0, &(0x7f0000000000)="f1000000", 0x4) 475.350659ms ago: executing program 1 (id=18120): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000060a0b04000000000000000002000000140004801000018009000f006d617371000000000900010473797a30000000000900020073797a320000000014000000110001000000000000000000f500000ae21ae8d7f3f4d9cc35656397e11088685c8cfe108cf83b5011f169e9b0cc532db25828ee048e0e684ce36997858c4d75dee52f9974ed382afe50c715f15bef6bc0be933a8d1ea2967ee95c212af597612b97176c26f0f4f5d804cb82baca94e3a90812e13f16f6b4c3026cf4579258ec147a09edca7b98ee3abcd5080c91da951a018059ec819ae5908d5dacd49aebb82d2e0e9c8e1875b43ebe8f6e24"], 0x68}}, 0x0) r1 = socket$caif_stream(0x25, 0x1, 0x3) recvmsg(r1, &(0x7f0000001500)={0x0, 0x0, 0x0}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000098"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0xe, 0x0, &(0x7f0000000300)="14fd54ab72df97e6256c00000000", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$kcm(0x2, 0x3, 0x84) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)={0x48, r7, 0x1, 0x0, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @device_b, @broadcast}, @ext_ch_sw={0x4, 0x4, {{}, @val={0x76, 0x6, {0x4, 0x5, 0x1f, 0x3}}}}}}]}, 0x48}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_STATION(r5, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x40140000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)={0x5c, r7, 0x100, 0x70bd2c, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x5, 0x74}}}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x1b, 0x13, [{0x24}, {0x1b, 0x1}, {0x1b}, {0x16}, {0xc}, {0x1b, 0x1}, {0x6c, 0x1}, {0x1, 0x1}, {0x5}, {0xb}, {0x1}, {0x9, 0x1}, {0x60, 0x1}, {0x41}, {0xb, 0x1}, {0x2, 0x1}, {0x1b, 0x1}, {0x5, 0x1}, {0x24}, {0xc, 0x1}, {0x48, 0x1}, {0x12}, {0xb, 0x1}]}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}, @NL80211_ATTR_STA_FLAGS={0x10, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_MFP={0x4}, @NL80211_STA_FLAG_AUTHENTICATED={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}]}]}, 0x5c}}, 0x4) sendmsg$inet(r4, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001880)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ceb4a06ff270ff8c9f0d3a19133f1fdfd51b767b8cef1f36e5490c5df5fcb378a6fb6eb5d8aaf7791ce81f61a05e1ebdd1789eb70ac1f3dfed378f6f3e237120052113a75ab977796117f7e7b2d6ee499f51dc070c820d10a0eaef4fc94ddc648bafae070caf70c465267497b3de963df649e113e2060c82b057abfae0798d424c81aeb42796189eb0936a2c547a5c4d6351ed786c75beb926118fb7af49ecc00b545fe2563bd4294a982980afed3f9cf390f304611db4c6d7b64d64f38db5fde5cf7cadb29c697013b710e0218660671d0051ddd7fb7f5eb72a34f469b2e20600000091817eb5b952af43d1a40f4770e7220fcdfe25d3e9747e2af76ece5922724840afdba6f6f9e1d11db8561e8e836413ee04d6e084700ec1ac0e00569f0e4d4844f4710299aabbef615c33e276544669ce074528938ec0cc6d2af1ce7a47a64ad676f08507aa08d4210f979ef4aacfa4d524c9952d4743d65c3c527302942a8880116ce7ebc6c84778346f02c806bb466db7d313d7ebc7ea87823d4a8de0b697929fb3277012327827801f75ca3c5776d1a81acb160007f73148dfaf05ab7eed5a0e603ac468eb2bcd9de5f140758e74c20a9931187e0cbc857aa62a4cec8a62f7e31af3a78cdb8608551cdd68e83aebb3c9e05519184ff996c336553fa6bf16865cd6c4eacf1e360b029cdae41070f569a15bfd30f671c0a2fd183ea0eaae427505d56994ccfd0737aae3abbc45f56710d2e3f2662bf4514044f7fa03cde28fa1783970d3c676cb23cb1923a9feb233267ef663936ccf25f7597a2270724527bf468d22786d0548b25582180b72c51742c4e5c373a1008dd4cfba508e8f3f8ec35e6f1375a11b1fbe2dc09e9fe609e80112c8f5c895c922cd547def707b7252d7afa0030d008b1dd10fd4a56e30237a6e0229fb4562cb8df3d4e64b28e15c075e59554e9d61a6065d49c1e765a49195cf5d6b1e2b6192447817fedfe41fcdf9a4fc5af567906e4b6453da7b97eac255cc253d7bceba09f67da4815438583c6843366b76d9e9277558e48681e9cfa920b47aea0e5c46ef86ea7f1ef534cf7565b24b833ba2cbfe60e6271614850dd68f2a8a6be4f315b83abb8e2699ed8e2a4b3506f9dacbb180c4deeef7489f49faf34cdf4e91a402956564f854d71c892e4aada1c91647ce45d4834d000e8d5be1773ecae388e511228977a69d4cc67fbab60ee1555a219e41eebc31807a87d9cbe88a8b05959e1a988f6ea6ed73a6ac1ec2f3d74d73eaa91a39308e008b7fa1ecc2a020d950a777c0d8d131416ef55a4ec041113df65ba4aea92fcb3e2268510f316bd17f04993b6473338fe7c08fd9874e743a31582162232c7d6c614e7b3513abcc0feb99b2c9111300004fe291f5bd682c039183e61c1fdac90b2a015939a8d10b07a05e99e5772b4b9329275cef8de2b066d4e4d421e4a0a69cdd8f674b12f5b3fa764e4b1e9f4d767e252e37577813a03f18da16d598fddcf4be590d9f65f64c647cb2f330a614fe688d3d80182ed8aa59905a1cb0d3f034d927e070d71f56ee8e5c5bdf23c4f85c7a17834467bd6cf58218868fe53e3675c130bbe44bea271fa67999a0dc3dbf7c40dbba6e7d6cc0936bd8d466a1f041883c093a3a60743d0549b1a989a2fa41ff978388014434909053e279a21e7866bd4efb4a9f46b7a8b0d1d84d83020e9e68936ca3de030269784aa29a3e25146cd5b03d21ca82f961be925c9ad487fb24b1e35c2d043ee4b6a4aaf811c4308a6ced6b4c45e7513a3f0e1421cb3b0fd8571a7085c9a4b454e4ee8b44767428666cd108b78369b871ab32f36943e24976f4bb6bd4068cc19585a2de791e3f950d220b28f4ba268d8c9dbccc1a705b1b1c30881babdbc8cc4cf97b801e4d410fd7c61b34b1f1265b9d114c99fb469914a213bb289c5bdf5af3835d089a230000000000000000000035c2674a2f57f411042857a0bf9bedcb5b986a94a11ae1f7241aedaa972e2d6c4b449d1e56b317ecb06246a661209a06252e1dc0d1dba130f52d", 0x61a}, {&(0x7f0000000340)="3001fb90647586f4e01659c5ad2644b99bfd65452e947b394c96c29278d097c5f170d77283a744139d2ce2a2f4bb5bb37e7396e7bac14056f25d17145e73bc2461b20ea3fce771f1b32d15fcc51fd5d43e305f06ab85e8a456763cfafcf7189145a6e261af6232014cbf8a0f898bf6d14136874b6a1fd7caf8ec9966b0419be0420dc6e247d1a402008ae29eb4bc67d6a04e80dfb7715ebafaa20fcbc57ade23cba05da1fbe4bba675b742472eebaabf356adc99866930e146125a272cef5baf5dfad4a28a01208d9908183ab208dc821e531f1bed4ac9c245ec19be383047656a7d857d364e6f69eccea5aca3964fa62884388d0f2997f3b71d995421bc41ab123251dd69fdc069efa6acdf16a72bb29e6126dffb023cc71c26daf8800b0a3193e14e1e33ea313400f41b77e67f088f889c45ba456ca2ed3649c07ca78b2b0ce03e1b432f7a593c4178cdaf78ac04b507b7f3680400000000008bba5dcf5b3cdc613060bfc27bc9fcacb08db695", 0x16e}, {&(0x7f0000001640)="79dfe4263f037de282e588f3c773eca5f0c383e7425d1573aa90a44223bfeced3ff85afe9d0c0b3b5a7ed7fcdb96a3934fe7af73ee25d5d36ba42e2a858c3d134299abc0393e031db435b2156e55eb2b2b2e0300e0706dfc5c4ec73ba929ffe8a7bb7ce55d95fb6e58560c45d96a58a13aa944b98c481a82927ec071b272b4592616116116527fd2dbc0dfd540810275770aa531098c572f714f6852063afc8358fb33cc7ef5c52565d586cfe6805bb8a95460b32b4e26bea604e534d8983790b5e2a180fed88108b0f5a499d5f80b4e4047d9ecc03d21856a4ec0d0d41496d99dddfa9098d327d9559e82fceb2b1b1c7be309200691488d6616780cd4e9020865ef41a22175dc52d35dac1232ae1164d7fee64a50651978436207fca4a9026a8a903e7857324459b7e8a143e6fdac0823c8d1a3ac864ad2d0402344aee2511247e716436fe118e65455da74ef25627785638dfa4bf365840fe12fbf73f0d42bcc66efc8693855156f6151e49471e1b7cccbfb01344f76cca177551c73147c32615b53f74a0b7c7ac25b86a01ce3b8b4234258ec5860e07407c4c9413c0c9293497b32d68a0b0df620daa978ef2aca173099321c5c9b009a52cbe3c443239b172229c320cb7b33872ba55850a8b46e794bbdbc94c782b3ac237ba67030e1e7658ea620ab3de23c08ba480a5f550830b6778466f124f0d732b0ddd0762102aa852c76cf34877a8acd1ba150f9013ad3a58a7646a9f6d811f9", 0x218}, {&(0x7f0000000cc0)="f2a0f0f863621b483b19e7ecfce0d34e53fbf295927214684f4d69e90f0ec506442d2126c3f5ab0cdfd79dc1815274c3ee57068b3793c25fab48eb353478689f452328afb023f75f93229060bc2c82dd05d1e8c3a549a06e280ca4eaf77b4aed57a0c5f6120d25a3d5121895638ec5e2e600000000f5be12a64e075c60dd63e0b00e8f42bfb7671a56925477029cec7e7f16b358404edfb5e7a055fdeb2ba044d0d54e341d1d1ef1eb2c317f587f591626ceed08555ca0b2f31a3e7bf5ba7541db275e6a6b6501b87cc74c4804f6da7d3de93327287204cc97f9cb747576d2ab23a6e35c6da6b3240c92ae18b31cb6e7bc60066994e2cb401c76b1840d3e231621355f10ff35ea91ffd463228d000000000000000e454d3c36efee949f6311c6ad78b5a8f091d2ebb008925107", 0x12d}], 0x4, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @loopback}}}], 0x20}, 0x4048000) 466.64934ms ago: executing program 0 (id=18121): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x655c, 0x4, 0x40, 0x7fffffff, 0x7fffffff, 0x80, 0xffffffff, 0x1}}}}]}, 0x58}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x4000001) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x78, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r2, {0xe}, {0x0, 0xfff9}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x48, 0x2, [@TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_VLAN_PRIO={0x5, 0x18, 0x3}, @TCA_FLOWER_KEY_IPV6_SRC_MASK={0x14, 0xf, [0xffffffff, 0xff000000, 0xffffffff, 0xff]}, @TCA_FLOWER_KEY_ETH_DST={0xa}, @TCA_FLOWER_KEY_IPV6_SRC={0x14, 0xe, @mcast1}]}}]}, 0x78}}, 0x4000) socket$inet6(0xa, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r7, &(0x7f0000000400)=[{&(0x7f0000000100)="92", 0x1}], 0x1) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, 0x0, r10, 0x0, 0xf3a, 0x0) splice(r6, 0x0, r10, 0x0, 0x80, 0x6) write$bt_hci(r10, &(0x7f0000000440)=ANY=[@ANYBLOB="01240c038d2c6ff484a93db0dadf35b2b0604de1a11b264a4bdbb8087f20636d00219782534af7d2c67975184032d27a54560b8e7e3fb71301b606285f258bb47361b5384c6d47e516aeb8767f7207629df720d5cca0f776a825fb896c173515a3ebd15842821783388d581cb416d4eed791f9e5fc8ad03914cf3a1b1c8bcbb7772050ee4c7cbb200112756280b449e3d0c05438b181767631941a4c8d9c244146b86bece40503afedab0e34f56b"], 0x7) write(r8, 0x0, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0x7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x240000e1}, 0x4890) socket$packet(0x11, 0x3, 0x300) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r11, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r11, 0x29, 0x23, &(0x7f0000000180)={{{@in=@rand_addr=0x64010100, @in=@loopback, 0x0, 0xbf, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0xfffffffffffffffc, 0x0, 0x1}, {0x3, 0x0, 0x0, 0x2}}, {{@in=@local, 0x0, 0x32}, 0x0, @in=@broadcast, 0x0, 0x3, 0x1, 0x0, 0xf000000}}, 0xe8) listen(r11, 0x0) 352.416832ms ago: executing program 4 (id=18122): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) socket$pptp(0x18, 0x1, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000020000000000000000000095"], &(0x7f0000000340)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0xc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x406, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)="a0", 0x0, 0x6ae053d2c3e58519}, 0x50) 351.193875ms ago: executing program 3 (id=18123): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{&(0x7f0000000100)={0xa, 0x0, 0xfffff001, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x4}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xe0ff}}], 0x1, 0x0) 245.841455ms ago: executing program 2 (id=18124): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x5, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000001400000000000000850000009a0000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x7f, 0x0, 0x0) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r1, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r1, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @null}, 0x1c) socket(0x1d, 0x2, 0x6) r2 = socket$netlink(0x10, 0x3, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[], 0x4c}}, 0x0) connect$rose(r1, &(0x7f0000000480)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) 207.712517ms ago: executing program 1 (id=18125): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@local, 0x800, 0x0, 0x2, 0x1, 0x3}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000001c0)={@loopback, 0x800, 0x1, 0x0, 0xffa4}, 0x20) 141.035513ms ago: executing program 4 (id=18126): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe04}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0xb6fb585}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xe1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r2, 0x2) sendto$inet6(r2, &(0x7f0000000040)="aaae8a0b3dc5e528eec2d3aa92153f45925b3df445b254bdf3555d22d00189768d91d86d33eca82ed7e4091a991a14a698852d3b6adae46fb5f250f45d465e7a3e363b5c3c957d87faf604a41e7810471169473ae187b728ca9d05f5cbac3cda5052ba2b4b28fb11975e0153654e7cb914504222bad24a3fa9901eb2e49adcbab690837057e993e5dcb633e7c080a3667fcfe0f3b04640be275d6fc65bf9327a8030f46cbd8353bd7c04fb3c10c0c4268f9c20ee3c33", 0xb6, 0x20008044, &(0x7f0000000100)={0xa, 0x4e22, 0xcb7d, @dev={0xfe, 0x80, '\x00', 0xe}, 0x2}, 0x1c) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'sit0\x00'}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r4, 0x27, 0x22, 0x0, &(0x7f0000000440)="f8ad48cc02cb29dcc8007f5b08009f59d351f20c83a50ee033cf5f0759cfc67cb3a4", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)={0x1f0, 0x1c, 0x1, 0xfffffffe, 0x25dfdbfc, "", [@nested={0x1df, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @nested={0xef, 0x125, 0x0, 0x1, [@generic="76397a7b2f1a62129b83c0fc327816eb9b8b7e028ff613e759b42c0e62d1937258c4503b4712c54a864c39463a63f4c306118b42b8de730c804d1b5535df06a936d1ee09a547e04c55ca0440aa5e94f2e4157aa9485cdfb8a9ee02f8ede687", @generic="8bcd6ee9b66f86b3cf63a5abdc3747767dafe7b03f27faff26206565b222839d8a0a670a48ab00b263df8310790ed17c896e9829a8927cd257111747a09eb4412e8e06656ae7cc3aab2e5d424f1ceb69f32f71263a28889e99a129d01564cc57da9a5a54b68273df545580a0ba67fe8d075c56a9fd1f1dd4bc9bc91333d0384fe80e0bb193fdc2372fef7846"]}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x1f0}], 0x1, 0x0, 0x0, 0x1}, 0x0) 140.479224ms ago: executing program 3 (id=18127): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000030000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f01000000010000006e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b98d2de10c21d3ea02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d000000200008000000000000001abc11c800000000000000000000000928ee53595a779d243a48cea769470424d20a04c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e495f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e4a48dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde05c10809c9edfa6d77c652fd742e6dad13d2a397bebe3ea8bc087d3720e2202f36c7719ae34f042e19dc08a3323a3d94098a7ec171469352bab1662c3e4d4803c565cfcce32dad628fade43a4844abb230ce608726fd87e93c405a96cf638c41510f26e9da5f316"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c00)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_bpf={{0x8}, {0x14, 0x2, [@TCA_BPF_FD={0x8, 0x6, r2}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket(0xf, 0x6, 0xfffffffe) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f00000000c0), r6) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="7000000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="0002000080820000400012800b00010069703667726500003000028008000c000001000008000c000800000008001d000d0000000400120006000e0001000000060010004e21000008000300"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x8000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) socket$key(0xf, 0x3, 0x2) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r9, 0x891c, &(0x7f0000000000)={'batadv_slave_1\x00', {0x2, 0x0, @empty=0xfe000000}}) sendmsg$nl_route(r8, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB=')\x00'/11], 0x14}}, 0x20048098) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x5c, 0x0, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x5c}}, 0xa0) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000004000000b5"], 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x4, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r10, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r11, 0x0, 0xf, 0x0, &(0x7f0000000180)="c1dfb080cd21d308098ee68886dd96", 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010030"], 0x0, 0x30, 0x0, 0x1}, 0x28) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c0000001a00010029bd70490000000002202000000000000020000008001e80"], 0x2c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x70}}, 0x0) 47.738862ms ago: executing program 0 (id=18128): r0 = socket(0x2d, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000740)=[{{&(0x7f00000000c0)={0xa, 0x4e20, 0xa6, @loopback, 0xf}, 0x1c, &(0x7f0000000dc0)=[{&(0x7f0000000180)="a6", 0x1}], 0x1}}], 0x1, 0x20000000) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f00000003c0)=@assoc_value, &(0x7f0000000400)=0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) r3 = socket(0xa, 0x3, 0x87) sendto(r3, 0x0, 0x0, 0x804, &(0x7f0000000600)=@nfc_llcp={0x27, 0x0, 0x1, 0x3, 0x3, 0x8, "cfc0ab0aaeac581acddcb2d59e438cd85622f4a1c937d255847c9dd07afbd2b83473109cb1d3955153168f1634a2a0657cbb6a86218b504e29c6137a6085df", 0x6}, 0x80) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r4, 0x110, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x4a, 0x0, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb7, 0x8, 0xffffffffffffffb9, &(0x7f0000000080)}}, 0x10) r5 = accept$alg(r2, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000001380)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000740)="17", 0x1}], 0x1, 0x0, 0x0, 0x11}], 0x1, 0xc48d4) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r6, 0x0) recvmmsg(r6, 0x0, 0x0, 0x10002, 0x0) readv(r5, &(0x7f00000000c0)=[{&(0x7f0000001780)=""/4096, 0x1000}], 0x1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) 0s ago: executing program 1 (id=18129): r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000100)={'gre0\x00', 0x0, 0x7800, 0x7800, 0x9, 0x585e, {{0x5, 0x4, 0x3, 0x0, 0x14, 0x67, 0x0, 0x4, 0x17, 0x0, @rand_addr=0x64010101, @private=0xa010101}}}}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_dump={0x40, 0xffffffff, 0x10000, 0x91, "65716d51d806af40405eddd0deabe7c3440ff018c1b2ee8a42cb2f81262613a351d2850743cbc82363196797d3facb9015188bd923bbcb93f97fdba7fb803df29fa5979251695e13071959541c1f6c67c71a486e9d62672b78c7dfdcc8678f9bada5aad8c6bf9a9c2dbfdc442fcbe3abd753bfc2250f1f591856aa492605a299d28a46b149aa67aad2a920427e1052ee5b"}}) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8) (async) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="aa8e0cf56164be5b", 0x8) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket(0x400000000010, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r5, 0x40305828, &(0x7f0000000300)={0x0, 0x2, 0x4}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x2c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {0xfffd}, {0x7, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x3, 0x8}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x0, 0x5, 0x1, 0x0, 0xfffffffffffffffd}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @range={{}, @void}}, {0x10, 0x1, 0x0, 0x1, @dup={{0x8}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xdc}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00U\x00=\t\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00', @ANYRES32=r10, @ANYBLOB="20000280", @ANYRES32=r9, @ANYBLOB="0000000000000000000000000a000000000000000000001420000100", @ANYRES32=r10], 0x58}}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r3, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x81}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x400) (async) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x60, r3, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x24, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x81}]}, 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x400) kernel console output (not intermixed with test programs): 0854][T25268] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1798.320871][T25268] RSP: 002b:00007fbba330bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1798.320894][T25268] RAX: ffffffffffffffda RBX: 00007fbba330c6c0 RCX: 00007fbba235c84e [ 1798.320908][T25268] RDX: 0000000000000001 RSI: 00007fbba330c0a0 RDI: 0000000000000009 [ 1798.320921][T25268] RBP: 00007fbba330c090 R08: 0000000000000000 R09: 0000000000000000 [ 1798.320932][T25268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1798.320944][T25268] R13: 00007fbba2616038 R14: 00007fbba2615fa0 R15: 00007ffc125b5358 [ 1798.320978][T25268] [ 1798.724015][T25277] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1798.766489][T25277] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1799.020203][T25295] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16886'. [ 1799.043070][T25299] netlink: 60 bytes leftover after parsing attributes in process `syz.4.16887'. [ 1799.120512][T25277] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1799.131952][T25277] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1799.334400][T25277] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1799.386076][T25277] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1799.423942][T25310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16891'. [ 1799.476130][T25313] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16891'. [ 1799.545244][T25316] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1799.638482][T25310] team0: entered promiscuous mode [ 1799.653933][T25310] team0: entered allmulticast mode [ 1799.668378][T25310] 8021q: adding VLAN 0 to HW filter on device team0 [ 1799.718916][T25321] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16893'. [ 1799.745611][T25321] netlink: 16 bytes leftover after parsing attributes in process `syz.4.16893'. [ 1799.807049][T25313] team1: entered promiscuous mode [ 1799.812326][T25313] team1: entered allmulticast mode [ 1799.818316][T25313] 8021q: adding VLAN 0 to HW filter on device team1 [ 1799.876154][T25277] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1799.894016][T25277] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1800.025154][T25327] netlink: 'syz.4.16895': attribute type 13 has an invalid length. [ 1800.080703][T13579] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1800.091441][T13579] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1800.167981][ T74] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1800.176249][ T74] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1800.219403][ T74] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1800.228583][ T74] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1800.266536][ T74] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1800.296833][ T74] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1800.362421][T25345] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16902'. [ 1800.416585][T25347] netlink: 'syz.1.16903': attribute type 13 has an invalid length. [ 1800.569190][T25351] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16905'. [ 1800.586604][T25351] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16905'. [ 1800.643797][T25361] tipc: Enabled bearer , priority 0 [ 1800.665658][T25361] syzkaller0: entered promiscuous mode [ 1800.671456][T25361] syzkaller0: entered allmulticast mode [ 1800.705548][T25361] syzkaller0: mtu less than device minimum [ 1800.717323][T25360] tipc: Resetting bearer [ 1800.763961][T25360] tipc: Disabling bearer [ 1801.020893][T25381] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16916'. [ 1801.069325][ T5835] block nbd4: Receive control failed (result -1) [ 1801.229527][T25391] x_tables: duplicate underflow at hook 2 [ 1801.552477][T25403] netlink: 'syz.0.16925': attribute type 15 has an invalid length. [ 1801.653373][ T30] audit: type=1107 audit(1770773640.704:60): pid=25408 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1801.668630][T25407] sch_tbf: burst 19 is lower than device syzkaller0 mtu (1514) ! [ 1801.817039][T25412] tipc: Enabled bearer , priority 0 [ 1801.862505][T25411] tipc: Disabling bearer [ 1802.499069][T25434] team0: entered promiscuous mode [ 1802.506142][T25434] team0: entered allmulticast mode [ 1802.518412][T25434] 8021q: adding VLAN 0 to HW filter on device team0 [ 1802.557492][ T30] audit: type=1107 audit(1770773641.614:61): pid=25439 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1802.607349][T25436] team1: entered promiscuous mode [ 1802.612455][T25436] team1: entered allmulticast mode [ 1802.637040][T25436] 8021q: adding VLAN 0 to HW filter on device team1 [ 1803.435261][T25462] lo: Caught tx_queue_len zero misconfig [ 1803.450752][T25462] netlink: 'syz.4.16945': attribute type 6 has an invalid length. [ 1803.750544][ T30] audit: type=1107 audit(1770773642.794:62): pid=25474 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1803.941969][T25485] lo speed is unknown, defaulting to 1000 [ 1803.954593][T25485] lo speed is unknown, defaulting to 1000 [ 1804.012652][T25488] netlink: 'syz.1.16958': attribute type 1 has an invalid length. [ 1804.152826][T25501] __nla_validate_parse: 16 callbacks suppressed [ 1804.152847][T25501] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16958'. [ 1804.178694][T25502] netlink: 76 bytes leftover after parsing attributes in process `syz.4.16959'. [ 1804.190127][T25502] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16959'. [ 1804.199319][T25502] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16959'. [ 1804.206701][T25501] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16958'. [ 1804.729705][T25512] netlink: 'syz.2.16963': attribute type 4 has an invalid length. [ 1804.889523][ T30] audit: type=1107 audit(1770773643.944:63): pid=25517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1805.074496][T25525] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16968'. [ 1805.398840][T25537] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1805.409124][T25537] team0: Device macvlan3 is already an upper device of the team interface [ 1805.715483][T25553] netlink: 'syz.0.16978': attribute type 6 has an invalid length. [ 1805.931849][T25565] netlink: 76 bytes leftover after parsing attributes in process `syz.4.16979'. [ 1805.957771][T25565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16979'. [ 1805.977743][T25565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16979'. [ 1806.144406][T25569] tipc: Enabled bearer , priority 0 [ 1806.166235][T25569] syzkaller0: entered promiscuous mode [ 1806.210022][T25569] syzkaller0: entered allmulticast mode [ 1806.245351][T25569] syzkaller0: mtu less than device minimum [ 1806.253796][T25568] tipc: Resetting bearer [ 1806.290035][T25568] tipc: Disabling bearer [ 1806.545866][T25586] netlink: 44 bytes leftover after parsing attributes in process `syz.0.16984'. [ 1806.779628][T25595] dvmrp12: entered allmulticast mode [ 1806.815038][T25599] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1806.853798][T25593] dvmrp12: left allmulticast mode [ 1806.944127][T25599] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1807.079351][T25599] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1807.829430][T25599] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1807.998540][ T1339] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1808.073582][ T74] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1808.135568][ T74] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1808.164465][ T74] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1808.449597][T25662] netlink: 'syz.4.17012': attribute type 15 has an invalid length. [ 1808.641474][ T1339] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1808.654462][T25671] netlink: 'syz.2.17016': attribute type 10 has an invalid length. [ 1808.660522][ T1339] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1808.683556][T25671] A link change request failed with some changes committed already. Interface vlan1 may have been left with an inconsistent configuration, please check. [ 1808.735761][ T1339] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1808.771281][T25673] tipc: Enabled bearer , priority 0 [ 1808.779525][T25673] syzkaller0: entered promiscuous mode [ 1808.785127][T25673] syzkaller0: entered allmulticast mode [ 1808.805594][ T1339] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1809.027502][T25663] tipc: Resetting bearer [ 1809.120311][T25663] tipc: Disabling bearer [ 1809.546793][T25686] netlink: 'syz.2.17019': attribute type 1 has an invalid length. [ 1809.675811][T25686] bond36: entered promiscuous mode [ 1809.706599][T25686] bond36: entered allmulticast mode [ 1809.732253][T25694] bond36: (slave ip6gretap10): making interface the new active one [ 1809.740919][T25694] ip6gretap10: entered promiscuous mode [ 1809.766558][T25694] ip6gretap10: entered allmulticast mode [ 1809.783948][T25694] bond36: (slave ip6gretap10): Enslaving as an active interface with an up link [ 1809.963694][T25703] __nla_validate_parse: 13 callbacks suppressed [ 1809.963716][T25703] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17024'. [ 1810.012955][T25710] netlink: 'syz.2.17026': attribute type 1 has an invalid length. [ 1810.023472][T25711] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17024'. [ 1810.081034][T25710] bond37: entered promiscuous mode [ 1810.086253][T25710] bond37: entered allmulticast mode [ 1810.111498][T25715] bond37: (slave ip6gretap11): making interface the new active one [ 1810.119605][T25715] ip6gretap11: entered promiscuous mode [ 1810.125456][T25715] ip6gretap11: entered allmulticast mode [ 1810.132587][T25715] bond37: (slave ip6gretap11): Enslaving as an active interface with an up link [ 1810.209233][T25719] netlink: 'syz.1.17031': attribute type 4 has an invalid length. [ 1810.290293][T25727] FAULT_INJECTION: forcing a failure. [ 1810.290293][T25727] name failslab, interval 1, probability 0, space 0, times 0 [ 1810.316825][T25727] CPU: 0 UID: 0 PID: 25727 Comm: syz.1.17033 Not tainted syzkaller #0 PREEMPT(full) [ 1810.316856][T25727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1810.316869][T25727] Call Trace: [ 1810.316877][T25727] [ 1810.316887][T25727] dump_stack_lvl+0xe8/0x150 [ 1810.316919][T25727] should_fail_ex+0x412/0x560 [ 1810.316951][T25727] should_failslab+0xa8/0x100 [ 1810.316978][T25727] __kmalloc_noprof+0xde/0x7e0 [ 1810.316998][T25727] ? kfree+0x4d/0x650 [ 1810.317022][T25727] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1810.317057][T25727] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1810.317086][T25727] ? tomoyo_domain+0xd7/0x130 [ 1810.317118][T25727] ? tomoyo_path_number_perm+0x219/0x630 [ 1810.317142][T25727] tomoyo_path_number_perm+0x246/0x630 [ 1810.317169][T25727] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1810.317190][T25727] ? __lock_acquire+0x6b5/0x2cf0 [ 1810.317237][T25727] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1810.317288][T25727] ? __fget_files+0x2a/0x420 [ 1810.317314][T25727] ? __fget_files+0x2a/0x420 [ 1810.317335][T25727] ? __fget_files+0x3a0/0x420 [ 1810.317365][T25727] ? __fget_files+0x2a/0x420 [ 1810.317391][T25727] security_file_ioctl+0xc3/0x2a0 [ 1810.317417][T25727] __se_sys_ioctl+0x47/0x170 [ 1810.317448][T25727] do_syscall_64+0xe2/0xf80 [ 1810.317475][T25727] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.317495][T25727] ? trace_irq_disable+0x37/0x100 [ 1810.317514][T25727] ? clear_bhb_loop+0x60/0xb0 [ 1810.317535][T25727] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.317554][T25727] RIP: 0033:0x7f87cad9bf79 [ 1810.317572][T25727] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1810.317587][T25727] RSP: 002b:00007f87cbcf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1810.317607][T25727] RAX: ffffffffffffffda RBX: 00007f87cb015fa0 RCX: 00007f87cad9bf79 [ 1810.317622][T25727] RDX: 00002000000002c0 RSI: 000000000000890c RDI: 0000000000000003 [ 1810.317633][T25727] RBP: 00007f87cbcf0090 R08: 0000000000000000 R09: 0000000000000000 [ 1810.317645][T25727] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1810.317657][T25727] R13: 00007f87cb016038 R14: 00007f87cb015fa0 R15: 00007ffd6b4f3398 [ 1810.317691][T25727] [ 1810.317701][T25727] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1810.571206][T25737] netlink: 40 bytes leftover after parsing attributes in process `syz.4.17037'. [ 1810.596682][T25739] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17036'. [ 1810.625713][T25739] team2: entered promiscuous mode [ 1810.662767][T25741] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17036'. [ 1810.666371][T25739] team2: entered allmulticast mode [ 1810.688992][T25745] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17034'. [ 1810.719703][T25739] 8021q: adding VLAN 0 to HW filter on device team2 [ 1810.801307][T25741] team3: entered promiscuous mode [ 1810.822062][T25741] team3: entered allmulticast mode [ 1810.829902][T25741] 8021q: adding VLAN 0 to HW filter on device team3 [ 1810.833005][T25753] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17039'. [ 1810.894181][T25755] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17038'. [ 1810.908742][T25757] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17039'. [ 1810.945355][T25762] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17038'. [ 1811.061871][T25755] team1: entered promiscuous mode [ 1811.067214][T25755] team1: entered allmulticast mode [ 1811.073095][T25755] 8021q: adding VLAN 0 to HW filter on device team1 [ 1811.107931][T25762] team2: entered promiscuous mode [ 1811.113044][T25762] team2: entered allmulticast mode [ 1811.119585][T25762] 8021q: adding VLAN 0 to HW filter on device team2 [ 1811.536031][T25790] IPVS: set_ctl: invalid protocol: 60 0.0.0.0:20001 [ 1811.668385][T29383] lec:lec_start_xmit: lec0:No lecd attached [ 1811.790994][T25796] netlink: 'syz.3.17054': attribute type 15 has an invalid length. [ 1812.260180][T25818] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1812.268851][T25818] team0: Device macvlan3 is already an upper device of the team interface [ 1812.886105][T25845] 8021q: adding VLAN 0 to HW filter on device bond32 [ 1812.937484][T25845] bond32 (unregistering): Released all slaves [ 1813.260061][T25864] netlink: 'syz.1.17077': attribute type 15 has an invalid length. [ 1813.951896][T25893] xfrm0: Caught tx_queue_len zero misconfig [ 1814.377161][T25914] netlink: 'syz.2.17093': attribute type 1 has an invalid length. [ 1814.419646][T25914] bond38: entered promiscuous mode [ 1814.424961][T25914] bond38: entered allmulticast mode [ 1814.487716][T25916] bond38: (slave ip6gretap12): making interface the new active one [ 1814.519674][T25916] ip6gretap12: entered promiscuous mode [ 1814.525508][T25916] ip6gretap12: entered allmulticast mode [ 1814.557876][T25916] bond38: (slave ip6gretap12): Enslaving as an active interface with an up link [ 1814.678741][T25923] netlink: 'syz.4.17096': attribute type 1 has an invalid length. [ 1814.754018][T25923] bond19: (slave geneve4): making interface the new active one [ 1814.756209][T25936] netlink: 'syz.0.17099': attribute type 15 has an invalid length. [ 1814.762936][T25923] bond19: (slave geneve4): Enslaving as an active interface with an up link [ 1814.786724][ T12] netdevsim netdevsim4 eth0: set [1, 2] type 2 family 0 port 20004 - 0 [ 1814.796592][ T3546] netdevsim netdevsim4 eth1: set [1, 2] type 2 family 0 port 20004 - 0 [ 1814.814742][ T3546] netdevsim netdevsim4 eth2: set [1, 2] type 2 family 0 port 20004 - 0 [ 1814.837048][ T3546] netdevsim netdevsim4 eth3: set [1, 2] type 2 family 0 port 20004 - 0 [ 1815.008553][T25949] __nla_validate_parse: 23 callbacks suppressed [ 1815.008575][T25949] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17106'. [ 1815.032110][T25944] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17103'. [ 1815.061593][T25954] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17106'. [ 1815.224585][T25960] netlink: 32 bytes leftover after parsing attributes in process `syz.4.17108'. [ 1815.273088][T25963] delete_channel: no stack [ 1815.373782][T25969] IPVS: Error connecting to the multicast addr [ 1815.431558][T25971] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17112'. [ 1815.471586][T25971] team2: entered promiscuous mode [ 1815.484853][T25976] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17112'. [ 1815.503538][T25971] team2: entered allmulticast mode [ 1815.527927][T25971] 8021q: adding VLAN 0 to HW filter on device team2 [ 1815.567954][ T30] audit: type=1107 audit(1770773654.624:64): pid=25978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1815.592560][T25971] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1815.628880][T25976] team3: entered promiscuous mode [ 1815.634089][T25976] team3: entered allmulticast mode [ 1815.640393][T25976] 8021q: adding VLAN 0 to HW filter on device team3 [ 1816.085201][T26000] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1816.171082][T26006] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17127'. [ 1816.224378][T26013] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17127'. [ 1816.228258][T26011] netlink: 'syz.4.17129': attribute type 15 has an invalid length. [ 1816.309316][T26015] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1816.383738][T26020] IPVS: set_ctl: invalid protocol: 60 0.0.0.0:20001 [ 1816.528660][T26006] team3: entered promiscuous mode [ 1816.533768][T26006] team3: entered allmulticast mode [ 1816.540033][T26006] 8021q: adding VLAN 0 to HW filter on device team3 [ 1816.553550][T13573] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1816.562254][T13573] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1816.599921][T26013] team4: entered promiscuous mode [ 1816.607433][T26013] team4: entered allmulticast mode [ 1816.613784][T26013] 8021q: adding VLAN 0 to HW filter on device team4 [ 1816.638203][T13573] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1816.666470][T13573] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1816.675236][T13573] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1816.684279][T13573] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1816.697627][T26024] FAULT_INJECTION: forcing a failure. [ 1816.697627][T26024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1816.726968][T26024] CPU: 1 UID: 0 PID: 26024 Comm: syz.2.17132 Not tainted syzkaller #0 PREEMPT(full) [ 1816.726993][T26024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1816.726991][T13573] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1816.727005][T26024] Call Trace: [ 1816.727014][T26024] [ 1816.727023][T26024] dump_stack_lvl+0xe8/0x150 [ 1816.727050][T26024] should_fail_ex+0x412/0x560 [ 1816.727075][T26024] _copy_to_user+0x31/0xb0 [ 1816.727104][T26024] simple_read_from_buffer+0xe1/0x170 [ 1816.727129][T26024] proc_fail_nth_read+0x1bb/0x230 [ 1816.727158][T26024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1816.727186][T26024] ? rw_verify_area+0x2a6/0x4d0 [ 1816.727210][T26024] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1816.727236][T26024] vfs_read+0x20c/0xa70 [ 1816.727258][T26024] ? fdget_pos+0x246/0x320 [ 1816.727282][T26024] ? __pfx___mutex_lock+0x10/0x10 [ 1816.727308][T26024] ? __pfx_vfs_read+0x10/0x10 [ 1816.727333][T26024] ? __fget_files+0x2a/0x420 [ 1816.727357][T26024] ? __fget_files+0x3a0/0x420 [ 1816.727375][T26024] ? __fget_files+0x2a/0x420 [ 1816.727404][T26024] ksys_read+0x150/0x270 [ 1816.727492][T26024] ? __pfx_ksys_read+0x10/0x10 [ 1816.727529][T26024] do_syscall_64+0xe2/0xf80 [ 1816.727552][T26024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1816.727569][T26024] ? trace_irq_disable+0x37/0x100 [ 1816.727587][T26024] ? clear_bhb_loop+0x60/0xb0 [ 1816.727609][T26024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1816.727626][T26024] RIP: 0033:0x7f5ec955c84e [ 1816.727643][T26024] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1816.727657][T26024] RSP: 002b:00007f5eca4ccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1816.727678][T26024] RAX: ffffffffffffffda RBX: 00007f5eca4cd6c0 RCX: 00007f5ec955c84e [ 1816.727691][T26024] RDX: 000000000000000f RSI: 00007f5eca4cd0a0 RDI: 0000000000000003 [ 1816.727702][T26024] RBP: 00007f5eca4cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1816.727714][T26024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1816.727725][T26024] R13: 00007f5ec9816038 R14: 00007f5ec9815fa0 R15: 00007fff22a8f678 [ 1816.727756][T26024] [ 1816.786406][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5120 ms [ 1816.786448][ C1] lec:lec_tx_timeout: lec0 [ 1816.817353][T13573] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1816.877022][T26029] netlink: 'syz.2.17134': attribute type 15 has an invalid length. [ 1817.088497][T26038] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17137'. [ 1817.126197][T26038] netlink: 39 bytes leftover after parsing attributes in process `syz.3.17137'. [ 1817.433576][T26057] FAULT_INJECTION: forcing a failure. [ 1817.433576][T26057] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1817.447798][T26057] CPU: 1 UID: 0 PID: 26057 Comm: syz.3.17143 Not tainted syzkaller #0 PREEMPT(full) [ 1817.447828][T26057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1817.447841][T26057] Call Trace: [ 1817.447849][T26057] [ 1817.447858][T26057] dump_stack_lvl+0xe8/0x150 [ 1817.447891][T26057] should_fail_ex+0x412/0x560 [ 1817.447920][T26057] _copy_from_user+0x2d/0xb0 [ 1817.447947][T26057] __sys_bpf+0x229/0x920 [ 1817.447972][T26057] ? __pfx___sys_bpf+0x10/0x10 [ 1817.448010][T26057] ? ksys_write+0x242/0x270 [ 1817.448042][T26057] ? __pfx_ksys_write+0x10/0x10 [ 1817.448104][T26057] __x64_sys_bpf+0x7c/0x90 [ 1817.448147][T26057] do_syscall_64+0xe2/0xf80 [ 1817.448175][T26057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1817.448196][T26057] ? trace_irq_disable+0x37/0x100 [ 1817.448216][T26057] ? clear_bhb_loop+0x60/0xb0 [ 1817.448241][T26057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1817.448262][T26057] RIP: 0033:0x7f4f2799bf79 [ 1817.448281][T26057] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1817.448299][T26057] RSP: 002b:00007f4f287b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1817.448322][T26057] RAX: ffffffffffffffda RBX: 00007f4f27c15fa0 RCX: 00007f4f2799bf79 [ 1817.448337][T26057] RDX: 0000000000000090 RSI: 0000200000000440 RDI: 0000000000000005 [ 1817.448350][T26057] RBP: 00007f4f287b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1817.448363][T26057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1817.448374][T26057] R13: 00007f4f27c16038 R14: 00007f4f27c15fa0 R15: 00007ffd9302f818 [ 1817.448408][T26057] [ 1817.675744][T26062] IPVS: set_ctl: invalid protocol: 60 0.0.0.0:20001 [ 1817.792695][T26066] team4: entered promiscuous mode [ 1817.800657][T26066] team4: entered allmulticast mode [ 1817.817192][T26066] 8021q: adding VLAN 0 to HW filter on device team4 [ 1817.853601][T26066] team5: entered promiscuous mode [ 1817.859276][T26066] team5: entered allmulticast mode [ 1817.865030][T26066] 8021q: adding VLAN 0 to HW filter on device team5 [ 1817.880990][T26066] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1817.955642][T26074] netlink: 'syz.2.17150': attribute type 4 has an invalid length. [ 1817.979367][T26074] syzkaller0: entered promiscuous mode [ 1817.997516][T26074] syzkaller0: entered allmulticast mode [ 1818.055395][T26074] tipc: Enabled bearer , priority 0 [ 1818.473014][T26070] tipc: Resetting bearer [ 1818.533453][T26070] tipc: Disabling bearer [ 1818.746037][T26101] IPVS: set_ctl: invalid protocol: 60 0.0.0.0:20001 [ 1819.026540][T26104] tipc: Enabled bearer , priority 0 [ 1819.067532][T26104] syzkaller0: entered promiscuous mode [ 1819.085475][T26104] syzkaller0: entered allmulticast mode [ 1819.168222][T26104] syzkaller0: mtu less than device minimum [ 1819.205516][T26103] tipc: Resetting bearer [ 1819.293190][T26103] tipc: Disabling bearer [ 1819.336084][T26109] openvswitch: netlink: Missing valid actions attribute. [ 1819.344924][T26109] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1819.757801][T26130] IPVS: set_ctl: invalid protocol: 60 0.0.0.0:20001 [ 1819.939014][T26136] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1820.070960][T26140] bond32: entered promiscuous mode [ 1820.641621][T26155] __nla_validate_parse: 17 callbacks suppressed [ 1820.641643][T26155] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17178'. [ 1820.726939][T26155] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17178'. [ 1820.803783][T26161] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17181'. [ 1820.813596][T26160] netlink: 72 bytes leftover after parsing attributes in process `syz.0.17180'. [ 1820.868426][T26167] netlink: 76 bytes leftover after parsing attributes in process `syz.0.17180'. [ 1820.878668][T26166] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17181'. [ 1820.910778][T26161] 8021q: adding VLAN 0 to HW filter on device bond33 [ 1820.939180][T26167] netlink: 72 bytes leftover after parsing attributes in process `syz.0.17180'. [ 1820.970847][T26166] bond33 (unregistering): Released all slaves [ 1821.207343][T26176] netlink: 'syz.1.17185': attribute type 15 has an invalid length. [ 1821.231234][T26177] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1821.454903][T26191] netlink: 72 bytes leftover after parsing attributes in process `syz.4.17188'. [ 1821.505767][T26184] netlink: 76 bytes leftover after parsing attributes in process `syz.4.17188'. [ 1821.536623][T26184] netlink: 72 bytes leftover after parsing attributes in process `syz.4.17188'. [ 1822.108567][T26223] netlink: 'syz.3.17200': attribute type 4 has an invalid length. [ 1822.297037][T26233] 8021q: VLANs not supported on gre0 [ 1822.485040][T26242] sch_tbf: burst 1 is lower than device syzkaller0 mtu (313) ! [ 1822.513708][T26242] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 1822.521569][T26242] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 1822.529893][T26242] tipc: Resetting bearer [ 1822.529939][T26244] sctp: [Deprecated]: syz.0.17208 (pid 26244) Use of int in max_burst socket option. [ 1822.529939][T26244] Use struct sctp_assoc_value instead [ 1822.779254][T26253] netlink: 'syz.2.17212': attribute type 15 has an invalid length. [ 1823.404879][T26286] No such timeout policy "syz1" [ 1823.618934][ T30] audit: type=1107 audit(1770773662.674:65): pid=26296 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1823.625706][T26302] bridge0: port 1(ip6gretap0) entered blocking state [ 1823.651543][T26302] bridge0: port 1(ip6gretap0) entered disabled state [ 1823.663312][T26302] ip6gretap0: entered allmulticast mode [ 1823.672252][T26302] ip6gretap0: left allmulticast mode [ 1824.687613][T26338] netlink: 'syz.0.17239': attribute type 15 has an invalid length. [ 1824.889119][T26349] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1824.915621][T26351] can: request_module (can-proto-3) failed. [ 1825.001954][T26359] netlink: 'syz.1.17246': attribute type 13 has an invalid length. [ 1825.106492][ T6624] IPVS: ip_vs_send_async error -101 [ 1825.396130][ T3546] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1825.412662][T26380] ip6gre2: entered allmulticast mode [ 1825.438481][ T3546] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1825.447778][ T3546] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1825.456187][ T3546] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1825.745266][T26390] lo speed is unknown, defaulting to 1000 [ 1825.752314][T26390] lo speed is unknown, defaulting to 1000 [ 1826.143434][T26406] __nla_validate_parse: 30 callbacks suppressed [ 1826.143458][T26406] netlink: 16 bytes leftover after parsing attributes in process `syz.1.17263'. [ 1826.161774][T26406] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17263'. [ 1826.187664][T26406] netlink: 16 bytes leftover after parsing attributes in process `syz.1.17263'. [ 1826.462137][T26416] syzkaller0: entered promiscuous mode [ 1826.468029][T26416] syzkaller0: entered allmulticast mode [ 1827.423218][T26454] SET target dimension over the limit! [ 1827.441847][T26454] sctp: [Deprecated]: syz.3.17275 (pid 26454) Use of int in max_burst socket option. [ 1827.441847][T26454] Use struct sctp_assoc_value instead [ 1827.643488][T26454] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17275'. [ 1827.828387][T26454] bond28: option broadcast_neighbor: invalid value (30) [ 1827.898644][T26454] bond28 (unregistering): Released all slaves [ 1827.938552][T26466] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17278'. [ 1828.013501][T26467] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17278'. [ 1828.019870][T26466] team1: entered promiscuous mode [ 1828.046715][T26466] team1: entered allmulticast mode [ 1828.057088][T26466] 8021q: adding VLAN 0 to HW filter on device team1 [ 1828.157803][T26467] team2: entered promiscuous mode [ 1828.166686][T26467] team2: entered allmulticast mode [ 1828.187389][T26467] 8021q: adding VLAN 0 to HW filter on device team2 [ 1828.228244][T26470] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17279'. [ 1828.237600][T26470] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17279'. [ 1828.343627][T26479] xfrm0: entered promiscuous mode [ 1828.355692][T26455] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17276'. [ 1828.367577][T26479] xfrm0: entered allmulticast mode [ 1828.377821][T26455] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17276'. [ 1828.550283][T26490] netlink: 'syz.0.17286': attribute type 15 has an invalid length. [ 1828.892082][T26506] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1829.028620][ T36] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1829.038837][ T36] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1829.056448][ T36] netdevsim netdevsim4 eth0: unset [1, 2] type 2 family 0 port 20004 - 0 [ 1829.069963][ T36] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1829.079451][ T36] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1829.088935][ T36] netdevsim netdevsim4 eth1: unset [1, 2] type 2 family 0 port 20004 - 0 [ 1829.149917][ T36] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1829.166747][ T36] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1829.178775][ T36] netdevsim netdevsim4 eth2: unset [1, 2] type 2 family 0 port 20004 - 0 [ 1829.197438][ T36] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1829.222463][ T36] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1829.241608][ T36] netdevsim netdevsim4 eth3: unset [1, 2] type 2 family 0 port 20004 - 0 [ 1829.309369][T26511] team2: entered promiscuous mode [ 1829.314471][T26511] team2: entered allmulticast mode [ 1829.320951][T26511] 8021q: adding VLAN 0 to HW filter on device team2 [ 1829.357738][T26512] team3: entered promiscuous mode [ 1829.367686][T26512] team3: entered allmulticast mode [ 1829.385674][T26512] 8021q: adding VLAN 0 to HW filter on device team3 [ 1829.515374][T26521] gretap0: refused to change device tx_queue_len [ 1829.543103][T26521] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1829.671321][T26526] veth1_virt_wifi: Caught tx_queue_len zero misconfig [ 1829.683516][T26526] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 1829.800910][T26536] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1829.873355][T26540] netlink: 'syz.3.17304': attribute type 15 has an invalid length. [ 1830.054764][T26552] netlink: 'syz.0.17309': attribute type 4 has an invalid length. [ 1830.167798][T26556] FAULT_INJECTION: forcing a failure. [ 1830.167798][T26556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1830.183173][T26556] CPU: 1 UID: 0 PID: 26556 Comm: syz.1.17310 Not tainted syzkaller #0 PREEMPT(full) [ 1830.183204][T26556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1830.183217][T26556] Call Trace: [ 1830.183226][T26556] [ 1830.183236][T26556] dump_stack_lvl+0xe8/0x150 [ 1830.183269][T26556] should_fail_ex+0x412/0x560 [ 1830.183300][T26556] _copy_from_iter+0x1d3/0x1670 [ 1830.183341][T26556] ? __pfx__copy_from_iter+0x10/0x10 [ 1830.183366][T26556] ? sock_alloc_send_pskb+0x896/0x990 [ 1830.183403][T26556] ? __pfx__copy_from_iter+0x10/0x10 [ 1830.183433][T26556] ? page_copy_sane+0x16a/0x270 [ 1830.183462][T26556] copy_page_from_iter+0xdd/0x170 [ 1830.183495][T26556] skb_copy_datagram_from_iter+0x306/0x710 [ 1830.183539][T26556] tun_get_user+0xc38/0x3dd0 [ 1830.183577][T26556] ? aa_file_perm+0x12d/0x1630 [ 1830.183608][T26556] ? aa_file_perm+0x440/0x1630 [ 1830.183633][T26556] ? __pfx_tun_get_user+0x10/0x10 [ 1830.183659][T26556] ? __lock_acquire+0x6b5/0x2cf0 [ 1830.183690][T26556] ? kstrtoull+0x12f/0x1d0 [ 1830.183724][T26556] ? ref_tracker_alloc+0x363/0x4d0 [ 1830.183752][T26556] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1830.183780][T26556] ? tun_get+0x1c/0x2f0 [ 1830.183801][T26556] ? tun_get+0x1c/0x2f0 [ 1830.183829][T26556] ? tun_get+0x1c/0x2f0 [ 1830.183848][T26556] ? tun_get+0x1c/0x2f0 [ 1830.183873][T26556] tun_chr_write_iter+0x113/0x200 [ 1830.183897][T26556] vfs_write+0x61d/0xb90 [ 1830.183934][T26556] ? __pfx_vfs_write+0x10/0x10 [ 1830.183972][T26556] ? __fget_files+0x2a/0x420 [ 1830.184004][T26556] ksys_write+0x150/0x270 [ 1830.184035][T26556] ? __pfx_ksys_write+0x10/0x10 [ 1830.184076][T26556] do_syscall_64+0xe2/0xf80 [ 1830.184108][T26556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1830.184127][T26556] ? clear_bhb_loop+0x60/0xb0 [ 1830.184160][T26556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1830.184180][T26556] RIP: 0033:0x7f87cad9bf79 [ 1830.184199][T26556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1830.184218][T26556] RSP: 002b:00007f87cbcf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1830.184241][T26556] RAX: ffffffffffffffda RBX: 00007f87cb015fa0 RCX: 00007f87cad9bf79 [ 1830.184257][T26556] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000004 [ 1830.184271][T26556] RBP: 00007f87cbcf0090 R08: 0000000000000000 R09: 0000000000000000 [ 1830.184284][T26556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1830.184296][T26556] R13: 00007f87cb016038 R14: 00007f87cb015fa0 R15: 00007ffd6b4f3398 [ 1830.184331][T26556] [ 1830.881223][T26572] 8021q: VLANs not supported on gre0 [ 1831.011439][T26582] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1831.180976][T26592] bridge0: port 1(ip6gretap0) entered blocking state [ 1831.249714][T26592] bridge0: port 1(ip6gretap0) entered disabled state [ 1831.293925][T26592] ip6gretap0: entered allmulticast mode [ 1831.348772][T26592] ip6gretap0: entered promiscuous mode [ 1831.387819][T26592] macsec0: entered promiscuous mode [ 1831.528371][T26604] netlink: 'syz.0.17323': attribute type 15 has an invalid length. [ 1831.720206][T26607] __nla_validate_parse: 20 callbacks suppressed [ 1831.720229][T26607] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17324'. [ 1831.960589][T26611] FAULT_INJECTION: forcing a failure. [ 1831.960589][T26611] name failslab, interval 1, probability 0, space 0, times 0 [ 1831.973972][T26611] CPU: 0 UID: 0 PID: 26611 Comm: syz.2.17326 Not tainted syzkaller #0 PREEMPT(full) [ 1831.974001][T26611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1831.974014][T26611] Call Trace: [ 1831.974023][T26611] [ 1831.974031][T26611] dump_stack_lvl+0xe8/0x150 [ 1831.974075][T26611] should_fail_ex+0x412/0x560 [ 1831.974107][T26611] should_failslab+0xa8/0x100 [ 1831.974132][T26611] __kmalloc_noprof+0xde/0x7e0 [ 1831.974153][T26611] ? kfree+0x4d/0x650 [ 1831.974177][T26611] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1831.974210][T26611] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1831.974238][T26611] ? tomoyo_domain+0xd7/0x130 [ 1831.974272][T26611] ? tomoyo_path_number_perm+0x219/0x630 [ 1831.974294][T26611] tomoyo_path_number_perm+0x246/0x630 [ 1831.974319][T26611] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1831.974340][T26611] ? __lock_acquire+0x6b5/0x2cf0 [ 1831.974385][T26611] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1831.974438][T26611] ? __fget_files+0x2a/0x420 [ 1831.974465][T26611] ? __fget_files+0x2a/0x420 [ 1831.974485][T26611] ? __fget_files+0x3a0/0x420 [ 1831.974506][T26611] ? __fget_files+0x2a/0x420 [ 1831.974532][T26611] security_file_ioctl+0xc3/0x2a0 [ 1831.974557][T26611] __se_sys_ioctl+0x47/0x170 [ 1831.974588][T26611] do_syscall_64+0xe2/0xf80 [ 1831.974616][T26611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1831.974635][T26611] ? trace_irq_disable+0x37/0x100 [ 1831.974653][T26611] ? clear_bhb_loop+0x60/0xb0 [ 1831.974678][T26611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1831.974697][T26611] RIP: 0033:0x7f5ec959bf79 [ 1831.974717][T26611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1831.974733][T26611] RSP: 002b:00007f5eca4cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1831.974755][T26611] RAX: ffffffffffffffda RBX: 00007f5ec9815fa0 RCX: 00007f5ec959bf79 [ 1831.974775][T26611] RDX: 0000200000000180 RSI: 0000000000008993 RDI: 0000000000000005 [ 1831.974787][T26611] RBP: 00007f5eca4cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1831.974800][T26611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1831.974812][T26611] R13: 00007f5ec9816038 R14: 00007f5ec9815fa0 R15: 00007fff22a8f678 [ 1831.974848][T26611] [ 1831.974952][T26611] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1832.328889][T26617] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17328'. [ 1832.353333][T26620] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17329'. [ 1832.482491][T26626] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap5 [ 1832.598974][T26631] netlink: 24 bytes leftover after parsing attributes in process `syz.1.17334'. [ 1833.260338][T26655] openvswitch: netlink: IP tunnel dst address not specified [ 1833.261571][T26653] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap4 [ 1833.434938][T26663] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1833.445189][T26664] vti0: entered promiscuous mode [ 1833.453049][T26664] vti0: entered allmulticast mode [ 1833.567096][T26671] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17350'. [ 1833.578927][ T36] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1833.580395][T26671] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17350'. [ 1833.617082][T13579] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1833.629445][T13579] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1833.640451][T26671] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17350'. [ 1833.662077][T13579] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1833.681723][T26677] netlink: 180 bytes leftover after parsing attributes in process `syz.3.17351'. [ 1833.695548][T26677] netlink: 40 bytes leftover after parsing attributes in process `syz.3.17351'. [ 1833.744761][T26674] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17351'. [ 1833.801634][T26683] netlink: 'syz.0.17353': attribute type 2 has an invalid length. [ 1834.424892][T26713] lo speed is unknown, defaulting to 1000 [ 1834.433150][T26713] lo speed is unknown, defaulting to 1000 [ 1835.563205][T26752] sctp: [Deprecated]: syz.3.17375 (pid 26752) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1835.563205][T26752] Use struct sctp_sack_info instead [ 1835.599923][T26752] sctp: [Deprecated]: syz.3.17375 (pid 26752) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1835.599923][T26752] Use struct sctp_sack_info instead [ 1835.783991][T26770] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1835.802358][T26770] team0: Device macvlan3 is already an upper device of the team interface [ 1836.187891][T26777] tcpmss_tg4_check: 1 callbacks suppressed [ 1836.187915][T26777] xt_TCPMSS: Only works on TCP SYN packets [ 1836.205355][T26775] netlink: 'syz.4.17381': attribute type 15 has an invalid length. [ 1836.327587][T26782] netlink: 'syz.1.17384': attribute type 1 has an invalid length. [ 1836.343462][T26782] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap5 [ 1836.554943][T26789] tipc: Enabling of bearer rejected, already enabled [ 1836.628387][T26789] syzkaller0: mtu greater than device maximum [ 1836.747019][T26801] pimreg: entered allmulticast mode [ 1836.754323][T26801] pimreg: left allmulticast mode [ 1837.148465][T26822] __nla_validate_parse: 6 callbacks suppressed [ 1837.148486][T26822] netlink: 44 bytes leftover after parsing attributes in process `syz.4.17398'. [ 1837.241844][T26826] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap8 [ 1837.262305][T26825] lo speed is unknown, defaulting to 1000 [ 1837.271977][T26825] lo speed is unknown, defaulting to 1000 [ 1837.392995][T26829] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17401'. [ 1837.754973][T26827] nr1: entered promiscuous mode [ 1837.774971][T26827] nr1: entered allmulticast mode [ 1838.011254][T26834] netlink: 'syz.3.17403': attribute type 10 has an invalid length. [ 1838.050932][T26846] netlink: 24 bytes leftover after parsing attributes in process `syz.4.17408'. [ 1838.124729][ T30] audit: type=1107 audit(1770773677.174:66): pid=26849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1838.157451][T26852] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1839.028977][T26883] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap8 [ 1839.178753][ T30] audit: type=1107 audit(1770773678.234:67): pid=26887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1839.221468][T26891] netlink: 'syz.2.17425': attribute type 4 has an invalid length. [ 1839.260683][T26893] netlink: 'syz.0.17426': attribute type 15 has an invalid length. [ 1839.432196][T26901] 8021q: VLANs not supported on gre0 [ 1839.742704][T26918] netlink: 'syz.2.17437': attribute type 2 has an invalid length. [ 1839.751250][T26918] netlink: 224 bytes leftover after parsing attributes in process `syz.2.17437'. [ 1839.773121][T26918] netlink: 'syz.2.17437': attribute type 7 has an invalid length. [ 1840.392304][T26942] x_tables: unsorted underflow at hook 2 [ 1840.398117][T26944] FAULT_INJECTION: forcing a failure. [ 1840.398117][T26944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1840.411887][T26944] CPU: 0 UID: 0 PID: 26944 Comm: syz.3.17446 Not tainted syzkaller #0 PREEMPT(full) [ 1840.411917][T26944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1840.411929][T26944] Call Trace: [ 1840.411939][T26944] [ 1840.411948][T26944] dump_stack_lvl+0xe8/0x150 [ 1840.411981][T26944] should_fail_ex+0x412/0x560 [ 1840.412011][T26944] _copy_from_user+0x2d/0xb0 [ 1840.412040][T26944] ax25_setsockopt+0x172/0xc30 [ 1840.412065][T26944] ? __pfx_ax25_setsockopt+0x10/0x10 [ 1840.412096][T26944] ? __fget_files+0x2a/0x420 [ 1840.412114][T26944] ? aa_sock_opt_perm+0xff/0x1a0 [ 1840.412140][T26944] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1840.412162][T26944] ? __pfx_ax25_setsockopt+0x10/0x10 [ 1840.412184][T26944] do_sock_setsockopt+0x17c/0x1b0 [ 1840.412215][T26944] __x64_sys_setsockopt+0x13d/0x1b0 [ 1840.412244][T26944] do_syscall_64+0xe2/0xf80 [ 1840.412267][T26944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1840.412285][T26944] ? trace_irq_disable+0x37/0x100 [ 1840.412302][T26944] ? clear_bhb_loop+0x60/0xb0 [ 1840.412324][T26944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1840.412341][T26944] RIP: 0033:0x7f4f2799bf79 [ 1840.412359][T26944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1840.412375][T26944] RSP: 002b:00007f4f287b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1840.412396][T26944] RAX: ffffffffffffffda RBX: 00007f4f27c15fa0 RCX: 00007f4f2799bf79 [ 1840.412409][T26944] RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000004 [ 1840.412421][T26944] RBP: 00007f4f287b7090 R08: 0000000000000010 R09: 0000000000000000 [ 1840.412433][T26944] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 1840.412446][T26944] R13: 00007f4f27c16038 R14: 00007f4f27c15fa0 R15: 00007ffd9302f818 [ 1840.412479][T26944] [ 1840.689499][T26949] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17449'. [ 1840.979619][T26962] netlink: 12 bytes leftover after parsing attributes in process `syz.2.17455'. [ 1840.995480][T26962] netlink: 'syz.2.17455': attribute type 1 has an invalid length. [ 1841.025130][T26962] netlink: 'syz.2.17455': attribute type 3 has an invalid length. [ 1841.036538][T26962] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17455'. [ 1841.243312][T26970] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1841.435922][T26980] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17459'. [ 1841.439265][T26981] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17461'. [ 1841.475783][T26980] netlink: 'syz.2.17459': attribute type 32 has an invalid length. [ 1841.814604][T26990] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17464'. [ 1843.017271][T27037] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17482'. [ 1843.097356][T27040] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17482'. [ 1843.211260][T27037] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1843.366646][T27040] bond20 (unregistering): Released all slaves [ 1843.505475][T27049] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1843.661069][T27052] netlink: 'syz.2.17487': attribute type 13 has an invalid length. [ 1843.708011][T27058] tipc: Enabled bearer , priority 0 [ 1843.715580][T27060] netlink: 'syz.3.17491': attribute type 16 has an invalid length. [ 1843.726537][T27060] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.17491'. [ 1843.771489][T27058] syzkaller0: entered promiscuous mode [ 1843.779055][T27058] syzkaller0: entered allmulticast mode [ 1843.838141][T27058] syzkaller0: mtu greater than device maximum [ 1843.856710][T27057] tipc: Resetting bearer [ 1843.961419][T27057] tipc: Disabling bearer [ 1844.055638][T27074] bond28: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1844.071415][T27078] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17494'. [ 1844.111636][T27074] bond28 (unregistering): Released all slaves [ 1844.181121][T27082] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1844.189433][T27082] team0: Device macvlan3 is already an upper device of the team interface [ 1844.271687][T27078] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1844.646666][T27096] netlink: 224 bytes leftover after parsing attributes in process `syz.1.17501'. [ 1844.689435][T27101] netlink: 36 bytes leftover after parsing attributes in process `syz.1.17501'. [ 1845.075277][T27108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.17506'. [ 1845.110286][T27108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.17506'. [ 1845.134184][T27111] netlink: 20 bytes leftover after parsing attributes in process `syz.3.17507'. [ 1845.147082][T27108] netlink: 28 bytes leftover after parsing attributes in process `syz.2.17506'. [ 1845.247921][T27115] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1845.273575][T27115] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1845.297142][T27117] FAULT_INJECTION: forcing a failure. [ 1845.297142][T27117] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1845.332275][T27117] CPU: 0 UID: 0 PID: 27117 Comm: syz.4.17509 Not tainted syzkaller #0 PREEMPT(full) [ 1845.332305][T27117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1845.332318][T27117] Call Trace: [ 1845.332327][T27117] [ 1845.332337][T27117] dump_stack_lvl+0xe8/0x150 [ 1845.332369][T27117] should_fail_ex+0x412/0x560 [ 1845.332401][T27117] _copy_to_user+0x31/0xb0 [ 1845.332433][T27117] simple_read_from_buffer+0xe1/0x170 [ 1845.332460][T27117] proc_fail_nth_read+0x1bb/0x230 [ 1845.332490][T27117] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1845.332521][T27117] ? rw_verify_area+0x2a6/0x4d0 [ 1845.332548][T27117] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1845.332576][T27117] vfs_read+0x20c/0xa70 [ 1845.332601][T27117] ? fdget_pos+0x246/0x320 [ 1845.332629][T27117] ? __pfx___mutex_lock+0x10/0x10 [ 1845.332658][T27117] ? __pfx_vfs_read+0x10/0x10 [ 1845.332686][T27117] ? __fget_files+0x2a/0x420 [ 1845.332712][T27117] ? __fget_files+0x3a0/0x420 [ 1845.332732][T27117] ? __fget_files+0x2a/0x420 [ 1845.332764][T27117] ksys_read+0x150/0x270 [ 1845.332790][T27117] ? __pfx_ksys_read+0x10/0x10 [ 1845.332829][T27117] do_syscall_64+0xe2/0xf80 [ 1845.332856][T27117] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1845.332875][T27117] ? trace_irq_disable+0x37/0x100 [ 1845.332895][T27117] ? clear_bhb_loop+0x60/0xb0 [ 1845.332919][T27117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1845.332937][T27117] RIP: 0033:0x7fbba235c84e [ 1845.332955][T27117] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1845.332972][T27117] RSP: 002b:00007fbba330bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1845.332995][T27117] RAX: ffffffffffffffda RBX: 00007fbba330c6c0 RCX: 00007fbba235c84e [ 1845.333010][T27117] RDX: 000000000000000f RSI: 00007fbba330c0a0 RDI: 0000000000000003 [ 1845.333023][T27117] RBP: 00007fbba330c090 R08: 0000000000000000 R09: 0000000000000000 [ 1845.333035][T27117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1845.333048][T27117] R13: 00007fbba2616038 R14: 00007fbba2615fa0 R15: 00007ffc125b5358 [ 1845.333083][T27117] [ 1845.804264][T27134] lo speed is unknown, defaulting to 1000 [ 1845.855834][T27134] lo speed is unknown, defaulting to 1000 [ 1845.913602][T27137] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1846.650742][T27167] 8021q: VLANs not supported on gre0 [ 1846.939566][T27177] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap5 [ 1847.108583][T27179] FAULT_INJECTION: forcing a failure. [ 1847.108583][T27179] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1847.125330][T27179] CPU: 1 UID: 0 PID: 27179 Comm: syz.1.17533 Not tainted syzkaller #0 PREEMPT(full) [ 1847.125361][T27179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1847.125383][T27179] Call Trace: [ 1847.125392][T27179] [ 1847.125401][T27179] dump_stack_lvl+0xe8/0x150 [ 1847.125432][T27179] should_fail_ex+0x412/0x560 [ 1847.125464][T27179] _copy_from_iter+0x1d3/0x1670 [ 1847.125506][T27179] ? __pfx__copy_from_iter+0x10/0x10 [ 1847.125530][T27179] ? sock_alloc_send_pskb+0x896/0x990 [ 1847.125566][T27179] ? __pfx__copy_from_iter+0x10/0x10 [ 1847.125602][T27179] ? page_copy_sane+0x16a/0x270 [ 1847.125632][T27179] copy_page_from_iter+0xdd/0x170 [ 1847.125664][T27179] skb_copy_datagram_from_iter+0x306/0x710 [ 1847.125707][T27179] tun_get_user+0xc38/0x3dd0 [ 1847.125744][T27179] ? aa_file_perm+0x12d/0x1630 [ 1847.125776][T27179] ? aa_file_perm+0x440/0x1630 [ 1847.125801][T27179] ? __pfx_tun_get_user+0x10/0x10 [ 1847.125827][T27179] ? __lock_acquire+0x6b5/0x2cf0 [ 1847.125858][T27179] ? kstrtoull+0x12f/0x1d0 [ 1847.125898][T27179] ? ref_tracker_alloc+0x363/0x4d0 [ 1847.125927][T27179] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1847.125955][T27179] ? tun_get+0x1c/0x2f0 [ 1847.125976][T27179] ? tun_get+0x1c/0x2f0 [ 1847.126004][T27179] ? tun_get+0x1c/0x2f0 [ 1847.126025][T27179] ? tun_get+0x1c/0x2f0 [ 1847.126051][T27179] tun_chr_write_iter+0x113/0x200 [ 1847.126077][T27179] vfs_write+0x61d/0xb90 [ 1847.126116][T27179] ? __pfx_vfs_write+0x10/0x10 [ 1847.126155][T27179] ? __fget_files+0x2a/0x420 [ 1847.126202][T27179] ksys_write+0x150/0x270 [ 1847.126233][T27179] ? __pfx_ksys_write+0x10/0x10 [ 1847.126270][T27179] do_syscall_64+0xe2/0xf80 [ 1847.126295][T27179] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1847.126313][T27179] ? trace_irq_disable+0x37/0x100 [ 1847.126331][T27179] ? clear_bhb_loop+0x60/0xb0 [ 1847.126355][T27179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1847.126382][T27179] RIP: 0033:0x7f87cad9bf79 [ 1847.126402][T27179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1847.126419][T27179] RSP: 002b:00007f87cbcf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1847.126443][T27179] RAX: ffffffffffffffda RBX: 00007f87cb015fa0 RCX: 00007f87cad9bf79 [ 1847.126457][T27179] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000004 [ 1847.126470][T27179] RBP: 00007f87cbcf0090 R08: 0000000000000000 R09: 0000000000000000 [ 1847.126483][T27179] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1847.126495][T27179] R13: 00007f87cb016038 R14: 00007f87cb015fa0 R15: 00007ffd6b4f3398 [ 1847.126529][T27179] [ 1847.820297][T27187] netlink: 'syz.2.17536': attribute type 1 has an invalid length. [ 1848.062671][T27206] __nla_validate_parse: 15 callbacks suppressed [ 1848.062693][T27206] netlink: 88 bytes leftover after parsing attributes in process `syz.0.17540'. [ 1848.103202][T27206] netlink: 76 bytes leftover after parsing attributes in process `syz.0.17540'. [ 1848.121489][T27206] netlink: 88 bytes leftover after parsing attributes in process `syz.0.17540'. [ 1848.133190][T27206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17540'. [ 1848.142803][T27206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17540'. [ 1848.155930][T27208] FAULT_INJECTION: forcing a failure. [ 1848.155930][T27208] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1848.175274][T27208] CPU: 1 UID: 0 PID: 27208 Comm: syz.3.17541 Not tainted syzkaller #0 PREEMPT(full) [ 1848.175304][T27208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1848.175316][T27208] Call Trace: [ 1848.175325][T27208] [ 1848.175334][T27208] dump_stack_lvl+0xe8/0x150 [ 1848.175378][T27208] should_fail_ex+0x412/0x560 [ 1848.175409][T27208] _copy_from_user+0x2d/0xb0 [ 1848.175440][T27208] sock_do_ioctl+0x195/0x320 [ 1848.175465][T27208] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1848.175483][T27208] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1848.175536][T27208] sock_ioctl+0x5c6/0x7f0 [ 1848.175558][T27208] ? __pfx_sock_ioctl+0x10/0x10 [ 1848.175579][T27208] ? __fget_files+0x2a/0x420 [ 1848.175601][T27208] ? __fget_files+0x3a0/0x420 [ 1848.175621][T27208] ? __fget_files+0x2a/0x420 [ 1848.175647][T27208] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1848.175672][T27208] ? __pfx_sock_ioctl+0x10/0x10 [ 1848.175691][T27208] __se_sys_ioctl+0xfc/0x170 [ 1848.175723][T27208] do_syscall_64+0xe2/0xf80 [ 1848.175751][T27208] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1848.175770][T27208] ? trace_irq_disable+0x37/0x100 [ 1848.175790][T27208] ? clear_bhb_loop+0x60/0xb0 [ 1848.175814][T27208] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1848.175834][T27208] RIP: 0033:0x7f4f2799bf79 [ 1848.175853][T27208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1848.175878][T27208] RSP: 002b:00007f4f287b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1848.175901][T27208] RAX: ffffffffffffffda RBX: 00007f4f27c15fa0 RCX: 00007f4f2799bf79 [ 1848.175916][T27208] RDX: 0000200000000180 RSI: 0000000000008993 RDI: 0000000000000005 [ 1848.175929][T27208] RBP: 00007f4f287b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1848.175943][T27208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1848.175956][T27208] R13: 00007f4f27c16038 R14: 00007f4f27c15fa0 R15: 00007ffd9302f818 [ 1848.175991][T27208] [ 1848.530508][T27218] tipc: Enabled bearer , priority 0 [ 1848.533592][T27220] netlink: 88 bytes leftover after parsing attributes in process `syz.0.17544'. [ 1848.538171][T27218] syzkaller0: entered promiscuous mode [ 1848.553166][T27218] syzkaller0: entered allmulticast mode [ 1848.602605][T27218] tipc: Resetting bearer [ 1848.606070][T27221] netlink: 76 bytes leftover after parsing attributes in process `syz.0.17544'. [ 1848.639531][T27221] netlink: 88 bytes leftover after parsing attributes in process `syz.0.17544'. [ 1848.677057][T27217] tipc: Resetting bearer [ 1848.767628][T27217] tipc: Disabling bearer [ 1848.812147][T27226] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1848.823140][T27226] team0: Device macvlan4 is already an upper device of the team interface [ 1848.832441][ T30] audit: type=1107 audit(1770773687.874:68): pid=27230 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1849.030269][T27241] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17554'. [ 1849.045691][T27243] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17555'. [ 1849.095628][T27241] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1849.188204][T27243] 8021q: adding VLAN 0 to HW filter on device bond40 [ 1849.242766][T27253] bond40 (unregistering): Released all slaves [ 1850.394379][T27313] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap8 [ 1850.577397][T27318] syzkaller1: entered promiscuous mode [ 1850.590236][T27320] FAULT_INJECTION: forcing a failure. [ 1850.590236][T27320] name failslab, interval 1, probability 0, space 0, times 0 [ 1850.604282][T27318] syzkaller1: entered allmulticast mode [ 1850.616561][T27320] CPU: 0 UID: 0 PID: 27320 Comm: syz.2.17574 Not tainted syzkaller #0 PREEMPT(full) [ 1850.616593][T27320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1850.616605][T27320] Call Trace: [ 1850.616615][T27320] [ 1850.616624][T27320] dump_stack_lvl+0xe8/0x150 [ 1850.616657][T27320] should_fail_ex+0x412/0x560 [ 1850.616685][T27320] should_failslab+0xa8/0x100 [ 1850.616709][T27320] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 1850.616737][T27320] ? __alloc_skb+0x186/0x7d0 [ 1850.616758][T27320] ? __alloc_skb+0x1d0/0x7d0 [ 1850.616778][T27320] ? __local_bh_enable_ip+0xd0/0x130 [ 1850.616802][T27320] __alloc_skb+0x1d0/0x7d0 [ 1850.616831][T27320] netlink_sendmsg+0x5d4/0xb40 [ 1850.616865][T27320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1850.616891][T27320] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1850.616917][T27320] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1850.616941][T27320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1850.616961][T27320] ____sys_sendmsg+0xa68/0xad0 [ 1850.616987][T27320] ? __might_fault+0xaf/0x130 [ 1850.617020][T27320] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1850.617056][T27320] ? import_iovec+0x73/0xa0 [ 1850.617088][T27320] ___sys_sendmsg+0x2a5/0x360 [ 1850.617110][T27320] ? __lock_acquire+0x6b5/0x2cf0 [ 1850.617151][T27320] ? __pfx____sys_sendmsg+0x10/0x10 [ 1850.617213][T27320] ? __fget_files+0x2a/0x420 [ 1850.617236][T27320] ? __fget_files+0x3a0/0x420 [ 1850.617268][T27320] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1850.617299][T27320] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1850.617337][T27320] ? __pfx_ksys_write+0x10/0x10 [ 1850.617377][T27320] do_syscall_64+0xe2/0xf80 [ 1850.617402][T27320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1850.617420][T27320] ? trace_irq_disable+0x37/0x100 [ 1850.617438][T27320] ? clear_bhb_loop+0x60/0xb0 [ 1850.617462][T27320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1850.617481][T27320] RIP: 0033:0x7f5ec959bf79 [ 1850.617501][T27320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1850.617518][T27320] RSP: 002b:00007f5eca4cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1850.617540][T27320] RAX: ffffffffffffffda RBX: 00007f5ec9815fa0 RCX: 00007f5ec959bf79 [ 1850.617554][T27320] RDX: 0000000000000010 RSI: 0000200000000680 RDI: 0000000000000005 [ 1850.617568][T27320] RBP: 00007f5eca4cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1850.617580][T27320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1850.617592][T27320] R13: 00007f5ec9816038 R14: 00007f5ec9815fa0 R15: 00007fff22a8f678 [ 1850.617625][T27320] [ 1850.958328][T27329] netlink: 'syz.3.17573': attribute type 21 has an invalid length. [ 1851.132448][T27335] pim6reg: entered allmulticast mode [ 1851.335813][T27332] pim6reg: left allmulticast mode [ 1851.564987][T27351] tap0: tun_chr_ioctl cmd 1074025681 [ 1851.810861][T27359] block nbd4: NBD_DISCONNECT [ 1851.815734][T27359] block nbd4: Send disconnect failed -32 [ 1851.822308][T27359] block nbd4: shutting down sockets [ 1852.053249][T27372] tipc: Enabling of bearer rejected, already enabled [ 1852.102947][T27372] syzkaller0: mtu greater than device maximum [ 1852.396418][T27386] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1852.453164][T27393] bond21 (unregistering): Released all slaves [ 1852.470689][T27401] netlink: 'syz.3.17596': attribute type 13 has an invalid length. [ 1852.520899][T27404] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap5 [ 1852.544342][T27401] tipc: Resetting bearer [ 1852.981059][T27426] team5: entered promiscuous mode [ 1852.989149][T27426] team5: entered allmulticast mode [ 1852.994832][T27426] 8021q: adding VLAN 0 to HW filter on device team5 [ 1853.046572][T27426] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1853.081718][T27423] team6: entered promiscuous mode [ 1853.088453][T27423] team6: entered allmulticast mode [ 1853.097640][T27423] 8021q: adding VLAN 0 to HW filter on device team6 [ 1853.125106][ T1302] clip:clip_start_xmit: skb_dst(skb) == NULL [ 1853.131378][ T1302] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1853.139685][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1853.147384][T27435] netlink: 'syz.2.17605': attribute type 13 has an invalid length. [ 1853.647756][T27459] mac80211_hwsim hwsim8 syzkaller0: Caught tx_queue_len zero misconfig [ 1854.103382][T27461] netlink: 'syz.0.17611': attribute type 1 has an invalid length. [ 1854.169115][T27476] __nla_validate_parse: 17 callbacks suppressed [ 1854.169136][T27476] netlink: 28 bytes leftover after parsing attributes in process `syz.0.17611'. [ 1854.206581][T27461] bond40: entered promiscuous mode [ 1854.212439][T27461] 8021q: adding VLAN 0 to HW filter on device bond40 [ 1854.641775][T27482] Cannot find map_set index 135 as target [ 1854.663493][T27483] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_cmd_wq": -EINTR [ 1854.693821][T27461] bond40: (slave bridge16): making interface the new active one [ 1854.712617][T27461] bridge16: entered promiscuous mode [ 1854.722071][T27461] bond40: (slave bridge16): Enslaving as an active interface with an up link [ 1855.050986][T27501] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1855.136537][T27501] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1855.279018][T27501] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1855.315600][T27501] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1855.434637][T27501] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1855.451624][T27501] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1855.517680][T27530] Cannot find del_set index 0 as target [ 1855.530142][T27530] openvswitch: netlink: Missing valid actions attribute. [ 1855.544597][T27501] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1855.554786][T27501] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1855.556476][T27530] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1855.644227][T27534] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17629'. [ 1855.682013][ T12] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1855.701048][ T12] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.733255][ T12] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1855.749206][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.783009][ T12] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1855.800816][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1855.861595][T13579] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1855.870361][T13579] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1856.052488][T27545] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap4 [ 1856.511854][T27567] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1856.578830][T27567] team0: Device macvlan3 is already an upper device of the team interface [ 1856.670902][T27570] tc_dump_action: action bad kind [ 1856.910127][T27582] bond0: Caught tx_queue_len zero misconfig [ 1856.916749][T27582] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17649'. [ 1857.014458][T27589] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1857.097972][T27590] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap6 [ 1857.359610][T27607] openvswitch: netlink: IP tunnel dst address not specified [ 1857.447317][T27611] tap0: tun_chr_ioctl cmd 2147767521 [ 1857.483481][ T30] audit: type=1107 audit(1770773696.534:69): pid=27613 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1857.522550][T27616] bridge0: port 2(veth0_to_bridge) entered blocking state [ 1857.530097][T27616] bridge0: port 2(veth0_to_bridge) entered disabled state [ 1857.537630][T27616] veth0_to_bridge: entered allmulticast mode [ 1857.544932][T27616] veth0_to_bridge: entered promiscuous mode [ 1858.002898][T27639] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap6 [ 1858.168502][T27643] netlink: 16 bytes leftover after parsing attributes in process `syz.4.17674'. [ 1858.186003][T27645] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17673'. [ 1858.209921][T27645] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17673'. [ 1858.304201][T27648] netlink: 'syz.0.17675': attribute type 1 has an invalid length. [ 1858.325247][T27648] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1858.551032][T27661] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17680'. [ 1858.608476][T27665] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17682'. [ 1858.618165][T27665] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17682'. [ 1858.643420][T27669] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap4 [ 1858.709218][T27673] siw: device registration error -23 [ 1858.786406][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5650 ms [ 1858.794506][ C1] lec:lec_tx_timeout: lec0 [ 1858.898882][T27673] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17685'. [ 1858.928678][T27673] : entered promiscuous mode [ 1859.211471][T27689] netlink: 'syz.3.17691': attribute type 3 has an invalid length. [ 1859.671700][T27708] __nla_validate_parse: 1 callbacks suppressed [ 1859.671723][T27708] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17699'. [ 1859.685642][T27710] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1859.706942][T27708] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17699'. [ 1859.798848][T27713] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17701'. [ 1859.854756][T27713] 8021q: adding VLAN 0 to HW filter on device bond28 [ 1860.121637][T27726] netlink: 80 bytes leftover after parsing attributes in process `syz.3.17706'. [ 1860.131484][T27726] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17706'. [ 1860.245482][T27730] netlink: 332 bytes leftover after parsing attributes in process `syz.3.17708'. [ 1860.257686][T27730] netlink: 'syz.3.17708': attribute type 9 has an invalid length. [ 1860.265617][T27730] netlink: 108 bytes leftover after parsing attributes in process `syz.3.17708'. [ 1860.277671][T27730] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17708'. [ 1860.440149][T27732] lo speed is unknown, defaulting to 1000 [ 1860.451820][T27732] lo speed is unknown, defaulting to 1000 [ 1860.533419][T27738] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17710'. [ 1860.680136][T27740] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17711'. [ 1860.761535][T27740] 8021q: adding VLAN 0 to HW filter on device bond41 [ 1862.166785][T27806] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1862.174205][T27797] syzkaller0: entered promiscuous mode [ 1862.193355][T27797] syzkaller0: entered allmulticast mode [ 1863.784912][T27845] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1865.441641][T27851] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1867.584990][T27832] tipc: Enabled bearer , priority 0 [ 1867.592675][T27833] syzkaller0: entered promiscuous mode [ 1867.598635][T27833] syzkaller0: entered allmulticast mode [ 1867.611292][T27841] tipc: Resetting bearer [ 1867.627329][T27845] tipc: Resetting bearer [ 1867.847252][T16700] lo speed is unknown, defaulting to 1000 [ 1867.853059][T16700] syz2: Port: 1 Link DOWN [ 1867.866872][T27841] tipc: Resetting bearer [ 1867.936904][T27841] tipc: Disabling bearer [ 1867.961597][ T1339] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1867.970048][T27865] __nla_validate_parse: 5 callbacks suppressed [ 1867.970068][T27865] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17745'. [ 1867.981800][T27862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17743'. [ 1867.998217][ T1339] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.076749][ T1339] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1868.085610][ T1339] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.094204][ T1339] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1868.106616][ T1339] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.135589][T27866] syzkaller0: entered promiscuous mode [ 1868.141427][T27866] syzkaller0: entered allmulticast mode [ 1868.188771][ T1339] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1868.197605][ T1339] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.480501][T27880] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17749'. [ 1868.487505][T27891] netlink: 'syz.1.17752': attribute type 1 has an invalid length. [ 1868.560060][T27891] gretap5: entered allmulticast mode [ 1868.569318][T27891] bond33: (slave gretap5): making interface the new active one [ 1868.578382][T27891] bond33: (slave gretap5): Enslaving as an active interface with an up link [ 1868.614805][T27895] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1868.735078][T27898] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17754'. [ 1868.863578][T27900] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1868.870755][T27900] syzkaller1: Linktype set failed because interface is up [ 1868.914316][T27903] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17756'. [ 1868.926811][T16700] syzkaller1: tun_net_xmit 90 [ 1869.046793][T16700] syzkaller1: tun_net_xmit 90 [ 1869.116455][T27913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17759'. [ 1869.159622][T27900] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17755'. [ 1869.165260][T27913] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap4 [ 1869.256649][T13571] syzkaller1: tun_net_xmit 86 [ 1869.281507][T27919] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17761'. [ 1869.290838][T27919] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17761'. [ 1869.432153][T27930] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17765'. [ 1869.470081][T27930] team4: entered promiscuous mode [ 1869.475590][T27930] team4: entered allmulticast mode [ 1869.487410][T27930] 8021q: adding VLAN 0 to HW filter on device team4 [ 1869.526579][T27931] team5: entered promiscuous mode [ 1869.531846][T27931] team5: entered allmulticast mode [ 1869.538082][T27931] 8021q: adding VLAN 0 to HW filter on device team5 [ 1869.895354][T27945] lo speed is unknown, defaulting to 1000 [ 1869.921399][T27945] lo speed is unknown, defaulting to 1000 [ 1870.069525][ T30] audit: type=1107 audit(1770773709.124:70): pid=27953 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1870.333014][T27964] FAULT_INJECTION: forcing a failure. [ 1870.333014][T27964] name failslab, interval 1, probability 0, space 0, times 0 [ 1870.347675][T27964] CPU: 1 UID: 0 PID: 27964 Comm: syz.1.17776 Not tainted syzkaller #0 PREEMPT(full) [ 1870.347706][T27964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1870.347718][T27964] Call Trace: [ 1870.347727][T27964] [ 1870.347736][T27964] dump_stack_lvl+0xe8/0x150 [ 1870.347769][T27964] should_fail_ex+0x412/0x560 [ 1870.347801][T27964] should_failslab+0xa8/0x100 [ 1870.347826][T27964] __kmalloc_noprof+0xde/0x7e0 [ 1870.347847][T27964] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 1870.347876][T27964] ? rcu_is_watching+0x15/0xb0 [ 1870.347902][T27964] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 1870.347940][T27964] genl_family_rcv_msg_doit+0xd9/0x330 [ 1870.347968][T27964] ? __asan_memcpy+0x40/0x70 [ 1870.348001][T27964] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1870.348066][T27964] ? apparmor_capable+0x137/0x1a0 [ 1870.348106][T27964] ? bpf_lsm_capable+0x9/0x20 [ 1870.348131][T27964] ? security_capable+0x7e/0x2c0 [ 1870.348163][T27964] genl_rcv_msg+0x61c/0x7a0 [ 1870.348200][T27964] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1870.348226][T27964] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 1870.348251][T27964] ? __pfx_nl802154_wpan_phy_netns+0x10/0x10 [ 1870.348276][T27964] ? __pfx_nl802154_post_doit+0x10/0x10 [ 1870.348318][T27964] netlink_rcv_skb+0x232/0x4b0 [ 1870.348343][T27964] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1870.348372][T27964] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1870.348392][T27964] ? genl_rcv+0x19/0x40 [ 1870.348440][T27964] ? down_read+0x272/0x2e0 [ 1870.348457][T27964] ? genl_rcv+0xd/0x40 [ 1870.348486][T27964] genl_rcv+0x28/0x40 [ 1870.348511][T27964] netlink_unicast+0x80f/0x9b0 [ 1870.348542][T27964] ? __pfx_netlink_unicast+0x10/0x10 [ 1870.348565][T27964] ? netlink_sendmsg+0x650/0xb40 [ 1870.348586][T27964] ? skb_put+0x11b/0x210 [ 1870.348617][T27964] netlink_sendmsg+0x813/0xb40 [ 1870.348651][T27964] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1870.348679][T27964] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1870.348706][T27964] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1870.348730][T27964] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1870.348752][T27964] ____sys_sendmsg+0xa68/0xad0 [ 1870.348779][T27964] ? __might_fault+0xaf/0x130 [ 1870.348817][T27964] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1870.348856][T27964] ? import_iovec+0x73/0xa0 [ 1870.348890][T27964] ___sys_sendmsg+0x2a5/0x360 [ 1870.348916][T27964] ? __lock_acquire+0x6b5/0x2cf0 [ 1870.348950][T27964] ? __pfx____sys_sendmsg+0x10/0x10 [ 1870.349022][T27964] ? __fget_files+0x2a/0x420 [ 1870.349043][T27964] ? __fget_files+0x3a0/0x420 [ 1870.349078][T27964] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1870.349128][T27964] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1870.349169][T27964] ? __pfx_ksys_write+0x10/0x10 [ 1870.349212][T27964] do_syscall_64+0xe2/0xf80 [ 1870.349240][T27964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1870.349259][T27964] ? trace_irq_disable+0x37/0x100 [ 1870.349279][T27964] ? clear_bhb_loop+0x60/0xb0 [ 1870.349304][T27964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1870.349324][T27964] RIP: 0033:0x7f87cad9bf79 [ 1870.349342][T27964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1870.349360][T27964] RSP: 002b:00007f87cbcf0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1870.349382][T27964] RAX: ffffffffffffffda RBX: 00007f87cb015fa0 RCX: 00007f87cad9bf79 [ 1870.349397][T27964] RDX: 0000000000000010 RSI: 0000200000000680 RDI: 0000000000000005 [ 1870.349410][T27964] RBP: 00007f87cbcf0090 R08: 0000000000000000 R09: 0000000000000000 [ 1870.349422][T27964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1870.349434][T27964] R13: 00007f87cb016038 R14: 00007f87cb015fa0 R15: 00007ffd6b4f3398 [ 1870.349471][T27964] [ 1870.349574][T27962] netlink: 'syz.4.17775': attribute type 1 has an invalid length. [ 1871.022871][T27984] FAULT_INJECTION: forcing a failure. [ 1871.022871][T27984] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1871.053831][T27984] CPU: 0 UID: 0 PID: 27984 Comm: syz.4.17783 Not tainted syzkaller #0 PREEMPT(full) [ 1871.053862][T27984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1871.053874][T27984] Call Trace: [ 1871.053883][T27984] [ 1871.053892][T27984] dump_stack_lvl+0xe8/0x150 [ 1871.053925][T27984] should_fail_ex+0x412/0x560 [ 1871.053957][T27984] _copy_to_user+0x31/0xb0 [ 1871.053992][T27984] simple_read_from_buffer+0xe1/0x170 [ 1871.054020][T27984] proc_fail_nth_read+0x1bb/0x230 [ 1871.054053][T27984] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1871.054086][T27984] ? rw_verify_area+0x2a6/0x4d0 [ 1871.054114][T27984] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1871.054143][T27984] vfs_read+0x20c/0xa70 [ 1871.054168][T27984] ? fdget_pos+0x246/0x320 [ 1871.054198][T27984] ? __pfx___mutex_lock+0x10/0x10 [ 1871.054227][T27984] ? __pfx_vfs_read+0x10/0x10 [ 1871.054258][T27984] ? __fget_files+0x2a/0x420 [ 1871.054283][T27984] ? __fget_files+0x3a0/0x420 [ 1871.054304][T27984] ? __fget_files+0x2a/0x420 [ 1871.054334][T27984] ksys_read+0x150/0x270 [ 1871.054364][T27984] ? __pfx_ksys_read+0x10/0x10 [ 1871.054449][T27984] do_syscall_64+0xe2/0xf80 [ 1871.054476][T27984] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.054495][T27984] ? trace_irq_disable+0x37/0x100 [ 1871.054514][T27984] ? clear_bhb_loop+0x60/0xb0 [ 1871.054539][T27984] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1871.054559][T27984] RIP: 0033:0x7fbba235c84e [ 1871.054578][T27984] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1871.054596][T27984] RSP: 002b:00007fbba330bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1871.054619][T27984] RAX: ffffffffffffffda RBX: 00007fbba330c6c0 RCX: 00007fbba235c84e [ 1871.054634][T27984] RDX: 000000000000000f RSI: 00007fbba330c0a0 RDI: 0000000000000004 [ 1871.054647][T27984] RBP: 00007fbba330c090 R08: 0000000000000000 R09: 0000000000000000 [ 1871.054660][T27984] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1871.054672][T27984] R13: 00007fbba2616038 R14: 00007fbba2615fa0 R15: 00007ffc125b5358 [ 1871.054709][T27984] [ 1871.470305][ T30] audit: type=1107 audit(1770773710.524:71): pid=27994 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1871.891592][T28013] tipc: Enabling of bearer rejected, failed to enable media [ 1872.365638][ T30] audit: type=1107 audit(1770773711.414:72): pid=28024 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N vy~2NI$ Zڎ/Yv. +D]Ӓ WG֨7֫\ 5Y6y&HGεΜsmZ' [ 1872.564467][T28038] FAULT_INJECTION: forcing a failure. [ 1872.564467][T28038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1872.608475][T28038] CPU: 0 UID: 0 PID: 28038 Comm: syz.1.17803 Not tainted syzkaller #0 PREEMPT(full) [ 1872.608508][T28038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1872.608521][T28038] Call Trace: [ 1872.608530][T28038] [ 1872.608540][T28038] dump_stack_lvl+0xe8/0x150 [ 1872.608573][T28038] should_fail_ex+0x412/0x560 [ 1872.608603][T28038] _copy_from_iter+0x1d3/0x1670 [ 1872.608641][T28038] ? rcu_is_watching+0x15/0xb0 [ 1872.608663][T28038] ? __pfx__copy_from_iter+0x10/0x10 [ 1872.608686][T28038] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 1872.608727][T28038] ? netlink_sendmsg+0x650/0xb40 [ 1872.608749][T28038] ? skb_put+0x11b/0x210 [ 1872.608779][T28038] netlink_sendmsg+0x6c0/0xb40 [ 1872.608813][T28038] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1872.608838][T28038] ? aa_file_perm+0x12d/0x1630 [ 1872.608863][T28038] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1872.608890][T28038] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1872.608916][T28038] sock_write_iter+0x503/0x550 [ 1872.608939][T28038] ? __pfx_sock_write_iter+0x10/0x10 [ 1872.608985][T28038] do_iter_readv_writev+0x619/0x8c0 [ 1872.609009][T28038] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1872.609045][T28038] ? bpf_lsm_file_permission+0x9/0x20 [ 1872.609067][T28038] ? security_file_permission+0x75/0x260 [ 1872.609090][T28038] ? rw_verify_area+0x255/0x4d0 [ 1872.609121][T28038] vfs_writev+0x33c/0x990 [ 1872.609155][T28038] ? __pfx_vfs_writev+0x10/0x10 [ 1872.609195][T28038] ? __fget_files+0x2a/0x420 [ 1872.609223][T28038] ? __fget_files+0x3a0/0x420 [ 1872.609244][T28038] ? __fget_files+0x2a/0x420 [ 1872.609276][T28038] do_writev+0x154/0x2e0 [ 1872.609302][T28038] ? __pfx_do_writev+0x10/0x10 [ 1872.609339][T28038] do_syscall_64+0xe2/0xf80 [ 1872.609375][T28038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1872.609395][T28038] ? trace_irq_disable+0x37/0x100 [ 1872.609414][T28038] ? clear_bhb_loop+0x60/0xb0 [ 1872.609440][T28038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1872.609460][T28038] RIP: 0033:0x7f87cad9bf79 [ 1872.609479][T28038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1872.609496][T28038] RSP: 002b:00007f87cbcf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1872.609519][T28038] RAX: ffffffffffffffda RBX: 00007f87cb015fa0 RCX: 00007f87cad9bf79 [ 1872.609534][T28038] RDX: 0000000000000001 RSI: 0000200000000280 RDI: 0000000000000003 [ 1872.609548][T28038] RBP: 00007f87cbcf0090 R08: 0000000000000000 R09: 0000000000000000 [ 1872.609560][T28038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1872.609572][T28038] R13: 00007f87cb016038 R14: 00007f87cb015fa0 R15: 00007ffd6b4f3398 [ 1872.609607][T28038] [ 1873.023363][T28043] __nla_validate_parse: 6 callbacks suppressed [ 1873.023389][T28043] netlink: 72 bytes leftover after parsing attributes in process `syz.2.17805'. [ 1873.098243][T28044] tipc: Resetting bearer [ 1873.330075][T28049] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17808'. [ 1873.448695][T28057] netlink: 156 bytes leftover after parsing attributes in process `syz.2.17810'. [ 1873.513632][T28049] netlink: 16 bytes leftover after parsing attributes in process `syz.4.17808'. [ 1873.540157][T28063] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17812'. [ 1873.588560][T28057] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1873.618407][T28057] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1873.719439][T28079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17813'. [ 1873.741983][T28075] lo speed is unknown, defaulting to 1000 [ 1873.749932][T28079] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17813'. [ 1873.759261][T28079] netlink: 348 bytes leftover after parsing attributes in process `syz.0.17813'. [ 1873.772624][T28075] lo speed is unknown, defaulting to 1000 [ 1873.784954][T28079] netlink: 4 bytes leftover after parsing attributes in process `syz.0.17813'. [ 1873.811711][T28068] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17814'. [ 1874.288641][T28089] FAULT_INJECTION: forcing a failure. [ 1874.288641][T28089] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1874.302900][T28089] CPU: 0 UID: 0 PID: 28089 Comm: syz.2.17816 Not tainted syzkaller #0 PREEMPT(full) [ 1874.302931][T28089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1874.302944][T28089] Call Trace: [ 1874.302952][T28089] [ 1874.302962][T28089] dump_stack_lvl+0xe8/0x150 [ 1874.302995][T28089] should_fail_ex+0x412/0x560 [ 1874.303025][T28089] _copy_from_iter+0x1d3/0x1670 [ 1874.303062][T28089] ? rcu_is_watching+0x15/0xb0 [ 1874.303084][T28089] ? __pfx__copy_from_iter+0x10/0x10 [ 1874.303121][T28089] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 1874.303163][T28089] ? netlink_sendmsg+0x650/0xb40 [ 1874.303185][T28089] ? skb_put+0x11b/0x210 [ 1874.303214][T28089] netlink_sendmsg+0x6c0/0xb40 [ 1874.303247][T28089] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1874.303275][T28089] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1874.303302][T28089] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1874.303326][T28089] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1874.303348][T28089] ____sys_sendmsg+0xa68/0xad0 [ 1874.303384][T28089] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1874.303422][T28089] ? import_iovec+0x73/0xa0 [ 1874.303454][T28089] ___sys_sendmsg+0x2a5/0x360 [ 1874.303480][T28089] ? __lock_acquire+0x6b5/0x2cf0 [ 1874.303511][T28089] ? __pfx____sys_sendmsg+0x10/0x10 [ 1874.303576][T28089] ? __fget_files+0x2a/0x420 [ 1874.303598][T28089] ? __fget_files+0x3a0/0x420 [ 1874.303631][T28089] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1874.303663][T28089] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1874.303701][T28089] ? __pfx_ksys_write+0x10/0x10 [ 1874.303743][T28089] do_syscall_64+0xe2/0xf80 [ 1874.303778][T28089] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1874.303797][T28089] ? clear_bhb_loop+0x60/0xb0 [ 1874.303821][T28089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1874.303840][T28089] RIP: 0033:0x7f5ec959bf79 [ 1874.303859][T28089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1874.303876][T28089] RSP: 002b:00007f5eca4cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1874.303899][T28089] RAX: ffffffffffffffda RBX: 00007f5ec9815fa0 RCX: 00007f5ec959bf79 [ 1874.303914][T28089] RDX: 0000000004044010 RSI: 0000200000000440 RDI: 0000000000000004 [ 1874.303927][T28089] RBP: 00007f5eca4cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1874.303939][T28089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1874.303951][T28089] R13: 00007f5ec9816038 R14: 00007f5ec9815fa0 R15: 00007fff22a8f678 [ 1874.303987][T28089] [ 1875.066089][T28110] pim6reg1: entered promiscuous mode [ 1875.081798][T28110] pim6reg1: entered allmulticast mode [ 1875.131165][T28113] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap5 [ 1875.517674][T28127] netlink: 'syz.4.17832': attribute type 1 has an invalid length. [ 1875.684494][T29383] lec:lec_start_xmit: lec0:No lecd attached [ 1876.010416][T28156] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1876.018996][T28156] team0: Device macvlan4 is already an upper device of the team interface [ 1876.051683][T28159] openvswitch: netlink: IP tunnel dst address not specified [ 1876.691144][T28179] syzkaller0: entered promiscuous mode [ 1876.697174][T28179] syzkaller0: entered allmulticast mode [ 1876.792108][T28192] team7: entered promiscuous mode [ 1876.799814][T28203] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1876.806704][T28192] team7: entered allmulticast mode [ 1876.817171][T28192] 8021q: adding VLAN 0 to HW filter on device team7 [ 1876.840578][T28199] team8: entered promiscuous mode [ 1876.845677][T28199] team8: entered allmulticast mode [ 1876.857645][T28199] 8021q: adding VLAN 0 to HW filter on device team8 [ 1879.068958][T28217] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1879.080939][T28217] team0: Device macvlan3 is already an upper device of the team interface [ 1879.201807][T28221] __nla_validate_parse: 22 callbacks suppressed [ 1879.201832][T28221] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17862'. [ 1879.236493][T28221] netlink: 28 bytes leftover after parsing attributes in process `syz.3.17862'. [ 1879.285669][T28221] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17862'. [ 1879.342977][T28221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17862'. [ 1879.404521][T28221] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap6 [ 1879.419531][T28233] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17863'. [ 1879.456646][T28224] can: request_module (can-proto-5) failed. [ 1879.601963][T28247] IPVS: set_ctl: invalid protocol: 44 172.20.20.170:20003 [ 1879.625438][T28246] FAULT_INJECTION: forcing a failure. [ 1879.625438][T28246] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1879.640221][T28246] CPU: 0 UID: 0 PID: 28246 Comm: syz.3.17870 Not tainted syzkaller #0 PREEMPT(full) [ 1879.640247][T28246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1879.640258][T28246] Call Trace: [ 1879.640266][T28246] [ 1879.640273][T28246] dump_stack_lvl+0xe8/0x150 [ 1879.640301][T28246] should_fail_ex+0x412/0x560 [ 1879.640327][T28246] _copy_from_iter+0x1d3/0x1670 [ 1879.640361][T28246] ? __pfx__copy_from_iter+0x10/0x10 [ 1879.640381][T28246] ? sock_alloc_send_pskb+0x896/0x990 [ 1879.640411][T28246] ? __pfx__copy_from_iter+0x10/0x10 [ 1879.640434][T28246] ? page_copy_sane+0x16a/0x270 [ 1879.640457][T28246] copy_page_from_iter+0xdd/0x170 [ 1879.640482][T28246] skb_copy_datagram_from_iter+0x306/0x710 [ 1879.640517][T28246] tun_get_user+0xc38/0x3dd0 [ 1879.640548][T28246] ? aa_file_perm+0x12d/0x1630 [ 1879.640572][T28246] ? aa_file_perm+0x440/0x1630 [ 1879.640592][T28246] ? __pfx_tun_get_user+0x10/0x10 [ 1879.640611][T28246] ? __lock_acquire+0x6b5/0x2cf0 [ 1879.640636][T28246] ? kstrtoull+0x12f/0x1d0 [ 1879.640663][T28246] ? ref_tracker_alloc+0x363/0x4d0 [ 1879.640687][T28246] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1879.640708][T28246] ? tun_get+0x1c/0x2f0 [ 1879.640725][T28246] ? tun_get+0x1c/0x2f0 [ 1879.640748][T28246] ? tun_get+0x1c/0x2f0 [ 1879.640764][T28246] ? tun_get+0x1c/0x2f0 [ 1879.640786][T28246] tun_chr_write_iter+0x113/0x200 [ 1879.640806][T28246] vfs_write+0x61d/0xb90 [ 1879.640838][T28246] ? __pfx_vfs_write+0x10/0x10 [ 1879.640870][T28246] ? __fget_files+0x2a/0x420 [ 1879.640898][T28246] ksys_write+0x150/0x270 [ 1879.640922][T28246] ? __pfx_ksys_write+0x10/0x10 [ 1879.640955][T28246] do_syscall_64+0xe2/0xf80 [ 1879.640976][T28246] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1879.640991][T28246] ? trace_irq_disable+0x37/0x100 [ 1879.641006][T28246] ? clear_bhb_loop+0x60/0xb0 [ 1879.641026][T28246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1879.641042][T28246] RIP: 0033:0x7f4f2799bf79 [ 1879.641059][T28246] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1879.641074][T28246] RSP: 002b:00007f4f287b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1879.641094][T28246] RAX: ffffffffffffffda RBX: 00007f4f27c15fa0 RCX: 00007f4f2799bf79 [ 1879.641106][T28246] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000004 [ 1879.641127][T28246] RBP: 00007f4f287b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1879.641137][T28246] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1879.641147][T28246] R13: 00007f4f27c16038 R14: 00007f4f27c15fa0 R15: 00007ffd9302f818 [ 1879.641177][T28246] [ 1880.253913][T28259] netlink: 'syz.1.17876': attribute type 1 has an invalid length. [ 1880.625116][T28263] vlan9: entered promiscuous mode [ 1880.639064][T28263] dummy0: entered promiscuous mode [ 1880.776180][T28266] netlink: 16 bytes leftover after parsing attributes in process `syz.0.17878'. [ 1880.786767][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5100 ms [ 1880.786806][ C1] lec:lec_tx_timeout: lec0 [ 1880.854382][T28266] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap8 [ 1880.909820][T28270] lo speed is unknown, defaulting to 1000 [ 1880.920041][T28270] lo speed is unknown, defaulting to 1000 [ 1881.017907][T28276] syzkaller0: entered promiscuous mode [ 1881.023987][T28276] syzkaller0: entered allmulticast mode [ 1881.345826][T28283] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1881.468560][T28291] netlink: 52 bytes leftover after parsing attributes in process `syz.0.17883'. [ 1881.538419][T28293] netlink: 76 bytes leftover after parsing attributes in process `syz.0.17883'. [ 1881.591170][T28282] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17883'. [ 1881.600676][T28282] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17883'. [ 1884.560000][T28283] tipc: Resetting bearer [ 1884.597119][T28293] netlink: 52 bytes leftover after parsing attributes in process `syz.0.17883'. [ 1884.694380][T28301] syzkaller0: entered promiscuous mode [ 1884.700157][T28301] syzkaller0: entered allmulticast mode [ 1884.906798][T28318] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17887'. [ 1886.626795][ T6624] IPVS: ip_vs_send_async error -101 [ 1887.141720][T28324] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap7 [ 1887.275587][T28330] netlink: 52 bytes leftover after parsing attributes in process `syz.2.17892'. [ 1887.296585][T28333] netlink: 7 bytes leftover after parsing attributes in process `syz.1.17893'. [ 1887.325926][T28333] netlink: 7 bytes leftover after parsing attributes in process `syz.1.17893'. [ 1887.350520][T28336] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17892'. [ 1887.395233][T28336] netlink: 52 bytes leftover after parsing attributes in process `syz.2.17892'. [ 1887.409450][T28341] netlink: 16 bytes leftover after parsing attributes in process `syz.3.17895'. [ 1887.431283][T28330] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17892'. [ 1887.443420][T28330] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17892'. [ 1887.582128][T28344] batadv3: entered promiscuous mode [ 1887.590131][T28344] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 1887.635126][T28341] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap7 [ 1887.835570][T28349] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1888.232172][T28362] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1888.255745][T28360] team9: entered promiscuous mode [ 1888.261852][T28360] team9: entered allmulticast mode [ 1888.269202][T28360] 8021q: adding VLAN 0 to HW filter on device team9 [ 1888.306611][T28368] netlink: 'syz.2.17904': attribute type 15 has an invalid length. [ 1888.340893][T28361] team10: entered promiscuous mode [ 1888.346186][T28361] team10: entered allmulticast mode [ 1888.352215][T28361] 8021q: adding VLAN 0 to HW filter on device team10 [ 1888.441949][T28373] team11: entered promiscuous mode [ 1888.447322][T28373] team11: entered allmulticast mode [ 1888.453215][T28373] 8021q: adding VLAN 0 to HW filter on device team11 [ 1888.513567][T28373] team12: entered promiscuous mode [ 1888.519410][T28373] team12: entered allmulticast mode [ 1888.525563][T28373] 8021q: adding VLAN 0 to HW filter on device team12 [ 1888.537970][T28364] netlink: 'syz.0.17903': attribute type 10 has an invalid length. [ 1888.547889][T28364] team0: Cannot enslave team device to itself [ 1888.568462][T28373] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1888.935437][T28395] tipc: Resetting bearer [ 1888.958384][T28395] syzkaller0: mtu less than device minimum [ 1889.097787][T28375] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1889.345845][T28401] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1889.354512][T28401] team0: Device macvlan4 is already an upper device of the team interface [ 1889.555109][T28417] Cannot find add_set index 0 as target [ 1889.581412][T28415] .70: renamed from hsr0 [ 1889.602118][T28415] .70: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1889.613095][T28415] .70: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1889.636665][T28415] .70: left promiscuous mode [ 1889.657113][T28415] A link change request failed with some changes committed already. Interface .70 may have been left with an inconsistent configuration, please check. [ 1889.804805][T28431] netlink: 'syz.4.17922': attribute type 21 has an invalid length. [ 1889.836118][T28425] lo speed is unknown, defaulting to 1000 [ 1889.878354][T28425] lo speed is unknown, defaulting to 1000 [ 1889.932118][T28435] __nla_validate_parse: 22 callbacks suppressed [ 1889.932142][T28435] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17924'. [ 1889.985012][T28435] netlink: 4 bytes leftover after parsing attributes in process `syz.2.17924'. [ 1890.011863][T28435] netlink: 16 bytes leftover after parsing attributes in process `syz.2.17924'. [ 1890.601878][T28456] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1890.609713][T28456] team0: Device macvlan3 is already an upper device of the team interface [ 1890.696959][T28427] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17921'. [ 1890.737631][T28427] openvswitch: netlink: IP tunnel dst address not specified [ 1890.824071][T28458] syzkaller0: entered promiscuous mode [ 1890.838665][T28458] syzkaller0: entered allmulticast mode [ 1890.890448][T28472] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17937'. [ 1890.908910][T28459] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17921'. [ 1890.942650][T28459] netlink: 32 bytes leftover after parsing attributes in process `syz.3.17921'. [ 1890.962924][T28459] netlink: 11 bytes leftover after parsing attributes in process `syz.3.17921'. [ 1890.983855][T28464] lo speed is unknown, defaulting to 1000 [ 1891.392319][T28469] netlink: 20 bytes leftover after parsing attributes in process `syz.2.17936'. [ 1893.409949][T28464] lo speed is unknown, defaulting to 1000 [ 1893.612582][T28481] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17940'. [ 1893.642012][T28481] netlink: 'syz.4.17940': attribute type 15 has an invalid length. [ 1893.681231][T28483] FAULT_INJECTION: forcing a failure. [ 1893.681231][T28483] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1893.704610][T28483] CPU: 0 UID: 0 PID: 28483 Comm: syz.0.17941 Not tainted syzkaller #0 PREEMPT(full) [ 1893.704639][T28483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1893.704651][T28483] Call Trace: [ 1893.704660][T28483] [ 1893.704668][T28483] dump_stack_lvl+0xe8/0x150 [ 1893.704699][T28483] should_fail_ex+0x412/0x560 [ 1893.704728][T28483] _copy_from_iter+0x1d3/0x1670 [ 1893.704767][T28483] ? __pfx__copy_from_iter+0x10/0x10 [ 1893.704790][T28483] ? sock_alloc_send_pskb+0x896/0x990 [ 1893.704826][T28483] ? __pfx__copy_from_iter+0x10/0x10 [ 1893.704855][T28483] ? page_copy_sane+0x16a/0x270 [ 1893.704882][T28483] copy_page_from_iter+0xdd/0x170 [ 1893.704913][T28483] skb_copy_datagram_from_iter+0x306/0x710 [ 1893.704954][T28483] tun_get_user+0xc38/0x3dd0 [ 1893.704991][T28483] ? aa_file_perm+0x12d/0x1630 [ 1893.705020][T28483] ? aa_file_perm+0x440/0x1630 [ 1893.705051][T28483] ? __pfx_tun_get_user+0x10/0x10 [ 1893.705075][T28483] ? __lock_acquire+0x6b5/0x2cf0 [ 1893.705102][T28483] ? kstrtoull+0x12f/0x1d0 [ 1893.705133][T28483] ? ref_tracker_alloc+0x363/0x4d0 [ 1893.705159][T28483] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1893.705184][T28483] ? tun_get+0x1c/0x2f0 [ 1893.705205][T28483] ? tun_get+0x1c/0x2f0 [ 1893.705230][T28483] ? tun_get+0x1c/0x2f0 [ 1893.705249][T28483] ? tun_get+0x1c/0x2f0 [ 1893.705273][T28483] tun_chr_write_iter+0x113/0x200 [ 1893.705307][T28483] vfs_write+0x61d/0xb90 [ 1893.705344][T28483] ? __pfx_vfs_write+0x10/0x10 [ 1893.705380][T28483] ? __fget_files+0x2a/0x420 [ 1893.705409][T28483] ksys_write+0x150/0x270 [ 1893.705438][T28483] ? __pfx_ksys_write+0x10/0x10 [ 1893.705478][T28483] do_syscall_64+0xe2/0xf80 [ 1893.705505][T28483] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1893.705524][T28483] ? trace_irq_disable+0x37/0x100 [ 1893.705543][T28483] ? clear_bhb_loop+0x60/0xb0 [ 1893.705569][T28483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1893.705588][T28483] RIP: 0033:0x7fd62af9bf79 [ 1893.705609][T28483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1893.705627][T28483] RSP: 002b:00007fd62be2d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1893.705650][T28483] RAX: ffffffffffffffda RBX: 00007fd62b215fa0 RCX: 00007fd62af9bf79 [ 1893.705666][T28483] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000004 [ 1893.705679][T28483] RBP: 00007fd62be2d090 R08: 0000000000000000 R09: 0000000000000000 [ 1893.705692][T28483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1893.705704][T28483] R13: 00007fd62b216038 R14: 00007fd62b215fa0 R15: 00007ffe75502048 [ 1893.705739][T28483] [ 1894.270830][T28493] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap8 [ 1894.803594][T28503] team6: entered promiscuous mode [ 1894.809252][T28503] team6: entered allmulticast mode [ 1894.815178][T28503] 8021q: adding VLAN 0 to HW filter on device team6 [ 1894.977534][T28504] team7: entered promiscuous mode [ 1894.982827][T28504] team7: entered allmulticast mode [ 1894.989874][T28504] 8021q: adding VLAN 0 to HW filter on device team7 [ 1895.134371][T28507] __nla_validate_parse: 3 callbacks suppressed [ 1895.134395][T28507] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17948'. [ 1895.442849][T28515] lo speed is unknown, defaulting to 1000 [ 1895.485559][T28515] lo speed is unknown, defaulting to 1000 [ 1895.514455][T28509] lo speed is unknown, defaulting to 1000 [ 1895.534658][T28525] netlink: 52 bytes leftover after parsing attributes in process `syz.0.17950'. [ 1895.577920][T28525] netlink: 76 bytes leftover after parsing attributes in process `syz.0.17950'. [ 1895.602173][T28525] netlink: 52 bytes leftover after parsing attributes in process `syz.0.17950'. [ 1895.640189][T28525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17950'. [ 1895.669958][T28525] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17950'. [ 1895.986613][T28541] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17957'. [ 1896.017723][T28509] lo speed is unknown, defaulting to 1000 [ 1896.027575][T28541] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17957'. [ 1896.131232][T28550] netlink: 52 bytes leftover after parsing attributes in process `syz.2.17959'. [ 1896.143799][T28550] netlink: 76 bytes leftover after parsing attributes in process `syz.2.17959'. [ 1896.396627][T28562] netlink: 'syz.4.17961': attribute type 4 has an invalid length. [ 1896.899483][T28580] lo: Caught tx_queue_len zero misconfig [ 1897.437383][T28590] syzkaller1: entered promiscuous mode [ 1897.444106][T28590] syzkaller1: entered allmulticast mode [ 1898.023774][T28598] bond35 (unregistering): Released all slaves [ 1898.940789][T28540] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1902.657728][T28639] FAULT_INJECTION: forcing a failure. [ 1902.657728][T28639] name failslab, interval 1, probability 0, space 0, times 0 [ 1902.712243][T28639] CPU: 1 UID: 0 PID: 28639 Comm: syz.4.17990 Not tainted syzkaller #0 PREEMPT(full) [ 1902.712271][T28639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1902.712291][T28639] Call Trace: [ 1902.712299][T28639] [ 1902.712308][T28639] dump_stack_lvl+0xe8/0x150 [ 1902.712340][T28639] should_fail_ex+0x412/0x560 [ 1902.712369][T28639] should_failslab+0xa8/0x100 [ 1902.712392][T28639] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1902.712421][T28639] ? alloc_empty_file+0x55/0x1d0 [ 1902.712446][T28639] alloc_empty_file+0x55/0x1d0 [ 1902.712469][T28639] alloc_file_pseudo+0x155/0x240 [ 1902.712495][T28639] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1902.712515][T28639] ? evm_inode_alloc_security+0x40/0xb0 [ 1902.712544][T28639] ? security_inode_alloc+0xd5/0x310 [ 1902.712582][T28639] sock_alloc_file+0xb8/0x2e0 [ 1902.712607][T28639] do_accept+0x3a0/0x760 [ 1902.712634][T28639] ? __pfx_do_accept+0x10/0x10 [ 1902.712677][T28639] __sys_accept4+0x139/0x230 [ 1902.712703][T28639] ? __pfx___sys_accept4+0x10/0x10 [ 1902.712726][T28639] ? __pfx_ksys_write+0x10/0x10 [ 1902.712761][T28639] __x64_sys_accept4+0x9a/0xb0 [ 1902.712784][T28639] do_syscall_64+0xe2/0xf80 [ 1902.712809][T28639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1902.712828][T28639] ? trace_irq_disable+0x37/0x100 [ 1902.712847][T28639] ? clear_bhb_loop+0x60/0xb0 [ 1902.712868][T28639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1902.712886][T28639] RIP: 0033:0x7fbba239bf79 [ 1902.712905][T28639] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1902.712921][T28639] RSP: 002b:00007fbba330c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 1902.712942][T28639] RAX: ffffffffffffffda RBX: 00007fbba2615fa0 RCX: 00007fbba239bf79 [ 1902.712956][T28639] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 1902.712967][T28639] RBP: 00007fbba330c090 R08: 0000000000000000 R09: 0000000000000000 [ 1902.712979][T28639] R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000001 [ 1902.712991][T28639] R13: 00007fbba2616038 R14: 00007fbba2615fa0 R15: 00007ffc125b5358 [ 1902.713021][T28639] [ 1903.265241][T28661] __nla_validate_parse: 16 callbacks suppressed [ 1903.265265][T28661] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17997'. [ 1903.288906][T28661] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17997'. [ 1903.309534][T28667] openvswitch: netlink: IP tunnel dst address not specified [ 1903.365496][T28670] netlink: 4 bytes leftover after parsing attributes in process `syz.0.18001'. [ 1903.538190][T28670] netlink: 28 bytes leftover after parsing attributes in process `syz.0.18001'. [ 1903.550351][T28670] netlink: 28 bytes leftover after parsing attributes in process `syz.0.18001'. [ 1903.622658][T28683] netlink: 12 bytes leftover after parsing attributes in process `syz.3.18006'. [ 1903.649880][T28683] nbd: couldn't find a device at index 65546 [ 1903.660264][T28685] netlink: 8 bytes leftover after parsing attributes in process `syz.4.18007'. [ 1903.670988][T28685] netlink: 'syz.4.18007': attribute type 15 has an invalid length. [ 1903.702715][T28687] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1903.775885][T28689] bond39: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 1903.794265][T28689] bond39 (unregistering): Released all slaves [ 1903.812080][T28694] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1903.835869][T28694] tipc: Resetting bearer [ 1903.923103][T28699] netlink: 20 bytes leftover after parsing attributes in process `syz.0.18011'. [ 1904.149100][T28709] FAULT_INJECTION: forcing a failure. [ 1904.149100][T28709] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1904.226661][T28709] CPU: 1 UID: 0 PID: 28709 Comm: syz.2.18014 Not tainted syzkaller #0 PREEMPT(full) [ 1904.226693][T28709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1904.226706][T28709] Call Trace: [ 1904.226715][T28709] [ 1904.226724][T28709] dump_stack_lvl+0xe8/0x150 [ 1904.226758][T28709] should_fail_ex+0x412/0x560 [ 1904.226789][T28709] _copy_from_user+0x2d/0xb0 [ 1904.226819][T28709] core_sys_select+0x6fd/0xc30 [ 1904.226859][T28709] ? __pfx_core_sys_select+0x10/0x10 [ 1904.226932][T28709] ? __pfx_set_user_sigmask+0x10/0x10 [ 1904.226966][T28709] __se_sys_pselect6+0x267/0x320 [ 1904.226994][T28709] ? __pfx___se_sys_pselect6+0x10/0x10 [ 1904.227016][T28709] ? __pfx_ksys_write+0x10/0x10 [ 1904.227051][T28709] ? __x64_sys_pselect6+0x21/0xf0 [ 1904.227074][T28709] do_syscall_64+0xe2/0xf80 [ 1904.227112][T28709] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1904.227132][T28709] ? trace_irq_disable+0x37/0x100 [ 1904.227151][T28709] ? clear_bhb_loop+0x60/0xb0 [ 1904.227176][T28709] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1904.227195][T28709] RIP: 0033:0x7f5ec959bf79 [ 1904.227215][T28709] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1904.227233][T28709] RSP: 002b:00007f5eca4cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 1904.227256][T28709] RAX: ffffffffffffffda RBX: 00007f5ec9815fa0 RCX: 00007f5ec959bf79 [ 1904.227271][T28709] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 1904.227285][T28709] RBP: 00007f5eca4cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1904.227298][T28709] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 1904.227311][T28709] R13: 00007f5ec9816038 R14: 00007f5ec9815fa0 R15: 00007fff22a8f678 [ 1904.227363][T28709] [ 1904.548111][T28713] netlink: 8 bytes leftover after parsing attributes in process `syz.1.18016'. [ 1904.801851][T28723] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18018'. [ 1904.854229][T28723] team13: entered promiscuous mode [ 1904.859711][T28723] team13: entered allmulticast mode [ 1904.868120][T28723] 8021q: adding VLAN 0 to HW filter on device team13 [ 1904.902625][T28729] team14: entered promiscuous mode [ 1904.908084][T28729] team14: entered allmulticast mode [ 1904.913790][T28729] 8021q: adding VLAN 0 to HW filter on device team14 [ 1904.926915][T28723] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 1905.204217][T28745] netlink: 'syz.3.18025': attribute type 15 has an invalid length. [ 1905.225385][T28742] netlink: 'syz.0.18023': attribute type 13 has an invalid length. [ 1905.230859][T28738] lo speed is unknown, defaulting to 1000 [ 1905.239890][T28742] netlink: 'syz.0.18023': attribute type 13 has an invalid length. [ 1905.250145][T28738] lo speed is unknown, defaulting to 1000 [ 1908.404258][T28792] __nla_validate_parse: 8 callbacks suppressed [ 1908.404279][T28792] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18041'. [ 1908.540831][T28801] netlink: 4 bytes leftover after parsing attributes in process `syz.4.18044'. [ 1908.562424][T28803] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18046'. [ 1908.573091][T28803] netlink: 'syz.2.18046': attribute type 15 has an invalid length. [ 1908.884475][T28812] netlink: 8 bytes leftover after parsing attributes in process `syz.1.18049'. [ 1908.912114][T28812] netlink: 'syz.1.18049': attribute type 15 has an invalid length. [ 1909.434024][T28832] FAULT_INJECTION: forcing a failure. [ 1909.434024][T28832] name failslab, interval 1, probability 0, space 0, times 0 [ 1909.446919][T28832] CPU: 1 UID: 0 PID: 28832 Comm: syz.3.18056 Not tainted syzkaller #0 PREEMPT(full) [ 1909.446946][T28832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1909.446958][T28832] Call Trace: [ 1909.446967][T28832] [ 1909.446976][T28832] dump_stack_lvl+0xe8/0x150 [ 1909.447007][T28832] should_fail_ex+0x412/0x560 [ 1909.447039][T28832] should_failslab+0xa8/0x100 [ 1909.447065][T28832] __kmalloc_node_track_caller_noprof+0xe1/0x7f0 [ 1909.447088][T28832] ? nf_ct_ext_add+0x1b6/0x460 [ 1909.447215][T28832] ? rcu_is_watching+0x15/0xb0 [ 1909.447235][T28832] ? nf_ct_ext_add+0x1b6/0x460 [ 1909.447273][T28832] krealloc_node_align_noprof+0x1ae/0x390 [ 1909.447300][T28832] nf_ct_ext_add+0x1b6/0x460 [ 1909.447336][T28832] init_conntrack+0x5c8/0xf70 [ 1909.447363][T28832] ? __pfx_init_conntrack+0x10/0x10 [ 1909.447388][T28832] ? __pfx___nf_conntrack_find_get+0x10/0x10 [ 1909.447414][T28832] ? do_raw_spin_lock+0x12b/0x2f0 [ 1909.447437][T28832] ? __siphash_unaligned+0x22e/0x3b0 [ 1909.447502][T28832] nf_conntrack_in+0xbd8/0x15e0 [ 1909.447529][T28832] ? lockdep_hardirqs_on+0x7a/0x110 [ 1909.447581][T28832] ? __pfx_nf_conntrack_in+0x10/0x10 [ 1909.447612][T28832] ? ip6t_do_table+0x1df/0x1560 [ 1909.447684][T28832] ? __pfx_ip6t_do_table+0x10/0x10 [ 1909.447712][T28832] ? NF_HOOK+0x9e/0x3c0 [ 1909.447782][T28832] ? ipv6_defrag+0x2d6/0x3b0 [ 1909.447805][T28832] ? __pfx_ipv6_conntrack_in+0x10/0x10 [ 1909.447830][T28832] nf_hook_slow+0xc5/0x220 [ 1909.447881][T28832] NF_HOOK+0x21f/0x3c0 [ 1909.447905][T28832] ? skb_orphan+0x4f/0xd0 [ 1909.447942][T28832] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1909.447969][T28832] ? NF_HOOK+0x9e/0x3c0 [ 1909.448017][T28832] ? __pfx_NF_HOOK+0x10/0x10 [ 1909.448048][T28832] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1909.448085][T28832] ? netif_receive_skb+0x102/0xbb0 [ 1909.448110][T28832] netif_receive_skb+0x278/0xbb0 [ 1909.448139][T28832] ? __pfx_netif_receive_skb+0x10/0x10 [ 1909.448160][T28832] ? skb_partial_csum_set+0x107/0x360 [ 1909.448189][T28832] ? tun_rx_batched+0x185/0x790 [ 1909.448215][T28832] tun_rx_batched+0x1de/0x790 [ 1909.448246][T28832] ? __pfx_tun_rx_batched+0x10/0x10 [ 1909.448276][T28832] ? tun_get_user+0x2669/0x3dd0 [ 1909.448300][T28832] ? tun_get_user+0x2669/0x3dd0 [ 1909.448327][T28832] ? tun_get_user+0x2354/0x3dd0 [ 1909.448348][T28832] ? __local_bh_enable_ip+0xd0/0x130 [ 1909.448372][T28832] ? tun_get_user+0x2669/0x3dd0 [ 1909.448393][T28832] tun_get_user+0x2a78/0x3dd0 [ 1909.448431][T28832] ? aa_file_perm+0x12d/0x1630 [ 1909.448464][T28832] ? aa_file_perm+0x440/0x1630 [ 1909.448489][T28832] ? __pfx_tun_get_user+0x10/0x10 [ 1909.448515][T28832] ? __lock_acquire+0x6b5/0x2cf0 [ 1909.448546][T28832] ? kstrtoull+0x12f/0x1d0 [ 1909.448581][T28832] ? ref_tracker_alloc+0x363/0x4d0 [ 1909.448611][T28832] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1909.448639][T28832] ? tun_get+0x1c/0x2f0 [ 1909.448661][T28832] ? tun_get+0x1c/0x2f0 [ 1909.448690][T28832] ? tun_get+0x1c/0x2f0 [ 1909.448711][T28832] ? tun_get+0x1c/0x2f0 [ 1909.448738][T28832] tun_chr_write_iter+0x113/0x200 [ 1909.448765][T28832] vfs_write+0x61d/0xb90 [ 1909.448802][T28832] ? __pfx_vfs_write+0x10/0x10 [ 1909.448840][T28832] ? __fget_files+0x2a/0x420 [ 1909.448871][T28832] ksys_write+0x150/0x270 [ 1909.448902][T28832] ? __pfx_ksys_write+0x10/0x10 [ 1909.448943][T28832] do_syscall_64+0xe2/0xf80 [ 1909.448970][T28832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1909.448989][T28832] ? trace_irq_disable+0x37/0x100 [ 1909.449006][T28832] ? clear_bhb_loop+0x60/0xb0 [ 1909.449029][T28832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1909.449048][T28832] RIP: 0033:0x7f4f2799bf79 [ 1909.449068][T28832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1909.449085][T28832] RSP: 002b:00007f4f287b7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1909.449106][T28832] RAX: ffffffffffffffda RBX: 00007f4f27c15fa0 RCX: 00007f4f2799bf79 [ 1909.449121][T28832] RDX: 000000000000fdef RSI: 0000200000000040 RDI: 0000000000000004 [ 1909.449134][T28832] RBP: 00007f4f287b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1909.449146][T28832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1909.449157][T28832] R13: 00007f4f27c16038 R14: 00007f4f27c15fa0 R15: 00007ffd9302f818 [ 1909.449191][T28832] [ 1910.139277][T28849] netlink: 24 bytes leftover after parsing attributes in process `syz.0.18064'. [ 1910.173634][T28849] netlink: 'syz.0.18064': attribute type 1 has an invalid length. [ 1910.336575][T28852] lo speed is unknown, defaulting to 1000 [ 1910.383115][T28852] lo speed is unknown, defaulting to 1000 [ 1910.400414][T28870] netlink: 'syz.3.18067': attribute type 83 has an invalid length. [ 1910.419061][T28870] netlink: 16 bytes leftover after parsing attributes in process `syz.3.18067'. [ 1911.410495][T28885] netlink: 8 bytes leftover after parsing attributes in process `syz.2.18073'. [ 1911.420560][T28885] netlink: 'syz.2.18073': attribute type 15 has an invalid length. [ 1911.516573][T28888] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18075'. [ 1911.525593][T28888] netlink: 261 bytes leftover after parsing attributes in process `syz.3.18075'. [ 1911.771833][T28892] lo speed is unknown, defaulting to 1000 [ 1911.843391][T28880] netlink: 7 bytes leftover after parsing attributes in process `syz.0.18072'. [ 1911.894631][T28892] lo speed is unknown, defaulting to 1000 [ 1911.980415][T28906] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1912.110562][T28908] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 1912.118090][T28908] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 1912.127260][T28908] tipc: Resetting bearer [ 1912.965437][T28921] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1913.364431][T28929] team4: entered promiscuous mode [ 1913.397668][T28929] team4: entered allmulticast mode [ 1913.417233][T28929] 8021q: adding VLAN 0 to HW filter on device team4 [ 1913.473861][T28931] team5: entered promiscuous mode [ 1913.479178][T28931] team5: entered allmulticast mode [ 1913.485142][T28931] 8021q: adding VLAN 0 to HW filter on device team5 [ 1913.572267][ T30] audit: type=1804 audit(1770773752.624:73): pid=28938 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.18089" name="x000000000000000500000000000000000000005" dev="tmpfs" ino=18551 res=1 errno=0 [ 1913.626428][ T30] audit: type=1800 audit(1770773752.624:74): pid=28938 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.18089" name="x000000000000000500000000000000000000005" dev="tmpfs" ino=18551 res=0 errno=0 [ 1913.923311][T28956] __nla_validate_parse: 2 callbacks suppressed [ 1913.923334][T28956] netlink: 32 bytes leftover after parsing attributes in process `syz.0.18093'. [ 1913.956641][T28956] netlink: 32 bytes leftover after parsing attributes in process `syz.0.18093'. [ 1914.143099][T28965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18100'. [ 1914.208748][T28968] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18100'. [ 1914.246925][T28965] team6: entered promiscuous mode [ 1914.263413][T28965] team6: entered allmulticast mode [ 1914.285526][T28965] 8021q: adding VLAN 0 to HW filter on device team6 [ 1914.367481][T28940] FAULT_INJECTION: forcing a failure. [ 1914.367481][T28940] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1914.380880][T28940] CPU: 0 UID: 0 PID: 28940 Comm: syz.3.18088 Not tainted syzkaller #0 PREEMPT(full) [ 1914.380909][T28940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1914.380921][T28940] Call Trace: [ 1914.380930][T28940] [ 1914.380939][T28940] dump_stack_lvl+0xe8/0x150 [ 1914.380971][T28940] should_fail_ex+0x412/0x560 [ 1914.381001][T28940] core_sys_select+0x8dd/0xc30 [ 1914.381038][T28940] ? __pfx_core_sys_select+0x10/0x10 [ 1914.381093][T28940] ? __pfx_set_user_sigmask+0x10/0x10 [ 1914.381123][T28940] __se_sys_pselect6+0x267/0x320 [ 1914.381148][T28940] ? __pfx___se_sys_pselect6+0x10/0x10 [ 1914.381165][T28940] ? __pfx_ksys_write+0x10/0x10 [ 1914.381199][T28940] ? __x64_sys_pselect6+0x21/0xf0 [ 1914.381221][T28940] do_syscall_64+0xe2/0xf80 [ 1914.381246][T28940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1914.381265][T28940] ? trace_irq_disable+0x37/0x100 [ 1914.381284][T28940] ? clear_bhb_loop+0x60/0xb0 [ 1914.381308][T28940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1914.381326][T28940] RIP: 0033:0x7f4f2799bf79 [ 1914.381346][T28940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1914.381363][T28940] RSP: 002b:00007f4f287b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 1914.381386][T28940] RAX: ffffffffffffffda RBX: 00007f4f27c15fa0 RCX: 00007f4f2799bf79 [ 1914.381400][T28940] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 1914.381413][T28940] RBP: 00007f4f287b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1914.381425][T28940] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 1914.381438][T28940] R13: 00007f4f27c16038 R14: 00007f4f27c15fa0 R15: 00007ffd9302f818 [ 1914.381473][T28940] [ 1914.564367][ T1302] clip:clip_start_xmit: skb_dst(skb) == NULL [ 1914.570475][ T1302] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1914.578559][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1914.614371][T28968] team7: entered promiscuous mode [ 1914.619901][T28968] team7: entered allmulticast mode [ 1914.626556][T28968] 8021q: adding VLAN 0 to HW filter on device team7 [ 1914.971476][T28985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18105'. [ 1914.981517][T28985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18105'. [ 1915.014849][T28985] netlink: 24 bytes leftover after parsing attributes in process `syz.3.18105'. [ 1915.208291][T28995] netlink: 24 bytes leftover after parsing attributes in process `syz.1.18108'. [ 1915.346487][T29001] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18108'. [ 1915.355589][T29001] netlink: 4 bytes leftover after parsing attributes in process `syz.1.18108'. [ 1915.447687][T29003] netlink: 'syz.0.18111': attribute type 2 has an invalid length. [ 1915.550300][T29010] netlink: 'syz.4.18114': attribute type 15 has an invalid length. [ 1915.633144][T29012] tipc: Resetting bearer [ 1917.277498][T29090] netlink: 'syz.4.18132': attribute type 15 has an invalid length. [ 1917.753565][T29115] lo: Caught tx_queue_len zero misconfig [ 1919.836534][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5260 ms [ 1919.844668][ C1] lec:lec_tx_timeout: lec0 [ 1939.932409][T29383] lec:lec_start_xmit: lec0:No lecd attached [ 1944.946421][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1944.954479][ C1] lec:lec_tx_timeout: lec0 [ 1947.348228][ T6624] IPVS: ip_vs_send_async error -101 [ 1975.990643][ T1302] clip:clip_start_xmit: skb_dst(skb) == NULL [ 1975.996818][ T1302] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1976.004784][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1981.826331][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 1981.834407][ C1] lec:lec_tx_timeout: lec0 [ 2003.593059][T29383] lec:lec_start_xmit: lec0:No lecd attached [ 2008.707847][ T6624] IPVS: ip_vs_send_async error -101 [ 2008.786517][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5190 ms [ 2008.794582][ C1] lec:lec_tx_timeout: lec0 [ 2032.306564][ C0] ================================================================== [ 2032.314726][ C0] BUG: KASAN: slab-use-after-free in rose_t0timer_expiry+0x1ea/0x560 [ 2032.322882][ C0] Read of size 8 at addr ffff88807e09f018 by task swapper/0/0 [ 2032.330334][ C0] [ 2032.332746][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 2032.332763][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 2032.332773][ C0] Call Trace: [ 2032.332781][ C0] [ 2032.332790][ C0] dump_stack_lvl+0xe8/0x150 [ 2032.332812][ C0] print_report+0xba/0x230 [ 2032.332827][ C0] ? rose_t0timer_expiry+0x1ea/0x560 [ 2032.332846][ C0] kasan_report+0x117/0x150 [ 2032.332864][ C0] ? rose_t0timer_expiry+0x1ea/0x560 [ 2032.332886][ C0] rose_t0timer_expiry+0x1ea/0x560 [ 2032.332906][ C0] call_timer_fn+0x192/0x5a0 [ 2032.332928][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 2032.332946][ C0] ? call_timer_fn+0xd4/0x5a0 [ 2032.332972][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 2032.332997][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 2032.333015][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 2032.333035][ C0] __run_timer_base+0x652/0x8b0 [ 2032.333054][ C0] ? ktime_get+0x45/0x200 [ 2032.333075][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 2032.333096][ C0] ? sched_clock_cpu+0x74/0x440 [ 2032.333119][ C0] run_timer_softirq+0xb7/0x170 [ 2032.333138][ C0] handle_softirqs+0x22a/0x7c0 [ 2032.333154][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 2032.333170][ C0] __irq_exit_rcu+0x5f/0x150 [ 2032.333183][ C0] irq_exit_rcu+0x9/0x30 [ 2032.333196][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2032.333216][ C0] [ 2032.333221][ C0] [ 2032.333228][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2032.333244][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2032.333265][ C0] Code: 48 60 02 e9 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 69 11 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 2032.333278][ C0] RSP: 0018:ffffffff8e207dc0 EFLAGS: 00000246 [ 2032.333294][ C0] RAX: 00000000004ef159 RBX: ffffffff8199370d RCX: 0000000080000001 [ 2032.333305][ C0] RDX: 0000000000000001 RSI: ffffffff8dcd0dbb RDI: ffffffff8c073a00 [ 2032.333316][ C0] RBP: ffffffff8e207eb0 R08: ffff8880b86336db R09: 1ffff110170c66db [ 2032.333327][ C0] R10: dffffc0000000000 R11: ffffed10170c66dc R12: ffffffff8fef4870 [ 2032.333338][ C0] R13: 1ffffffff1c52a78 R14: 0000000000000000 R15: 0000000000000000 [ 2032.333350][ C0] ? do_idle+0x1bd/0x500 [ 2032.333368][ C0] default_idle+0x9/0x20 [ 2032.333381][ C0] default_idle_call+0x72/0xb0 [ 2032.333395][ C0] do_idle+0x1bd/0x500 [ 2032.333407][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 2032.333428][ C0] ? __pfx_do_idle+0x10/0x10 [ 2032.333445][ C0] cpu_startup_entry+0x43/0x60 [ 2032.333458][ C0] rest_init+0x2de/0x300 [ 2032.333474][ C0] start_kernel+0x380/0x3d0 [ 2032.333496][ C0] x86_64_start_reservations+0x24/0x30 [ 2032.333513][ C0] x86_64_start_kernel+0x143/0x1c0 [ 2032.333529][ C0] common_startup_64+0x13e/0x147 [ 2032.333554][ C0] [ 2032.333559][ C0] [ 2032.615278][ C0] Allocated by task 26493: [ 2032.619877][ C0] kasan_save_track+0x3e/0x80 [ 2032.624678][ C0] __kasan_kmalloc+0x93/0xb0 [ 2032.629300][ C0] __kmalloc_cache_noprof+0x3d1/0x6e0 [ 2032.634804][ C0] rose_add_node+0x23c/0xf00 [ 2032.639493][ C0] rose_rt_ioctl+0xd35/0x12a0 [ 2032.644356][ C0] rose_ioctl+0x3fb/0x8f0 [ 2032.648816][ C0] sock_do_ioctl+0x101/0x320 [ 2032.653449][ C0] sock_ioctl+0x5c6/0x7f0 [ 2032.657807][ C0] __se_sys_ioctl+0xfc/0x170 [ 2032.662507][ C0] do_syscall_64+0xe2/0xf80 [ 2032.667033][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2032.672946][ C0] [ 2032.675275][ C0] Freed by task 0: [ 2032.678991][ C0] kasan_save_track+0x3e/0x80 [ 2032.683707][ C0] kasan_save_free_info+0x46/0x50 [ 2032.688734][ C0] __kasan_slab_free+0x5c/0x80 [ 2032.693506][ C0] kfree+0x1be/0x650 [ 2032.697490][ C0] rose_timer_expiry+0x4cb/0x600 [ 2032.702428][ C0] call_timer_fn+0x192/0x5a0 [ 2032.707028][ C0] __run_timer_base+0x652/0x8b0 [ 2032.711966][ C0] run_timer_softirq+0xb7/0x170 [ 2032.716820][ C0] handle_softirqs+0x22a/0x7c0 [ 2032.721582][ C0] __irq_exit_rcu+0x5f/0x150 [ 2032.726168][ C0] irq_exit_rcu+0x9/0x30 [ 2032.730411][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2032.736225][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2032.742298][ C0] [ 2032.744708][ C0] The buggy address belongs to the object at ffff88807e09f000 [ 2032.744708][ C0] which belongs to the cache kmalloc-512 of size 512 [ 2032.759027][ C0] The buggy address is located 24 bytes inside of [ 2032.759027][ C0] freed 512-byte region [ffff88807e09f000, ffff88807e09f200) [ 2032.772823][ C0] [ 2032.775270][ C0] The buggy address belongs to the physical page: [ 2032.781764][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807e09d400 pfn:0x7e09c [ 2032.791824][ C0] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2032.800417][ C0] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 2032.808921][ C0] page_type: f5(slab) [ 2032.812991][ C0] raw: 00fff00000000240 ffff88813fe26c80 ffffea0001582710 ffffea0001d70210 [ 2032.821575][ C0] raw: ffff88807e09d400 0000000000100005 00000000f5000000 0000000000000000 [ 2032.830158][ C0] head: 00fff00000000240 ffff88813fe26c80 ffffea0001582710 ffffea0001d70210 [ 2032.838829][ C0] head: ffff88807e09d400 0000000000100005 00000000f5000000 0000000000000000 [ 2032.847674][ C0] head: 00fff00000000002 ffffea0001f82701 00000000ffffffff 00000000ffffffff [ 2032.856517][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 2032.865354][ C0] page dumped because: kasan: bad access detected [ 2032.871761][ C0] page_owner tracks the page as allocated [ 2032.877471][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 31144, tgid 31138 (syz.4.8962), ts 926254937285, free_ts 925371178106 [ 2032.899013][ C0] post_alloc_hook+0x228/0x280 [ 2032.903788][ C0] get_page_from_freelist+0x24dc/0x2580 [ 2032.909332][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 2032.915142][ C0] alloc_pages_mpol+0x232/0x4a0 [ 2032.919991][ C0] allocate_slab+0x86/0x3a0 [ 2032.924507][ C0] ___slab_alloc+0xd82/0x1760 [ 2032.929271][ C0] __slab_alloc+0x65/0x100 [ 2032.933723][ C0] __kmalloc_cache_noprof+0x40d/0x6e0 [ 2032.939188][ C0] __ipv6_dev_mc_inc+0x44f/0xa50 [ 2032.944294][ C0] ipv6_add_dev+0xe43/0x13a0 [ 2032.948884][ C0] addrconf_notify+0x771/0x1050 [ 2032.953736][ C0] notifier_call_chain+0x19d/0x3a0 [ 2032.958844][ C0] register_netdevice+0x173a/0x1cf0 [ 2032.964153][ C0] register_netdev+0x40/0x60 [ 2032.968781][ C0] ip6gre_init_net+0x291/0x3c0 [ 2032.973635][ C0] ops_init+0x35c/0x5c0 [ 2032.977881][ C0] page last free pid 5837 tgid 5837 stack trace: [ 2032.984202][ C0] __free_frozen_pages+0xbf8/0xd70 [ 2032.989316][ C0] __slab_free+0x2ce/0x320 [ 2032.993735][ C0] qlist_free_all+0x97/0x100 [ 2032.998461][ C0] kasan_quarantine_reduce+0x148/0x160 [ 2033.003932][ C0] __kasan_slab_alloc+0x22/0x80 [ 2033.008780][ C0] kmem_cache_alloc_noprof+0x370/0x6e0 [ 2033.014243][ C0] getname_flags+0xb7/0x540 [ 2033.018763][ C0] __x64_sys_mkdirat+0x7a/0xa0 [ 2033.023547][ C0] do_syscall_64+0xe2/0xf80 [ 2033.028181][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2033.034175][ C0] [ 2033.036508][ C0] Memory state around the buggy address: [ 2033.042137][ C0] ffff88807e09ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2033.050205][ C0] ffff88807e09ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2033.058353][ C0] >ffff88807e09f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2033.066412][ C0] ^ [ 2033.071256][ C0] ffff88807e09f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2033.079590][ C0] ffff88807e09f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2033.087734][ C0] ================================================================== [ 2033.095860][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2033.103080][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 2033.112039][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 2033.122101][ C0] Call Trace: [ 2033.125390][ C0] [ 2033.128242][ C0] vpanic+0x1e0/0x670 [ 2033.132240][ C0] panic+0xc5/0xd0 [ 2033.135967][ C0] ? __pfx_panic+0x10/0x10 [ 2033.140474][ C0] ? rose_t0timer_expiry+0x1ea/0x560 [ 2033.145770][ C0] ? rose_t0timer_expiry+0x1ea/0x560 [ 2033.151209][ C0] check_panic_on_warn+0x89/0xb0 [ 2033.156154][ C0] ? rose_t0timer_expiry+0x1ea/0x560 [ 2033.161469][ C0] end_report+0x6f/0x140 [ 2033.165721][ C0] kasan_report+0x128/0x150 [ 2033.170226][ C0] ? rose_t0timer_expiry+0x1ea/0x560 [ 2033.175517][ C0] rose_t0timer_expiry+0x1ea/0x560 [ 2033.180636][ C0] call_timer_fn+0x192/0x5a0 [ 2033.185247][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 2033.190972][ C0] ? call_timer_fn+0xd4/0x5a0 [ 2033.195739][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 2033.200946][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 2033.206236][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 2033.211873][ C0] __run_timer_base+0x652/0x8b0 [ 2033.216821][ C0] ? ktime_get+0x45/0x200 [ 2033.221154][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 2033.226539][ C0] ? sched_clock_cpu+0x74/0x440 [ 2033.231487][ C0] run_timer_softirq+0xb7/0x170 [ 2033.236345][ C0] handle_softirqs+0x22a/0x7c0 [ 2033.241110][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 2033.245972][ C0] __irq_exit_rcu+0x5f/0x150 [ 2033.250560][ C0] irq_exit_rcu+0x9/0x30 [ 2033.254829][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2033.260476][ C0] [ 2033.263405][ C0] [ 2033.266342][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2033.272409][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2033.278408][ C0] Code: 48 60 02 e9 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 69 11 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 2033.298128][ C0] RSP: 0018:ffffffff8e207dc0 EFLAGS: 00000246 [ 2033.304305][ C0] RAX: 00000000004ef159 RBX: ffffffff8199370d RCX: 0000000080000001 [ 2033.312286][ C0] RDX: 0000000000000001 RSI: ffffffff8dcd0dbb RDI: ffffffff8c073a00 [ 2033.320262][ C0] RBP: ffffffff8e207eb0 R08: ffff8880b86336db R09: 1ffff110170c66db [ 2033.328367][ C0] R10: dffffc0000000000 R11: ffffed10170c66dc R12: ffffffff8fef4870 [ 2033.336537][ C0] R13: 1ffffffff1c52a78 R14: 0000000000000000 R15: 0000000000000000 [ 2033.344619][ C0] ? do_idle+0x1bd/0x500 [ 2033.348962][ C0] default_idle+0x9/0x20 [ 2033.353425][ C0] default_idle_call+0x72/0xb0 [ 2033.358187][ C0] do_idle+0x1bd/0x500 [ 2033.362260][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 2033.367552][ C0] ? __pfx_do_idle+0x10/0x10 [ 2033.372319][ C0] cpu_startup_entry+0x43/0x60 [ 2033.377131][ C0] rest_init+0x2de/0x300 [ 2033.381374][ C0] start_kernel+0x380/0x3d0 [ 2033.385885][ C0] x86_64_start_reservations+0x24/0x30 [ 2033.391521][ C0] x86_64_start_kernel+0x143/0x1c0 [ 2033.396639][ C0] common_startup_64+0x13e/0x147 [ 2033.401586][ C0] [ 2033.404771][ C0] Kernel Offset: disabled [ 2033.409105][ C0] Rebooting in 86400 seconds..