last executing test programs: 7m55.02328542s ago: executing program 4 (id=2982): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0xf, 0x6, 0x0) sendmsg$nl_route_sched(r1, &(0x7f000000a280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newtaction={0x48, 0x5a, 0x1, 0x4, 0xfffffffe, {0x2}, [{0x34, 0x1, [@m_csum={0x30, 0x13, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}]}, 0x48}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x4, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x100, r2, 0x400, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x9, 0x5e}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b4977d1a2c7d9f87c7d7099f38e28b83457b40a37567cbf6"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "4439099467ebb3ee9f858a8e824bbc021487db00bcba07ea"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "a24d04ec9c933911e8220e50033108477002ebeb6f37509e"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5}]}, 0x100}, 0x1, 0x0, 0x0, 0x50}, 0x4004810) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x1, &(0x7f0000000400)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x1e) unshare(0x6020400) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r8, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00), 0x8) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={0xffffffffffffffff, r8, 0x0, r7}, 0x10) write(r6, &(0x7f0000000080)="0b000300010001", 0x7) 7m54.088430591s ago: executing program 4 (id=2987): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000007d40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000004c0)={{r0, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000580)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r1}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000070000000000000020004008500000097000000b7080000000000007b8af8ff00000000b7080000ffffffff7b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) 7m53.776449594s ago: executing program 4 (id=2988): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@RTM_NEWMDB={0x38, 0x55, 0x1e5, 0x0, 0x0, {0x7, r1}, [@MDBA_SET_ENTRY={0x20, 0x1, {r1, 0x0, 0x3, 0x4, {@in6_addr=@local, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008004}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x1f, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc48}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x65, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x4, 0xf, 0x2, 0x20}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000240)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f00000002c0)=[{0x2, 0x4, 0x8, 0xb}], 0x10, 0x5}, 0x94) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b0}, 0x94) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x0, r5}, 0x18) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08d1ca4eb6b8b4889cdd4e786eb807e0"], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000340)={@fallback=r7, 0x35, 0x0, 0x6, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0], 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000380)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="30000000eb4b1e9991d601000000", @ANYRES32, @ANYRES32, @ANYBLOB, @ANYRES64=r8], 0x20) r9 = bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)=ANY=[@ANYRES32=r4, @ANYRES32=r6, @ANYBLOB="370600"/12, @ANYRES32=r9, @ANYBLOB, @ANYRES64=r8], 0x20) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1e000000ffff0000040000000500000000100000", @ANYRES64=r10, @ANYBLOB="792dffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000024000000020000000300000000000000004e9789759e8931f981189d4480fd9e000000000000004efe0f2b0be36a4a1b65e5ef179ae23b6ddd36de7a34206ab383f8c1ce35a521f07feb9cca7ecf7bca829dc3fb5c28e633abedb22b06be4e04c8a1f497192bf5265e876a03042eddc7db4c59e87dfb3a768e7684e4a3edf4fe22"], 0x50) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={@map=r11, r3, 0x24, 0x2000, r3, @value, @void, @void, @void, r8}, 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000740)={@map, 0xffffffffffffffff, 0x33, 0x10, 0x0, @void, @value, @void, @void, r8}, 0x20) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="16000000000000000084000001"], 0x48) r13 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r13, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) connect$tipc(r13, &(0x7f0000000240)=@id={0x1e, 0x3, 0x0, {0x4e24, 0x3}}, 0x10) bpf$MAP_DELETE_ELEM(0x15, &(0x7f0000000400)={r12, 0x0, 0x20000000, 0x4}, 0x20) r14 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_lsm={0x1d, 0x12, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffe}, [@printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @alu={0x4, 0x1, 0x5, 0xa, 0x4, 0xffffffffffffffc0, 0xffffffffffffffff}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0xf}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x4}]}, &(0x7f00000004c0)='syzkaller\x00', 0xfffffff9, 0x42, &(0x7f0000000500)=""/66, 0x40f00, 0x0, '\x00', r1, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x4, 0x0, 0x2, 0xe1a6}, 0x10, 0x0, 0x0, 0x5, &(0x7f00000005c0)=[0x1, 0xffffffffffffffff, 0x1], &(0x7f0000000600)=[{0x4, 0x3, 0x10, 0x7}, {0x3, 0x5, 0x4, 0x2}, {0x3, 0x2, 0x0, 0x8}, {0x4, 0x4, 0x10, 0x7}, {0x0, 0x5, 0xa, 0x1}], 0x10, 0x2}, 0x94) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000003c0)={@map=r12, r2, 0x2c, 0x0, 0x0, @void, @value=r14, @void, @void, r8}, 0x20) 7m52.36562044s ago: executing program 4 (id=2996): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0xf, 0x6, 0x0) sendmsg$nl_route_sched(r1, &(0x7f000000a280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newtaction={0x48, 0x5a, 0x1, 0x4, 0xfffffffe, {0x2}, [{0x34, 0x1, [@m_csum={0x30, 0x13, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}]}, 0x48}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x4, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x7d}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000300)={0x100, r2, 0x400, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x9, 0x5e}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "b4977d1a2c7d9f87c7d7099f38e28b83457b40a37567cbf6"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "4439099467ebb3ee9f858a8e824bbc021487db00bcba07ea"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "a24d04ec9c933911e8220e50033108477002ebeb6f37509e"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_4ADDR={0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5}]}, 0x100}, 0x1, 0x0, 0x0, 0x50}, 0x4004810) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x1, &(0x7f0000000400)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x1e) unshare(0x6020400) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r8, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00), 0x8) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={0xffffffffffffffff, r8, 0x0, r7}, 0x10) write(r6, &(0x7f0000000080)="0b000300010001", 0x7) 7m51.531894497s ago: executing program 4 (id=2998): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@bridge_newvlan={0x24, 0x70, 0x1, 0x70bd2a, 0x25dfdbfb, {0x7, 0x0, 0x0, r1}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x21, 0x3}}}]}, 0x24}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a05000000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000040900010073797a30000000000900030073797a320000000058000000060a011500000000000000000100000208000b4000000000300004802c0001800b00010065787468647200001c000280080001400000000c050002000700000008000640000000020900010073797a3000000000140000001100010000000000000000000700000a"], 0xcc}, 0x1, 0x0, 0x0, 0x8000}, 0x24000810) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r2}, 0x11) r4 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r4, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4005}, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000040)=ANY=[@ANYRES8=r4, @ANYRES8=r2, @ANYRESHEX=r4], 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0900000005000000000200004000000000000000", @ANYBLOB="24e39362", @ANYRES8=r5], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000003c0), 0x7fff, r7}, 0x38) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f00000001c0)={r7, &(0x7f0000000080), &(0x7f0000000180)=""/29}, 0x20) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r6, @ANYBLOB="050424bd7000fedbdf250100000008000100", @ANYRES32=r8, @ANYBLOB="8400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e6365"], 0xa0}, 0x1, 0x0, 0x0, 0x4040800}, 0x24040084) socket$netlink(0x10, 0x3, 0xb) accept(r5, &(0x7f0000000200)=@l2={0x1f, 0x0, @none}, &(0x7f0000000000)=0x80) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl1\x00', r8, 0x2f, 0x4, 0x24, 0x3, 0x69, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x20, 0x7800, 0x6, 0x5}}) syz_emit_ethernet(0x5e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6000000000280600fc000000000000000000000000000000ff0200000000000000000000000000014e244001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a002000090780000000e06e2d4c3d9080a00000003ffffffff000000bffc07417d0af779a7da61f29ef143956cde2a7526ee6a9113829bfa25b4c887e91e86e315fc41e497d7c43e26106226f0c6e258b237b76db0f0e2263b0c49b90d28842d89af1277535f1003e7c28c30b43736ef251efb8f092de3830d722ef6f7d5c36f93cf9e03793e9fbd8b412e566771905d3d5f97a744828585a5fbeacb6e446f1d8d766f374c4f40942c91d4280806f1c95d0a7475d27f2c2cae0eb80c58d9ea9bbe59f56b518aae755bf5c910ef5131a9debbe5481a5332aa49ed5119cc439bc2d12406d35eae57ba8421170fb6bb94dba3e1dc938c5c5bbd456b6c94aaca55686173603e883dbfc6fff4734b9aa514b7ae723b8cb20d643a44b4d7714f6fc03fffd0393e8c32df3d74686a1052a7deee42c3ca12471a99ac9e8da420db24d5c93f9884beb0b851903bdeb29b42ceeaf876896db7261c6a3cb316ccfe93489c294a4d4376a8f219f5268537336f10292068dbe0d29832e8c007e2debae476b588cad40950374096bb3a77d2cca573"], 0x0) 7m50.622937022s ago: executing program 4 (id=3001): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000010005fba00000000000000e500000060", @ANYRES32=0x0, @ANYBLOB="800002000800000008001b000000000008"], 0x30}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000000100)={0x14, r0, 0x1, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x12) 7m35.442021443s ago: executing program 32 (id=3001): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), 0xffffffffffffffff) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000010005fba00000000000000e500000060", @ANYRES32=0x0, @ANYBLOB="800002000800000008001b000000000008"], 0x30}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000000100)={0x14, r0, 0x1, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x12) 10.723444763s ago: executing program 2 (id=6024): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x80, 0x7800, 0x800, 0x3, {{0x1d, 0x4, 0x1, 0x1e, 0x74, 0x64, 0x0, 0x4, 0x2f, 0x0, @multicast1, @multicast1, {[@ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x1c, 0xa6, 0x3, 0x0, [{@loopback, 0x5e4}, {@broadcast, 0x8}, {@local, 0x6b}]}, @lsrr={0x83, 0x1f, 0xdf, [@local, @dev={0xac, 0x14, 0x14, 0x23}, @local, @dev={0xac, 0x14, 0x14, 0x17}, @local, @multicast2, @rand_addr=0x64010100]}, @cipso={0x86, 0x1a, 0x2, [{0x1, 0x5, "1783e1"}, {0xcbb2d0b6a093a690, 0x2}, {0x6, 0x6, "8a440a73"}, {0x6, 0x7, "5564cc85f1"}]}, @ra={0x94, 0x4}]}}}}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xfffff7ff}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x80820}, 0xc0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="02eb0000000000000000", @ANYRES32=r0, @ANYRES32, @ANYBLOB="00000000010000000300"/28], 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000006040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000068000000060a010400000000000000000500400008000b4000000000400004803c0001800b00010074756e6e656c00002c0002800800034000000000080001400000000108000340000000020800014000000000080002400000000c0900010073797a30"], 0x5d54}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000003c0)='cubic', 0xb) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_buf(r5, 0x107, 0x1, &(0x7f0000000500)="0482aeb79f5cc605f3f10192bf28", 0xe) accept4(r4, 0x0, 0x0, 0x80000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x1b, &(0x7f00000000c0)={@empty, 0x1, 0x2}, 0x20) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="700000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0580040000000000500012800b00010067656e657665000040000280050008000000000005000d000100"], 0x70}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x3b, 0xfd08, &(0x7f0000000180)="5ae02efc442000000000000000c723fa03faf2acdc0f9d5af8015b0abe92772c580d85e0dfa999ceaef773ead243c07350d9156d0ecc6a43edaeaa20fbf448d756e97a49901cf5", &(0x7f0000000140)=""/24, 0x0, 0x0, 0x37, 0x21}, 0x28) 9.62767339s ago: executing program 2 (id=6032): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="4400000010000104000002feffffff0200000000", @ANYRES32=0x0, @ANYBLOB="0386010000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x44}, 0x1, 0x0, 0x0, 0x20004885}, 0x4054) 9.057820751s ago: executing program 2 (id=6034): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000080)=@ethtool_coalesce={0xe, 0x10, 0x6, 0x6, 0x9, 0x5d3b51a8, 0xd0dc, 0x6, 0x5, 0x3, 0x0, 0x4, 0xf, 0x80000000, 0x8000, 0x49, 0x9, 0x3ff, 0x400, 0x4, 0x200, 0x6, 0x9}}) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00005d5000/0x3000)=nil, 0x3000, 0x0, 0x13, r4, 0x3000) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r5, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000040)={0x0, 'rose0\x00', {0x2}, 0x94}) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0x1000) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) bind$packet(r6, &(0x7f0000000140)={0x11, 0x5, r7, 0x1, 0x8}, 0x14) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r4, 0x84, 0x7, &(0x7f0000000280)={0x6fd}, 0x4) r9 = socket$packet(0x11, 0x2, 0x300) bind$packet(r9, &(0x7f0000000000)={0x11, 0x6, r7, 0x1, 0x4}, 0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r7, {0x7, 0xa}, {0xd, 0xc}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r10, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0xd, 0x28011, r0, 0x4000) 8.584434286s ago: executing program 2 (id=6035): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$netlink(0x10, 0x3, 0x4) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000"], 0x48) listen(0xffffffffffffffff, 0x568) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000010c0)=ANY=[], 0x54}}, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000d00), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b0000"], 0x7c}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000001380)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000c80)={&(0x7f0000001880)={0x2bc, r4, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3f7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7ff}]}, @TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x353}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x641}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}]}, @TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x12, 0x1, @l2={'ib', 0x3a, 'syzkaller0\x00'}}]}, @TIPC_NLA_NODE={0xd4, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "4fd0339d058c902c5e3f2552b71d6e3083d2c734"}}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "26e118bf602a3c412e176046045a2a0e11ebc389b8ea8263fc60"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "0e696d917b32a0066b41de70bbf75911bbf82f32821af43d"}}]}, @TIPC_NLA_MEDIA={0xbc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcd8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xac}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x150cf89e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1633}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc637}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x35c5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x14d}]}, @TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x19c}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x6}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x2bc}, 0x1, 0x0, 0x0, 0x40}, 0x200040c0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11000000040000000400000022"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000002c0)={r6, &(0x7f0000000540)}, 0x20) ppoll(&(0x7f0000000500)=[{r1}], 0x1, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1d, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009f00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$int_in(r0, 0x5421, &(0x7f0000000100)=0x5) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081002000bfa30000000000000703000000feffff720af3fef8ffffff71a400fe000000007110100000000000e5000600000000004704000001ed030407030000060000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 7.838785512s ago: executing program 1 (id=6042): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9c, 0x9c, 0x2, [@union={0xf, 0xa, 0x0, 0x5, 0x1, 0x3, [{0x4, 0x0, 0x101}, {0x3, 0x4, 0xf85c}, {0x4, 0x2, 0x10001}, {0x4, 0x5, 0x6}, {0x5, 0x2, 0x8}, {0x5, 0x1, 0x3}, {0xe, 0x0, 0x101}, {0xf, 0x0, 0x2}, {0x3, 0x3, 0x5}, {0x2, 0x0, 0xa}]}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}}, 0x0, 0xb6, 0x0, 0x1}, 0x28) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r0}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x5e, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42, 0x0, 0x0, 0x10, 0x80}, 0x94) unshare(0x62040200) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x82, &(0x7f00000007c0)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000088a800442f00fc000000000000000000000000000000ff02000000000000000000000000000124203bc5494cc63aafbbdd4a22eb0000000000000800000086dd080088be86ddffff100000000100000000000000080022eb000000002000e0000200000000000000000000000800655800000000a6991b7f42a4879f1fd33690f4"], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)={0x1b, 0x0, 0x0, 0x1e2, 0x0, 0xffffffffffffffff, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x7}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{}, &(0x7f00000001c0), &(0x7f00000002c0)='%pi6 \x00'}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0x11, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0xffff2c09}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@map_idx={0x18, 0xa, 0x5, 0x0, 0x800a}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002abd7000fcdbdf2507000000080001000100000008000500020000000a0004007770616e2300aae3becaaeaa0000"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r3, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x300000d, 0x6052, r8, 0x83a06000) ioctl$SIOCAX25NOUID(r8, 0x89e3, &(0x7f0000000440)=0x1) listen(r7, 0x0) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) 6.916186734s ago: executing program 5 (id=6044): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000140)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0xb, 0x2, 0xb, 0x8c, 0xb, 0x4, 0x4, 0x5, 0xa, 0xf, 0x10, 0x2, 0xd, 0x8, 0x5, 0xc], 0x1, [0x9, 0x67ef, 0xfffe, 0x4, 0x4, 0x8, 0x3, 0xfff9, 0x9, 0x4, 0x6, 0x200, 0x10, 0x0, 0xc73, 0x5], [0x800, 0x1, 0x7, 0x3d3e, 0xff, 0x4, 0x2, 0x50ad, 0x81, 0xc5, 0x8002, 0x3, 0x2, 0x7, 0x8, 0xce]}}}}]}, 0x88}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'veth0_macvtap\x00', 0x0}) sendmmsg$inet(r3, &(0x7f0000002240)=[{{&(0x7f0000000040)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000180)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @local, @loopback}}}], 0x20}}], 0x1, 0x0) 6.565727259s ago: executing program 2 (id=6047): syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), 0xffffffffffffffff) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x5, 0xfffffffb}, 0x10) r1 = socket$inet(0x2, 0x80001, 0x84) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r2, 0x1) socket(0x15, 0x800, 0x200) connect$bt_rfcomm(r2, 0x0, 0x0) listen(0xffffffffffffffff, 0x3) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) bind$inet(r1, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) listen(r1, 0x3) listen(r1, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000901000000000000000005000000000800040001000000", 0x24) 6.385459389s ago: executing program 5 (id=6049): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$tipc(0x1e, 0x5, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b000000000000000000000000803bb80000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x3, 0x8, &(0x7f00000002c0)="b80000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, 0x0, 0x4000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socket(0xa, 0x3, 0xfc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x48}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="a77aef6cfed542deb203c536200000000706010800"/32], 0x20}}, 0x20000001) read(r5, &(0x7f00000003c0)=""/68, 0x44) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="100000001014040027bd7000fbdb36e97cdb0a14b4a5ea7cb3ff84a4e1df25"], 0x10}, 0x1, 0x0, 0x0, 0x14}, 0x1) setsockopt$inet_tcp_int(r2, 0x29, 0x8, 0x0, 0x0) close(0x4) r7 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8924, &(0x7f0000001300)={'nr0\x00'}) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e120900210000000401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1, 0x0, 0x0, 0x2000000}, 0x0) unshare(0x6a040000) listen(r0, 0x1) 6.311288269s ago: executing program 2 (id=6050): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) unshare(0x6a040000) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x640100ff, 0x4e22, 0x3, 'ovf\x00', 0x1, 0x10000b7e, 0x70}, 0x2c) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000ed0759cb47cd90df41fa7a40c72a22dcc53a83731c39b01fceb7"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r3, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4f, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001200)=[{}], 0x8, 0x0, 0x0, 0x0, 0x37, 0x0, 0x8, 0x0, 0x0}}, 0x10) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x0, 0x8, 0x77}, {@remote, 0x4e20, 0x1, 0xcd}}, 0x44) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x5, &(0x7f0000000080)=0x7, 0x4) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@netrom={'nr', 0x0}, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x4e23, @local}, 0x10) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffffffffffff, 0x4}, 0x38) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r6 = socket$netlink(0x10, 0x3, 0x12) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x84, &(0x7f0000000180)={0x0, @in={{0x2, 0x4e24, @remote}}, 0xd, 0x7fff}, &(0x7f0000001040)=0x90) sendmmsg(r6, &(0x7f0000000800), 0x2, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, 0x0, 0x0) 3.093267328s ago: executing program 0 (id=6068): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000900)="a4", 0xffffffffffffffef, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @ipv4={'\x00', '\xff\xff', @remote}, 0x4000a}, 0x1c) 2.954639185s ago: executing program 0 (id=6069): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, 0x0, 0x800, 0x70bd26, 0x25dfdbff, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008008}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) unshare(0x22020400) (async) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000000)={r1, 0x0, 0x0}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r2 = socket(0x10, 0x3, 0x0) (rerun: 32) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x240, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x60, 0x0, 0x0, r4, {0x0, 0x3}, {0xffff, 0xffff}, {0x2, 0x7ff2}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x210, 0x2, {{0x5, [0x1, 0x9, 0xc, 0x4, 0xe, 0x8, 0x9, 0x6, 0x2, 0x8, 0x9, 0x2, 0xd, 0x7, 0x9, 0xd], 0x1, [0x9, 0x400, 0x800, 0x80, 0x8, 0x9, 0x8001, 0x7, 0x9, 0x4, 0x4, 0x100, 0x1, 0x2, 0x3ff, 0x9], [0x8001, 0x8, 0x5, 0x5, 0x2, 0x5, 0x100, 0x7, 0x6, 0x6, 0x40, 0xfffa, 0x7, 0x0, 0x9, 0xa]}, [@TCA_MQPRIO_MODE={0x6, 0x1, 0x1}, @TCA_MQPRIO_MODE={0x6, 0x1, 0x1}, @TCA_MQPRIO_MAX_RATE64={0x28, 0x4, 0x0, 0x1, [{0xc, 0x4, 0x7}, {0xc, 0x4, 0x3}, {0xc, 0x4, 0x67}]}, @TCA_MQPRIO_MAX_RATE64={0x1c, 0x4, 0x0, 0x1, [{0xc, 0x4, 0x5ee}, {0xc, 0x4, 0x24}]}, @TCA_MQPRIO_MAX_RATE64={0x34, 0x4, 0x0, 0x1, [{0xc, 0x4, 0x4}, {0xc, 0x4, 0x5}, {0xc, 0x4, 0x8000000000000001}, {0xc, 0x4, 0x2}]}, @TCA_MQPRIO_MIN_RATE64={0x70, 0x3, 0x0, 0x1, [{0xc, 0x3, 0xfff}, {0xc, 0x3, 0xc82}, {0xc, 0x3, 0x6}, {0xc, 0x3, 0x1}, {0xc, 0x3, 0x3}, {0xc, 0x3, 0x7f}, {0xc, 0x3, 0x6}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0xc}]}, @TCA_MQPRIO_MODE={0x6, 0x1, 0x1}, @TCA_MQPRIO_MIN_RATE64={0xb8, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x1ff}, {0xc, 0x3, 0x1c00}, {0xc, 0x3, 0x8}, {0xc, 0x3, 0x8}, {0xc, 0x3, 0x7}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0xf}, {0xc, 0x3, 0x2}, {0xc, 0x3, 0xd}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x2}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x400}]}]}}}]}, 0x240}}, 0x44040) (async, rerun: 64) r5 = socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 64) r6 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r7 = socket(0x400000000010, 0x3, 0x0) write(r7, &(0x7f0000000040)="3a03000019002551075c0165ff0ffc02802000030004000500e1000c0400070280000f00", 0x33a) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip_vti0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x8, 0x700, 0x0, 0x5, {{0xb, 0x4, 0x0, 0x5, 0x2c, 0x68, 0x0, 0x10, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, {[@rr={0x7, 0xb, 0x5a, [@broadcast, @dev={0xac, 0x14, 0x14, 0x1b}]}, @noop, @end, @lsrr={0x83, 0x7, 0x82, [@multicast2]}, @noop]}}}}}) setsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000200)={r8, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x28}}, 0xc) (async) getsockopt$XDP_MMAP_OFFSETS(r5, 0x11b, 0x1, &(0x7f0000000040), &(0x7f00000000c0)=0x80) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="400000000d0a010800000000000000000a0000010900020073797a31000000000900010073797131000000001400038006"], 0x40}}, 0xd1) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000001740)=ANY=[@ANYBLOB="cbaa00fea100000071101d000000000095"], &(0x7f0000000480)='syzkaller\x00', 0x5, 0x0, 0x0, 0x20800}, 0x94) 2.740869363s ago: executing program 0 (id=6070): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)={0x38, r1, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_SEC_DEVKEY={0x24, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_ID={0xc, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}]}]}, 0x38}}, 0x4000040) 2.684709439s ago: executing program 0 (id=6071): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000840), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000001c0)={0x64, r1, 0x1, 0xfffffffd, 0x25dfdbfc, {}, [@NL802154_ATTR_SEC_DEVKEY={0x2c, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0102}}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0xae4}, @NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8, 0x1, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'ip6_vti0\x00', 0x0}) r6 = gettid() socket$inet6_mptcp(0xa, 0x1, 0x106) r7 = socket(0x10, 0x803, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010000304f9fffffffedbfb2500007400", @ANYRES32=r5, @ANYBLOB="049c01000750050008001300", @ANYRES32=r6, @ANYBLOB], 0x28}, 0x1, 0x0, 0x0, 0x4802}, 0x0) 2.526622572s ago: executing program 0 (id=6072): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="2e00000010008188040f6fec59acbc0435a181003f00000003010000000000000e000d000d6ed60012801900121f", 0x2e}], 0x1}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000034000000030a010200000000000000000100fffc0900030073797a32000000000900010073797a300000000008000a40000000042c000000080a01080000000000000000010000000900020073797a32000004000900010073797a30"], 0xa8}}, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r4, {0x8, 0x7}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x2}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x1008}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000300)={"6e84b821a329c4a4b8dc15033aff7112", 0x0, 0x0, {0x5, 0xfffffffe}, {0x6, 0x1000}, 0x39ef, [0x8, 0x1, 0x1ff, 0x0, 0x561b, 0x3, 0x8, 0x3, 0x6, 0x10, 0x1cb3, 0x2, 0x80000000, 0x100000000, 0xa5, 0xffffffffff6f4796]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) sendmsg$inet(r6, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)="91", 0x1}], 0x1}, 0x805) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r8, @ANYRES32=r9, @ANYBLOB="0500"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r8}, &(0x7f00000006c0), &(0x7f0000000700)=r7}, 0x20) sendmsg$inet(r6, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000400)="55ad", 0x2}], 0x1}, 0x4c03) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000600)={0x0, 0x0, {0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000013c0)={{r1}, r5, 0x14, @unused=[0xfffffffffffffff8, 0x2, 0x3, 0x7], @devid=r10}) sendto$inet6(r0, &(0x7f0000000900), 0x0, 0x0, &(0x7f0000000180)={0xa, 0x2, 0xffff, @ipv4={'\x00', '\xff\xff', @remote}, 0x4000a}, 0x1c) 2.192565123s ago: executing program 0 (id=6074): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$tipc(0x1e, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/21], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0xfca804a0, 0x3, 0x8, &(0x7f00000002c0)="b80000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) socket(0xa, 0x3, 0xfc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x48}}, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="a77aef6cfed542deb203c536200000000706010800"/32], 0x20}}, 0x20000001) read(0xffffffffffffffff, &(0x7f00000003c0)=""/68, 0x44) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="100000001014040027bd7000fbdb36e97cdb0a14b4a5ea7cb3ff84a4e1df25"], 0x10}, 0x1, 0x0, 0x0, 0x14}, 0x1) setsockopt$inet_tcp_int(r1, 0x29, 0x8, 0x0, 0x0) close(0x4) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d083911000000000000a1180015000600142603600e1209002100feff0401a80016000400144006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) unshare(0x6a040000) listen(0xffffffffffffffff, 0x1) 2.096830762s ago: executing program 5 (id=6075): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000800000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) 1.669399265s ago: executing program 3 (id=6076): r0 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip_vti0\x00', 0x0, 0x780e, 0x700, 0x101, 0x9, {{0x8, 0x4, 0x1, 0x3, 0x20, 0x64, 0x0, 0xc, 0x4, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0xc, 0x28, 0x3, 0x8, [{@loopback, 0x6}]}]}}}}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r1}, 0x8) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$NL80211_CMD_GET_WOWLAN(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r3, 0x20, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x56}, @void, @val={0xc, 0x99, {0x6, 0x4}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x44800}, 0x20000010) (async) sendmsg$NL80211_CMD_GET_WOWLAN(r2, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, r3, 0x20, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x56}, @void, @val={0xc, 0x99, {0x6, 0x4}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x44800}, 0x20000010) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x6a00}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0xff, 0x4, 0x6, 0x6}, 0x4, r4}}]}, {0x4, 0xa}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x2000a804) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r4], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r4], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) 1.589078456s ago: executing program 5 (id=6077): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x80, 0x7800, 0x800, 0x3, {{0x1d, 0x4, 0x1, 0x1e, 0x74, 0x64, 0x0, 0x4, 0x2f, 0x0, @multicast1, @multicast1, {[@ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x1c, 0xa6, 0x3, 0x0, [{@loopback, 0x5e4}, {@broadcast, 0x8}, {@local, 0x6b}]}, @lsrr={0x83, 0x1f, 0xdf, [@local, @dev={0xac, 0x14, 0x14, 0x23}, @local, @dev={0xac, 0x14, 0x14, 0x17}, @local, @multicast2, @rand_addr=0x64010100]}, @cipso={0x86, 0x1a, 0x2, [{0x1, 0x5, "1783e1"}, {0xcbb2d0b6a093a690, 0x2}, {0x6, 0x6, "8a440a73"}, {0x6, 0x7, "5564cc85f1"}]}, @ra={0x94, 0x4}]}}}}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xfffff7ff}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x80820}, 0xc0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="02eb0000000000000000", @ANYRES32=r0, @ANYRES32, @ANYBLOB="00000000010000000300"/28], 0x50) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000006040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000068000000060a010400000000000000000500400008000b4000000000400004803c0001800b00010074756e6e656c00002c0002800800034000000000080001400000000108000340000000020800014000000000080002400000000c0900010073797a30"], 0x5d54}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f00000003c0)='cubic', 0xb) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_buf(r5, 0x107, 0x1, &(0x7f0000000500)="0482aeb79f5cc605f3f10192bf2813", 0xf) accept4(r4, 0x0, 0x0, 0x80000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x1b, &(0x7f00000000c0)={@empty, 0x1, 0x2}, 0x20) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="700000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0580040000000000500012800b00010067656e657665000040000280050008000000000005000d000100"], 0x70}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x3b, 0xfd08, &(0x7f0000000180)="5ae02efc442000000000000000c723fa03faf2acdc0f9d5af8015b0abe92772c580d85e0dfa999ceaef773ead243c07350d9156d0ecc6a43edaeaa20fbf448d756e97a49901cf5", &(0x7f0000000140)=""/24, 0x0, 0x0, 0x37, 0x21}, 0x28) 1.252840113s ago: executing program 3 (id=6078): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x2}]}]}}, 0x0, 0x2e, 0x0, 0x1}, 0x28) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010002"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000006172da7", @ANYRES32=r1, @ANYBLOB], 0x1c}}, 0x20000080) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x200, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4ac2d78a}}, 0x0, 0x0, 0x3f, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8) r8 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r8, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x33}}}, 0x18) connect$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f00000009c0)=@gcm_256={{0x303}, "0100", "acba84f0a6731f234db1dc7f39000080d00600000003a9f4f600000000400080", "129c9707", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) ioctl$int_in(r7, 0x5421, &(0x7f0000000140)=0x1) writev(r7, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) ioctl$SIOCAX25ADDFWD(r1, 0x89ea, &(0x7f0000000080)={@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}}) socket$inet_sctp(0x2, 0x5, 0x84) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) 683.91149ms ago: executing program 5 (id=6079): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000000ac14143b00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000000080000000000000000010000010000000044000500ac1414aa003100000000000000000000000000003200000002000000ac1414aa0000000000000000000000000600000004"], 0xfc}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@dev, 0x800, 0x0, 0x2000000000903, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) 665.428846ms ago: executing program 3 (id=6080): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x800) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e0000002ac1414aa0000000003"], 0x1c) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) 648.411419ms ago: executing program 1 (id=6081): pipe(&(0x7f0000000e00)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000980)=[{&(0x7f00000004c0)="18e41dbb2ed7", 0x6}, {&(0x7f0000000080)="846c95", 0x3}, {&(0x7f00000002c0)="de", 0x1}, {&(0x7f0000000580)="36a982a2a7", 0x5}, {&(0x7f0000000e40)="d9", 0x1}], 0x5, 0xc) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) 469.288886ms ago: executing program 1 (id=6082): r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'team_slave_0\x00', &(0x7f00000000c0)=@ethtool_channels={0x3d, 0x0, 0x2000000, 0x0, 0x4, 0x2, 0x2, 0x2}}) 469.132875ms ago: executing program 5 (id=6083): r0 = socket(0x840000000002, 0x3, 0x100) connect$inet(r0, &(0x7f0000000080)={0x2, 0xfff7, @remote}, 0x10) sendmmsg$inet(r0, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2b, 0x0, 0x0) 459.496653ms ago: executing program 3 (id=6084): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x9, 0x18, 0x8, 0x40, 0x42, 0x1, 0xfffffffd}, 0x50) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000001600)={r0, &(0x7f0000000580), 0x0}, 0x20) 358.332206ms ago: executing program 1 (id=6085): bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000008c0)={0xffffffffffffffff}, 0x4) 249.294491ms ago: executing program 1 (id=6086): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x2f, 0xaf, 0x1, 0x4, 0x23, @loopback, @empty, 0x1, 0x7, 0x0, 0x2}}) 248.951589ms ago: executing program 3 (id=6087): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000002280)={0x3, &(0x7f0000000280)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff00c}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @address_request={0x11, 0x0, 0x0, 0x8}}}}}, 0x0) syz_genetlink_get_family_id$smc(0x0, 0xffffffffffffffff) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, 0x0, 0x4004) 111.180658ms ago: executing program 3 (id=6088): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0xfffffff8, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x810) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x7fffe, {0x0, 0x0, 0x0, r4, {}, {0xb, 0xb}, {0x2, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x80, 0x808, 0x205, 0x1, 0xc}, 0xb, 0xffffffff, 0x5, 0x5, 0x9, 0x2, 0x9, 0xd, 0x1, 0x1, {0xffff1c72, 0x3, 0x1000, 0xfd, 0xfffffffe, 0x7583}}}}]}, 0x78}}, 0x8000) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000200)="bada30fbc99b5400040000ea0756a85d86dd775a2c78c540624409ab09f4ac40ab420e89", 0x24, 0x8040, &(0x7f00000001c0)={0x11, 0x88a8, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) 0s ago: executing program 1 (id=6089): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) kernel console output (not intermixed with test programs): 24207] CPU: 0 UID: 0 PID: 24207 Comm: syz.2.5312 Not tainted syzkaller #0 PREEMPT(full) [ 828.920750][T24207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 828.920764][T24207] Call Trace: [ 828.920774][T24207] [ 828.920784][T24207] dump_stack_lvl+0xe8/0x150 [ 828.920819][T24207] should_fail_ex+0x412/0x560 [ 828.920859][T24207] should_failslab+0xa8/0x100 [ 828.920886][T24207] kmem_cache_alloc_noprof+0x87/0x6e0 [ 828.920919][T24207] ? __netlink_lookup+0xc6/0x8b0 [ 828.920947][T24207] ? skb_clone+0x212/0x3a0 [ 828.920983][T24207] skb_clone+0x212/0x3a0 [ 828.921017][T24207] __netlink_deliver_tap+0x404/0x850 [ 828.921057][T24207] ? netlink_deliver_tap+0x2e/0x1b0 [ 828.921084][T24207] netlink_deliver_tap+0x19c/0x1b0 [ 828.921112][T24207] netlink_unicast+0x7e3/0x9b0 [ 828.921144][T24207] ? __pfx_netlink_unicast+0x10/0x10 [ 828.921170][T24207] ? netlink_sendmsg+0x650/0xb40 [ 828.921193][T24207] ? skb_put+0x11b/0x210 [ 828.921225][T24207] netlink_sendmsg+0x813/0xb40 [ 828.921261][T24207] ? __pfx_netlink_sendmsg+0x10/0x10 [ 828.921292][T24207] ? aa_sock_msg_perm+0xf1/0x1b0 [ 828.921322][T24207] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 828.921348][T24207] ? __pfx_netlink_sendmsg+0x10/0x10 [ 828.921373][T24207] ____sys_sendmsg+0xa68/0xad0 [ 828.921403][T24207] ? __might_fault+0xaf/0x130 [ 828.921443][T24207] ? __pfx_____sys_sendmsg+0x10/0x10 [ 828.921488][T24207] ? import_iovec+0x73/0xa0 [ 828.921526][T24207] ___sys_sendmsg+0x2a5/0x360 [ 828.921554][T24207] ? __lock_acquire+0x6b5/0x2cf0 [ 828.921590][T24207] ? __pfx____sys_sendmsg+0x10/0x10 [ 828.921666][T24207] ? __fget_files+0x2a/0x420 [ 828.921689][T24207] ? __fget_files+0x3a0/0x420 [ 828.921725][T24207] __x64_sys_sendmsg+0x1bd/0x2a0 [ 828.921758][T24207] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 828.921801][T24207] ? __pfx_ksys_write+0x10/0x10 [ 828.921846][T24207] do_syscall_64+0xe2/0xf80 [ 828.921872][T24207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.921894][T24207] ? trace_irq_disable+0x37/0x100 [ 828.921935][T24207] ? clear_bhb_loop+0x60/0xb0 [ 828.921962][T24207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 828.921983][T24207] RIP: 0033:0x7efe7839aeb9 [ 828.922002][T24207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 828.922021][T24207] RSP: 002b:00007efe7925b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 828.922045][T24207] RAX: ffffffffffffffda RBX: 00007efe78615fa0 RCX: 00007efe7839aeb9 [ 828.922063][T24207] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000003 [ 828.922078][T24207] RBP: 00007efe7925b090 R08: 0000000000000000 R09: 0000000000000000 [ 828.922092][T24207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 828.922106][T24207] R13: 00007efe78616038 R14: 00007efe78615fa0 R15: 00007ffe228d7f08 [ 828.922143][T24207] [ 828.956537][T24208] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5313'. [ 829.271308][T24208] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5313'. [ 829.301054][T24213] FAULT_INJECTION: forcing a failure. [ 829.301054][T24213] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 829.319467][T24208] IPv6: sit1: Disabled Multicast RS [ 829.325576][T24213] CPU: 1 UID: 0 PID: 24213 Comm: syz.0.5315 Not tainted syzkaller #0 PREEMPT(full) [ 829.325614][T24213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 829.325629][T24213] Call Trace: [ 829.325638][T24213] [ 829.325648][T24213] dump_stack_lvl+0xe8/0x150 [ 829.325681][T24213] should_fail_ex+0x412/0x560 [ 829.325713][T24213] _copy_from_iter+0x1d3/0x1670 [ 829.325753][T24213] ? rcu_is_watching+0x15/0xb0 [ 829.325775][T24213] ? __pfx__copy_from_iter+0x10/0x10 [ 829.325802][T24213] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 829.325846][T24213] ? netlink_sendmsg+0x650/0xb40 [ 829.325871][T24213] ? skb_put+0x11b/0x210 [ 829.325902][T24213] netlink_sendmsg+0x6c0/0xb40 [ 829.325937][T24213] ? __pfx_netlink_sendmsg+0x10/0x10 [ 829.325967][T24213] ? aa_sock_msg_perm+0xf1/0x1b0 [ 829.325996][T24213] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 829.326022][T24213] ? __pfx_netlink_sendmsg+0x10/0x10 [ 829.326047][T24213] ____sys_sendmsg+0xa68/0xad0 [ 829.326077][T24213] ? __might_fault+0xaf/0x130 [ 829.326116][T24213] ? __pfx_____sys_sendmsg+0x10/0x10 [ 829.326157][T24213] ? import_iovec+0x73/0xa0 [ 829.326192][T24213] ___sys_sendmsg+0x2a5/0x360 [ 829.326221][T24213] ? __lock_acquire+0x6b5/0x2cf0 [ 829.326255][T24213] ? __pfx____sys_sendmsg+0x10/0x10 [ 829.326322][T24213] ? __fget_files+0x2a/0x420 [ 829.326347][T24213] ? __fget_files+0x3a0/0x420 [ 829.326381][T24213] __x64_sys_sendmsg+0x1bd/0x2a0 [ 829.326415][T24213] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 829.326456][T24213] ? __pfx_ksys_write+0x10/0x10 [ 829.326499][T24213] do_syscall_64+0xe2/0xf80 [ 829.326525][T24213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.326545][T24213] ? trace_irq_disable+0x37/0x100 [ 829.326566][T24213] ? clear_bhb_loop+0x60/0xb0 [ 829.326598][T24213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.326619][T24213] RIP: 0033:0x7faf46d9aeb9 [ 829.326640][T24213] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 829.326659][T24213] RSP: 002b:00007faf47c1a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 829.326682][T24213] RAX: ffffffffffffffda RBX: 00007faf47015fa0 RCX: 00007faf46d9aeb9 [ 829.326698][T24213] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 829.326712][T24213] RBP: 00007faf47c1a090 R08: 0000000000000000 R09: 0000000000000000 [ 829.326726][T24213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 829.326739][T24213] R13: 00007faf47016038 R14: 00007faf47015fa0 R15: 00007ffccd744e38 [ 829.326774][T24213] [ 829.614825][T24208] sit1: entered allmulticast mode [ 829.624785][T24208] netlink: 'syz.3.5313': attribute type 13 has an invalid length. [ 829.703312][T24208] 8021q: adding VLAN 0 to HW filter on device bond0 [ 829.711796][T24208] 8021q: adding VLAN 0 to HW filter on device team0 [ 829.719726][T24208] batman_adv: batadv0: Interface activated: dummy0 [ 829.727178][T24208] batadv0: mtu less than device minimum [ 829.734816][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.747017][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.758633][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.770108][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.781973][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.793342][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.804641][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.816302][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 829.827590][T24208] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 830.510105][T24240] netlink: 'syz.5.5324': attribute type 6 has an invalid length. [ 830.680397][T24249] __nla_validate_parse: 1 callbacks suppressed [ 830.680420][T24249] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5325'. [ 830.743163][T24190] lo speed is unknown, defaulting to 1000 [ 831.205048][T24190] lo speed is unknown, defaulting to 1000 [ 831.495344][T24265] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5330'. [ 831.541440][T24265] team0: No ports can be present during mode change [ 831.661769][T24272] gretap3: entered promiscuous mode [ 831.788524][T24275] tipc: Enabling of bearer rejected, failed to enable media [ 831.967044][T24279] netlink: 'syz.0.5336': attribute type 1 has an invalid length. [ 833.230127][T24337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 833.301057][T24346] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5355'. [ 833.313551][T24337] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5352'. [ 833.366939][T24337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 833.414084][T24337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 833.427804][T24337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 833.545166][T24357] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5359'. [ 833.671865][T24360] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5357'. [ 833.815396][T24360] 8021q: adding VLAN 0 to HW filter on device bond6 [ 833.846617][T24369] bond6: Unable to set up delay as MII monitoring is disabled [ 833.914334][T24374] netlink: 'syz.0.5362': attribute type 6 has an invalid length. [ 834.008607][T24379] netlink: 'syz.0.5362': attribute type 6 has an invalid length. [ 834.197792][T24385] lo: entered allmulticast mode [ 834.214479][T24384] lo: left allmulticast mode [ 834.409581][T24388] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5365'. [ 834.557750][T24401] netlink: 'syz.2.5367': attribute type 2 has an invalid length. [ 834.565906][T24401] netlink: 'syz.2.5367': attribute type 11 has an invalid length. [ 834.574075][T24401] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5367'. [ 834.861829][T24404] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5368'. [ 835.167686][T24412] netlink: 52 bytes leftover after parsing attributes in process `syz.5.5370'. [ 835.260589][T24372] lo speed is unknown, defaulting to 1000 [ 835.717540][T24419] tipc: Resetting bearer [ 835.732419][T24422] Cannot find set identified by id 65534 to match [ 835.786332][T24372] lo speed is unknown, defaulting to 1000 [ 836.036672][T24429] lo: entered allmulticast mode [ 836.054394][T24428] lo: left allmulticast mode [ 836.286586][T24409] lo speed is unknown, defaulting to 1000 [ 836.570835][T24450] __nla_validate_parse: 1 callbacks suppressed [ 836.570870][T24450] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5381'. [ 836.718814][T24455] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5383'. [ 836.760744][T24456] netlink: 'syz.5.5382': attribute type 2 has an invalid length. [ 836.768840][T24409] lo speed is unknown, defaulting to 1000 [ 836.770904][T24456] netlink: 'syz.5.5382': attribute type 11 has an invalid length. [ 836.784008][T24456] netlink: 132 bytes leftover after parsing attributes in process `syz.5.5382'. [ 837.013461][T24459] macvtap0: entered allmulticast mode [ 837.019114][T24459] team0: entered allmulticast mode [ 837.027291][T24459] team_slave_0: entered allmulticast mode [ 837.033633][T24459] team_slave_1: entered allmulticast mode [ 837.041936][T24459] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 837.074186][T24459] team0: left allmulticast mode [ 837.084885][T24459] team_slave_0: left allmulticast mode [ 837.098842][T24459] team_slave_1: left allmulticast mode [ 837.548531][T24466] tipc: Resetting bearer [ 837.807740][T24476] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5390'. [ 837.836946][T24476] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5390'. [ 838.098462][T24478] vlan2: entered promiscuous mode [ 838.447696][T24493] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5394'. [ 838.492421][T24495] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5395'. [ 838.533019][T24495] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5395'. [ 838.577708][T24495] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5395'. [ 838.979541][T24507] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5399'. [ 839.834154][T24533] FAULT_INJECTION: forcing a failure. [ 839.834154][T24533] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 839.870089][T24533] CPU: 0 UID: 0 PID: 24533 Comm: syz.0.5404 Not tainted syzkaller #0 PREEMPT(full) [ 839.870120][T24533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 839.870133][T24533] Call Trace: [ 839.870142][T24533] [ 839.870152][T24533] dump_stack_lvl+0xe8/0x150 [ 839.870183][T24533] should_fail_ex+0x412/0x560 [ 839.870214][T24533] _copy_from_user+0x2d/0xb0 [ 839.870260][T24533] memdup_user+0x5e/0xd0 [ 839.870287][T24533] strndup_user+0x68/0xd0 [ 839.870313][T24533] bpf_uprobe_multi_link_attach+0x34e/0xf10 [ 839.870354][T24533] ? __pfx_bpf_uprobe_multi_link_attach+0x10/0x10 [ 839.870376][T24533] ? __fget_files+0x2a/0x420 [ 839.870402][T24533] ? __fget_files+0x2a/0x420 [ 839.870425][T24533] ? __fget_files+0x3a0/0x420 [ 839.870447][T24533] ? __fget_files+0x2a/0x420 [ 839.870475][T24533] ? bpf_prog_attach_check_attach_type+0x453/0x540 [ 839.870508][T24533] link_create+0x673/0x850 [ 839.870539][T24533] __sys_bpf+0x73b/0x920 [ 839.870564][T24533] ? __pfx___sys_bpf+0x10/0x10 [ 839.870603][T24533] ? ksys_write+0x242/0x270 [ 839.870636][T24533] ? __pfx_ksys_write+0x10/0x10 [ 839.870676][T24533] __x64_sys_bpf+0x7c/0x90 [ 839.870709][T24533] do_syscall_64+0xe2/0xf80 [ 839.870736][T24533] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.870757][T24533] ? trace_irq_disable+0x37/0x100 [ 839.870778][T24533] ? clear_bhb_loop+0x60/0xb0 [ 839.870805][T24533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 839.870826][T24533] RIP: 0033:0x7faf46d9aeb9 [ 839.870847][T24533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 839.870866][T24533] RSP: 002b:00007faf47bf9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 839.870890][T24533] RAX: ffffffffffffffda RBX: 00007faf47016090 RCX: 00007faf46d9aeb9 [ 839.870907][T24533] RDX: 0000000000000040 RSI: 0000200000000180 RDI: 000000000000001c [ 839.870921][T24533] RBP: 00007faf47bf9090 R08: 0000000000000000 R09: 0000000000000000 [ 839.870936][T24533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 839.870949][T24533] R13: 00007faf47016128 R14: 00007faf47016090 R15: 00007ffccd744e38 [ 839.870985][T24533] [ 840.410514][T24543] net_ratelimit: 12 callbacks suppressed [ 840.410536][T24543] openvswitch: netlink: IP tunnel dst address not specified [ 840.703065][T24549] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'filter' [ 840.843721][T24553] bridge0: port 4(batadv2) entered blocking state [ 840.874561][T24553] bridge0: port 4(batadv2) entered disabled state [ 840.887262][T24553] batadv2: entered allmulticast mode [ 840.907375][T24553] batadv2: entered promiscuous mode [ 841.133624][T24569] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 841.320067][ T36] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 841.329393][ T36] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 841.797454][T24582] Cannot find set identified by id 65534 to match [ 842.516109][T24537] lo speed is unknown, defaulting to 1000 [ 842.764381][T24593] __nla_validate_parse: 13 callbacks suppressed [ 842.764405][T24593] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5423'. [ 842.800103][T24593] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5423'. [ 842.844439][T12217] lo speed is unknown, defaulting to 1000 [ 843.312769][T24603] FAULT_INJECTION: forcing a failure. [ 843.312769][T24603] name failslab, interval 1, probability 0, space 0, times 0 [ 843.325512][T24603] CPU: 1 UID: 0 PID: 24603 Comm: syz.3.5428 Not tainted syzkaller #0 PREEMPT(full) [ 843.325542][T24603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 843.325556][T24603] Call Trace: [ 843.325566][T24603] [ 843.325575][T24603] dump_stack_lvl+0xe8/0x150 [ 843.325609][T24603] should_fail_ex+0x412/0x560 [ 843.325643][T24603] should_failslab+0xa8/0x100 [ 843.325670][T24603] kmem_cache_alloc_noprof+0x87/0x6e0 [ 843.325705][T24603] ? dst_alloc+0x105/0x170 [ 843.325743][T24603] dst_alloc+0x105/0x170 [ 843.325782][T24603] ip_route_input_rcu+0x23e5/0x3130 [ 843.325826][T24603] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 843.325872][T24603] ? __pfx_stack_trace_save+0x10/0x10 [ 843.325912][T24603] ? ipt_do_table+0x13d2/0x1630 [ 843.325934][T24603] ? kasan_save_track+0x4f/0x80 [ 843.325958][T24603] ? ip_route_input_noref+0xad/0x270 [ 843.325989][T24603] ip_route_input_noref+0x17c/0x270 [ 843.326021][T24603] ? __pfx_ip_route_input_noref+0x10/0x10 [ 843.326056][T24603] ? ipt_do_table+0x2b2/0x1630 [ 843.326080][T24603] ? __pfx_ipt_do_table+0x10/0x10 [ 843.326108][T24603] ip_rcv_finish_core+0x5af/0x1c00 [ 843.326145][T24603] ip_rcv_finish+0x14c/0x2f0 [ 843.326171][T24603] NF_HOOK+0x336/0x3c0 [ 843.326196][T24603] ? __pfx_ip_rcv_finish+0x10/0x10 [ 843.326217][T24603] ? NF_HOOK+0x9e/0x3c0 [ 843.326238][T24603] ? __pfx_NF_HOOK+0x10/0x10 [ 843.326263][T24603] ? __pfx_ip_rcv_finish+0x10/0x10 [ 843.326293][T24603] ? netif_receive_skb+0x102/0xbb0 [ 843.326315][T24603] ? __pfx_ip_rcv+0x10/0x10 [ 843.326336][T24603] netif_receive_skb+0x45b/0xbb0 [ 843.326365][T24603] ? __pfx_netif_receive_skb+0x10/0x10 [ 843.326388][T24603] ? skb_partial_csum_set+0x107/0x360 [ 843.326418][T24603] ? tun_rx_batched+0x185/0x790 [ 843.326445][T24603] tun_rx_batched+0x1de/0x790 [ 843.326476][T24603] ? __pfx_tun_rx_batched+0x10/0x10 [ 843.326500][T24603] ? tun_get_user+0x2669/0x3dd0 [ 843.326525][T24603] ? tun_get_user+0x2669/0x3dd0 [ 843.326553][T24603] ? tun_get_user+0x2354/0x3dd0 [ 843.326575][T24603] ? __local_bh_enable_ip+0xd0/0x130 [ 843.326600][T24603] ? tun_get_user+0x2669/0x3dd0 [ 843.326621][T24603] tun_get_user+0x2a78/0x3dd0 [ 843.326659][T24603] ? aa_file_perm+0x12d/0x1630 [ 843.326693][T24603] ? aa_file_perm+0x440/0x1630 [ 843.326721][T24603] ? __pfx_tun_get_user+0x10/0x10 [ 843.326747][T24603] ? __lock_acquire+0x6b5/0x2cf0 [ 843.326781][T24603] ? kstrtoull+0x12f/0x1d0 [ 843.326817][T24603] ? ref_tracker_alloc+0x363/0x4d0 [ 843.326856][T24603] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 843.326887][T24603] ? tun_get+0x1c/0x2f0 [ 843.326910][T24603] ? tun_get+0x1c/0x2f0 [ 843.326940][T24603] ? tun_get+0x1c/0x2f0 [ 843.326962][T24603] ? tun_get+0x1c/0x2f0 [ 843.326990][T24603] tun_chr_write_iter+0x113/0x200 [ 843.327018][T24603] vfs_write+0x61d/0xb90 [ 843.327060][T24603] ? __pfx_vfs_write+0x10/0x10 [ 843.327103][T24603] ? __fget_files+0x2a/0x420 [ 843.327138][T24603] ksys_write+0x150/0x270 [ 843.327173][T24603] ? __pfx_ksys_write+0x10/0x10 [ 843.327217][T24603] do_syscall_64+0xe2/0xf80 [ 843.327243][T24603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.327265][T24603] ? trace_irq_disable+0x37/0x100 [ 843.327286][T24603] ? clear_bhb_loop+0x60/0xb0 [ 843.327313][T24603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.327335][T24603] RIP: 0033:0x7fe10079aeb9 [ 843.327355][T24603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.327375][T24603] RSP: 002b:00007fe1016a3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 843.327399][T24603] RAX: ffffffffffffffda RBX: 00007fe100a15fa0 RCX: 00007fe10079aeb9 [ 843.327416][T24603] RDX: 000000000000004e RSI: 0000200000000280 RDI: 0000000000000004 [ 843.327430][T24603] RBP: 00007fe1016a3090 R08: 0000000000000000 R09: 0000000000000000 [ 843.327444][T24603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.327457][T24603] R13: 00007fe100a16038 R14: 00007fe100a15fa0 R15: 00007ffeb5bf94c8 [ 843.327494][T24603] [ 843.756868][T24537] lo speed is unknown, defaulting to 1000 [ 843.774340][T24538] lo speed is unknown, defaulting to 1000 [ 843.976243][T24608] netlink: 'syz.3.5430': attribute type 29 has an invalid length. [ 843.998711][T24608] netlink: 148 bytes leftover after parsing attributes in process `syz.3.5430'. [ 844.091856][T24605] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5429'. [ 844.119890][T24605] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5429'. [ 844.192639][T24538] lo speed is unknown, defaulting to 1000 [ 844.210189][T24598] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 844.907159][T24634] netlink: 'syz.2.5436': attribute type 1 has an invalid length. [ 845.052539][T24634] 8021q: adding VLAN 0 to HW filter on device bond11 [ 845.114879][T24636] bond11: (slave ip6gretap4): making interface the new active one [ 845.128905][T24636] bond11: (slave ip6gretap4): Enslaving as an active interface with an up link [ 845.507187][T24640] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5437'. [ 845.522615][T24640] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5437'. [ 845.622926][T24650] netlink: 'syz.3.5440': attribute type 83 has an invalid length. [ 845.684279][T24654] netlink: 'syz.0.5442': attribute type 2 has an invalid length. [ 845.703726][T24654] netlink: 'syz.0.5442': attribute type 11 has an invalid length. [ 845.724950][T24654] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5442'. [ 845.828427][T24657] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5444'. [ 846.584590][T24680] FAULT_INJECTION: forcing a failure. [ 846.584590][T24680] name failslab, interval 1, probability 0, space 0, times 0 [ 846.613820][T24680] CPU: 0 UID: 0 PID: 24680 Comm: syz.2.5450 Not tainted syzkaller #0 PREEMPT(full) [ 846.613851][T24680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 846.613865][T24680] Call Trace: [ 846.613874][T24680] [ 846.613883][T24680] dump_stack_lvl+0xe8/0x150 [ 846.613917][T24680] should_fail_ex+0x412/0x560 [ 846.613949][T24680] should_failslab+0xa8/0x100 [ 846.613977][T24680] kmem_cache_alloc_noprof+0x87/0x6e0 [ 846.614012][T24680] ? getname_kernel+0x5a/0x2f0 [ 846.614039][T24680] getname_kernel+0x5a/0x2f0 [ 846.614065][T24680] kern_path+0x1d/0x50 [ 846.614090][T24680] bpf_uprobe_multi_link_attach+0x3a6/0xf10 [ 846.614132][T24680] ? __pfx_bpf_uprobe_multi_link_attach+0x10/0x10 [ 846.614154][T24680] ? __fget_files+0x2a/0x420 [ 846.614181][T24680] ? __fget_files+0x2a/0x420 [ 846.614205][T24680] ? __fget_files+0x2a/0x420 [ 846.614233][T24680] ? bpf_prog_attach_check_attach_type+0x453/0x540 [ 846.614264][T24680] link_create+0x673/0x850 [ 846.614294][T24680] __sys_bpf+0x73b/0x920 [ 846.614317][T24680] ? __pfx___sys_bpf+0x10/0x10 [ 846.614355][T24680] ? ksys_write+0x242/0x270 [ 846.614389][T24680] ? __pfx_ksys_write+0x10/0x10 [ 846.614428][T24680] __x64_sys_bpf+0x7c/0x90 [ 846.614461][T24680] do_syscall_64+0xe2/0xf80 [ 846.614487][T24680] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.614519][T24680] ? trace_irq_disable+0x37/0x100 [ 846.614540][T24680] ? clear_bhb_loop+0x60/0xb0 [ 846.614565][T24680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.614586][T24680] RIP: 0033:0x7efe7839aeb9 [ 846.614606][T24680] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.614624][T24680] RSP: 002b:00007efe7925b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 846.614647][T24680] RAX: ffffffffffffffda RBX: 00007efe78615fa0 RCX: 00007efe7839aeb9 [ 846.614664][T24680] RDX: 0000000000000040 RSI: 0000200000000180 RDI: 000000000000001c [ 846.614678][T24680] RBP: 00007efe7925b090 R08: 0000000000000000 R09: 0000000000000000 [ 846.614691][T24680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.614704][T24680] R13: 00007efe78616038 R14: 00007efe78615fa0 R15: 00007ffe228d7f08 [ 846.614737][T24680] [ 846.956835][T24694] ip6gre1: entered promiscuous mode [ 846.962367][T24694] ip6gre1: entered allmulticast mode [ 847.198769][T24701] bond2: (slave ip6gretap5): speed changed to 0 on port 2 [ 847.207709][T24701] bond2: (slave ip6gretap5): Enslaving as a backup interface with an up link [ 847.389126][T24706] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5458'. [ 847.408121][T24706] bridge0: port 3(batadv1) entered blocking state [ 847.437769][T24706] bridge0: port 3(batadv1) entered disabled state [ 847.452198][T24706] batadv1: entered allmulticast mode [ 847.467539][T24706] batadv1: entered promiscuous mode [ 847.587601][T24713] netlink: 'syz.5.5461': attribute type 1 has an invalid length. [ 847.643641][T24713] 8021q: adding VLAN 0 to HW filter on device bond4 [ 847.666909][T24722] netlink: 'syz.2.5462': attribute type 2 has an invalid length. [ 847.675940][T24722] netlink: 'syz.2.5462': attribute type 11 has an invalid length. [ 847.689783][T24713] bond4: (slave ip6gretap2): making interface the new active one [ 847.700748][T24713] bond4: (slave ip6gretap2): Enslaving as an active interface with an up link [ 847.910446][ T36] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 847.919923][ T36] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 847.937423][T24730] __nla_validate_parse: 1 callbacks suppressed [ 847.937443][T24730] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5465'. [ 847.966458][T24730] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 847.977814][T24731] xt_l2tp: unknown flags: 51 [ 847.986810][T24733] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5467'. [ 848.076865][T24734] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 848.089277][T24730] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 848.202503][T24668] lo speed is unknown, defaulting to 1000 [ 848.340800][ T5829] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 848.593179][T24747] x_tables: duplicate underflow at hook 2 [ 848.652796][T24668] lo speed is unknown, defaulting to 1000 [ 849.411080][T24778] FAULT_INJECTION: forcing a failure. [ 849.411080][T24778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 849.501954][T24778] CPU: 1 UID: 0 PID: 24778 Comm: syz.2.5477 Not tainted syzkaller #0 PREEMPT(full) [ 849.501984][T24778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 849.501999][T24778] Call Trace: [ 849.502008][T24778] [ 849.502018][T24778] dump_stack_lvl+0xe8/0x150 [ 849.502051][T24778] should_fail_ex+0x412/0x560 [ 849.502083][T24778] _copy_from_iter+0x1d3/0x1670 [ 849.502122][T24778] ? rcu_is_watching+0x15/0xb0 [ 849.502144][T24778] ? __pfx__copy_from_iter+0x10/0x10 [ 849.502169][T24778] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 849.502212][T24778] ? netlink_sendmsg+0x650/0xb40 [ 849.502236][T24778] ? skb_put+0x11b/0x210 [ 849.502267][T24778] netlink_sendmsg+0x6c0/0xb40 [ 849.502301][T24778] ? __pfx_netlink_sendmsg+0x10/0x10 [ 849.502330][T24778] ? aa_sock_msg_perm+0xf1/0x1b0 [ 849.502357][T24778] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 849.502383][T24778] ? __pfx_netlink_sendmsg+0x10/0x10 [ 849.502408][T24778] ____sys_sendmsg+0xa68/0xad0 [ 849.502437][T24778] ? __might_fault+0xaf/0x130 [ 849.502473][T24778] ? __pfx_____sys_sendmsg+0x10/0x10 [ 849.502511][T24778] ? import_iovec+0x73/0xa0 [ 849.502555][T24778] ___sys_sendmsg+0x2a5/0x360 [ 849.502583][T24778] ? __lock_acquire+0x6b5/0x2cf0 [ 849.502617][T24778] ? __pfx____sys_sendmsg+0x10/0x10 [ 849.502682][T24778] ? __fget_files+0x2a/0x420 [ 849.502705][T24778] ? __fget_files+0x3a0/0x420 [ 849.502737][T24778] __x64_sys_sendmsg+0x1bd/0x2a0 [ 849.502770][T24778] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 849.502812][T24778] ? __pfx_ksys_write+0x10/0x10 [ 849.502856][T24778] do_syscall_64+0xe2/0xf80 [ 849.502882][T24778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.502903][T24778] ? trace_irq_disable+0x37/0x100 [ 849.502924][T24778] ? clear_bhb_loop+0x60/0xb0 [ 849.502950][T24778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.502972][T24778] RIP: 0033:0x7efe7839aeb9 [ 849.502992][T24778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 849.503011][T24778] RSP: 002b:00007efe79219028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 849.503034][T24778] RAX: ffffffffffffffda RBX: 00007efe78616180 RCX: 00007efe7839aeb9 [ 849.503050][T24778] RDX: 0000000020048054 RSI: 0000200000000200 RDI: 0000000000000009 [ 849.503064][T24778] RBP: 00007efe79219090 R08: 0000000000000000 R09: 0000000000000000 [ 849.503078][T24778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 849.503091][T24778] R13: 00007efe78616218 R14: 00007efe78616180 R15: 00007ffe228d7f08 [ 849.503124][T24778] [ 849.805332][T24786] netlink: 'syz.3.5480': attribute type 33 has an invalid length. [ 849.826337][T24786] netlink: 152 bytes leftover after parsing attributes in process `syz.3.5480'. [ 850.300806][T24802] netlink: 'syz.0.5481': attribute type 2 has an invalid length. [ 850.311636][T24802] netlink: 'syz.0.5481': attribute type 11 has an invalid length. [ 850.334613][T24802] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5481'. [ 850.988929][T24790] lo speed is unknown, defaulting to 1000 [ 851.359654][T24790] lo speed is unknown, defaulting to 1000 [ 851.441550][T24786] lo speed is unknown, defaulting to 1000 [ 851.713337][T24786] lo speed is unknown, defaulting to 1000 [ 851.721686][T24805] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 852.048780][T24817] bridge0: entered promiscuous mode [ 852.080172][T24817] macsec0: entered promiscuous mode [ 852.090817][T24817] bridge0: port 4(macsec0) entered blocking state [ 852.101092][T24817] bridge0: port 4(macsec0) entered disabled state [ 852.118355][T24817] macsec0: entered allmulticast mode [ 852.138126][T24817] bridge0: entered allmulticast mode [ 852.153331][T24817] macsec0: left allmulticast mode [ 852.170879][T24817] bridge0: left allmulticast mode [ 852.196461][T24817] bridge0: left promiscuous mode [ 852.402314][T24824] syzkaller0: left promiscuous mode [ 852.407710][T24824] syzkaller0: left allmulticast mode [ 852.798810][T24838] vlan3: entered promiscuous mode [ 854.018252][T24873] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5504'. [ 854.246570][T24880] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5505'. [ 854.329140][T24883] FAULT_INJECTION: forcing a failure. [ 854.329140][T24883] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 854.355346][T24879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 854.380082][T24883] CPU: 0 UID: 0 PID: 24883 Comm: syz.3.5506 Not tainted syzkaller #0 PREEMPT(full) [ 854.380115][T24883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 854.380130][T24883] Call Trace: [ 854.380139][T24883] [ 854.380149][T24883] dump_stack_lvl+0xe8/0x150 [ 854.380182][T24883] should_fail_ex+0x412/0x560 [ 854.380214][T24883] _copy_from_user+0x2d/0xb0 [ 854.380249][T24883] __sys_sendto+0x2af/0x7a0 [ 854.380280][T24883] ? __pfx___sys_sendto+0x10/0x10 [ 854.380305][T24883] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 854.380344][T24883] ? __fget_files+0x3a0/0x420 [ 854.380380][T24883] ? ksys_write+0x242/0x270 [ 854.380413][T24883] ? __pfx_ksys_write+0x10/0x10 [ 854.380450][T24883] __x64_sys_sendto+0xde/0x100 [ 854.380482][T24883] do_syscall_64+0xe2/0xf80 [ 854.380507][T24883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 854.380528][T24883] ? trace_irq_disable+0x37/0x100 [ 854.380550][T24883] ? clear_bhb_loop+0x60/0xb0 [ 854.380576][T24883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 854.380597][T24883] RIP: 0033:0x7fe10079aeb9 [ 854.380616][T24883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 854.380636][T24883] RSP: 002b:00007fe1016a3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 854.380659][T24883] RAX: ffffffffffffffda RBX: 00007fe100a15fa0 RCX: 00007fe10079aeb9 [ 854.380676][T24883] RDX: 0000000000000001 RSI: 0000200000000900 RDI: 0000000000000003 [ 854.380689][T24883] RBP: 00007fe1016a3090 R08: 00002000000001c0 R09: 000000000000001c [ 854.380704][T24883] R10: 0000000020000045 R11: 0000000000000246 R12: 0000000000000001 [ 854.380718][T24883] R13: 00007fe100a16038 R14: 00007fe100a15fa0 R15: 00007ffeb5bf94c8 [ 854.380754][T24883] [ 854.914410][T24897] Cannot find set identified by id 65534 to match [ 855.373494][T24909] tipc: Resetting bearer [ 855.613277][T24912] netlink: 'syz.2.5516': attribute type 33 has an invalid length. [ 855.626143][T24912] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5516'. [ 855.913010][T24922] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5519'. [ 855.922421][T24922] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5519'. [ 855.973203][T24926] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 856.028704][T24926] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5521'. [ 856.071859][T24926] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 856.110452][T24926] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 856.123870][T24926] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 856.225845][T24934] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5524'. [ 856.331346][T24934] bond5: (slave veth1): Releasing active interface [ 856.662430][T24943] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5525'. [ 856.671871][T24943] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5525'. [ 856.696583][T24912] lo speed is unknown, defaulting to 1000 [ 856.888790][T24951] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5529'. [ 857.209321][T24912] lo speed is unknown, defaulting to 1000 [ 857.245877][T24968] netlink: 'syz.1.5535': attribute type 83 has an invalid length. [ 858.006202][T24970] syz_tun: entered allmulticast mode [ 858.101378][T24970] syz_tun (unregistering): left allmulticast mode [ 858.318837][T24961] lo speed is unknown, defaulting to 1000 [ 858.341905][T24990] FAULT_INJECTION: forcing a failure. [ 858.341905][T24990] name failslab, interval 1, probability 0, space 0, times 0 [ 858.356913][T24990] CPU: 1 UID: 0 PID: 24990 Comm: syz.0.5542 Not tainted syzkaller #0 PREEMPT(full) [ 858.356942][T24990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 858.356957][T24990] Call Trace: [ 858.356966][T24990] [ 858.356975][T24990] dump_stack_lvl+0xe8/0x150 [ 858.357009][T24990] should_fail_ex+0x412/0x560 [ 858.357041][T24990] should_failslab+0xa8/0x100 [ 858.357069][T24990] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 858.357103][T24990] ? __alloc_skb+0x1d0/0x7d0 [ 858.357128][T24990] ? __local_bh_enable_ip+0xd0/0x130 [ 858.357154][T24990] __alloc_skb+0x1d0/0x7d0 [ 858.357186][T24990] rose_write_internal+0x100/0x1b60 [ 858.357221][T24990] ? __pfx_rose_write_internal+0x10/0x10 [ 858.357240][T24990] ? __local_bh_enable_ip+0xd0/0x130 [ 858.357260][T24990] ? rose_route_free_lci+0x140/0x170 [ 858.357290][T24990] ? rose_connect+0x87b/0x1110 [ 858.357322][T24990] rose_connect+0x93b/0x1110 [ 858.357345][T24990] ? aa_sk_perm+0x15a/0x960 [ 858.357375][T24990] ? __might_fault+0xaf/0x130 [ 858.357411][T24990] ? __pfx_rose_connect+0x10/0x10 [ 858.357437][T24990] ? aa_af_perm+0x350/0x350 [ 858.357461][T24990] ? tomoyo_socket_connect_permission+0x163/0x290 [ 858.357501][T24990] ? bpf_lsm_socket_connect+0x9/0x20 [ 858.357529][T24990] __sys_connect+0x312/0x450 [ 858.357564][T24990] ? __pfx___sys_connect+0x10/0x10 [ 858.357604][T24990] ? __pfx_ksys_write+0x10/0x10 [ 858.357644][T24990] __x64_sys_connect+0x7a/0x90 [ 858.357672][T24990] do_syscall_64+0xe2/0xf80 [ 858.357697][T24990] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 858.357718][T24990] ? trace_irq_disable+0x37/0x100 [ 858.357740][T24990] ? clear_bhb_loop+0x60/0xb0 [ 858.357766][T24990] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 858.357788][T24990] RIP: 0033:0x7faf46d9aeb9 [ 858.357808][T24990] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 858.357828][T24990] RSP: 002b:00007faf47c1a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 858.357852][T24990] RAX: ffffffffffffffda RBX: 00007faf47015fa0 RCX: 00007faf46d9aeb9 [ 858.357868][T24990] RDX: 000000000000001c RSI: 0000200000000100 RDI: 0000000000000004 [ 858.357888][T24990] RBP: 00007faf47c1a090 R08: 0000000000000000 R09: 0000000000000000 [ 858.357902][T24990] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 858.357915][T24990] R13: 00007faf47016038 R14: 00007faf47015fa0 R15: 00007ffccd744e38 [ 858.357951][T24990] [ 858.886810][T24998] syzkaller0: entered promiscuous mode [ 858.892728][T24998] syzkaller0: entered allmulticast mode [ 858.926607][T24961] lo speed is unknown, defaulting to 1000 [ 859.238872][T25008] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 859.642193][T25023] vlan3: entered promiscuous mode [ 859.819257][T25032] netlink: 'syz.0.5558': attribute type 1 has an invalid length. [ 859.909669][T25032] 8021q: adding VLAN 0 to HW filter on device bond17 [ 859.926244][T25037] netlink: 'syz.2.5559': attribute type 3 has an invalid length. [ 859.934527][T25037] netlink: 'syz.2.5559': attribute type 3 has an invalid length. [ 860.047750][T25036] bond17: (slave ip6gretap7): making interface the new active one [ 860.061587][T25036] bond17: (slave ip6gretap7): Enslaving as an active interface with an up link [ 860.664596][T25056] __nla_validate_parse: 2 callbacks suppressed [ 860.664616][T25056] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5565'. [ 860.702567][T25059] netlink: 'syz.1.5568': attribute type 10 has an invalid length. [ 860.727891][T25059] bond0: (slave dummy0): Releasing backup interface [ 860.763864][T25062] netlink: 'syz.1.5568': attribute type 10 has an invalid length. [ 860.827780][T25059] dummy0: entered promiscuous mode [ 860.842193][T25059] team0: Port device dummy0 added [ 860.854327][T25005] lo speed is unknown, defaulting to 1000 [ 860.919107][T25062] dummy0: left promiscuous mode [ 861.001400][T25062] team0: Port device dummy0 removed [ 861.047729][T25062] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 861.057427][T25065] bond0: Error: Cannot enslave bond to itself. [ 861.069666][T25055] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 861.141167][T25071] netlink: 'syz.0.5570': attribute type 2 has an invalid length. [ 861.148975][T25071] netlink: 'syz.0.5570': attribute type 11 has an invalid length. [ 861.157847][T25071] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5570'. [ 861.242333][T25005] lo speed is unknown, defaulting to 1000 [ 861.711474][T25077] netlink: 'syz.1.5572': attribute type 13 has an invalid length. [ 861.721024][T25077] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5572'. [ 861.733707][T25079] netlink: 'syz.1.5572': attribute type 13 has an invalid length. [ 861.742850][T25077] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5572'. [ 861.819207][T25082] netlink: 'syz.2.5571': attribute type 83 has an invalid length. [ 861.892644][T25084] Cannot find set identified by id 65534 to match [ 862.092468][T25087] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 862.164038][T25097] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5577'. [ 862.336700][T25087] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 862.431051][T25105] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5577'. [ 862.445795][T25087] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 862.571826][T25107] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5578'. [ 862.592339][T25087] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 862.794416][ T2098] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.812566][T25113] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5581'. [ 862.868492][ T8742] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.992646][ T8162] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 863.002218][T25112] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 863.046628][ T8742] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 863.117135][T25117] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5582'. [ 863.267961][T25121] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5583'. [ 863.304664][T25116] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 863.470657][T25126] netlink: 'syz.3.5585': attribute type 2 has an invalid length. [ 863.478653][T25126] netlink: 'syz.3.5585': attribute type 11 has an invalid length. [ 863.636889][T25130] netlink: 'syz.2.5587': attribute type 1 has an invalid length. [ 863.682683][T25130] 8021q: adding VLAN 0 to HW filter on device bond12 [ 863.706005][T25134] bond13: entered allmulticast mode [ 863.739594][T25130] 8021q: adding VLAN 0 to HW filter on device bond14 [ 863.748651][T25134] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 863.845780][T25144] Unsupported ieee802154 address type: 0 [ 865.068270][T25179] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 866.695440][T25211] lo speed is unknown, defaulting to 1000 [ 866.964102][T25255] validate_nla: 6 callbacks suppressed [ 866.964124][T25255] netlink: 'syz.5.5625': attribute type 10 has an invalid length. [ 867.177272][T25211] lo speed is unknown, defaulting to 1000 [ 867.184814][T25259] netlink: 'syz.5.5626': attribute type 2 has an invalid length. [ 867.193070][T25259] netlink: 'syz.5.5626': attribute type 11 has an invalid length. [ 867.201171][T25259] __nla_validate_parse: 8 callbacks suppressed [ 867.201190][T25259] netlink: 132 bytes leftover after parsing attributes in process `syz.5.5626'. [ 867.782438][T25264] netlink: 'syz.0.5628': attribute type 6 has an invalid length. [ 867.955040][T25268] lo: entered allmulticast mode [ 867.962813][T25267] lo: left allmulticast mode [ 868.152577][T25271] Cannot find set identified by id 65534 to match [ 868.348591][T25277] trusted_key: syz.5.5633 sent an empty control message without MSG_MORE. [ 868.831467][T25289] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5636'. [ 868.855719][T25292] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5638'. [ 868.871972][T25289] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5636'. [ 868.949133][T25291] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 869.056587][T25298] syz_tun: entered allmulticast mode [ 869.065772][T25300] lo: entered allmulticast mode [ 869.076331][T25297] syz_tun: left allmulticast mode [ 869.083531][T25299] lo: left allmulticast mode [ 870.129145][T25332] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5652'. [ 870.160528][T25332] netlink: 60 bytes leftover after parsing attributes in process `syz.5.5652'. [ 870.193413][T25336] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5654'. [ 870.233993][T25336] bridge0: port 5(batadv3) entered blocking state [ 870.251613][T25336] bridge0: port 5(batadv3) entered disabled state [ 870.258396][T25336] batadv3: entered allmulticast mode [ 870.289991][T25336] batadv3: entered promiscuous mode [ 870.325747][T25338] bond4: option updelay: invalid value (18446744072924056005) [ 870.333576][T25338] bond4: option updelay: allowed values 0 - 2147483647 [ 870.348098][T25338] bond4 (unregistering): Released all slaves [ 870.361080][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 870.372349][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 870.381407][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 870.389471][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 870.397777][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 870.532686][T25345] netlink: 'syz.0.5657': attribute type 1 has an invalid length. [ 870.695086][T25345] 8021q: adding VLAN 0 to HW filter on device bond18 [ 870.721531][T25348] vlan2: entered promiscuous mode [ 870.742284][ T36] batman_adv: batadv3: No IGMP Querier present - multicast optimizations disabled [ 870.751764][ T36] batman_adv: batadv3: No MLD Querier present - multicast optimizations disabled [ 870.804795][T25358] bond18: (slave ip6gretap8): making interface the new active one [ 870.814719][T25358] bond18: (slave ip6gretap8): Enslaving as an active interface with an up link [ 870.940759][T25360] batman_adv: batadv0: Interface deactivated: dummy0 [ 870.997406][ T38] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 55120 - 0 [ 871.016798][T25362] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5661'. [ 871.024698][ T38] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 55120 - 0 [ 871.127389][ T8742] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.209211][ T38] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 55120 - 0 [ 871.235047][ T38] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 55120 - 0 [ 871.271596][ T8742] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.316199][T25370] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5665'. [ 871.327181][T25376] netlink: 'syz.5.5663': attribute type 33 has an invalid length. [ 871.335271][T25370] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5665'. [ 871.392305][ T8742] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.489098][ T8742] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 871.539666][T25361] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 871.573684][T25383] netlink: 'syz.0.5666': attribute type 83 has an invalid length. [ 871.900574][ T8742] batadv1: left allmulticast mode [ 871.912305][ T8742] batadv1: left promiscuous mode [ 871.917708][ T8742] bridge0: port 3(batadv1) entered disabled state [ 871.940485][ T8742] bridge_slave_1: left allmulticast mode [ 871.946211][ T8742] bridge_slave_1: left promiscuous mode [ 871.963760][ T8742] bridge0: port 2(bridge_slave_1) entered disabled state [ 871.992796][ T8742] bridge_slave_0: left allmulticast mode [ 872.003900][ T8742] bridge_slave_0: left promiscuous mode [ 872.015486][ T8742] bridge0: port 1(bridge_slave_0) entered disabled state [ 872.056898][ T8742] tipc: Resetting bearer [ 872.178518][T25389] Cannot find del_set index 4 as target [ 872.394310][ T8742] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 872.403690][ T8742] bond2 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 22:d8:2f:a1:91:dc - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 872.430109][ T5839] Bluetooth: hci2: command tx timeout [ 872.477450][ T8742] bond10 (unregistering): (slave ip6gretap3): Releasing active interface [ 872.572890][ T8742] bond11 (unregistering): (slave ip6gretap4): Releasing active interface [ 872.630590][ T8742] bond2 (unregistering): (slave ip6gretap5): Releasing backup interface [ 872.646316][T25392] netlink: 'syz.3.5667': attribute type 10 has an invalid length. [ 872.654642][T25392] __nla_validate_parse: 1 callbacks suppressed [ 872.654662][T25392] netlink: 2 bytes leftover after parsing attributes in process `syz.3.5667'. [ 872.674934][T25396] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5671'. [ 872.983804][ T8742] tipc: Disabling bearer [ 873.134735][ T8742] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 873.146594][ T8742] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 873.157998][ T8742] bond0 (unregistering): Released all slaves [ 873.272300][ T8742] bond1 (unregistering): (slave vlan2): Releasing active interface [ 873.282395][ T8742] bond1 (unregistering): Released all slaves [ 873.297321][ T8742] bond2 (unregistering): Released all slaves [ 873.423795][ T8742] bond3 (unregistering): Released all slaves [ 873.546450][ T8742] bond4 (unregistering): Released all slaves [ 873.666611][ T8742] bond5 (unregistering): Released all slaves [ 873.681376][ T8742] bond6 (unregistering): Released all slaves [ 873.695788][ T8742] bond7 (unregistering): Released all slaves [ 873.815880][ T8742] bond8 (unregistering): Released all slaves [ 873.830648][ T8742] bond9 (unregistering): Released all slaves [ 873.949477][ T8742] bond10 (unregistering): Released all slaves [ 874.065646][ T8742] bond11 (unregistering): Released all slaves [ 874.207591][ T8742] bond12 (unregistering): Released all slaves [ 874.222421][ T8742] bond13 (unregistering): Released all slaves [ 874.354626][ T8742] bond14 (unregistering): Released all slaves [ 874.371082][T25341] lo speed is unknown, defaulting to 1000 [ 874.380021][T25392] bond0: entered promiscuous mode [ 874.385119][T25392] bond_slave_0: entered promiscuous mode [ 874.400885][T25392] bond_slave_1: entered promiscuous mode [ 874.412690][T25392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 874.438116][T25392] bridge0: port 7(bond0) entered blocking state [ 874.445753][T25392] bridge0: port 7(bond0) entered disabled state [ 874.453374][T25392] bond0: entered allmulticast mode [ 874.458712][T25392] bond_slave_0: entered allmulticast mode [ 874.470337][T25392] bond_slave_1: entered allmulticast mode [ 874.502173][ T5839] Bluetooth: hci2: command tx timeout [ 874.643993][ T8742] tipc: Left network mode [ 874.725709][T25405] sctp: [Deprecated]: syz.0.5673 (pid 25405) Use of int in maxseg socket option. [ 874.725709][T25405] Use struct sctp_assoc_value instead [ 875.145980][T25341] lo speed is unknown, defaulting to 1000 [ 875.235637][T25415] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5676'. [ 875.241080][T25423] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5677'. [ 875.245216][T25415] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5676'. [ 875.328894][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 875.563891][T25421] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 875.757769][T25439] syzkaller0: entered promiscuous mode [ 875.765384][T25439] syzkaller0: entered allmulticast mode [ 875.892000][T25437] tipc: Enabled bearer , priority 0 [ 875.915962][T25435] tipc: Resetting bearer [ 875.927523][T25376] lo speed is unknown, defaulting to 1000 [ 875.939402][T25435] tipc: Disabling bearer [ 875.966258][T25446] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5680'. [ 876.005048][T25446] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5680'. [ 876.027876][T25341] chnl_net:caif_netlink_parms(): no params data found [ 876.049514][T25442] xt_CT: No such helper "snmp_trap" [ 876.129543][T25442] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5680'. [ 876.392869][T25450] tipc: Enabling of bearer rejected, failed to enable media [ 876.581891][ T5839] Bluetooth: hci2: command tx timeout [ 876.597274][T25376] lo speed is unknown, defaulting to 1000 [ 876.609490][T25341] bridge0: port 1(bridge_slave_0) entered blocking state [ 876.634791][T25341] bridge0: port 1(bridge_slave_0) entered disabled state [ 876.642310][T25341] bridge_slave_0: entered allmulticast mode [ 876.650357][T25341] bridge_slave_0: entered promiscuous mode [ 876.659182][T25341] bridge0: port 2(bridge_slave_1) entered blocking state [ 876.666593][T25341] bridge0: port 2(bridge_slave_1) entered disabled state [ 876.673973][T25341] bridge_slave_1: entered allmulticast mode [ 876.682184][T25341] bridge_slave_1: entered promiscuous mode [ 876.884196][T25341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 876.935937][T25341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 877.480596][T25341] team0: Port device team_slave_0 added [ 877.693492][T25341] team0: Port device team_slave_1 added [ 877.934743][T25495] netlink: 'syz.1.5692': attribute type 10 has an invalid length. [ 877.948864][T25341] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 877.980932][T25341] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 878.007515][T25495] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5692'. [ 878.040153][T25341] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 878.221363][T25341] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 878.237624][T25341] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 878.271774][T25341] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 878.536278][T25502] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5694'. [ 878.598198][ T8742] hsr_slave_0: left promiscuous mode [ 878.620299][ T8742] hsr_slave_1: left promiscuous mode [ 878.663157][ T5839] Bluetooth: hci2: command tx timeout [ 878.682207][ T8742] veth1_vlan: left promiscuous mode [ 878.702709][ T8742] veth0_vlan: left promiscuous mode [ 878.939611][ T8742] pimreg (unregistering): left allmulticast mode [ 879.803748][ T8742] team_slave_1 (unregistering): left promiscuous mode [ 879.813413][ T8742] team0 (unregistering): Port device team_slave_1 removed [ 879.854176][ T8742] team_slave_0 (unregistering): left promiscuous mode [ 879.862387][ T8742] team0 (unregistering): Port device team_slave_0 removed [ 880.228638][T25341] hsr_slave_0: entered promiscuous mode [ 880.238034][T25341] hsr_slave_1: entered promiscuous mode [ 880.245813][T25341] debugfs: 'hsr0' already exists in 'hsr' [ 880.252867][T25341] Cannot create hsr debugfs directory [ 880.265450][T25502] bridge0: port 6(batadv4) entered blocking state [ 880.272362][T25502] bridge0: port 6(batadv4) entered disabled state [ 880.279028][T25502] batadv4: entered allmulticast mode [ 880.286780][T25502] batadv4: entered promiscuous mode [ 880.541018][T25525] 8021q: adding VLAN 0 to HW filter on device bond4 [ 880.545040][T25529] netlink: 'syz.1.5697': attribute type 83 has an invalid length. [ 880.647771][T25533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5701'. [ 880.792395][ T8742] IPVS: stop unused estimator thread 0... [ 880.832885][ T38] batman_adv: batadv4: No IGMP Querier present - multicast optimizations disabled [ 880.842267][ T38] batman_adv: batadv4: No MLD Querier present - multicast optimizations disabled [ 881.022457][T25548] FAULT_INJECTION: forcing a failure. [ 881.022457][T25548] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 881.070728][T25548] CPU: 0 UID: 0 PID: 25548 Comm: syz.3.5703 Not tainted syzkaller #0 PREEMPT(full) [ 881.070759][T25548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 881.070774][T25548] Call Trace: [ 881.070783][T25548] [ 881.070793][T25548] dump_stack_lvl+0xe8/0x150 [ 881.070827][T25548] should_fail_ex+0x412/0x560 [ 881.070859][T25548] _copy_from_user+0x2d/0xb0 [ 881.070894][T25548] ___sys_sendmsg+0x1c6/0x360 [ 881.070923][T25548] ? __lock_acquire+0x6b5/0x2cf0 [ 881.070958][T25548] ? __pfx____sys_sendmsg+0x10/0x10 [ 881.071022][T25548] ? __fget_files+0x2a/0x420 [ 881.071046][T25548] ? __fget_files+0x3a0/0x420 [ 881.071080][T25548] __x64_sys_sendmsg+0x1bd/0x2a0 [ 881.071113][T25548] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 881.071153][T25548] ? __pfx_ksys_write+0x10/0x10 [ 881.071204][T25548] do_syscall_64+0xe2/0xf80 [ 881.071228][T25548] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.071245][T25548] ? trace_irq_disable+0x37/0x100 [ 881.071263][T25548] ? clear_bhb_loop+0x60/0xb0 [ 881.071283][T25548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 881.071300][T25548] RIP: 0033:0x7fe10079aeb9 [ 881.071316][T25548] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 881.071333][T25548] RSP: 002b:00007fe1016a3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 881.071353][T25548] RAX: ffffffffffffffda RBX: 00007fe100a15fa0 RCX: 00007fe10079aeb9 [ 881.071366][T25548] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 881.071378][T25548] RBP: 00007fe1016a3090 R08: 0000000000000000 R09: 0000000000000000 [ 881.071388][T25548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 881.071399][T25548] R13: 00007fe100a16038 R14: 00007fe100a15fa0 R15: 00007ffeb5bf94c8 [ 881.071427][T25548] [ 881.436847][T25548] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5703'. [ 881.755319][T25557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5705'. [ 881.883554][T25560] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5706'. [ 881.930491][T25560] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5706'. [ 882.282283][T25341] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 882.715180][T25341] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 882.876550][T25341] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 882.906905][T25341] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 883.019109][T25601] netlink: 'syz.0.5714': attribute type 83 has an invalid length. [ 883.165807][T25341] 8021q: adding VLAN 0 to HW filter on device bond0 [ 883.234196][T25341] 8021q: adding VLAN 0 to HW filter on device team0 [ 883.250732][T25607] Set syz0 is full, maxelem 0 reached [ 883.283878][ T8742] bridge0: port 1(bridge_slave_0) entered blocking state [ 883.291166][ T8742] bridge0: port 1(bridge_slave_0) entered forwarding state [ 883.344841][ T8742] bridge0: port 2(bridge_slave_1) entered blocking state [ 883.352116][ T8742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 883.472688][T25615] syzkaller0: entered promiscuous mode [ 883.486636][T25615] syzkaller0: entered allmulticast mode [ 883.873758][T25341] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 884.169493][T25341] veth0_vlan: entered promiscuous mode [ 884.216180][T25645] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5722'. [ 884.226049][T25341] veth1_vlan: entered promiscuous mode [ 884.348158][T25341] veth0_macvtap: entered promiscuous mode [ 884.381543][T25341] veth1_macvtap: entered promiscuous mode [ 884.461950][T25341] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 884.505041][T25341] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 884.541997][ T8742] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.570504][ T8742] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.623367][ T8742] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.645326][ T8742] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 884.680592][T25669] netlink: 51 bytes leftover after parsing attributes in process `syz.3.5727'. [ 884.949556][T25677] netlink: 'syz.1.5728': attribute type 11 has an invalid length. [ 884.979903][ T3645] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 885.002682][ T3645] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 885.124515][ T8742] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 885.153529][ T8742] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 885.245104][T25691] netlink: 'syz.0.5731': attribute type 12 has an invalid length. [ 885.253831][T25691] netlink: 'syz.0.5731': attribute type 29 has an invalid length. [ 885.268397][T25691] netlink: 148 bytes leftover after parsing attributes in process `syz.0.5731'. [ 885.553864][T25700] netlink: 'syz.2.5734': attribute type 1 has an invalid length. [ 886.053048][ T5829] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 886.064582][ T5829] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 886.073129][ T5829] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 886.093067][ T5829] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 886.101649][ T5829] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 886.207265][T25708] netlink: 'syz.5.5736': attribute type 1 has an invalid length. [ 886.525928][T25716] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5738'. [ 886.613880][T25716] netlink: 'syz.2.5738': attribute type 1 has an invalid length. [ 886.853366][T25713] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5738'. [ 887.313125][T25743] netlink: 'syz.2.5741': attribute type 1 has an invalid length. [ 887.499912][T25743] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 887.847463][T25669] lo speed is unknown, defaulting to 1000 [ 888.180214][ T5829] Bluetooth: hci1: command tx timeout [ 888.616106][T25669] lo speed is unknown, defaulting to 1000 [ 888.698130][T25703] lo speed is unknown, defaulting to 1000 [ 889.141562][T25781] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5744'. [ 889.200940][T25782] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5745'. [ 889.226434][T25781] team0: No ports can be present during mode change [ 889.649162][T25731] lo speed is unknown, defaulting to 1000 [ 889.688216][T25801] netlink: 'syz.5.5747': attribute type 2 has an invalid length. [ 889.696098][T25801] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5747'. [ 889.707347][T25801] netlink: 'syz.5.5747': attribute type 1 has an invalid length. [ 889.715272][T25801] netlink: 224 bytes leftover after parsing attributes in process `syz.5.5747'. [ 890.050347][T25703] lo speed is unknown, defaulting to 1000 [ 890.101314][T25731] lo speed is unknown, defaulting to 1000 [ 890.125473][T25812] team_slave_0: entered promiscuous mode [ 890.131451][T25812] team_slave_1: entered promiscuous mode [ 890.160651][T25812] vlan2: entered promiscuous mode [ 890.189989][T25812] team0: entered promiscuous mode [ 890.260860][ T5829] Bluetooth: hci1: command tx timeout [ 890.820581][T25833] xt_CT: No such helper "snmp_trap" [ 890.848719][T25833] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5753'. [ 890.978017][T25837] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5753'. [ 891.827192][T25847] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5757'. [ 892.155168][T25703] chnl_net:caif_netlink_parms(): no params data found [ 892.258322][T25858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5759'. [ 892.341824][ T5829] Bluetooth: hci1: command tx timeout [ 892.421245][T25863] netlink: 'syz.2.5760': attribute type 89 has an invalid length. [ 892.437437][T25864] netlink: 64 bytes leftover after parsing attributes in process `syz.5.5761'. [ 892.494601][T25863] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5760'. [ 892.504669][T25703] bridge0: port 1(bridge_slave_0) entered blocking state [ 892.521212][T25703] bridge0: port 1(bridge_slave_0) entered disabled state [ 892.538767][T25703] bridge_slave_0: entered allmulticast mode [ 892.550734][T25703] bridge_slave_0: entered promiscuous mode [ 892.580928][T25703] bridge0: port 2(bridge_slave_1) entered blocking state [ 892.589358][T25703] bridge0: port 2(bridge_slave_1) entered disabled state [ 892.599092][T25703] bridge_slave_1: entered allmulticast mode [ 892.607560][T25703] bridge_slave_1: entered promiscuous mode [ 892.702281][T25703] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 892.753476][T25703] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 892.801167][T25878] netlink: 'syz.2.5764': attribute type 2 has an invalid length. [ 892.818746][T25878] netlink: 'syz.2.5764': attribute type 11 has an invalid length. [ 892.834003][T25878] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5764'. [ 892.935874][T25703] team0: Port device team_slave_0 added [ 892.945839][T25703] team0: Port device team_slave_1 added [ 892.976735][T25703] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 892.984157][T25703] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 893.010962][T25703] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 893.025015][T25703] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 893.033420][T25703] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 893.060760][T25703] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 893.139470][T25703] hsr_slave_0: entered promiscuous mode [ 893.147228][T25703] hsr_slave_1: entered promiscuous mode [ 893.154253][T25703] debugfs: 'hsr0' already exists in 'hsr' [ 893.160751][T25703] Cannot create hsr debugfs directory [ 893.377037][T25703] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.453045][T25703] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.504028][T25889] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5767'. [ 893.516128][T25889] team0: No ports can be present during mode change [ 893.563127][T25703] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.693105][T25703] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 894.144103][T25703] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 894.169256][T25703] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 894.193912][T25908] netlink: 'syz.2.5776': attribute type 1 has an invalid length. [ 894.211361][T25703] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 894.281309][T25703] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 894.367192][T25914] syzkaller0: entered promiscuous mode [ 894.396292][T25914] syzkaller0: entered allmulticast mode [ 894.425774][ T5829] Bluetooth: hci1: command tx timeout [ 894.448431][T25925] netlink: 'syz.2.5779': attribute type 16 has an invalid length. [ 894.469892][T25925] netlink: 'syz.2.5779': attribute type 17 has an invalid length. [ 895.290823][T25925] bridge0: port 2(bridge_slave_1) entered disabled state [ 895.298604][T25925] bridge0: port 1(bridge_slave_0) entered disabled state [ 895.633170][T25925] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 895.663194][T25925] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 896.076019][T25944] __nla_validate_parse: 3 callbacks suppressed [ 896.076040][T25944] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5782'. [ 896.095740][ T7017] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.132325][ T7017] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.149930][ T7017] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.210067][ T7017] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 896.280613][T25948] : rxe_newlink: already configured on ipvlan0 [ 896.317237][T25952] openvswitch: netlink: IP tunnel dst address not specified [ 896.336042][T25951] netlink: 'syz.3.5786': attribute type 4 has an invalid length. [ 896.401185][T25703] 8021q: adding VLAN 0 to HW filter on device bond0 [ 896.413079][T25951] netlink: 152 bytes leftover after parsing attributes in process `syz.3.5786'. [ 896.439882][T25951] nbd: couldn't find a device at index 0 [ 896.458145][T25703] 8021q: adding VLAN 0 to HW filter on device team0 [ 896.466517][T25958] FAULT_INJECTION: forcing a failure. [ 896.466517][T25958] name failslab, interval 1, probability 0, space 0, times 0 [ 896.483580][T25958] CPU: 1 UID: 0 PID: 25958 Comm: syz.5.5789 Not tainted syzkaller #0 PREEMPT(full) [ 896.483609][T25958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 896.483623][T25958] Call Trace: [ 896.483632][T25958] [ 896.483642][T25958] dump_stack_lvl+0xe8/0x150 [ 896.483676][T25958] should_fail_ex+0x412/0x560 [ 896.483709][T25958] should_failslab+0xa8/0x100 [ 896.483736][T25958] kmem_cache_alloc_noprof+0x87/0x6e0 [ 896.483767][T25958] ? __netlink_lookup+0xc6/0x8b0 [ 896.483793][T25958] ? skb_clone+0x212/0x3a0 [ 896.483827][T25958] skb_clone+0x212/0x3a0 [ 896.483861][T25958] __netlink_deliver_tap+0x404/0x850 [ 896.483898][T25958] ? netlink_deliver_tap+0x2e/0x1b0 [ 896.483923][T25958] netlink_deliver_tap+0x19c/0x1b0 [ 896.483950][T25958] netlink_unicast+0x7e3/0x9b0 [ 896.483982][T25958] ? __pfx_netlink_unicast+0x10/0x10 [ 896.484005][T25958] ? netlink_sendmsg+0x650/0xb40 [ 896.484028][T25958] ? skb_put+0x11b/0x210 [ 896.484059][T25958] netlink_sendmsg+0x813/0xb40 [ 896.484094][T25958] ? __pfx_netlink_sendmsg+0x10/0x10 [ 896.484123][T25958] ? aa_sock_msg_perm+0xf1/0x1b0 [ 896.484150][T25958] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 896.484176][T25958] ? __pfx_netlink_sendmsg+0x10/0x10 [ 896.484200][T25958] ____sys_sendmsg+0xa68/0xad0 [ 896.484230][T25958] ? __might_fault+0xaf/0x130 [ 896.484270][T25958] ? __pfx_____sys_sendmsg+0x10/0x10 [ 896.484310][T25958] ? import_iovec+0x73/0xa0 [ 896.484346][T25958] ___sys_sendmsg+0x2a5/0x360 [ 896.484374][T25958] ? __lock_acquire+0x6b5/0x2cf0 [ 896.484409][T25958] ? __pfx____sys_sendmsg+0x10/0x10 [ 896.484480][T25958] ? __fget_files+0x2a/0x420 [ 896.484512][T25958] ? __fget_files+0x3a0/0x420 [ 896.484547][T25958] __x64_sys_sendmsg+0x1bd/0x2a0 [ 896.484582][T25958] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 896.484623][T25958] ? __pfx_ksys_write+0x10/0x10 [ 896.484669][T25958] do_syscall_64+0xe2/0xf80 [ 896.484694][T25958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.484716][T25958] ? trace_irq_disable+0x37/0x100 [ 896.484737][T25958] ? clear_bhb_loop+0x60/0xb0 [ 896.484763][T25958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.484785][T25958] RIP: 0033:0x7f945ef9aeb9 [ 896.484805][T25958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 896.484824][T25958] RSP: 002b:00007f945fe3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 896.484848][T25958] RAX: ffffffffffffffda RBX: 00007f945f215fa0 RCX: 00007f945ef9aeb9 [ 896.484865][T25958] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 896.484880][T25958] RBP: 00007f945fe3e090 R08: 0000000000000000 R09: 0000000000000000 [ 896.484894][T25958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 896.484908][T25958] R13: 00007f945f216038 R14: 00007f945f215fa0 R15: 00007fffe4d0cb48 [ 896.484944][T25958] [ 896.488396][ T2098] bridge0: port 1(bridge_slave_0) entered blocking state [ 896.777268][ T2098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 896.897395][T25964] bridge0: port 2(bridge_slave_1) entered blocking state [ 896.904679][T25964] bridge0: port 2(bridge_slave_1) entered forwarding state [ 896.989077][T25951] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5786'. [ 897.006454][T25973] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5791'. [ 897.843081][T25984] netlink: 228 bytes leftover after parsing attributes in process `syz.5.5793'. [ 898.041541][T25978] delete_channel: no stack [ 898.079758][T25703] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 898.187406][T25703] veth0_vlan: entered promiscuous mode [ 898.222769][T25703] veth1_vlan: entered promiscuous mode [ 898.306367][T25998] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5797'. [ 898.308605][T25703] veth0_macvtap: entered promiscuous mode [ 898.342459][T25703] veth1_macvtap: entered promiscuous mode [ 898.366439][T25703] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 898.385693][T25703] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 898.414968][ T3913] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.433602][ T3913] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.450969][ T3913] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.470827][ T3913] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 898.507832][T25957] lo speed is unknown, defaulting to 1000 [ 898.646043][ T7015] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 898.667218][ T7015] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 898.732888][ T5993] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 898.759537][ T5993] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 898.974078][T25957] lo speed is unknown, defaulting to 1000 [ 898.988497][T25995] siw: device registration error -23 [ 899.199512][T26020] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5801'. [ 899.418614][T26033] netlink: 'syz.0.5803': attribute type 2 has an invalid length. [ 899.449983][T26033] netlink: 'syz.0.5803': attribute type 11 has an invalid length. [ 899.463157][T26033] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5803'. [ 900.007801][T26044] vlan2: entered promiscuous mode [ 900.333838][T26055] macvtap0: entered allmulticast mode [ 900.339312][T26055] team0: entered allmulticast mode [ 900.375790][T26055] team_slave_0: entered allmulticast mode [ 900.385507][T26055] team_slave_1: entered allmulticast mode [ 900.411449][T26061] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5812'. [ 900.413760][T26055] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 900.469178][T26055] team0: left allmulticast mode [ 900.486708][T26055] team_slave_0: left allmulticast mode [ 900.496973][T26055] team_slave_1: left allmulticast mode [ 900.547127][T26064] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5814'. [ 900.588575][T26053] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 900.777711][T26071] FAULT_INJECTION: forcing a failure. [ 900.777711][T26071] name failslab, interval 1, probability 0, space 0, times 0 [ 900.796345][T26070] syzkaller0: entered promiscuous mode [ 900.802773][T26070] syzkaller0: entered allmulticast mode [ 900.810182][T26071] CPU: 0 UID: 0 PID: 26071 Comm: syz.0.5817 Not tainted syzkaller #0 PREEMPT(full) [ 900.810213][T26071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 900.810226][T26071] Call Trace: [ 900.810236][T26071] [ 900.810245][T26071] dump_stack_lvl+0xe8/0x150 [ 900.810279][T26071] should_fail_ex+0x412/0x560 [ 900.810312][T26071] should_failslab+0xa8/0x100 [ 900.810339][T26071] __kmalloc_cache_noprof+0x83/0x6e0 [ 900.810361][T26071] ? ip_set_pernet+0x23/0x240 [ 900.810392][T26071] ? ip_set_pernet+0x23/0x240 [ 900.810423][T26071] ? ip_set_create+0x391/0x1a40 [ 900.810448][T26071] ip_set_create+0x391/0x1a40 [ 900.810472][T26071] ? rcu_is_watching+0x15/0xb0 [ 900.810505][T26071] ? __pfx_ip_set_create+0x10/0x10 [ 900.810561][T26071] nfnetlink_rcv_msg+0xc00/0x12c0 [ 900.810582][T26071] ? unwind_get_return_address+0x4d/0x90 [ 900.810608][T26071] ? nfnetlink_rcv_msg+0x229/0x12c0 [ 900.810650][T26071] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 900.810728][T26071] netlink_rcv_skb+0x232/0x4b0 [ 900.810755][T26071] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 900.810780][T26071] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 900.810826][T26071] ? bpf_lsm_capable+0x9/0x20 [ 900.810854][T26071] ? security_capable+0x7e/0x2c0 [ 900.810887][T26071] nfnetlink_rcv+0x2c0/0x27b0 [ 900.810918][T26071] ? __local_bh_enable_ip+0xd0/0x130 [ 900.810939][T26071] ? lockdep_hardirqs_on+0x7a/0x110 [ 900.810964][T26071] ? __dev_queue_xmit+0x274/0x3850 [ 900.810993][T26071] ? __local_bh_enable_ip+0xd0/0x130 [ 900.811009][T26071] ? __dev_queue_xmit+0x274/0x3850 [ 900.811039][T26071] ? __dev_queue_xmit+0x1e6c/0x3850 [ 900.811069][T26071] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 900.811111][T26071] ? __dev_queue_xmit+0x274/0x3850 [ 900.811145][T26071] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 900.811174][T26071] ? __pfx___dev_queue_xmit+0x10/0x10 [ 900.811214][T26071] ? ref_tracker_free+0x693/0x840 [ 900.811239][T26071] ? __copy_skb_header+0xa3/0x4a0 [ 900.811272][T26071] ? __pfx_ref_tracker_free+0x10/0x10 [ 900.811317][T26071] ? skb_clone+0x246/0x3a0 [ 900.811349][T26071] ? __netlink_deliver_tap+0x807/0x850 [ 900.811375][T26071] ? netlink_deliver_tap+0x2e/0x1b0 [ 900.811407][T26071] ? netlink_deliver_tap+0x2e/0x1b0 [ 900.811441][T26071] netlink_unicast+0x80f/0x9b0 [ 900.811473][T26071] ? __pfx_netlink_unicast+0x10/0x10 [ 900.811497][T26071] ? netlink_sendmsg+0x650/0xb40 [ 900.811519][T26071] ? skb_put+0x11b/0x210 [ 900.811550][T26071] netlink_sendmsg+0x813/0xb40 [ 900.811585][T26071] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.811613][T26071] ? aa_sock_msg_perm+0xf1/0x1b0 [ 900.811640][T26071] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 900.811663][T26071] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.811686][T26071] ____sys_sendmsg+0xa68/0xad0 [ 900.811714][T26071] ? __might_fault+0xaf/0x130 [ 900.811752][T26071] ? __pfx_____sys_sendmsg+0x10/0x10 [ 900.811798][T26071] ? import_iovec+0x73/0xa0 [ 900.811833][T26071] ___sys_sendmsg+0x2a5/0x360 [ 900.811860][T26071] ? __lock_acquire+0x6b5/0x2cf0 [ 900.811894][T26071] ? __pfx____sys_sendmsg+0x10/0x10 [ 900.811960][T26071] ? __fget_files+0x2a/0x420 [ 900.811983][T26071] ? __fget_files+0x3a0/0x420 [ 900.812019][T26071] __x64_sys_sendmsg+0x1bd/0x2a0 [ 900.812051][T26071] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 900.812090][T26071] ? __pfx_ksys_write+0x10/0x10 [ 900.812134][T26071] do_syscall_64+0xe2/0xf80 [ 900.812159][T26071] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.812180][T26071] ? trace_irq_disable+0x37/0x100 [ 900.812201][T26071] ? clear_bhb_loop+0x60/0xb0 [ 900.812227][T26071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.812248][T26071] RIP: 0033:0x7f5c6979aeb9 [ 900.812268][T26071] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 900.812287][T26071] RSP: 002b:00007f5c6a621028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 900.812309][T26071] RAX: ffffffffffffffda RBX: 00007f5c69a15fa0 RCX: 00007f5c6979aeb9 [ 900.812324][T26071] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 900.812338][T26071] RBP: 00007f5c6a621090 R08: 0000000000000000 R09: 0000000000000000 [ 900.812351][T26071] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.812364][T26071] R13: 00007f5c69a16038 R14: 00007f5c69a15fa0 R15: 00007ffe49d60818 [ 900.812399][T26071] [ 901.296676][T26075] netlink: 'syz.0.5819': attribute type 10 has an invalid length. [ 901.332859][T26075] team0: Device veth0_macvtap failed to register rx_handler [ 901.347033][T26070] tipc: Enabled bearer , priority 0 [ 901.379483][T26075] tipc: Started in network mode [ 901.385377][T26075] tipc: Node identity 463f2360bc51, cluster identity 4711 [ 901.394301][T26075] tipc: Enabled bearer , priority 0 [ 901.446533][T26075] syzkaller0: entered promiscuous mode [ 901.452156][T26075] syzkaller0: entered allmulticast mode [ 901.459256][T26075] tipc: Resetting bearer [ 901.475847][T26068] tipc: Resetting bearer [ 901.510446][T26068] tipc: Disabling bearer [ 901.520256][T26073] tipc: Resetting bearer [ 901.746848][T26092] xt_CT: No such helper "snmp_trap" [ 901.773581][T26092] __nla_validate_parse: 1 callbacks suppressed [ 901.773601][T26092] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5824'. [ 901.883634][T26095] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5824'. [ 903.307248][T26073] tipc: Disabling bearer [ 903.332659][T26079] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5820'. [ 903.351747][T12436] tipc: Node number set to 4201522016 [ 903.591062][T26107] syz_tun: entered allmulticast mode [ 903.599354][T26106] syz_tun: left allmulticast mode [ 903.685791][T26111] FAULT_INJECTION: forcing a failure. [ 903.685791][T26111] name failslab, interval 1, probability 0, space 0, times 0 [ 903.713496][T26111] CPU: 1 UID: 0 PID: 26111 Comm: syz.1.5832 Not tainted syzkaller #0 PREEMPT(full) [ 903.713527][T26111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 903.713541][T26111] Call Trace: [ 903.713550][T26111] [ 903.713560][T26111] dump_stack_lvl+0xe8/0x150 [ 903.713594][T26111] should_fail_ex+0x412/0x560 [ 903.713627][T26111] should_failslab+0xa8/0x100 [ 903.713654][T26111] __kmalloc_cache_noprof+0x83/0x6e0 [ 903.713675][T26111] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 903.713700][T26111] ? sctp_v6_cmp_addr+0x15/0xd0 [ 903.713723][T26111] ? sctp_add_bind_addr+0x8c/0x370 [ 903.713753][T26111] sctp_add_bind_addr+0x8c/0x370 [ 903.713782][T26111] sctp_copy_local_addr_list+0x314/0x4f0 [ 903.713819][T26111] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 903.713845][T26111] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 903.713873][T26111] ? sctp_v6_is_any+0x64/0x80 [ 903.713900][T26111] ? sctp_copy_one_addr+0x93/0x360 [ 903.713928][T26111] sctp_bind_addr_copy+0xb3/0x3c0 [ 903.713953][T26111] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 903.713992][T26111] sctp_connect_new_asoc+0x2ff/0x6b0 [ 903.714026][T26111] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 903.714058][T26111] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 903.714089][T26111] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 903.714117][T26111] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 903.714147][T26111] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 903.714173][T26111] ? security_sctp_bind_connect+0x7e/0x2c0 [ 903.714200][T26111] sctp_sendmsg+0x1528/0x2c10 [ 903.714247][T26111] ? __pfx_sctp_sendmsg+0x10/0x10 [ 903.714275][T26111] ? aa_sk_perm+0x15a/0x960 [ 903.714301][T26111] ? aa_sk_perm+0x82d/0x960 [ 903.714335][T26111] ? __might_fault+0xaf/0x130 [ 903.714374][T26111] ? __pfx_aa_sk_perm+0x10/0x10 [ 903.714404][T26111] ? sock_rps_record_flow+0x19/0x400 [ 903.714460][T26111] ? inet_sendmsg+0x2f4/0x370 [ 903.714496][T26111] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 903.714524][T26111] __sys_sendto+0x627/0x7a0 [ 903.714556][T26111] ? __pfx___sys_sendto+0x10/0x10 [ 903.714580][T26111] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 903.714622][T26111] ? __fget_files+0x3a0/0x420 [ 903.714668][T26111] ? ksys_write+0x242/0x270 [ 903.714703][T26111] ? __pfx_ksys_write+0x10/0x10 [ 903.714740][T26111] __x64_sys_sendto+0xde/0x100 [ 903.714772][T26111] do_syscall_64+0xe2/0xf80 [ 903.714806][T26111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.714828][T26111] ? trace_irq_disable+0x37/0x100 [ 903.714849][T26111] ? clear_bhb_loop+0x60/0xb0 [ 903.714875][T26111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.714896][T26111] RIP: 0033:0x7fc45739aeb9 [ 903.714917][T26111] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 903.714937][T26111] RSP: 002b:00007fc458297028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 903.714961][T26111] RAX: ffffffffffffffda RBX: 00007fc457615fa0 RCX: 00007fc45739aeb9 [ 903.714978][T26111] RDX: 000000000000005b RSI: 0000200000000040 RDI: 0000000000000003 [ 903.714992][T26111] RBP: 00007fc458297090 R08: 0000200000000100 R09: 000000000000001c [ 903.715008][T26111] R10: 0000000000000014 R11: 0000000000000246 R12: 0000000000000002 [ 903.715021][T26111] R13: 00007fc457616038 R14: 00007fc457615fa0 R15: 00007ffc77e7ac08 [ 903.715058][T26111] [ 903.813111][T26113] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5833'. [ 904.068548][T26116] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 904.086195][T26113] x_tables: duplicate underflow at hook 2 [ 904.113421][T26118] netlink: 'syz.5.5834': attribute type 12 has an invalid length. [ 904.127798][T26118] netlink: 'syz.5.5834': attribute type 29 has an invalid length. [ 904.143669][T26118] netlink: 148 bytes leftover after parsing attributes in process `syz.5.5834'. [ 904.180791][T26117] netlink: 'syz.0.5835': attribute type 1 has an invalid length. [ 904.338561][T26122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 904.348648][T26122] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 904.437467][T26129] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 904.665197][T26146] netlink: 'syz.2.5846': attribute type 13 has an invalid length. [ 904.816191][T26156] netlink: 364 bytes leftover after parsing attributes in process `syz.1.5849'. [ 904.968529][T26160] IPv6: addrconf: prefix option has invalid lifetime [ 905.434925][T26177] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 905.529598][T26181] syz_tun: entered allmulticast mode [ 905.587056][T26182] 8021q: adding VLAN 0 to HW filter on device bond2 [ 905.759394][T26176] veth1_to_bridge: mtu greater than device maximum [ 905.790752][T26175] syz_tun: left allmulticast mode [ 907.830664][T26210] tipc: Enabling of bearer rejected, failed to enable media [ 908.276761][T26255] netlink: 'syz.3.5877': attribute type 33 has an invalid length. [ 908.295236][T26255] netlink: 164 bytes leftover after parsing attributes in process `syz.3.5877'. [ 908.305406][T26255] netlink: 14 bytes leftover after parsing attributes in process `syz.3.5877'. [ 908.333470][T26255] batman_adv: batadv0: Removing interface: dummy0 [ 908.810917][T26251] lo speed is unknown, defaulting to 1000 [ 909.040196][T26259] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5878'. [ 909.080051][T26259] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5878'. [ 909.301158][T26277] netlink: 'syz.2.5882': attribute type 12 has an invalid length. [ 909.320511][T26277] netlink: 'syz.2.5882': attribute type 29 has an invalid length. [ 909.329305][T26277] netlink: 148 bytes leftover after parsing attributes in process `syz.2.5882'. [ 909.340077][T26251] lo speed is unknown, defaulting to 1000 [ 909.521932][T26283] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 909.536537][T26283] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 909.628769][T26283] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.5884'. [ 909.652045][T26285] bond3: option lacp_rate: invalid value (192) [ 909.661264][T26283] netlink: Conntrack attr has 3 unknown bytes [ 909.677392][T26285] bond3 (unregistering): Released all slaves [ 910.314986][T26316] netlink: 'syz.0.5893': attribute type 2 has an invalid length. [ 910.493115][T26319] IPVS: persistence engine module ip_vs_pe_‘« not found [ 910.787675][ T6037] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 910.817533][ T6037] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 910.956573][T26337] syzkaller1: entered promiscuous mode [ 910.982794][T26337] syzkaller1: entered allmulticast mode [ 911.037497][T26340] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5900'. [ 911.072292][T26340] xt_hashlimit: max too large, truncated to 1048576 [ 911.086862][T26343] GUP no longer grows the stack in syz.5.5899 (26343): 200000003000-20000000a000 (200000001000) [ 911.134296][T26343] CPU: 0 UID: 0 PID: 26343 Comm: syz.5.5899 Not tainted syzkaller #0 PREEMPT(full) [ 911.134328][T26343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 911.134343][T26343] Call Trace: [ 911.134352][T26343] [ 911.134362][T26343] dump_stack_lvl+0xe8/0x150 [ 911.134397][T26343] __get_user_pages+0x2453/0x29d0 [ 911.134453][T26343] ? __gup_longterm_locked+0xc4e/0x1630 [ 911.134487][T26343] ? down_read_killable+0x1bb/0x340 [ 911.134525][T26343] ? try_get_folio+0xec/0x650 [ 911.134562][T26343] __gup_longterm_locked+0xdcf/0x1630 [ 911.134627][T26343] gup_fast_fallback+0x1d82/0x22e0 [ 911.134704][T26343] ? __pfx_gup_fast_fallback+0x10/0x10 [ 911.134740][T26343] ? is_valid_gup_args+0x11f/0x200 [ 911.134774][T26343] ? get_user_pages_fast+0x4d/0xb0 [ 911.134808][T26343] __iov_iter_get_pages_alloc+0x3b6/0xb10 [ 911.134851][T26343] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 911.134884][T26343] iov_iter_get_pages2+0x5e/0xa0 [ 911.134922][T26343] __se_sys_vmsplice+0x7b3/0x1490 [ 911.134972][T26343] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 911.134998][T26343] ? __pfx_futex_wait+0x10/0x10 [ 911.135057][T26343] ? kmem_cache_free+0x195/0x610 [ 911.135079][T26343] ? do_sys_openat2+0x168/0x220 [ 911.135147][T26343] do_syscall_64+0xe2/0xf80 [ 911.135173][T26343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.135196][T26343] ? trace_irq_disable+0x37/0x100 [ 911.135217][T26343] ? clear_bhb_loop+0x60/0xb0 [ 911.135245][T26343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.135266][T26343] RIP: 0033:0x7f945ef9aeb9 [ 911.135288][T26343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 911.135308][T26343] RSP: 002b:00007f945fe1d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 911.135334][T26343] RAX: ffffffffffffffda RBX: 00007f945f216090 RCX: 00007f945ef9aeb9 [ 911.135351][T26343] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 000000000000000b [ 911.135366][T26343] RBP: 00007f945f008c1f R08: 0000000000000000 R09: 0000000000000000 [ 911.135381][T26343] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 911.135395][T26343] R13: 00007f945f216128 R14: 00007f945f216090 R15: 00007fffe4d0cb48 [ 911.135433][T26343] [ 911.413826][T26346] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5902'. [ 911.423067][T26346] netlink: 'syz.2.5902': attribute type 20 has an invalid length. [ 911.446791][T26346] netlink: 'syz.2.5902': attribute type 21 has an invalid length. [ 911.480687][T26347] netlink: 'syz.2.5902': attribute type 1 has an invalid length. [ 911.529462][T26347] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5902'. [ 911.608439][ T5839] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 911.618508][ T5839] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 911.627731][ T5839] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 911.640849][ T5839] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 911.670076][ T5839] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 912.255125][T26351] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5904'. [ 912.373430][T26359] Unknown options in mask b7f2 [ 912.533404][T26365] syzkaller0: entered promiscuous mode [ 912.538982][T26365] syzkaller0: entered allmulticast mode [ 912.685263][T26365] tipc: Enabled bearer , priority 0 [ 912.710606][T26364] tipc: Resetting bearer [ 912.766127][T26364] tipc: Disabling bearer [ 913.090370][T26391] netlink: 'syz.1.5918': attribute type 10 has an invalid length. [ 913.104263][T26391] bond0: (slave dummy0): Releasing backup interface [ 913.115386][T26391] dummy0: entered promiscuous mode [ 913.122469][T26391] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 913.132217][T26391] team0: Failed to send options change via netlink (err -105) [ 913.141767][T26391] team0: Port device dummy0 added [ 913.148533][T26392] netlink: 'syz.1.5918': attribute type 10 has an invalid length. [ 913.171431][T26392] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 913.184410][T26392] dummy0: left promiscuous mode [ 913.193017][T26392] team0: Failed to send options change via netlink (err -105) [ 913.201115][T26392] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 913.210977][T26392] team0: Port device dummy0 removed [ 913.221608][T26392] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 913.484449][T26348] lo speed is unknown, defaulting to 1000 [ 913.711085][ T5829] Bluetooth: hci5: command tx timeout [ 913.747769][T26410] netlink: 'syz.2.5925': attribute type 12 has an invalid length. [ 913.756188][T26410] netlink: 'syz.2.5925': attribute type 29 has an invalid length. [ 913.764418][T26410] __nla_validate_parse: 2 callbacks suppressed [ 913.764444][T26410] netlink: 148 bytes leftover after parsing attributes in process `syz.2.5925'. [ 913.841620][T26348] lo speed is unknown, defaulting to 1000 [ 914.217753][T26348] chnl_net:caif_netlink_parms(): no params data found [ 914.508962][T26348] bridge0: port 1(bridge_slave_0) entered blocking state [ 914.548597][T26348] bridge0: port 1(bridge_slave_0) entered disabled state [ 914.573320][T26348] bridge_slave_0: entered allmulticast mode [ 914.594477][T26348] bridge_slave_0: entered promiscuous mode [ 914.622230][T26348] bridge0: port 2(bridge_slave_1) entered blocking state [ 914.632292][T26440] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5932'. [ 914.642631][T26348] bridge0: port 2(bridge_slave_1) entered disabled state [ 914.654040][T26440] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 914.664706][T26348] bridge_slave_1: entered allmulticast mode [ 914.673577][T26348] bridge_slave_1: entered promiscuous mode [ 914.864016][T26348] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 914.893734][T26348] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 914.996168][T26348] team0: Port device team_slave_0 added [ 915.014758][T26348] team0: Port device team_slave_1 added [ 915.130839][T26348] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 915.137963][T26348] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.201129][T26348] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 915.218942][T26404] lo speed is unknown, defaulting to 1000 [ 915.236485][T26348] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 915.251875][T26348] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.281347][T26348] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 915.351288][T26348] hsr_slave_0: entered promiscuous mode [ 915.359010][T26348] hsr_slave_1: entered promiscuous mode [ 915.381126][T26348] debugfs: 'hsr0' already exists in 'hsr' [ 915.387280][T26348] Cannot create hsr debugfs directory [ 915.567910][T26404] lo speed is unknown, defaulting to 1000 [ 915.780611][ T5839] Bluetooth: hci5: command tx timeout [ 915.851169][T26470] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 915.916782][T26470] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 916.019116][T26456] delete_channel: no stack [ 917.864020][ T5839] Bluetooth: hci5: command tx timeout [ 918.177928][T26492] netlink: 'syz.2.5948': attribute type 21 has an invalid length. [ 918.188512][T26492] netlink: 'syz.2.5948': attribute type 1 has an invalid length. [ 918.198242][T26492] netlink: 132 bytes leftover after parsing attributes in process `syz.2.5948'. [ 918.539162][T26348] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 918.565380][T26348] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 918.589598][T26348] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 918.615960][T26348] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 918.805269][T26348] 8021q: adding VLAN 0 to HW filter on device bond0 [ 918.863158][T26348] 8021q: adding VLAN 0 to HW filter on device team0 [ 918.883604][ T6028] bridge0: port 1(bridge_slave_0) entered blocking state [ 918.890877][ T6028] bridge0: port 1(bridge_slave_0) entered forwarding state [ 918.939502][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 918.946750][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 919.070726][T26523] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5957'. [ 919.087026][T26523] team0: No ports can be present during mode change [ 919.162071][T26527] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5958'. [ 919.237428][T26524] "syz.5.5958" (26524) uses obsolete ecb(arc4) skcipher [ 919.397462][T26535] FAULT_INJECTION: forcing a failure. [ 919.397462][T26535] name failslab, interval 1, probability 0, space 0, times 0 [ 919.424648][T26535] CPU: 0 UID: 0 PID: 26535 Comm: syz.5.5960 Not tainted syzkaller #0 PREEMPT(full) [ 919.424680][T26535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 919.424694][T26535] Call Trace: [ 919.424704][T26535] [ 919.424714][T26535] dump_stack_lvl+0xe8/0x150 [ 919.424748][T26535] should_fail_ex+0x412/0x560 [ 919.424788][T26535] should_failslab+0xa8/0x100 [ 919.424816][T26535] __kmalloc_noprof+0xde/0x7e0 [ 919.424838][T26535] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 919.424871][T26535] ? rcu_is_watching+0x15/0xb0 [ 919.424898][T26535] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 919.424941][T26535] genl_family_rcv_msg_doit+0xd9/0x330 [ 919.424974][T26535] ? __asan_memcpy+0x40/0x70 [ 919.425009][T26535] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 919.425052][T26535] ? apparmor_capable+0x137/0x1a0 [ 919.425087][T26535] ? bpf_lsm_capable+0x9/0x20 [ 919.425116][T26535] ? security_capable+0x7e/0x2c0 [ 919.425149][T26535] genl_rcv_msg+0x61c/0x7a0 [ 919.425189][T26535] ? __pfx_genl_rcv_msg+0x10/0x10 [ 919.425218][T26535] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 919.425244][T26535] ? __pfx_nl802154_add_llsec_devkey+0x10/0x10 [ 919.425272][T26535] ? __pfx_nl802154_post_doit+0x10/0x10 [ 919.425315][T26535] netlink_rcv_skb+0x232/0x4b0 [ 919.425342][T26535] ? __pfx_genl_rcv_msg+0x10/0x10 [ 919.425375][T26535] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 919.425398][T26535] ? genl_rcv+0x19/0x40 [ 919.425447][T26535] ? down_read+0x272/0x2e0 [ 919.425474][T26535] ? genl_rcv+0xd/0x40 [ 919.425507][T26535] genl_rcv+0x28/0x40 [ 919.425535][T26535] netlink_unicast+0x80f/0x9b0 [ 919.425568][T26535] ? __pfx_netlink_unicast+0x10/0x10 [ 919.425594][T26535] ? netlink_sendmsg+0x650/0xb40 [ 919.425617][T26535] ? skb_put+0x11b/0x210 [ 919.425649][T26535] netlink_sendmsg+0x813/0xb40 [ 919.425686][T26535] ? __pfx_netlink_sendmsg+0x10/0x10 [ 919.425717][T26535] ? aa_sock_msg_perm+0xf1/0x1b0 [ 919.425745][T26535] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 919.425771][T26535] ? __pfx_netlink_sendmsg+0x10/0x10 [ 919.425803][T26535] ____sys_sendmsg+0xa68/0xad0 [ 919.425833][T26535] ? __might_fault+0xaf/0x130 [ 919.425872][T26535] ? __pfx_____sys_sendmsg+0x10/0x10 [ 919.425913][T26535] ? import_iovec+0x73/0xa0 [ 919.425951][T26535] ___sys_sendmsg+0x2a5/0x360 [ 919.425979][T26535] ? __lock_acquire+0x6b5/0x2cf0 [ 919.426015][T26535] ? __pfx____sys_sendmsg+0x10/0x10 [ 919.426088][T26535] ? __fget_files+0x2a/0x420 [ 919.426112][T26535] ? __fget_files+0x3a0/0x420 [ 919.426149][T26535] __x64_sys_sendmsg+0x1bd/0x2a0 [ 919.426183][T26535] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 919.426225][T26535] ? __pfx_ksys_write+0x10/0x10 [ 919.426271][T26535] do_syscall_64+0xe2/0xf80 [ 919.426296][T26535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.426317][T26535] ? trace_irq_disable+0x37/0x100 [ 919.426337][T26535] ? clear_bhb_loop+0x60/0xb0 [ 919.426365][T26535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.426385][T26535] RIP: 0033:0x7f945ef9aeb9 [ 919.426405][T26535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 919.426425][T26535] RSP: 002b:00007f945fe3e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 919.426449][T26535] RAX: ffffffffffffffda RBX: 00007f945f215fa0 RCX: 00007f945ef9aeb9 [ 919.426465][T26535] RDX: 0000000004000040 RSI: 0000200000000580 RDI: 0000000000000004 [ 919.426480][T26535] RBP: 00007f945fe3e090 R08: 0000000000000000 R09: 0000000000000000 [ 919.426494][T26535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 919.426507][T26535] R13: 00007f945f216038 R14: 00007f945f215fa0 R15: 00007fffe4d0cb48 [ 919.426546][T26535] [ 919.904517][T26348] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 919.941550][ T5839] Bluetooth: hci5: command tx timeout [ 920.046939][T26348] veth0_vlan: entered promiscuous mode [ 920.060477][T26348] veth1_vlan: entered promiscuous mode [ 920.101408][T26348] veth0_macvtap: entered promiscuous mode [ 920.117508][T26348] veth1_macvtap: entered promiscuous mode [ 920.145683][T26348] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 920.159643][T26348] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 920.177669][ T6028] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 920.223810][ T6028] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 920.236213][T26549] netlink: 44 bytes leftover after parsing attributes in process `syz.5.5962'. [ 920.293146][ T6028] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 920.322326][ T6028] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 920.475775][ T7021] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 920.500263][ T7021] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 920.553686][ T7021] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 920.566082][ T7021] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 920.736014][T26514] lo speed is unknown, defaulting to 1000 [ 921.072358][T26572] netlink: 'syz.5.5970': attribute type 2 has an invalid length. [ 921.083516][T26572] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 921.089674][T26572] syzkaller1: linktype set to 768 [ 921.121527][T26514] lo speed is unknown, defaulting to 1000 [ 921.717491][T26592] netlink: 'syz.1.5975': attribute type 1 has an invalid length. [ 921.881500][T26598] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5976'. [ 921.941252][T26592] 8021q: adding VLAN 0 to HW filter on device bond7 [ 921.979623][T26595] bond7: (slave ip6gretap1): making interface the new active one [ 921.997751][T26601] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5977'. [ 922.019050][T26595] bond7: (slave ip6gretap1): Enslaving as an active interface with an up link [ 922.449551][T26610] nr5: left promiscuous mode [ 922.454655][T26610] nr5: left allmulticast mode [ 922.807960][T26614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5982'. [ 922.866582][ T5829] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 922.879317][ T5829] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 922.893677][ T5829] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 922.905241][ T5829] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 922.913387][ T5829] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 923.271730][T26621] syzkaller1: entered promiscuous mode [ 923.277282][T26621] syzkaller1: entered allmulticast mode [ 924.331463][T26606] lo speed is unknown, defaulting to 1000 [ 924.682748][T26608] lo speed is unknown, defaulting to 1000 [ 924.688816][T26606] lo speed is unknown, defaulting to 1000 [ 924.983380][ T5829] Bluetooth: hci4: command tx timeout [ 925.534086][T26608] lo speed is unknown, defaulting to 1000 [ 925.534099][T26615] lo speed is unknown, defaulting to 1000 [ 925.859246][T26651] bridge0: port 3(syz_tun) entered blocking state [ 925.890301][T26651] bridge0: port 3(syz_tun) entered disabled state [ 925.897047][T26651] syz_tun: entered allmulticast mode [ 925.931449][T26651] syz_tun: entered promiscuous mode [ 925.937470][T26651] bridge0: port 3(syz_tun) entered blocking state [ 925.944129][T26651] bridge0: port 3(syz_tun) entered forwarding state [ 926.135037][T26615] lo speed is unknown, defaulting to 1000 [ 926.782286][T26615] chnl_net:caif_netlink_parms(): no params data found [ 926.923378][T26660] delete_channel: no stack [ 927.009662][T26677] netlink: 'syz.3.5998': attribute type 1 has an invalid length. [ 927.019483][T26615] bridge0: port 1(bridge_slave_0) entered blocking state [ 927.027459][T26615] bridge0: port 1(bridge_slave_0) entered disabled state [ 927.035707][T26615] bridge_slave_0: entered allmulticast mode [ 927.044117][T26615] bridge_slave_0: entered promiscuous mode [ 927.053847][T26615] bridge0: port 2(bridge_slave_1) entered blocking state [ 927.061902][T26615] bridge0: port 2(bridge_slave_1) entered disabled state [ 927.069289][T26615] bridge_slave_1: entered allmulticast mode [ 927.077975][T26615] bridge_slave_1: entered promiscuous mode [ 927.077998][ T5829] Bluetooth: hci4: command tx timeout [ 927.266458][T26679] netlink: 'syz.3.5999': attribute type 1 has an invalid length. [ 927.285398][T26615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 927.294944][T26681] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6000'. [ 927.306027][T26679] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5999'. [ 927.357386][T26615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 927.396877][T26681] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6000'. [ 927.527676][T26681] netlink: 'syz.2.6000': attribute type 1 has an invalid length. [ 927.595554][T26688] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6000'. [ 927.634736][T26615] team0: Port device team_slave_0 added [ 927.644197][T26688] veth3: entered promiscuous mode [ 927.677917][T26615] team0: Port device team_slave_1 added [ 927.796957][T26615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 927.804493][T26615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 927.833243][T26615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 927.847285][T26615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 927.863296][T26615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 927.921515][T26615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 927.951505][T26692] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6002'. [ 927.996537][T26694] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6003'. [ 928.111201][T26658] lo speed is unknown, defaulting to 1000 [ 928.231248][T26615] hsr_slave_0: entered promiscuous mode [ 928.251793][T26615] hsr_slave_1: entered promiscuous mode [ 928.268514][T26701] netlink: 'syz.3.6005': attribute type 2 has an invalid length. [ 928.300456][T26615] debugfs: 'hsr0' already exists in 'hsr' [ 928.317235][T26615] Cannot create hsr debugfs directory [ 928.605980][T26705] IPVS: persistence engine module ip_vs_pe_‘« not found [ 928.808738][T26713] bridge_slave_1: left allmulticast mode [ 928.815143][T26713] bridge_slave_1: left promiscuous mode [ 928.823383][T26713] bridge0: port 2(bridge_slave_1) entered disabled state [ 928.844551][T26713] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 928.883893][T26719] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6009'. [ 928.903144][T26719] netlink: 'syz.3.6009': attribute type 2 has an invalid length. [ 928.912308][T26719] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6009'. [ 929.143034][ T5829] Bluetooth: hci4: command tx timeout [ 929.182227][T26658] lo speed is unknown, defaulting to 1000 [ 929.333441][T26722] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6010'. [ 929.485710][T26722] netlink: 176 bytes leftover after parsing attributes in process `syz.3.6010'. [ 930.705276][T26744] netlink: 'syz.5.6018': attribute type 2 has an invalid length. [ 930.718383][T26743] netlink: 'syz.3.6017': attribute type 12 has an invalid length. [ 930.737234][T26743] netlink: 'syz.3.6017': attribute type 29 has an invalid length. [ 930.764024][T26615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 930.841986][T26615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 930.927156][T26615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 930.988495][T26615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 931.003362][T26750] IPVS: persistence engine module ip_vs_pe_‘« not found [ 931.018551][T26754] netlink: 'syz.3.6020': attribute type 2 has an invalid length. [ 931.069718][T26754] netlink: 'syz.3.6020': attribute type 11 has an invalid length. [ 931.221925][ T5829] Bluetooth: hci4: command tx timeout [ 931.396507][T26615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 931.433541][T26615] 8021q: adding VLAN 0 to HW filter on device team0 [ 931.448636][ T2098] bridge0: port 1(bridge_slave_0) entered blocking state [ 931.456033][ T2098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 931.482164][ T2098] bridge0: port 2(bridge_slave_1) entered blocking state [ 931.489417][ T2098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 931.815936][T26790] FAULT_INJECTION: forcing a failure. [ 931.815936][T26790] name failslab, interval 1, probability 0, space 0, times 0 [ 931.864935][T26790] CPU: 1 UID: 0 PID: 26790 Comm: syz.0.6027 Not tainted syzkaller #0 PREEMPT(full) [ 931.864966][T26790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 931.864981][T26790] Call Trace: [ 931.864991][T26790] [ 931.865000][T26790] dump_stack_lvl+0xe8/0x150 [ 931.865035][T26790] should_fail_ex+0x412/0x560 [ 931.865069][T26790] should_failslab+0xa8/0x100 [ 931.865096][T26790] __kvmalloc_node_noprof+0x166/0x8d0 [ 931.865122][T26790] ? nf_hook_entries_grow+0x288/0x720 [ 931.865150][T26790] ? __pfx___mutex_lock+0x10/0x10 [ 931.865181][T26790] nf_hook_entries_grow+0x288/0x720 [ 931.865209][T26790] ? rht_lock+0x8b/0x180 [ 931.865247][T26790] __nf_register_net_hook+0x2c9/0x930 [ 931.865287][T26790] nf_register_net_hook+0xb2/0x190 [ 931.865317][T26790] nft_netdev_register_hooks+0x88/0x250 [ 931.865356][T26790] nf_tables_newchain+0x235b/0x2890 [ 931.865406][T26790] ? __pfx_nf_tables_newchain+0x10/0x10 [ 931.865464][T26790] ? nft_trans_table_add+0x230/0x430 [ 931.865500][T26790] ? nfnl_pernet+0x23/0x240 [ 931.865521][T26790] ? nfnl_pernet+0x23/0x240 [ 931.865554][T26790] ? __nla_parse+0x40/0x60 [ 931.865590][T26790] nfnetlink_rcv+0x1240/0x27b0 [ 931.865651][T26790] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 931.865692][T26790] ? ref_tracker_free+0x693/0x840 [ 931.865760][T26790] ? __netlink_deliver_tap+0x807/0x850 [ 931.865787][T26790] ? netlink_deliver_tap+0x2e/0x1b0 [ 931.865833][T26790] netlink_unicast+0x80f/0x9b0 [ 931.865865][T26790] ? __pfx_netlink_unicast+0x10/0x10 [ 931.865888][T26790] ? netlink_sendmsg+0x650/0xb40 [ 931.865910][T26790] ? skb_put+0x11b/0x210 [ 931.865943][T26790] netlink_sendmsg+0x813/0xb40 [ 931.865979][T26790] ? __pfx_netlink_sendmsg+0x10/0x10 [ 931.866010][T26790] ? aa_sock_msg_perm+0xf1/0x1b0 [ 931.866040][T26790] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 931.866066][T26790] ? __pfx_netlink_sendmsg+0x10/0x10 [ 931.866091][T26790] ____sys_sendmsg+0xa68/0xad0 [ 931.866120][T26790] ? __might_fault+0xaf/0x130 [ 931.866160][T26790] ? __pfx_____sys_sendmsg+0x10/0x10 [ 931.866200][T26790] ? import_iovec+0x73/0xa0 [ 931.866234][T26790] ___sys_sendmsg+0x2a5/0x360 [ 931.866261][T26790] ? __lock_acquire+0x6b5/0x2cf0 [ 931.866293][T26790] ? __pfx____sys_sendmsg+0x10/0x10 [ 931.866359][T26790] ? __fget_files+0x2a/0x420 [ 931.866381][T26790] ? __fget_files+0x3a0/0x420 [ 931.866417][T26790] __x64_sys_sendmsg+0x1bd/0x2a0 [ 931.866450][T26790] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 931.866492][T26790] ? __pfx_ksys_write+0x10/0x10 [ 931.866538][T26790] do_syscall_64+0xe2/0xf80 [ 931.866563][T26790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 931.866584][T26790] ? trace_irq_disable+0x37/0x100 [ 931.866606][T26790] ? clear_bhb_loop+0x60/0xb0 [ 931.866632][T26790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 931.866654][T26790] RIP: 0033:0x7f5c6979aeb9 [ 931.866674][T26790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 931.866694][T26790] RSP: 002b:00007f5c6a621028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 931.866728][T26790] RAX: ffffffffffffffda RBX: 00007f5c69a15fa0 RCX: 00007f5c6979aeb9 [ 931.866745][T26790] RDX: 0000000004000010 RSI: 0000200000000100 RDI: 0000000000000003 [ 931.866760][T26790] RBP: 00007f5c6a621090 R08: 0000000000000000 R09: 0000000000000000 [ 931.866774][T26790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 931.866786][T26790] R13: 00007f5c69a16038 R14: 00007f5c69a15fa0 R15: 00007ffe49d60818 [ 931.866821][T26790] [ 932.312400][T26615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 932.378339][T26615] veth0_vlan: entered promiscuous mode [ 932.392911][T26615] veth1_vlan: entered promiscuous mode [ 932.428794][T26615] veth0_macvtap: entered promiscuous mode [ 932.439589][T26615] veth1_macvtap: entered promiscuous mode [ 932.488194][T26615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 932.506177][T26615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 932.539580][ T2131] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 932.612409][ T147] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 932.633558][T26800] validate_nla: 1 callbacks suppressed [ 932.633580][T26800] netlink: 'syz.0.6030': attribute type 2 has an invalid length. [ 932.642937][ T147] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 932.670030][T26800] netlink: 'syz.0.6030': attribute type 11 has an invalid length. [ 932.680817][ T147] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 932.695017][T26800] __nla_validate_parse: 7 callbacks suppressed [ 932.695038][T26800] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6030'. [ 932.737103][T26802] macvtap1: entered allmulticast mode [ 932.743366][T26802] team0: entered allmulticast mode [ 932.753110][T26802] team_slave_0: entered allmulticast mode [ 932.768978][T26802] team_slave_1: entered allmulticast mode [ 932.784029][T26802] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 932.805152][T26802] team0: left allmulticast mode [ 932.822045][T26802] team_slave_0: left allmulticast mode [ 932.839308][T26802] team_slave_1: left allmulticast mode [ 933.121751][ T8742] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 933.159505][ T8742] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 933.287611][ T8742] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 933.327276][ T8742] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 933.336811][T26820] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6034'. [ 933.861580][T26838] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6036'. [ 933.871964][T26838] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6036'. [ 933.883862][T26845] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6035'. [ 934.184241][T26778] lo speed is unknown, defaulting to 1000 [ 934.247331][T26859] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 934.486337][T26867] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6042'. [ 934.546357][T26868] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6041'. [ 934.569316][T26868] team0: No ports can be present during mode change [ 934.934210][T26778] lo speed is unknown, defaulting to 1000 [ 935.162243][T26871] netlink: 'syz.5.6043': attribute type 10 has an invalid length. [ 935.539230][T26877] pim6reg1: entered promiscuous mode [ 935.557020][T26877] pim6reg1: entered allmulticast mode [ 935.925294][T26892] netlink: 'syz.5.6049': attribute type 33 has an invalid length. [ 935.948000][T12436] IPVS: starting estimator thread 0... [ 935.954144][T26892] netlink: 152 bytes leftover after parsing attributes in process `syz.5.6049'. [ 935.966664][T26891] netlink: 'syz.0.6051': attribute type 1 has an invalid length. [ 936.030662][T26899] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6051'. [ 936.056289][T26891] 8021q: adding VLAN 0 to HW filter on device bond1 [ 936.080309][T26894] IPVS: using max 31 ests per chain, 74400 per kthread [ 936.114375][T26899] veth3: entered promiscuous mode [ 936.124750][T26891] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6051'. [ 936.185525][T26865] lo speed is unknown, defaulting to 1000 [ 936.208097][T26904] netlink: 'syz.0.6053': attribute type 1 has an invalid length. [ 936.278144][T26908] netlink: 'syz.3.6054': attribute type 10 has an invalid length. [ 936.325957][T26906] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 936.338037][T26906] bond2: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 936.356451][T26906] bond2: (slave vxcan3): making interface the new active one [ 936.365879][T26906] bond2: (slave vxcan3): Enslaving as an active interface with an up link [ 936.389113][T26908] team0: Port device netdevsim0 added [ 936.406994][T26904] bond2 (unregistering): (slave vxcan3): Releasing backup interface [ 936.468373][T26904] bond2 (unregistering): Released all slaves [ 936.497094][T26865] lo speed is unknown, defaulting to 1000 [ 936.858595][T26917] Cannot find set identified by id 65534 to match [ 937.172624][T26926] team0: No ports can be present during mode change [ 937.757852][T26930] FAULT_INJECTION: forcing a failure. [ 937.757852][T26930] name failslab, interval 1, probability 0, space 0, times 0 [ 937.800104][T26930] CPU: 1 UID: 0 PID: 26930 Comm: syz.3.6064 Not tainted syzkaller #0 PREEMPT(full) [ 937.800136][T26930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 937.800151][T26930] Call Trace: [ 937.800161][T26930] [ 937.800170][T26930] dump_stack_lvl+0xe8/0x150 [ 937.800205][T26930] should_fail_ex+0x412/0x560 [ 937.800238][T26930] should_failslab+0xa8/0x100 [ 937.800266][T26930] __kvmalloc_node_noprof+0x166/0x8d0 [ 937.800292][T26930] ? nf_hook_entries_grow+0x288/0x720 [ 937.800321][T26930] ? __pfx___mutex_lock+0x10/0x10 [ 937.800353][T26930] nf_hook_entries_grow+0x288/0x720 [ 937.800381][T26930] ? rht_lock+0x8b/0x180 [ 937.800420][T26930] __nf_register_net_hook+0x2c9/0x930 [ 937.800460][T26930] nf_register_net_hook+0xb2/0x190 [ 937.800491][T26930] nft_netdev_register_hooks+0x88/0x250 [ 937.800533][T26930] nf_tables_newchain+0x235b/0x2890 [ 937.800582][T26930] ? __pfx_nf_tables_newchain+0x10/0x10 [ 937.800642][T26930] ? nft_trans_table_add+0x230/0x430 [ 937.800678][T26930] ? nfnl_pernet+0x23/0x240 [ 937.800708][T26930] ? nfnl_pernet+0x23/0x240 [ 937.800741][T26930] ? __nla_parse+0x40/0x60 [ 937.800777][T26930] nfnetlink_rcv+0x1240/0x27b0 [ 937.800839][T26930] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 937.800880][T26930] ? ref_tracker_free+0x693/0x840 [ 937.800942][T26930] ? __netlink_deliver_tap+0x807/0x850 [ 937.800968][T26930] ? netlink_deliver_tap+0x2e/0x1b0 [ 937.801014][T26930] netlink_unicast+0x80f/0x9b0 [ 937.801048][T26930] ? __pfx_netlink_unicast+0x10/0x10 [ 937.801081][T26930] ? netlink_sendmsg+0x650/0xb40 [ 937.801105][T26930] ? skb_put+0x11b/0x210 [ 937.801138][T26930] netlink_sendmsg+0x813/0xb40 [ 937.801176][T26930] ? __pfx_netlink_sendmsg+0x10/0x10 [ 937.801207][T26930] ? aa_sock_msg_perm+0xf1/0x1b0 [ 937.801242][T26930] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 937.801269][T26930] ? __pfx_netlink_sendmsg+0x10/0x10 [ 937.801294][T26930] ____sys_sendmsg+0xa68/0xad0 [ 937.801325][T26930] ? __might_fault+0xaf/0x130 [ 937.801365][T26930] ? __pfx_____sys_sendmsg+0x10/0x10 [ 937.801407][T26930] ? import_iovec+0x73/0xa0 [ 937.801445][T26930] ___sys_sendmsg+0x2a5/0x360 [ 937.801473][T26930] ? __lock_acquire+0x6b5/0x2cf0 [ 937.801509][T26930] ? __pfx____sys_sendmsg+0x10/0x10 [ 937.801581][T26930] ? __fget_files+0x2a/0x420 [ 937.801606][T26930] ? __fget_files+0x3a0/0x420 [ 937.801642][T26930] __x64_sys_sendmsg+0x1bd/0x2a0 [ 937.801676][T26930] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 937.801718][T26930] ? __pfx_ksys_write+0x10/0x10 [ 937.801764][T26930] do_syscall_64+0xe2/0xf80 [ 937.801789][T26930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.801811][T26930] ? trace_irq_disable+0x37/0x100 [ 937.801832][T26930] ? clear_bhb_loop+0x60/0xb0 [ 937.801859][T26930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 937.801880][T26930] RIP: 0033:0x7f262c39aeb9 [ 937.801901][T26930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 937.801920][T26930] RSP: 002b:00007f262d1cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 937.801944][T26930] RAX: ffffffffffffffda RBX: 00007f262c615fa0 RCX: 00007f262c39aeb9 [ 937.801961][T26930] RDX: 0000000004000010 RSI: 0000200000000100 RDI: 0000000000000003 [ 937.801976][T26930] RBP: 00007f262d1cb090 R08: 0000000000000000 R09: 0000000000000000 [ 937.801991][T26930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 937.802004][T26930] R13: 00007f262c616038 R14: 00007f262c615fa0 R15: 00007ffd9e2751c8 [ 937.802041][T26930] [ 938.447593][T26934] __nla_validate_parse: 2 callbacks suppressed [ 938.447615][T26934] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6065'. [ 938.503429][T26932] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6065'. [ 938.543541][T26934] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 938.807015][T26896] lo speed is unknown, defaulting to 1000 [ 938.903573][T26940] netlink: 'syz.3.6067': attribute type 2 has an invalid length. [ 938.922527][T26940] netlink: 'syz.3.6067': attribute type 11 has an invalid length. [ 938.953697][T26940] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6067'. [ 939.687439][T26896] lo speed is unknown, defaulting to 1000 [ 939.801443][T26889] lo speed is unknown, defaulting to 1000 [ 939.970526][T26963] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6073'. [ 939.979557][T26963] team0: No ports can be present during mode change [ 940.012046][T26965] netlink: 'syz.0.6074': attribute type 33 has an invalid length. [ 940.020345][T26965] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6074'. [ 940.120036][T26969] netlink: 'syz.5.6075': attribute type 1 has an invalid length. [ 940.246010][T26969] 8021q: adding VLAN 0 to HW filter on device bond5 [ 940.399162][T26971] bond5: (slave ip6gretap3): making interface the new active one [ 940.411078][T26971] bond5: (slave ip6gretap3): Enslaving as an active interface with an up link [ 940.665071][T26973] team0 (unregistering): Port device team_slave_0 removed [ 940.687345][T26977] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6077'. [ 940.729209][T26973] team0 (unregistering): Port device team_slave_1 removed [ 940.753033][T26973] team0 (unregistering): Port device netdevsim0 removed [ 940.825822][T26889] lo speed is unknown, defaulting to 1000 [ 940.954018][T26981] netlink: 'syz.3.6078': attribute type 1 has an invalid length. [ 941.081044][T26981] bond1: entered promiscuous mode [ 941.086288][T26981] bond1: entered allmulticast mode [ 941.092311][T26981] 8021q: adding VLAN 0 to HW filter on device bond1 [ 941.154324][T26983] macvlan2: entered promiscuous mode [ 941.160020][T26983] macvlan2: entered allmulticast mode [ 941.167815][T26983] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 941.586529][T26990] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 942.187108][T27007] syzkaller0: entered promiscuous mode [ 942.200177][T27007] syzkaller0: entered allmulticast mode [ 942.302310][T27009] [ 942.305019][T27009] ============================= [ 942.310141][T27009] WARNING: suspicious RCU usage [ 942.315071][T27009] syzkaller #0 Not tainted [ 942.319523][T27009] ----------------------------- [ 942.325049][T27009] kernel/events/callchain.c:163 suspicious rcu_dereference_check() usage! [ 942.333763][T27009] [ 942.333763][T27009] other info that might help us debug this: [ 942.333763][T27009] [ 942.344305][T27009] [ 942.344305][T27009] rcu_scheduler_active = 2, debug_locks = 1 [ 942.353695][T27009] 1 lock held by syz.1.6089/27009: [ 942.361227][T27009] #0: ffffffff8e55a540 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x37/0x80 [ 942.371699][T27009] [ 942.371699][T27009] stack backtrace: [ 942.377648][T27009] CPU: 0 UID: 0 PID: 27009 Comm: syz.1.6089 Not tainted syzkaller #0 PREEMPT(full) [ 942.377678][T27009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 942.377692][T27009] Call Trace: [ 942.377702][T27009] [ 942.377713][T27009] dump_stack_lvl+0xe8/0x150 [ 942.377750][T27009] lockdep_rcu_suspicious+0x13f/0x1d0 [ 942.377790][T27009] get_callchain_entry+0x2b6/0x3c0 [ 942.377830][T27009] get_perf_callchain+0xcb/0x830 [ 942.377870][T27009] ? __pfx_get_perf_callchain+0x10/0x10 [ 942.377905][T27009] ? futex_unqueue+0x22/0x240 [ 942.377934][T27009] ? futex_unqueue+0x22/0x240 [ 942.377960][T27009] ? futex_unqueue+0x22/0x240 [ 942.377996][T27009] __bpf_get_stack+0x445/0xab0 [ 942.378041][T27009] ? __pfx___bpf_get_stack+0x10/0x10 [ 942.378079][T27009] ? __lock_acquire+0x6b5/0x2cf0 [ 942.378116][T27009] bpf_get_stack+0x33/0x50 [ 942.378147][T27009] ? bpf_prog_42db8cfdf50901c9+0x46/0x4e [ 942.378169][T27009] bpf_get_stack_raw_tp+0x1a9/0x220 [ 942.378211][T27009] bpf_prog_42db8cfdf50901c9+0x46/0x4e [ 942.378234][T27009] bpf_prog_run_pin_on_cpu+0x3b4/0x470 [ 942.378270][T27009] bpf_prog_test_run_syscall+0x318/0x4c0 [ 942.378302][T27009] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 942.378329][T27009] ? __fget_files+0x2a/0x420 [ 942.378361][T27009] ? __pfx_bpf_prog_test_run_syscall+0x10/0x10 [ 942.378391][T27009] bpf_prog_test_run+0x2c7/0x340 [ 942.378421][T27009] __sys_bpf+0x5cb/0x920 [ 942.378446][T27009] ? __pfx___sys_bpf+0x10/0x10 [ 942.378493][T27009] ? rcu_is_watching+0x15/0xb0 [ 942.378525][T27009] __x64_sys_bpf+0x7c/0x90 [ 942.378559][T27009] do_syscall_64+0xe2/0xf80 [ 942.378586][T27009] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.378608][T27009] ? trace_irq_disable+0x37/0x100 [ 942.378640][T27009] ? clear_bhb_loop+0x60/0xb0 [ 942.378668][T27009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 942.378691][T27009] RIP: 0033:0x7f2376d9aeb9 [ 942.378712][T27009] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 942.378733][T27009] RSP: 002b:00007f2377cbf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 942.378757][T27009] RAX: ffffffffffffffda RBX: 00007f2377015fa0 RCX: 00007f2376d9aeb9 [ 942.378775][T27009] RDX: 000000000000000c RSI: 00002000000004c0 RDI: 000000000000000a [ 942.378789][T27009] RBP: 00007f2376e08c1f R08: 0000000000000000 R09: 0000000000000000 [ 942.378804][T27009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 942.378818][T27009] R13: 00007f2377016038 R14: 00007f2377015fa0 R15: 00007ffd6dbf9fd8 [ 942.378854][T27009] [ 942.724699][T26965] lo speed is unknown, defaulting to 1000 [ 943.441099][T26965] lo speed is unknown, defaulting to 1000