last executing test programs: 6m24.879805222s ago: executing program 4 (id=9177): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0x3, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 6m24.695277116s ago: executing program 4 (id=9182): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100003020702500000000002020207b1af8ff00000000bfa1000000000000070100003affffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffd}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000400)='kfree\x00', r0}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x1c, 0x3, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040800}, 0x8d0) 6m24.536984252s ago: executing program 4 (id=9184): socketpair$tipc(0x1e, 0x4, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$tipc(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000005c0)='kfree_skb\x00', r2}, 0x18) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='kfree_skb\x00', r3}, 0x10) close(r0) 6m24.471176466s ago: executing program 4 (id=9186): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x25dddbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xffff, 0xffff}, {0x1, 0xd}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x32, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x0, 0xa}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x220048e8}, 0x800) 6m24.218829764s ago: executing program 4 (id=9192): r0 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$nl_route(r0, 0x0, 0x4008040) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000800)=@newlink={0x44, 0x10, 0x503, 0x70bd2a, 0x4, {0x0, 0x0, 0x0, 0x0, 0x0, 0x201a0}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_SCB={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x800) 6m23.745842046s ago: executing program 4 (id=9200): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000040)={@multicast2, @multicast1, r2}, 0xc) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 6m23.515482994s ago: executing program 32 (id=9200): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000040)={@multicast2, @multicast1, r2}, 0xc) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.882101375s ago: executing program 2 (id=13742): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0xffffffffffffffe0}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) 1.724905945s ago: executing program 2 (id=13744): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000980)=ANY=[@ANYBLOB="9feb010018000000000000002400000024000000090000000000000000000083"], 0x0, 0x45, 0x0, 0x0, 0xa}, 0x20) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @private2, 0x3}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x25, &(0x7f00000012c0)={r1, @in={{0x2, 0x4e20, @empty}}}, 0xff6b) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_int(r3, 0x107, 0xa, 0x0, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000100)="6507060082762422f9a30250a90def79e5ddb933b83b8f8f", 0x18) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, 0x0, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$IPSET_CMD_RENAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000000506010200000000000000000a000001"], 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r6, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) write$tun(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5", @ANYRES8=r2, @ANYRESOCT=r1], 0x72) bind$inet6(r3, &(0x7f0000000240)={0xa, 0x4e20, 0x4, @empty}, 0xffffffffffffff98) setsockopt$inet6_udp_int(r4, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, 0x0, 0x0) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r8, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000001311ff00000000000000000000000000000000ff0200000003000000000000e9ffff004f194e20"], 0x4b) r10 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$SIOCRSSCAUSE(r10, 0x89e1, 0x0) bind$rose(r10, &(0x7f00000000c0)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @bcast}, 0x1c) 1.610857347s ago: executing program 3 (id=13746): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x20, 0x1, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x20040000) 1.530352957s ago: executing program 0 (id=13747): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=ANY=[], 0x10}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="8fedcb79079a00f29f009875f37538e486697340f41cf67e93a43826e0185884259102f592409c3c0e00023f2a3de7f66463f9bb4f3461d3219733807279fc7a"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="05000000050000000100000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0xe, 0x0, &(0x7f0000000580)='syzkaller\x00', 0xa, 0x5, &(0x7f0000000140)=""/5, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[r1, r1, r1, r1, 0xffffffffffffffff, r1], 0x0, 0x10, 0xfffffffe}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x18) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c010}, 0x50) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r4 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$inet_sctp6_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f00000004c0)=0x1, 0x4) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 1.5005991s ago: executing program 5 (id=13749): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@local, 0x800, 0x0, 0x2, 0x1, 0x3}, 0x20) (async) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) (async) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000001c0)={@loopback, 0x800, 0x1}, 0x20) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'ipvlan0\x00', 0x0}) (async) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000fedbdf25080000001800028014000380100001800400030008000100050000000c00018008000100", @ANYRES32=r2], 0x38}, 0x1, 0x0, 0x0, 0x40801}, 0x14) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)={0x4c, r5, 0x1, 0x70bd27, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x20, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ethtool\x00'}]}]}]}]}, 0x4c}}, 0x804) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$pptp(0x18, 0x1, 0x2) (async) sendmmsg(r6, &(0x7f00000025c0), 0x6, 0x8800) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r1) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}]}, 0x54}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6_vti0\x00', r3, 0x29, 0x0, 0xf9, 0x2, 0x40, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7, 0x80, 0xffffff7f}}) (async) unshare(0x6020400) (async) r9 = gettid() syz_open_procfs$namespace(r9, &(0x7f0000000000)='ns/uts\x00') (async) unshare(0x2c060000) close(0x3) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r1, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f00000027c0)={0xe4, r7, 0x208, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x10}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @local}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x553}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x24}}]}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_TOKEN={0x0, 0x4, 0x401}, @MPTCP_PM_ATTR_SUBFLOWS={0x0, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x0, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x5}, @MPTCP_PM_ATTR_ADDR={0x62}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4080}, 0x10000091) 1.475767074s ago: executing program 3 (id=13750): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'hsr0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xd}, {0xfff1, 0xfff2}, {0xffe0, 0x20}}}, 0x24}}, 0x40000) 1.454768537s ago: executing program 0 (id=13751): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000080)={0x64, r3, 0x1, 0x0, 0x0, {0x37}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x64}}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$inet6(r4, &(0x7f0000008e00)=[{{0x0, 0x0, 0x0}}], 0x1, 0xc0c0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00'}) r5 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r2) sendmsg$NL80211_CMD_ADD_TX_TS(r2, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x64, r7, 0x20, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_USER_PRIO={0x5}, @NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x3}, @NL80211_ATTR_ADMITTED_TIME={0x6, 0xd4, 0x52a1}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x48000) r8 = socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_sfb={{0x59}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x9, 0x9, 0x81, 0xd4, 0x7, 0xfffffffb, 0x100, 0xf4e5, 0x5}}}}]}, 0x58}}, 0x20040084) sendmsg$nl_route_sched(r8, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x34, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {0x7, 0xffff}, {0xc, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x8}}, @TCA_RATE={0x6, 0x5, {0xaa, 0x8}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000000) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r11, 0x8946, &(0x7f0000000140)={'macvlan0\x00', &(0x7f0000000080)=@ethtool_modinfo={0x42, 0xc273, 0x1dfaeca2}}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000740)) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x80489439, &(0x7f00000002c0)) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r13, 0x1}, 0x14}}, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r1, 0x8004f50e, &(0x7f0000000180)) syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[], 0x60}, 0x1, 0x0, 0x0, 0x4040}, 0x44800) 1.270440861s ago: executing program 2 (id=13753): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'hsr0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610408000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x3, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffe6b}, 0x48) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000c40)=ANY=[], 0x58}}, 0x0) sendmsg$NL80211_CMD_SET_REG(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, 0x0, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x9}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x2}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x14}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0xff}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x8010}, 0x4048000) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x0) recvmmsg(r2, &(0x7f0000000000)=[{{0x0, 0x140, &(0x7f0000000180)=[{&(0x7f00000014c0)=""/4095, 0x1014}, {&(0x7f00000003c0)=""/254, 0xf0}], 0x4, 0x0, 0x353}}], 0xebadb096fd1881, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x6}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r6, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xd}, {0xfff1, 0xfff2}, {0xffe0}}}, 0x24}}, 0x40000) 1.222116511s ago: executing program 5 (id=13754): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x3e8, @remote, 0x31}]}, &(0x7f0000002100)=0x10) 1.211310311s ago: executing program 3 (id=13755): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000)=0x3, 0x4) sendto$inet6(r0, &(0x7f0000000500)='g', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000000c0)={0xb, 0x4, 0xfe, 0x2, 0x3, 0xfd, 0xe5, 0x0, 0x6, 0x4, 0x6, 0x0, 0xf, 0x8}, 0xe) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[], 0x7c}}, 0x0) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}, 0x4000000}], 0x414, 0x0, 0x0) 1.07476172s ago: executing program 1 (id=13756): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3f9d0000000000000000170000000800", @ANYRES32=r2, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 1.07439462s ago: executing program 5 (id=13757): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x9c35}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_VALIDATION={0x5, 0xd, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x48890}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x0, @remote, 0x34}]}, &(0x7f0000002100)=0x10) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, 0x0, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newtaction={0x48, 0x32, 0x1, 0x80, 0x25dfdbfe, {}, [{0x34, 0x1, [@m_vlan={0x30, 0x1, 0x0, 0x0, {{0x9, 0x3}, {0xfffffffffffffd97}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x48}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000140), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@union={0xd, 0x1, 0x0, 0x5, 0x1, 0x7, [{0x0, 0x5, 0x9}]}]}, {0x0, [0x5f]}}, 0x0, 0x33}, 0x28) 1.013092049s ago: executing program 2 (id=13758): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) syz_emit_ethernet(0x3a, &(0x7f0000000240)={@local, @link_local, @val={@void, {0x4305, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0xfffc, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x6}}}}}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) sendmsg$NL80211_CMD_GET_KEY(r0, &(0x7f0000005a40)={0x0, 0x0, &(0x7f0000005a00)={&(0x7f0000005a80)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fddbdf250900000008000300", @ANYRES32=r1, @ANYBLOB="40005080110001006bbfc8f4565dc5cdb7aafb342300000014000880040002000400020004000100040002000800030001ac0f000a000400d895308802a10000050008"], 0x78}, 0x1, 0x0, 0x0, 0x8010}, 0x4040000) 985.130032ms ago: executing program 0 (id=13759): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x4) 910.70839ms ago: executing program 3 (id=13760): getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, &(0x7f0000000240)=""/211, &(0x7f0000000000)=0xd3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x13, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000066adbfc29068732cfaf70a772ca00000001801000020696c2500000000002020207b0a00fe00000000bda106000000000026010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020c31af8ffa1000000bfa100000000000007ff000000feffffb702000008000000b7030000000000008500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 849.173285ms ago: executing program 5 (id=13761): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)=ANY=[], 0x10}], 0x1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="8fedcb79079a00f29f009875f37538e486697340f41cf67e93a43826e0185884259102f592409c3c0e00023f2a3de7f66463f9bb4f3461d3219733807279fc7a"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="05000000050000000100000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0xe, 0x0, &(0x7f0000000580)='syzkaller\x00', 0xa, 0x5, &(0x7f0000000140)=""/5, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[r1, r1, r1, r1, 0xffffffffffffffff, r1], 0x0, 0x10, 0xfffffffe}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x18) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r2, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c010}, 0x50) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r4 = accept4(r3, 0x0, 0x0, 0x800) setsockopt$inet_sctp6_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f00000004c0)=0x1, 0x4) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 837.137413ms ago: executing program 0 (id=13762): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000800000006"], 0x48) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c, 0x0}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001a00)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000080)="1a64829bf8f72508a80cd8d857b57faf39ee3f9eea1eee8a57ed874438f5d4c1071331ca143e3e50586a06bc83689f2a60f917d4a74431cca878e35f69c9cc01bd35", 0x42}], 0x1, 0x0, 0x168}}], 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_proto_private(r0, 0x8b20, &(0x7f0000000080)) 837.023797ms ago: executing program 2 (id=13763): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0xfffc}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, 0x0, 0x0) 824.529292ms ago: executing program 1 (id=13764): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, 0x0, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001080)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010026bd7000ffdbdf250300000008000300", @ANYRES32=r5], 0x28}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'dummy0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x84, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x58, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0x1, 0x1, 0x3, 0x1, 0x4, 0x2, 0x6, 0x7ffffffa, [{0x1fc, 0x500, 0x3, 0x6}, {0x6783, 0x2, 0x8001, 0x10}, {0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_MARK={0x10, 0xa, {0x0, 0x6}}]}}]}, 0x84}}, 0x24040084) 753.789404ms ago: executing program 3 (id=13765): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'hsr0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xd}, {0xfff1, 0xfff2}, {0xffe0, 0x21}}}, 0x24}}, 0x40000) 753.034612ms ago: executing program 0 (id=13766): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086", 0x17}], 0x1}, 0x4) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="20010000120013070000000000000000e0000001000000000000000000000000fc00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072c42572f64a264410b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbc18c8582fc7800000000000000000000000050019000000000028001a"], 0x120}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="850000008a0000009500000000000500"], &(0x7f0000000180)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x11}, 0xea) 667.017852ms ago: executing program 5 (id=13767): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140012"], 0x48}}, 0x400400c0) sendfile(0xffffffffffffffff, r0, &(0x7f0000000040)=0x10000, 0x4) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 614.69236ms ago: executing program 1 (id=13768): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x1}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000500000000000000000800040001000000", 0x24) 614.469304ms ago: executing program 2 (id=13769): socket$packet(0x11, 0x2, 0x300) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f0000000140), &(0x7f0000000040)=0x80) (async) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f0000000140), &(0x7f0000000040)=0x80) syz_emit_ethernet(0x32, &(0x7f0000000100)={@link_local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x38}, @void, {@ipv4={0x88e5, @dccp={{0x5, 0x4, 0x2, 0x1, 0x24, 0x67, 0x0, 0x7, 0x21, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast}, {{0x4e22, 0x4e23, 0x4, 0x1, 0xc, 0x0, 0x0, 0x1, 0x1, "05f945", 0x4, "44f28b"}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000000000000071114200000000008510000002000000850000000500000095000000000000009500a50500000000a681c9cc3825038a0fe4295446"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) 613.347169ms ago: executing program 0 (id=13770): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newqdisc={0x38, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_QUANTUM={0x8, 0x2, 0xa406}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) (fail_nth: 5) 571.044992ms ago: executing program 5 (id=13771): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000200)=0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40004) r4 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)={0x1c, 0xd, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) r5 = socket(0xa, 0x3, 0x3a) syz_emit_ethernet(0x16, &(0x7f0000000340)={@remote, @remote, @void, {@generic={0x9100, "bcef9fcef53a5ba3"}}}, 0x0) setsockopt$MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f0000000000)={0x2, 0x1, 0x0, 0x0, 0x200}, 0x3a) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000080)=0x9, 0x4) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r7], 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="7025034f0404"], 0x6) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r1) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000200)) (async) sendmsg$NFC_CMD_ACTIVATE_TARGET(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x1c, r2, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40004) (async) socket$netlink(0x10, 0x3, 0xc) (async) sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)={0x1c, 0xd, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) (async) socket(0xa, 0x3, 0x3a) (async) syz_emit_ethernet(0x16, &(0x7f0000000340)={@remote, @remote, @void, {@generic={0x9100, "bcef9fcef53a5ba3"}}}, 0x0) (async) setsockopt$MRT6_ADD_MIF(r5, 0x29, 0xca, &(0x7f0000000000)={0x2, 0x1, 0x0, 0x0, 0x200}, 0x3a) (async) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000080)=0x9, 0x4) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)) (async) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r7], 0x1c}}, 0x0) (async) write$nci(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="7025034f0404"], 0x6) (async) 518.164234ms ago: executing program 1 (id=13772): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x4) 18.718586ms ago: executing program 1 (id=13773): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0xffffffffffffffe0}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) 18.353717ms ago: executing program 3 (id=13774): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3f9d000000000000000017000000080003", @ANYRES32=r2, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c000180050002000000000008000400050000000800010002000000240003"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) 0s ago: executing program 1 (id=13775): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b05, 0x0) kernel console output (not intermixed with test programs): __pfx_ksys_write+0x10/0x10 [ 889.535709][ T4295] ? do_syscall_64+0xbe/0xfa0 [ 889.535737][ T4295] do_syscall_64+0xfa/0xfa0 [ 889.535758][ T4295] ? lockdep_hardirqs_on+0x9c/0x150 [ 889.535781][ T4295] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.535804][ T4295] ? clear_bhb_loop+0x60/0xb0 [ 889.535825][ T4295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.535842][ T4295] RIP: 0033:0x7feeceb8f6c9 [ 889.535859][ T4295] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 889.535874][ T4295] RSP: 002b:00007feecfa5d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 889.535894][ T4295] RAX: ffffffffffffffda RBX: 00007feecede5fa0 RCX: 00007feeceb8f6c9 [ 889.535908][ T4295] RDX: 0000000024000080 RSI: 0000200000000640 RDI: 0000000000000003 [ 889.535921][ T4295] RBP: 00007feecfa5d090 R08: 0000000000000000 R09: 0000000000000000 [ 889.535932][ T4295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 889.535943][ T4295] R13: 00007feecede6038 R14: 00007feecede5fa0 R15: 00007ffd2afbd348 [ 889.535983][ T4295] [ 889.841286][ T4292] syzkaller0: entered promiscuous mode [ 889.855454][ T4292] syzkaller0: entered allmulticast mode [ 889.952978][ T4299] tipc: Enabled bearer , priority 0 [ 889.965473][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 889.989583][ T4303] tipc: Enabled bearer , priority 0 [ 890.009095][ T4303] tipc: Resetting bearer [ 890.033572][ T4302] tipc: Disabling bearer [ 890.072583][ T4299] syzkaller0: entered promiscuous mode [ 890.088235][ T4299] syzkaller0: entered allmulticast mode [ 890.137565][ T4299] tipc: Resetting bearer [ 890.186452][ T4307] bond18: option packets_per_slave: invalid value (18446744073709551615) [ 890.203744][ T4307] bond18: option packets_per_slave: allowed values 0 - 65535 [ 890.214628][ T4307] bond18 (unregistering): Released all slaves [ 890.232343][ T4298] tipc: Resetting bearer [ 890.247490][ T4298] tipc: Disabling bearer [ 890.279324][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 890.395610][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 890.462684][ T4330] syzkaller1: entered promiscuous mode [ 890.490039][ T4330] syzkaller1: entered allmulticast mode [ 890.731320][ T4335] syzkaller0: entered promiscuous mode [ 890.737727][ T4335] syzkaller0: entered allmulticast mode [ 890.756556][ T4348] syzkaller0: entered promiscuous mode [ 890.762064][ T4348] syzkaller0: entered allmulticast mode [ 890.772288][ T4353] __nla_validate_parse: 9 callbacks suppressed [ 890.772306][ T4353] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12571'. [ 891.005037][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 891.115600][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 891.177051][ T4375] tipc: Enabled bearer , priority 0 [ 891.192032][ T4375] syzkaller0: entered promiscuous mode [ 891.210018][ T4371] FAULT_INJECTION: forcing a failure. [ 891.210018][ T4371] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 891.214691][ T4375] syzkaller0: entered allmulticast mode [ 891.223282][ T4371] CPU: 1 UID: 0 PID: 4371 Comm: syz.0.12575 Not tainted syzkaller #0 PREEMPT(full) [ 891.223308][ T4371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 891.223319][ T4371] Call Trace: [ 891.223333][ T4371] [ 891.223342][ T4371] dump_stack_lvl+0x189/0x250 [ 891.223370][ T4371] ? __pfx____ratelimit+0x10/0x10 [ 891.223393][ T4371] ? __pfx_dump_stack_lvl+0x10/0x10 [ 891.223415][ T4371] ? __pfx__printk+0x10/0x10 [ 891.223435][ T4371] ? __might_fault+0xb0/0x130 [ 891.223470][ T4371] should_fail_ex+0x414/0x560 [ 891.223501][ T4371] _copy_from_user+0x2d/0xb0 [ 891.223524][ T4371] ___sys_recvmsg+0x12e/0x510 [ 891.223551][ T4371] ? __pfx____sys_recvmsg+0x10/0x10 [ 891.223605][ T4371] ? __might_fault+0xb0/0x130 [ 891.223632][ T4371] do_recvmmsg+0x307/0x770 [ 891.223661][ T4371] ? __pfx_do_recvmmsg+0x10/0x10 [ 891.223692][ T4371] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 891.223735][ T4371] __x64_sys_recvmmsg+0x190/0x240 [ 891.223759][ T4371] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 891.223783][ T4371] ? do_syscall_64+0xbe/0xfa0 [ 891.223810][ T4371] do_syscall_64+0xfa/0xfa0 [ 891.223831][ T4371] ? lockdep_hardirqs_on+0x9c/0x150 [ 891.223854][ T4371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.223872][ T4371] ? clear_bhb_loop+0x60/0xb0 [ 891.223894][ T4371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.223911][ T4371] RIP: 0033:0x7fa73258f6c9 [ 891.223927][ T4371] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 891.223942][ T4371] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 891.223962][ T4371] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 891.223976][ T4371] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 891.223987][ T4371] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 891.223999][ T4371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 891.224010][ T4371] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 891.224043][ T4371] [ 891.455386][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 891.518465][ T4375] tipc: Resetting bearer [ 891.549602][ T4374] tipc: Resetting bearer [ 891.571766][ T4374] tipc: Disabling bearer [ 891.587241][ T4394] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12582'. [ 891.597705][ T4394] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12582'. [ 891.615194][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 891.670428][ T4394] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12582'. [ 891.681997][ T4394] netlink: 'syz.0.12582': attribute type 5 has an invalid length. [ 891.701564][ T4394] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12582'. [ 891.721915][ T4394] geneve6: entered promiscuous mode [ 891.728442][ T4394] geneve6: entered allmulticast mode [ 891.736421][ T991] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 891.745937][ T991] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 891.769192][ T991] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 891.790402][ T991] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 891.848109][ T4404] syzkaller0: entered promiscuous mode [ 891.860777][ T4404] syzkaller0: entered allmulticast mode [ 891.969515][ T4416] FAULT_INJECTION: forcing a failure. [ 891.969515][ T4416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 892.005059][ T4416] CPU: 1 UID: 0 PID: 4416 Comm: syz.5.12588 Not tainted syzkaller #0 PREEMPT(full) [ 892.005085][ T4416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 892.005096][ T4416] Call Trace: [ 892.005103][ T4416] [ 892.005112][ T4416] dump_stack_lvl+0x189/0x250 [ 892.005140][ T4416] ? __pfx____ratelimit+0x10/0x10 [ 892.005164][ T4416] ? __pfx_dump_stack_lvl+0x10/0x10 [ 892.005186][ T4416] ? __pfx__printk+0x10/0x10 [ 892.005217][ T4416] should_fail_ex+0x414/0x560 [ 892.005248][ T4416] _copy_to_user+0x31/0xb0 [ 892.005272][ T4416] simple_read_from_buffer+0xe1/0x170 [ 892.005304][ T4416] proc_fail_nth_read+0x1b3/0x220 [ 892.005330][ T4416] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 892.005356][ T4416] ? rw_verify_area+0x2a6/0x4d0 [ 892.005377][ T4416] ? __lock_acquire+0xab9/0xd20 [ 892.005391][ T4416] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 892.005413][ T4416] vfs_read+0x200/0xa30 [ 892.005433][ T4416] ? fdget_pos+0x247/0x320 [ 892.005455][ T4416] ? __pfx___mutex_lock+0x10/0x10 [ 892.005479][ T4416] ? __pfx_vfs_read+0x10/0x10 [ 892.005502][ T4416] ? __fget_files+0x2a/0x420 [ 892.005524][ T4416] ? __fget_files+0x3a0/0x420 [ 892.005540][ T4416] ? __fget_files+0x2a/0x420 [ 892.005566][ T4416] ksys_read+0x145/0x250 [ 892.005592][ T4416] ? __pfx_ksys_read+0x10/0x10 [ 892.005618][ T4416] ? do_syscall_64+0xbe/0xfa0 [ 892.005646][ T4416] do_syscall_64+0xfa/0xfa0 [ 892.005667][ T4416] ? lockdep_hardirqs_on+0x9c/0x150 [ 892.005689][ T4416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.005707][ T4416] ? clear_bhb_loop+0x60/0xb0 [ 892.005729][ T4416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.005746][ T4416] RIP: 0033:0x7f0be1f8e0dc [ 892.005762][ T4416] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 892.005777][ T4416] RSP: 002b:00007f0be01f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 892.005796][ T4416] RAX: ffffffffffffffda RBX: 00007f0be21e5fa0 RCX: 00007f0be1f8e0dc [ 892.005809][ T4416] RDX: 000000000000000f RSI: 00007f0be01f60a0 RDI: 0000000000000004 [ 892.005820][ T4416] RBP: 00007f0be01f6090 R08: 0000000000000000 R09: 0000000000000000 [ 892.005832][ T4416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 892.005843][ T4416] R13: 00007f0be21e6038 R14: 00007f0be21e5fa0 R15: 00007ffcbe801b28 [ 892.005876][ T4416] [ 892.253655][ T991] net_ratelimit: 1 callbacks suppressed [ 892.253676][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 892.376155][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 892.401190][ T4424] FAULT_INJECTION: forcing a failure. [ 892.401190][ T4424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 892.437048][ T4424] CPU: 0 UID: 0 PID: 4424 Comm: syz.1.12589 Not tainted syzkaller #0 PREEMPT(full) [ 892.437074][ T4424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 892.437085][ T4424] Call Trace: [ 892.437092][ T4424] [ 892.437101][ T4424] dump_stack_lvl+0x189/0x250 [ 892.437129][ T4424] ? __pfx____ratelimit+0x10/0x10 [ 892.437153][ T4424] ? __pfx_dump_stack_lvl+0x10/0x10 [ 892.437182][ T4424] ? __pfx__printk+0x10/0x10 [ 892.437201][ T4424] ? __might_fault+0xb0/0x130 [ 892.437236][ T4424] should_fail_ex+0x414/0x560 [ 892.437266][ T4424] _copy_from_user+0x2d/0xb0 [ 892.437290][ T4424] ___sys_recvmsg+0x12e/0x510 [ 892.437315][ T4424] ? __pfx____sys_recvmsg+0x10/0x10 [ 892.437367][ T4424] ? __might_fault+0xb0/0x130 [ 892.437394][ T4424] do_recvmmsg+0x307/0x770 [ 892.437423][ T4424] ? __pfx_do_recvmmsg+0x10/0x10 [ 892.437456][ T4424] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 892.437498][ T4424] __x64_sys_recvmmsg+0x190/0x240 [ 892.437521][ T4424] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 892.437546][ T4424] ? do_syscall_64+0xbe/0xfa0 [ 892.437573][ T4424] do_syscall_64+0xfa/0xfa0 [ 892.437599][ T4424] ? lockdep_hardirqs_on+0x9c/0x150 [ 892.437622][ T4424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.437639][ T4424] ? clear_bhb_loop+0x60/0xb0 [ 892.437664][ T4424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.437685][ T4424] RIP: 0033:0x7f821ed8f6c9 [ 892.437701][ T4424] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 892.437716][ T4424] RSP: 002b:00007f821fbbf038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 892.437735][ T4424] RAX: ffffffffffffffda RBX: 00007f821efe5fa0 RCX: 00007f821ed8f6c9 [ 892.437748][ T4424] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 892.437760][ T4424] RBP: 00007f821fbbf090 R08: 0000000000000000 R09: 0000000000000000 [ 892.437772][ T4424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 892.437783][ T4424] R13: 00007f821efe6038 R14: 00007f821efe5fa0 R15: 00007ffffa97ee98 [ 892.437816][ T4424] [ 892.659019][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 892.698146][ T4434] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12593'. [ 892.733526][ T4438] netlink: 'syz.2.12595': attribute type 1 has an invalid length. [ 892.795477][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 892.849293][ T4436] syzkaller0: entered promiscuous mode [ 892.858006][ T4436] syzkaller0: entered allmulticast mode [ 892.927164][ T4445] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12596'. [ 893.025211][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 893.123943][ T4461] netlink: 'syz.2.12599': attribute type 10 has an invalid length. [ 893.225391][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 893.233557][ T4465] syzkaller0: entered promiscuous mode [ 893.240139][ T4465] syzkaller0: entered allmulticast mode [ 893.340627][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 893.465477][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 893.606642][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 893.692022][ T4495] netlink: 36 bytes leftover after parsing attributes in process `syz.5.12611'. [ 893.712804][ T4496] netlink: 'syz.0.12612': attribute type 3 has an invalid length. [ 893.720303][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 893.721128][ T4498] netlink: 'syz.0.12612': attribute type 3 has an invalid length. [ 894.022556][ T4506] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12614'. [ 894.125131][ T4516] netlink: 8 bytes leftover after parsing attributes in process `syz.5.12616'. [ 894.347789][ T4530] Unsupported ieee802154 address type: 0 [ 894.398498][ T4535] FAULT_INJECTION: forcing a failure. [ 894.398498][ T4535] name failslab, interval 1, probability 0, space 0, times 0 [ 894.415115][ T4535] CPU: 1 UID: 0 PID: 4535 Comm: syz.5.12627 Not tainted syzkaller #0 PREEMPT(full) [ 894.415140][ T4535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 894.415152][ T4535] Call Trace: [ 894.415160][ T4535] [ 894.415168][ T4535] dump_stack_lvl+0x189/0x250 [ 894.415196][ T4535] ? __pfx____ratelimit+0x10/0x10 [ 894.415220][ T4535] ? __pfx_dump_stack_lvl+0x10/0x10 [ 894.415242][ T4535] ? __pfx__printk+0x10/0x10 [ 894.415265][ T4535] ? __pfx___might_resched+0x10/0x10 [ 894.415285][ T4535] ? fs_reclaim_acquire+0x7d/0x100 [ 894.415316][ T4535] should_fail_ex+0x414/0x560 [ 894.415347][ T4535] should_failslab+0xa8/0x100 [ 894.415367][ T4535] __kmalloc_cache_noprof+0x6f/0x6f0 [ 894.415390][ T4535] ? netlink_lookup+0x30/0x200 [ 894.415412][ T4535] ? genl_start+0x1c9/0x6c0 [ 894.415437][ T4535] genl_start+0x1c9/0x6c0 [ 894.415456][ T4535] ? netlink_lookup+0x30/0x200 [ 894.415486][ T4535] __netlink_dump_start+0x469/0x7e0 [ 894.415520][ T4535] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 894.415545][ T4535] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 894.415566][ T4535] ? genl_get_cmd+0x7d9/0x910 [ 894.415587][ T4535] ? __pfx___mutex_lock+0x10/0x10 [ 894.415613][ T4535] ? __pfx_genl_start+0x10/0x10 [ 894.415631][ T4535] ? __pfx_genl_dumpit+0x10/0x10 [ 894.415649][ T4535] ? __pfx_genl_done+0x10/0x10 [ 894.415676][ T4535] ? stack_trace_save+0x9c/0xe0 [ 894.415703][ T4535] genl_rcv_msg+0x5da/0x790 [ 894.415729][ T4535] ? __pfx_genl_rcv_msg+0x10/0x10 [ 894.415757][ T4535] ? __pfx_nl802154_dump_interface+0x10/0x10 [ 894.415798][ T4535] netlink_rcv_skb+0x208/0x470 [ 894.415813][ T4535] ? __lock_acquire+0xab9/0xd20 [ 894.415830][ T4535] ? __pfx_genl_rcv_msg+0x10/0x10 [ 894.415852][ T4535] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 894.415887][ T4535] ? down_read+0x1ad/0x2e0 [ 894.415906][ T4535] genl_rcv+0x28/0x40 [ 894.415924][ T4535] netlink_unicast+0x82f/0x9e0 [ 894.415956][ T4535] ? __pfx_netlink_unicast+0x10/0x10 [ 894.415979][ T4535] ? netlink_sendmsg+0x642/0xb30 [ 894.415993][ T4535] ? skb_put+0x11b/0x210 [ 894.416013][ T4535] netlink_sendmsg+0x805/0xb30 [ 894.416040][ T4535] ? __pfx_netlink_sendmsg+0x10/0x10 [ 894.416063][ T4535] ? aa_sock_msg_perm+0xf1/0x1d0 [ 894.416090][ T4535] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 894.416108][ T4535] ? __pfx_netlink_sendmsg+0x10/0x10 [ 894.416127][ T4535] __sock_sendmsg+0x21c/0x270 [ 894.416154][ T4535] ____sys_sendmsg+0x505/0x830 [ 894.416181][ T4535] ? __pfx_____sys_sendmsg+0x10/0x10 [ 894.416211][ T4535] ? import_iovec+0x74/0xa0 [ 894.416237][ T4535] ___sys_sendmsg+0x21f/0x2a0 [ 894.416259][ T4535] ? __pfx____sys_sendmsg+0x10/0x10 [ 894.416308][ T4535] ? __fget_files+0x2a/0x420 [ 894.416325][ T4535] ? __fget_files+0x3a0/0x420 [ 894.416354][ T4535] __x64_sys_sendmsg+0x19b/0x260 [ 894.416377][ T4535] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 894.416408][ T4535] ? __pfx_ksys_write+0x10/0x10 [ 894.416436][ T4535] ? do_syscall_64+0xbe/0xfa0 [ 894.416464][ T4535] do_syscall_64+0xfa/0xfa0 [ 894.416485][ T4535] ? lockdep_hardirqs_on+0x9c/0x150 [ 894.416508][ T4535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.416527][ T4535] ? clear_bhb_loop+0x60/0xb0 [ 894.416549][ T4535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.416566][ T4535] RIP: 0033:0x7f0be1f8f6c9 [ 894.416583][ T4535] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 894.416598][ T4535] RSP: 002b:00007f0be01f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 894.416618][ T4535] RAX: ffffffffffffffda RBX: 00007f0be21e5fa0 RCX: 00007f0be1f8f6c9 [ 894.416632][ T4535] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 894.416644][ T4535] RBP: 00007f0be01f6090 R08: 0000000000000000 R09: 0000000000000000 [ 894.416655][ T4535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 894.416666][ T4535] R13: 00007f0be21e6038 R14: 00007f0be21e5fa0 R15: 00007ffcbe801b28 [ 894.416701][ T4535] [ 894.474584][ T4542] FAULT_INJECTION: forcing a failure. [ 894.474584][ T4542] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 894.785128][ T4558] sctp: [Deprecated]: syz.0.12632 (pid 4558) Use of struct sctp_assoc_value in delayed_ack socket option. [ 894.785128][ T4558] Use struct sctp_sack_info instead [ 894.797107][ T4542] CPU: 0 UID: 0 PID: 4542 Comm: syz.3.12629 Not tainted syzkaller #0 PREEMPT(full) [ 894.797133][ T4542] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 894.797144][ T4542] Call Trace: [ 894.797152][ T4542] [ 894.797159][ T4542] dump_stack_lvl+0x189/0x250 [ 894.797184][ T4542] ? __pfx____ratelimit+0x10/0x10 [ 894.797206][ T4542] ? __pfx_dump_stack_lvl+0x10/0x10 [ 894.797228][ T4542] ? __pfx__printk+0x10/0x10 [ 894.797247][ T4542] ? __might_fault+0xb0/0x130 [ 894.797279][ T4542] should_fail_ex+0x414/0x560 [ 894.797309][ T4542] _copy_from_user+0x2d/0xb0 [ 894.797329][ T4542] ___sys_sendmsg+0x158/0x2a0 [ 894.797351][ T4542] ? __pfx____sys_sendmsg+0x10/0x10 [ 894.797405][ T4542] ? __fget_files+0x2a/0x420 [ 894.797420][ T4542] ? __fget_files+0x3a0/0x420 [ 894.797445][ T4542] __x64_sys_sendmsg+0x19b/0x260 [ 894.797468][ T4542] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 894.797495][ T4542] ? __pfx_ksys_write+0x10/0x10 [ 894.797521][ T4542] ? do_syscall_64+0xbe/0xfa0 [ 894.797547][ T4542] do_syscall_64+0xfa/0xfa0 [ 894.797568][ T4542] ? lockdep_hardirqs_on+0x9c/0x150 [ 894.797590][ T4542] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.797607][ T4542] ? clear_bhb_loop+0x60/0xb0 [ 894.797627][ T4542] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.797645][ T4542] RIP: 0033:0x7feeceb8f6c9 [ 894.797662][ T4542] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 894.797676][ T4542] RSP: 002b:00007feecfa5d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 894.797694][ T4542] RAX: ffffffffffffffda RBX: 00007feecede5fa0 RCX: 00007feeceb8f6c9 [ 894.797706][ T4542] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 894.797717][ T4542] RBP: 00007feecfa5d090 R08: 0000000000000000 R09: 0000000000000000 [ 894.797729][ T4542] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 894.797740][ T4542] R13: 00007feecede6038 R14: 00007feecede5fa0 R15: 00007ffd2afbd348 [ 894.797771][ T4542] [ 894.886630][ T4553] bond0: (slave bond_slave_0): Releasing backup interface [ 895.111023][ T4553] team0: Port device team_slave_0 removed [ 895.127328][ T4553] team0: Port device team_slave_1 removed [ 895.469312][ T4580] FAULT_INJECTION: forcing a failure. [ 895.469312][ T4580] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 895.499804][ T4580] CPU: 0 UID: 0 PID: 4580 Comm: syz.0.12639 Not tainted syzkaller #0 PREEMPT(full) [ 895.499831][ T4580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 895.499842][ T4580] Call Trace: [ 895.499849][ T4580] [ 895.499858][ T4580] dump_stack_lvl+0x189/0x250 [ 895.499892][ T4580] ? __pfx____ratelimit+0x10/0x10 [ 895.499916][ T4580] ? __pfx_dump_stack_lvl+0x10/0x10 [ 895.499938][ T4580] ? __pfx__printk+0x10/0x10 [ 895.499957][ T4580] ? __might_fault+0xb0/0x130 [ 895.499992][ T4580] should_fail_ex+0x414/0x560 [ 895.500023][ T4580] _copy_from_user+0x2d/0xb0 [ 895.500046][ T4580] ___sys_recvmsg+0x12e/0x510 [ 895.500073][ T4580] ? __pfx____sys_recvmsg+0x10/0x10 [ 895.500125][ T4580] ? __might_fault+0xb0/0x130 [ 895.500152][ T4580] do_recvmmsg+0x307/0x770 [ 895.500181][ T4580] ? __pfx_do_recvmmsg+0x10/0x10 [ 895.500214][ T4580] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 895.500256][ T4580] __x64_sys_recvmmsg+0x190/0x240 [ 895.500279][ T4580] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 895.500304][ T4580] ? do_syscall_64+0xbe/0xfa0 [ 895.500331][ T4580] do_syscall_64+0xfa/0xfa0 [ 895.500352][ T4580] ? lockdep_hardirqs_on+0x9c/0x150 [ 895.500375][ T4580] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.500392][ T4580] ? clear_bhb_loop+0x60/0xb0 [ 895.500414][ T4580] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.500431][ T4580] RIP: 0033:0x7fa73258f6c9 [ 895.500448][ T4580] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 895.500463][ T4580] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 895.500483][ T4580] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 895.500496][ T4580] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 895.500507][ T4580] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 895.500518][ T4580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 895.500530][ T4580] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 895.500562][ T4580] [ 895.829187][ T4593] FAULT_INJECTION: forcing a failure. [ 895.829187][ T4593] name failslab, interval 1, probability 0, space 0, times 0 [ 895.846035][ T4593] CPU: 1 UID: 0 PID: 4593 Comm: syz.0.12641 Not tainted syzkaller #0 PREEMPT(full) [ 895.846062][ T4593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 895.846071][ T4593] Call Trace: [ 895.846078][ T4593] [ 895.846085][ T4593] dump_stack_lvl+0x189/0x250 [ 895.846109][ T4593] ? __pfx____ratelimit+0x10/0x10 [ 895.846129][ T4593] ? __pfx_dump_stack_lvl+0x10/0x10 [ 895.846147][ T4593] ? __pfx__printk+0x10/0x10 [ 895.846169][ T4593] ? __pfx___might_resched+0x10/0x10 [ 895.846186][ T4593] ? fs_reclaim_acquire+0x7d/0x100 [ 895.846217][ T4593] should_fail_ex+0x414/0x560 [ 895.846247][ T4593] should_failslab+0xa8/0x100 [ 895.846267][ T4593] kmem_cache_alloc_node_noprof+0x77/0x710 [ 895.846290][ T4593] ? __alloc_skb+0x112/0x2d0 [ 895.846314][ T4593] __alloc_skb+0x112/0x2d0 [ 895.846336][ T4593] netlink_dump+0x1b7/0xe90 [ 895.846374][ T4593] ? __pfx_netlink_dump+0x10/0x10 [ 895.846414][ T4593] ? genl_start+0x499/0x6c0 [ 895.846442][ T4593] __netlink_dump_start+0x5cb/0x7e0 [ 895.846475][ T4593] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 895.846501][ T4593] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 895.846522][ T4593] ? genl_get_cmd+0x7d9/0x910 [ 895.846544][ T4593] ? __pfx___mutex_lock+0x10/0x10 [ 895.846569][ T4593] ? __pfx_genl_start+0x10/0x10 [ 895.846586][ T4593] ? __pfx_genl_dumpit+0x10/0x10 [ 895.846603][ T4593] ? __pfx_genl_done+0x10/0x10 [ 895.846628][ T4593] ? stack_trace_save+0x9c/0xe0 [ 895.846656][ T4593] genl_rcv_msg+0x5da/0x790 [ 895.846683][ T4593] ? __pfx_genl_rcv_msg+0x10/0x10 [ 895.846700][ T4593] ? __pfx_nl802154_dump_interface+0x10/0x10 [ 895.846733][ T4593] netlink_rcv_skb+0x208/0x470 [ 895.846745][ T4593] ? __lock_acquire+0xab9/0xd20 [ 895.846759][ T4593] ? __pfx_genl_rcv_msg+0x10/0x10 [ 895.846777][ T4593] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 895.846808][ T4593] ? down_read+0x1ad/0x2e0 [ 895.846824][ T4593] genl_rcv+0x28/0x40 [ 895.846848][ T4593] netlink_unicast+0x82f/0x9e0 [ 895.846875][ T4593] ? __pfx_netlink_unicast+0x10/0x10 [ 895.846896][ T4593] ? netlink_sendmsg+0x642/0xb30 [ 895.846908][ T4593] ? skb_put+0x11b/0x210 [ 895.846926][ T4593] netlink_sendmsg+0x805/0xb30 [ 895.846953][ T4593] ? __pfx_netlink_sendmsg+0x10/0x10 [ 895.846970][ T4593] ? aa_sock_msg_perm+0xf1/0x1d0 [ 895.846993][ T4593] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 895.847007][ T4593] ? __pfx_netlink_sendmsg+0x10/0x10 [ 895.847022][ T4593] __sock_sendmsg+0x21c/0x270 [ 895.847044][ T4593] ____sys_sendmsg+0x505/0x830 [ 895.847065][ T4593] ? __pfx_____sys_sendmsg+0x10/0x10 [ 895.847089][ T4593] ? import_iovec+0x74/0xa0 [ 895.847110][ T4593] ___sys_sendmsg+0x21f/0x2a0 [ 895.847129][ T4593] ? __pfx____sys_sendmsg+0x10/0x10 [ 895.847178][ T4593] ? __fget_files+0x2a/0x420 [ 895.847192][ T4593] ? __fget_files+0x3a0/0x420 [ 895.847215][ T4593] __x64_sys_sendmsg+0x19b/0x260 [ 895.847233][ T4593] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 895.847258][ T4593] ? __pfx_ksys_write+0x10/0x10 [ 895.847281][ T4593] ? do_syscall_64+0xbe/0xfa0 [ 895.847304][ T4593] do_syscall_64+0xfa/0xfa0 [ 895.847322][ T4593] ? lockdep_hardirqs_on+0x9c/0x150 [ 895.847340][ T4593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.847354][ T4593] ? clear_bhb_loop+0x60/0xb0 [ 895.847372][ T4593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.847386][ T4593] RIP: 0033:0x7fa73258f6c9 [ 895.847400][ T4593] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 895.847412][ T4593] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 895.847429][ T4593] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 895.847440][ T4593] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 895.847449][ T4593] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 895.847457][ T4593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 895.847466][ T4593] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 895.847495][ T4593] [ 897.693997][T13056] net_ratelimit: 8 callbacks suppressed [ 897.694017][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 897.754842][ T4597] syzkaller0: entered promiscuous mode [ 897.764181][ T4597] syzkaller0: entered allmulticast mode [ 897.830427][ T4597] tipc: Enabled bearer , priority 0 [ 897.862218][ T4597] tipc: Resetting bearer [ 897.892583][ T4596] tipc: Resetting bearer [ 897.957839][ T4596] tipc: Disabling bearer [ 897.985663][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.106797][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.215488][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.238468][ T4625] __nla_validate_parse: 1 callbacks suppressed [ 898.238487][ T4625] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12651'. [ 898.280085][ T4625] netlink: 6 bytes leftover after parsing attributes in process `syz.3.12651'. [ 898.335084][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.399991][ T4639] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12657'. [ 898.447179][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.576044][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.700672][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.763773][ T4656] xt_nat: multiple ranges no longer supported [ 898.865493][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 898.889924][ T4669] tipc: Enabled bearer , priority 0 [ 898.910243][ T4669] syzkaller0: entered promiscuous mode [ 898.926717][ T4669] syzkaller0: entered allmulticast mode [ 898.995500][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 899.057477][ T4669] tipc: Resetting bearer [ 899.109900][ T4665] tipc: Resetting bearer [ 899.148207][ T4686] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12670'. [ 899.182374][ T4665] tipc: Disabling bearer [ 899.521594][ T4714] syz_tun: entered allmulticast mode [ 899.530546][ T4708] syz_tun: left allmulticast mode [ 899.764474][ T4730] FAULT_INJECTION: forcing a failure. [ 899.764474][ T4730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 899.790894][ T4730] CPU: 0 UID: 0 PID: 4730 Comm: syz.5.12685 Not tainted syzkaller #0 PREEMPT(full) [ 899.790920][ T4730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 899.790932][ T4730] Call Trace: [ 899.790940][ T4730] [ 899.790948][ T4730] dump_stack_lvl+0x189/0x250 [ 899.790976][ T4730] ? __pfx____ratelimit+0x10/0x10 [ 899.791000][ T4730] ? __pfx_dump_stack_lvl+0x10/0x10 [ 899.791023][ T4730] ? __pfx__printk+0x10/0x10 [ 899.791042][ T4730] ? __might_fault+0xb0/0x130 [ 899.791077][ T4730] should_fail_ex+0x414/0x560 [ 899.791108][ T4730] _copy_from_user+0x2d/0xb0 [ 899.791131][ T4730] ___sys_sendmsg+0x158/0x2a0 [ 899.791154][ T4730] ? __pfx____sys_sendmsg+0x10/0x10 [ 899.791210][ T4730] ? __fget_files+0x2a/0x420 [ 899.791227][ T4730] ? __fget_files+0x3a0/0x420 [ 899.791255][ T4730] __x64_sys_sendmsg+0x19b/0x260 [ 899.791276][ T4730] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 899.791305][ T4730] ? __pfx_ksys_write+0x10/0x10 [ 899.791332][ T4730] ? do_syscall_64+0xbe/0xfa0 [ 899.791359][ T4730] do_syscall_64+0xfa/0xfa0 [ 899.791380][ T4730] ? lockdep_hardirqs_on+0x9c/0x150 [ 899.791404][ T4730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.791428][ T4730] ? clear_bhb_loop+0x60/0xb0 [ 899.791449][ T4730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 899.791466][ T4730] RIP: 0033:0x7f0be1f8f6c9 [ 899.791483][ T4730] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 899.791499][ T4730] RSP: 002b:00007f0be01f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 899.791519][ T4730] RAX: ffffffffffffffda RBX: 00007f0be21e5fa0 RCX: 00007f0be1f8f6c9 [ 899.791533][ T4730] RDX: 0000000004000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 899.791545][ T4730] RBP: 00007f0be01f6090 R08: 0000000000000000 R09: 0000000000000000 [ 899.791557][ T4730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 899.791568][ T4730] R13: 00007f0be21e6038 R14: 00007f0be21e5fa0 R15: 00007ffcbe801b28 [ 899.791601][ T4730] [ 900.134033][ T4738] netlink: 60 bytes leftover after parsing attributes in process `syz.3.12688'. [ 900.643396][ T4775] netlink: 'syz.1.12703': attribute type 1 has an invalid length. [ 900.704770][ T4777] FAULT_INJECTION: forcing a failure. [ 900.704770][ T4777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 900.757441][ T4777] CPU: 0 UID: 0 PID: 4777 Comm: syz.0.12704 Not tainted syzkaller #0 PREEMPT(full) [ 900.757469][ T4777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 900.757480][ T4777] Call Trace: [ 900.757488][ T4777] [ 900.757496][ T4777] dump_stack_lvl+0x189/0x250 [ 900.757522][ T4777] ? __pfx____ratelimit+0x10/0x10 [ 900.757546][ T4777] ? __pfx_dump_stack_lvl+0x10/0x10 [ 900.757567][ T4777] ? __pfx__printk+0x10/0x10 [ 900.757596][ T4777] ? __might_fault+0xb0/0x130 [ 900.757634][ T4777] should_fail_ex+0x414/0x560 [ 900.757665][ T4777] _copy_from_user+0x2d/0xb0 [ 900.757687][ T4777] ___sys_recvmsg+0x12e/0x510 [ 900.757714][ T4777] ? __pfx____sys_recvmsg+0x10/0x10 [ 900.757765][ T4777] ? __might_fault+0xb0/0x130 [ 900.757791][ T4777] do_recvmmsg+0x307/0x770 [ 900.757820][ T4777] ? __pfx_do_recvmmsg+0x10/0x10 [ 900.757853][ T4777] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 900.757895][ T4777] __x64_sys_recvmmsg+0x190/0x240 [ 900.757919][ T4777] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 900.757943][ T4777] ? do_syscall_64+0xbe/0xfa0 [ 900.757971][ T4777] do_syscall_64+0xfa/0xfa0 [ 900.757993][ T4777] ? lockdep_hardirqs_on+0x9c/0x150 [ 900.758016][ T4777] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.758034][ T4777] ? clear_bhb_loop+0x60/0xb0 [ 900.758062][ T4777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.758079][ T4777] RIP: 0033:0x7fa73258f6c9 [ 900.758096][ T4777] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 900.758113][ T4777] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 900.758133][ T4777] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 900.758146][ T4777] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 900.758159][ T4777] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 900.758170][ T4777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 900.758182][ T4777] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 900.758214][ T4777] [ 901.047387][ T4794] bridge0: Device is already in use. [ 901.284091][ T4807] tipc: Enabling of bearer rejected, failed to enable media [ 901.553799][ T4823] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12712'. [ 901.577729][ T4826] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12713'. [ 902.444799][ T4882] tipc: Enabling of bearer rejected, failed to enable media [ 902.517613][ T4885] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12729'. [ 902.695065][ T1344] net_ratelimit: 21 callbacks suppressed [ 902.695084][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 902.808621][ T4903] tc_dump_action: action bad kind [ 902.866059][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 902.985302][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 903.115490][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 903.226367][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 903.308188][ T4938] FAULT_INJECTION: forcing a failure. [ 903.308188][ T4938] name failslab, interval 1, probability 0, space 0, times 0 [ 903.337627][ T4938] CPU: 0 UID: 0 PID: 4938 Comm: syz.1.12743 Not tainted syzkaller #0 PREEMPT(full) [ 903.337653][ T4938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 903.337664][ T4938] Call Trace: [ 903.337672][ T4938] [ 903.337681][ T4938] dump_stack_lvl+0x189/0x250 [ 903.337709][ T4938] ? __pfx____ratelimit+0x10/0x10 [ 903.337733][ T4938] ? __pfx_dump_stack_lvl+0x10/0x10 [ 903.337754][ T4938] ? __pfx__printk+0x10/0x10 [ 903.337779][ T4938] ? __pfx___might_resched+0x10/0x10 [ 903.337797][ T4938] ? fs_reclaim_acquire+0x7d/0x100 [ 903.337827][ T4938] should_fail_ex+0x414/0x560 [ 903.337857][ T4938] should_failslab+0xa8/0x100 [ 903.337880][ T4938] kmem_cache_alloc_node_noprof+0x77/0x710 [ 903.337903][ T4938] ? __alloc_skb+0x112/0x2d0 [ 903.337925][ T4938] __alloc_skb+0x112/0x2d0 [ 903.337946][ T4938] netlink_sendmsg+0x5c6/0xb30 [ 903.337974][ T4938] ? __pfx_netlink_sendmsg+0x10/0x10 [ 903.337995][ T4938] ? aa_sock_msg_perm+0xf1/0x1d0 [ 903.338022][ T4938] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 903.338045][ T4938] ? __pfx_netlink_sendmsg+0x10/0x10 [ 903.338063][ T4938] __sock_sendmsg+0x21c/0x270 [ 903.338089][ T4938] ____sys_sendmsg+0x505/0x830 [ 903.338115][ T4938] ? __pfx_____sys_sendmsg+0x10/0x10 [ 903.338143][ T4938] ? import_iovec+0x74/0xa0 [ 903.338169][ T4938] ___sys_sendmsg+0x21f/0x2a0 [ 903.338191][ T4938] ? __pfx____sys_sendmsg+0x10/0x10 [ 903.338247][ T4938] ? __fget_files+0x2a/0x420 [ 903.338262][ T4938] ? __fget_files+0x3a0/0x420 [ 903.338290][ T4938] __x64_sys_sendmsg+0x19b/0x260 [ 903.338312][ T4938] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 903.338340][ T4938] ? __pfx_ksys_write+0x10/0x10 [ 903.338366][ T4938] ? do_syscall_64+0xbe/0xfa0 [ 903.338394][ T4938] do_syscall_64+0xfa/0xfa0 [ 903.338415][ T4938] ? lockdep_hardirqs_on+0x9c/0x150 [ 903.338438][ T4938] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.338456][ T4938] ? clear_bhb_loop+0x60/0xb0 [ 903.338477][ T4938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 903.338493][ T4938] RIP: 0033:0x7f821ed8f6c9 [ 903.338509][ T4938] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 903.338522][ T4938] RSP: 002b:00007f821fbbf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 903.338540][ T4938] RAX: ffffffffffffffda RBX: 00007f821efe5fa0 RCX: 00007f821ed8f6c9 [ 903.338552][ T4938] RDX: 0000000000000000 RSI: 0000200000000c00 RDI: 0000000000000003 [ 903.338563][ T4938] RBP: 00007f821fbbf090 R08: 0000000000000000 R09: 0000000000000000 [ 903.338572][ T4938] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 903.338582][ T4938] R13: 00007f821efe6038 R14: 00007f821efe5fa0 R15: 00007ffffa97ee98 [ 903.338605][ T4938] [ 903.395253][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 903.757606][ T4958] tipc: Enabling of bearer rejected, failed to enable media [ 903.865064][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 903.919053][ T4964] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12747'. [ 903.975928][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 904.085303][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 904.159418][ T4976] netlink: 40 bytes leftover after parsing attributes in process `syz.5.12748'. [ 904.195036][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 904.536713][ T4990] tipc: Enabled bearer , priority 0 [ 904.544215][ T4990] syzkaller0: entered promiscuous mode [ 904.555335][ T4990] syzkaller0: entered allmulticast mode [ 904.605050][ T4990] tipc: Resetting bearer [ 904.632877][ T4986] tipc: Resetting bearer [ 904.695352][ T4986] tipc: Disabling bearer [ 904.721248][ T4999] FAULT_INJECTION: forcing a failure. [ 904.721248][ T4999] name failslab, interval 1, probability 0, space 0, times 0 [ 904.737045][ T4992] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12752'. [ 904.747257][ T4999] CPU: 0 UID: 0 PID: 4999 Comm: syz.5.12756 Not tainted syzkaller #0 PREEMPT(full) [ 904.747282][ T4999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 904.747294][ T4999] Call Trace: [ 904.747303][ T4999] [ 904.747311][ T4999] dump_stack_lvl+0x189/0x250 [ 904.747339][ T4999] ? __pfx____ratelimit+0x10/0x10 [ 904.747363][ T4999] ? __pfx_dump_stack_lvl+0x10/0x10 [ 904.747386][ T4999] ? __pfx__printk+0x10/0x10 [ 904.747408][ T4999] ? __pfx___might_resched+0x10/0x10 [ 904.747425][ T4999] ? fs_reclaim_acquire+0x7d/0x100 [ 904.747454][ T4999] should_fail_ex+0x414/0x560 [ 904.747482][ T4999] should_failslab+0xa8/0x100 [ 904.747501][ T4999] kmem_cache_alloc_node_noprof+0x77/0x710 [ 904.747525][ T4999] ? __alloc_skb+0x112/0x2d0 [ 904.747549][ T4999] __alloc_skb+0x112/0x2d0 [ 904.747570][ T4999] netlink_dump+0x1b7/0xe90 [ 904.747601][ T4999] ? __nla_parse+0x40/0x60 [ 904.747625][ T4999] ? __pfx_netlink_dump+0x10/0x10 [ 904.747646][ T4999] ? ip_set_dump_start+0x2ec/0x410 [ 904.747684][ T4999] ? netlink_lookup+0x30/0x200 [ 904.747708][ T4999] ? netlink_lookup+0x30/0x200 [ 904.747729][ T4999] ? netlink_lookup+0x30/0x200 [ 904.747759][ T4999] __netlink_dump_start+0x5cb/0x7e0 [ 904.747795][ T4999] ip_set_dump+0x13e/0x1c0 [ 904.747818][ T4999] ? __pfx_ip_set_dump+0x10/0x10 [ 904.747839][ T4999] ? __pfx_ip_set_dump_start+0x10/0x10 [ 904.747860][ T4999] ? __pfx_ip_set_dump_do+0x10/0x10 [ 904.747882][ T4999] ? __pfx_ip_set_dump_done+0x10/0x10 [ 904.747928][ T4999] nfnetlink_rcv_msg+0xb4d/0x1130 [ 904.747955][ T4999] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 904.748000][ T4999] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 904.748021][ T4999] ? kasan_save_track+0x4f/0x80 [ 904.748100][ T4999] netlink_rcv_skb+0x208/0x470 [ 904.748116][ T4999] ? lockdep_hardirqs_on+0x9c/0x150 [ 904.748140][ T4999] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 904.748166][ T4999] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 904.748197][ T4999] ? bpf_lsm_capable+0x9/0x20 [ 904.748217][ T4999] ? security_capable+0x7e/0x2e0 [ 904.748249][ T4999] nfnetlink_rcv+0x282/0x2590 [ 904.748276][ T4999] ? __dev_queue_xmit+0x27b/0x3b50 [ 904.748298][ T4999] ? __dev_queue_xmit+0x1d79/0x3b50 [ 904.748317][ T4999] ? kasan_save_track+0x3e/0x80 [ 904.748338][ T4999] ? __kasan_slab_alloc+0x6c/0x80 [ 904.748371][ T4999] ? __dev_queue_xmit+0x27b/0x3b50 [ 904.748406][ T4999] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 904.748431][ T4999] ? __pfx___dev_queue_xmit+0x10/0x10 [ 904.748467][ T4999] ? ref_tracker_free+0x63a/0x7d0 [ 904.748485][ T4999] ? __asan_memcpy+0x40/0x70 [ 904.748506][ T4999] ? __pfx_ref_tracker_free+0x10/0x10 [ 904.748542][ T4999] ? skb_clone+0x246/0x3a0 [ 904.748565][ T4999] ? __netlink_deliver_tap+0x807/0x850 [ 904.748583][ T4999] ? netlink_deliver_tap+0x2e/0x1b0 [ 904.748607][ T4999] ? netlink_deliver_tap+0x2e/0x1b0 [ 904.748635][ T4999] netlink_unicast+0x82f/0x9e0 [ 904.748668][ T4999] ? __pfx_netlink_unicast+0x10/0x10 [ 904.748695][ T4999] ? netlink_sendmsg+0x642/0xb30 [ 904.748710][ T4999] ? skb_put+0x11b/0x210 [ 904.748732][ T4999] netlink_sendmsg+0x805/0xb30 [ 904.748760][ T4999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 904.748783][ T4999] ? aa_sock_msg_perm+0xf1/0x1d0 [ 904.748809][ T4999] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 904.748827][ T4999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 904.748846][ T4999] __sock_sendmsg+0x21c/0x270 [ 904.748873][ T4999] ____sys_sendmsg+0x505/0x830 [ 904.748899][ T4999] ? __pfx_____sys_sendmsg+0x10/0x10 [ 904.748935][ T4999] ? import_iovec+0x74/0xa0 [ 904.748961][ T4999] ___sys_sendmsg+0x21f/0x2a0 [ 904.748984][ T4999] ? __pfx____sys_sendmsg+0x10/0x10 [ 904.749045][ T4999] ? __fget_files+0x2a/0x420 [ 904.749061][ T4999] ? __fget_files+0x3a0/0x420 [ 904.749091][ T4999] __x64_sys_sendmsg+0x19b/0x260 [ 904.749114][ T4999] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 904.749144][ T4999] ? __pfx_ksys_write+0x10/0x10 [ 904.749173][ T4999] ? do_syscall_64+0xbe/0xfa0 [ 904.749201][ T4999] do_syscall_64+0xfa/0xfa0 [ 904.749222][ T4999] ? lockdep_hardirqs_on+0x9c/0x150 [ 904.749245][ T4999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.749264][ T4999] ? clear_bhb_loop+0x60/0xb0 [ 904.749286][ T4999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.749304][ T4999] RIP: 0033:0x7f0be1f8f6c9 [ 904.749322][ T4999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 904.749337][ T4999] RSP: 002b:00007f0be01f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 904.749357][ T4999] RAX: ffffffffffffffda RBX: 00007f0be21e5fa0 RCX: 00007f0be1f8f6c9 [ 904.749370][ T4999] RDX: 0000000004000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 904.749383][ T4999] RBP: 00007f0be01f6090 R08: 0000000000000000 R09: 0000000000000000 [ 904.749395][ T4999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 904.749406][ T4999] R13: 00007f0be21e6038 R14: 00007f0be21e5fa0 R15: 00007ffcbe801b28 [ 904.749441][ T4999] [ 905.240129][ T5002] FAULT_INJECTION: forcing a failure. [ 905.240129][ T5002] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 905.253335][ T5002] CPU: 0 UID: 0 PID: 5002 Comm: syz.3.12755 Not tainted syzkaller #0 PREEMPT(full) [ 905.253359][ T5002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 905.253369][ T5002] Call Trace: [ 905.253376][ T5002] [ 905.253384][ T5002] dump_stack_lvl+0x189/0x250 [ 905.253410][ T5002] ? __pfx____ratelimit+0x10/0x10 [ 905.253430][ T5002] ? __pfx_dump_stack_lvl+0x10/0x10 [ 905.253452][ T5002] ? __pfx__printk+0x10/0x10 [ 905.253471][ T5002] ? __might_fault+0xb0/0x130 [ 905.253501][ T5002] should_fail_ex+0x414/0x560 [ 905.253526][ T5002] _copy_from_user+0x2d/0xb0 [ 905.253544][ T5002] ___sys_recvmsg+0x12e/0x510 [ 905.253582][ T5002] ? __pfx____sys_recvmsg+0x10/0x10 [ 905.253634][ T5002] ? __might_fault+0xb0/0x130 [ 905.253659][ T5002] do_recvmmsg+0x307/0x770 [ 905.253686][ T5002] ? __pfx_do_recvmmsg+0x10/0x10 [ 905.253716][ T5002] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 905.253755][ T5002] __x64_sys_recvmmsg+0x190/0x240 [ 905.253778][ T5002] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 905.253802][ T5002] ? do_syscall_64+0xbe/0xfa0 [ 905.253828][ T5002] do_syscall_64+0xfa/0xfa0 [ 905.253848][ T5002] ? lockdep_hardirqs_on+0x9c/0x150 [ 905.253869][ T5002] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.253886][ T5002] ? clear_bhb_loop+0x60/0xb0 [ 905.253907][ T5002] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.253923][ T5002] RIP: 0033:0x7feeceb8f6c9 [ 905.253939][ T5002] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 905.253954][ T5002] RSP: 002b:00007feecfa3c038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 905.253974][ T5002] RAX: ffffffffffffffda RBX: 00007feecede6090 RCX: 00007feeceb8f6c9 [ 905.253987][ T5002] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 905.253999][ T5002] RBP: 00007feecfa3c090 R08: 0000000000000000 R09: 0000000000000000 [ 905.254011][ T5002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 905.254021][ T5002] R13: 00007feecede6128 R14: 00007feecede6090 R15: 00007ffd2afbd348 [ 905.254051][ T5002] [ 905.609520][ T5014] tipc: Enabled bearer , priority 0 [ 905.650033][ T5014] syzkaller0: entered promiscuous mode [ 905.685257][ T5014] syzkaller0: entered allmulticast mode [ 905.735873][ T5024] tipc: Enabling of bearer rejected, failed to enable media [ 905.773551][ T5014] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 905.921713][ T5014] tipc: Resetting bearer [ 905.951540][ T5013] tipc: Resetting bearer [ 906.042473][ T5013] tipc: Disabling bearer [ 906.268893][ T5053] netlink: 64 bytes leftover after parsing attributes in process `syz.2.12767'. [ 906.404243][ T5066] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12773'. [ 906.686796][ T5092] tipc: Enabling of bearer rejected, failed to enable media [ 906.884591][ T5108] netlink: 52 bytes leftover after parsing attributes in process `syz.0.12781'. [ 907.198384][ T5124] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12784'. [ 907.227331][ T5122] tipc: Enabled bearer , priority 0 [ 907.242409][ T5120] netlink: 'syz.5.12783': attribute type 4 has an invalid length. [ 907.286699][ T5117] tipc: Resetting bearer [ 907.318299][ T5133] FAULT_INJECTION: forcing a failure. [ 907.318299][ T5133] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 907.348762][ T5133] CPU: 1 UID: 0 PID: 5133 Comm: syz.3.12787 Not tainted syzkaller #0 PREEMPT(full) [ 907.348789][ T5133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 907.348799][ T5133] Call Trace: [ 907.348807][ T5133] [ 907.348815][ T5133] dump_stack_lvl+0x189/0x250 [ 907.348843][ T5133] ? __pfx____ratelimit+0x10/0x10 [ 907.348867][ T5133] ? __pfx_dump_stack_lvl+0x10/0x10 [ 907.348889][ T5133] ? __pfx__printk+0x10/0x10 [ 907.348908][ T5133] ? __might_fault+0xb0/0x130 [ 907.348943][ T5133] should_fail_ex+0x414/0x560 [ 907.348975][ T5133] _copy_from_user+0x2d/0xb0 [ 907.348997][ T5133] kstrtouint_from_user+0xc4/0x170 [ 907.349021][ T5133] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 907.349057][ T5133] proc_fail_nth_write+0x88/0x200 [ 907.349079][ T5133] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 907.349107][ T5133] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 907.349128][ T5133] vfs_write+0x27e/0xb30 [ 907.349166][ T5133] ? __pfx_vfs_write+0x10/0x10 [ 907.349191][ T5133] ? __fget_files+0x2a/0x420 [ 907.349212][ T5133] ? __fget_files+0x3a0/0x420 [ 907.349224][ T5133] ? __fget_files+0x2a/0x420 [ 907.349248][ T5133] ksys_write+0x145/0x250 [ 907.349271][ T5133] ? __pfx_ksys_write+0x10/0x10 [ 907.349295][ T5133] ? do_syscall_64+0xbe/0xfa0 [ 907.349321][ T5133] do_syscall_64+0xfa/0xfa0 [ 907.349340][ T5133] ? lockdep_hardirqs_on+0x9c/0x150 [ 907.349362][ T5133] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 907.349379][ T5133] ? clear_bhb_loop+0x60/0xb0 [ 907.349400][ T5133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 907.349417][ T5133] RIP: 0033:0x7feeceb8e17f [ 907.349433][ T5133] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 907.349448][ T5133] RSP: 002b:00007feecfa5d030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 907.349467][ T5133] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007feeceb8e17f [ 907.349484][ T5133] RDX: 0000000000000001 RSI: 00007feecfa5d0a0 RDI: 0000000000000004 [ 907.349494][ T5133] RBP: 00007feecfa5d090 R08: 0000000000000000 R09: 0000000000000000 [ 907.349506][ T5133] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 907.349516][ T5133] R13: 00007feecede6038 R14: 00007feecede5fa0 R15: 00007ffd2afbd348 [ 907.349548][ T5133] [ 907.463183][ T5140] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12788'. [ 907.469096][ T5141] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12788'. [ 909.168350][ T5117] tipc: Disabling bearer [ 909.185235][T13054] net_ratelimit: 17 callbacks suppressed [ 909.185256][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 909.214037][ T5140] netlink: 'syz.2.12788': attribute type 1 has an invalid length. [ 909.222782][ T5140] netlink: 'syz.2.12788': attribute type 2 has an invalid length. [ 909.239709][ T5141] netlink: 'syz.2.12788': attribute type 1 has an invalid length. [ 909.255767][ T5141] netlink: 'syz.2.12788': attribute type 2 has an invalid length. [ 909.315498][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 909.425506][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 909.454778][ T5171] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12797'. [ 909.488857][ T5182] tipc: Enabling of bearer rejected, failed to enable media [ 909.555430][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 909.687876][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 909.827405][ T36] bond4: (slave macvlan2): failed to get link speed/duplex [ 909.975531][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 910.085071][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 910.117076][ T5217] netlink: 12 bytes leftover after parsing attributes in process `syz.5.12805'. [ 910.197013][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 910.325538][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 910.361840][ T5234] syzkaller0: entered promiscuous mode [ 910.368743][ T5234] syzkaller0: entered allmulticast mode [ 910.633640][ T5245] tipc: Enabling of bearer rejected, failed to enable media [ 910.970584][ T5261] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12822'. [ 911.255985][ T5280] netlink: 'syz.2.12827': attribute type 11 has an invalid length. [ 911.285722][ T5280] netlink: 224 bytes leftover after parsing attributes in process `syz.2.12827'. [ 911.802724][ T5308] tipc: Enabled bearer , priority 0 [ 911.819182][ T5308] tipc: Resetting bearer [ 911.838598][ T5313] netlink: 'syz.2.12837': attribute type 83 has an invalid length. [ 911.886820][ T5307] tipc: Disabling bearer [ 912.085861][ T5329] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12846'. [ 912.819165][ T5376] bridge0: port 1(batadv4) entered blocking state [ 912.826488][ T5376] bridge0: port 1(batadv4) entered disabled state [ 912.833127][ T5376] batadv4: entered allmulticast mode [ 912.841190][ T5376] batadv4: entered promiscuous mode [ 912.849764][ T5374] tipc: Enabled bearer , priority 0 [ 912.868482][ T5374] tipc: Resetting bearer [ 912.927429][ T5373] tipc: Disabling bearer [ 913.242741][ T5400] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12866'. [ 913.315447][ T1344] batman_adv: batadv4: No IGMP Querier present - multicast optimizations disabled [ 913.325228][ T1344] batman_adv: batadv4: No MLD Querier present - multicast optimizations disabled [ 913.679693][ T5426] tipc: Enabled bearer , priority 0 [ 913.694261][ T5428] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12871'. [ 913.781980][ T5426] tipc: Resetting bearer [ 913.830171][ T5425] tipc: Disabling bearer [ 914.196881][ T991] net_ratelimit: 34 callbacks suppressed [ 914.196901][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 914.325626][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 914.389355][ T5473] tipc: Enabled bearer , priority 0 [ 914.412096][ T5473] syzkaller0: entered promiscuous mode [ 914.421401][ T5473] syzkaller0: entered allmulticast mode [ 914.480441][ T5473] tipc: Resetting bearer [ 914.493174][ T5472] tipc: Resetting bearer [ 914.520443][ T5472] tipc: Disabling bearer [ 914.545858][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 914.566446][ T5478] gtp2: entered promiscuous mode [ 914.571501][ T5478] gtp2: entered allmulticast mode [ 914.655172][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 914.779159][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 914.908651][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 915.035956][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 915.049740][ T5520] netlink: 60 bytes leftover after parsing attributes in process `syz.2.12900'. [ 915.175392][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 915.271318][ T5531] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12903'. [ 915.285604][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 915.302565][ T5531] netlink: 'syz.3.12903': attribute type 1 has an invalid length. [ 915.336425][ T5531] netlink: 'syz.3.12903': attribute type 2 has an invalid length. [ 915.405436][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 915.530443][ T5552] netlink: 172 bytes leftover after parsing attributes in process `syz.1.12913'. [ 915.824107][ T5564] netlink: 56 bytes leftover after parsing attributes in process `syz.5.12915'. [ 915.922654][ T5564] bond5 (unregistering): Released all slaves [ 915.969091][ T5598] netlink: 'syz.1.12920': attribute type 10 has an invalid length. [ 916.000388][ T5598] netlink: 40 bytes leftover after parsing attributes in process `syz.1.12920'. [ 916.020077][ T5598] batadv0: entered allmulticast mode [ 916.047070][ T5598] netlink: 7 bytes leftover after parsing attributes in process `syz.1.12920'. [ 916.205194][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 916.894081][ T5644] tipc: Enabled bearer , priority 0 [ 916.909920][ T5644] syzkaller0: entered promiscuous mode [ 916.923532][ T5644] syzkaller0: entered allmulticast mode [ 916.951323][ T5644] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 917.282177][ T5652] tipc: Resetting bearer [ 917.318823][ T5642] tipc: Resetting bearer [ 917.375510][ T5642] tipc: Disabling bearer [ 917.493022][ T5661] syzkaller0: entered promiscuous mode [ 917.499918][ T5661] syzkaller0: entered allmulticast mode [ 917.666096][ T5687] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12943'. [ 918.020919][ T5712] netlink: 'syz.5.12950': attribute type 10 has an invalid length. [ 918.075928][ T5714] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12951'. [ 918.776510][T27202] page_pool_release_retry() stalled pool shutdown: id 68, 1 inflight 302 sec [ 919.440007][ T5712] syz_tun: entered promiscuous mode [ 919.455079][ T60] net_ratelimit: 14 callbacks suppressed [ 919.455100][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 919.567248][ T5724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12954'. [ 919.635158][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 919.675236][ T5729] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12954'. [ 919.928191][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 920.045261][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 921.935912][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 922.085142][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 922.136288][ T5789] __nla_validate_parse: 2 callbacks suppressed [ 922.136307][ T5789] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12969'. [ 922.215083][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 922.280366][ T5799] tipc: Enabled bearer , priority 0 [ 922.300507][ T5803] netlink: 'syz.0.12975': attribute type 1 has an invalid length. [ 922.301128][ T5799] syzkaller0: entered promiscuous mode [ 922.308839][ T5804] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12977'. [ 922.326057][ T5799] syzkaller0: entered allmulticast mode [ 922.343982][ T5799] tipc: Resetting bearer [ 922.355913][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 922.376273][ T5798] tipc: Resetting bearer [ 922.406879][ T5798] tipc: Disabling bearer [ 922.421881][ T5813] FAULT_INJECTION: forcing a failure. [ 922.421881][ T5813] name failslab, interval 1, probability 0, space 0, times 0 [ 922.434812][ T5805] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 922.446246][ T5813] CPU: 0 UID: 0 PID: 5813 Comm: syz.0.12979 Not tainted syzkaller #0 PREEMPT(full) [ 922.446273][ T5813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 922.446285][ T5813] Call Trace: [ 922.446293][ T5813] [ 922.446301][ T5813] dump_stack_lvl+0x189/0x250 [ 922.446328][ T5813] ? __pfx____ratelimit+0x10/0x10 [ 922.446352][ T5813] ? __pfx_dump_stack_lvl+0x10/0x10 [ 922.446373][ T5813] ? __pfx__printk+0x10/0x10 [ 922.446397][ T5813] ? __pfx___might_resched+0x10/0x10 [ 922.446415][ T5813] ? fs_reclaim_acquire+0x7d/0x100 [ 922.446447][ T5813] should_fail_ex+0x414/0x560 [ 922.446478][ T5813] should_failslab+0xa8/0x100 [ 922.446499][ T5813] __kmalloc_noprof+0xcb/0x7f0 [ 922.446521][ T5813] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 922.446552][ T5813] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 922.446582][ T5813] genl_family_rcv_msg_doit+0xb8/0x300 [ 922.446610][ T5813] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 922.446641][ T5813] ? apparmor_capable+0x137/0x1b0 [ 922.446663][ T5813] ? bpf_lsm_capable+0x9/0x20 [ 922.446682][ T5813] ? security_capable+0x7e/0x2e0 [ 922.446711][ T5813] genl_rcv_msg+0x60e/0x790 [ 922.446740][ T5813] ? __pfx_genl_rcv_msg+0x10/0x10 [ 922.446759][ T5813] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 922.446777][ T5813] ? __pfx_nl80211_tx_mgmt+0x10/0x10 [ 922.446794][ T5813] ? __pfx_nl80211_post_doit+0x10/0x10 [ 922.446827][ T5813] netlink_rcv_skb+0x208/0x470 [ 922.446840][ T5813] ? __lock_acquire+0xab9/0xd20 [ 922.446858][ T5813] ? __pfx_genl_rcv_msg+0x10/0x10 [ 922.446881][ T5813] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 922.446917][ T5813] ? down_read+0x1ad/0x2e0 [ 922.446938][ T5813] genl_rcv+0x28/0x40 [ 922.446953][ T5813] netlink_unicast+0x82f/0x9e0 [ 922.446978][ T5813] ? __pfx_netlink_unicast+0x10/0x10 [ 922.446998][ T5813] ? netlink_sendmsg+0x642/0xb30 [ 922.447010][ T5813] ? skb_put+0x11b/0x210 [ 922.447026][ T5813] netlink_sendmsg+0x805/0xb30 [ 922.447054][ T5813] ? __pfx_netlink_sendmsg+0x10/0x10 [ 922.447070][ T5813] ? aa_sock_msg_perm+0xf1/0x1d0 [ 922.447090][ T5813] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 922.447103][ T5813] ? __pfx_netlink_sendmsg+0x10/0x10 [ 922.447117][ T5813] __sock_sendmsg+0x21c/0x270 [ 922.447138][ T5813] ____sys_sendmsg+0x505/0x830 [ 922.447158][ T5813] ? __pfx_____sys_sendmsg+0x10/0x10 [ 922.447180][ T5813] ? import_iovec+0x74/0xa0 [ 922.447199][ T5813] ___sys_sendmsg+0x21f/0x2a0 [ 922.447216][ T5813] ? __pfx____sys_sendmsg+0x10/0x10 [ 922.447259][ T5813] ? __fget_files+0x2a/0x420 [ 922.447271][ T5813] ? __fget_files+0x3a0/0x420 [ 922.447292][ T5813] __x64_sys_sendmsg+0x19b/0x260 [ 922.447309][ T5813] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 922.447331][ T5813] ? __pfx_ksys_write+0x10/0x10 [ 922.447353][ T5813] ? do_syscall_64+0xbe/0xfa0 [ 922.447374][ T5813] do_syscall_64+0xfa/0xfa0 [ 922.447390][ T5813] ? lockdep_hardirqs_on+0x9c/0x150 [ 922.447407][ T5813] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 922.447422][ T5813] ? clear_bhb_loop+0x60/0xb0 [ 922.447437][ T5813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 922.447450][ T5813] RIP: 0033:0x7fa73258f6c9 [ 922.447464][ T5813] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 922.447476][ T5813] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 922.447492][ T5813] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 922.447502][ T5813] RDX: 0000000000000000 RSI: 0000200000000c00 RDI: 0000000000000003 [ 922.447512][ T5813] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 922.447520][ T5813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 922.447528][ T5813] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 922.447553][ T5813] [ 922.856238][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 922.965763][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 923.041189][ T5838] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 924.418209][ T5892] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 924.768009][ T5872] A link change request failed with some changes committed already. Interface Z7nz>RA may have been left with an inconsistent configuration, please check. [ 924.838766][ T5917] tipc: Enabled bearer , priority 0 [ 924.865850][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 924.895254][ T5918] syzkaller0: entered promiscuous mode [ 924.900782][ T5918] syzkaller0: entered allmulticast mode [ 924.940179][ T5915] tipc: Resetting bearer [ 924.959319][ T5905] tipc: Resetting bearer [ 924.981498][ T5905] tipc: Disabling bearer [ 924.997267][ T5926] FAULT_INJECTION: forcing a failure. [ 924.997267][ T5926] name failslab, interval 1, probability 0, space 0, times 0 [ 924.998091][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 925.026265][ T5926] CPU: 1 UID: 0 PID: 5926 Comm: syz.0.12995 Not tainted syzkaller #0 PREEMPT(full) [ 925.026292][ T5926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 925.026302][ T5926] Call Trace: [ 925.026309][ T5926] [ 925.026317][ T5926] dump_stack_lvl+0x189/0x250 [ 925.026343][ T5926] ? __pfx____ratelimit+0x10/0x10 [ 925.026366][ T5926] ? __pfx_dump_stack_lvl+0x10/0x10 [ 925.026387][ T5926] ? __pfx__printk+0x10/0x10 [ 925.026411][ T5926] ? __pfx___might_resched+0x10/0x10 [ 925.026435][ T5926] should_fail_ex+0x414/0x560 [ 925.026474][ T5926] should_failslab+0xa8/0x100 [ 925.026494][ T5926] kmem_cache_alloc_node_noprof+0x77/0x710 [ 925.026518][ T5926] ? __alloc_skb+0x112/0x2d0 [ 925.026541][ T5926] __alloc_skb+0x112/0x2d0 [ 925.026563][ T5926] netlink_ack+0x146/0xa50 [ 925.026585][ T5926] ? __pfx_genl_rcv_msg+0x10/0x10 [ 925.026605][ T5926] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 925.026625][ T5926] ? __pfx_nl80211_post_doit+0x10/0x10 [ 925.026660][ T5926] netlink_rcv_skb+0x28c/0x470 [ 925.026675][ T5926] ? __lock_acquire+0xab9/0xd20 [ 925.026693][ T5926] ? __pfx_genl_rcv_msg+0x10/0x10 [ 925.026713][ T5926] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 925.026750][ T5926] ? down_read+0x1ad/0x2e0 [ 925.026771][ T5926] genl_rcv+0x28/0x40 [ 925.026794][ T5926] netlink_unicast+0x82f/0x9e0 [ 925.026828][ T5926] ? __pfx_netlink_unicast+0x10/0x10 [ 925.026853][ T5926] ? netlink_sendmsg+0x642/0xb30 [ 925.026869][ T5926] ? skb_put+0x11b/0x210 [ 925.026891][ T5926] netlink_sendmsg+0x805/0xb30 [ 925.026919][ T5926] ? __pfx_netlink_sendmsg+0x10/0x10 [ 925.026941][ T5926] ? aa_sock_msg_perm+0xf1/0x1d0 [ 925.026967][ T5926] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 925.026986][ T5926] ? __pfx_netlink_sendmsg+0x10/0x10 [ 925.027005][ T5926] __sock_sendmsg+0x21c/0x270 [ 925.027030][ T5926] ____sys_sendmsg+0x505/0x830 [ 925.027056][ T5926] ? __pfx_____sys_sendmsg+0x10/0x10 [ 925.027085][ T5926] ? import_iovec+0x74/0xa0 [ 925.027110][ T5926] ___sys_sendmsg+0x21f/0x2a0 [ 925.027130][ T5926] ? __pfx____sys_sendmsg+0x10/0x10 [ 925.027185][ T5926] ? __fget_files+0x2a/0x420 [ 925.027200][ T5926] ? __fget_files+0x3a0/0x420 [ 925.027227][ T5926] __x64_sys_sendmsg+0x19b/0x260 [ 925.027249][ T5926] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 925.027278][ T5926] ? __pfx_ksys_write+0x10/0x10 [ 925.027305][ T5926] ? do_syscall_64+0xbe/0xfa0 [ 925.027330][ T5926] do_syscall_64+0xfa/0xfa0 [ 925.027351][ T5926] ? lockdep_hardirqs_on+0x9c/0x150 [ 925.027373][ T5926] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.027390][ T5926] ? clear_bhb_loop+0x60/0xb0 [ 925.027410][ T5926] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.027427][ T5926] RIP: 0033:0x7fa73258f6c9 [ 925.027441][ T5926] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 925.027463][ T5926] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 925.027483][ T5926] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 925.027496][ T5926] RDX: 0000000000000000 RSI: 0000200000000c00 RDI: 0000000000000003 [ 925.027506][ T5926] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 925.027517][ T5926] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 925.027528][ T5926] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 925.027562][ T5926] [ 925.368072][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 925.422530][ T5940] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13001'. [ 925.488189][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 925.579592][ T5951] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 925.632059][ T5955] netlink: 'syz.5.13008': attribute type 10 has an invalid length. [ 925.637315][ T5944] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 925.733027][ T5960] netlink: 'syz.5.13008': attribute type 4 has an invalid length. [ 925.751247][ T5960] netlink: 17 bytes leftover after parsing attributes in process `syz.5.13008'. [ 927.385444][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 927.508053][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 927.508112][ T5984] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13015'. [ 927.646390][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 927.708039][ T6000] netlink: 5 bytes leftover after parsing attributes in process `syz.5.13018'. [ 927.727651][ T6000] 0{X: renamed from gretap0 (while UP) [ 927.762454][ T6000] 0{X: entered allmulticast mode [ 927.795637][ T6000] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 927.850904][ T6004] tipc: Enabling of bearer rejected, failed to enable media [ 927.868088][ T6015] netlink: 144 bytes leftover after parsing attributes in process `syz.1.13023'. [ 927.918690][ T6017] netlink: 84 bytes leftover after parsing attributes in process `syz.3.13024'. [ 928.206293][ T6038] netlink: 72 bytes leftover after parsing attributes in process `syz.2.13031'. [ 928.421959][ T6054] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13037'. [ 928.450981][ T6054] netlink: 'syz.2.13037': attribute type 1 has an invalid length. [ 928.467265][ T6054] netlink: 224 bytes leftover after parsing attributes in process `syz.2.13037'. [ 928.570365][ T6062] syzkaller0: entered promiscuous mode [ 928.583780][ T6062] syzkaller0: entered allmulticast mode [ 928.667825][ T6068] tipc: Enabled bearer , priority 0 [ 928.678114][ T6072] syzkaller0: entered promiscuous mode [ 928.683613][ T6072] syzkaller0: entered allmulticast mode [ 928.690137][ T6010] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 928.717569][ T6068] tipc: Resetting bearer [ 928.748822][ T6067] tipc: Resetting bearer [ 928.820481][ T6067] tipc: Disabling bearer [ 928.871379][ T6081] netlink: 48 bytes leftover after parsing attributes in process `syz.3.13047'. [ 929.152256][ T6102] syzkaller0: entered promiscuous mode [ 929.158611][ T6102] syzkaller0: entered allmulticast mode [ 929.158669][ T6099] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13054'. [ 929.223484][ T6099] hsr_slave_0: left promiscuous mode [ 929.247637][ T6099] hsr_slave_1: left promiscuous mode [ 929.847094][ T6133] FAULT_INJECTION: forcing a failure. [ 929.847094][ T6133] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 929.866625][ T60] net_ratelimit: 38 callbacks suppressed [ 929.866646][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 929.879818][ T6133] CPU: 1 UID: 0 PID: 6133 Comm: syz.5.13064 Not tainted syzkaller #0 PREEMPT(full) [ 929.879843][ T6133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 929.879854][ T6133] Call Trace: [ 929.879862][ T6133] [ 929.879874][ T6133] dump_stack_lvl+0x189/0x250 [ 929.879901][ T6133] ? __pfx____ratelimit+0x10/0x10 [ 929.879924][ T6133] ? __pfx_dump_stack_lvl+0x10/0x10 [ 929.879945][ T6133] ? __pfx__printk+0x10/0x10 [ 929.879966][ T6133] ? __might_fault+0xb0/0x130 [ 929.879998][ T6133] should_fail_ex+0x414/0x560 [ 929.880028][ T6133] _copy_from_user+0x2d/0xb0 [ 929.880051][ T6133] ___sys_recvmsg+0x12e/0x510 [ 929.880077][ T6133] ? __pfx____sys_recvmsg+0x10/0x10 [ 929.880124][ T6133] ? __might_fault+0xb0/0x130 [ 929.880151][ T6133] do_recvmmsg+0x307/0x770 [ 929.880179][ T6133] ? __pfx_do_recvmmsg+0x10/0x10 [ 929.880218][ T6133] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 929.880261][ T6133] __x64_sys_recvmmsg+0x190/0x240 [ 929.880284][ T6133] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 929.880309][ T6133] ? do_syscall_64+0xbe/0xfa0 [ 929.880335][ T6133] do_syscall_64+0xfa/0xfa0 [ 929.880356][ T6133] ? lockdep_hardirqs_on+0x9c/0x150 [ 929.880378][ T6133] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.880396][ T6133] ? clear_bhb_loop+0x60/0xb0 [ 929.880416][ T6133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.880432][ T6133] RIP: 0033:0x7f0be1f8f6c9 [ 929.880447][ T6133] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 929.880459][ T6133] RSP: 002b:00007f0be01f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 929.880479][ T6133] RAX: ffffffffffffffda RBX: 00007f0be21e5fa0 RCX: 00007f0be1f8f6c9 [ 929.880492][ T6133] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 929.880503][ T6133] RBP: 00007f0be01f6090 R08: 0000000000000000 R09: 0000000000000000 [ 929.880514][ T6133] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 929.880525][ T6133] R13: 00007f0be21e6038 R14: 00007f0be21e5fa0 R15: 00007ffcbe801b28 [ 929.880557][ T6133] [ 930.153219][ T6104] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 930.212791][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 930.335951][ T6148] syzkaller0: entered promiscuous mode [ 930.341538][ T6148] syzkaller0: entered allmulticast mode [ 930.387984][ T6151] netlink: 'syz.0.13072': attribute type 10 has an invalid length. [ 930.406111][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 930.482653][ T6155] syzkaller0: create flow: hash 3957741964 index 2 [ 930.561877][ T6156] tipc: Enabled bearer , priority 0 [ 930.575324][ T6156] syzkaller0: entered promiscuous mode [ 930.581455][ T6156] syzkaller0: entered allmulticast mode [ 930.635946][ T6164] FAULT_INJECTION: forcing a failure. [ 930.635946][ T6164] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 930.650166][ T6164] CPU: 0 UID: 0 PID: 6164 Comm: syz.0.13077 Not tainted syzkaller #0 PREEMPT(full) [ 930.650191][ T6164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 930.650202][ T6164] Call Trace: [ 930.650210][ T6164] [ 930.650219][ T6164] dump_stack_lvl+0x189/0x250 [ 930.650247][ T6164] ? __pfx____ratelimit+0x10/0x10 [ 930.650271][ T6164] ? __pfx_dump_stack_lvl+0x10/0x10 [ 930.650293][ T6164] ? __pfx__printk+0x10/0x10 [ 930.650312][ T6164] ? __might_fault+0xb0/0x130 [ 930.650346][ T6164] should_fail_ex+0x414/0x560 [ 930.650375][ T6164] _copy_from_user+0x2d/0xb0 [ 930.650398][ T6164] ___sys_recvmsg+0x12e/0x510 [ 930.650424][ T6164] ? __pfx____sys_recvmsg+0x10/0x10 [ 930.650469][ T6164] ? __might_fault+0xb0/0x130 [ 930.650495][ T6164] do_recvmmsg+0x307/0x770 [ 930.650524][ T6164] ? __pfx_do_recvmmsg+0x10/0x10 [ 930.650556][ T6164] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 930.650598][ T6164] __x64_sys_recvmmsg+0x190/0x240 [ 930.650621][ T6164] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 930.650645][ T6164] ? do_syscall_64+0xbe/0xfa0 [ 930.650671][ T6164] do_syscall_64+0xfa/0xfa0 [ 930.650692][ T6164] ? lockdep_hardirqs_on+0x9c/0x150 [ 930.650710][ T6164] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.650728][ T6164] ? clear_bhb_loop+0x60/0xb0 [ 930.650749][ T6164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 930.650765][ T6164] RIP: 0033:0x7fa73258f6c9 [ 930.650783][ T6164] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 930.650797][ T6164] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 930.650817][ T6164] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 930.650831][ T6164] RDX: 0000000000000414 RSI: 0000200000000840 RDI: 0000000000000003 [ 930.650842][ T6164] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 930.650876][ T6164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 930.650887][ T6164] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 930.650925][ T6164] [ 930.683032][ T6169] netlink: 'syz.3.13078': attribute type 10 has an invalid length. [ 930.776465][ T6162] tipc: Resetting bearer [ 930.897514][ T1344] syzkaller0 selects TX queue 2, but real number of TX queues is 2 [ 930.905932][ T1344] syzkaller0: tun_net_xmit 76 [ 930.912220][ T1344] syzkaller0 selects TX queue 2, but real number of TX queues is 2 [ 930.920499][ T1344] syzkaller0: tun_net_xmit 48 [ 930.925782][ T10] syzkaller0 selects TX queue 2, but real number of TX queues is 2 [ 930.934061][ T10] syzkaller0: tun_net_xmit 76 [ 930.939509][ T6142] syzkaller0: delete flow: hash 3957741964 index 2 [ 930.953210][ T6153] tipc: Resetting bearer [ 930.975401][ T6153] tipc: Disabling bearer [ 930.976664][ T10] syzkaller0: tun_net_xmit 76 [ 931.296029][ T6192] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13083'. [ 931.653481][ T6172] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 931.723866][ T6199] netlink: 'syz.0.13085': attribute type 10 has an invalid length. [ 932.654092][ T6194] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13083'. [ 932.775050][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 932.879414][ T6214] netlink: 48 bytes leftover after parsing attributes in process `syz.0.13090'. [ 932.895533][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 932.916168][ T6214] netlink: 48 bytes leftover after parsing attributes in process `syz.0.13090'. [ 932.947581][ T6214] netlink: 'syz.0.13090': attribute type 11 has an invalid length. [ 932.967525][ T6219] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 933.016779][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 933.204260][ T6235] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13097'. [ 933.297475][ T6243] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13097'. [ 933.323243][ T6243] nbd: device at index 64 is going down [ 933.373312][ T6248] netlink: 'syz.3.13100': attribute type 10 has an invalid length. [ 933.549741][ T6245] udevd[6245]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 933.595195][ T6245] udevd[6245]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 933.616515][ T6259] syzkaller0: entered promiscuous mode [ 933.639109][ T6259] syzkaller0: entered allmulticast mode [ 933.759554][ T6272] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13111'. [ 933.775879][ T6272] hsr_slave_0: left promiscuous mode [ 933.791535][ T6272] hsr_slave_1: left promiscuous mode [ 933.847805][ T6224] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 934.007170][ T6283] netlink: 'syz.2.13115': attribute type 10 has an invalid length. [ 934.256112][ T6304] syzkaller0: entered promiscuous mode [ 934.278099][ T6304] syzkaller0: entered allmulticast mode [ 934.548584][ T6326] syzkaller0: entered promiscuous mode [ 934.568741][ T6326] syzkaller0: entered allmulticast mode [ 934.660159][ T6337] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13134'. [ 934.966075][ T3549] net_ratelimit: 15 callbacks suppressed [ 934.966094][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 935.063535][ T6362] syzkaller0: entered promiscuous mode [ 935.089173][ T6362] syzkaller0: entered allmulticast mode [ 935.125572][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 935.305672][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 935.465389][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 935.490265][ T6388] syzkaller0: entered promiscuous mode [ 935.496120][ T6388] syzkaller0: entered allmulticast mode [ 935.496748][ T6396] netlink: 28 bytes leftover after parsing attributes in process `syz.1.13147'. [ 935.560183][ T6386] netlink: 40 bytes leftover after parsing attributes in process `syz.1.13147'. [ 935.574290][ T6386] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13147'. [ 935.585292][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 935.689478][ T6408] x_tables: duplicate underflow at hook 1 [ 935.718617][ T6407] tipc: Enabled bearer , priority 0 [ 935.777500][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 935.790265][ T6407] syzkaller0: entered promiscuous mode [ 935.815929][ T6407] syzkaller0: entered allmulticast mode [ 935.863264][ T6407] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 935.971825][ T6407] tipc: Resetting bearer [ 935.979687][ T6418] syzkaller0: entered allmulticast mode [ 935.993699][ T6405] tipc: Resetting bearer [ 936.036034][ T6405] tipc: Disabling bearer [ 936.129944][ T6432] syzkaller0: entered promiscuous mode [ 936.136087][ T6432] syzkaller0: entered allmulticast mode [ 936.175661][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 936.311086][ T6442] syzkaller0: entered promiscuous mode [ 936.318869][ T6442] syzkaller0: entered allmulticast mode [ 936.507444][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 936.616357][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 936.685613][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 936.916001][ T6483] syzkaller0: entered promiscuous mode [ 936.923087][ T6483] syzkaller0: entered allmulticast mode [ 937.197830][ T6500] syzkaller0: entered promiscuous mode [ 937.217433][ T6500] syzkaller0: entered allmulticast mode [ 937.611154][ T6533] syzkaller0: entered promiscuous mode [ 937.617278][ T6533] syzkaller0: entered allmulticast mode [ 937.780276][ T6542] tipc: Enabled bearer , priority 0 [ 937.798054][ T6542] syzkaller0: entered promiscuous mode [ 937.812587][ T6542] syzkaller0: entered allmulticast mode [ 938.557137][ T6588] __nla_validate_parse: 4 callbacks suppressed [ 938.557158][ T6588] netlink: 4 bytes leftover after parsing attributes in process `syz.5.13207'. [ 938.618238][ T6588] netlink: 12 bytes leftover after parsing attributes in process `syz.5.13207'. [ 938.723144][ T6595] netlink: 176 bytes leftover after parsing attributes in process `syz.3.13209'. [ 938.733211][ T6588] netlink: 'syz.5.13207': attribute type 3 has an invalid length. [ 938.761340][ T6536] tipc: Resetting bearer [ 938.786863][ T6536] tipc: Disabling bearer [ 938.800352][ T6595] netlink: 188 bytes leftover after parsing attributes in process `syz.3.13209'. [ 938.918953][ T6610] FAULT_INJECTION: forcing a failure. [ 938.918953][ T6610] name failslab, interval 1, probability 0, space 0, times 0 [ 938.961442][ T6610] CPU: 0 UID: 0 PID: 6610 Comm: syz.1.13213 Not tainted syzkaller #0 PREEMPT(full) [ 938.961469][ T6610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 938.961480][ T6610] Call Trace: [ 938.961488][ T6610] [ 938.961497][ T6610] dump_stack_lvl+0x189/0x250 [ 938.961524][ T6610] ? __pfx____ratelimit+0x10/0x10 [ 938.961549][ T6610] ? __pfx_dump_stack_lvl+0x10/0x10 [ 938.961571][ T6610] ? __pfx__printk+0x10/0x10 [ 938.961595][ T6610] ? __pfx___might_resched+0x10/0x10 [ 938.961619][ T6610] should_fail_ex+0x414/0x560 [ 938.961650][ T6610] should_failslab+0xa8/0x100 [ 938.961670][ T6610] __kmalloc_noprof+0xcb/0x7f0 [ 938.961692][ T6610] ? kfree+0x4d/0x6d0 [ 938.961709][ T6610] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 938.961741][ T6610] tomoyo_realpath_from_path+0xe3/0x5d0 [ 938.961768][ T6610] ? tomoyo_domain+0xd9/0x130 [ 938.961790][ T6610] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 938.961813][ T6610] tomoyo_path_number_perm+0x1e8/0x5a0 [ 938.961837][ T6610] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 938.961897][ T6610] ? __fget_files+0x2a/0x420 [ 938.961920][ T6610] ? __fget_files+0x3a0/0x420 [ 938.961936][ T6610] ? __fget_files+0x2a/0x420 [ 938.961958][ T6610] security_file_ioctl+0xcb/0x2d0 [ 938.961979][ T6610] __se_sys_ioctl+0x47/0x170 [ 938.962004][ T6610] do_syscall_64+0xfa/0xfa0 [ 938.962025][ T6610] ? lockdep_hardirqs_on+0x9c/0x150 [ 938.962049][ T6610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 938.962067][ T6610] ? clear_bhb_loop+0x60/0xb0 [ 938.962089][ T6610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 938.962106][ T6610] RIP: 0033:0x7f821ed8f6c9 [ 938.962122][ T6610] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 938.962136][ T6610] RSP: 002b:00007f821fbbf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 938.962155][ T6610] RAX: ffffffffffffffda RBX: 00007f821efe5fa0 RCX: 00007f821ed8f6c9 [ 938.962168][ T6610] RDX: 0000200000000240 RSI: 00000000400448e7 RDI: 0000000000000004 [ 938.962180][ T6610] RBP: 00007f821fbbf090 R08: 0000000000000000 R09: 0000000000000000 [ 938.962190][ T6610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 938.962200][ T6610] R13: 00007f821efe6038 R14: 00007f821efe5fa0 R15: 00007ffffa97ee98 [ 938.962232][ T6610] [ 938.962258][ T6610] ERROR: Out of memory at tomoyo_realpath_from_path. [ 939.230068][ T6625] netlink: 40 bytes leftover after parsing attributes in process `syz.0.13217'. [ 939.296893][ T6628] netlink: 40 bytes leftover after parsing attributes in process `syz.0.13217'. [ 939.474553][ T6636] tipc: Enabled bearer , priority 0 [ 939.500867][ T6636] syzkaller0: entered promiscuous mode [ 939.515594][ T6636] syzkaller0: entered allmulticast mode [ 939.526640][ T6636] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 939.544153][ T6646] netlink: 'syz.2.13225': attribute type 28 has an invalid length. [ 939.560992][ T6636] tipc: Resetting bearer [ 939.576390][ T6646] netlink: 'syz.2.13225': attribute type 3 has an invalid length. [ 939.584237][ T6646] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13225'. [ 939.596599][ T6635] tipc: Resetting bearer [ 939.653115][ T6635] tipc: Disabling bearer [ 939.806955][ T6657] xt_HMARK: spi-set and port-set can't be combined [ 939.828215][ T6660] netlink: 168 bytes leftover after parsing attributes in process `syz.0.13229'. [ 939.893241][ T6666] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13229'. [ 940.000316][ T6671] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13234'. [ 940.056354][ T1344] net_ratelimit: 27 callbacks suppressed [ 940.056373][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 940.205548][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 940.318643][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 940.431720][ T6703] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 940.451063][ T6702] netlink: 'syz.3.13244': attribute type 3 has an invalid length. [ 940.465667][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 940.576052][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 940.695787][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 940.719455][ T6731] FAULT_INJECTION: forcing a failure. [ 940.719455][ T6731] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 940.734752][ T6731] CPU: 0 UID: 0 PID: 6731 Comm: syz.0.13253 Not tainted syzkaller #0 PREEMPT(full) [ 940.734784][ T6731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 940.734795][ T6731] Call Trace: [ 940.734803][ T6731] [ 940.734810][ T6731] dump_stack_lvl+0x189/0x250 [ 940.734836][ T6731] ? __pfx____ratelimit+0x10/0x10 [ 940.734869][ T6731] ? __pfx_dump_stack_lvl+0x10/0x10 [ 940.734889][ T6731] ? __pfx__printk+0x10/0x10 [ 940.734908][ T6731] ? __might_fault+0xb0/0x130 [ 940.734940][ T6731] should_fail_ex+0x414/0x560 [ 940.734970][ T6731] _copy_from_user+0x2d/0xb0 [ 940.734990][ T6731] hci_sock_reject_list_del+0x8e/0x120 [ 940.735010][ T6731] ? __pfx_hci_sock_reject_list_del+0x10/0x10 [ 940.735032][ T6731] ? security_capable+0x7e/0x2e0 [ 940.735063][ T6731] hci_sock_ioctl+0x7f7/0x910 [ 940.735087][ T6731] sock_do_ioctl+0xdc/0x300 [ 940.735112][ T6731] ? __pfx_sock_do_ioctl+0x10/0x10 [ 940.735152][ T6731] sock_ioctl+0x576/0x790 [ 940.735176][ T6731] ? __pfx_sock_ioctl+0x10/0x10 [ 940.735201][ T6731] ? __fget_files+0x3a0/0x420 [ 940.735218][ T6731] ? __fget_files+0x2a/0x420 [ 940.735239][ T6731] ? bpf_lsm_file_ioctl+0x9/0x20 [ 940.735259][ T6731] ? __pfx_sock_ioctl+0x10/0x10 [ 940.735280][ T6731] __se_sys_ioctl+0xfc/0x170 [ 940.735304][ T6731] do_syscall_64+0xfa/0xfa0 [ 940.735327][ T6731] ? lockdep_hardirqs_on+0x9c/0x150 [ 940.735350][ T6731] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.735368][ T6731] ? clear_bhb_loop+0x60/0xb0 [ 940.735390][ T6731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 940.735407][ T6731] RIP: 0033:0x7fa73258f6c9 [ 940.735423][ T6731] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 940.735438][ T6731] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 940.735457][ T6731] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 940.735468][ T6731] RDX: 0000200000000240 RSI: 00000000400448e7 RDI: 0000000000000004 [ 940.735480][ T6731] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 940.735492][ T6731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 940.735502][ T6731] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 940.735536][ T6731] [ 940.965838][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 941.076488][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 941.206965][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 941.673470][ T6786] FAULT_INJECTION: forcing a failure. [ 941.673470][ T6786] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 941.693997][ T6781] tipc: Enabled bearer , priority 0 [ 941.703084][ T6781] syzkaller0: entered promiscuous mode [ 941.711899][ T6781] syzkaller0: entered allmulticast mode [ 941.739736][ T6786] CPU: 0 UID: 0 PID: 6786 Comm: syz.2.13267 Not tainted syzkaller #0 PREEMPT(full) [ 941.739770][ T6786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 941.739781][ T6786] Call Trace: [ 941.739790][ T6786] [ 941.739798][ T6786] dump_stack_lvl+0x189/0x250 [ 941.739826][ T6786] ? __pfx____ratelimit+0x10/0x10 [ 941.739849][ T6786] ? __pfx_dump_stack_lvl+0x10/0x10 [ 941.739872][ T6786] ? __pfx__printk+0x10/0x10 [ 941.739904][ T6786] should_fail_ex+0x414/0x560 [ 941.739936][ T6786] _copy_to_user+0x31/0xb0 [ 941.739960][ T6786] simple_read_from_buffer+0xe1/0x170 [ 941.739990][ T6786] proc_fail_nth_read+0x1b3/0x220 [ 941.740016][ T6786] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 941.740040][ T6786] ? rw_verify_area+0x2a6/0x4d0 [ 941.740062][ T6786] ? __lock_acquire+0xab9/0xd20 [ 941.740078][ T6786] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 941.740101][ T6786] vfs_read+0x200/0xa30 [ 941.740123][ T6786] ? fdget_pos+0x247/0x320 [ 941.740145][ T6786] ? __pfx___mutex_lock+0x10/0x10 [ 941.740170][ T6786] ? __pfx_vfs_read+0x10/0x10 [ 941.740194][ T6786] ? __fget_files+0x2a/0x420 [ 941.740216][ T6786] ? __fget_files+0x3a0/0x420 [ 941.740231][ T6786] ? __fget_files+0x2a/0x420 [ 941.740258][ T6786] ksys_read+0x145/0x250 [ 941.740279][ T6786] ? __fget_files+0x2a/0x420 [ 941.740297][ T6786] ? __pfx_ksys_read+0x10/0x10 [ 941.740324][ T6786] ? do_syscall_64+0xbe/0xfa0 [ 941.740351][ T6786] do_syscall_64+0xfa/0xfa0 [ 941.740373][ T6786] ? lockdep_hardirqs_on+0x9c/0x150 [ 941.740395][ T6786] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 941.740412][ T6786] ? clear_bhb_loop+0x60/0xb0 [ 941.740431][ T6786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 941.740445][ T6786] RIP: 0033:0x7f8810b8e0dc [ 941.740459][ T6786] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 941.740473][ T6786] RSP: 002b:00007f8811a59030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 941.740490][ T6786] RAX: ffffffffffffffda RBX: 00007f8810de5fa0 RCX: 00007f8810b8e0dc [ 941.740501][ T6786] RDX: 000000000000000f RSI: 00007f8811a590a0 RDI: 0000000000000003 [ 941.740510][ T6786] RBP: 00007f8811a59090 R08: 0000000000000000 R09: 0000000000000000 [ 941.740520][ T6786] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 941.740530][ T6786] R13: 00007f8810de6038 R14: 00007f8810de5fa0 R15: 00007fff3df2ccd8 [ 941.740560][ T6786] [ 942.073172][ T6781] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 942.251162][ T6780] tipc: Resetting bearer [ 942.377523][ T6780] tipc: Disabling bearer [ 943.005372][ T6842] team0: Device vti0 is of different type [ 943.111383][ T6850] tipc: Enabled bearer , priority 0 [ 943.135857][ T6850] syzkaller0: entered promiscuous mode [ 943.141422][ T6850] syzkaller0: entered allmulticast mode [ 943.209070][ T6850] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 943.301221][ T6863] sctp: [Deprecated]: syz.0.13291 (pid 6863) Use of struct sctp_assoc_value in delayed_ack socket option. [ 943.301221][ T6863] Use struct sctp_sack_info instead [ 943.323075][ T6850] tipc: Resetting bearer [ 943.332767][ T6849] tipc: Resetting bearer [ 943.363820][ T6849] tipc: Disabling bearer [ 944.555845][ T6917] __nla_validate_parse: 14 callbacks suppressed [ 944.555863][ T6917] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13306'. [ 945.443997][ T6897] : renamed from bond0 [ 945.486996][ T50] net_ratelimit: 15 callbacks suppressed [ 945.487016][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 945.514359][ T6912] netlink: 'syz.2.13305': attribute type 3 has an invalid length. [ 945.537100][ T6912] netlink: 666 bytes leftover after parsing attributes in process `syz.2.13305'. [ 945.885181][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 945.999622][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 946.047605][ T6949] netlink: 20 bytes leftover after parsing attributes in process `syz.5.13316'. [ 946.054597][ T6952] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13319'. [ 946.068401][ T6950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13317'. [ 946.341764][ T6960] udevd[6960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 946.359571][ T6960] udevd[6960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 947.815470][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 947.901565][ T6978] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13327'. [ 947.936381][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 948.000108][ T6985] netlink: 'syz.5.13330': attribute type 4 has an invalid length. [ 948.050347][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 948.092981][ T6990] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13331'. [ 948.177010][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 948.298434][ T7006] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 948.317177][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 948.350979][ T7011] FAULT_INJECTION: forcing a failure. [ 948.350979][ T7011] name failslab, interval 1, probability 0, space 0, times 0 [ 948.383723][ T7011] CPU: 1 UID: 0 PID: 7011 Comm: syz.5.13340 Not tainted syzkaller #0 PREEMPT(full) [ 948.383750][ T7011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 948.383762][ T7011] Call Trace: [ 948.383769][ T7011] [ 948.383779][ T7011] dump_stack_lvl+0x189/0x250 [ 948.383807][ T7011] ? __pfx____ratelimit+0x10/0x10 [ 948.383832][ T7011] ? __pfx_dump_stack_lvl+0x10/0x10 [ 948.383855][ T7011] ? __pfx__printk+0x10/0x10 [ 948.383881][ T7011] ? __pfx___might_resched+0x10/0x10 [ 948.383908][ T7011] should_fail_ex+0x414/0x560 [ 948.383938][ T7011] should_failslab+0xa8/0x100 [ 948.383960][ T7011] kmem_cache_alloc_node_noprof+0x77/0x710 [ 948.383984][ T7011] ? __alloc_skb+0x112/0x2d0 [ 948.384019][ T7011] __alloc_skb+0x112/0x2d0 [ 948.384042][ T7011] netlink_ack+0x146/0xa50 [ 948.384066][ T7011] ? __pfx_genl_rcv_msg+0x10/0x10 [ 948.384086][ T7011] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 948.384110][ T7011] ? __pfx_nl80211_post_doit+0x10/0x10 [ 948.384133][ T7011] ? __asan_memcpy+0x40/0x70 [ 948.384155][ T7011] ? __pfx_ref_tracker_free+0x10/0x10 [ 948.384182][ T7011] netlink_rcv_skb+0x28c/0x470 [ 948.384199][ T7011] ? __lock_acquire+0xab9/0xd20 [ 948.384218][ T7011] ? __pfx_genl_rcv_msg+0x10/0x10 [ 948.384241][ T7011] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 948.384279][ T7011] ? down_read+0x1ad/0x2e0 [ 948.384300][ T7011] genl_rcv+0x28/0x40 [ 948.384320][ T7011] netlink_unicast+0x82f/0x9e0 [ 948.384355][ T7011] ? __pfx_netlink_unicast+0x10/0x10 [ 948.384381][ T7011] ? netlink_sendmsg+0x642/0xb30 [ 948.384398][ T7011] ? skb_put+0x11b/0x210 [ 948.384420][ T7011] netlink_sendmsg+0x805/0xb30 [ 948.384447][ T7011] ? __pfx_netlink_sendmsg+0x10/0x10 [ 948.384470][ T7011] ? aa_sock_msg_perm+0xf1/0x1d0 [ 948.384498][ T7011] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 948.384516][ T7011] ? __pfx_netlink_sendmsg+0x10/0x10 [ 948.384540][ T7011] __sock_sendmsg+0x21c/0x270 [ 948.384568][ T7011] ____sys_sendmsg+0x505/0x830 [ 948.384594][ T7011] ? __pfx_____sys_sendmsg+0x10/0x10 [ 948.384624][ T7011] ? import_iovec+0x74/0xa0 [ 948.384650][ T7011] ___sys_sendmsg+0x21f/0x2a0 [ 948.384673][ T7011] ? __pfx____sys_sendmsg+0x10/0x10 [ 948.384733][ T7011] ? __fget_files+0x2a/0x420 [ 948.384750][ T7011] ? __fget_files+0x3a0/0x420 [ 948.384779][ T7011] __x64_sys_sendmsg+0x19b/0x260 [ 948.384802][ T7011] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 948.384840][ T7011] ? do_syscall_64+0xbe/0xfa0 [ 948.384868][ T7011] do_syscall_64+0xfa/0xfa0 [ 948.384886][ T7011] ? lockdep_hardirqs_on+0x9c/0x150 [ 948.384906][ T7011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 948.384923][ T7011] ? clear_bhb_loop+0x60/0xb0 [ 948.384944][ T7011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 948.384962][ T7011] RIP: 0033:0x7f0be1f8f6c9 [ 948.384979][ T7011] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 948.385002][ T7011] RSP: 002b:00007f0be01f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 948.385023][ T7011] RAX: ffffffffffffffda RBX: 00007f0be21e5fa0 RCX: 00007f0be1f8f6c9 [ 948.385037][ T7011] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 948.385050][ T7011] RBP: 00007f0be01f6090 R08: 0000000000000000 R09: 0000000000000000 [ 948.385062][ T7011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 948.385075][ T7011] R13: 00007f0be21e6038 R14: 00007f0be21e5fa0 R15: 00007ffcbe801b28 [ 948.385110][ T7011] [ 948.456104][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 949.003545][ T7044] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13348'. [ 949.257759][ T7058] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13348'. [ 950.622126][ T7052] tipc: Enabling of bearer rejected, failed to enable media [ 950.631590][ T7056] vlan0: entered allmulticast mode [ 950.653526][ T7056] gretap0: entered allmulticast mode [ 950.667385][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 952.482936][ T7090] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13359'. [ 952.505159][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 952.645847][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 952.880498][ T7120] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13366'. [ 952.967389][ T7122] netlink: 128 bytes leftover after parsing attributes in process `syz.3.13366'. [ 954.509731][ T7134] tipc: Enabled bearer , priority 0 [ 954.519058][ T7135] syzkaller0: entered promiscuous mode [ 954.524555][ T7135] syzkaller0: entered allmulticast mode [ 954.572447][ T7127] tipc: Resetting bearer [ 954.586262][ T7147] netlink: 44 bytes leftover after parsing attributes in process `syz.0.13372'. [ 954.610578][ T7147] netlink: 43 bytes leftover after parsing attributes in process `syz.0.13372'. [ 954.624207][ T7147] netlink: 'syz.0.13372': attribute type 6 has an invalid length. [ 954.635978][ T7147] netlink: 'syz.0.13372': attribute type 5 has an invalid length. [ 954.644157][ T7147] netlink: 43 bytes leftover after parsing attributes in process `syz.0.13372'. [ 954.661426][ T7127] tipc: Disabling bearer [ 954.695177][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 954.714490][ T7154] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13375'. [ 954.884045][ T7163] netlink: 156 bytes leftover after parsing attributes in process `syz.0.13378'. [ 956.710565][ T7199] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13384'. [ 957.169194][ T52] block nbd4: Receive control failed (result -110) [ 958.117435][ T7199] bridge_slave_0: left allmulticast mode [ 958.123115][ T7199] bridge_slave_0: left promiscuous mode [ 958.137106][ T7199] bridge0: port 1(bridge_slave_0) entered disabled state [ 958.275841][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 958.292122][ T7202] tipc: Enabled bearer , priority 0 [ 958.309882][ T7202] syzkaller0: entered promiscuous mode [ 958.326121][ T7202] syzkaller0: entered allmulticast mode [ 958.339000][ T7206] syzkaller0: entered promiscuous mode [ 958.351561][ T7206] syzkaller0: entered allmulticast mode [ 958.401731][ T7201] tipc: Resetting bearer [ 958.489087][ T7201] tipc: Disabling bearer [ 958.536605][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 958.658147][ T7227] syzkaller0: create flow: hash 2413530488 index 2 [ 958.896751][T13054] syzkaller0: tun_net_xmit 76 [ 958.904350][T13054] syzkaller0: tun_net_xmit 48 [ 958.921684][ T7220] syzkaller0: delete flow: hash 2413530488 index 2 [ 958.936171][T28197] syzkaller0: tun_net_xmit 76 [ 959.243023][ T7264] netlink: 'syz.0.13409': attribute type 1 has an invalid length. [ 959.251726][ T7264] netlink: 224 bytes leftover after parsing attributes in process `syz.0.13409'. [ 960.616115][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 960.710062][ T7265] tipc: Enabling of bearer rejected, failed to enable media [ 960.745403][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.187675][ T7283] mac80211_hwsim hwsim6 wlan1: entered allmulticast mode [ 962.205846][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.316986][ T991] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.425197][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.536052][ T50] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.655648][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.711929][ T7317] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13423'. [ 962.761087][ T7321] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.13424'. [ 962.787054][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 962.877135][ T7330] syzkaller0: create flow: hash 2413530488 index 2 [ 963.058970][ T1344] syzkaller0: tun_net_xmit 76 [ 963.070178][ T1344] syzkaller0: tun_net_xmit 48 [ 963.086852][T27193] syzkaller0: tun_net_xmit 76 [ 963.093420][ T7348] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 963.214675][ T7319] syzkaller0: delete flow: hash 2413530488 index 2 [ 964.743175][ T7361] netlink: 6 bytes leftover after parsing attributes in process `syz.0.13433'. [ 964.865074][ T7363] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13434'. [ 966.287205][ T7371] FAULT_INJECTION: forcing a failure. [ 966.287205][ T7371] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 966.308857][ T7371] CPU: 1 UID: 0 PID: 7371 Comm: syz.2.13436 Not tainted syzkaller #0 PREEMPT(full) [ 966.308883][ T7371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 966.308893][ T7371] Call Trace: [ 966.308901][ T7371] [ 966.308909][ T7371] dump_stack_lvl+0x189/0x250 [ 966.308938][ T7371] ? __pfx____ratelimit+0x10/0x10 [ 966.308961][ T7371] ? __pfx_dump_stack_lvl+0x10/0x10 [ 966.308984][ T7371] ? __pfx__printk+0x10/0x10 [ 966.309002][ T7371] ? __might_fault+0xb0/0x130 [ 966.309037][ T7371] should_fail_ex+0x414/0x560 [ 966.309077][ T7371] _copy_from_user+0x2d/0xb0 [ 966.309099][ T7371] ___sys_sendmsg+0x158/0x2a0 [ 966.309123][ T7371] ? __pfx____sys_sendmsg+0x10/0x10 [ 966.309179][ T7371] ? __fget_files+0x2a/0x420 [ 966.309196][ T7371] ? __fget_files+0x3a0/0x420 [ 966.309223][ T7371] __x64_sys_sendmsg+0x19b/0x260 [ 966.309243][ T7371] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 966.309270][ T7371] ? __pfx_ksys_write+0x10/0x10 [ 966.309296][ T7371] ? do_syscall_64+0xbe/0xfa0 [ 966.309319][ T7371] do_syscall_64+0xfa/0xfa0 [ 966.309336][ T7371] ? lockdep_hardirqs_on+0x9c/0x150 [ 966.309357][ T7371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.309375][ T7371] ? clear_bhb_loop+0x60/0xb0 [ 966.309395][ T7371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 966.309412][ T7371] RIP: 0033:0x7f8810b8f6c9 [ 966.309429][ T7371] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 966.309444][ T7371] RSP: 002b:00007f8811a59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 966.309465][ T7371] RAX: ffffffffffffffda RBX: 00007f8810de5fa0 RCX: 00007f8810b8f6c9 [ 966.309477][ T7371] RDX: 0000000000040000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 966.309487][ T7371] RBP: 00007f8811a59090 R08: 0000000000000000 R09: 0000000000000000 [ 966.309497][ T7371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 966.309508][ T7371] R13: 00007f8810de6038 R14: 00007f8810de5fa0 R15: 00007fff3df2ccd8 [ 966.309537][ T7371] [ 967.996262][ T3549] bond4: (slave macvlan2): failed to get link speed/duplex [ 968.105096][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 968.120937][ T7391] netlink: 32 bytes leftover after parsing attributes in process `syz.5.13438'. [ 968.245343][ T7395] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13440'. [ 968.254588][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 968.296013][ T7399] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13441'. [ 968.378034][ T60] bond4: (slave macvlan2): failed to get link speed/duplex [ 968.486030][ T7418] syzkaller0: create flow: hash 2413530488 index 2 [ 969.004184][ T7405] syzkaller0: delete flow: hash 2413530488 index 2 [ 970.475476][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 970.582315][ T7465] netlink: 4 bytes leftover after parsing attributes in process `syz.5.13452'. [ 970.869336][ T7485] netlink: 'syz.1.13459': attribute type 1 has an invalid length. [ 970.869652][ T7484] netlink: 'syz.1.13459': attribute type 1 has an invalid length. [ 972.184111][ T7465] hsr_slave_0: left promiscuous mode [ 972.231781][ T7485] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 972.233645][ T7484] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 972.265152][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 972.671920][ T7509] netlink: 'syz.0.13467': attribute type 2 has an invalid length. [ 972.681219][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 972.704047][ T7509] 9: entered promiscuous mode [ 972.713345][ T7509] netlink: 'syz.0.13467': attribute type 1 has an invalid length. [ 972.722237][ T7509] netlink: 'syz.0.13467': attribute type 1 has an invalid length. [ 972.732940][ T7509] netlink: 'syz.0.13467': attribute type 1 has an invalid length. [ 972.743604][ T7509] netlink: 'syz.0.13467': attribute type 2 has an invalid length. [ 972.796839][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 972.855216][ T7509] netlink: 76 bytes leftover after parsing attributes in process `syz.0.13467'. [ 972.864363][ T7511] netlink: 'syz.0.13467': attribute type 1 has an invalid length. [ 972.878132][ T7511] netlink: 'syz.0.13467': attribute type 1 has an invalid length. [ 972.896855][ T7511] netlink: 'syz.0.13467': attribute type 1 has an invalid length. [ 972.905979][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 972.946974][ T7511] netlink: 76 bytes leftover after parsing attributes in process `syz.0.13467'. [ 972.971927][ T7517] tipc: Enabled bearer , priority 0 [ 972.991430][ T7517] syzkaller0: entered promiscuous mode [ 973.004646][ T7517] syzkaller0: entered allmulticast mode [ 973.091159][ T7516] tipc: Resetting bearer [ 973.118120][ T7516] tipc: Disabling bearer [ 973.157092][ T7524] wg2: entered promiscuous mode [ 973.164790][ T7524] wg2: entered allmulticast mode [ 973.176787][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 973.287327][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 973.364325][ T7543] netlink: 228 bytes leftover after parsing attributes in process `syz.0.13478'. [ 973.438432][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 973.520142][ T7550] tipc: Enabled bearer , priority 0 [ 973.529146][ T7550] syzkaller0: entered promiscuous mode [ 973.534638][ T7550] syzkaller0: entered allmulticast mode [ 973.590905][ T7550] tipc: Resetting bearer [ 973.653090][ T7549] tipc: Resetting bearer [ 973.687858][ T7549] tipc: Disabling bearer [ 973.766489][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 973.985761][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 974.099550][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 974.216192][ T7598] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13501'. [ 974.225873][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 974.335022][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 974.426102][ T7612] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13506'. [ 974.466107][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 974.476781][ T7617] netlink: 8 bytes leftover after parsing attributes in process `syz.5.13507'. [ 974.485992][ T7617] netlink: 4 bytes leftover after parsing attributes in process `syz.5.13507'. [ 974.575204][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 974.583968][ T7622] netlink: 184 bytes leftover after parsing attributes in process `syz.1.13509'. [ 974.843045][ T7632] netlink: 4 bytes leftover after parsing attributes in process `syz.5.13513'. [ 976.220157][ T7729] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13541'. [ 976.276083][ T7729] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13541'. [ 976.385841][ T7741] wg2: entered promiscuous mode [ 976.390835][ T7741] wg2: entered allmulticast mode [ 976.580778][ T7755] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13553'. [ 977.296872][ T7797] xt_NFQUEUE: number of queues (16) out of range (got 65549) [ 977.381943][ T7797] netlink: 56 bytes leftover after parsing attributes in process `syz.5.13569'. [ 977.491328][ T7808] netlink: 45 bytes leftover after parsing attributes in process `syz.1.13572'. [ 977.508118][ T7797] bond5 (unregistering): Released all slaves [ 977.571225][ T7808] netlink: 20 bytes leftover after parsing attributes in process `syz.1.13572'. [ 977.607482][ T7817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13574'. [ 977.711422][ T7823] FAULT_INJECTION: forcing a failure. [ 977.711422][ T7823] name failslab, interval 1, probability 0, space 0, times 0 [ 977.775498][ T7823] CPU: 0 UID: 0 PID: 7823 Comm: syz.2.13576 Not tainted syzkaller #0 PREEMPT(full) [ 977.775525][ T7823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 977.775535][ T7823] Call Trace: [ 977.775543][ T7823] [ 977.775552][ T7823] dump_stack_lvl+0x189/0x250 [ 977.775579][ T7823] ? __pfx____ratelimit+0x10/0x10 [ 977.775602][ T7823] ? __pfx_dump_stack_lvl+0x10/0x10 [ 977.775625][ T7823] ? __pfx__printk+0x10/0x10 [ 977.775651][ T7823] ? __pfx___might_resched+0x10/0x10 [ 977.775675][ T7823] should_fail_ex+0x414/0x560 [ 977.775707][ T7823] should_failslab+0xa8/0x100 [ 977.775727][ T7823] __kmalloc_noprof+0xcb/0x7f0 [ 977.775749][ T7823] ? kfree+0x4d/0x6d0 [ 977.775767][ T7823] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 977.775800][ T7823] tomoyo_realpath_from_path+0xe3/0x5d0 [ 977.775827][ T7823] ? tomoyo_domain+0xd9/0x130 [ 977.775851][ T7823] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 977.775873][ T7823] tomoyo_path_number_perm+0x1e8/0x5a0 [ 977.775899][ T7823] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 977.775971][ T7823] ? __fget_files+0x2a/0x420 [ 977.775993][ T7823] ? __fget_files+0x3a0/0x420 [ 977.776009][ T7823] ? __fget_files+0x2a/0x420 [ 977.776030][ T7823] security_file_ioctl+0xcb/0x2d0 [ 977.776054][ T7823] __se_sys_ioctl+0x47/0x170 [ 977.776078][ T7823] do_syscall_64+0xfa/0xfa0 [ 977.776099][ T7823] ? lockdep_hardirqs_on+0x9c/0x150 [ 977.776122][ T7823] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.776141][ T7823] ? clear_bhb_loop+0x60/0xb0 [ 977.776162][ T7823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.776179][ T7823] RIP: 0033:0x7f8810b8f6c9 [ 977.776195][ T7823] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 977.776211][ T7823] RSP: 002b:00007f8811a59038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 977.776231][ T7823] RAX: ffffffffffffffda RBX: 00007f8810de5fa0 RCX: 00007f8810b8f6c9 [ 977.776244][ T7823] RDX: 0000200000000040 RSI: 0000000000008b04 RDI: 0000000000000006 [ 977.776256][ T7823] RBP: 00007f8811a59090 R08: 0000000000000000 R09: 0000000000000000 [ 977.776267][ T7823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 977.776277][ T7823] R13: 00007f8810de6038 R14: 00007f8810de5fa0 R15: 00007fff3df2ccd8 [ 977.776308][ T7823] [ 977.776317][ T7823] ERROR: Out of memory at tomoyo_realpath_from_path. [ 978.257229][ T7845] netlink: 128 bytes leftover after parsing attributes in process `syz.0.13583'. [ 978.277579][ T1327] net_ratelimit: 27 callbacks suppressed [ 978.277600][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 978.317356][ T7845] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13583'. [ 978.422654][ T7845] hsr_slave_0: left promiscuous mode [ 978.556170][ T7865] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13591'. [ 978.588853][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 978.715961][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 978.810275][ T7879] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 978.945021][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 979.055214][ T7897] validate_nla: 4 callbacks suppressed [ 979.055234][ T7897] netlink: 'syz.0.13602': attribute type 20 has an invalid length. [ 979.068839][ T1327] bond4: (slave macvlan2): failed to get link speed/duplex [ 979.090681][ T7897] netlink: 'syz.0.13602': attribute type 20 has an invalid length. [ 979.165230][T27202] page_pool_release_retry() stalled pool shutdown: id 68, 1 inflight 362 sec [ 979.188001][ T7904] netlink: 'syz.0.13606': attribute type 1 has an invalid length. [ 979.196680][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 979.302289][ T7911] bond19: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 979.316993][ T7911] bond19: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 979.331064][ T7911] bond19: (slave ipvlan0): Setting fail_over_mac to active for active-backup mode [ 979.379438][ T7918] bond19: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 979.392695][ T7918] bond19: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 979.486949][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 979.567949][ T7923] vlan3: entered allmulticast mode [ 979.573105][ T7923] batadv0: entered allmulticast mode [ 979.615892][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 979.725930][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 979.791520][ T7943] tipc: Enabled bearer , priority 0 [ 979.811363][ T7943] syzkaller0: entered promiscuous mode [ 979.826123][ T7943] syzkaller0: entered allmulticast mode [ 979.876774][ T7943] tipc: Resetting bearer [ 979.911902][ T7953] netlink: 'syz.3.13618': attribute type 3 has an invalid length. [ 979.917777][ T7943] tipc: Disabling bearer [ 980.093900][ T7966] sock: sock_timestamping_bind_phc: sock not bind to device [ 980.253497][ T7975] IPVS: sync thread started: state = BACKUP, mcast_ifn = geneve1, syncid = 2, id = 0 [ 980.873808][ T8023] wg2: entered promiscuous mode [ 980.892485][ T8023] wg2: entered allmulticast mode [ 981.815621][ T8091] __nla_validate_parse: 23 callbacks suppressed [ 981.815643][ T8091] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13670'. [ 981.986599][ T8102] wg2: left promiscuous mode [ 981.991305][ T8102] wg2: left allmulticast mode [ 982.027028][ T8106] wg2: entered promiscuous mode [ 982.033145][ T8106] wg2: entered allmulticast mode [ 982.233566][ T8117] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:20004 [ 982.234622][ T8119] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13681'. [ 982.252047][ T8121] netlink: 212 bytes leftover after parsing attributes in process `syz.0.13680'. [ 982.328732][ T8119] veth15: entered allmulticast mode [ 982.381814][ T8123] syzkaller0: entered promiscuous mode [ 982.395568][ T8123] syzkaller0: entered allmulticast mode [ 982.479671][ T8128] netlink: 60 bytes leftover after parsing attributes in process `syz.5.13682'. [ 982.638174][ T8148] netlink: 'syz.1.13685': attribute type 1 has an invalid length. [ 983.052449][ T8161] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13695'. [ 983.371595][ T1344] net_ratelimit: 26 callbacks suppressed [ 983.371614][ T1344] bond4: (slave macvlan2): failed to get link speed/duplex [ 983.513511][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 983.657034][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 983.697761][ T8211] sock: sock_timestamping_bind_phc: sock not bind to device [ 983.765071][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 983.964062][ T8221] syzkaller0: entered promiscuous mode [ 983.970910][ T8221] syzkaller0: entered allmulticast mode [ 983.989410][ T8232] netlink: 'syz.1.13714': attribute type 1 has an invalid length. [ 983.997745][ T8232] netlink: 'syz.1.13714': attribute type 11 has an invalid length. [ 984.009197][ T8232] netlink: 224 bytes leftover after parsing attributes in process `syz.1.13714'. [ 984.018600][ T8229] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13713'. [ 985.968209][T13054] bond4: (slave macvlan2): failed to get link speed/duplex [ 986.040810][ T8284] netlink: 96 bytes leftover after parsing attributes in process `syz.2.13724'. [ 986.085320][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 986.193103][ T8294] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 986.197917][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 986.425207][T13057] bond4: (slave macvlan2): failed to get link speed/duplex [ 986.681170][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 986.868004][ T8338] netlink: 96 bytes leftover after parsing attributes in process `syz.3.13740'. [ 986.976053][ T8334] netlink: 332 bytes leftover after parsing attributes in process `syz.0.13739'. [ 987.083201][ T8348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13743'. [ 987.114103][ T8348] netlink: 76 bytes leftover after parsing attributes in process `syz.1.13743'. [ 987.401499][ T8374] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13750'. [ 987.629507][ T8386] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13753'. [ 987.791855][ T8397] netlink: 96 bytes leftover after parsing attributes in process `syz.1.13756'. [ 987.850517][ T8402] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13758'. [ 988.028525][ T8413] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13764'. [ 988.092333][ T8416] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13766'. [ 988.166718][ T8421] netlink: 'syz.5.13767': attribute type 18 has an invalid length. [ 988.286777][ T8428] FAULT_INJECTION: forcing a failure. [ 988.286777][ T8428] name failslab, interval 1, probability 0, space 0, times 0 [ 988.317623][ T8428] CPU: 1 UID: 0 PID: 8428 Comm: syz.0.13770 Not tainted syzkaller #0 PREEMPT(full) [ 988.317649][ T8428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 988.317660][ T8428] Call Trace: [ 988.317667][ T8428] [ 988.317675][ T8428] dump_stack_lvl+0x189/0x250 [ 988.317703][ T8428] ? __pfx____ratelimit+0x10/0x10 [ 988.317725][ T8428] ? __pfx_dump_stack_lvl+0x10/0x10 [ 988.317747][ T8428] ? __pfx__printk+0x10/0x10 [ 988.317767][ T8428] ? __pfx___might_resched+0x10/0x10 [ 988.317794][ T8428] ? fs_reclaim_acquire+0x7d/0x100 [ 988.317824][ T8428] should_fail_ex+0x414/0x560 [ 988.317853][ T8428] should_failslab+0xa8/0x100 [ 988.317872][ T8428] __kmalloc_cache_noprof+0x6f/0x6f0 [ 988.317896][ T8428] ? qfq_change_class+0xb65/0x10a0 [ 988.317923][ T8428] qfq_change_class+0xb65/0x10a0 [ 988.317955][ T8428] ? __pfx_qfq_change_class+0x10/0x10 [ 988.317981][ T8428] ? lockdep_rtnl_is_held+0x26/0x40 [ 988.317999][ T8428] ? qdisc_lookup+0x179/0x6d0 [ 988.318023][ T8428] tc_ctl_tclass+0xaa0/0x1500 [ 988.318061][ T8428] ? __pfx_tc_ctl_tclass+0x10/0x10 [ 988.318078][ T8428] ? rcu_is_watching+0x15/0xb0 [ 988.318097][ T8428] ? trace_contention_end+0x39/0x120 [ 988.318117][ T8428] ? __mutex_lock+0x335/0x1350 [ 988.318139][ T8428] ? is_bpf_text_address+0x292/0x2b0 [ 988.318158][ T8428] ? is_bpf_text_address+0x26/0x2b0 [ 988.318216][ T8428] ? __pfx_tc_ctl_tclass+0x10/0x10 [ 988.318235][ T8428] rtnetlink_rcv_msg+0x77c/0xb70 [ 988.318258][ T8428] ? __lock_acquire+0xab9/0xd20 [ 988.318276][ T8428] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 988.318299][ T8428] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 988.318340][ T8428] netlink_rcv_skb+0x208/0x470 [ 988.318354][ T8428] ? __lock_acquire+0xab9/0xd20 [ 988.318372][ T8428] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 988.318398][ T8428] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 988.318426][ T8428] ? netlink_deliver_tap+0x2e/0x1b0 [ 988.318450][ T8428] netlink_unicast+0x82f/0x9e0 [ 988.318480][ T8428] ? __pfx_netlink_unicast+0x10/0x10 [ 988.318504][ T8428] ? netlink_sendmsg+0x642/0xb30 [ 988.318520][ T8428] ? skb_put+0x11b/0x210 [ 988.318540][ T8428] netlink_sendmsg+0x805/0xb30 [ 988.318569][ T8428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 988.318590][ T8428] ? aa_sock_msg_perm+0xf1/0x1d0 [ 988.318617][ T8428] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 988.318635][ T8428] ? __pfx_netlink_sendmsg+0x10/0x10 [ 988.318653][ T8428] __sock_sendmsg+0x21c/0x270 [ 988.318681][ T8428] ____sys_sendmsg+0x505/0x830 [ 988.318706][ T8428] ? __pfx_____sys_sendmsg+0x10/0x10 [ 988.318735][ T8428] ? import_iovec+0x74/0xa0 [ 988.318760][ T8428] ___sys_sendmsg+0x21f/0x2a0 [ 988.318780][ T8428] ? __pfx____sys_sendmsg+0x10/0x10 [ 988.318839][ T8428] ? __fget_files+0x2a/0x420 [ 988.318853][ T8428] ? __fget_files+0x3a0/0x420 [ 988.318879][ T8428] __x64_sys_sendmsg+0x19b/0x260 [ 988.318898][ T8428] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 988.318925][ T8428] ? __pfx_ksys_write+0x10/0x10 [ 988.318952][ T8428] ? do_syscall_64+0xbe/0xfa0 [ 988.318978][ T8428] do_syscall_64+0xfa/0xfa0 [ 988.318999][ T8428] ? lockdep_hardirqs_on+0x9c/0x150 [ 988.319021][ T8428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.319037][ T8428] ? clear_bhb_loop+0x60/0xb0 [ 988.319057][ T8428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.319073][ T8428] RIP: 0033:0x7fa73258f6c9 [ 988.319091][ T8428] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 988.319106][ T8428] RSP: 002b:00007fa733367038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 988.319126][ T8428] RAX: ffffffffffffffda RBX: 00007fa7327e5fa0 RCX: 00007fa73258f6c9 [ 988.319138][ T8428] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 988.319148][ T8428] RBP: 00007fa733367090 R08: 0000000000000000 R09: 0000000000000000 [ 988.319159][ T8428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 988.319169][ T8428] R13: 00007fa7327e6038 R14: 00007fa7327e5fa0 R15: 00007fffbcbd07a8 [ 988.319204][ T8428] [ 988.712828][T13056] net_ratelimit: 12 callbacks suppressed [ 988.712846][T13056] bond4: (slave macvlan2): failed to get link speed/duplex [ 988.764455][ T8430] pim6reg: entered allmulticast mode [ 988.777637][ T8426] ================================================================== [ 988.785828][ T8426] BUG: KASAN: slab-use-after-free in qfq_reset_qdisc+0xf9/0x240 [ 988.793477][ T8426] Read of size 8 at addr ffff8880470c0050 by task syz.0.13770/8426 [ 988.801372][ T8426] [ 988.803702][ T8426] CPU: 0 UID: 0 PID: 8426 Comm: syz.0.13770 Not tainted syzkaller #0 PREEMPT(full) [ 988.803724][ T8426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 988.803736][ T8426] Call Trace: [ 988.803743][ T8426] [ 988.803751][ T8426] dump_stack_lvl+0x189/0x250 [ 988.803783][ T8426] ? __virt_addr_valid+0x1c8/0x5c0 [ 988.803805][ T8426] ? rcu_is_watching+0x15/0xb0 [ 988.803823][ T8426] ? __kasan_check_byte+0x12/0x40 [ 988.803841][ T8426] ? __pfx_dump_stack_lvl+0x10/0x10 [ 988.803861][ T8426] ? rcu_is_watching+0x15/0xb0 [ 988.803879][ T8426] ? lock_release+0x4b/0x3e0 [ 988.803897][ T8426] ? __virt_addr_valid+0x1c8/0x5c0 [ 988.803919][ T8426] ? __virt_addr_valid+0x4a5/0x5c0 [ 988.803941][ T8426] print_report+0xca/0x240 [ 988.803960][ T8426] ? qfq_reset_qdisc+0xf9/0x240 [ 988.803980][ T8426] kasan_report+0x118/0x150 [ 988.803997][ T8426] ? qfq_reset_qdisc+0xf9/0x240 [ 988.804022][ T8426] qfq_reset_qdisc+0xf9/0x240 [ 988.804045][ T8426] ? __pfx_qfq_reset_qdisc+0x10/0x10 [ 988.804066][ T8426] qdisc_reset+0x10f/0x580 [ 988.804092][ T8426] __qdisc_destroy+0x120/0x420 [ 988.804110][ T8426] dev_shutdown+0x34c/0x440 [ 988.804128][ T8426] unregister_netdevice_many_notify+0x118c/0x2390 [ 988.804158][ T8426] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 988.804179][ T8426] ? __mod_timer+0xb37/0xf30 [ 988.804203][ T8426] ? queue_delayed_work_on+0x11a/0x280 [ 988.804223][ T8426] ? lockdep_hardirqs_on+0x9c/0x150 [ 988.804249][ T8426] unregister_netdevice_queue+0x33c/0x380 [ 988.804269][ T8426] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 988.804289][ T8426] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 988.804309][ T8426] ? linkwatch_urgent_event+0x62/0x3a0 [ 988.804333][ T8426] __tun_detach+0x6d9/0x15d0 [ 988.804360][ T8426] ? __pfx_tun_chr_close+0x10/0x10 [ 988.804380][ T8426] tun_chr_close+0x10a/0x1c0 [ 988.804399][ T8426] __fput+0x44c/0xa70 [ 988.804424][ T8426] task_work_run+0x1d4/0x260 [ 988.804449][ T8426] ? __pfx_task_work_run+0x10/0x10 [ 988.804473][ T8426] ? exit_to_user_mode_loop+0x40/0x130 [ 988.804492][ T8426] exit_to_user_mode_loop+0xe9/0x130 [ 988.804509][ T8426] do_syscall_64+0x2bd/0xfa0 [ 988.804531][ T8426] ? lockdep_hardirqs_on+0x9c/0x150 [ 988.804553][ T8426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.804571][ T8426] ? clear_bhb_loop+0x60/0xb0 [ 988.804595][ T8426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 988.804613][ T8426] RIP: 0033:0x7fa73258f6c9 [ 988.804629][ T8426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 988.804644][ T8426] RSP: 002b:00007fffbcbd0908 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 988.804664][ T8426] RAX: 0000000000000000 RBX: 00007fa7327e7da0 RCX: 00007fa73258f6c9 [ 988.804695][ T8426] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 988.804706][ T8426] RBP: 00007fa7327e7da0 R08: 0000000000000000 R09: 0000000ebcbd0bff [ 988.804718][ T8426] R10: 000000000003fd70 R11: 0000000000000246 R12: 00000000000f1778 [ 988.804730][ T8426] R13: 00007fffbcbd0a00 R14: ffffffffffffffff R15: 00007fffbcbd0a20 [ 988.804753][ T8426] [ 988.804760][ T8426] [ 989.110401][ T8426] Allocated by task 8428: [ 989.114710][ T8426] kasan_save_track+0x3e/0x80 [ 989.119390][ T8426] __kasan_kmalloc+0x93/0xb0 [ 989.123972][ T8426] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 989.129326][ T8426] qfq_change_class+0x67c/0x10a0 [ 989.134246][ T8426] tc_ctl_tclass+0xaa0/0x1500 [ 989.138910][ T8426] rtnetlink_rcv_msg+0x77c/0xb70 [ 989.143831][ T8426] netlink_rcv_skb+0x208/0x470 [ 989.148576][ T8426] netlink_unicast+0x82f/0x9e0 [ 989.153328][ T8426] netlink_sendmsg+0x805/0xb30 [ 989.158093][ T8426] __sock_sendmsg+0x21c/0x270 [ 989.162753][ T8426] ____sys_sendmsg+0x505/0x830 [ 989.167493][ T8426] ___sys_sendmsg+0x21f/0x2a0 [ 989.172154][ T8426] __x64_sys_sendmsg+0x19b/0x260 [ 989.177073][ T8426] do_syscall_64+0xfa/0xfa0 [ 989.181560][ T8426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.187433][ T8426] [ 989.189739][ T8426] Freed by task 8428: [ 989.194042][ T8426] kasan_save_track+0x3e/0x80 [ 989.198705][ T8426] __kasan_save_free_info+0x46/0x50 [ 989.203886][ T8426] __kasan_slab_free+0x5c/0x80 [ 989.208630][ T8426] kfree+0x19a/0x6d0 [ 989.212507][ T8426] qfq_change_class+0xc60/0x10a0 [ 989.217426][ T8426] tc_ctl_tclass+0xaa0/0x1500 [ 989.222098][ T8426] rtnetlink_rcv_msg+0x77c/0xb70 [ 989.227034][ T8426] netlink_rcv_skb+0x208/0x470 [ 989.231789][ T8426] netlink_unicast+0x82f/0x9e0 [ 989.236546][ T8426] netlink_sendmsg+0x805/0xb30 [ 989.241298][ T8426] __sock_sendmsg+0x21c/0x270 [ 989.245964][ T8426] ____sys_sendmsg+0x505/0x830 [ 989.250716][ T8426] ___sys_sendmsg+0x21f/0x2a0 [ 989.256633][ T8426] __x64_sys_sendmsg+0x19b/0x260 [ 989.261977][ T8426] do_syscall_64+0xfa/0xfa0 [ 989.266478][ T8426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.272361][ T8426] [ 989.274669][ T8426] The buggy address belongs to the object at ffff8880470c0000 [ 989.274669][ T8426] which belongs to the cache kmalloc-128 of size 128 [ 989.288709][ T8426] The buggy address is located 80 bytes inside of [ 989.288709][ T8426] freed 128-byte region [ffff8880470c0000, ffff8880470c0080) [ 989.302404][ T8426] [ 989.304714][ T8426] The buggy address belongs to the physical page: [ 989.311148][ T8426] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x470c0 [ 989.319892][ T8426] ksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 989.327334][ T8426] page_type: f5(slab) [ 989.331302][ T8426] raw: 00fff00000000000 ffff88801a026a00 ffffea0001ef5300 dead000000000003 [ 989.339867][ T8426] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 989.348431][ T8426] page dumped because: kasan: bad access detected [ 989.354855][ T8426] page_owner tracks the page as allocated [ 989.360553][ T8426] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5198, tgid 5198 (udevd), ts 112594362422, free_ts 112592496233 [ 989.379467][ T8426] post_alloc_hook+0x240/0x2a0 [ 989.384232][ T8426] get_page_from_freelist+0x2365/0x2440 [ 989.389757][ T8426] __alloc_frozen_pages_noprof+0x181/0x370 [ 989.395542][ T8426] alloc_pages_mpol+0x232/0x4a0 [ 989.400369][ T8426] allocate_slab+0x96/0x350 [ 989.404856][ T8426] ___slab_alloc+0xe94/0x18a0 [ 989.409522][ T8426] __slab_alloc+0x65/0x100 [ 989.413925][ T8426] __kmalloc_cache_noprof+0x411/0x6f0 [ 989.419306][ T8426] kernfs_fop_open+0x7b5/0xca0 [ 989.424065][ T8426] do_dentry_open+0x953/0x13f0 [ 989.428825][ T8426] vfs_open+0x3b/0x340 [ 989.432886][ T8426] path_openat+0x2ee5/0x3830 [ 989.437466][ T8426] do_filp_open+0x1fa/0x410 [ 989.441965][ T8426] do_sys_openat2+0x121/0x1c0 [ 989.446643][ T8426] __x64_sys_openat+0x138/0x170 [ 989.451498][ T8426] do_syscall_64+0xfa/0xfa0 [ 989.455995][ T8426] page last free pid 5830 tgid 5830 stack trace: [ 989.462306][ T8426] __free_frozen_pages+0xbc4/0xd30 [ 989.467409][ T8426] vfree+0x25a/0x400 [ 989.471289][ T8426] do_ip6t_get_ctl+0xeb0/0x1180 [ 989.476126][ T8426] nf_getsockopt+0x26e/0x290 [ 989.480804][ T8426] ipv6_getsockopt+0x1ed/0x290 [ 989.485592][ T8426] do_sock_getsockopt+0x372/0x450 [ 989.490617][ T8426] __x64_sys_getsockopt+0x1a5/0x250 [ 989.495873][ T8426] do_syscall_64+0xfa/0xfa0 [ 989.500401][ T8426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.506299][ T8426] [ 989.508614][ T8426] Memory state around the buggy address: [ 989.514226][ T8426] ffff8880470bff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 989.522272][ T8426] ffff8880470bff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 989.530313][ T8426] >ffff8880470c0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 989.538354][ T8426] ^ [ 989.545527][ T8426] ffff8880470c0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 989.553570][ T8426] ffff8880470c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 989.561608][ T8426] ================================================================== [ 989.573819][ T8426] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 989.581037][ T8426] CPU: 1 UID: 0 PID: 8426 Comm: syz.0.13770 Not tainted syzkaller #0 PREEMPT(full) [ 989.590760][ T8426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 989.600832][ T8426] Call Trace: [ 989.604117][ T8426] [ 989.607068][ T8426] dump_stack_lvl+0x99/0x250 [ 989.611754][ T8426] ? __asan_memcpy+0x40/0x70 [ 989.616355][ T8426] ? __pfx_dump_stack_lvl+0x10/0x10 [ 989.621588][ T8426] ? __pfx__printk+0x10/0x10 [ 989.626210][ T8426] vpanic+0x237/0x6d0 [ 989.630188][ T8426] ? __pfx_vpanic+0x10/0x10 [ 989.634677][ T8426] ? preempt_schedule_common+0x83/0xd0 [ 989.640119][ T8426] ? preempt_schedule+0xae/0xc0 [ 989.644961][ T8426] panic+0xb9/0xc0 [ 989.648677][ T8426] ? __pfx_panic+0x10/0x10 [ 989.653086][ T8426] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 989.659402][ T8426] ? qfq_reset_qdisc+0xf9/0x240 [ 989.664250][ T8426] check_panic_on_warn+0x89/0xb0 [ 989.669612][ T8426] ? qfq_reset_qdisc+0xf9/0x240 [ 989.674466][ T8426] end_report+0x78/0x160 [ 989.678695][ T8426] kasan_report+0x129/0x150 [ 989.683183][ T8426] ? qfq_reset_qdisc+0xf9/0x240 [ 989.688022][ T8426] qfq_reset_qdisc+0xf9/0x240 [ 989.692689][ T8426] ? __pfx_qfq_reset_qdisc+0x10/0x10 [ 989.697959][ T8426] qdisc_reset+0x10f/0x580 [ 989.702366][ T8426] __qdisc_destroy+0x120/0x420 [ 989.707123][ T8426] dev_shutdown+0x34c/0x440 [ 989.711620][ T8426] unregister_netdevice_many_notify+0x118c/0x2390 [ 989.718026][ T8426] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 989.724772][ T8426] ? __mod_timer+0xb37/0xf30 [ 989.729359][ T8426] ? queue_delayed_work_on+0x11a/0x280 [ 989.734809][ T8426] ? lockdep_hardirqs_on+0x9c/0x150 [ 989.740002][ T8426] unregister_netdevice_queue+0x33c/0x380 [ 989.745715][ T8426] ? __pfx_queue_delayed_work_on+0x10/0x10 [ 989.751521][ T8426] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 989.757763][ T8426] ? linkwatch_urgent_event+0x62/0x3a0 [ 989.763216][ T8426] __tun_detach+0x6d9/0x15d0 [ 989.767798][ T8426] ? __pfx_tun_chr_close+0x10/0x10 [ 989.772896][ T8426] tun_chr_close+0x10a/0x1c0 [ 989.777471][ T8426] __fput+0x44c/0xa70 [ 989.781441][ T8426] task_work_run+0x1d4/0x260 [ 989.786018][ T8426] ? __pfx_task_work_run+0x10/0x10 [ 989.791207][ T8426] ? exit_to_user_mode_loop+0x40/0x130 [ 989.796651][ T8426] exit_to_user_mode_loop+0xe9/0x130 [ 989.801923][ T8426] do_syscall_64+0x2bd/0xfa0 [ 989.806500][ T8426] ? lockdep_hardirqs_on+0x9c/0x150 [ 989.811692][ T8426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.817741][ T8426] ? clear_bhb_loop+0x60/0xb0 [ 989.822411][ T8426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 989.828285][ T8426] RIP: 0033:0x7fa73258f6c9 [ 989.832685][ T8426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 989.852283][ T8426] RSP: 002b:00007fffbcbd0908 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 989.860695][ T8426] RAX: 0000000000000000 RBX: 00007fa7327e7da0 RCX: 00007fa73258f6c9 [ 989.868663][ T8426] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 989.876624][ T8426] RBP: 00007fa7327e7da0 R08: 0000000000000000 R09: 0000000ebcbd0bff [ 989.884591][ T8426] R10: 000000000003fd70 R11: 0000000000000246 R12: 00000000000f1778 [ 989.892563][ T8426] R13: 00007fffbcbd0a00 R14: ffffffffffffffff R15: 00007fffbcbd0a20 [ 989.900540][ T8426] [ 989.903928][ T8426] Kernel Offset: disabled [ 989.908234][ T8426] Rebooting in 86400 seconds..