last executing test programs: 21.371423629s ago: executing program 2 (id=4990): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) bind$ax25(0xffffffffffffffff, &(0x7f0000000280)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @bcast, @null]}, 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf2500000000", @ANYRES32=r2, @ANYBLOB="138000002b9201002400128009000100626f6e64000000001400028008", @ANYRES16=r0], 0x44}}, 0x8000) 21.249404094s ago: executing program 2 (id=4992): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000200)=0x80000000a, 0xffffffb4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0xc, &(0x7f0000000900)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bba100000000000007010000f8ffffffb702000008000000b7030000110b0008850000007201000095b7bdc6fb97eaae467c671a1e7a6de8e407479b619f1dd4410b562190669095ba57073440e4034c8da8f3a166607db3a0297760c8ce17bb92dd1385284427f91727cd3db6e05fc74a0445f3056744674e49188ce80e9e7da01352f20508fbadfa312c6c3dc70490fda3d9b3dfb1259e87a9dd472cb2bb69ef10ea8a1f81bee2e7e3d284de390bd9979b8d5444d8e900de0d894a30973811625426c2a02402899ffea92d2427b0cbbaa74832ff364a53c1afb278633044f348b3561faa3c15a0d0a2818c0f803766ff64722d6a432df865"], &(0x7f0000000500)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@timestamp, @mss={0x2, 0x8}, @timestamp, @window={0x3, 0xe978, 0x46}, @sack_perm, @sack_perm], 0x6) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r5 = socket(0x1e, 0x5, 0x0) connect$tipc(r5, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x2}}}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001380)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d7d18db747c88f6e518f0a947ee2b49e33538afa8af92347514f0b56a20ff27fffe170d93b67f7003709494e3f1675924d13bdfb907b00bfe9a25698472cdcf93aec6a28319ec359b7631c53d400251d66a034e7d2e511c323ad1596dda2bb77e41b61f01769be0c60e995430bbb54d2faa0e33dd92671d3f84423a4c5dac5fa592ffdc4b8241f966938921f6bca54a67504e44703eea608ebdb3d6cf9df12648c31ff5c512e1be00e0fc749d6e75e35ca5e6023cdd0d7f37b20522701a759feb7968fc863cc41638dfe6236cfa5e7c976befc7d7e9a27d2196584ace1034ee6e88660fac61e4abe664cc90bab43b83a6b20aa19ddf6bf95dad7de453f8091a7c8069a30c5c7e92f7a99844bb74a5d029ed7e9a375b10d3701b486531b12429143f2e13ac4cbe09b1aa3d181c4c68679be19f12c20c4f4af9d27aa5888e4bfd8a9ea8064d0598e3020fc8d8e2abb3dc102e58843039fbacd6598a06af0b9a021906ba34ebefac553012e4cf9a50d7376150d19d13b47507ad7c3f5e93c43861abc59496ee4cbc94edf54deab6a096e8402fd17a7d3599d719dfa5dae28ed138943be946585ea4ba438a183edb091dd2aa956585141c9b7205f39f45504", 0x22d}], 0x1}, 0x20004000) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000000)) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x9, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r7, 0xfffff000, 0xe, 0x0, &(0x7f0000000100)="5c250ed6087361df712bc884fed5", 0x0, 0x2ef8, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r1, 0x18000000000002a0, 0x22, 0x0, &(0x7f0000000b80)="b9ff0300600d698cff9e14f0080005e5cdcdb6ae7d2b3593c8a4884de7f9c7645533", 0x0, 0x14, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x8800) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="310300000000000000000900000008000300", @ANYRES32=r10], 0x24}}, 0x4000) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r11, @ANYBLOB="02002abd7000fedbdf2515000000480001801400021076657468305f766c616e0000000000001400020067656e6576653000000000000000000008000300030d00001400020069300000000000000000004c000180140002e164766d72701c00000000000000000000080003000100000014000200767863616e3100000000000000000000080001000000000000", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="0800030001000005c4a7283dee79b9af3406666365de85299eb9818b521590c60072703000000000000000000000140002000800000000000000000000000000d18a5b2827ab70c81b1fa8bf326ae067105e2cd635974ac39f8d7ac1421649e78f0bcf430a2d5140a10fda7d56b8edb7323b750156892675d987b26502bb68f69d"], 0xd4}, 0x1, 0x0, 0x0, 0x800}, 0x44010) 20.624785385s ago: executing program 3 (id=4999): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="01000000000000002400128009000100626f6e640000"], 0x44}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r0}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={r2}) sendmsg(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000180)="93256970edaf21355964ad5ec5c15bea04c17879018910ab950ec98f530e770b32b2e95a15a3b7e7de465f778a809f3bd90febc825cd302ea0250e7a70a44507d52c2694089f14c34538874659931401f9076286f3c7bd9018ce589eeb20e9be959537d30fc2b9eaf61c857f32b4669a9ec1d21b6582e019f1b8dbf932b3323b0e1e575e22624b7eba4a295ef32de50df7ee34d8e3a9b9d23b1188aa35abb0125300b07d3b96b029d0", 0xa9}, {&(0x7f0000000240)="1758943a6ee46c5780a8b5994f1e3ac282a66d5a421b944fded6feca6412149d93e5f415ceae1ebd99ba28dc0126e160d6d21d5b064a02edc2e2274b86934c9c8babf87d6eed5a893a439ee065b9e3f9fe244f9df173dde0336c395c54d81d9c31f72da92264a12c7ead783a5f2feca4463687e4d7f8fa24d6794f243daee30018b491a67f035bf6f5317638978e89f027be77133e93e872f07c2a02e425173427ccb17a793c8ec446a704e74824af0cbfe521fe5bbaeec444b4816797c3a52540cf0f59e51b38540b431f101192870dbc894ace6b57dc9113364b1e58380180398491470b2513f8", 0xe8}, {&(0x7f0000000340)="618c134ce0f210f5a6caaf8619396d630077", 0x12}, {&(0x7f0000000380)="234d11d18cfd7c2171e8b0491832682c8991c22dbee665c242", 0x19}, {&(0x7f00000003c0)="26fb96dc0c2798243603c1f8c71254a1f3a65501f6da2fa9904a77d596151fc4a2dcc4d5d8cb777ee91ee1e769ff0cc895bced5e41b635683e4a8dda4a95cac58ee1735e23984911347710cd5e9a18172efd26819286e32a5ff3dbf79a4f61e902e96c20ac4aaf886d9154dc438f7d374cde127c6498b630aac36bb852091ef8f6", 0x81}, {&(0x7f0000000500)="e42bd2a7669eb29be1f02c60ef9101cb45224ad03a01f5c9903e62a7438e61e45b13900feb1d04492fdbe72798c4225b7f50e75ad52b86f98089decb7e999b1c7d1a28dcc5e8a404b7d5f1a34daaa10e83ff2e19e3c8a3f50591f28b2dc8c6efa35d647c2a439bb966869bb2d87eb074b2c22b620fe34943f3c9a5b5d36f7f16bf6adb03cb987b9d", 0x88}, {&(0x7f00000005c0)="a5fcf0e984b1dac9e16fc44d4bc65ed05d207cb6f64bdaa4c8c4a6b998a9420f2b29eca13c8c379bc9ab56ffa71ebbf70a6a9d789dc559616aadc65f5a4667c66b806efbc28be06132d0066f", 0x4c}, {&(0x7f0000000740)="c9107d894548115b9bda3fd5f905a301f500c39cd0df7c4a21188b95056da99df07a2e625e953f73f6d8df4a65f1c29f18dcd0033ce43aedab6e252cbf97b7cb2314019141a3093c812e4d22856dcd578635b76e751d2238fdf7592482b2d71fde5cc9e2505f53fa44a946915a6ac8fbbb0d052e63410f2d142e957903b089b26de43f628154157aa5af1c9eb5298eeec18e01f8fe58228045919496302bfc5054478ad187cd3ed3b8220f6b478fd3b457e816cb3370c0b8f7bc545cc4546eabe0963bc6b678", 0xc6}, {&(0x7f0000000840)}], 0x9, &(0x7f0000000b40)=ANY=[@ANYBLOB="08010000000000000100000007000000e27a0c6920fc0250a82914eab51b99e94f7d69689ff91bd6febfef335bbac640dd8e3ece8e79d5f6926c2b90b98c71c038ee0f9ffb00935444ff3acaea509deed7cc8258667d8609bcaea6adda89f89f86731e1e4fc610317bdd71febdda4915a2f4306b1330df0c99c053c65e1f30ea0a7fb65238c12e9a879f39d7d5c9dfc1c9f61fc2daf2418b7eb2078a33bc560a4336ed7f46f9b7f0d21da29107ea7527c9746d7cbdc8f01facd397722c5df8c5cd39abed36c5286ed1d4023fa7f85865bdaf92450011fe10b9639669e09940091a3e7e6c44034a89c5d08c5cb5be288e2bc2bcea5baa973cfaeb6ca5ede4886f3c4b10b910b1dcb88957a500000000"], 0x108}, 0x8040) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e23, 0x0, @empty}, 0x0, {[0x0, 0xb]}}, 0x5c) setsockopt$MRT6_FLUSH(r4, 0x29, 0xd4, &(0x7f0000000100)=0x2, 0x4) close(r3) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x8000, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xfff7fff7}], 0x1c) listen(r5, 0xfffff789) r6 = accept(r5, 0x0, 0x0) pipe(&(0x7f0000000000)) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r7, 0x0, 0x8, 0x0, 0x0) ioctl$XFS_IOC_FSGROWFSLOG(r0, 0x4008586f, &(0x7f0000000080)={0x3, 0x5}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000140)={0x0, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0xffff, 0x992f}, 0x90) r8 = socket$nl_sock_diag(0x10, 0x3, 0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000001000), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x4000) setsockopt$SO_J1939_FILTER(r2, 0x6b, 0x1, &(0x7f0000000940)=[{0x0, 0x0, {0x0, 0xf0, 0x1}, {0x1}, 0x2}, {0x2, 0x1, {0x2, 0xf0, 0x2}, {0x1, 0x1, 0x4}, 0xff, 0x1}, {0x0, 0x2, {0x2, 0x1ec, 0x1}, {0x2}, 0xfe, 0xfd}, {0x0, 0x3, {0x1, 0x1, 0x1}, {0x2, 0xff, 0x2}, 0xfd, 0xfe}], 0x80) r10 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r10, 0x84, 0x75, &(0x7f00000000c0)={0x0, 0x4}, &(0x7f0000000140)=0x8) readv(r8, &(0x7f0000000640)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0, 0xfffffe84}, {0x0}], 0x9) 20.198154001s ago: executing program 2 (id=5006): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="180000002500010324bd5f02ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r5, &(0x7f0000005140)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x98fd}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000015c0)=""/4096, 0x1000}, {&(0x7f00000025c0)=""/65, 0x41}, {&(0x7f0000002640)=""/254, 0xfe}, {&(0x7f0000000280)=""/240, 0xf0}], 0x4}, 0x101}], 0x3, 0x20, 0x0) sendmsg$nl_generic(r5, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002b40)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x4000084) recvmsg(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000580)=""/4089, 0xff9}, {&(0x7f0000000300)=""/91, 0x5b}, {&(0x7f00000001c0)=""/42, 0x2a}], 0x3}, 0x2000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000003380)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x8, [@func={0xe, 0x0, 0x0, 0xc, 0x3}, @struct={0xe, 0x6, 0x0, 0x4, 0x0, 0x3, [{0x0, 0x5, 0xaf7}, {0x5, 0xa, 0x97}, {0x9, 0x1, 0x3}, {0x4, 0x0, 0x7fffffff}, {0x6, 0x0, 0x6}, {0xa, 0x2, 0x10000}]}]}, {0x0, [0x2e, 0x71, 0x0, 0x5f, 0x5f, 0x2e]}}, &(0x7f0000003340)=""/5, 0x80, 0x5, 0x1, 0x6abb}, 0x28) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYRESOCT=r6], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x4000054) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r3, {0xa, 0x8}, {}, {0xc, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xd}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) 19.643278761s ago: executing program 3 (id=5016): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000200)=0x80000000a, 0xffffffb4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x8, 0xc, &(0x7f0000000900)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bba100000000000007010000f8ffffffb702000008000000b7030000110b0008850000007201000095b7bdc6fb97eaae467c671a1e7a6de8e407479b619f1dd4410b562190669095ba57073440e4034c8da8f3a166607db3a0297760c8ce17bb92dd1385284427f91727cd3db6e05fc74a0445f3056744674e49188ce80e9e7da01352f20508fbadfa312c6c3dc70490fda3d9b3dfb1259e87a9dd472cb2bb69ef10ea8a1f81bee2e7e3d284de390bd9979b8d5444d8e900de0d894a30973811625426c2a02402899ffea92d2427b0cbbaa74832ff364a53c1afb278633044f348b3561faa3c15a0d0a2818c0f803766ff64722d6a432df865"], &(0x7f0000000500)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000000)=[@timestamp, @mss={0x2, 0x8}, @timestamp, @window={0x3, 0xe978, 0x46}, @sack_perm, @sack_perm], 0x6) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r5 = socket(0x1e, 0x5, 0x0) connect$tipc(r5, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x2}}}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001380)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d7d18db747c88f6e518f0a947ee2b49e33538afa8af92347514f0b56a20ff27fffe170d93b67f7003709494e3f1675924d13bdfb907b00bfe9a25698472cdcf93aec6a28319ec359b7631c53d400251d66a034e7d2e511c323ad1596dda2bb77e41b61f01769be0c60e995430bbb54d2faa0e33dd92671d3f84423a4c5dac5fa592ffdc4b8241f966938921f6bca54a67504e44703eea608ebdb3d6cf9df12648c31ff5c512e1be00e0fc749d6e75e35ca5e6023cdd0d7f37b20522701a759feb7968fc863cc41638dfe6236cfa5e7c976befc7d7e9a27d2196584ace1034ee6e88660fac61e4abe664cc90bab43b83a6b20aa19ddf6bf95dad7de453f8091a7c8069a30c5c7e92f7a99844bb74a5d029ed7e9a375b10d3701b486531b12429143f2e13ac4cbe09b1aa3d181c4c68679be19f12c20c4f4af9d27aa5888e4bfd8a9ea8064d0598e3020fc8d8e2abb3dc102e58843039fbacd6598a06af0b9a021906ba34ebefac553012e4cf9a50d7376150d19d13b47507ad7c3f5e93c43861abc59496ee4cbc94edf54deab6a096e8402fd17a7d3599d719dfa5dae28ed138943be946585ea4ba438a183edb091dd2aa956585141c9b7205f39f45504", 0x22d}], 0x1}, 0x20004000) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x3}, 0x1c) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000000)) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x6, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000300000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x9, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r7, 0xfffff000, 0xe, 0x0, &(0x7f0000000100)="5c250ed6087361df712bc884fed5", 0x0, 0x2ef8, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r1, 0x18000000000002a0, 0x22, 0x0, &(0x7f0000000b80)="b9ff0300600d698cff9e14f0080005e5cdcdb6ae7d2b3593c8a4884de7f9c7645533", 0x0, 0x14, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x8800) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="310300000000000000000900000008000300", @ANYRES32=r10], 0x24}}, 0x4000) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000540)=ANY=[@ANYBLOB="d4000000", @ANYRES16=r11, @ANYBLOB="02002abd7000fedbdf2515000000480001801400021076657468305f766c616e0000000000001400020067656e6576653000000000000000000008000300030d00001400020069300000000000000000004c000180140002e164766d72701c00000000000000000000080003000100000014000200767863616e3100000000000000000000080001000000000000", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="0800030001000005c4a7283dee79b9af3406666365de85299eb9818b521590c60072703000000000000000000000140002000800000000000000000000000000d18a5b2827ab70c81b1fa8bf326ae067105e2cd635974ac39f8d7ac1421649e78f0bcf430a2d5140a10fda7d56b8edb7323b750156892675d987b26502bb68f69d"], 0xd4}, 0x1, 0x0, 0x0, 0x800}, 0x44010) 19.532916959s ago: executing program 2 (id=5020): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_256={{0x304}, "1eedc78106a0e743", "eba9f36855546014e24d7e30b50b3fde57008c99592d00", "8e8ec580", "3c3c23fff2050cf6"}, 0x38) sendto$inet6(r0, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0) close(r0) 19.390866499s ago: executing program 2 (id=5023): r0 = socket$inet6(0xa, 0x805, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r2, 0x4048587b, &(0x7f0000001a80)={{r2, &(0x7f00000018c0)='nl80211\x00', 0x50040, &(0x7f0000001900)={@align=0x200, {0x800, 0x2, 0x6, 0x67f}}, 0x3, &(0x7f0000001940), &(0x7f0000001980)=0x394}, 0x1, &(0x7f0000001a40)=[{0x2, 0x2, &(0x7f00000019c0)='ip6gre\x00', &(0x7f0000001a00)="aba63a253d5ef11a", 0x8, 0x10}]}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x70bd28, 0x25dfdbfc, {0x2, 0x20, 0x1, 0xc8, r3}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x40000c0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x58, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_OKEY={0x8, 0x5, 0x8c}, @IFLA_GRE_LOCAL={0x14, 0x6, @private1}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x58}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f00000002c0)) r4 = socket$netlink(0x10, 0x3, 0x6) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x110}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_DEFAULT_PVID={0x6, 0x27, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x48000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001240)={0xffffffffffffffff, 0x20, &(0x7f0000001200)={&(0x7f0000000040)=""/9, 0x9, 0x0, &(0x7f0000001100)=""/195, 0xc3}}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f0000001080)={0x0, r0}, 0x8) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000001380), r4) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r4, &(0x7f0000001480)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001440)={&(0x7f00000013c0)={0x54, r6, 0x8, 0x70bd27, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x5}, {0xc, 0x90, 0x30a}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000001280)={0x10, 0x4, 0x0, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10, r5}, 0x94) getsockopt$bt_hci(r0, 0x84, 0x81, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) r7 = socket$igmp(0x2, 0x3, 0x2) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001740), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001780)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_RADAR_DETECT(r2, &(0x7f0000001880)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001840)={&(0x7f00000017c0)={0x58, r8, 0x800, 0x70bd2c, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x6, 0x37}}}}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x284}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xb}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1630}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_FREQ={0x8}]}, 0x58}, 0x1, 0x0, 0x0, 0x8040}, 0x400c800) getsockopt$IPT_SO_GET_REVISION_MATCH(r7, 0x0, 0x42, &(0x7f0000001680)={'HL\x00'}, &(0x7f00000016c0)=0x1e) sendmsg$DEVLINK_CMD_GET(r4, &(0x7f0000001640)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001600)={&(0x7f0000001500)={0x100, r6, 0x2, 0x1d8, 0x25dfdbfd, {}, [@pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8}, {0x11}}, @pci={{0x8}, {0x11}}]}, 0x100}, 0x1, 0x0, 0x0, 0x695b37a09a094358}, 0x4004000) 19.26848861s ago: executing program 1 (id=5024): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0x121040, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)=0x801) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(r1) 18.650465483s ago: executing program 1 (id=5029): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4084) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r6, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) sendto$packet(r7, &(0x7f0000000480)="c1858aec1d0a21756f66b4805f3a", 0xe, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r6, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 18.592202684s ago: executing program 2 (id=5030): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, r2, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x100000000010001}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xc066}]}, 0x34}, 0x1, 0x0, 0x0, 0x20}, 0x40004) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0x70bd2b, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x17}, [@FRA_GENERIC_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004054}, 0x44004) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r4, 0x2, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x1}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x9}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x40b0) 18.551570369s ago: executing program 3 (id=5031): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x0, 0x0, 0x2, 0x9, 0x0, 0xd}, 0x2f) 18.388296051s ago: executing program 1 (id=5034): syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x5, 0x4, 0x4, 0x9, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000040)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000005c0)='%-010d \x00'}, 0x55) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000800)={r1, 0xffffffffffffffff}, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000ffff0b867b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000880)="40f05373f047010000bf7bbb7c00", 0x0, 0xbaa, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) 18.302611807s ago: executing program 3 (id=5035): r0 = socket(0x10, 0x3, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x6, 0x1}, 0x80, 0x0}}], 0x1, 0x4040004) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) sendmsg$kcm(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000022008102e0", 0x9}, {0x0}], 0x2, 0x0, 0x0, 0x10}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x3b}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x3}, 0x38) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000400)={'ip6tnl0\x00', 0x0, 0x4, 0x0, 0x18, 0x2, 0x4b, @local, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8007, 0x80, 0x4, 0xfff}}) 18.215696956s ago: executing program 1 (id=5036): socket$inet6(0xa, 0x80003, 0xff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001dc0)=@newtfilter={0x48, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0xb}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000010}, 0x20040000) 18.105829816s ago: executing program 1 (id=5038): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv4_delroute={0x1c, 0x18, 0x901, 0x70bd2c, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0x2000}, 0x0) 18.012680375s ago: executing program 3 (id=5039): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0x121040, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)=0x801) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(r1) 17.959986242s ago: executing program 1 (id=5041): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={r1, 0x0, 0x0}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$NFNL_MSG_CTHELPER_GET(r0, 0x0, 0x4000000) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000000)=0xf3f, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000040)=0x56c, 0x4) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2c, &(0x7f0000000200)={0x5, {{0xa, 0x4e20, 0x3, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xa4fffffb, @loopback}}}, 0x108) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xf, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc, 0x1}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sadb_x_sa2={0x2, 0x13, 0x3, 0x0, 0x0, 0x70bd28, 0x3503}]}, 0x78}, 0x1, 0x7}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x9, [@fwd={0x7}, @type_tag={0x7, 0x0, 0x0, 0x12, 0x1}, @func_proto={0x0, 0x0, 0x0, 0xd, 0x2}]}, {0x0, [0x30, 0x0, 0x0, 0x30, 0x0, 0x5f, 0x5f]}}, 0x0, 0x45}, 0x28) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x480c1}, 0x20008044) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000080)="09000000e700140000007e7bfbf788a83baa9900d6f18f8e950088a800dd8600", 0x20, 0x24040011, &(0x7f0000000300)={0x11, 0x8100, r9, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, 0x14) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x50f1}, 0x4040) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) r11 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR(r11, 0x114, 0x2, &(0x7f0000000740)={{&(0x7f0000000600)=""/236, 0xec}, &(0x7f0000000700)}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x2, 0x60b924, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {}, {0x6, 0xb}, {0xa, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048060}, 0x20004080) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000100)={0x0, 0xe00, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r10, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0xbf}]}}}]}, 0x40}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 17.804255379s ago: executing program 3 (id=5043): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x28, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa8}, [@ldst={0x5, 0x3, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000540)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r2, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)='y', 0x1}, {&(0x7f0000000340)="b9", 0x1}, {&(0x7f0000000940)="99", 0x1}, {&(0x7f00000008c0)='z', 0x1}, {&(0x7f00000009c0)='~', 0x1}, {&(0x7f0000000a00)='x', 0x1}, {&(0x7f0000000440)="06", 0x1}, {&(0x7f0000000580)='k', 0xffffffc6}, {&(0x7f00000006c0)="1d", 0x1}, {&(0x7f0000000800)='a', 0x1}, {&(0x7f0000000280)='$', 0x1}], 0xc}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000001040)="fc"}, {&(0x7f0000001080)="c9", 0x1}, {&(0x7f0000002180)='-', 0x1}, {&(0x7f0000002240)='R', 0x1}, {&(0x7f00000033c0)="c4", 0x1}], 0x5}}], 0x2, 0x4000000) setsockopt$sock_int(r2, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000100)) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0xf, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9f21, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x89}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = epoll_create(0x11ffffe) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f00000010c0)=@nat={'nat\x00', 0x19, 0x3, 0x472, [0x200000000b00, 0x0, 0x0, 0x200000000cae, 0x200000000f2c], 0x0, &(0x7f00000000c0), &(0x7f0000000b00)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x51, 0x88a8, 'wg0\x00', 'pim6reg1\x00', 'veth0\x00', 'ipvlan0\x00', @random="f215be810d13", [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @multicast, [0x0, 0x0, 0xff, 0x0, 0xff], 0x6e, 0xd6, 0x10e, [], [@common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffc}}, @snat={'snat\x00', 0x10, {{@remote, 0xfffffffffffffffe}}}], @snat={'snat\x00', 0x10, {{@empty, 0xfffffffffffffffe}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{0x1e, 0x20, 0x1c, 'veth1_virt_wifi\x00', 'team_slave_0\x00', 'batadv_slave_1\x00', 'batadv_slave_1\x00', @remote, [0x0, 0x0, 0x0, 0xff, 0x0, 0xff], @random="ff59a64b7303", [0x0, 0x0, 0xff, 0xff, 0xff], 0x196, 0x1ce, 0x206, [@comment={{'comment\x00', 0x0, 0x100}}], [@snat={'snat\x00', 0x10, {{@random="6ac81f9c6335", 0x2}}}], @snat={'snat\x00', 0x10, {{@local, 0x10}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x1, [{0x11, 0xd, 0x600, 'ipvlan0\x00', 'vlan0\x00', 'wlan1\x00', 'ip_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, [0xff, 0x0, 0x0, 0x0, 0x0, 0xff], @random="805f15a737ce", [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0x6e, 0x6e, 0x9e, [], [], @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x1}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff}]}, 0x4ea) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000000)={0x40000001}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r6, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, r7, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r1, &(0x7f0000000080)={0x2000a212}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000180)={r9, 0x1, 0x6}, 0x10) r10 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_int(r10, 0x101, 0x6, &(0x7f0000000040)=0x2, 0x4) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r9, 0x3, 0x6, @random="7c6a97bead69"}, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r9, {0x7, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 17.661218977s ago: executing program 4 (id=5044): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x10, 0x0, 0x0) 17.612174221s ago: executing program 4 (id=5046): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x19, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fcffffff0000000000000100850000003600000018110000", @ANYRES32=r0, @ANYBLOB], 0x0, 0x8, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xdc0, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 17.538694848s ago: executing program 4 (id=5048): socket$inet6(0xa, 0x80003, 0xff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001dc0)=@newtfilter={0x48, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0xb}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000010}, 0x20040000) 17.236405315s ago: executing program 4 (id=5051): r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x100, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x121040, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)=0x801) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(r1) 17.129661586s ago: executing program 4 (id=5053): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x121040, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(r1) 16.989024092s ago: executing program 4 (id=5056): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0xf0, &(0x7f0000000140)={&(0x7f0000000080)={0x34, r1, 0x1, 0x0, 0x3, {0x1c}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x34}, 0x1, 0x0, 0x4000}, 0x4) 15.510882158s ago: executing program 0 (id=5066): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x121040, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(r1) 15.4004341s ago: executing program 0 (id=5067): openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0x4, 0x4, 0x8}, 0x48) ioctl$TUNSETDEBUG(0xffffffffffffffff, 0x400454c9, 0xffffffffffffffff) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0xfff5}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x1}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xe0}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 15.391391869s ago: executing program 0 (id=5068): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, 0x0) 15.342192077s ago: executing program 0 (id=5069): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x19, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fcffffff0000000000000100850000003600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xdc0, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 15.252408328s ago: executing program 0 (id=5070): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv4_delroute={0x1c, 0x18, 0x901, 0x70bd2c, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0xf0ff}, 0x0) 15.25209317s ago: executing program 0 (id=5071): r0 = socket$inet6(0xa, 0x805, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x20000044) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x1c, r4, 0x9, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000011c0)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x1c, r4, 0x300, 0x70bd2a, 0x7, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x44) r6 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) r8 = socket$packet(0x11, 0x2, 0x300) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r11, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@newqdisc={0x70, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@TCA_INGRESS_BLOCK={0x0, 0xd, 0x7}]}, 0x25}}, 0x8c814) sendto$packet(r8, 0x0, 0x0, 0x830, &(0x7f0000000440)={0x11, 0x0, r11, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x14) sendmsg$key(r7, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000640)=ANY=[@ANYBLOB="020afc000700000028bd7000fe9bdf2505001a0000000000000300000000000000000000640101000000000000000000000000000a0030"], 0x38}}, 0x40408c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f00000002c0)) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@newlink={0x4c, 0x10, 0x1, 0x70bd6c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2944d}, [@IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x1000, 0xfffffffc, 0xfffffffb}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000040) 3.523424483s ago: executing program 32 (id=5030): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, r2, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x100000000010001}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xc066}]}, 0x34}, 0x1, 0x0, 0x0, 0x20}, 0x40004) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@ipv4_newrule={0x24, 0x20, 0xf4db158ec847dc81, 0x70bd2b, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x17}, [@FRA_GENERIC_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e24, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004054}, 0x44004) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r4, 0x2, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x1}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x9}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x40b0) 2.522271461s ago: executing program 33 (id=5041): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={r1, 0x0, 0x0}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$NFNL_MSG_CTHELPER_GET(r0, 0x0, 0x4000000) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000000)=0xf3f, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000040)=0x56c, 0x4) r6 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2c, &(0x7f0000000200)={0x5, {{0xa, 0x4e20, 0x3, @mcast1={0xff, 0x7}}}, {{0xa, 0x4e20, 0xa4fffffb, @loopback}}}, 0x108) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xf, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc, 0x1}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sadb_x_sa2={0x2, 0x13, 0x3, 0x0, 0x0, 0x70bd28, 0x3503}]}, 0x78}, 0x1, 0x7}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x9, [@fwd={0x7}, @type_tag={0x7, 0x0, 0x0, 0x12, 0x1}, @func_proto={0x0, 0x0, 0x0, 0xd, 0x2}]}, {0x0, [0x30, 0x0, 0x0, 0x30, 0x0, 0x5f, 0x5f]}}, 0x0, 0x45}, 0x28) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000840)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x8}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x480c1}, 0x20008044) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000080)="09000000e700140000007e7bfbf788a83baa9900d6f18f8e950088a800dd8600", 0x20, 0x24040011, &(0x7f0000000300)={0x11, 0x8100, r9, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}}, 0x14) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x50f1}, 0x4040) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) r11 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR(r11, 0x114, 0x2, &(0x7f0000000740)={{&(0x7f0000000600)=""/236, 0xec}, &(0x7f0000000700)}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x2, 0x60b924, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {}, {0x6, 0xb}, {0xa, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x4048060}, 0x20004080) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000100)={0x0, 0xe00, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r10, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0xbf}]}}}]}, 0x40}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 2.483986417s ago: executing program 34 (id=5043): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x28, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x3, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb7, 0x5, 0x0, 0x0, 0x0, 0x79, 0x10, 0xa8}, [@ldst={0x5, 0x3, 0x0, 0xa}]}, &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000540)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r2, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)='y', 0x1}, {&(0x7f0000000340)="b9", 0x1}, {&(0x7f0000000940)="99", 0x1}, {&(0x7f00000008c0)='z', 0x1}, {&(0x7f00000009c0)='~', 0x1}, {&(0x7f0000000a00)='x', 0x1}, {&(0x7f0000000440)="06", 0x1}, {&(0x7f0000000580)='k', 0xffffffc6}, {&(0x7f00000006c0)="1d", 0x1}, {&(0x7f0000000800)='a', 0x1}, {&(0x7f0000000280)='$', 0x1}], 0xc}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000001040)="fc"}, {&(0x7f0000001080)="c9", 0x1}, {&(0x7f0000002180)='-', 0x1}, {&(0x7f0000002240)='R', 0x1}, {&(0x7f00000033c0)="c4", 0x1}], 0x5}}], 0x2, 0x4000000) setsockopt$sock_int(r2, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000100)) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0xf, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9f21, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x89}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = epoll_create(0x11ffffe) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f00000010c0)=@nat={'nat\x00', 0x19, 0x3, 0x472, [0x200000000b00, 0x0, 0x0, 0x200000000cae, 0x200000000f2c], 0x0, &(0x7f00000000c0), &(0x7f0000000b00)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x11, 0x51, 0x88a8, 'wg0\x00', 'pim6reg1\x00', 'veth0\x00', 'ipvlan0\x00', @random="f215be810d13", [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @multicast, [0x0, 0x0, 0xff, 0x0, 0xff], 0x6e, 0xd6, 0x10e, [], [@common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffc}}, @snat={'snat\x00', 0x10, {{@remote, 0xfffffffffffffffe}}}], @snat={'snat\x00', 0x10, {{@empty, 0xfffffffffffffffe}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{0x1e, 0x20, 0x1c, 'veth1_virt_wifi\x00', 'team_slave_0\x00', 'batadv_slave_1\x00', 'batadv_slave_1\x00', @remote, [0x0, 0x0, 0x0, 0xff, 0x0, 0xff], @random="ff59a64b7303", [0x0, 0x0, 0xff, 0xff, 0xff], 0x196, 0x1ce, 0x206, [@comment={{'comment\x00', 0x0, 0x100}}], [@snat={'snat\x00', 0x10, {{@random="6ac81f9c6335", 0x2}}}], @snat={'snat\x00', 0x10, {{@local, 0x10}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x1, [{0x11, 0xd, 0x600, 'ipvlan0\x00', 'vlan0\x00', 'wlan1\x00', 'ip_vti0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, [0xff, 0x0, 0x0, 0x0, 0x0, 0xff], @random="805f15a737ce", [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0x6e, 0x6e, 0x9e, [], [], @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x1}}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff}]}, 0x4ea) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000000)={0x40000001}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000e00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_SCAN(r6, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000380)={0x1c, r7, 0xf21, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x48010}, 0x0) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r1, &(0x7f0000000080)={0x2000a212}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000180)={r9, 0x1, 0x6}, 0x10) r10 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_int(r10, 0x101, 0x6, &(0x7f0000000040)=0x2, 0x4) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r9, 0x3, 0x6, @random="7c6a97bead69"}, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r9, {0x7, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) 1.013890659s ago: executing program 35 (id=5056): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0xf0, &(0x7f0000000140)={&(0x7f0000000080)={0x34, r1, 0x1, 0x0, 0x3, {0x1c}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x34}, 0x1, 0x0, 0x4000}, 0x4) 0s ago: executing program 36 (id=5071): r0 = socket$inet6(0xa, 0x805, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x20000044) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000e80)={0x1c, r4, 0x9, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000011c0)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001180)={&(0x7f0000001140)={0x1c, r4, 0x300, 0x70bd2a, 0x7, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x44) r6 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) r8 = socket$packet(0x11, 0x2, 0x300) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x92}}, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32=r11, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=@newqdisc={0x70, 0x24, 0xe0b, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff1}}, [@TCA_INGRESS_BLOCK={0x0, 0xd, 0x7}]}, 0x25}}, 0x8c814) sendto$packet(r8, 0x0, 0x0, 0x830, &(0x7f0000000440)={0x11, 0x0, r11, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0x14) sendmsg$key(r7, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000640)=ANY=[@ANYBLOB="020afc000700000028bd7000fe9bdf2505001a0000000000000300000000000000000000640101000000000000000000000000000a0030"], 0x38}}, 0x40408c0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f00000002c0)) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@newlink={0x4c, 0x10, 0x1, 0x70bd6c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2944d}, [@IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x1000, 0xfffffffc, 0xfffffffb}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000040) kernel console output (not intermixed with test programs): l_action+0x43b/0xc70 [ 752.890035][T21752] ? __pfx_tc_ctl_action+0x10/0x10 [ 752.890067][T21752] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 752.890093][T21752] ? lockdep_hardirqs_on+0x7a/0x110 [ 752.890170][T21752] ? __pfx_tc_ctl_action+0x10/0x10 [ 752.890197][T21752] rtnetlink_rcv_msg+0x77e/0xbe0 [ 752.890224][T21752] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 752.890255][T21752] ? netlink_sendmsg+0x5d4/0xb40 [ 752.890289][T21752] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 752.890317][T21752] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 752.890347][T21752] ? __lock_acquire+0x6b5/0x2cf0 [ 752.890392][T21752] netlink_rcv_skb+0x232/0x4b0 [ 752.890424][T21752] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 752.890464][T21752] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 752.890510][T21752] ? netlink_deliver_tap+0x2e/0x1b0 [ 752.890541][T21752] ? netlink_deliver_tap+0x2e/0x1b0 [ 752.890578][T21752] netlink_unicast+0x75c/0x8e0 [ 752.890618][T21752] netlink_sendmsg+0x813/0xb40 [ 752.890661][T21752] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.890696][T21752] ? aa_sock_msg_perm+0xf1/0x1b0 [ 752.890734][T21752] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 752.890770][T21752] ____sys_sendmsg+0x972/0x9f0 [ 752.890803][T21752] ? __might_fault+0xaf/0x130 [ 752.890841][T21752] ? __pfx_____sys_sendmsg+0x10/0x10 [ 752.890885][T21752] ? import_iovec+0x73/0xa0 [ 752.890911][T21752] ___sys_sendmsg+0x2a5/0x360 [ 752.890943][T21752] ? __lock_acquire+0x6b5/0x2cf0 [ 752.890975][T21752] ? __pfx____sys_sendmsg+0x10/0x10 [ 752.891049][T21752] ? __fget_files+0x2a/0x420 [ 752.891076][T21752] ? __fget_files+0x3a0/0x420 [ 752.891115][T21752] __x64_sys_sendmsg+0x1bd/0x2a0 [ 752.891152][T21752] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 752.891196][T21752] ? __pfx_ksys_write+0x10/0x10 [ 752.891238][T21752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.891262][T21752] do_syscall_64+0x15f/0xf80 [ 752.891287][T21752] ? trace_irq_disable+0x3b/0x140 [ 752.891310][T21752] ? clear_bhb_loop+0x40/0x90 [ 752.891337][T21752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.891358][T21752] RIP: 0033:0x7fcab339c819 [ 752.891379][T21752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 752.891397][T21752] RSP: 002b:00007fcab41ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 752.891421][T21752] RAX: ffffffffffffffda RBX: 00007fcab3615fa0 RCX: 00007fcab339c819 [ 752.891444][T21752] RDX: 000000002400c800 RSI: 0000200000000b00 RDI: 0000000000000003 [ 752.891458][T21752] RBP: 00007fcab41ff090 R08: 0000000000000000 R09: 0000000000000000 [ 752.891471][T21752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 752.891484][T21752] R13: 00007fcab3616038 R14: 00007fcab3615fa0 R15: 00007ffc83516b18 [ 752.891519][T21752] [ 752.934782][T21747] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4241'. [ 753.176925][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 753.176958][ C1] lec:lec_tx_timeout: lec0 [ 753.404116][T21747] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4241'. [ 753.924354][T21775] ipvlan0: entered promiscuous mode [ 754.258487][T21792] netlink: 88 bytes leftover after parsing attributes in process `syz.1.4255'. [ 754.829873][T21812] lo speed is unknown, defaulting to 1000 [ 754.879812][T21819] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 754.879812][T21819] Please contact the netfilter-devel mailing list or update your nftables rules. [ 755.001272][T21825] tipc: Enabling of bearer rejected, already enabled [ 755.239443][T21837] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4271'. [ 755.251926][T21837] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4271'. [ 755.330094][T21840] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4272'. [ 755.340212][T21840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4272'. [ 755.354045][T21840] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4272'. [ 755.562569][T21845] lo speed is unknown, defaulting to 1000 [ 755.728400][T21851] FAULT_INJECTION: forcing a failure. [ 755.728400][T21851] name failslab, interval 1, probability 0, space 0, times 0 [ 755.742282][T21851] CPU: 1 UID: 0 PID: 21851 Comm: syz.0.4275 Not tainted syzkaller #0 PREEMPT(full) [ 755.742313][T21851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 755.742326][T21851] Call Trace: [ 755.742336][T21851] [ 755.742345][T21851] dump_stack_lvl+0xe8/0x150 [ 755.742384][T21851] should_fail_ex+0x412/0x560 [ 755.742421][T21851] should_failslab+0xa8/0x100 [ 755.742448][T21851] __kmalloc_cache_noprof+0x88/0x660 [ 755.742481][T21851] ? tcf_skbedit_init+0x8cf/0x1050 [ 755.742512][T21851] tcf_skbedit_init+0x8cf/0x1050 [ 755.742550][T21851] ? __pfx_tcf_skbedit_init+0x10/0x10 [ 755.742590][T21851] ? nla_memcpy+0x5b/0xc0 [ 755.742621][T21851] tcf_action_init_1+0x4ba/0x740 [ 755.742657][T21851] ? __pfx_tcf_action_init_1+0x10/0x10 [ 755.742682][T21851] ? _raw_read_unlock+0x28/0x50 [ 755.742706][T21851] ? tc_action_load_ops+0x247/0x540 [ 755.742755][T21851] ? __nla_parse+0x40/0x60 [ 755.742781][T21851] tcf_action_init+0x31e/0xb40 [ 755.742812][T21851] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 755.742840][T21851] ? __pfx_tcf_action_init+0x10/0x10 [ 755.742898][T21851] ? __pfx___nla_validate_parse+0x10/0x10 [ 755.742922][T21851] ? trace_sched_exit_tp+0x3a/0x130 [ 755.742985][T21851] tc_ctl_action+0x43b/0xc70 [ 755.743027][T21851] ? __pfx_tc_ctl_action+0x10/0x10 [ 755.743058][T21851] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 755.743084][T21851] ? lockdep_hardirqs_on+0x7a/0x110 [ 755.743159][T21851] ? __pfx_tc_ctl_action+0x10/0x10 [ 755.743187][T21851] rtnetlink_rcv_msg+0x77e/0xbe0 [ 755.743229][T21851] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 755.743258][T21851] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 755.743286][T21851] ? ref_tracker_free+0x693/0x840 [ 755.743322][T21851] ? __pfx_ref_tracker_free+0x10/0x10 [ 755.743366][T21851] netlink_rcv_skb+0x232/0x4b0 [ 755.743400][T21851] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 755.743433][T21851] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 755.743479][T21851] ? netlink_deliver_tap+0x2e/0x1b0 [ 755.743510][T21851] ? netlink_deliver_tap+0x2e/0x1b0 [ 755.743552][T21851] netlink_unicast+0x75c/0x8e0 [ 755.743594][T21851] netlink_sendmsg+0x813/0xb40 [ 755.743637][T21851] ? __pfx_netlink_sendmsg+0x10/0x10 [ 755.743674][T21851] ? aa_sock_msg_perm+0xf1/0x1b0 [ 755.743706][T21851] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 755.743744][T21851] ____sys_sendmsg+0x972/0x9f0 [ 755.743777][T21851] ? __might_fault+0xaf/0x130 [ 755.743814][T21851] ? __pfx_____sys_sendmsg+0x10/0x10 [ 755.743858][T21851] ? import_iovec+0x73/0xa0 [ 755.743885][T21851] ___sys_sendmsg+0x2a5/0x360 [ 755.743918][T21851] ? __lock_acquire+0x6b5/0x2cf0 [ 755.743971][T21851] ? __pfx____sys_sendmsg+0x10/0x10 [ 755.744045][T21851] ? __fget_files+0x2a/0x420 [ 755.744073][T21851] ? __fget_files+0x3a0/0x420 [ 755.744120][T21851] __x64_sys_sendmsg+0x1bd/0x2a0 [ 755.744157][T21851] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 755.744209][T21851] ? __pfx_ksys_write+0x10/0x10 [ 755.744253][T21851] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.744277][T21851] do_syscall_64+0x15f/0xf80 [ 755.744303][T21851] ? trace_irq_disable+0x3b/0x140 [ 755.744327][T21851] ? clear_bhb_loop+0x40/0x90 [ 755.744354][T21851] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.744376][T21851] RIP: 0033:0x7ffa0719c819 [ 755.744397][T21851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.744416][T21851] RSP: 002b:00007ffa07f97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 755.744441][T21851] RAX: ffffffffffffffda RBX: 00007ffa07415fa0 RCX: 00007ffa0719c819 [ 755.744457][T21851] RDX: 000000002400c800 RSI: 0000200000000b00 RDI: 0000000000000003 [ 755.744472][T21851] RBP: 00007ffa07f97090 R08: 0000000000000000 R09: 0000000000000000 [ 755.744486][T21851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 755.744499][T21851] R13: 00007ffa07416038 R14: 00007ffa07415fa0 R15: 00007fffd554aa08 [ 755.744534][T21851] [ 756.372817][T21857] macsec0: entered promiscuous mode [ 756.519345][T21863] netlink: 'syz.1.4278': attribute type 153 has an invalid length. [ 756.702816][T21865] bond5: Unable to set peer notification delay as MII monitoring is disabled [ 756.739123][T21865] bond5 (unregistering): Released all slaves [ 757.057311][T21888] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4283'. [ 757.111432][T21888] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 757.182045][T21888] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 757.291567][T21896] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 757.587242][T21904] tipc: Enabling of bearer rejected, failed to enable media [ 757.849038][T21913] __nla_validate_parse: 1 callbacks suppressed [ 757.849062][T21913] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4293'. [ 757.870709][T21915] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4294'. [ 757.881451][T21913] x_tables: duplicate underflow at hook 1 [ 758.003910][T21921] netlink: 'syz.1.4296': attribute type 11 has an invalid length. [ 761.159444][T21942] FAULT_INJECTION: forcing a failure. [ 761.159444][T21942] name failslab, interval 1, probability 0, space 0, times 0 [ 761.174128][T21942] CPU: 1 UID: 0 PID: 21942 Comm: syz.1.4302 Not tainted syzkaller #0 PREEMPT(full) [ 761.174157][T21942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 761.174169][T21942] Call Trace: [ 761.174178][T21942] [ 761.174188][T21942] dump_stack_lvl+0xe8/0x150 [ 761.174225][T21942] should_fail_ex+0x412/0x560 [ 761.174261][T21942] should_failslab+0xa8/0x100 [ 761.174286][T21942] __kmalloc_noprof+0xe8/0x760 [ 761.174317][T21942] ? flow_action_cookie_create+0x26/0x90 [ 761.174351][T21942] flow_action_cookie_create+0x26/0x90 [ 761.174376][T21942] ? tc_setup_action+0x1b6/0xae0 [ 761.174408][T21942] tc_setup_action+0x330/0xae0 [ 761.174459][T21942] ? __pfx_tc_setup_action+0x10/0x10 [ 761.174488][T21942] ? tcf_action_offload_add_ex+0x4fc/0x8b0 [ 761.174519][T21942] ? __local_bh_enable_ip+0xd0/0x130 [ 761.174553][T21942] tcf_action_offload_add_ex+0x5d9/0x8b0 [ 761.174595][T21942] ? __pfx_tcf_action_offload_add_ex+0x10/0x10 [ 761.174659][T21942] ? tcf_action_fill_size+0x1c/0x2e0 [ 761.174695][T21942] ? tcf_action_fill_size+0x1c/0x2e0 [ 761.174717][T21942] ? tcf_skbedit_get_fill_size+0x9/0x20 [ 761.174746][T21942] tcf_action_init+0x390/0xb40 [ 761.174781][T21942] ? __pfx_tcf_action_init+0x10/0x10 [ 761.174842][T21942] ? __pfx___nla_validate_parse+0x10/0x10 [ 761.174902][T21942] tc_ctl_action+0x43b/0xc70 [ 761.174941][T21942] ? __pfx_tc_ctl_action+0x10/0x10 [ 761.174974][T21942] ? trace_contention_end+0x3d/0x140 [ 761.175041][T21942] ? __pfx_tc_ctl_action+0x10/0x10 [ 761.175068][T21942] rtnetlink_rcv_msg+0x77e/0xbe0 [ 761.175096][T21942] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 761.175127][T21942] ? netlink_sendmsg+0x5d4/0xb40 [ 761.175161][T21942] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 761.175190][T21942] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 761.175220][T21942] ? __lock_acquire+0x6b5/0x2cf0 [ 761.175263][T21942] netlink_rcv_skb+0x232/0x4b0 [ 761.175295][T21942] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 761.175327][T21942] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 761.175371][T21942] ? netlink_deliver_tap+0x2e/0x1b0 [ 761.175401][T21942] ? netlink_deliver_tap+0x2e/0x1b0 [ 761.175438][T21942] netlink_unicast+0x75c/0x8e0 [ 761.175477][T21942] netlink_sendmsg+0x813/0xb40 [ 761.175520][T21942] ? __pfx_netlink_sendmsg+0x10/0x10 [ 761.175556][T21942] ? aa_sock_msg_perm+0xf1/0x1b0 [ 761.175588][T21942] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 761.175634][T21942] ____sys_sendmsg+0x972/0x9f0 [ 761.175668][T21942] ? __might_fault+0xaf/0x130 [ 761.175704][T21942] ? __pfx_____sys_sendmsg+0x10/0x10 [ 761.175749][T21942] ? import_iovec+0x73/0xa0 [ 761.175776][T21942] ___sys_sendmsg+0x2a5/0x360 [ 761.175808][T21942] ? __lock_acquire+0x6b5/0x2cf0 [ 761.175841][T21942] ? __pfx____sys_sendmsg+0x10/0x10 [ 761.175916][T21942] ? __fget_files+0x2a/0x420 [ 761.175943][T21942] ? __fget_files+0x3a0/0x420 [ 761.175983][T21942] __x64_sys_sendmsg+0x1bd/0x2a0 [ 761.176020][T21942] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 761.176064][T21942] ? __pfx_ksys_write+0x10/0x10 [ 761.176106][T21942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.176129][T21942] do_syscall_64+0x15f/0xf80 [ 761.176155][T21942] ? trace_irq_disable+0x3b/0x140 [ 761.176179][T21942] ? clear_bhb_loop+0x40/0x90 [ 761.176207][T21942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.176228][T21942] RIP: 0033:0x7fcab339c819 [ 761.176249][T21942] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.176268][T21942] RSP: 002b:00007fcab41ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 761.176292][T21942] RAX: ffffffffffffffda RBX: 00007fcab3615fa0 RCX: 00007fcab339c819 [ 761.176308][T21942] RDX: 000000002400c800 RSI: 0000200000000b00 RDI: 0000000000000003 [ 761.176328][T21942] RBP: 00007fcab41ff090 R08: 0000000000000000 R09: 0000000000000000 [ 761.176342][T21942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 761.176355][T21942] R13: 00007fcab3616038 R14: 00007fcab3615fa0 R15: 00007ffc83516b18 [ 761.176392][T21942] [ 761.622122][T21947] netlink: 'syz.4.4305': attribute type 1 has an invalid length. [ 761.692124][T21954] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4306'. [ 761.701249][T21954] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 761.728071][T21952] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4308'. [ 761.782884][T21952] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4308'. [ 761.799595][T21958] FAULT_INJECTION: forcing a failure. [ 761.799595][T21958] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 761.813086][T21947] bond8: entered promiscuous mode [ 761.818786][T21947] 8021q: adding VLAN 0 to HW filter on device bond8 [ 761.826903][T21958] CPU: 1 UID: 0 PID: 21958 Comm: syz.1.4309 Not tainted syzkaller #0 PREEMPT(full) [ 761.826932][T21958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 761.826946][T21958] Call Trace: [ 761.826954][T21958] [ 761.826963][T21958] dump_stack_lvl+0xe8/0x150 [ 761.826999][T21958] should_fail_ex+0x412/0x560 [ 761.827036][T21958] _copy_from_user+0x2d/0xb0 [ 761.827061][T21958] ___sys_recvmsg+0x175/0x590 [ 761.827089][T21958] ? __pfx____sys_recvmsg+0x10/0x10 [ 761.827114][T21958] ? __fget_files+0x2a/0x420 [ 761.827173][T21958] do_recvmmsg+0x334/0x800 [ 761.827204][T21958] ? __pfx_do_recvmmsg+0x10/0x10 [ 761.827236][T21958] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 761.827278][T21958] __x64_sys_recvmmsg+0x198/0x250 [ 761.827300][T21958] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 761.827330][T21958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.827354][T21958] do_syscall_64+0x15f/0xf80 [ 761.827378][T21958] ? trace_irq_disable+0x3b/0x140 [ 761.827402][T21958] ? clear_bhb_loop+0x40/0x90 [ 761.827428][T21958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 761.827449][T21958] RIP: 0033:0x7fcab339c819 [ 761.827470][T21958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.827488][T21958] RSP: 002b:00007fcab41ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 761.827520][T21958] RAX: ffffffffffffffda RBX: 00007fcab3615fa0 RCX: 00007fcab339c819 [ 761.827535][T21958] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 761.827548][T21958] RBP: 00007fcab41ff090 R08: 0000000000000000 R09: 0000000000000000 [ 761.827561][T21958] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 761.827573][T21958] R13: 00007fcab3616038 R14: 00007fcab3615fa0 R15: 00007ffc83516b18 [ 761.827604][T21958] [ 762.058683][T21959] bond8: (slave bridge4): making interface the new active one [ 762.067972][T21959] bridge4: entered promiscuous mode [ 762.074599][T21959] bond8: (slave bridge4): Enslaving as an active interface with an up link [ 762.129409][T21947] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4305'. [ 762.149384][T21955] ipvlan2: entered allmulticast mode [ 762.155268][T21955] bond8: entered allmulticast mode [ 762.160465][T21955] bridge4: entered allmulticast mode [ 762.178869][T21947] sctp: [Deprecated]: syz.4.4305 (pid 21947) Use of int in max_burst socket option. [ 762.178869][T21947] Use struct sctp_assoc_value instead [ 762.611274][T21978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4316'. [ 762.642915][T21978] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4316'. [ 762.668701][T21978] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4316'. [ 762.722137][ T8578] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 762.722309][T21978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4316'. [ 762.738263][ T8578] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 762.748882][ T8578] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 762.759513][ T8578] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 762.858354][T21982] __nla_validate_parse: 2 callbacks suppressed [ 762.858376][T21982] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4317'. [ 763.430505][T22008] FAULT_INJECTION: forcing a failure. [ 763.430505][T22008] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 763.469020][T22008] CPU: 1 UID: 0 PID: 22008 Comm: syz.2.4326 Not tainted syzkaller #0 PREEMPT(full) [ 763.469053][T22008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 763.469066][T22008] Call Trace: [ 763.469076][T22008] [ 763.469085][T22008] dump_stack_lvl+0xe8/0x150 [ 763.469124][T22008] should_fail_ex+0x412/0x560 [ 763.469161][T22008] _copy_from_user+0x2d/0xb0 [ 763.469185][T22008] ___sys_sendmsg+0x1c6/0x360 [ 763.469219][T22008] ? __lock_acquire+0x6b5/0x2cf0 [ 763.469253][T22008] ? __pfx____sys_sendmsg+0x10/0x10 [ 763.469325][T22008] ? __fget_files+0x2a/0x420 [ 763.469352][T22008] ? __fget_files+0x3a0/0x420 [ 763.469390][T22008] __x64_sys_sendmsg+0x1bd/0x2a0 [ 763.469428][T22008] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 763.469472][T22008] ? __pfx_ksys_write+0x10/0x10 [ 763.469513][T22008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.469537][T22008] do_syscall_64+0x15f/0xf80 [ 763.469563][T22008] ? trace_irq_disable+0x3b/0x140 [ 763.469586][T22008] ? clear_bhb_loop+0x40/0x90 [ 763.469614][T22008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.469635][T22008] RIP: 0033:0x7f0daf99c819 [ 763.469656][T22008] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 763.469675][T22008] RSP: 002b:00007f0dadbf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 763.469699][T22008] RAX: ffffffffffffffda RBX: 00007f0dafc15fa0 RCX: 00007f0daf99c819 [ 763.469724][T22008] RDX: 0000000000008000 RSI: 0000200000000200 RDI: 000000000000000e [ 763.469738][T22008] RBP: 00007f0dadbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 763.469752][T22008] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 763.469765][T22008] R13: 00007f0dafc16038 R14: 00007f0dafc15fa0 R15: 00007fffa4ab0438 [ 763.469801][T22008] [ 763.757461][T22005] RDS: rds_bind could not find a transport for ::ffff:10.1.1.2, load rds_tcp or rds_rdma? [ 764.086932][T22014] xt_connbytes: Forcing CT accounting to be enabled [ 764.130088][T22014] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 764.345157][T22025] x_tables: unsorted underflow at hook 4 [ 764.594749][T22040] netlink: 212 bytes leftover after parsing attributes in process `syz.1.4334'. [ 764.616546][T22034] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4332'. [ 764.657531][T22041] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4333'. [ 764.699359][T22032] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4333'. [ 764.786204][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 30 seconds [ 764.802957][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 30 seconds [ 764.814426][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 30 seconds [ 764.828671][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 30 seconds [ 764.857409][T22042] SET target dimension over the limit! [ 764.921196][T22036] delete_channel: no stack [ 764.979413][T22045] FAULT_INJECTION: forcing a failure. [ 764.979413][T22045] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 765.027165][T22045] CPU: 1 UID: 0 PID: 22045 Comm: syz.4.4335 Not tainted syzkaller #0 PREEMPT(full) [ 765.027196][T22045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 765.027211][T22045] Call Trace: [ 765.027220][T22045] [ 765.027229][T22045] dump_stack_lvl+0xe8/0x150 [ 765.027267][T22045] should_fail_ex+0x412/0x560 [ 765.027304][T22045] _copy_from_user+0x2d/0xb0 [ 765.027329][T22045] ___sys_recvmsg+0x175/0x590 [ 765.027357][T22045] ? __pfx____sys_recvmsg+0x10/0x10 [ 765.027384][T22045] ? __fget_files+0x2a/0x420 [ 765.027450][T22045] do_recvmmsg+0x334/0x800 [ 765.027488][T22045] ? __pfx_do_recvmmsg+0x10/0x10 [ 765.027522][T22045] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 765.027578][T22045] __x64_sys_recvmmsg+0x198/0x250 [ 765.027604][T22045] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 765.027639][T22045] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.027663][T22045] do_syscall_64+0x15f/0xf80 [ 765.027688][T22045] ? trace_irq_disable+0x3b/0x140 [ 765.027712][T22045] ? clear_bhb_loop+0x40/0x90 [ 765.027738][T22045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.027760][T22045] RIP: 0033:0x7fd78bb9c819 [ 765.027780][T22045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 765.027798][T22045] RSP: 002b:00007fd78cb2e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 765.027822][T22045] RAX: ffffffffffffffda RBX: 00007fd78be15fa0 RCX: 00007fd78bb9c819 [ 765.027839][T22045] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 765.027853][T22045] RBP: 00007fd78cb2e090 R08: 0000000000000000 R09: 0000000000000000 [ 765.027867][T22045] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000002 [ 765.027880][T22045] R13: 00007fd78be16038 R14: 00007fd78be15fa0 R15: 00007fff70656058 [ 765.027916][T22045] [ 765.680255][T22067] FAULT_INJECTION: forcing a failure. [ 765.680255][T22067] name failslab, interval 1, probability 0, space 0, times 0 [ 765.716846][T22067] CPU: 1 UID: 0 PID: 22067 Comm: syz.1.4343 Not tainted syzkaller #0 PREEMPT(full) [ 765.716877][T22067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 765.716890][T22067] Call Trace: [ 765.716899][T22067] [ 765.716908][T22067] dump_stack_lvl+0xe8/0x150 [ 765.716947][T22067] should_fail_ex+0x412/0x560 [ 765.716983][T22067] should_failslab+0xa8/0x100 [ 765.717009][T22067] __kvmalloc_node_noprof+0x178/0x8a0 [ 765.717030][T22067] ? nla_strdup+0xb8/0x140 [ 765.717049][T22067] ? nf_tables_newchain+0x1c7a/0x2890 [ 765.717084][T22067] nf_tables_newchain+0x1c7a/0x2890 [ 765.717126][T22067] ? __pfx_nf_tables_newchain+0x10/0x10 [ 765.717181][T22067] ? nfnl_pernet+0x23/0x240 [ 765.717211][T22067] ? nfnl_pernet+0x23/0x240 [ 765.717261][T22067] ? __nla_parse+0x40/0x60 [ 765.717292][T22067] nfnetlink_rcv+0x123e/0x27b0 [ 765.717359][T22067] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 765.717440][T22067] ? netlink_deliver_tap+0x2e/0x1b0 [ 765.717483][T22067] ? netlink_deliver_tap+0x2e/0x1b0 [ 765.717515][T22067] ? netlink_deliver_tap+0x2e/0x1b0 [ 765.717552][T22067] netlink_unicast+0x75c/0x8e0 [ 765.717593][T22067] netlink_sendmsg+0x813/0xb40 [ 765.717636][T22067] ? __pfx_netlink_sendmsg+0x10/0x10 [ 765.717672][T22067] ? aa_sock_msg_perm+0xf1/0x1b0 [ 765.717705][T22067] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 765.717741][T22067] ____sys_sendmsg+0x972/0x9f0 [ 765.717775][T22067] ? __might_fault+0xaf/0x130 [ 765.717811][T22067] ? __pfx_____sys_sendmsg+0x10/0x10 [ 765.717855][T22067] ? import_iovec+0x73/0xa0 [ 765.717880][T22067] ___sys_sendmsg+0x2a5/0x360 [ 765.717912][T22067] ? __lock_acquire+0x6b5/0x2cf0 [ 765.717945][T22067] ? __pfx____sys_sendmsg+0x10/0x10 [ 765.718019][T22067] ? __fget_files+0x2a/0x420 [ 765.718045][T22067] ? __fget_files+0x3a0/0x420 [ 765.718083][T22067] __x64_sys_sendmsg+0x1bd/0x2a0 [ 765.718119][T22067] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 765.718162][T22067] ? __pfx_ksys_write+0x10/0x10 [ 765.718227][T22067] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.718259][T22067] do_syscall_64+0x15f/0xf80 [ 765.718284][T22067] ? trace_irq_disable+0x3b/0x140 [ 765.718307][T22067] ? clear_bhb_loop+0x40/0x90 [ 765.718334][T22067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.718356][T22067] RIP: 0033:0x7fcab339c819 [ 765.718376][T22067] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 765.718395][T22067] RSP: 002b:00007fcab41ff028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 765.718419][T22067] RAX: ffffffffffffffda RBX: 00007fcab3615fa0 RCX: 00007fcab339c819 [ 765.718435][T22067] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 765.718449][T22067] RBP: 00007fcab41ff090 R08: 0000000000000000 R09: 0000000000000000 [ 765.718463][T22067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 765.718476][T22067] R13: 00007fcab3616038 R14: 00007fcab3615fa0 R15: 00007ffc83516b18 [ 765.718512][T22067] [ 766.185144][T22079] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4347'. [ 766.274126][T22082] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4346'. [ 766.311762][T22082] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4346'. [ 766.616165][T22089] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4349'. [ 767.104726][T22102] lo speed is unknown, defaulting to 1000 [ 767.123853][T22109] netlink: 'syz.2.4352': attribute type 8 has an invalid length. [ 767.243249][T22113] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4354'. [ 767.587175][T22116] lo: Caught tx_queue_len zero misconfig [ 768.162442][T22146] __nla_validate_parse: 2 callbacks suppressed [ 768.162464][T22146] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4364'. [ 768.223467][T22152] FAULT_INJECTION: forcing a failure. [ 768.223467][T22152] name failslab, interval 1, probability 0, space 0, times 0 [ 768.237690][T22152] CPU: 1 UID: 0 PID: 22152 Comm: syz.3.4367 Not tainted syzkaller #0 PREEMPT(full) [ 768.237725][T22152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 768.237738][T22152] Call Trace: [ 768.237748][T22152] [ 768.237757][T22152] dump_stack_lvl+0xe8/0x150 [ 768.237795][T22152] should_fail_ex+0x412/0x560 [ 768.237833][T22152] should_failslab+0xa8/0x100 [ 768.237858][T22152] __kmalloc_cache_noprof+0x88/0x660 [ 768.237892][T22152] ? nf_tables_newchain+0x1df0/0x2890 [ 768.237923][T22152] nf_tables_newchain+0x1df0/0x2890 [ 768.237965][T22152] ? __pfx_nf_tables_newchain+0x10/0x10 [ 768.238022][T22152] ? nfnl_pernet+0x23/0x240 [ 768.238052][T22152] ? nfnl_pernet+0x23/0x240 [ 768.238089][T22152] ? __nla_parse+0x40/0x60 [ 768.238113][T22152] nfnetlink_rcv+0x123e/0x27b0 [ 768.238190][T22152] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 768.238265][T22152] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.238306][T22152] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.238335][T22152] ? netlink_deliver_tap+0x2e/0x1b0 [ 768.238370][T22152] netlink_unicast+0x75c/0x8e0 [ 768.238409][T22152] netlink_sendmsg+0x813/0xb40 [ 768.238453][T22152] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.238489][T22152] ? aa_sock_msg_perm+0xf1/0x1b0 [ 768.238521][T22152] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 768.238558][T22152] ____sys_sendmsg+0x972/0x9f0 [ 768.238591][T22152] ? __might_fault+0xaf/0x130 [ 768.238628][T22152] ? __pfx_____sys_sendmsg+0x10/0x10 [ 768.238672][T22152] ? import_iovec+0x73/0xa0 [ 768.238698][T22152] ___sys_sendmsg+0x2a5/0x360 [ 768.238730][T22152] ? __lock_acquire+0x6b5/0x2cf0 [ 768.238764][T22152] ? __pfx____sys_sendmsg+0x10/0x10 [ 768.238836][T22152] ? __fget_files+0x2a/0x420 [ 768.238864][T22152] ? __fget_files+0x3a0/0x420 [ 768.238903][T22152] __x64_sys_sendmsg+0x1bd/0x2a0 [ 768.238940][T22152] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 768.238991][T22152] ? __pfx_ksys_write+0x10/0x10 [ 768.239033][T22152] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.239057][T22152] do_syscall_64+0x15f/0xf80 [ 768.239084][T22152] ? trace_irq_disable+0x3b/0x140 [ 768.239107][T22152] ? clear_bhb_loop+0x40/0x90 [ 768.239143][T22152] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.239165][T22152] RIP: 0033:0x7fb90579c819 [ 768.239186][T22152] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 768.239205][T22152] RSP: 002b:00007fb9039f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 768.239229][T22152] RAX: ffffffffffffffda RBX: 00007fb905a15fa0 RCX: 00007fb90579c819 [ 768.239245][T22152] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 768.239259][T22152] RBP: 00007fb9039f6090 R08: 0000000000000000 R09: 0000000000000000 [ 768.239272][T22152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 768.239285][T22152] R13: 00007fb905a16038 R14: 00007fb905a15fa0 R15: 00007ffd433f6558 [ 768.239322][T22152] [ 768.533529][T22154] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4366'. [ 768.552214][T22155] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4364'. [ 768.606928][T22153] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4366'. [ 769.276469][T22178] bond7: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 769.351244][T22178] bond7: (slave lo): Enslaving as an active interface with an up link [ 769.387945][T22178] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 769.435079][ T10] lo speed is unknown, defaulting to 1000 [ 769.442534][ T5941] lo speed is unknown, defaulting to 1000 [ 769.465804][ T5941] syz2: Port: 1 Link ACTIVE [ 769.609735][T22191] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4380'. [ 769.912267][T22204] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4383'. [ 769.941653][T22200] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4383'. [ 770.247268][T22215] FAULT_INJECTION: forcing a failure. [ 770.247268][T22215] name failslab, interval 1, probability 0, space 0, times 0 [ 770.309910][T22215] CPU: 1 UID: 0 PID: 22215 Comm: syz.3.4386 Not tainted syzkaller #0 PREEMPT(full) [ 770.309939][T22215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 770.309953][T22215] Call Trace: [ 770.309962][T22215] [ 770.309971][T22215] dump_stack_lvl+0xe8/0x150 [ 770.310007][T22215] should_fail_ex+0x412/0x560 [ 770.310041][T22215] ? __d_alloc+0x37/0x6f0 [ 770.310071][T22215] should_failslab+0xa8/0x100 [ 770.310096][T22215] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 770.310137][T22215] __d_alloc+0x37/0x6f0 [ 770.310174][T22215] path_from_stashed+0x384/0x5c0 [ 770.310214][T22215] proc_ns_get_link+0xf4/0x220 [ 770.310244][T22215] ? __pfx_proc_ns_get_link+0x10/0x10 [ 770.310278][T22215] ? atime_needs_update+0x3ac/0x6d0 [ 770.310309][T22215] ? bpf_lsm_inode_follow_link+0x9/0x20 [ 770.310343][T22215] ? __pfx_proc_ns_get_link+0x10/0x10 [ 770.310372][T22215] pick_link+0x727/0xfe0 [ 770.310413][T22215] step_into_slowpath+0x547/0x7e0 [ 770.310448][T22215] ? __pfx_step_into_slowpath+0x10/0x10 [ 770.310488][T22215] path_openat+0x22a6/0x3860 [ 770.310555][T22215] ? __pfx_path_openat+0x10/0x10 [ 770.310584][T22215] ? __x64_sys_openat+0x138/0x170 [ 770.310631][T22215] do_file_open+0x23e/0x4a0 [ 770.310669][T22215] ? __pfx_do_file_open+0x10/0x10 [ 770.310723][T22215] ? _raw_spin_unlock+0x28/0x50 [ 770.310746][T22215] ? alloc_fd+0x64b/0x6c0 [ 770.310784][T22215] do_sys_openat2+0x113/0x200 [ 770.310812][T22215] ? __pfx_do_sys_openat2+0x10/0x10 [ 770.310838][T22215] ? ksys_write+0x242/0x270 [ 770.310871][T22215] ? __pfx_ksys_write+0x10/0x10 [ 770.310915][T22215] __x64_sys_openat+0x138/0x170 [ 770.310944][T22215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.310979][T22215] do_syscall_64+0x15f/0xf80 [ 770.311005][T22215] ? trace_irq_disable+0x3b/0x140 [ 770.311028][T22215] ? clear_bhb_loop+0x40/0x90 [ 770.311054][T22215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 770.311076][T22215] RIP: 0033:0x7fb90575d04e [ 770.311100][T22215] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 770.311118][T22215] RSP: 002b:00007fb9039f5f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 770.311142][T22215] RAX: ffffffffffffffda RBX: 00007fb9039f66c0 RCX: 00007fb90575d04e [ 770.311159][T22215] RDX: 0000000000000000 RSI: 00007fb905832328 RDI: ffffffffffffff9c [ 770.311173][T22215] RBP: 00007fb9039f6090 R08: 0000000000000000 R09: 0000000000000000 [ 770.311188][T22215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 770.311200][T22215] R13: 00007fb905a16038 R14: 00007fb905a15fa0 R15: 00007ffd433f6558 [ 770.311235][T22215] [ 770.376043][T22218] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 770.619054][T22220] netlink: 7060 bytes leftover after parsing attributes in process `syz.1.4388'. [ 770.698148][T22222] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4391'. [ 770.816917][T22224] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4392'. [ 771.113977][T22239] syzkaller0: entered promiscuous mode [ 771.127445][T22239] syzkaller0: entered allmulticast mode [ 771.209882][T22242] syzkaller0: entered promiscuous mode [ 771.219227][T22242] syzkaller0: entered allmulticast mode [ 772.285264][T22271] lo speed is unknown, defaulting to 1000 [ 772.798397][T22285] syzkaller0: entered promiscuous mode [ 772.807395][T22285] syzkaller0: entered allmulticast mode [ 772.833343][T22282] wg1: left promiscuous mode [ 772.839729][T22282] wg1: left allmulticast mode [ 772.863526][T22282] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 773.041771][T22288] syzkaller0: entered promiscuous mode [ 773.048204][T22288] syzkaller0: entered allmulticast mode [ 773.320803][T22301] __nla_validate_parse: 11 callbacks suppressed [ 773.320826][T22301] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4413'. [ 774.291061][T22319] syzkaller1: tun_chr_ioctl cmd 2147767506 [ 774.535679][T22323] netlink: 7060 bytes leftover after parsing attributes in process `syz.1.4422'. [ 774.614482][T22327] syzkaller0: entered promiscuous mode [ 774.634953][T22327] syzkaller0: entered allmulticast mode [ 774.939203][T22343] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4421'. [ 774.960746][T22336] bond5: (slave bond_slave_1): Device is not our slave [ 774.976750][T22336] bond5: option active_slave: invalid value (bond_slave_1) [ 775.015190][T22336] bond5 (unregistering): Released all slaves [ 775.137413][T22354] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4421'. [ 775.346407][T22348] bond5: (slave geneve4): Enslaving as an active interface with an up link [ 775.383360][T22354] 8021q: adding VLAN 0 to HW filter on device bond5 [ 775.411489][ T57] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 20000 - 0 [ 775.440729][ T57] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 20000 - 0 [ 775.484328][T22344] syzkaller0: entered promiscuous mode [ 775.495500][T22344] syzkaller0: entered allmulticast mode [ 775.522153][ T57] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 20000 - 0 [ 775.539884][ T57] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 20000 - 0 [ 775.736473][T22347] lo speed is unknown, defaulting to 1000 [ 775.843092][T22353] lo speed is unknown, defaulting to 1000 [ 775.983919][T22364] lo speed is unknown, defaulting to 1000 [ 776.701305][T22383] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4437'. [ 776.729768][T22383] netlink: 7060 bytes leftover after parsing attributes in process `syz.1.4437'. [ 777.225397][T22394] netlink: 'syz.1.4442': attribute type 1 has an invalid length. [ 777.252970][T22394] netlink: 'syz.1.4442': attribute type 3 has an invalid length. [ 777.266685][T22394] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4442'. [ 777.827794][T22411] lo speed is unknown, defaulting to 1000 [ 778.014290][T22420] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4447'. [ 778.175626][T22419] syzkaller0: entered promiscuous mode [ 778.190628][T22419] syzkaller0: entered allmulticast mode [ 778.295181][T22426] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4450'. [ 779.365198][T22457] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4459'. [ 779.543870][T22457] netlink: 7060 bytes leftover after parsing attributes in process `syz.0.4459'. [ 779.584716][T22457] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4459'. [ 779.648053][T22463] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4462'. [ 779.648068][T22460] lo speed is unknown, defaulting to 1000 [ 779.715641][T22463] bond0: option arp_validate: invalid value (18446744072210219584) [ 779.949820][T22469] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4464'. [ 779.998210][T22469] netlink: 5 bytes leftover after parsing attributes in process `syz.0.4464'. [ 780.025337][T22469] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 780.052200][T22469] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 780.215781][T22481] lo speed is unknown, defaulting to 1000 [ 780.356319][T22487] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4463'. [ 781.032477][T22510] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4472'. [ 781.826317][T22535] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4480'. [ 781.855054][T22535] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4480'. [ 782.405809][T22562] x_tables: unsorted entry at hook 2 [ 782.411560][T22563] x_tables: unsorted entry at hook 2 [ 783.497660][T22605] sch_tbf: burst 0 is lower than device ip6tnl0 mtu (1280) ! [ 784.295778][T22640] netlink: 'syz.2.4510': attribute type 30 has an invalid length. [ 784.363156][T22640] bond2: option arp_missed_max: invalid value (0) [ 784.370263][T22640] bond2: option arp_missed_max: allowed values 1 - 255 [ 784.392140][T22640] bond2 (unregistering): Released all slaves [ 784.751925][T22648] __nla_validate_parse: 10 callbacks suppressed [ 784.751946][T22648] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4514'. [ 784.827855][T22648] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4514'. [ 785.224323][T22673] syzkaller0: refused to change device tx_queue_len [ 785.279373][T22679] bridge4: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 785.407262][T22683] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4523'. [ 785.430683][T22689] team_slave_1: Caught tx_queue_len zero misconfig [ 785.439684][T22689] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4525'. [ 785.453580][T22683] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4523'. [ 786.053566][T22719] block nbd0: NBD_DISCONNECT [ 786.064635][T22719] block nbd0: shutting down sockets [ 786.420106][T22732] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4539'. [ 786.450663][T22732] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4539'. [ 786.720630][T22752] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4543'. [ 786.756790][T22752] netlink: 5 bytes leftover after parsing attributes in process `syz.4.4543'. [ 786.790362][T22752] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 786.823653][T22752] A link change request failed with some changes committed already. Interface 31ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 786.970507][T22763] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4546'. [ 787.003868][T22769] syzkaller0: entered promiscuous mode [ 787.010222][T22769] syzkaller0: entered allmulticast mode [ 787.336766][T22785] netlink: 'syz.3.4553': attribute type 17 has an invalid length. [ 788.018464][T22807] netlink: 'syz.1.4557': attribute type 1 has an invalid length. [ 788.346938][T22813] syzkaller0: entered promiscuous mode [ 788.365048][T22813] syzkaller0: entered allmulticast mode [ 789.531025][T22850] lo speed is unknown, defaulting to 1000 [ 789.959986][T22862] syzkaller0: entered promiscuous mode [ 789.975052][T22862] syzkaller0: entered allmulticast mode [ 790.451573][T22877] __nla_validate_parse: 13 callbacks suppressed [ 790.451595][T22877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4579'. [ 790.469190][T22877] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4579'. [ 790.884022][T22891] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4583'. [ 790.919176][T22891] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4583'. [ 791.009180][T22906] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4587'. [ 791.052392][T22906] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4587'. [ 791.219574][T22911] syzkaller0: entered promiscuous mode [ 791.231756][T22911] syzkaller0: entered allmulticast mode [ 791.537686][T22923] syzkaller0: entered promiscuous mode [ 791.543317][T22923] syzkaller0: entered allmulticast mode [ 791.648583][T22919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4592'. [ 791.671725][T22919] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4592'. [ 791.927665][T22941] FAULT_INJECTION: forcing a failure. [ 791.927665][T22941] name failslab, interval 1, probability 0, space 0, times 0 [ 791.957495][T22941] CPU: 0 UID: 0 PID: 22941 Comm: syz.2.4599 Not tainted syzkaller #0 PREEMPT(full) [ 791.957525][T22941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 791.957539][T22941] Call Trace: [ 791.957548][T22941] [ 791.957557][T22941] dump_stack_lvl+0xe8/0x150 [ 791.957596][T22941] should_fail_ex+0x412/0x560 [ 791.957639][T22941] should_failslab+0xa8/0x100 [ 791.957664][T22941] __kmalloc_noprof+0xe8/0x760 [ 791.957697][T22941] ? security_sk_alloc+0x52/0x360 [ 791.957802][T22941] security_sk_alloc+0x52/0x360 [ 791.957827][T22941] sk_prot_alloc+0x101/0x210 [ 791.957858][T22941] ? sk_alloc+0x27/0x390 [ 791.957892][T22941] sk_alloc+0x3a/0x390 [ 791.957920][T22941] ? bpf_lsm_capable+0x9/0x20 [ 791.957950][T22941] llc_sk_alloc+0x32/0x440 [ 791.957980][T22941] llc_ui_create+0xe4/0x300 [ 791.958018][T22941] __sock_create+0x4b2/0x9d0 [ 791.958056][T22941] __sys_socket+0xd6/0x1b0 [ 791.958084][T22941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.958109][T22941] __x64_sys_socket+0x7a/0x90 [ 791.958137][T22941] do_syscall_64+0x15f/0xf80 [ 791.958163][T22941] ? trace_irq_disable+0x3b/0x140 [ 791.958186][T22941] ? clear_bhb_loop+0x40/0x90 [ 791.958213][T22941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.958235][T22941] RIP: 0033:0x7f0daf99c819 [ 791.958255][T22941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 791.958275][T22941] RSP: 002b:00007f0dadbf5fc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 791.958300][T22941] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f0daf99c819 [ 791.958316][T22941] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000001a [ 791.958329][T22941] RBP: 00007f0dadbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 791.958342][T22941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 791.958355][T22941] R13: 00007f0dafc16038 R14: 00007f0dafc15fa0 R15: 00007fffa4ab0438 [ 791.958391][T22941] [ 792.197252][T22937] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4597'. [ 792.230311][T22943] lo speed is unknown, defaulting to 1000 [ 792.238519][T22937] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4597'. [ 793.347865][T22996] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 793.436738][T22996] netlink: 'syz.0.4617': attribute type 153 has an invalid length. [ 793.533798][T22991] lo speed is unknown, defaulting to 1000 [ 793.869947][T23001] syzkaller0: entered promiscuous mode [ 793.888212][T23001] syzkaller0: entered allmulticast mode [ 794.628021][T23041] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.793620][T23041] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.834098][T23049] syzkaller0: entered promiscuous mode [ 794.840267][T23049] syzkaller0: entered allmulticast mode [ 794.876022][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 60 seconds [ 794.886913][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 60 seconds [ 794.897978][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 60 seconds [ 794.909616][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 60 seconds [ 795.101573][T23041] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 795.190346][T23041] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 795.318956][T23062] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 795.443162][ T12] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.472662][ T8577] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.502932][ T8577] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.539519][ T8577] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.808089][T23076] lo speed is unknown, defaulting to 1000 [ 796.054490][T23085] netlink: 'syz.1.4646': attribute type 2 has an invalid length. [ 796.467678][T23099] __nla_validate_parse: 12 callbacks suppressed [ 796.467699][T23099] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4648'. [ 796.553333][T23099] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4648'. [ 796.592695][T23104] netlink: 'syz.2.4649': attribute type 1 has an invalid length. [ 796.613484][T23104] netlink: 'syz.2.4649': attribute type 3 has an invalid length. [ 796.633007][T23104] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4649'. [ 797.843242][T23137] netlink: 'syz.3.4659': attribute type 13 has an invalid length. [ 797.898968][T23137] netlink: 'syz.3.4659': attribute type 13 has an invalid length. [ 797.940386][T23133] lo speed is unknown, defaulting to 1000 [ 798.584210][T23160] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4665'. [ 798.617885][T23160] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4665'. [ 798.898221][T23165] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4667'. [ 799.036200][T23167] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4667'. [ 799.623134][T23179] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 799.716376][T23183] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.4676'. [ 799.766432][T23183] openvswitch: netlink: Missing key (keys=40, expected=80) [ 799.880859][T23190] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 799.958677][T23190] ipt_REJECT: TCP_RESET invalid for non-tcp [ 801.249947][T23225] syzkaller0: entered promiscuous mode [ 801.290972][T23225] syzkaller0: entered allmulticast mode [ 805.485550][T23269] syzkaller0: entered promiscuous mode [ 805.498642][T23269] syzkaller0: entered allmulticast mode [ 806.450096][ T7621] lec:lec_start_xmit: lec0:No lecd attached [ 806.957845][T23338] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4726'. [ 807.017951][T23338] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4726'. [ 807.129552][T23347] FAULT_INJECTION: forcing a failure. [ 807.129552][T23347] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 807.165364][T23347] CPU: 1 UID: 0 PID: 23347 Comm: syz.4.4730 Not tainted syzkaller #0 PREEMPT(full) [ 807.165392][T23347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 807.165405][T23347] Call Trace: [ 807.165414][T23347] [ 807.165422][T23347] dump_stack_lvl+0xe8/0x150 [ 807.165460][T23347] should_fail_ex+0x412/0x560 [ 807.165509][T23347] _copy_to_user+0x31/0xb0 [ 807.165535][T23347] simple_read_from_buffer+0xe1/0x170 [ 807.165570][T23347] proc_fail_nth_read+0x1bb/0x230 [ 807.165605][T23347] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 807.165639][T23347] ? rw_verify_area+0x2a6/0x4d0 [ 807.165669][T23347] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 807.165699][T23347] vfs_read+0x20c/0xa70 [ 807.165734][T23347] ? __pfx___mutex_lock+0x10/0x10 [ 807.165763][T23347] ? __pfx_vfs_read+0x10/0x10 [ 807.165795][T23347] ? __fget_files+0x2a/0x420 [ 807.165827][T23347] ? __fget_files+0x3a0/0x420 [ 807.165853][T23347] ? __fget_files+0x2a/0x420 [ 807.165889][T23347] ksys_read+0x150/0x270 [ 807.165923][T23347] ? __pfx_ksys_read+0x10/0x10 [ 807.165964][T23347] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.165987][T23347] do_syscall_64+0x15f/0xf80 [ 807.166019][T23347] ? trace_irq_disable+0x3b/0x140 [ 807.166048][T23347] ? clear_bhb_loop+0x40/0x90 [ 807.166075][T23347] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.166096][T23347] RIP: 0033:0x7fd78bb5d04e [ 807.166117][T23347] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 807.166135][T23347] RSP: 002b:00007fd78cb0cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 807.166160][T23347] RAX: ffffffffffffffda RBX: 00007fd78cb0d6c0 RCX: 00007fd78bb5d04e [ 807.166175][T23347] RDX: 000000000000000f RSI: 00007fd78cb0d0a0 RDI: 0000000000000008 [ 807.166189][T23347] RBP: 00007fd78cb0d090 R08: 0000000000000000 R09: 0000000000000000 [ 807.166202][T23347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 807.166215][T23347] R13: 00007fd78be16128 R14: 00007fd78be16090 R15: 00007fff70656058 [ 807.166251][T23347] [ 807.724320][T23356] netlink: 'syz.4.4731': attribute type 1 has an invalid length. [ 807.756196][T23356] netlink: 'syz.4.4731': attribute type 4 has an invalid length. [ 807.776282][T23364] netlink: 'syz.4.4731': attribute type 1 has an invalid length. [ 807.787608][T23356] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.4731'. [ 807.844267][T23364] netlink: 'syz.4.4731': attribute type 4 has an invalid length. [ 807.912918][T23364] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.4731'. [ 808.044200][T23356] lo speed is unknown, defaulting to 1000 [ 809.635392][T23416] lo speed is unknown, defaulting to 1000 [ 809.791787][T23421] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4748'. [ 809.988716][T23434] FAULT_INJECTION: forcing a failure. [ 809.988716][T23434] name failslab, interval 1, probability 0, space 0, times 0 [ 810.002218][T23434] CPU: 0 UID: 0 PID: 23434 Comm: syz.4.4753 Not tainted syzkaller #0 PREEMPT(full) [ 810.002244][T23434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 810.002255][T23434] Call Trace: [ 810.002263][T23434] [ 810.002272][T23434] dump_stack_lvl+0xe8/0x150 [ 810.002304][T23434] should_fail_ex+0x412/0x560 [ 810.002335][T23434] should_failslab+0xa8/0x100 [ 810.002353][T23434] ? __anon_vma_prepare+0xcb/0x4a0 [ 810.002379][T23434] kmem_cache_alloc_noprof+0x87/0x650 [ 810.002412][T23434] __anon_vma_prepare+0xcb/0x4a0 [ 810.002443][T23434] do_wp_page+0x2e7b/0x5a00 [ 810.002473][T23434] ? __pte_offset_map+0x29/0x240 [ 810.002505][T23434] ? __pfx_do_wp_page+0x10/0x10 [ 810.002525][T23434] ? do_raw_spin_lock+0x12b/0x2f0 [ 810.002547][T23434] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 810.002575][T23434] handle_mm_fault+0x1520/0x3310 [ 810.002610][T23434] ? handle_mm_fault+0xee/0x3310 [ 810.002640][T23434] ? __pfx_handle_mm_fault+0x10/0x10 [ 810.002679][T23434] ? lock_mm_and_find_vma+0xa7/0x340 [ 810.002710][T23434] do_user_addr_fault+0x75b/0x1340 [ 810.002749][T23434] exc_page_fault+0x6a/0xc0 [ 810.002772][T23434] asm_exc_page_fault+0x26/0x30 [ 810.002790][T23434] RIP: 0010:rep_movs_alternative+0x33/0x90 [ 810.002818][T23434] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb [ 810.002833][T23434] RSP: 0018:ffffc90007397aa8 EFLAGS: 00050202 [ 810.002853][T23434] RAX: 0000000000000000 RBX: 0000000000000018 RCX: 0000000000000018 [ 810.002865][T23434] RDX: 0000000000000000 RSI: ffffc90007397b70 RDI: 0000200000000100 [ 810.002877][T23434] RBP: ffffc90007397cb0 R08: ffffc90007397b87 R09: 1ffff92000e72f70 [ 810.002891][T23434] R10: dffffc0000000000 R11: fffff52000e72f71 R12: 0000200000000118 [ 810.002904][T23434] R13: 00007ffffffff000 R14: ffffc90007397b70 R15: 0000200000000100 [ 810.002932][T23434] _copy_to_user+0x8a/0xb0 [ 810.002953][T23434] rfcomm_dev_ioctl+0xe3d/0x21d0 [ 810.002984][T23434] ? kasan_quarantine_put+0xbb/0x1f0 [ 810.003010][T23434] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 810.003046][T23434] ? tomoyo_path_number_perm+0x219/0x630 [ 810.003176][T23434] ? tomoyo_path_number_perm+0x219/0x630 [ 810.003204][T23434] ? do_vfs_ioctl+0x1166/0x1530 [ 810.003224][T23434] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 810.003247][T23434] sock_do_ioctl+0x101/0x320 [ 810.003272][T23434] ? __pfx_sock_do_ioctl+0x10/0x10 [ 810.003290][T23434] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 810.003327][T23434] sock_ioctl+0x5c6/0x7f0 [ 810.003349][T23434] ? __pfx_sock_ioctl+0x10/0x10 [ 810.003369][T23434] ? __fget_files+0x2a/0x420 [ 810.003391][T23434] ? __fget_files+0x3a0/0x420 [ 810.003413][T23434] ? __fget_files+0x2a/0x420 [ 810.003438][T23434] ? bpf_lsm_file_ioctl+0x9/0x20 [ 810.003457][T23434] ? __pfx_sock_ioctl+0x10/0x10 [ 810.003476][T23434] __se_sys_ioctl+0xfc/0x170 [ 810.003492][T23434] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 810.003511][T23434] do_syscall_64+0x15f/0xf80 [ 810.003534][T23434] ? trace_irq_disable+0x3b/0x140 [ 810.003555][T23434] ? clear_bhb_loop+0x40/0x90 [ 810.003578][T23434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 810.003595][T23434] RIP: 0033:0x7fd78bb9c819 [ 810.003611][T23434] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 810.003626][T23434] RSP: 002b:00007fd78cb2e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 810.003644][T23434] RAX: ffffffffffffffda RBX: 00007fd78be15fa0 RCX: 00007fd78bb9c819 [ 810.003656][T23434] RDX: 0000200000000100 RSI: 00000000800452d3 RDI: 0000000000000004 [ 810.003668][T23434] RBP: 00007fd78cb2e090 R08: 0000000000000000 R09: 0000000000000000 [ 810.003679][T23434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 810.003690][T23434] R13: 00007fd78be16038 R14: 00007fd78be15fa0 R15: 00007fff70656058 [ 810.003718][T23434] [ 810.752757][T23449] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4756'. [ 811.337681][T23461] netlink: 'syz.0.4759': attribute type 6 has an invalid length. [ 811.360094][T23461] netlink: 3936 bytes leftover after parsing attributes in process `syz.0.4759'. [ 811.381055][T23461] netlink: 'syz.0.4759': attribute type 1 has an invalid length. [ 811.394973][T23461] block nbd0: Unsupported socket: should be TCP or UNIX. [ 811.430282][T23463] syzkaller0: entered promiscuous mode [ 811.447915][T23463] syzkaller0: entered allmulticast mode [ 811.470719][T23463] FAULT_INJECTION: forcing a failure. [ 811.470719][T23463] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 811.514647][T23463] CPU: 1 UID: 0 PID: 23463 Comm: syz.3.4760 Not tainted syzkaller #0 PREEMPT(full) [ 811.514678][T23463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 811.514691][T23463] Call Trace: [ 811.514701][T23463] [ 811.514710][T23463] dump_stack_lvl+0xe8/0x150 [ 811.514749][T23463] should_fail_ex+0x412/0x560 [ 811.514786][T23463] _copy_from_user+0x2d/0xb0 [ 811.514833][T23463] __copy_msghdr+0x3c5/0x5b0 [ 811.514872][T23463] ___sys_sendmsg+0x213/0x360 [ 811.514905][T23463] ? __lock_acquire+0x6b5/0x2cf0 [ 811.514938][T23463] ? __pfx____sys_sendmsg+0x10/0x10 [ 811.515011][T23463] ? __fget_files+0x2a/0x420 [ 811.515038][T23463] ? __fget_files+0x3a0/0x420 [ 811.515077][T23463] __x64_sys_sendmsg+0x1bd/0x2a0 [ 811.515113][T23463] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 811.515158][T23463] ? __pfx_ksys_write+0x10/0x10 [ 811.515206][T23463] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 811.515230][T23463] do_syscall_64+0x15f/0xf80 [ 811.515257][T23463] ? trace_irq_disable+0x3b/0x140 [ 811.515280][T23463] ? clear_bhb_loop+0x40/0x90 [ 811.515307][T23463] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 811.515328][T23463] RIP: 0033:0x7fb90579c819 [ 811.515348][T23463] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 811.515367][T23463] RSP: 002b:00007fb9039f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 811.515391][T23463] RAX: ffffffffffffffda RBX: 00007fb905a15fa0 RCX: 00007fb90579c819 [ 811.515407][T23463] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000006 [ 811.515421][T23463] RBP: 00007fb9039f6090 R08: 0000000000000000 R09: 0000000000000000 [ 811.515435][T23463] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 811.515448][T23463] R13: 00007fb905a16038 R14: 00007fb905a15fa0 R15: 00007ffd433f6558 [ 811.515483][T23463] [ 811.896108][T23466] netlink: 'syz.0.4762': attribute type 1 has an invalid length. [ 811.933912][T23466] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4762'. [ 812.072704][T23474] lo speed is unknown, defaulting to 1000 [ 812.144936][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5690 ms [ 812.153064][ C1] lec:lec_tx_timeout: lec0 [ 812.157850][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 812.179811][T23482] netlink: 'syz.2.4763': attribute type 13 has an invalid length. [ 812.203857][T23482] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4763'. [ 812.265508][T23485] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4766'. [ 812.439271][T23501] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4766'. [ 812.600134][T23504] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4766'. [ 812.636652][T23485] 8021q: adding VLAN 0 to HW filter on device bond6 [ 812.873122][T23486] 8021q: adding VLAN 0 to HW filter on device bond7 [ 812.929594][T23486] bond6: (slave bond7): Enslaving as an active interface with an up link [ 813.177730][T23501] bond6 (unregistering): (slave bond7): Releasing backup interface [ 813.251750][T23501] bond6 (unregistering): Released all slaves [ 813.369044][T23488] lo speed is unknown, defaulting to 1000 [ 813.744093][T23530] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4776'. [ 813.781383][T23530] netlink: 7060 bytes leftover after parsing attributes in process `syz.3.4776'. [ 813.791565][T23530] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4776'. [ 813.971386][T23535] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4777'. [ 813.982099][T23535] netlink: 5 bytes leftover after parsing attributes in process `syz.3.4777'. [ 813.993397][T23535] 0ªî{X¹¦: renamed from 31ªî{X¹¦ (while UP) [ 814.007088][T23535] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 815.209144][T23556] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4782'. [ 815.393265][T23493] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 815.927570][T23572] lo speed is unknown, defaulting to 1000 [ 816.447172][T23584] syzkaller0: entered promiscuous mode [ 816.473513][T23584] syzkaller0: entered allmulticast mode [ 816.506036][T23584] tc action pedit offset 48 out of bounds [ 816.513484][T23584] tc action pedit offset 48 out of bounds [ 816.519343][T23584] tc action pedit offset 48 out of bounds [ 816.525166][T23584] tc action pedit offset 48 out of bounds [ 816.530935][T23584] tc action pedit offset 48 out of bounds [ 816.536808][T23584] tc action pedit offset 48 out of bounds [ 816.542579][T23584] tc action pedit offset 48 out of bounds [ 816.548421][T23584] tc action pedit offset 48 out of bounds [ 816.554190][T23584] tc action pedit offset 48 out of bounds [ 816.560094][T23584] tc action pedit offset 48 out of bounds [ 816.565924][T23584] 0: reclassify loop, rule prio 0, protocol 800 [ 817.164916][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 817.173046][ C1] lec:lec_tx_timeout: lec0 [ 817.243994][T23593] __nla_validate_parse: 1 callbacks suppressed [ 817.244015][T23593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4795'. [ 817.275905][T23593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4795'. [ 817.303003][T23593] netlink: 124 bytes leftover after parsing attributes in process `syz.1.4795'. [ 817.354617][T23598] veth0_to_bridge: left allmulticast mode [ 817.376036][T23599] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4795'. [ 817.378860][T23598] veth0_to_bridge: left promiscuous mode [ 817.418734][T23598] bridge0: port 2(veth0_to_bridge) entered disabled state [ 817.488807][T23598] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 817.550031][T23599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 817.952308][T23611] tap0: tun_chr_ioctl cmd 1074025677 [ 817.974144][T23611] tap0: linktype set to 778 [ 818.997550][T23637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4810'. [ 819.066821][T23639] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4812'. [ 819.097445][T23639] nbd: nbd2 already in use [ 819.385415][T23646] netlink: 'syz.2.4814': attribute type 14 has an invalid length. [ 819.424994][T23646] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4814'. [ 819.455265][T23651] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4816'. [ 819.875578][T23665] FAULT_INJECTION: forcing a failure. [ 819.875578][T23665] name failslab, interval 1, probability 0, space 0, times 0 [ 819.929308][T23665] CPU: 0 UID: 0 PID: 23665 Comm: syz.2.4820 Not tainted syzkaller #0 PREEMPT(full) [ 819.929344][T23665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 819.929358][T23665] Call Trace: [ 819.929367][T23665] [ 819.929376][T23665] dump_stack_lvl+0xe8/0x150 [ 819.929413][T23665] should_fail_ex+0x412/0x560 [ 819.929450][T23665] should_failslab+0xa8/0x100 [ 819.929490][T23665] ? radix_tree_node_alloc+0x7e/0x3a0 [ 819.929515][T23665] kmem_cache_alloc_noprof+0x87/0x650 [ 819.929548][T23665] ? __pfx___mutex_trylock_common+0x10/0x10 [ 819.929591][T23665] radix_tree_node_alloc+0x7e/0x3a0 [ 819.929623][T23665] idr_get_free+0x2b3/0xa70 [ 819.929661][T23665] idr_alloc_u32+0x18d/0x320 [ 819.929694][T23665] ? __pfx_idr_alloc_u32+0x10/0x10 [ 819.929728][T23665] ? tcf_idr_check_alloc+0xc8/0x7f0 [ 819.929759][T23665] tcf_idr_check_alloc+0x623/0x7f0 [ 819.929784][T23665] ? tcf_idr_check_alloc+0xc8/0x7f0 [ 819.929810][T23665] ? __pfx_tcf_idr_check_alloc+0x10/0x10 [ 819.929839][T23665] ? __nla_parse+0x40/0x60 [ 819.929866][T23665] tcf_skbedit_init+0x498/0x1050 [ 819.929905][T23665] ? __pfx_tcf_skbedit_init+0x10/0x10 [ 819.929946][T23665] ? nla_memcpy+0x5b/0xc0 [ 819.929978][T23665] tcf_action_init_1+0x4ba/0x740 [ 819.930012][T23665] ? __pfx_tcf_action_init_1+0x10/0x10 [ 819.930039][T23665] ? _raw_read_unlock+0x28/0x50 [ 819.930062][T23665] ? tc_action_load_ops+0x247/0x540 [ 819.930106][T23665] ? radix_tree_delete_item+0x2e9/0x400 [ 819.930134][T23665] ? __nla_parse+0x40/0x60 [ 819.930158][T23665] tcf_action_init+0x31e/0xb40 [ 819.930197][T23665] ? __pfx_tcf_action_init+0x10/0x10 [ 819.930256][T23665] ? __pfx___nla_validate_parse+0x10/0x10 [ 819.930336][T23665] tc_ctl_action+0x519/0xc70 [ 819.930378][T23665] ? __pfx_tc_ctl_action+0x10/0x10 [ 819.930413][T23665] ? trace_contention_end+0x3d/0x140 [ 819.930484][T23665] ? __pfx_tc_ctl_action+0x10/0x10 [ 819.930512][T23665] rtnetlink_rcv_msg+0x77e/0xbe0 [ 819.930540][T23665] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 819.930571][T23665] ? netlink_sendmsg+0x5d4/0xb40 [ 819.930605][T23665] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 819.930633][T23665] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 819.930675][T23665] ? __lock_acquire+0x6b5/0x2cf0 [ 819.930718][T23665] netlink_rcv_skb+0x232/0x4b0 [ 819.930750][T23665] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 819.930780][T23665] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 819.930824][T23665] ? netlink_deliver_tap+0x2e/0x1b0 [ 819.930854][T23665] ? netlink_deliver_tap+0x2e/0x1b0 [ 819.930890][T23665] netlink_unicast+0x75c/0x8e0 [ 819.930930][T23665] netlink_sendmsg+0x813/0xb40 [ 819.930971][T23665] ? __pfx_netlink_sendmsg+0x10/0x10 [ 819.931007][T23665] ? aa_sock_msg_perm+0xf1/0x1b0 [ 819.931039][T23665] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 819.931075][T23665] ____sys_sendmsg+0x972/0x9f0 [ 819.931107][T23665] ? __might_fault+0xaf/0x130 [ 819.931141][T23665] ? __pfx_____sys_sendmsg+0x10/0x10 [ 819.931183][T23665] ? import_iovec+0x73/0xa0 [ 819.931210][T23665] ___sys_sendmsg+0x2a5/0x360 [ 819.931241][T23665] ? __lock_acquire+0x6b5/0x2cf0 [ 819.931273][T23665] ? __pfx____sys_sendmsg+0x10/0x10 [ 819.931352][T23665] ? __fget_files+0x2a/0x420 [ 819.931378][T23665] ? __fget_files+0x3a0/0x420 [ 819.931416][T23665] __x64_sys_sendmsg+0x1bd/0x2a0 [ 819.931452][T23665] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 819.931495][T23665] ? __pfx_ksys_write+0x10/0x10 [ 819.931537][T23665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 819.931560][T23665] do_syscall_64+0x15f/0xf80 [ 819.931586][T23665] ? trace_irq_disable+0x3b/0x140 [ 819.931610][T23665] ? clear_bhb_loop+0x40/0x90 [ 819.931635][T23665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 819.931657][T23665] RIP: 0033:0x7f0daf99c819 [ 819.931678][T23665] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 819.931696][T23665] RSP: 002b:00007f0dadbf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 819.931719][T23665] RAX: ffffffffffffffda RBX: 00007f0dafc15fa0 RCX: 00007f0daf99c819 [ 819.931752][T23665] RDX: 000000002400c800 RSI: 0000200000000b00 RDI: 0000000000000003 [ 819.931767][T23665] RBP: 00007f0dadbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 819.931780][T23665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 819.931793][T23665] R13: 00007f0dafc16038 R14: 00007f0dafc15fa0 R15: 00007fffa4ab0438 [ 819.931829][T23665] [ 820.606895][T23673] macsec0: entered allmulticast mode [ 820.655455][T23673] veth1_macvtap: entered allmulticast mode [ 820.661391][T23673] macsec0: left allmulticast mode [ 820.667617][T23673] veth1_macvtap: left allmulticast mode [ 820.838711][T23686] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4829'. [ 820.840666][T23687] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4826'. [ 821.147358][T23695] syzkaller0: entered promiscuous mode [ 821.176349][T23695] syzkaller0: entered allmulticast mode [ 822.429669][T23719] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4839'. [ 822.615042][T23721] netlink: zone id is out of range [ 822.636112][T23721] netlink: zone id is out of range [ 822.667024][T23721] netlink: zone id is out of range [ 822.715033][T23721] netlink: zone id is out of range [ 822.736603][T23721] netlink: zone id is out of range [ 822.764761][T23727] netlink: 'syz.1.4843': attribute type 21 has an invalid length. [ 822.786888][T23721] netlink: zone id is out of range [ 822.826779][T23721] netlink: zone id is out of range [ 822.849137][T23721] netlink: zone id is out of range [ 822.861588][T23721] netlink: zone id is out of range [ 822.871550][T23721] netlink: zone id is out of range [ 822.982680][T23733] netlink: 'syz.4.4842': attribute type 2 has an invalid length. [ 823.011109][T23733] syzkaller0: entered promiscuous mode [ 823.026752][T23733] syzkaller0: entered allmulticast mode [ 823.054283][T23742] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4847'. [ 823.172956][T23740] netlink: 7060 bytes leftover after parsing attributes in process `syz.2.4847'. [ 823.183928][T23740] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4847'. [ 823.224419][T23746] syzkaller0: entered promiscuous mode [ 823.235755][T23746] syzkaller0: entered allmulticast mode [ 823.309432][T23750] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4851'. [ 823.757401][T23778] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4860'. [ 823.787334][T23778] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4860'. [ 823.863031][T23782] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4861'. [ 824.022114][T23782] netlink: 7060 bytes leftover after parsing attributes in process `syz.1.4861'. [ 824.075570][T23782] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4861'. [ 824.165381][T23794] ip6gre3: entered promiscuous mode [ 824.180091][T23794] ip6gre3: entered allmulticast mode [ 824.257385][T23794] netlink: 'syz.3.4863': attribute type 11 has an invalid length. [ 824.307591][T23799] syzkaller0: entered promiscuous mode [ 824.313638][T23799] syzkaller0: entered allmulticast mode [ 824.622729][T23808] netlink: 'syz.1.4868': attribute type 39 has an invalid length. [ 824.721530][T23808] bond6: (slave syz_tun): Removing an active aggregator [ 824.756921][T23808] bond6: (slave syz_tun): Releasing backup interface [ 824.824420][T23812] netlink: 'syz.4.4869': attribute type 4 has an invalid length. [ 824.976144][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 90 seconds [ 824.988023][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 90 seconds [ 824.999142][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 90 seconds [ 825.011710][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 90 seconds [ 825.145040][T23829] sctp: [Deprecated]: syz.4.4873 (pid 23829) Use of int in maxseg socket option. [ 825.145040][T23829] Use struct sctp_assoc_value instead [ 825.237160][T23829] hsr0: entered promiscuous mode [ 825.288631][T23829] hsr_slave_0: left promiscuous mode [ 825.303415][T23829] hsr_slave_1: left promiscuous mode [ 825.331620][T23829] hsr0 (unregistering): left promiscuous mode [ 826.092748][T23865] xt_HMARK: spi-set and port-set can't be combined [ 826.337693][T23879] lo speed is unknown, defaulting to 1000 [ 826.937908][T23901] bond9 (unregistering): Released all slaves [ 827.748716][T23932] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 827.785083][T23932] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 827.935372][T23935] __nla_validate_parse: 5 callbacks suppressed [ 827.935393][T23935] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4910'. [ 828.114171][T23946] netlink: 7060 bytes leftover after parsing attributes in process `syz.3.4910'. [ 828.144050][T23946] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4910'. [ 828.190125][T23932] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.248762][T23932] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 828.411326][T23932] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.429665][T23932] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 828.621253][T23932] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.633851][T23932] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 828.783224][ T57] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 828.801130][T23962] net_ratelimit: 22 callbacks suppressed [ 828.801152][T23962] netlink: zone id is out of range [ 828.802027][ T57] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 828.829768][T23962] netlink: zone id is out of range [ 828.849465][ T57] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 828.856396][T23962] netlink: zone id is out of range [ 828.868300][ T57] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 828.907836][T23962] netlink: zone id is out of range [ 828.926686][T23962] netlink: zone id is out of range [ 828.943767][T23962] netlink: zone id is out of range [ 828.949888][ T8569] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 828.966883][T23962] netlink: zone id is out of range [ 828.978723][T23962] netlink: zone id is out of range [ 828.984607][ T8569] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 828.997957][T23962] netlink: zone id is out of range [ 829.027998][ T8569] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 829.028755][T23962] netlink: zone id is out of range [ 829.064439][ T8569] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 829.681300][T23993] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4927'. [ 829.783606][T23992] netlink: 7060 bytes leftover after parsing attributes in process `syz.2.4927'. [ 829.807565][T23992] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4927'. [ 830.285272][T24010] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4933'. [ 830.589545][T24015] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4936'. [ 830.848113][T24024] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.4937'. [ 831.120542][T24032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4941'. [ 831.265389][T24042] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 831.596842][T24055] syzkaller0: entered promiscuous mode [ 831.610233][T24055] syzkaller0: entered allmulticast mode [ 832.082614][T24063] 1ªî{X¹¦: left allmulticast mode [ 832.334328][T24069] syzkaller0: entered promiscuous mode [ 832.353789][T24069] syzkaller0: entered allmulticast mode [ 832.944610][T24098] netlink: 'syz.1.4962': attribute type 11 has an invalid length. [ 833.079854][T24101] netlink: 'syz.4.4963': attribute type 13 has an invalid length. [ 833.103043][T24101] __nla_validate_parse: 2 callbacks suppressed [ 833.103067][T24101] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4963'. [ 833.760835][T24125] netlink: 'syz.1.4973': attribute type 21 has an invalid length. [ 833.769035][T24125] netlink: 'syz.1.4973': attribute type 1 has an invalid length. [ 833.784241][T24125] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4973'. [ 833.831458][T24121] syzkaller0: entered promiscuous mode [ 833.855108][T24121] syzkaller0: entered allmulticast mode [ 833.889863][T24123] lo speed is unknown, defaulting to 1000 [ 834.091939][T24129] syzkaller0: entered promiscuous mode [ 834.098318][T24129] syzkaller0: entered allmulticast mode [ 834.127558][T24135] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4976'. [ 834.145139][T24135] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4976'. [ 834.182735][T24138] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4976'. [ 834.197794][T24138] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4976'. [ 834.207473][T24138] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4976'. [ 834.216907][T24138] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4976'. [ 834.475881][T24150] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4978'. [ 834.528704][T24141] lo speed is unknown, defaulting to 1000 [ 834.552417][T24154] syzkaller0: entered promiscuous mode [ 834.563559][T24154] syzkaller0: entered allmulticast mode [ 834.683992][T24154] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4979'. [ 835.566387][T24186] syzkaller0: entered promiscuous mode [ 835.592607][T24186] syzkaller0: entered allmulticast mode [ 836.470186][T24233] pim6reg1: entered promiscuous mode [ 836.475944][T24233] pim6reg1: entered allmulticast mode [ 836.926321][T24249] syzkaller0: entered promiscuous mode [ 836.931895][T24249] syzkaller0: entered allmulticast mode [ 837.467696][T24274] netlink: 'syz.2.5023': attribute type 1 has an invalid length. [ 837.635976][T24274] bond2: entered promiscuous mode [ 837.658697][T24274] 8021q: adding VLAN 0 to HW filter on device bond2 [ 837.753041][T24281] 8021q: adding VLAN 0 to HW filter on device bond2 [ 837.786650][T24281] bond2: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 837.817616][T24281] bond2: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 837.870998][T24281] bond2: (slave ip6gre2): making interface the new active one [ 837.901770][T24281] ip6gre2: entered promiscuous mode [ 837.928090][T24281] bond2: (slave ip6gre2): Enslaving as an active interface with an up link [ 838.477424][T24318] __nla_validate_parse: 5 callbacks suppressed [ 838.477446][T24318] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5033'. [ 838.583636][T24322] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5033'. [ 838.629482][T24322] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5033'. [ 839.312112][T24364] hsr0: entered promiscuous mode [ 839.360145][T24347] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5043'. [ 839.391524][T24347] hsr_slave_0: left promiscuous mode [ 839.410246][T24347] hsr_slave_1: left promiscuous mode [ 839.433286][T24347] hsr0 (unregistering): left promiscuous mode [ 839.660189][T24379] netlink: 'syz.0.5054': attribute type 13 has an invalid length. [ 839.673567][T24379] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5054'. [ 839.683429][T24379] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 840.412076][T24404] syzkaller0: entered promiscuous mode [ 840.418099][T24404] syzkaller0: entered allmulticast mode [ 840.571670][T24406] lo speed is unknown, defaulting to 1000 [ 841.154048][T24413] netlink: 156 bytes leftover after parsing attributes in process `syz.0.5065'. [ 841.584267][T24426] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5071'. [ 844.520854][ T5192] udevd[5192]: worker [17438] /devices/virtual/block/nbd2 is taking a long time [ 853.323942][T21453] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 853.332571][T21453] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 853.343864][T21453] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 853.353810][T21453] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 853.363416][T21453] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 853.408003][T24428] lo speed is unknown, defaulting to 1000 [ 853.534525][T24428] chnl_net:caif_netlink_parms(): no params data found [ 853.617340][T24428] bridge0: port 1(bridge_slave_0) entered blocking state [ 853.624586][T24428] bridge0: port 1(bridge_slave_0) entered disabled state [ 853.632108][T24428] bridge_slave_0: entered allmulticast mode [ 853.640164][T24428] bridge_slave_0: entered promiscuous mode [ 853.648629][T24428] bridge0: port 2(bridge_slave_1) entered blocking state [ 853.656031][T24428] bridge0: port 2(bridge_slave_1) entered disabled state [ 853.663400][T24428] bridge_slave_1: entered allmulticast mode [ 853.673256][T24428] bridge_slave_1: entered promiscuous mode [ 853.706320][T24428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 853.718967][T24428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 853.753346][T24428] team0: Port device team_slave_0 added [ 853.761870][T24428] team0: Port device team_slave_1 added [ 853.790320][T24428] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 853.797878][T24428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 853.824096][T24428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 853.838766][T24428] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 853.845913][T24428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 853.872313][T24428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 853.920602][T24428] hsr_slave_0: entered promiscuous mode [ 853.927518][T24428] hsr_slave_1: entered promiscuous mode [ 853.933895][T24428] debugfs: 'hsr0' already exists in 'hsr' [ 853.940046][T24428] Cannot create hsr debugfs directory [ 854.377025][T21453] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 854.389670][T21453] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 854.398171][T21453] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 854.410705][T21453] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 854.435772][T24441] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 854.443226][T24443] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 854.461244][T24441] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 854.474496][T24441] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 854.488075][T24441] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 854.498455][T24441] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 854.565657][T24438] lo speed is unknown, defaulting to 1000 [ 854.616923][T24440] lo speed is unknown, defaulting to 1000 [ 854.805736][T24438] chnl_net:caif_netlink_parms(): no params data found [ 854.865947][T24440] chnl_net:caif_netlink_parms(): no params data found [ 854.962071][T24438] bridge0: port 1(bridge_slave_0) entered blocking state [ 854.969503][T24438] bridge0: port 1(bridge_slave_0) entered disabled state [ 854.977137][T24438] bridge_slave_0: entered allmulticast mode [ 854.984568][T24438] bridge_slave_0: entered promiscuous mode [ 855.001114][T24438] bridge0: port 2(bridge_slave_1) entered blocking state [ 855.009131][T24438] bridge0: port 2(bridge_slave_1) entered disabled state [ 855.016645][T24438] bridge_slave_1: entered allmulticast mode [ 855.024332][T24438] bridge_slave_1: entered promiscuous mode [ 855.035950][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 120 seconds [ 855.047009][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 120 seconds [ 855.058162][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 120 seconds [ 855.069266][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 120 seconds [ 855.118700][T24440] bridge0: port 1(bridge_slave_0) entered blocking state [ 855.126599][T24440] bridge0: port 1(bridge_slave_0) entered disabled state [ 855.133879][T24440] bridge_slave_0: entered allmulticast mode [ 855.141617][T24440] bridge_slave_0: entered promiscuous mode [ 855.152479][T24438] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 855.162406][T24440] bridge0: port 2(bridge_slave_1) entered blocking state [ 855.169878][T24440] bridge0: port 2(bridge_slave_1) entered disabled state [ 855.177410][T24440] bridge_slave_1: entered allmulticast mode [ 855.186164][T24440] bridge_slave_1: entered promiscuous mode [ 855.195921][T24438] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 855.253296][T24440] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 855.265369][T24438] team0: Port device team_slave_0 added [ 855.273902][T24440] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 855.285880][T24438] team0: Port device team_slave_1 added [ 855.337625][T24440] team0: Port device team_slave_0 added [ 855.344185][T24438] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 855.351468][T24438] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 855.377856][T24438] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 855.391204][T24440] team0: Port device team_slave_1 added [ 855.398306][T24438] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 855.405663][T24438] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 855.431968][T21453] Bluetooth: hci5: command tx timeout [ 855.437621][T24438] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 855.481458][T24440] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 855.488590][T24440] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 855.515260][T24440] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 855.528388][T24440] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 855.535492][T24440] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 855.561589][T24440] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 855.612518][T24438] hsr_slave_0: entered promiscuous mode [ 855.619460][T24438] hsr_slave_1: entered promiscuous mode [ 855.626497][T24438] debugfs: 'hsr0' already exists in 'hsr' [ 855.632282][T24438] Cannot create hsr debugfs directory [ 855.679843][T24440] hsr_slave_0: entered promiscuous mode [ 855.686712][T24440] hsr_slave_1: entered promiscuous mode [ 855.692939][T24440] debugfs: 'hsr0' already exists in 'hsr' [ 855.699313][T24440] Cannot create hsr debugfs directory [ 855.896337][ T5142] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 855.911938][ T5142] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 855.920654][ T5142] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 855.929304][ T5142] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 855.940754][ T5142] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 856.076261][T24457] lo speed is unknown, defaulting to 1000 [ 856.311735][T24457] chnl_net:caif_netlink_parms(): no params data found [ 856.391269][T24457] bridge0: port 1(bridge_slave_0) entered blocking state [ 856.398856][T24457] bridge0: port 1(bridge_slave_0) entered disabled state [ 856.406965][T24457] bridge_slave_0: entered allmulticast mode [ 856.414365][T24457] bridge_slave_0: entered promiscuous mode [ 856.423013][T24457] bridge0: port 2(bridge_slave_1) entered blocking state [ 856.430437][T24457] bridge0: port 2(bridge_slave_1) entered disabled state [ 856.438125][T24457] bridge_slave_1: entered allmulticast mode [ 856.445878][T24457] bridge_slave_1: entered promiscuous mode [ 856.478150][T24457] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 856.490786][T24457] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 856.524082][T24457] team0: Port device team_slave_0 added [ 856.532496][T24457] team0: Port device team_slave_1 added [ 856.545060][T21453] Bluetooth: hci6: command tx timeout [ 856.545071][ T5142] Bluetooth: hci7: command tx timeout [ 856.572943][T24457] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 856.580372][T24457] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 856.606613][T24457] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 856.619500][T24457] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 856.626875][T24457] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 856.653155][T24457] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 856.701992][T24457] hsr_slave_0: entered promiscuous mode [ 856.708791][T24457] hsr_slave_1: entered promiscuous mode [ 856.716329][T24457] debugfs: 'hsr0' already exists in 'hsr' [ 856.722518][T24457] Cannot create hsr debugfs directory [ 856.892192][ T5142] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 856.908336][ T5142] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 856.918151][ T5142] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 856.930431][ T5142] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 856.940688][ T5142] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 857.045720][T24466] lo speed is unknown, defaulting to 1000 [ 857.176790][T24466] chnl_net:caif_netlink_parms(): no params data found [ 857.262309][T24466] bridge0: port 1(bridge_slave_0) entered blocking state [ 857.269680][T24466] bridge0: port 1(bridge_slave_0) entered disabled state [ 857.277254][T24466] bridge_slave_0: entered allmulticast mode [ 857.284925][T24466] bridge_slave_0: entered promiscuous mode [ 857.293116][T24466] bridge0: port 2(bridge_slave_1) entered blocking state [ 857.300624][T24466] bridge0: port 2(bridge_slave_1) entered disabled state [ 857.308080][T24466] bridge_slave_1: entered allmulticast mode [ 857.316066][T24466] bridge_slave_1: entered promiscuous mode [ 857.347872][T24466] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 857.360306][T24466] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 857.393847][T24466] team0: Port device team_slave_0 added [ 857.402495][T24466] team0: Port device team_slave_1 added [ 857.431851][T24466] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 857.438994][T24466] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 857.465762][T24466] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 857.478214][T24466] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 857.485218][T24466] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 857.511339][T21453] Bluetooth: hci5: command tx timeout [ 857.517536][T24466] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 857.564308][T24466] hsr_slave_0: entered promiscuous mode [ 857.571000][T24466] hsr_slave_1: entered promiscuous mode [ 857.577466][T24466] debugfs: 'hsr0' already exists in 'hsr' [ 857.583231][T24466] Cannot create hsr debugfs directory [ 857.985085][T21453] Bluetooth: hci8: command tx timeout [ 858.625039][T21453] Bluetooth: hci6: command tx timeout [ 858.625417][ T5142] Bluetooth: hci7: command tx timeout [ 859.025156][T21453] Bluetooth: hci9: command tx timeout [ 859.585113][T21453] Bluetooth: hci5: command tx timeout [ 860.065110][T21453] Bluetooth: hci8: command tx timeout [ 860.705089][ T5142] Bluetooth: hci7: command tx timeout [ 860.711649][T21453] Bluetooth: hci6: command tx timeout [ 861.105106][ T5142] Bluetooth: hci9: command tx timeout [ 861.665157][ T5142] Bluetooth: hci5: command tx timeout [ 862.145149][ T5142] Bluetooth: hci8: command tx timeout [ 862.785207][ T5142] Bluetooth: hci7: command tx timeout [ 862.785217][T21453] Bluetooth: hci6: command tx timeout [ 863.185070][ T5142] Bluetooth: hci9: command tx timeout [ 864.225170][ T5142] Bluetooth: hci8: command tx timeout [ 865.265188][ T5142] Bluetooth: hci9: command tx timeout [ 869.876082][ T7621] lec:lec_start_xmit: lec0:No lecd attached [ 875.104958][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5230 ms [ 875.113040][ C1] lec:lec_tx_timeout: lec0 [ 875.117949][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 880.144931][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 880.153013][ C1] lec:lec_tx_timeout: lec0 [ 885.106962][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 150 seconds [ 885.117866][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 150 seconds [ 885.129268][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 150 seconds [ 885.140449][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 150 seconds [ 913.382267][T21453] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 913.391273][T21453] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 913.399998][T21453] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 913.411379][T21453] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 913.419954][T21453] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 913.466531][T24480] lo speed is unknown, defaulting to 1000 [ 913.598553][T24480] chnl_net:caif_netlink_parms(): no params data found [ 913.680961][T24480] bridge0: port 1(bridge_slave_0) entered blocking state [ 913.688539][T24480] bridge0: port 1(bridge_slave_0) entered disabled state [ 913.696536][T24480] bridge_slave_0: entered allmulticast mode [ 913.704023][T24480] bridge_slave_0: entered promiscuous mode [ 913.712598][T24480] bridge0: port 2(bridge_slave_1) entered blocking state [ 913.719884][T24480] bridge0: port 2(bridge_slave_1) entered disabled state [ 913.727490][T24480] bridge_slave_1: entered allmulticast mode [ 913.735112][T24480] bridge_slave_1: entered promiscuous mode [ 913.767394][T24480] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 913.781202][T24480] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 913.815099][T24480] team0: Port device team_slave_0 added [ 913.823487][T24480] team0: Port device team_slave_1 added [ 913.851518][T24480] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 913.858625][T24480] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 913.884696][T24480] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 913.897618][T24480] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 913.904607][T24480] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 913.930990][T24480] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 913.978399][T24480] hsr_slave_0: entered promiscuous mode [ 913.986189][T24480] hsr_slave_1: entered promiscuous mode [ 913.992819][T24480] debugfs: 'hsr0' already exists in 'hsr' [ 913.998904][T24480] Cannot create hsr debugfs directory [ 914.456736][T21453] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 914.477326][T21453] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 914.488983][T21453] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 914.503434][T21453] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 914.530899][T21453] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 914.591521][ T5142] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 914.607870][ T5142] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 914.618863][ T5142] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 914.628780][ T5142] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 914.637634][ T5142] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 914.732246][T24490] lo speed is unknown, defaulting to 1000 [ 914.759919][T24492] lo speed is unknown, defaulting to 1000 [ 914.988739][T24490] chnl_net:caif_netlink_parms(): no params data found [ 915.057942][T24492] chnl_net:caif_netlink_parms(): no params data found [ 915.143440][T24490] bridge0: port 1(bridge_slave_0) entered blocking state [ 915.151014][T24490] bridge0: port 1(bridge_slave_0) entered disabled state [ 915.158613][T24490] bridge_slave_0: entered allmulticast mode [ 915.167482][T24490] bridge_slave_0: entered promiscuous mode [ 915.182326][T24490] bridge0: port 2(bridge_slave_1) entered blocking state [ 915.189882][T24490] bridge0: port 2(bridge_slave_1) entered disabled state [ 915.197492][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 180 seconds [ 915.208517][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 180 seconds [ 915.213886][T24490] bridge_slave_1: entered allmulticast mode [ 915.219650][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 180 seconds [ 915.219716][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 180 seconds [ 915.250370][T24490] bridge_slave_1: entered promiscuous mode [ 915.303006][T24490] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 915.326857][T24490] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 915.336558][T24492] bridge0: port 1(bridge_slave_0) entered blocking state [ 915.343903][T24492] bridge0: port 1(bridge_slave_0) entered disabled state [ 915.351700][T24492] bridge_slave_0: entered allmulticast mode [ 915.360130][T24492] bridge_slave_0: entered promiscuous mode [ 915.380065][T24492] bridge0: port 2(bridge_slave_1) entered blocking state [ 915.387610][T24492] bridge0: port 2(bridge_slave_1) entered disabled state [ 915.395200][T24492] bridge_slave_1: entered allmulticast mode [ 915.402753][T24492] bridge_slave_1: entered promiscuous mode [ 915.435255][T24490] team0: Port device team_slave_0 added [ 915.456049][T24490] team0: Port device team_slave_1 added [ 915.466493][T24492] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 915.490023][T24492] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 915.505575][T21453] Bluetooth: hci10: command tx timeout [ 915.528763][T24490] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 915.536130][T24490] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.562237][T24490] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 915.588358][T24492] team0: Port device team_slave_0 added [ 915.595239][T24490] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 915.602227][T24490] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.628763][T24490] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 915.642515][T24492] team0: Port device team_slave_1 added [ 915.680541][T24492] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 915.687665][T24492] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.713692][T24492] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 915.738989][T24492] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 915.746383][T24492] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 915.772853][T24492] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 915.827960][T24490] hsr_slave_0: entered promiscuous mode [ 915.836632][T24490] hsr_slave_1: entered promiscuous mode [ 915.843307][T24490] debugfs: 'hsr0' already exists in 'hsr' [ 915.849369][T24490] Cannot create hsr debugfs directory [ 915.922731][T24492] hsr_slave_0: entered promiscuous mode [ 915.930240][T24492] hsr_slave_1: entered promiscuous mode [ 915.937457][T24492] debugfs: 'hsr0' already exists in 'hsr' [ 915.943263][T24492] Cannot create hsr debugfs directory [ 915.980719][ T5142] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 915.992847][ T5142] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 916.003560][ T5142] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 916.011940][ T5142] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 916.020742][ T5142] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 916.192985][T24508] lo speed is unknown, defaulting to 1000 [ 916.432868][T24508] chnl_net:caif_netlink_parms(): no params data found [ 916.542296][T24508] bridge0: port 1(bridge_slave_0) entered blocking state [ 916.550150][T24508] bridge0: port 1(bridge_slave_0) entered disabled state [ 916.558145][T24508] bridge_slave_0: entered allmulticast mode [ 916.566559][T24508] bridge_slave_0: entered promiscuous mode [ 916.575728][T24508] bridge0: port 2(bridge_slave_1) entered blocking state [ 916.582954][T24508] bridge0: port 2(bridge_slave_1) entered disabled state [ 916.590385][T24508] bridge_slave_1: entered allmulticast mode [ 916.598412][T24508] bridge_slave_1: entered promiscuous mode [ 916.635572][T21453] Bluetooth: hci11: command tx timeout [ 916.657852][T24508] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 916.670641][T24508] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 916.704992][T21453] Bluetooth: hci12: command tx timeout [ 916.715167][T24508] team0: Port device team_slave_0 added [ 916.739337][T24508] team0: Port device team_slave_1 added [ 916.766886][T24508] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 916.773876][T24508] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 916.811126][T24508] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 916.842261][T24508] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 916.849585][T24508] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 916.878586][T24508] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 916.991926][T24508] hsr_slave_0: entered promiscuous mode [ 917.002438][T24508] hsr_slave_1: entered promiscuous mode [ 917.011670][T24508] debugfs: 'hsr0' already exists in 'hsr' [ 917.018020][T24508] Cannot create hsr debugfs directory [ 917.043076][ T5142] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 917.056388][ T5142] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 917.072401][ T5142] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 917.084967][ T5142] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 917.096755][ T5142] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 917.277907][T24517] lo speed is unknown, defaulting to 1000 [ 917.546734][T24517] chnl_net:caif_netlink_parms(): no params data found [ 917.585748][T21453] Bluetooth: hci10: command tx timeout [ 917.679651][T24517] bridge0: port 1(bridge_slave_0) entered blocking state [ 917.687121][T24517] bridge0: port 1(bridge_slave_0) entered disabled state [ 917.694508][T24517] bridge_slave_0: entered allmulticast mode [ 917.703864][T24517] bridge_slave_0: entered promiscuous mode [ 917.715959][T24517] bridge0: port 2(bridge_slave_1) entered blocking state [ 917.723364][T24517] bridge0: port 2(bridge_slave_1) entered disabled state [ 917.730899][T24517] bridge_slave_1: entered allmulticast mode [ 917.738666][T24517] bridge_slave_1: entered promiscuous mode [ 917.781919][T24517] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 917.795209][T24517] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 917.855984][T24517] team0: Port device team_slave_0 added [ 917.865749][T24517] team0: Port device team_slave_1 added [ 917.909645][T24517] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 917.916954][T24517] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 917.943534][T24517] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 917.959226][T24517] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 917.966573][T24517] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 917.993189][T24517] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 918.065600][T21453] Bluetooth: hci13: command tx timeout [ 918.080662][T24517] hsr_slave_0: entered promiscuous mode [ 918.087794][T24517] hsr_slave_1: entered promiscuous mode [ 918.094191][T24517] debugfs: 'hsr0' already exists in 'hsr' [ 918.100211][T24517] Cannot create hsr debugfs directory [ 918.706178][T21453] Bluetooth: hci11: command tx timeout [ 918.785069][T21453] Bluetooth: hci12: command tx timeout [ 919.185327][T21453] Bluetooth: hci14: command tx timeout [ 919.665151][T21453] Bluetooth: hci10: command tx timeout [ 920.145108][T21453] Bluetooth: hci13: command tx timeout [ 920.785060][T21453] Bluetooth: hci11: command tx timeout [ 920.864999][T21453] Bluetooth: hci12: command tx timeout [ 921.266096][T21453] Bluetooth: hci14: command tx timeout [ 921.540219][ T5192] udevd[5192]: worker [17438] /devices/virtual/block/nbd2 timeout; kill it [ 921.549035][ T5192] udevd[5192]: seq 30628 '/devices/virtual/block/nbd2' killed [ 921.745157][T21453] Bluetooth: hci10: command tx timeout [ 922.225049][T21453] Bluetooth: hci13: command tx timeout [ 922.865043][T21453] Bluetooth: hci11: command tx timeout [ 922.944985][T21453] Bluetooth: hci12: command tx timeout [ 923.355601][T21453] Bluetooth: hci14: command tx timeout [ 924.305029][T21453] Bluetooth: hci13: command tx timeout [ 925.425541][T21453] Bluetooth: hci14: command tx timeout [ 931.831603][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 937.104976][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5270 ms [ 937.113029][ C1] lec:lec_tx_timeout: lec0 [ 937.118002][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 942.145073][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 942.153136][ C1] lec:lec_tx_timeout: lec0 [ 945.265435][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 210 seconds [ 945.276601][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 210 seconds [ 945.288767][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 210 seconds [ 945.299928][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 210 seconds [ 973.454705][ T5142] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 973.464453][ T5142] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 973.475634][ T5142] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 973.483871][ T5142] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 973.495727][ T5142] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 973.538931][T24531] lo speed is unknown, defaulting to 1000 [ 973.670891][T24531] chnl_net:caif_netlink_parms(): no params data found [ 973.757473][T24531] bridge0: port 1(bridge_slave_0) entered blocking state [ 973.764703][T24531] bridge0: port 1(bridge_slave_0) entered disabled state [ 973.772575][T24531] bridge_slave_0: entered allmulticast mode [ 973.780379][T24531] bridge_slave_0: entered promiscuous mode [ 973.789053][T24531] bridge0: port 2(bridge_slave_1) entered blocking state [ 973.796479][T24531] bridge0: port 2(bridge_slave_1) entered disabled state [ 973.803848][T24531] bridge_slave_1: entered allmulticast mode [ 973.812161][T24531] bridge_slave_1: entered promiscuous mode [ 973.846112][T24531] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 973.858900][T24531] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 973.892565][T24531] team0: Port device team_slave_0 added [ 973.901131][T24531] team0: Port device team_slave_1 added [ 973.929975][T24531] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 973.937621][T24531] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 973.963755][T24531] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 973.976587][T24531] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 973.983558][T24531] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 974.009718][T24531] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 974.056910][T24531] hsr_slave_0: entered promiscuous mode [ 974.064214][T24531] hsr_slave_1: entered promiscuous mode [ 974.071324][T24531] debugfs: 'hsr0' already exists in 'hsr' [ 974.077232][T24531] Cannot create hsr debugfs directory [ 975.001912][T21453] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1 [ 975.018506][T21453] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9 [ 975.031173][T21453] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9 [ 975.044302][T21453] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4 [ 975.052714][T21453] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2 [ 975.073241][T21453] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1 [ 975.091878][T21453] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9 [ 975.101946][T21453] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9 [ 975.117380][ T50] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4 [ 975.135659][T21453] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2 [ 975.169163][T24541] lo speed is unknown, defaulting to 1000 [ 975.228796][T24543] lo speed is unknown, defaulting to 1000 [ 975.352744][ T1600] block nbd2: Possible stuck request ffff888026d35080: control (read@0,1024B). Runtime 240 seconds [ 975.364146][ T1600] block nbd2: Possible stuck request ffff888026d35240: control (read@1024,1024B). Runtime 240 seconds [ 975.375664][ T1600] block nbd2: Possible stuck request ffff888026d35400: control (read@2048,1024B). Runtime 240 seconds [ 975.386738][ T1600] block nbd2: Possible stuck request ffff888026d355c0: control (read@3072,1024B). Runtime 240 seconds [ 975.464268][T24541] chnl_net:caif_netlink_parms(): no params data found [ 975.532069][T24543] chnl_net:caif_netlink_parms(): no params data found [ 975.587150][T21453] Bluetooth: hci15: command tx timeout [ 975.634449][T24541] bridge0: port 1(bridge_slave_0) entered blocking state [ 975.641868][T24541] bridge0: port 1(bridge_slave_0) entered disabled state [ 975.649626][T24541] bridge_slave_0: entered allmulticast mode [ 975.657395][T24541] bridge_slave_0: entered promiscuous mode [ 975.673816][T24541] bridge0: port 2(bridge_slave_1) entered blocking state [ 975.681175][T24541] bridge0: port 2(bridge_slave_1) entered disabled state [ 975.688937][T24541] bridge_slave_1: entered allmulticast mode [ 975.696753][T24541] bridge_slave_1: entered promiscuous mode [ 975.755167][T24541] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 975.764615][T24543] bridge0: port 1(bridge_slave_0) entered blocking state [ 975.772029][T24543] bridge0: port 1(bridge_slave_0) entered disabled state [ 975.779760][T24543] bridge_slave_0: entered allmulticast mode [ 975.787828][T24543] bridge_slave_0: entered promiscuous mode [ 975.798408][T24541] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 975.808123][T24543] bridge0: port 2(bridge_slave_1) entered blocking state [ 975.815466][T24543] bridge0: port 2(bridge_slave_1) entered disabled state [ 975.823024][T24543] bridge_slave_1: entered allmulticast mode [ 975.831228][T24543] bridge_slave_1: entered promiscuous mode [ 975.914194][T24543] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 975.929522][T24541] team0: Port device team_slave_0 added [ 975.942113][T24543] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 975.975927][T24541] team0: Port device team_slave_1 added [ 976.019302][T24441] Bluetooth: hci18: unexpected cc 0x0c03 length: 249 > 1 [ 976.039120][T24441] Bluetooth: hci18: unexpected cc 0x1003 length: 249 > 9 [ 976.049620][T24441] Bluetooth: hci18: unexpected cc 0x1001 length: 249 > 9 [ 976.059180][T24543] team0: Port device team_slave_0 added [ 976.066034][T24541] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 976.073395][T24441] Bluetooth: hci18: unexpected cc 0x0c23 length: 249 > 4 [ 976.081188][T24541] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 976.108044][T24541] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 976.120928][T24441] Bluetooth: hci18: unexpected cc 0x0c38 length: 249 > 2 [ 976.131465][T24543] team0: Port device team_slave_1 added [ 976.148833][T24541] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 976.156294][T24541] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 976.186320][T24541] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 976.236978][T24543] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 976.244160][T24543] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 976.270501][T24543] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 976.294171][T24543] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 976.301600][T24543] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 976.328227][T24543] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 976.373201][T24541] hsr_slave_0: entered promiscuous mode [ 976.381017][T24541] hsr_slave_1: entered promiscuous mode [ 976.389064][T24541] debugfs: 'hsr0' already exists in 'hsr' [ 976.395475][T24541] Cannot create hsr debugfs directory [ 976.448384][T24558] lo speed is unknown, defaulting to 1000 [ 976.469329][T24543] hsr_slave_0: entered promiscuous mode [ 976.476469][T24543] hsr_slave_1: entered promiscuous mode [ 976.482874][T24543] debugfs: 'hsr0' already exists in 'hsr' [ 976.488856][T24543] Cannot create hsr debugfs directory [ 976.881187][T24558] chnl_net:caif_netlink_parms(): no params data found [ 976.984464][T24558] bridge0: port 1(bridge_slave_0) entered blocking state [ 976.991781][T24558] bridge0: port 1(bridge_slave_0) entered disabled state [ 976.999882][T24558] bridge_slave_0: entered allmulticast mode [ 977.009902][T24558] bridge_slave_0: entered promiscuous mode [ 977.019597][T24558] bridge0: port 2(bridge_slave_1) entered blocking state [ 977.027487][T24558] bridge0: port 2(bridge_slave_1) entered disabled state [ 977.035161][T24558] bridge_slave_1: entered allmulticast mode [ 977.042721][T24558] bridge_slave_1: entered promiscuous mode [ 977.084670][T24558] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 977.098516][T24558] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 977.115969][T21453] Bluetooth: hci16: command tx timeout [ 977.150326][T24558] team0: Port device team_slave_0 added [ 977.159319][T24558] team0: Port device team_slave_1 added [ 977.185146][T21453] Bluetooth: hci17: command tx timeout [ 977.212892][T24558] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 977.221221][T24558] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 977.247927][T24558] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 977.277764][T24558] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 977.285188][T24558] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 977.311728][T24558] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 977.394091][T24558] hsr_slave_0: entered promiscuous mode [ 977.401816][T24558] hsr_slave_1: entered promiscuous mode [ 977.409538][T24558] debugfs: 'hsr0' already exists in 'hsr' [ 977.415920][T24558] Cannot create hsr debugfs directory [ 977.537526][T24441] Bluetooth: hci19: unexpected cc 0x0c03 length: 249 > 1 [ 977.560502][T24441] Bluetooth: hci19: unexpected cc 0x1003 length: 249 > 9 [ 977.570890][T24441] Bluetooth: hci19: unexpected cc 0x1001 length: 249 > 9 [ 977.581577][T24441] Bluetooth: hci19: unexpected cc 0x0c23 length: 249 > 4 [ 977.590067][T24441] Bluetooth: hci19: unexpected cc 0x0c38 length: 249 > 2 [ 977.683102][T24567] lo speed is unknown, defaulting to 1000 [ 977.689463][T24441] Bluetooth: hci15: command tx timeout [ 977.979758][T24567] chnl_net:caif_netlink_parms(): no params data found [ 978.130040][T24567] bridge0: port 1(bridge_slave_0) entered blocking state [ 978.139227][T24567] bridge0: port 1(bridge_slave_0) entered disabled state [ 978.147415][T24567] bridge_slave_0: entered allmulticast mode [ 978.156618][T24567] bridge_slave_0: entered promiscuous mode [ 978.165893][T24567] bridge0: port 2(bridge_slave_1) entered blocking state [ 978.173206][T24567] bridge0: port 2(bridge_slave_1) entered disabled state [ 978.180874][T24567] bridge_slave_1: entered allmulticast mode [ 978.188867][T24567] bridge_slave_1: entered promiscuous mode [ 978.225079][T24573] Bluetooth: hci18: command tx timeout [ 978.235337][T24567] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 978.249420][T24567] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 978.294125][T24567] team0: Port device team_slave_0 added [ 978.303219][T24567] team0: Port device team_slave_1 added [ 978.336546][T24567] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 978.343594][T24567] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 978.370896][T24567] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 978.384442][T24567] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 978.391658][T24567] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 978.420073][T24567] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 978.501849][T24567] hsr_slave_0: entered promiscuous mode [ 978.508804][T24567] hsr_slave_1: entered promiscuous mode [ 978.515631][T24567] debugfs: 'hsr0' already exists in 'hsr' [ 978.521436][T24567] Cannot create hsr debugfs directory [ 979.185396][T24573] Bluetooth: hci16: command tx timeout [ 979.265143][T24573] Bluetooth: hci17: command tx timeout [ 979.665220][T24573] Bluetooth: hci19: command tx timeout [ 979.744948][T24573] Bluetooth: hci15: command tx timeout [ 979.999887][T24573] Bluetooth: hci7: command 0x0406 tx timeout [ 980.009393][T24573] Bluetooth: hci8: command 0x0406 tx timeout [ 980.020018][T24573] Bluetooth: hci6: command 0x0406 tx timeout [ 980.028453][T24573] Bluetooth: hci5: command 0x0406 tx timeout [ 980.029107][T24572] Bluetooth: hci9: command 0x0406 tx timeout [ 980.305047][T21453] Bluetooth: hci18: command tx timeout [ 981.265986][T21453] Bluetooth: hci16: command tx timeout [ 981.345068][T21453] Bluetooth: hci17: command tx timeout [ 981.745377][T21453] Bluetooth: hci19: command tx timeout [ 981.825046][T21453] Bluetooth: hci15: command tx timeout [ 982.384951][T21453] Bluetooth: hci18: command tx timeout [ 982.386727][ T30] INFO: task syz.2.5030:24307 blocked for more than 143 seconds. [ 982.398786][ T30] Not tainted syzkaller #0 [ 982.403820][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 982.413227][ T30] task:syz.2.5030 state:D stack:26328 pid:24307 tgid:24306 ppid:5831 task_flags:0x480140 flags:0x00080002 [ 982.426052][ T30] Call Trace: [ 982.429421][ T30] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 982.432413][ T30] __schedule+0x17b4/0x5680 [ 982.437435][ T30] ? __pfx___schedule+0x10/0x10 [ 982.442387][ T30] ? schedule+0x90/0x360 [ 982.446958][ T30] schedule+0x164/0x360 [ 982.451357][ T30] blk_mq_freeze_queue_wait+0x101/0x180 [ 982.458099][ T30] ? __pfx_blk_mq_freeze_queue_wait+0x10/0x10 [ 982.464273][ T30] ? queue_limits_commit_update_frozen+0x55/0xd0 [ 982.472791][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 982.480301][ T30] queue_limits_commit_update_frozen+0x55/0xd0 [ 982.486947][ T30] nbd_set_size+0x454/0x680 [ 982.491644][ T30] ? __pfx_nbd_set_size+0x10/0x10 [ 982.497560][ T30] ? nla_memcpy+0x5b/0xc0 [ 982.501991][ T30] nbd_genl_reconfigure+0x7f5/0x1ea0 [ 982.507873][ T30] ? __pfx_nbd_genl_reconfigure+0x10/0x10 [ 982.513718][ T30] ? rcu_is_watching+0x15/0xb0 [ 982.519172][ T30] ? trace_kmalloc+0x2a/0xf0 [ 982.524533][ T30] ? __nla_parse+0x40/0x60 [ 982.546547][ T30] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 982.565190][ T30] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 982.580947][ T30] genl_family_rcv_msg_doit+0x22a/0x330 [ 982.587986][ T30] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 982.594191][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 982.599795][ T30] genl_rcv_msg+0x61c/0x7a0 [ 982.604396][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 982.610145][ T30] ? __pfx_nbd_genl_reconfigure+0x10/0x10 [ 982.616297][ T30] netlink_rcv_skb+0x232/0x4b0 [ 982.621210][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 982.631328][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 982.637047][ T30] ? down_read+0x270/0x2e0 [ 982.641552][ T30] ? genl_rcv+0xd/0x40 [ 982.649320][ T30] genl_rcv+0x28/0x40 [ 982.658298][ T30] netlink_unicast+0x75c/0x8e0 [ 982.664531][ T30] netlink_sendmsg+0x813/0xb40 [ 982.669834][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 982.675482][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 982.680508][ T30] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 982.686153][ T30] ____sys_sendmsg+0x972/0x9f0 [ 982.691036][ T30] ? __might_fault+0xaf/0x130 [ 982.695945][ T30] ? __pfx_____sys_sendmsg+0x10/0x10 [ 982.701332][ T30] ? import_iovec+0x73/0xa0 [ 982.706691][ T30] ___sys_sendmsg+0x2a5/0x360 [ 982.711518][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 982.716720][ T30] ? __pfx____sys_sendmsg+0x10/0x10 [ 982.722118][ T30] ? futex_wait+0x2a2/0x390 [ 982.726947][ T30] ? __fget_files+0x2a/0x420 [ 982.731615][ T30] ? __fget_files+0x3a0/0x420 [ 982.736501][ T30] __x64_sys_sendmsg+0x1bd/0x2a0 [ 982.741519][ T30] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 982.747468][ T30] ? rcu_is_watching+0x15/0xb0 [ 982.752326][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.758682][ T30] do_syscall_64+0x15f/0xf80 [ 982.763346][ T30] ? trace_irq_disable+0x3b/0x140 [ 982.768654][ T30] ? clear_bhb_loop+0x40/0x90 [ 982.773401][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 982.779564][ T30] RIP: 0033:0x7f0daf99c819 [ 982.784044][ T30] RSP: 002b:00007f0dadbf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 982.792812][ T30] RAX: ffffffffffffffda RBX: 00007f0dafc15fa0 RCX: 00007f0daf99c819 [ 982.803152][ T30] RDX: 0000000000040004 RSI: 0000200000000100 RDI: 0000000000000005 [ 982.811456][ T30] RBP: 00007f0dafa32c91 R08: 0000000000000000 R09: 0000000000000000 [ 982.819789][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 982.827975][ T30] R13: 00007f0dafc16038 R14: 00007f0dafc15fa0 R15: 00007fffa4ab0438 [ 982.836166][ T30] [ 982.839259][ T30] INFO: task syz.2.5030:24310 blocked for more than 143 seconds. [ 982.847278][ T30] Not tainted syzkaller #0 [ 982.852249][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 982.861139][ T30] task:syz.2.5030 state:D stack:25304 pid:24310 tgid:24306 ppid:5831 task_flags:0x400140 flags:0x00080002 [ 982.873586][ T30] Call Trace: [ 982.877237][ T30] [ 982.880209][ T30] __schedule+0x17b4/0x5680 [ 982.884809][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 982.889818][ T30] ? __pfx___schedule+0x10/0x10 [ 982.894700][ T30] ? schedule+0x90/0x360 [ 982.899273][ T30] schedule+0x164/0x360 [ 982.903538][ T30] schedule_preempt_disabled+0x13/0x30 [ 982.909472][ T30] __mutex_lock+0x7f5/0x1550 [ 982.914141][ T30] ? kernel_text_address+0xa5/0xe0 [ 982.919603][ T30] ? __mutex_lock+0x606/0x1550 [ 982.924428][ T30] ? genl_rcv_msg+0x10b/0x7a0 [ 982.929309][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 982.934399][ T30] ? stack_trace_save+0xa9/0x100 [ 982.939519][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 982.944565][ T30] ? radix_tree_lookup+0x240/0x290 [ 982.949923][ T30] genl_rcv_msg+0x10b/0x7a0 [ 982.954487][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 982.959648][ T30] netlink_rcv_skb+0x232/0x4b0 [ 982.964485][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 982.969631][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 982.975111][ T30] ? down_read+0x270/0x2e0 [ 982.979606][ T30] ? genl_rcv+0xd/0x40 [ 982.983704][ T30] genl_rcv+0x28/0x40 [ 982.987783][ T30] netlink_unicast+0x75c/0x8e0 [ 982.992606][ T30] netlink_sendmsg+0x813/0xb40 [ 982.997518][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 983.002854][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 983.007956][ T30] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 983.013295][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 983.018927][ T30] __sys_sendto+0x672/0x710 [ 983.023633][ T30] ? __pfx___sys_sendto+0x10/0x10 [ 983.029792][ T30] ? fd_install+0x94/0x3d0 [ 983.034332][ T30] ? fd_install+0x306/0x3d0 [ 983.039135][ T30] __x64_sys_sendto+0xde/0x100 [ 983.043994][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.050365][ T30] do_syscall_64+0x15f/0xf80 [ 983.055225][ T30] ? trace_irq_disable+0x3b/0x140 [ 983.060379][ T30] ? clear_bhb_loop+0x40/0x90 [ 983.065422][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.071385][ T30] RIP: 0033:0x7f0daf95d04e [ 983.076071][ T30] RSP: 002b:00007f0dadbd3e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 983.084552][ T30] RAX: ffffffffffffffda RBX: 00007f0dadbd56c0 RCX: 00007f0daf95d04e [ 983.092912][ T30] RDX: 0000000000000028 RSI: 00007f0dadbd4000 RDI: 0000000000000004 [ 983.101277][ T30] RBP: 0000000000000000 R08: 00007f0dadbd3f04 R09: 000000000000000c [ 983.109746][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 983.118047][ T30] R13: 00007f0dadbd3f58 R14: 00007f0dadbd4000 R15: 0000000000000000 [ 983.126461][ T30] [ 983.129580][ T30] INFO: task syz.1.5041:24340 blocked for more than 144 seconds. [ 983.144250][ T30] Not tainted syzkaller #0 [ 983.149559][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 983.158562][ T30] task:syz.1.5041 state:D stack:25720 pid:24340 tgid:24335 ppid:5832 task_flags:0x400140 flags:0x00080002 [ 983.170848][ T30] Call Trace: [ 983.174196][ T30] [ 983.177226][ T30] __schedule+0x17b4/0x5680 [ 983.181824][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 983.187034][ T30] ? __pfx___schedule+0x10/0x10 [ 983.191971][ T30] ? schedule+0x90/0x360 [ 983.196476][ T30] schedule+0x164/0x360 [ 983.200736][ T30] schedule_preempt_disabled+0x13/0x30 [ 983.206561][ T30] __mutex_lock+0x7f5/0x1550 [ 983.211230][ T30] ? kernel_text_address+0xa5/0xe0 [ 983.216587][ T30] ? __mutex_lock+0x606/0x1550 [ 983.221434][ T30] ? genl_rcv_msg+0x10b/0x7a0 [ 983.226332][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 983.231457][ T30] ? stack_trace_save+0xa9/0x100 [ 983.236589][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 983.241607][ T30] ? radix_tree_lookup+0x240/0x290 [ 983.247157][ T30] genl_rcv_msg+0x10b/0x7a0 [ 983.251797][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 983.256981][ T30] netlink_rcv_skb+0x232/0x4b0 [ 983.261800][ T30] ? __pfx_genl_rcv_msg+0x10/0x10 [ 983.267168][ T30] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 983.272548][ T30] ? down_read+0x270/0x2e0 [ 983.277280][ T30] ? genl_rcv+0xd/0x40 [ 983.281426][ T30] genl_rcv+0x28/0x40 [ 983.285715][ T30] netlink_unicast+0x75c/0x8e0 [ 983.290589][ T30] netlink_sendmsg+0x813/0xb40 [ 983.295489][ T30] ? __pfx_netlink_sendmsg+0x10/0x10 [ 983.300868][ T30] ? aa_sock_msg_perm+0xf1/0x1b0 [ 983.306151][ T30] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 983.311520][ T30] ____sys_sendmsg+0x972/0x9f0 [ 983.316533][ T30] ? __might_fault+0xaf/0x130 [ 983.321313][ T30] ? __pfx_____sys_sendmsg+0x10/0x10 [ 983.326925][ T30] ? import_iovec+0x73/0xa0 [ 983.331513][ T30] ___sys_sendmsg+0x2a5/0x360 [ 983.336406][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 983.341431][ T30] ? __pfx____sys_sendmsg+0x10/0x10 [ 983.347263][T21453] Bluetooth: hci16: command tx timeout [ 983.352966][ T30] ? futex_wait+0x2a2/0x390 [ 983.357630][ T30] ? __fget_files+0x2a/0x420 [ 983.362278][ T30] ? __fget_files+0x3a0/0x420 [ 983.367175][ T30] __x64_sys_sendmsg+0x1bd/0x2a0 [ 983.372242][ T30] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 983.377976][ T30] ? rcu_is_watching+0x15/0xb0 [ 983.382838][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.389078][ T30] do_syscall_64+0x15f/0xf80 [ 983.393744][ T30] ? trace_irq_disable+0x3b/0x140 [ 983.398936][ T30] ? clear_bhb_loop+0x40/0x90 [ 983.403673][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 983.409881][ T30] RIP: 0033:0x7fcab339c819 [ 983.414376][ T30] RSP: 002b:00007fcab41de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 983.423070][ T30] RAX: ffffffffffffffda RBX: 00007fcab3616090 RCX: 00007fcab339c819 [ 983.431206][T21453] Bluetooth: hci17: command tx timeout [ 983.437100][ T30] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 000000000000000d [ 983.445265][ T30] RBP: 00007fcab3432c91 R08: 0000000000000000 R09: 0000000000000000 [ 983.453315][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 983.461751][ T30] R13: 00007fcab3616128 R14: 00007fcab3616090 R15: 00007ffc83516b18 [ 983.469934][ T30] [ 983.473101][ T30] [ 983.473101][ T30] Showing all locks held in the system: [ 983.484215][ T30] 1 lock held by ksoftirqd/0/15: [ 983.490261][ T30] 1 lock held by khungtaskd/30: [ 983.495263][ T30] #0: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 983.505864][ T30] 2 locks held by getty/5577: [ 983.510619][ T30] #0: ffff8880326b40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 983.520838][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 983.531326][ T30] 1 lock held by udevd/17438: [ 983.536239][ T30] #0: ffff888026c76350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 983.546107][ T30] 6 locks held by syz.2.5030/24307: [ 983.551431][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.559848][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.569629][ T30] #2: ffff888026b9ca60 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_reconfigure+0x4c1/0x1ea0 [ 983.580521][ T30] #3: ffff888026876d08 (&q->limits_lock){+.+.}-{4:4}, at: nbd_set_size+0x263/0x680 [ 983.591483][ T30] #4: ffff8880268766d0 (&q->q_usage_counter(io)#51){++++}-{0:0}, at: queue_limits_commit_update_frozen+0x55/0xd0 [ 983.603700][ T30] #5: ffff888026876708 (&q->q_usage_counter(queue)#35){+.+.}-{0:0}, at: queue_limits_commit_update_frozen+0x55/0xd0 [ 983.616525][ T30] 2 locks held by syz.2.5030/24310: [ 983.621789][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.630158][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.639294][ T30] 2 locks held by syz.1.5041/24340: [ 983.644543][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.652941][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.662296][ T30] 2 locks held by syz.3.5043/24358: [ 983.669033][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.677593][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.687047][ T30] 2 locks held by syz.4.5056/24385: [ 983.692421][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.700810][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.709932][ T30] 2 locks held by syz.0.5071/24425: [ 983.715328][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.723623][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.732785][ T30] 2 locks held by syz-executor/24428: [ 983.738284][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.746854][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.755990][ T30] 2 locks held by syz-executor/24438: [ 983.761422][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.769982][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.779194][ T30] 2 locks held by syz-executor/24440: [ 983.784581][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.793007][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.802311][ T30] 2 locks held by syz-executor/24457: [ 983.807804][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.816300][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.825566][ T30] 2 locks held by syz-executor/24466: [ 983.825586][T21453] Bluetooth: hci19: command tx timeout [ 983.830984][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831048][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831102][ T30] 2 locks held by syz-executor/24480: [ 983.831114][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831162][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831215][ T30] 2 locks held by syz-executor/24490: [ 983.831226][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831274][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831333][ T30] 2 locks held by syz-executor/24492: [ 983.831345][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831393][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831444][ T30] 2 locks held by syz-executor/24508: [ 983.831456][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831504][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831554][ T30] 2 locks held by syz-executor/24517: [ 983.831566][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831615][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831666][ T30] 2 locks held by syz-executor/24531: [ 983.831677][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831725][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831775][ T30] 2 locks held by syz-executor/24541: [ 983.831787][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831835][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831885][ T30] 2 locks held by syz-executor/24543: [ 983.831897][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.831945][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.831996][ T30] 2 locks held by syz-executor/24558: [ 983.832007][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.832054][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.832104][ T30] 2 locks held by syz-executor/24567: [ 983.832116][ T30] #0: ffffffff8fe3ddc8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 983.832163][ T30] #1: ffffffff8fe3dc00 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 983.832329][ T30] [ 983.832337][ T30] ============================================= [ 983.832337][ T30] [ 983.832363][ T30] NMI backtrace for cpu 0 [ 983.832378][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 983.832397][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 983.832409][ T30] Call Trace: [ 983.832419][ T30] [ 983.832428][ T30] dump_stack_lvl+0xe8/0x150 [ 983.832458][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 983.832487][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 983.832515][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 983.832549][ T30] sys_info+0x135/0x170 [ 983.832612][ T30] watchdog+0xfaa/0x1000 [ 983.832728][ T30] ? watchdog+0x209/0x1000 [ 983.832830][ T30] kthread+0x388/0x470 [ 983.832895][ T30] ? __pfx_watchdog+0x10/0x10 [ 983.832952][ T30] ? __pfx_kthread+0x10/0x10 [ 983.833017][ T30] ret_from_fork+0x514/0xb70 [ 983.833115][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 983.833196][ T30] ? __switch_to+0xc79/0x1410 [ 983.833274][ T30] ? __pfx_kthread+0x10/0x10 [ 983.833352][ T30] ret_from_fork_asm+0x1a/0x30 [ 983.833492][ T30] [ 983.833517][ T30] Sending NMI from CPU 0 to CPUs 1: [ 984.205217][ C1] NMI backtrace for cpu 1 [ 984.205236][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 984.205257][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 984.205269][ C1] RIP: 0010:__lock_acquire+0x482/0x2cf0 [ 984.205300][ C1] Code: 41 8d 5c 24 01 49 ff cc 89 d9 83 c1 fe 78 40 45 89 e7 41 81 e7 ff ff ff 7f 83 f9 31 73 1d 4b 8d 0c bf 41 8b 8c ce b0 0b 00 00 <31> c1 ff cb 49 ff cc f7 c1 00 60 00 00 74 cf eb 17 48 c7 c7 70 b3 [ 984.205317][ C1] RSP: 0018:ffffc90000a08950 EFLAGS: 00000087 [ 984.205335][ C1] RAX: 00000000000c2000 RBX: 0000000000000004 RCX: 00000000000c204c [ 984.205348][ C1] RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000000 [ 984.205360][ C1] RBP: ffff88801de80c08 R08: ffffffff84b9ba73 R09: ffffffff9a6a58a8 [ 984.205374][ C1] R10: dffffc0000000000 R11: ffffed100ef61a32 R12: 0000000000000002 [ 984.205388][ C1] R13: 0000000000000000 R14: ffff88801de80000 R15: 0000000000000002 [ 984.205401][ C1] FS: 0000000000000000(0000) GS:ffff888125345000(0000) knlGS:0000000000000000 [ 984.205416][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 984.205429][ C1] CR2: 00005564de189ee8 CR3: 000000000e74a000 CR4: 00000000003526f0 [ 984.205446][ C1] Call Trace: [ 984.205453][ C1] [ 984.205464][ C1] ? call_timer_fn+0x192/0x5e0 [ 984.205490][ C1] ? __run_timer_base+0x67e/0x8b0 [ 984.205510][ C1] ? run_timer_softirq+0xb7/0x170 [ 984.205532][ C1] ? handle_softirqs+0x22a/0x840 [ 984.205563][ C1] ? __irq_exit_rcu+0xca/0x220 [ 984.205586][ C1] ? irq_exit_rcu+0x9/0x30 [ 984.205609][ C1] ? sysvec_apic_timer_interrupt+0xa6/0xc0 [ 984.205630][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 984.205654][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 984.205675][ C1] ? debug_object_activate+0x83/0x580 [ 984.205792][ C1] lock_acquire+0x106/0x350 [ 984.205815][ C1] ? debug_object_activate+0x83/0x580 [ 984.205842][ C1] ? _raw_spin_unlock+0x28/0x50 [ 984.205861][ C1] ? pwq_tryinc_nr_active+0x66f/0x9b0 [ 984.205887][ C1] _raw_spin_lock_irqsave+0x40/0x60 [ 984.205906][ C1] ? debug_object_activate+0x83/0x580 [ 984.205931][ C1] debug_object_activate+0x83/0x580 [ 984.205956][ C1] ? __pfx_pwq_tryinc_nr_active+0x10/0x10 [ 984.205982][ C1] insert_work+0x35/0x330 [ 984.206005][ C1] __queue_work+0xbad/0xfc0 [ 984.206035][ C1] ? __queue_work+0x1a1/0xfc0 [ 984.206061][ C1] call_timer_fn+0x192/0x5e0 [ 984.206086][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 984.206112][ C1] ? call_timer_fn+0xd4/0x5e0 [ 984.206136][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 984.206166][ C1] ? do_raw_spin_unlock+0xf5/0x210 [ 984.206185][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 984.206213][ C1] __run_timer_base+0x67e/0x8b0 [ 984.206234][ C1] ? ktime_get+0x45/0x220 [ 984.206260][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 984.206291][ C1] run_timer_softirq+0xb7/0x170 [ 984.206315][ C1] handle_softirqs+0x22a/0x840 [ 984.206341][ C1] ? __irq_exit_rcu+0xca/0x220 [ 984.206369][ C1] __irq_exit_rcu+0xca/0x220 [ 984.206393][ C1] irq_exit_rcu+0x9/0x30 [ 984.206416][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 984.206437][ C1] [ 984.206444][ C1] [ 984.206451][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 984.206470][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 984.206492][ C1] Code: 5b 74 02 e9 c3 f6 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 4d 16 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 984.206507][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000242 [ 984.206524][ C1] RAX: 00000000001c6efb RBX: ffffffff819a67ea RCX: 0000000080000001 [ 984.206537][ C1] RDX: 0000000000000001 RSI: ffffffff8dfb65fa RDI: ffffffff8c27f000 [ 984.206558][ C1] RBP: ffffc90000197f10 R08: ffff8880b87339db R09: 1ffff110170e673b [ 984.206572][ C1] R10: dffffc0000000000 R11: ffffed10170e673c R12: 0000000000000001 [ 984.206585][ C1] R13: 1ffff11003bd0000 R14: 0000000000000001 R15: 1ffff11003bd0000 [ 984.206600][ C1] ? do_idle+0x36a/0x5f0 [ 984.206630][ C1] default_idle+0x9/0x20 [ 984.206654][ C1] default_idle_call+0x72/0xb0 [ 984.206679][ C1] do_idle+0x36a/0x5f0 [ 984.206706][ C1] ? __pfx_do_idle+0x10/0x10 [ 984.206735][ C1] cpu_startup_entry+0x43/0x60 [ 984.206761][ C1] start_secondary+0x101/0x110 [ 984.206783][ C1] common_startup_64+0x13e/0x147 [ 984.206811][ C1] [ 984.465799][T21453] Bluetooth: hci18: command tx timeout [ 984.472490][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 984.472557][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 984.472642][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 984.472685][ T30] Call Trace: [ 984.472709][ T30] [ 984.472744][ T30] vpanic+0x56c/0xa60 [ 984.472853][ T30] ? __pfx___schedule+0x10/0x10 [ 984.472923][ T30] ? __pfx_vpanic+0x10/0x10 [ 984.473011][ T30] ? __pfx_console_unlock+0x10/0x10 [ 984.473148][ T30] panic+0xc5/0xd0 [ 984.473265][ T30] ? __pfx_panic+0x10/0x10 [ 984.473366][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 984.473448][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 984.473563][ T30] watchdog+0xff4/0x1000 [ 984.473653][ T30] ? watchdog+0x209/0x1000 [ 984.473742][ T30] kthread+0x388/0x470 [ 984.473813][ T30] ? __pfx_watchdog+0x10/0x10 [ 984.473877][ T30] ? __pfx_kthread+0x10/0x10 [ 984.473947][ T30] ret_from_fork+0x514/0xb70 [ 984.474037][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 984.474126][ T30] ? __switch_to+0xc79/0x1410 [ 984.474196][ T30] ? __pfx_kthread+0x10/0x10 [ 984.474256][ T30] ret_from_fork_asm+0x1a/0x30 [ 984.474388][ T30] [ 984.477158][ T30] Kernel Offset: disabled