last executing test programs: 4.153698681s ago: executing program 3 (id=16542): r0 = socket$igmp6(0xa, 0x3, 0x2) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) (async) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800450000280000000000069078000000000000000000004e22", @ANYRES32=r1, @ANYRES16=r0, @ANYRES8=r0], 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000440)={r1, &(0x7f0000000040)='-@\x00', 0x40, &(0x7f0000000340)={@_ha_fsid={[0x3, 0x7]}, {0xfff, 0x1, 0x3, 0x7f}}, 0x6, &(0x7f00000003c0), &(0x7f0000000400)=0x6}) openat$cgroup_procs(r2, &(0x7f0000000480)='tasks\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x8, &(0x7f0000000500)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xa2}, @alu={0x7, 0x1, 0x1, 0x3, 0xa, 0xfffffffffffffff4, 0xfffffffffffffffc}, @exit, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x2}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_extract_tcp_res$synack(&(0x7f00000004c0), 0x1, 0x0) (async) r3 = socket$kcm(0x29, 0x2, 0x0) (async) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xf}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x24, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x8400000000000000}]}}}]}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xe4}}, 0x0) (async) sendmsg$key(r4, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000001f0f000000000300060000000e0002000000e0000009000c000000000000020001000029648fc000000200000100030005000000000002000000e10000010000"], 0x50}}, 0x0) (async) close(r3) (async) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) (async) r7 = socket$inet6_udp(0xa, 0x2, 0x0) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000a00)={0x14, 0x30, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x4, 0xf2}]}, 0x14}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) setsockopt$inet6_opts(r7, 0x29, 0x36, &(0x7f0000000540)=@hopopts={0x6d, 0x0, '\x00', [@pad1]}, 0x10) sendmsg$inet(r6, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, 0x0}, 0x30004040) (async) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000040)={0x4, 0x7}, 0x4) (async) setsockopt$packet_fanout_data(r8, 0x107, 0x16, 0x0, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0xd, &(0x7f00000000c0), 0xfe11) (async) close(r3) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0xc98, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0xbc8, 0xffffffff, 0xffffffff, 0xbc8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x8e0, 0x908, 0x0, {}, [@common=@unspec=@u32={{0x7e0}, {[{[{0xd8800000, 0x1}, {0xec, 0x2}, {0x6, 0x3}, {0x80}, {0x6, 0x2}, {0x10000, 0x2}, {0xd}, {0x2}, {0x4, 0x3}, {0x1, 0x1}, {0x4}], [{0x9, 0xfffffffb}, {0x7, 0x7}, {0x2, 0x80000000}, {0x9, 0x1}, {0x799, 0x8001}, {0x0, 0x2}, {0xc2, 0x5}, {0x8, 0x1000}, {0x40, 0x9}, {0xff, 0x81}, {0x636, 0x6}], 0x6}, {[{0x8, 0x2}, {0xe000}, {0xb8b4, 0x1}, {0x3c5f9b87, 0x3}, {0x3, 0x1}, {}, {0x29b5, 0x2}, {0x54a2f77, 0x3}, {0x3, 0x3}, {0x1000, 0x2}, {0x1, 0x2}], [{0x6, 0x5}, {0x5, 0x7}, {0x2, 0x3}, {0x80000000, 0x2}, {0xee84, 0x8000}, {0x9, 0x9}, {0x3800000, 0x3}, {0x800, 0x9}, {0xfffffffa, 0x1}, {0x0, 0x2}, {0x7, 0x7}], 0x4, 0x3}, {[{0x286f, 0x1}, {0x554b, 0x3}, {0x0, 0x3}, {0x6, 0x3}, {0x5}, {0x9, 0x1}, {0x6000000, 0x3}, {0x400, 0x3}, {0x9, 0x2}, {0x8001, 0x2}, {0xc5bf}], [{0x6, 0x7f}, {0x5, 0xfffffff9}, {0x7, 0x8}, {0xb, 0x3}, {0x8, 0x9}, {0x2}, {0x7}, {0x7, 0x1000}, {0xfff, 0x2e4}, {0x0, 0x400}, {0x0, 0x8}], 0xb, 0x4}, {[{0x5, 0x2}, {0x2, 0x1}, {0x6, 0x3}, {0xfffffffc, 0x1}, {0x4, 0x3}, {0x10001}, {0xca0, 0x2}, {0x10, 0x1}, {0x8, 0x1}, {0x6796, 0x3}, {0x8, 0x1}], [{0x6, 0x6}, {0x1, 0x7}, {0x5, 0x9}, {0xffff, 0x2}, {0xc, 0x5}, {0x51a3, 0x3}, {0x8, 0x5}, {0xfffffff7, 0x9}, {0xd0, 0x1}, {0xfffffff8, 0x8}, {0x7656, 0x2}], 0x7}, {[{0x2, 0x2}, {0x10001}, {0x4eb}, {0x10000, 0x3}, {0x2, 0x2}, {0x3}, {0x81}, {0x4, 0x1}, {0x10001, 0x2}, {0x9, 0x3}, {0x1, 0x2}], [{0x4}, {0x0, 0x400}, {0xd9a8, 0x7}, {0x1000, 0x8f8}, {0x3, 0x10001}, {0x3, 0x7c67}, {0x6, 0x80}, {0xfffffff9, 0x2}, {0xffff, 0x2}, {0x1000, 0x9}, {0x3, 0x2}], 0x1, 0x4}, {[{0xabb918, 0x1}, {0x3, 0x1}, {0x8, 0x2}, {0x9, 0x1}, {0x2}, {0x9, 0x1}, {0x80000000, 0x3}, {0x1, 0x2}, {0x0, 0xc49aafde8229cbf1}, {0x4, 0x1}, {0x3, 0x2}], [{0x8b, 0x9}, {0x6, 0x553}, {0x1, 0xe0}, {0x3, 0x4ad}, {0x0, 0x10001}, {0x1, 0x2}, {0xd1, 0x100}, {0x6, 0x7641}, {0x3, 0xfffffffc}, {0x2, 0x4}, {0x9, 0x2}], 0x1, 0x1}, {[{0x8015, 0x3}, {0x3, 0x3}, {0x1, 0x2}, {0x0, 0x2}, {0x37b, 0x3}, {0x5}, {0x2, 0x3}, {0x1, 0x2}, {0x7f}, {0x6, 0x2}, {0xfffffff6, 0x2}], [{0x9, 0x7}, {0x8, 0x7}, {0x6, 0x4}, {0x800, 0x80000001}, {0x0, 0x10000}, {0x2, 0x3b58}, {0x4ca7ea08, 0x8001}, {0x0, 0xa9b}, {0x1ff}, {0x5, 0x2}, {0x8, 0x4}], 0xa, 0xb}, {[{0x10001, 0x3}, {0x3}, {0xc, 0x1}, {0x7a, 0x3}, {0x6, 0x1}, {0x80000001, 0x3}, {0x3, 0x2}, {0xa}, {0x401, 0x1}, {0x9}, {0x1, 0x2}], [{0x200, 0x1}, {0x8, 0x1aaa}, {0x706, 0x9}, {0x9, 0x2}, {0x4, 0x7}, {0x5, 0x9}, {0x3}, {0x5, 0xbf789c5e}, {0x8, 0x3}, {0x7, 0x10001}, {0x1}], 0xa, 0x1}, {[{0xc2}, {0x5, 0x1}, {0x7cd72bba}, {0x8, 0x2}, {0x400}, {0x7ff, 0x3}, {0x10001}, {0xe1a}, {0x9, 0x3}, {0xfffffffc, 0x3}, {0x9}], [{0x10, 0x4}, {0x1, 0x10000}, {0xbf9, 0x6}, {0x4}, {0x101, 0x8}, {0x100, 0x4}, {0x0, 0xb6e}, {0x7f, 0x8}, {0x9, 0x7}, {0xffff, 0x92a}, {0xd, 0x2}], 0x9, 0x2}, {[{0x8, 0x3}, {0x80000001}, {0x8, 0x3}, {0x4, 0x2}, {0x1, 0x3}, {0x4}, {0x4, 0x1}, {0x1, 0x3}, {0xc, 0x3}, {0x101, 0x2}, {0x1}], [{0x4, 0x3}, {0x0, 0x8}, {0xffffe5cb, 0x1}, {0x7f, 0xfffffff4}, {0x40, 0xffffffff}, {0x2, 0x7}, {0x7fff, 0x6}, {0x0, 0x8}, {0xffffff2e, 0x7ff}, {0x40, 0xa}, {0x3, 0x7}], 0x6, 0x2}, {[{0x1ff}, {0x5, 0x2}, {0x10001, 0x1}, {0x2, 0x2}, {0xff, 0x1}, {0x1, 0x1}, {0x800, 0x3}, {0x80000001, 0x2}, {0x1ef6, 0x2}, {0x1, 0x2}, {0xba, 0x3}], [{0x18d, 0x7}, {0x0, 0x2}, {0xdf91, 0x1}, {0xe08, 0x6}, {0x4, 0x7ff}, {0xa64, 0x101}, {0x7, 0x4}, {0x401, 0x2}, {0x7ff}, {0x0, 0xd4}, {0xef}], 0x2, 0x7}], 0xfe}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x2c0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0xc4, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0xffffffffffffffff, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x8000, 0x16a, 0x1, 'syz1\x00', 'syz0\x00', {0x80000001}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0xcf8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) 3.820429151s ago: executing program 3 (id=16548): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) close(r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="04"], 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r3) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000200), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='0\"\x00\x00', @ANYRES16=r4, @ANYBLOB="1d3200000000000000001000000014000f00fe8000000000000000000000000000bb0800010000000000"], 0x30}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1b, 0x8, &(0x7f0000000140)=ANY=[@ANYRES8=r5, @ANYRESDEC=r5, @ANYRES64], &(0x7f0000000180)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x40000001}, 0x1c) poll(&(0x7f0000000300)=[{r5, 0x9145}], 0x1, 0xff) 3.417218169s ago: executing program 3 (id=16557): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4001, 0x800000, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a0677bc45ff8105fffffffe000058000b480400945f64009400050028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1) 2.473092379s ago: executing program 3 (id=16577): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x2400}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x19}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x74}}, 0x0) 2.048121273s ago: executing program 3 (id=16583): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6410, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000015c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r3, {0xfffa, 0x2}, {}, {0x10, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x800}, @TCA_FLOWER_KEY_IP_PROTO={0x5, 0x9, 0x6}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008000}, 0x24004000) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r6, 0x11, 0x68, &(0x7f0000000080)=0xa40, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'hsr0\x00', @random="7e9f8f75964a"}) setsockopt$inet6_udp_encap(r6, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) write$tun(r7, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000001011ff00000000000100070000000000000000ff0200000000000000000000000000014f194e20"], 0xfdef) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x10) r9 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r9, &(0x7f0000000600)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="800000001334ee5f2cbd7000fbdbdf25cb3b5c748e55a1d31b9d226fb1f1b2c51521aa6c6f7e6a97a66e72ba9d970f6f5a1346b7a2da88617b95fde15a4476ec76df39031d5e159693114ca3c1c245bc82c6d0857765bb5b8ee770e7262cd621001656520fd8412aa1b4cb9d22c11ecea398f5"], 0x80}, 0x1, 0x0, 0x0, 0x12}, 0x4000000) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) 1.724112899s ago: executing program 4 (id=16587): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000a08000f00fd000000", 0x85) r1 = socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000200)={0x0, 0x2, 0x30}, &(0x7f0000000240)=0xc) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x4004004) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r2, 0x40286608, &(0x7f00000000c0)={0x2, 0x100000001, 0x0, 0x8, 0x3, 0x6d9e}) syz_emit_ethernet(0xffffffffffffff34, &(0x7f0000000300)=ANY=[@ANYRES32=0x41424344, @ANYBLOB], 0x0) 1.631626375s ago: executing program 3 (id=16589): socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000200"/32], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r4, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000007980)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x10003, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r5], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x200000c0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000380)={0x0, 0x1c, &(0x7f0000000340)=[@in6={0xa, 0x0, 0x0, @private0}]}, &(0x7f00000003c0)=0x10) shutdown(r7, 0x1) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xc}, {0xffff, 0xffff}}}, 0x24}}, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000300)={{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1, @remote}, 0x0, {0x2, 0x0, @private}, 'syz_tun\x00'}) 1.585163623s ago: executing program 4 (id=16590): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/5, 0x1c000, 0x800}, 0x20) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000140)={0x0, 0x300000, 0x1000, 0x9, 0x2}, 0x20) r1 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r1, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000041ff4b040000950000000000000050d528b51a30c98bba9600"/40], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x50, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x12, r2, 0x16430000) 1.502589473s ago: executing program 4 (id=16592): socket$kcm(0x10, 0x2, 0x0) (async) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="5500000020007fafb70000200000000080000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d5e801e0b009000000000100005ae583de0dd7d8319f98af84fda542e718f9", 0x55}], 0x1}, 0x840) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r3 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000001680)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002c0000009500000000000000eb4779fcbb3e3bbff2971871b1b1c0b4f0fca28377f3aa77d6c8d949060c54d53bd61b3561319f7b346f8cadae05957ee562fe28a5d0b564a59c30cb37ebb90e516d9c72b9d81817f7a04496e4261b41dae579bd93d38e2740ac98d6108c318a35d29534fd3c6bf14ef7a5c59c3d48f092e6b6bb43ec765d850f71052de0718c08"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000440)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="180000004700000000000000070000009500000000000000522ce0b09bb75656521dc376ec0e78360041c94f2345abe67812e2412c13622d5f2b63c4ea1c9a72d3b28bebc13c3eae5fdd1a80342c59fa83187463d6"], 0x0, 0x7, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, 0x3c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2bad3, r6, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) (async) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x40010) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x4c, 0x10, 0xffffff1f, 0xfffffffc, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x502e}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x14, &(0x7f00000000c0)=0x100000001, 0x4) (async) connect$inet(r3, &(0x7f00000001c0)={0x2, 0x200, @local}, 0x10) sendto$inet(r3, &(0x7f0000000000)="e1345ef6cb", 0x5, 0x20000010, 0x0, 0x0) splice(r3, 0x0, r2, 0x0, 0x5, 0xa) (async) recvmmsg$unix(r1, &(0x7f0000008d40)=[{{&(0x7f00000003c0)=@abs, 0x6e, &(0x7f0000000700)=[{&(0x7f0000000500)=""/162, 0xa2}, {&(0x7f0000000640)=""/176, 0xb0}], 0x2, &(0x7f00000007c0)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}], 0x60}}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000000840)=""/187, 0xbb}, {&(0x7f0000000900)=""/195, 0xc3}, {&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000002740)=""/92, 0x5c}, {&(0x7f00000027c0)=""/78, 0x4e}], 0x5, &(0x7f00000028c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x88}}, {{&(0x7f0000002980)=@abs, 0x6e, &(0x7f0000005cc0)=[{&(0x7f0000002a00)=""/67, 0x43}, {&(0x7f0000002a80)=""/245, 0xf5}, {&(0x7f0000002b80)=""/4096, 0x1000}, {&(0x7f0000003b80)=""/85, 0x55}, {&(0x7f0000003c00)=""/4096, 0x1000}, {&(0x7f0000004c00)=""/4096, 0x1000}, {&(0x7f0000005c00)=""/143, 0x8f}], 0x7}}, {{&(0x7f0000005d40)=@abs, 0x6e, &(0x7f0000005f00)=[{&(0x7f0000005dc0)=""/175, 0xaf}, {&(0x7f0000005e80)=""/56, 0x38}], 0x2}}, {{0x0, 0x0, &(0x7f00000074c0)=[{&(0x7f0000005f40)}, {&(0x7f0000005f80)=""/227, 0xe3}, {&(0x7f0000006080)=""/4096, 0x1000}, {&(0x7f0000007080)=""/145, 0x91}, {&(0x7f0000007140)=""/251, 0xfb}, {&(0x7f0000007240)=""/206, 0xce}, {&(0x7f0000007340)=""/228, 0xe4}, {&(0x7f0000007440)=""/90, 0x5a}], 0x8, &(0x7f0000007540)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000007780)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x68}}, {{&(0x7f0000007800)=@abs, 0x6e, &(0x7f0000008c80)=[{&(0x7f0000007880)=""/113, 0x71}, {&(0x7f0000007900)=""/209, 0xd1}, {&(0x7f0000007a00)=""/4096, 0x1000}, {&(0x7f0000008a00)=""/43, 0x2b}, {&(0x7f0000008a40)=""/152, 0x98}, {&(0x7f0000008b00)=""/169, 0xa9}, {&(0x7f0000008bc0)=""/51, 0x33}, {&(0x7f0000008c00)=""/19, 0x13}, {&(0x7f0000008c40)=""/62, 0x3e}], 0x9}}], 0x7, 0x11, &(0x7f0000008f00)={0x0, 0x989680}) (async) write$cgroup_subtree(r2, &(0x7f0000000040)={[{0x2d, 'io'}, {0x2b, 'cpuset'}, {0x6, 'net_prio'}]}, 0x16) (async) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r13, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYRESDEC=r9, @ANYRES8=r12, @ANYRES16=r8, @ANYRESDEC=r11, @ANYRES64=r10, @ANYRES16=0x0], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x10) (async) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x6, 0x4, 0x3, 0x7}, 0x50) (async, rerun: 64) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (rerun: 64) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff00000000000086dd61"], 0x0) (async, rerun: 32) r15 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) (rerun: 32) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r15, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x0, 0x353a, 0x1}}, 0x20) r16 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r16, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r14, @ANYBLOB="0000000000000000b7080000000000007baaf8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) 1.141384918s ago: executing program 1 (id=16598): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0820fe067c05e8fe55a10a0015000140020003600e41b0000900ac0006fc1100000016000500014002000000035c3b61c1d67f6f94007174cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001b14d6d930dfe1d9d322fe7c4650b5b9bd6ee6f63f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b4ff010000000000000dd6e4edef3d93452a09004b43370e9703920723f97e46bb5c07540d3b", 0xd8}], 0x1}, 0x8044) 1.038548118s ago: executing program 0 (id=16599): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000002080)={0x18, r1, 0xd01, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x300}, 0x0) 1.038364575s ago: executing program 4 (id=16600): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, 0x0, &(0x7f0000000e40)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 957.316761ms ago: executing program 0 (id=16602): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711217000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@delpolicy={0x5c, 0x14, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in6=@loopback}}, [@sec_ctx={0xc, 0x8, {0x8}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x48040}, 0x0) 957.178765ms ago: executing program 1 (id=16603): r0 = socket(0x10, 0x3, 0x0) r1 = gettid() sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0xff05, 0x70bd28, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xe09a8ffbfca4af68, 0x12c00}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x3}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e24}]}}}, @IFLA_NET_NS_PID={0x8, 0x13, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0xff05, 0x70bd28, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0xe09a8ffbfca4af68, 0x12c00}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x3}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e24}]}}}, @IFLA_NET_NS_PID={0x8, 0x13, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 935.335733ms ago: executing program 0 (id=16604): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'hsr0\x00', 0x200}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r0, &(0x7f0000000140)={@val={0x0, 0x4305}, @void, @eth={@local, @multicast, @val={@val={0x88a8, 0x5, 0x0, 0x4}, {0x8100, 0x5, 0x1, 0x3}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x14, 0x65, 0x0, 0x8, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x29}, @loopback}}}}}}, 0x26) 884.89789ms ago: executing program 2 (id=16605): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) getpeername$netlink(r1, &(0x7f0000000040), &(0x7f0000000080)=0xc) (async) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f00000000c0)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) 823.533028ms ago: executing program 1 (id=16606): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0xfd}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x10) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b80000001500010000000000feffffffe0000002000000000000000000000000e00000010000000000000000000000004e200000000000000a00102000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000100000010000000000000000010000000000000000007639d24ec9bd2031410b7211d9000000000000000000000000000900000000000000ffffffff0000000000000000000000000000000000000000000000000000000000200000b56b6efa0200010000000000f4f60dfb192e1430080424478e53f18dbd3a052fe0a1da2c1f7dde83c07f79c2a87bcf5b6c980a0f6eb200999d317a66cf705ce66cffc118a21dd359fc3c94462a02d59cedd11d0027fca80855cf0b3713ff58698a165b8541bf4244b04cf038d4098c94820f70dc9972b03e6f451870893607b723722a7e39401d50b044a1bea8f7a53a14e37fcaaa81762f85c71e9f15984c6dabab8a4db717d0b0c77f04826ad0d7d8b3ee566a22a96876af765cd2"], 0xb8}}, 0x24000080) 783.38128ms ago: executing program 1 (id=16607): bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) sendmsg$DEVLINK_CMD_RATE_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r0, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@DEVLINK_ATTR_RATE_TX_MAX={0xc, 0xa7, 0xbea4}, @DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xe}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000000)="114353012008ba00000037510800", 0x59f, 0x4008015, &(0x7f00000000c0)={0x11, 0xe5, r3, 0x1, 0x7}, 0x14) r4 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="8c000000", @ANYRES16=r4, @ANYBLOB="01002abd7000fcdbdf250100000008000100", @ANYRES32=r5, @ANYBLOB="7000028038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004"], 0x8c}, 0x1, 0x0, 0x0, 0x24004000}, 0x24044880) 754.311413ms ago: executing program 4 (id=16608): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x6) socket$inet(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x32, &(0x7f0000000000)={@multicast, @empty, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x8}, @multicast1}, {{0x0, 0x6558, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d8621b", 0x0, "2c17a9"}}}}}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000000201010100000000000000000200000004000180180002801400018008000100b04c94a708000200ac1414aa140019800800010004000000080002"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000780)="2e00000011008188040f46ecdb4cb9cca7480ef413000000e3bd6efb440009000e000a400d000000ba80000054eb", 0x2e}], 0x1}, 0x6400000c) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), 0xffffffffffffffff) 680.766407ms ago: executing program 2 (id=16609): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000680)=@newtaction={0x180, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x16c, 0x1, [@m_connmark={0x50, 0x2, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0xd, 0x5, 0x0, 0x3}, 0x8}}]}, {0x4}, {0xc, 0x7, {0xefff}}, {0xc}}}, @m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0xd4, 0x3, 0x0, 0x0, {{0x9}, {0x58, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0x0, 0x3, {0x2, 0xea3, 0x7}}, @TCA_GACT_PROB={0xc, 0x3, {0x0, 0x1d28}}, @TCA_GACT_PARMS={0x18, 0x2, {0xb66, 0xb3, 0x10000000, 0x34e, 0xffff}}, @TCA_GACT_PARMS={0x18, 0x2, {0x7ff, 0xd8, 0x0, 0x9, 0x100000e0}}]}, {0x52, 0x6, "a06b1d1931f3579c6d7c5159238a286074602c3726c701f3c0d5382de62a6e8c4fb714fcd674c66cd306a4f78d3d05530609c9b04b7483bd084d70df8e77e6fbd503917aa0a6c737cef0ed021b60"}, {0xc}, {0x1, 0x8, {0x2, 0x2}}}}]}]}, 0x180}}, 0x0) 609.462114ms ago: executing program 2 (id=16610): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x2a, &(0x7f0000000100)=r1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7338, 0x0, 0x0, 0x0, 0xfffffffd}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) 552.974887ms ago: executing program 4 (id=16611): bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000380)=@req3={0x808000, 0x4, 0x20300, 0xfc, 0x0, 0x2}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x20004000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={0x0, 0x0, 0x26}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000d40)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000005fdb2971dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359ca9daf3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef682cc4375f594425d408ccc58187feb0e3d43347f989007a7c63f6dae682acb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259621818c3c75da30000bce645451b851111dd98ac4d8da9317c2c082020e0b2d6340809000000000000008e053645cc413790faf7e229c782845b5bb774f7f154263178151ea93ff2cac4b181332c9c9a1c7d85616c8100000000000000d8300d19d585000000fc005774b56a7142047326f940e95b8489e1c5650f5c61299a295f39c88456521cffdef93e29f10f4a11f0cfbfc0ff976b20fe"], &(0x7f0000000080)='GPL\x00', 0x0, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @fallback, r3}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, 0x0) sendmsg$nl_route(r4, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x34, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}]}, 0x34}}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000000c0)={'team0\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) recvmmsg(r6, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f0000000440)=""/96, 0x60}, {&(0x7f00000004c0)=""/77, 0x4d}, {&(0x7f00000016c0)=""/4096, 0x1000}], 0x5}, 0x1}], 0x400000000000141, 0x20, 0x0) 460.833206ms ago: executing program 2 (id=16612): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000400010000000000000001410000001c001700000000000000006574683a73"], 0x38}}, 0x0) 460.368656ms ago: executing program 1 (id=16613): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x4c0, 0x98, 0x138, 0x428, 0x0, 0x0, 0x428, 0x428, 0x428, 0x428, 0x428, 0x6, 0x0, {[{{@ip={@remote, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x9}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@private=0xa010100, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00', {}, {0xff}}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {}, 0x32}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x9, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x3, 0x8}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x520) (fail_nth: 2) 377.18683ms ago: executing program 2 (id=16614): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0xffffffff, 0xffffffff, 0x190, 0xffffffff, 0x2a0, 0xffffffff, 0xffffffff, 0x2a0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff0000ff], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {0xff}, 0x0, 0x0, 0x2}, 0x0, 0x128, 0x190, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x81, 0x0, 0x9}}, @common=@inet=@hashlimit1={{0x58}, {'rose0\x00', {0x29, 0x1ff, 0x6, 0xb0e6, 0x1, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x18, 0x800, 0x93, 0x6, '\x00', 'syz0\x00', {0x6}}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [0xffffff00], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x8, 0x2, 0x8, 'pptp\x00', 'syz1\x00', {0x5a}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x3d0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000280)={@private1, @private=0xa010100, 0x14, 0x1f}}) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$igmp6(0xa, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0xffffffff, 0xffffffff, 0x190, 0xffffffff, 0x2a0, 0xffffffff, 0xffffffff, 0x2a0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x0, 0x0, 0xff0000ff], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {0xff}, 0x0, 0x0, 0x2}, 0x0, 0x128, 0x190, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x81, 0x0, 0x9}}, @common=@inet=@hashlimit1={{0x58}, {'rose0\x00', {0x29, 0x1ff, 0x6, 0xb0e6, 0x1, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x18, 0x800, 0x93, 0x6, '\x00', 'syz0\x00', {0x6}}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [0xffffff00], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x8, 0x2, 0x8, 'pptp\x00', 'syz1\x00', {0x5a}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x3d0) (async) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f00000002c0)={'sit0\x00', &(0x7f0000000280)={@private1, @private=0xa010100, 0x14, 0x1f}}) (async) 139.209738ms ago: executing program 0 (id=16615): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febd0cf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ed70590fbbf4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845000000", 0x118) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$phonet(0x23, 0x2, 0x1) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000002c0)={'vxcan1\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x24}}}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0xffea, &(0x7f0000000180)={&(0x7f00000000c0)={0x90, r3, 0x0, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6, 0x1e}}}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x100}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x39e}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x80}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xee}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x26}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x39}], @NL80211_ATTR_MESH_SETUP={0x20, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5}, @NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000}, 0x40004) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="2000000069000b000000000000ffffffe800f9ffffff00000800010000000000"], 0x20}}, 0x0) socket$inet6(0xa, 0x1, 0x0) (async) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febd0cf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ed70590fbbf4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845000000", 0x118) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$phonet(0x23, 0x2, 0x1) (async) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000002c0)={'vxcan1\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x24}}}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000001c0)={&(0x7f0000000000), 0xffea, &(0x7f0000000180)={&(0x7f00000000c0)={0x90, r3, 0x0, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6, 0x1e}}}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x100}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x39e}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x80}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xee}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x26}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x39}], @NL80211_ATTR_MESH_SETUP={0x20, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5, 0x6, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5}, @NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC={0x5, 0x2, 0x1}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x4000}, 0x40004) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="2000000069000b000000000000ffffffe800f9ffffff00000800010000000000"], 0x20}}, 0x0) (async) 49.356381ms ago: executing program 1 (id=16616): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x20, &(0x7f0000000000)={&(0x7f00000000c0)=@gettaction={0x28, 0x5a, 0x1, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8}]}, 0x28}, 0x1, 0x2000000, 0x0, 0x4000800}, 0x0) 49.241499ms ago: executing program 0 (id=16617): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe00000000ef000008000f00fd000000", 0x85) close(0x3) 42.729446ms ago: executing program 2 (id=16618): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) accept$unix(r0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x3b, 0x2, [{0x80001}, {0xfbfffdf8, 0x1c3ff}]}}) 0s ago: executing program 0 (id=16619): syz_80211_join_ibss(&(0x7f0000000040)='wlan1\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010025bd700000000000280000feff00008014000200006574683000"/38], 0x2c}}, 0x0) kernel console output (not intermixed with test programs): ? is_bpf_text_address+0x26/0x2b0 [ 990.770842][T10692] ? __lock_acquire+0x683/0x2cf0 [ 990.770872][T10692] ? kernel_text_address+0xa5/0xe0 [ 990.770910][T10692] ? __kernel_text_address+0xd/0x30 [ 990.770937][T10692] ? unwind_get_return_address+0x4d/0x90 [ 990.770957][T10692] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 990.770981][T10692] ? arch_stack_walk+0xfb/0x150 [ 990.771027][T10692] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 990.771078][T10692] ? __pfx_rtnl_newlink+0x10/0x10 [ 990.771102][T10692] rtnetlink_rcv_msg+0x802/0xc00 [ 990.771127][T10692] ? netlink_sendmsg+0x5d4/0xb40 [ 990.771150][T10692] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 990.771175][T10692] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 990.771201][T10692] ? __lock_acquire+0x683/0x2cf0 [ 990.771241][T10692] netlink_rcv_skb+0x226/0x4a0 [ 990.771272][T10692] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 990.771300][T10692] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 990.771343][T10692] ? netlink_deliver_tap+0x2e/0x1b0 [ 990.771371][T10692] ? netlink_deliver_tap+0x2e/0x1b0 [ 990.771407][T10692] netlink_unicast+0x7bb/0x940 [ 990.771446][T10692] netlink_sendmsg+0x813/0xb40 [ 990.771476][T10692] ? __pfx_netlink_sendmsg+0x10/0x10 [ 990.771500][T10692] ? aa_sock_msg_perm+0xf1/0x1b0 [ 990.771526][T10692] ? __pfx_netlink_sendmsg+0x10/0x10 [ 990.771543][T10692] sock_sendmsg_nosec+0x13a/0x180 [ 990.771569][T10692] ____sys_sendmsg+0x54e/0x850 [ 990.771604][T10692] ? __pfx_____sys_sendmsg+0x10/0x10 [ 990.771643][T10692] ? import_iovec+0x73/0xa0 [ 990.771675][T10692] ___sys_sendmsg+0x2a5/0x360 [ 990.771702][T10692] ? __lock_acquire+0x683/0x2cf0 [ 990.771732][T10692] ? __pfx____sys_sendmsg+0x10/0x10 [ 990.771800][T10692] ? __fget_files+0x2a/0x420 [ 990.771825][T10692] ? __fget_files+0x3a2/0x420 [ 990.771861][T10692] __x64_sys_sendmsg+0x1b1/0x290 [ 990.771893][T10692] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 990.771942][T10692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 990.771963][T10692] do_syscall_64+0x174/0x580 [ 990.771989][T10692] ? trace_irq_disable+0x3b/0x140 [ 990.772013][T10692] ? clear_bhb_loop+0x40/0x90 [ 990.772038][T10692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 990.772064][T10692] RIP: 0033:0x7f42f1d9de59 [ 990.772084][T10692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 990.772101][T10692] RSP: 002b:00007f42efff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 990.772122][T10692] RAX: ffffffffffffffda RBX: 00007f42f2025fa0 RCX: 00007f42f1d9de59 [ 990.772136][T10692] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 990.772149][T10692] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 990.772161][T10692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 990.772173][T10692] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 990.772207][T10692] [ 990.774219][T10692] debugfs: out of free dentries, can not create file 'netdev@ffff88803fec0700' [ 991.300858][T10692] vlan4: entered promiscuous mode [ 991.414637][T10700] bond23: Unable to set peer notification delay as MII monitoring is disabled [ 991.443352][T10700] bond23 (unregistering): Released all slaves [ 991.512168][T10716] batadv_slave_1: entered promiscuous mode [ 991.563932][T10717] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 991.596039][T10719] FAULT_INJECTION: forcing a failure. [ 991.596039][T10719] name failslab, interval 1, probability 0, space 0, times 0 [ 991.612840][T10716] batadv_slave_1: left promiscuous mode [ 991.623613][T10719] CPU: 1 UID: 0 PID: 10719 Comm: syz.0.15377 Not tainted syzkaller #0 PREEMPT(full) [ 991.623645][T10719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 991.623657][T10719] Call Trace: [ 991.623665][T10719] [ 991.623674][T10719] dump_stack_lvl+0xe8/0x150 [ 991.623706][T10719] should_fail_ex+0x40c/0x560 [ 991.623732][T10719] should_failslab+0xa8/0x100 [ 991.623759][T10719] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 991.623782][T10719] ? security_file_alloc+0x34/0x310 [ 991.623804][T10719] ? security_file_alloc+0x34/0x310 [ 991.623833][T10719] security_file_alloc+0x34/0x310 [ 991.623859][T10719] init_file+0x90/0x2b0 [ 991.623884][T10719] alloc_empty_file+0x74/0x1d0 [ 991.623907][T10719] alloc_file_pseudo+0x115/0x1e0 [ 991.623932][T10719] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 991.623952][T10719] ? security_inode_alloc+0xd5/0x310 [ 991.623973][T10719] ? inode_init_always_gfp+0x994/0xd30 [ 991.624002][T10719] sock_alloc_file+0xb8/0x2e0 [ 991.624036][T10719] do_accept+0x3a0/0x750 [ 991.624064][T10719] ? __pfx_do_accept+0x10/0x10 [ 991.624109][T10719] __sys_accept4+0x139/0x230 [ 991.624135][T10719] ? __pfx___sys_accept4+0x10/0x10 [ 991.624160][T10719] ? __pfx_ksys_write+0x10/0x10 [ 991.624194][T10719] __x64_sys_accept4+0x9a/0xb0 [ 991.624217][T10719] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.624235][T10719] do_syscall_64+0x174/0x580 [ 991.624258][T10719] ? trace_irq_disable+0x3b/0x140 [ 991.624281][T10719] ? clear_bhb_loop+0x40/0x90 [ 991.624303][T10719] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 991.624321][T10719] RIP: 0033:0x7f2b06d9de59 [ 991.624339][T10719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 991.624354][T10719] RSP: 002b:00007f2b07c06028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 991.624372][T10719] RAX: ffffffffffffffda RBX: 00007f2b07025fa0 RCX: 00007f2b06d9de59 [ 991.624389][T10719] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 991.624400][T10719] RBP: 00007f2b07c06090 R08: 0000000000000000 R09: 0000000000000000 [ 991.624412][T10719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 991.624423][T10719] R13: 00007f2b07026038 R14: 00007f2b07025fa0 R15: 00007ffc0a85d368 [ 991.624451][T10719] [ 991.889715][T10723] xt_ecn: cannot match TCP bits for non-tcp packets [ 991.904710][T10721] netlink: 'syz.3.15378': attribute type 1 has an invalid length. [ 992.031895][T10735] tipc: Enabled bearer , priority 0 [ 992.060925][T10735] syzkaller0: entered promiscuous mode [ 992.073924][T10735] syzkaller0: entered allmulticast mode [ 992.088613][T10740] veth1_to_team: Caught tx_queue_len zero misconfig [ 992.106854][T10740] dvmrp2: entered allmulticast mode [ 992.118702][T10735] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 992.168258][T10735] tipc: Resetting bearer [ 992.182559][T10742] tipc: Enabling of bearer rejected, failed to enable media [ 992.200963][T10734] tipc: Resetting bearer [ 992.286568][T10734] tipc: Disabling bearer [ 992.305910][T10744] __nla_validate_parse: 6 callbacks suppressed [ 992.305931][T10744] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15385'. [ 992.359003][T10753] bond23: Unable to set peer notification delay as MII monitoring is disabled [ 992.374238][T10753] bond23 (unregistering): Released all slaves [ 992.566528][T10767] vlan4: entered promiscuous mode [ 992.602643][T10765] syzkaller0: entered promiscuous mode [ 992.613499][T10765] syzkaller0: entered allmulticast mode [ 992.626335][T10774] FAULT_INJECTION: forcing a failure. [ 992.626335][T10774] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 992.670397][T10774] CPU: 0 UID: 0 PID: 10774 Comm: syz.1.15397 Not tainted syzkaller #0 PREEMPT(full) [ 992.670424][T10774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 992.670435][T10774] Call Trace: [ 992.670443][T10774] [ 992.670452][T10774] dump_stack_lvl+0xe8/0x150 [ 992.670485][T10774] should_fail_ex+0x40c/0x560 [ 992.670511][T10774] _copy_from_iter+0x1d3/0x1660 [ 992.670536][T10774] ? trace_kmem_cache_alloc+0x29/0xe0 [ 992.670562][T10774] ? kmem_cache_alloc_noprof+0x308/0x5f0 [ 992.670582][T10774] ? kmem_cache_alloc_noprof+0x150/0x5f0 [ 992.670602][T10774] ? __build_skb+0x62/0x440 [ 992.670625][T10774] ? __build_skb+0x62/0x440 [ 992.670648][T10774] ? __pfx__copy_from_iter+0x10/0x10 [ 992.670674][T10774] ? __build_skb+0x2a2/0x440 [ 992.670696][T10774] ? netlink_sendmsg+0x650/0xb40 [ 992.670712][T10774] ? skb_put+0x112/0x210 [ 992.670737][T10774] netlink_sendmsg+0x6c0/0xb40 [ 992.670764][T10774] ? __pfx_netlink_sendmsg+0x10/0x10 [ 992.670784][T10774] ? aa_sock_msg_perm+0xf1/0x1b0 [ 992.670808][T10774] ? __pfx_netlink_sendmsg+0x10/0x10 [ 992.670824][T10774] sock_sendmsg_nosec+0x13a/0x180 [ 992.670850][T10774] ____sys_sendmsg+0x54e/0x850 [ 992.670884][T10774] ? __pfx_____sys_sendmsg+0x10/0x10 [ 992.670919][T10774] ? import_iovec+0x73/0xa0 [ 992.670948][T10774] ___sys_sendmsg+0x2a5/0x360 [ 992.670975][T10774] ? __lock_acquire+0x683/0x2cf0 [ 992.671001][T10774] ? __pfx____sys_sendmsg+0x10/0x10 [ 992.671119][T10774] ? __fget_files+0x2a/0x420 [ 992.671140][T10774] ? __fget_files+0x3a2/0x420 [ 992.671173][T10774] __x64_sys_sendmsg+0x1b1/0x290 [ 992.671201][T10774] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 992.671246][T10774] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.671267][T10774] do_syscall_64+0x174/0x580 [ 992.671292][T10774] ? trace_irq_disable+0x3b/0x140 [ 992.671316][T10774] ? clear_bhb_loop+0x40/0x90 [ 992.671340][T10774] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.671359][T10774] RIP: 0033:0x7ff1cc39de59 [ 992.671378][T10774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 992.671395][T10774] RSP: 002b:00007ff1ca5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 992.671417][T10774] RAX: ffffffffffffffda RBX: 00007ff1cc625fa0 RCX: 00007ff1cc39de59 [ 992.671431][T10774] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 992.671445][T10774] RBP: 00007ff1ca5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 992.671458][T10774] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 992.671470][T10774] R13: 00007ff1cc626038 R14: 00007ff1cc625fa0 R15: 00007ffd2e579e08 [ 992.671502][T10774] [ 992.729034][T10779] netlink: 260 bytes leftover after parsing attributes in process `syz.0.15400'. [ 992.889315][T10784] netlink: 'syz.2.15402': attribute type 1 has an invalid length. [ 993.028745][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.155163][T10797] bond21: Unable to set peer notification delay as MII monitoring is disabled [ 993.171101][T10797] bond21 (unregistering): Released all slaves [ 993.212337][T10803] netlink: zone id is out of range [ 993.218395][T10803] netlink: zone id is out of range [ 993.319427][T10807] netlink: 108 bytes leftover after parsing attributes in process `syz.2.15408'. [ 993.330279][T10807] netlink: 108 bytes leftover after parsing attributes in process `syz.2.15408'. [ 993.342264][T10807] netlink: 84 bytes leftover after parsing attributes in process `syz.2.15408'. [ 993.353632][T10809] netlink: 'syz.1.15409': attribute type 4 has an invalid length. [ 993.409820][T10811] netlink: 'syz.2.15410': attribute type 2 has an invalid length. [ 993.421366][T10811] FAULT_INJECTION: forcing a failure. [ 993.421366][T10811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 993.454636][T10811] CPU: 0 UID: 0 PID: 10811 Comm: syz.2.15410 Not tainted syzkaller #0 PREEMPT(full) [ 993.454662][T10811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 993.454673][T10811] Call Trace: [ 993.454681][T10811] [ 993.454689][T10811] dump_stack_lvl+0xe8/0x150 [ 993.454720][T10811] should_fail_ex+0x40c/0x560 [ 993.454742][T10811] _copy_to_user+0x31/0xb0 [ 993.454768][T10811] simple_read_from_buffer+0xe1/0x170 [ 993.454802][T10811] proc_fail_nth_read+0x1bb/0x230 [ 993.454826][T10811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 993.454849][T10811] ? rw_verify_area+0x24a/0x4c0 [ 993.454873][T10811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 993.454892][T10811] vfs_read+0x213/0xa80 [ 993.454918][T10811] ? __pfx___mutex_lock+0x10/0x10 [ 993.454942][T10811] ? __pfx_vfs_read+0x10/0x10 [ 993.454965][T10811] ? __fget_files+0x2a/0x420 [ 993.454987][T10811] ? __fget_files+0x3a2/0x420 [ 993.455006][T10811] ? __fget_files+0x2a/0x420 [ 993.455031][T10811] ksys_read+0x150/0x270 [ 993.455055][T10811] ? __pfx_ksys_read+0x10/0x10 [ 993.455083][T10811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.455101][T10811] do_syscall_64+0x174/0x580 [ 993.455121][T10811] ? trace_irq_disable+0x3b/0x140 [ 993.455140][T10811] ? clear_bhb_loop+0x40/0x90 [ 993.455161][T10811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 993.455177][T10811] RIP: 0033:0x7f42f1d5e68e [ 993.455191][T10811] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 993.455205][T10811] RSP: 002b:00007f42efff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 993.455222][T10811] RAX: ffffffffffffffda RBX: 00007f42efff66c0 RCX: 00007f42f1d5e68e [ 993.455233][T10811] RDX: 000000000000000f RSI: 00007f42efff60a0 RDI: 0000000000000004 [ 993.455243][T10811] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 993.455253][T10811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 993.455262][T10811] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 993.455289][T10811] [ 993.772579][T10827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15415'. [ 993.863778][T10833] macvlan0: entered promiscuous mode [ 994.002331][T10843] netlink: 108 bytes leftover after parsing attributes in process `syz.0.15420'. [ 994.041955][T10843] netlink: 108 bytes leftover after parsing attributes in process `syz.0.15420'. [ 994.065372][T10843] netlink: 84 bytes leftover after parsing attributes in process `syz.0.15420'. [ 994.085243][T10845] tipc: Enabled bearer , priority 0 [ 994.104110][T10847] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15422'. [ 994.305667][T10860] syzkaller0: entered promiscuous mode [ 994.330255][T10860] syzkaller0: entered allmulticast mode [ 994.732270][T10885] FAULT_INJECTION: forcing a failure. [ 994.732270][T10885] name failslab, interval 1, probability 0, space 0, times 0 [ 994.798868][T10885] CPU: 1 UID: 0 PID: 10885 Comm: syz.2.15433 Not tainted syzkaller #0 PREEMPT(full) [ 994.798896][T10885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 994.798907][T10885] Call Trace: [ 994.798915][T10885] [ 994.798925][T10885] dump_stack_lvl+0xe8/0x150 [ 994.798958][T10885] should_fail_ex+0x40c/0x560 [ 994.798987][T10885] should_failslab+0xa8/0x100 [ 994.799016][T10885] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 994.799044][T10885] ? __alloc_skb+0x1d7/0x7a0 [ 994.799068][T10885] ? __alloc_skb+0x1d7/0x7a0 [ 994.799093][T10885] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 994.799132][T10885] __alloc_skb+0x1d7/0x7a0 [ 994.799162][T10885] tipc_msg_build+0x15f/0xf50 [ 994.799193][T10885] ? stack_trace_save+0xa9/0x100 [ 994.799222][T10885] ? stack_depot_save_flags+0x33/0x800 [ 994.799245][T10885] ? __pfx_tipc_msg_build+0x10/0x10 [ 994.799278][T10885] ? __kasan_slab_free+0x5c/0x80 [ 994.799301][T10885] ? kmem_cache_free+0x182/0x650 [ 994.799323][T10885] ? tipc_accept+0xb41/0x1330 [ 994.799346][T10885] ? do_accept+0x521/0x750 [ 994.799369][T10885] ? __x64_sys_accept4+0x9a/0xb0 [ 994.799392][T10885] ? do_syscall_64+0x174/0x580 [ 994.799417][T10885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.799442][T10885] __tipc_sendstream+0x8f4/0x12a0 [ 994.799504][T10885] ? __pfx___tipc_sendstream+0x10/0x10 [ 994.799528][T10885] ? kasan_quarantine_put+0xbb/0x1f0 [ 994.799551][T10885] ? __pfx_woken_wake_function+0x10/0x10 [ 994.799579][T10885] ? __asan_memset+0x22/0x50 [ 994.799600][T10885] ? iov_iter_kvec+0xb8/0x180 [ 994.799629][T10885] tipc_accept+0xef0/0x1330 [ 994.799666][T10885] ? __pfx_tipc_accept+0x10/0x10 [ 994.799690][T10885] ? __pfx_woken_wake_function+0x10/0x10 [ 994.799730][T10885] ? apparmor_socket_accept+0xee/0x1b0 [ 994.799854][T10885] do_accept+0x521/0x750 [ 994.799885][T10885] ? __pfx_do_accept+0x10/0x10 [ 994.799936][T10885] __sys_accept4+0x139/0x230 [ 994.799964][T10885] ? __pfx___sys_accept4+0x10/0x10 [ 994.799989][T10885] ? __pfx_ksys_write+0x10/0x10 [ 994.800025][T10885] __x64_sys_accept4+0x9a/0xb0 [ 994.800050][T10885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.800071][T10885] do_syscall_64+0x174/0x580 [ 994.800096][T10885] ? trace_irq_disable+0x3b/0x140 [ 994.800126][T10885] ? clear_bhb_loop+0x40/0x90 [ 994.800150][T10885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 994.800169][T10885] RIP: 0033:0x7f42f1d9de59 [ 994.800187][T10885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 994.800204][T10885] RSP: 002b:00007f42efff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 994.800225][T10885] RAX: ffffffffffffffda RBX: 00007f42f2025fa0 RCX: 00007f42f1d9de59 [ 994.800239][T10885] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 994.800251][T10885] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 994.800263][T10885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 994.800275][T10885] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 994.800308][T10885] [ 994.802577][T10893] syzkaller0: entered promiscuous mode [ 994.994272][T10903] netlink: zone id is out of range [ 995.013190][T10893] syzkaller0: entered allmulticast mode [ 995.063913][T10903] netlink: zone id is out of range [ 995.093118][T10895] tipc: Enabling of bearer rejected, already enabled [ 995.102297][T10903] netlink: zone id is out of range [ 995.174188][T10903] netlink: zone id is out of range [ 995.179742][T10903] netlink: zone id is out of range [ 995.208002][T10903] netlink: zone id is out of range [ 995.215790][T10903] netlink: zone id is out of range [ 995.220965][T10903] netlink: zone id is out of range [ 995.354254][T10911] netlink: 'syz.1.15443': attribute type 17 has an invalid length. [ 995.368677][T10913] syzkaller0: entered promiscuous mode [ 995.383877][T10913] syzkaller0: entered allmulticast mode [ 995.577248][T10931] Cannot find add_set index 46338 as target [ 995.703228][T10938] tipc: Enabling of bearer rejected, failed to enable media [ 995.770550][T10940] syzkaller0: entered promiscuous mode [ 995.783084][T10940] syzkaller0: entered allmulticast mode [ 996.263782][T10972] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 996.426734][T10984] ipip1: entered promiscuous mode [ 996.435016][T10984] ipip1: entered allmulticast mode [ 996.788687][T11009] netlink: 'syz.3.15482': attribute type 3 has an invalid length. [ 996.981598][T11021] x_tables: duplicate underflow at hook 2 [ 997.344859][T11042] ieee802154 phy0 wpan0: encryption failed: -22 [ 997.363161][T11042] __nla_validate_parse: 17 callbacks suppressed [ 997.363180][T11042] netlink: 144 bytes leftover after parsing attributes in process `syz.2.15493'. [ 997.426789][T11042] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15493'. [ 997.600578][T11065] xt_CT: You must specify a L4 protocol and not use inversions on it [ 998.043336][T11088] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15508'. [ 998.149610][T11093] netlink: 'syz.0.15510': attribute type 62 has an invalid length. [ 998.313050][T11096] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15511'. [ 998.431649][T11105] netlink: 72 bytes leftover after parsing attributes in process `syz.3.15514'. [ 998.476547][T11105] netlink: 72 bytes leftover after parsing attributes in process `syz.3.15514'. [ 998.660605][T11125] tipc: Enabling of bearer rejected, failed to enable media [ 998.985245][T11140] netlink: 'syz.4.15524': attribute type 11 has an invalid length. [ 999.015936][T11144] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15526'. [ 999.240602][T11155] RDS: rds_bind could not find a transport for fe88::1, load rds_tcp or rds_rdma? [ 999.429950][T11163] xt_connbytes: Forcing CT accounting to be enabled [ 999.447819][T11163] Cannot find set identified by id 65534 to match [ 999.470328][T11164] tipc: Enabling of bearer rejected, already enabled [ 999.646688][T11184] FAULT_INJECTION: forcing a failure. [ 999.646688][T11184] name failslab, interval 1, probability 0, space 0, times 0 [ 999.655529][T11179] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15538'. [ 999.661808][T11184] CPU: 0 UID: 0 PID: 11184 Comm: syz.2.15539 Not tainted syzkaller #0 PREEMPT(full) [ 999.661834][T11184] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 999.661861][T11184] Call Trace: [ 999.661869][T11184] [ 999.661877][T11184] dump_stack_lvl+0xe8/0x150 [ 999.661911][T11184] should_fail_ex+0x40c/0x560 [ 999.661938][T11184] should_failslab+0xa8/0x100 [ 999.661966][T11184] __kmalloc_cache_noprof+0xa8/0x660 [ 999.661991][T11184] ? __kmalloc_cache_noprof+0x150/0x660 [ 999.662013][T11184] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 999.662122][T11184] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 999.662147][T11184] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 999.662181][T11184] genl_family_rcv_msg_doit+0x233/0x340 [ 999.662213][T11184] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 999.662248][T11184] ? bpf_lsm_capable+0x9/0x20 [ 999.662271][T11184] ? security_capable+0x7e/0x2c0 [ 999.662305][T11184] genl_rcv_msg+0x614/0x7a0 [ 999.662334][T11184] ? __pfx_genl_rcv_msg+0x10/0x10 [ 999.662356][T11184] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 999.662390][T11184] netlink_rcv_skb+0x226/0x4a0 [ 999.662419][T11184] ? __pfx_genl_rcv_msg+0x10/0x10 [ 999.662442][T11184] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 999.662486][T11184] ? down_read+0x2be/0x330 [ 999.662507][T11184] genl_rcv+0x28/0x40 [ 999.662528][T11184] netlink_unicast+0x7bb/0x940 [ 999.662564][T11184] netlink_sendmsg+0x813/0xb40 [ 999.662593][T11184] ? __pfx_netlink_sendmsg+0x10/0x10 [ 999.662622][T11184] ? aa_sock_msg_perm+0xf1/0x1b0 [ 999.662647][T11184] ? __pfx_netlink_sendmsg+0x10/0x10 [ 999.662664][T11184] sock_sendmsg_nosec+0x13a/0x180 [ 999.662690][T11184] ____sys_sendmsg+0x54e/0x850 [ 999.662727][T11184] ? __pfx_____sys_sendmsg+0x10/0x10 [ 999.662763][T11184] ? import_iovec+0x73/0xa0 [ 999.662793][T11184] ___sys_sendmsg+0x2a5/0x360 [ 999.662819][T11184] ? __lock_acquire+0x683/0x2cf0 [ 999.662849][T11184] ? __pfx____sys_sendmsg+0x10/0x10 [ 999.662914][T11184] ? __fget_files+0x2a/0x420 [ 999.662937][T11184] ? __fget_files+0x3a2/0x420 [ 999.662970][T11184] __x64_sys_sendmsg+0x1b1/0x290 [ 999.663001][T11184] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 999.663046][T11184] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 999.663067][T11184] do_syscall_64+0x174/0x580 [ 999.663092][T11184] ? trace_irq_disable+0x3b/0x140 [ 999.663115][T11184] ? clear_bhb_loop+0x40/0x90 [ 999.663137][T11184] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 999.663156][T11184] RIP: 0033:0x7f42f1d9de59 [ 999.663174][T11184] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 999.663190][T11184] RSP: 002b:00007f42efff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 999.663209][T11184] RAX: ffffffffffffffda RBX: 00007f42f2025fa0 RCX: 00007f42f1d9de59 [ 999.663223][T11184] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 999.663235][T11184] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 999.663247][T11184] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 999.663258][T11184] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 999.663288][T11184] [ 999.746686][T11187] netlink: 'syz.0.15540': attribute type 4 has an invalid length. [ 999.765102][T11190] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15541'. [ 999.872434][T11194] netlink: 'syz.0.15540': attribute type 4 has an invalid length. [ 999.954464][T11198] FAULT_INJECTION: forcing a failure. [ 999.954464][T11198] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1000.035968][T11198] CPU: 1 UID: 0 PID: 11198 Comm: syz.4.15543 Not tainted syzkaller #0 PREEMPT(full) [ 1000.035995][T11198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1000.036006][T11198] Call Trace: [ 1000.036014][T11198] [ 1000.036022][T11198] dump_stack_lvl+0xe8/0x150 [ 1000.036056][T11198] should_fail_ex+0x40c/0x560 [ 1000.036093][T11198] _copy_from_user+0x2d/0xb0 [ 1000.036121][T11198] kstrtouint_from_user+0xd6/0x180 [ 1000.036148][T11198] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1000.036188][T11198] proc_fail_nth_write+0x8e/0x210 [ 1000.036215][T11198] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1000.036249][T11198] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1000.036274][T11198] vfs_write+0x296/0xba0 [ 1000.036311][T11198] ? __pfx_vfs_write+0x10/0x10 [ 1000.036341][T11198] ? __fget_files+0x2a/0x420 [ 1000.036370][T11198] ? __fget_files+0x3a2/0x420 [ 1000.036392][T11198] ? __fget_files+0x2a/0x420 [ 1000.036426][T11198] ksys_write+0x150/0x270 [ 1000.036456][T11198] ? __pfx_ksys_write+0x10/0x10 [ 1000.036493][T11198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1000.036514][T11198] do_syscall_64+0x174/0x580 [ 1000.036540][T11198] ? trace_irq_disable+0x3b/0x140 [ 1000.036564][T11198] ? clear_bhb_loop+0x40/0x90 [ 1000.036587][T11198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1000.036606][T11198] RIP: 0033:0x7fe411b5e68e [ 1000.036624][T11198] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1000.036641][T11198] RSP: 002b:00007fe412ae4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1000.036661][T11198] RAX: ffffffffffffffda RBX: 00007fe412ae56c0 RCX: 00007fe411b5e68e [ 1000.036674][T11198] RDX: 0000000000000001 RSI: 00007fe412ae50a0 RDI: 000000000000000b [ 1000.036687][T11198] RBP: 00007fe412ae5090 R08: 0000000000000000 R09: 0000000000000000 [ 1000.036699][T11198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1000.036710][T11198] R13: 00007fe411e26128 R14: 00007fe411e26090 R15: 00007ffed04dc918 [ 1000.036742][T11198] [ 1000.409680][T11210] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15548'. [ 1000.480712][T11219] FAULT_INJECTION: forcing a failure. [ 1000.480712][T11219] name failslab, interval 1, probability 0, space 0, times 0 [ 1000.494196][T11219] CPU: 0 UID: 0 PID: 11219 Comm: syz.4.15551 Not tainted syzkaller #0 PREEMPT(full) [ 1000.494221][T11219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1000.494229][T11219] Call Trace: [ 1000.494234][T11219] [ 1000.494238][T11219] dump_stack_lvl+0xe8/0x150 [ 1000.494261][T11219] should_fail_ex+0x40c/0x560 [ 1000.494277][T11219] should_failslab+0xa8/0x100 [ 1000.494294][T11219] __kmalloc_cache_noprof+0xa8/0x660 [ 1000.494309][T11219] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1000.494320][T11219] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1000.494334][T11219] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1000.494352][T11219] genl_family_rcv_msg_doit+0x233/0x340 [ 1000.494370][T11219] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1000.494390][T11219] ? bpf_lsm_capable+0x9/0x20 [ 1000.494404][T11219] ? security_capable+0x7e/0x2c0 [ 1000.494424][T11219] genl_rcv_msg+0x614/0x7a0 [ 1000.494440][T11219] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1000.494452][T11219] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 1000.494470][T11219] netlink_rcv_skb+0x226/0x4a0 [ 1000.494487][T11219] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1000.494500][T11219] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1000.494524][T11219] ? down_read+0x2be/0x330 [ 1000.494537][T11219] genl_rcv+0x28/0x40 [ 1000.494548][T11219] netlink_unicast+0x7bb/0x940 [ 1000.494568][T11219] netlink_sendmsg+0x813/0xb40 [ 1000.494583][T11219] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1000.494596][T11219] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1000.494609][T11219] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1000.494618][T11219] sock_sendmsg_nosec+0x13a/0x180 [ 1000.494632][T11219] ____sys_sendmsg+0x54e/0x850 [ 1000.494652][T11219] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1000.494673][T11219] ? import_iovec+0x73/0xa0 [ 1000.494690][T11219] ___sys_sendmsg+0x2a5/0x360 [ 1000.494705][T11219] ? __lock_acquire+0x683/0x2cf0 [ 1000.494724][T11219] ? __pfx____sys_sendmsg+0x10/0x10 [ 1000.494758][T11219] ? __fget_files+0x2a/0x420 [ 1000.494772][T11219] ? __fget_files+0x3a2/0x420 [ 1000.494791][T11219] __x64_sys_sendmsg+0x1b1/0x290 [ 1000.494808][T11219] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1000.494840][T11219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1000.494860][T11219] do_syscall_64+0x174/0x580 [ 1000.494888][T11219] ? clear_bhb_loop+0x40/0x90 [ 1000.494911][T11219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1000.494928][T11219] RIP: 0033:0x7fe411b9de59 [ 1000.494946][T11219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1000.494960][T11219] RSP: 002b:00007fe412b06028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1000.494979][T11219] RAX: ffffffffffffffda RBX: 00007fe411e25fa0 RCX: 00007fe411b9de59 [ 1000.494992][T11219] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1000.495004][T11219] RBP: 00007fe412b06090 R08: 0000000000000000 R09: 0000000000000000 [ 1000.495012][T11219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1000.495018][T11219] R13: 00007fe411e26038 R14: 00007fe411e25fa0 R15: 00007ffed04dc918 [ 1000.495036][T11219] [ 1000.829777][T11222] net_ratelimit: 6 callbacks suppressed [ 1000.829795][T11222] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 1000.887077][T11224] netlink: zone id is out of range [ 1000.892270][T11224] netlink: zone id is out of range [ 1000.897536][T11224] netlink: zone id is out of range [ 1000.902687][T11224] netlink: zone id is out of range [ 1000.907865][T11224] netlink: zone id is out of range [ 1000.913877][T11224] netlink: zone id is out of range [ 1000.919020][T11224] netlink: zone id is out of range [ 1000.924169][T11224] netlink: zone id is out of range [ 1000.929311][T11224] netlink: zone id is out of range [ 1001.070661][T11232] netlink: 'syz.4.15557': attribute type 39 has an invalid length. [ 1001.079441][T11232] hsr_slave_0: left promiscuous mode [ 1001.085974][T11232] hsr_slave_1: left promiscuous mode [ 1002.393346][T11163] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1002.594964][T11248] __nla_validate_parse: 2 callbacks suppressed [ 1002.594982][T11248] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15562'. [ 1002.630302][T11248] netlink: 2 bytes leftover after parsing attributes in process `syz.3.15562'. [ 1002.654883][T11248] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15562'. [ 1002.739289][T30376] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1002.767640][T30376] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1002.791212][T11262] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1002.796746][T11267] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1003.149431][T11285] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15573'. [ 1003.281072][T11295] syzkaller0: entered promiscuous mode [ 1003.288013][T11295] syzkaller0: entered allmulticast mode [ 1003.563905][T11304] x_tables: duplicate underflow at hook 1 [ 1003.648622][T11314] FAULT_INJECTION: forcing a failure. [ 1003.648622][T11314] name failslab, interval 1, probability 0, space 0, times 0 [ 1003.661868][T11314] CPU: 0 UID: 0 PID: 11314 Comm: syz.3.15587 Not tainted syzkaller #0 PREEMPT(full) [ 1003.661895][T11314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1003.661907][T11314] Call Trace: [ 1003.661915][T11314] [ 1003.661924][T11314] dump_stack_lvl+0xe8/0x150 [ 1003.661959][T11314] should_fail_ex+0x40c/0x560 [ 1003.661988][T11314] should_failslab+0xa8/0x100 [ 1003.662017][T11314] __kmalloc_node_noprof+0x105/0x740 [ 1003.662043][T11314] ? __pfx___up_read+0x10/0x10 [ 1003.662062][T11314] ? crypto_create_tfm_node+0x81/0x3c0 [ 1003.662172][T11314] ? crypto_create_tfm_node+0x81/0x3c0 [ 1003.662208][T11314] crypto_create_tfm_node+0x81/0x3c0 [ 1003.662239][T11314] crypto_spawn_tfm2+0x5c/0x90 [ 1003.662291][T11314] lskcipher_init_tfm_simple+0x42/0x90 [ 1003.662346][T11314] crypto_create_tfm_node+0x143/0x3c0 [ 1003.662378][T11314] crypto_init_lskcipher_ops_sg+0x5b/0xe0 [ 1003.662409][T11314] crypto_create_tfm_node+0x143/0x3c0 [ 1003.662446][T11314] crypto_spawn_tfm2+0x5c/0x90 [ 1003.662470][T11314] crypto_authenc_init_tfm+0x69/0x1c0 [ 1003.662541][T11314] crypto_create_tfm_node+0x143/0x3c0 [ 1003.662574][T11314] crypto_spawn_tfm2+0x5c/0x90 [ 1003.662597][T11314] aead_init_geniv+0xa6/0x170 [ 1003.662627][T11314] crypto_create_tfm_node+0x143/0x3c0 [ 1003.662660][T11314] crypto_alloc_tfm_node+0x169/0x3e0 [ 1003.662698][T11314] esp_init_state+0x615/0x1220 [ 1003.662773][T11314] ? ____sys_sendmsg+0x54e/0x850 [ 1003.662797][T11314] ? ___sys_sendmsg+0x2a5/0x360 [ 1003.662822][T11314] ? __x64_sys_sendmsg+0x1b1/0x290 [ 1003.662860][T11314] ? __pfx_esp_init_state+0x10/0x10 [ 1003.662897][T11314] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1003.662944][T11314] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1003.662972][T11314] ? __xfrm_init_state+0x745/0x12c0 [ 1003.663029][T11314] __xfrm_init_state+0x9dd/0x12c0 [ 1003.663052][T11314] ? __xfrm_init_state+0x745/0x12c0 [ 1003.663078][T11314] xfrm_init_state+0x1e/0xa0 [ 1003.663102][T11314] pfkey_add+0x1d71/0x2e50 [ 1003.663185][T11314] ? __pfx_pfkey_add+0x10/0x10 [ 1003.663220][T11314] pfkey_sendmsg+0xceb/0x11d0 [ 1003.663256][T11314] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1003.663297][T11314] ? __pfx_aa_sk_perm+0x10/0x10 [ 1003.663328][T11314] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1003.663351][T11314] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1003.663373][T11314] sock_sendmsg_nosec+0x13a/0x180 [ 1003.663397][T11314] ____sys_sendmsg+0x54e/0x850 [ 1003.663429][T11314] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1003.663463][T11314] ? import_iovec+0x73/0xa0 [ 1003.663490][T11314] ___sys_sendmsg+0x2a5/0x360 [ 1003.663515][T11314] ? __lock_acquire+0x683/0x2cf0 [ 1003.663543][T11314] ? __pfx____sys_sendmsg+0x10/0x10 [ 1003.663603][T11314] ? __fget_files+0x2a/0x420 [ 1003.663625][T11314] ? __fget_files+0x3a2/0x420 [ 1003.663662][T11314] __x64_sys_sendmsg+0x1b1/0x290 [ 1003.663689][T11314] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1003.663741][T11314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1003.663762][T11314] do_syscall_64+0x174/0x580 [ 1003.663788][T11314] ? trace_irq_disable+0x3b/0x140 [ 1003.663812][T11314] ? clear_bhb_loop+0x40/0x90 [ 1003.663836][T11314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1003.663856][T11314] RIP: 0033:0x7fc956f9de59 [ 1003.663875][T11314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1003.663892][T11314] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1003.663912][T11314] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1003.663927][T11314] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1003.663939][T11314] RBP: 00007fc957dd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1003.663951][T11314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1003.663963][T11314] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1003.663996][T11314] [ 1004.288348][T11329] syzkaller0: entered promiscuous mode [ 1004.294904][T11329] syzkaller0: entered allmulticast mode [ 1004.373566][T11331] netlink: 140 bytes leftover after parsing attributes in process `syz.0.15595'. [ 1004.552882][T11343] FAULT_INJECTION: forcing a failure. [ 1004.552882][T11343] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.623933][T11343] CPU: 1 UID: 0 PID: 11343 Comm: syz.3.15601 Not tainted syzkaller #0 PREEMPT(full) [ 1004.623962][T11343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1004.623975][T11343] Call Trace: [ 1004.623983][T11343] [ 1004.623993][T11343] dump_stack_lvl+0xe8/0x150 [ 1004.624028][T11343] should_fail_ex+0x40c/0x560 [ 1004.624057][T11343] should_failslab+0xa8/0x100 [ 1004.624088][T11343] __kmalloc_cache_noprof+0xa8/0x660 [ 1004.624115][T11343] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1004.624144][T11343] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1004.624172][T11343] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1004.624208][T11343] genl_family_rcv_msg_doit+0x233/0x340 [ 1004.624242][T11343] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1004.624280][T11343] ? bpf_lsm_capable+0x9/0x20 [ 1004.624304][T11343] ? security_capable+0x7e/0x2c0 [ 1004.624341][T11343] genl_rcv_msg+0x614/0x7a0 [ 1004.624372][T11343] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1004.624395][T11343] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 1004.624418][T11343] ? __pfx_ref_tracker_free+0x10/0x10 [ 1004.624453][T11343] netlink_rcv_skb+0x226/0x4a0 [ 1004.624484][T11343] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1004.624510][T11343] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1004.624556][T11343] ? down_read+0x2be/0x330 [ 1004.624580][T11343] genl_rcv+0x28/0x40 [ 1004.624601][T11343] netlink_unicast+0x7bb/0x940 [ 1004.624638][T11343] netlink_sendmsg+0x813/0xb40 [ 1004.624665][T11343] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1004.624688][T11343] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1004.624711][T11343] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1004.624726][T11343] sock_sendmsg_nosec+0x13a/0x180 [ 1004.624752][T11343] ____sys_sendmsg+0x54e/0x850 [ 1004.624787][T11343] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1004.624820][T11343] ? import_iovec+0x73/0xa0 [ 1004.624846][T11343] ___sys_sendmsg+0x2a5/0x360 [ 1004.624869][T11343] ? __lock_acquire+0x683/0x2cf0 [ 1004.624896][T11343] ? __pfx____sys_sendmsg+0x10/0x10 [ 1004.624952][T11343] ? __fget_files+0x2a/0x420 [ 1004.624977][T11343] ? __fget_files+0x3a2/0x420 [ 1004.625009][T11343] __x64_sys_sendmsg+0x1b1/0x290 [ 1004.625039][T11343] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1004.625084][T11343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.625104][T11343] do_syscall_64+0x174/0x580 [ 1004.625129][T11343] ? trace_irq_disable+0x3b/0x140 [ 1004.625160][T11343] ? clear_bhb_loop+0x40/0x90 [ 1004.625183][T11343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.625200][T11343] RIP: 0033:0x7fc956f9de59 [ 1004.625218][T11343] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.625235][T11343] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1004.625254][T11343] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1004.625268][T11343] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1004.625280][T11343] RBP: 00007fc957dd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.625291][T11343] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1004.625303][T11343] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1004.625333][T11343] [ 1004.657610][T11347] netlink: 64 bytes leftover after parsing attributes in process `syz.2.15602'. [ 1004.698884][T11348] FAULT_INJECTION: forcing a failure. [ 1004.698884][T11348] name failslab, interval 1, probability 0, space 0, times 0 [ 1004.906359][T11347] syzkaller1: entered promiscuous mode [ 1004.917459][T11348] CPU: 1 UID: 0 PID: 11348 Comm: syz.1.15603 Not tainted syzkaller #0 PREEMPT(full) [ 1004.917486][T11348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1004.917498][T11348] Call Trace: [ 1004.917505][T11348] [ 1004.917514][T11348] dump_stack_lvl+0xe8/0x150 [ 1004.917548][T11348] should_fail_ex+0x40c/0x560 [ 1004.917575][T11348] should_failslab+0xa8/0x100 [ 1004.917600][T11348] __kmalloc_noprof+0xfe/0x720 [ 1004.917620][T11348] ? crypto_alloc_tfm_node+0x3b5/0x3e0 [ 1004.917649][T11348] ? esp_init_state+0x740/0x1220 [ 1004.917670][T11348] ? esp_init_state+0x740/0x1220 [ 1004.917699][T11348] esp_init_state+0x740/0x1220 [ 1004.917719][T11348] ? ____sys_sendmsg+0x54e/0x850 [ 1004.917746][T11348] ? ___sys_sendmsg+0x2a5/0x360 [ 1004.917784][T11348] ? __x64_sys_sendmsg+0x1b1/0x290 [ 1004.917820][T11348] ? __pfx_esp_init_state+0x10/0x10 [ 1004.917856][T11348] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1004.917874][T11348] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 1004.917903][T11348] ? __xfrm_init_state+0x745/0x12c0 [ 1004.917935][T11348] __xfrm_init_state+0x9dd/0x12c0 [ 1004.917962][T11348] ? __xfrm_init_state+0x745/0x12c0 [ 1004.917990][T11348] xfrm_init_state+0x1e/0xa0 [ 1004.918015][T11348] pfkey_add+0x1d71/0x2e50 [ 1004.918059][T11348] ? __pfx_pfkey_add+0x10/0x10 [ 1004.918097][T11348] pfkey_sendmsg+0xceb/0x11d0 [ 1004.918145][T11348] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1004.918188][T11348] ? __pfx_aa_sk_perm+0x10/0x10 [ 1004.918220][T11348] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1004.918244][T11348] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 1004.918268][T11348] sock_sendmsg_nosec+0x13a/0x180 [ 1004.918293][T11348] ____sys_sendmsg+0x54e/0x850 [ 1004.918326][T11348] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1004.918362][T11348] ? import_iovec+0x73/0xa0 [ 1004.918390][T11348] ___sys_sendmsg+0x2a5/0x360 [ 1004.918417][T11348] ? __lock_acquire+0x683/0x2cf0 [ 1004.918447][T11348] ? __pfx____sys_sendmsg+0x10/0x10 [ 1004.918510][T11348] ? __fget_files+0x2a/0x420 [ 1004.918533][T11348] ? __fget_files+0x3a2/0x420 [ 1004.918568][T11348] __x64_sys_sendmsg+0x1b1/0x290 [ 1004.918597][T11348] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1004.918643][T11348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.918664][T11348] do_syscall_64+0x174/0x580 [ 1004.918690][T11348] ? trace_irq_disable+0x3b/0x140 [ 1004.918713][T11348] ? clear_bhb_loop+0x40/0x90 [ 1004.918736][T11348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1004.918755][T11348] RIP: 0033:0x7ff1cc39de59 [ 1004.918774][T11348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.918790][T11348] RSP: 002b:00007ff1ca5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1004.918810][T11348] RAX: ffffffffffffffda RBX: 00007ff1cc625fa0 RCX: 00007ff1cc39de59 [ 1004.918824][T11348] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1004.918836][T11348] RBP: 00007ff1ca5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.918848][T11348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1004.918859][T11348] R13: 00007ff1cc626038 R14: 00007ff1cc625fa0 R15: 00007ffd2e579e08 [ 1004.918891][T11348] [ 1005.183766][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1005.183829][ C0] bridge0: topology change detected, propagating [ 1005.185928][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1005.185951][ C0] bridge0: topology change detected, propagating [ 1005.327459][T11347] syzkaller1: entered allmulticast mode [ 1005.616687][T11384] FAULT_INJECTION: forcing a failure. [ 1005.616687][T11384] name failslab, interval 1, probability 0, space 0, times 0 [ 1005.629754][T11384] CPU: 1 UID: 0 PID: 11384 Comm: syz.3.15615 Not tainted syzkaller #0 PREEMPT(full) [ 1005.629780][T11384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1005.629791][T11384] Call Trace: [ 1005.629799][T11384] [ 1005.629807][T11384] dump_stack_lvl+0xe8/0x150 [ 1005.629842][T11384] should_fail_ex+0x40c/0x560 [ 1005.629869][T11384] should_failslab+0xa8/0x100 [ 1005.629899][T11384] __kmalloc_cache_noprof+0xa8/0x660 [ 1005.629925][T11384] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1005.629944][T11384] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1005.629968][T11384] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1005.630006][T11384] genl_family_rcv_msg_doit+0x233/0x340 [ 1005.630035][T11384] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1005.630069][T11384] ? bpf_lsm_capable+0x9/0x20 [ 1005.630089][T11384] ? security_capable+0x7e/0x2c0 [ 1005.630120][T11384] genl_rcv_msg+0x614/0x7a0 [ 1005.630149][T11384] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1005.630168][T11384] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 1005.630189][T11384] ? __pfx_ref_tracker_free+0x10/0x10 [ 1005.630221][T11384] netlink_rcv_skb+0x226/0x4a0 [ 1005.630248][T11384] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1005.630270][T11384] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1005.630309][T11384] ? down_read+0x2be/0x330 [ 1005.630330][T11384] genl_rcv+0x28/0x40 [ 1005.630349][T11384] netlink_unicast+0x7bb/0x940 [ 1005.630384][T11384] netlink_sendmsg+0x813/0xb40 [ 1005.630412][T11384] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1005.630434][T11384] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1005.630458][T11384] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1005.630475][T11384] sock_sendmsg_nosec+0x13a/0x180 [ 1005.630499][T11384] ____sys_sendmsg+0x54e/0x850 [ 1005.630532][T11384] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1005.630567][T11384] ? import_iovec+0x73/0xa0 [ 1005.630596][T11384] ___sys_sendmsg+0x2a5/0x360 [ 1005.630630][T11384] ? __lock_acquire+0x683/0x2cf0 [ 1005.630656][T11384] ? __pfx____sys_sendmsg+0x10/0x10 [ 1005.630706][T11384] ? __fget_files+0x2a/0x420 [ 1005.630724][T11384] ? __fget_files+0x3a2/0x420 [ 1005.630752][T11384] __x64_sys_sendmsg+0x1b1/0x290 [ 1005.630776][T11384] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1005.630812][T11384] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1005.630829][T11384] do_syscall_64+0x174/0x580 [ 1005.630849][T11384] ? trace_irq_disable+0x3b/0x140 [ 1005.630871][T11384] ? clear_bhb_loop+0x40/0x90 [ 1005.630890][T11384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1005.630905][T11384] RIP: 0033:0x7fc956f9de59 [ 1005.630921][T11384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1005.630935][T11384] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1005.630951][T11384] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1005.630962][T11384] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1005.630972][T11384] RBP: 00007fc957dd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1005.630982][T11384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1005.630990][T11384] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1005.631016][T11384] [ 1005.990439][T11386] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15613'. [ 1006.501474][T11426] netlink: 32 bytes leftover after parsing attributes in process `syz.0.15628'. [ 1006.819776][T11446] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15636'. [ 1006.865903][T11447] syzkaller1: entered promiscuous mode [ 1006.881532][T11447] syzkaller1: entered allmulticast mode [ 1007.012072][T11460] net_ratelimit: 380 callbacks suppressed [ 1007.012092][T11460] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1007.060977][T11465] netlink: zone id is out of range [ 1007.080258][T11465] netlink: zone id is out of range [ 1007.093435][T11465] netlink: zone id is out of range [ 1007.098963][T11465] netlink: zone id is out of range [ 1007.125167][T11465] netlink: zone id is out of range [ 1007.130437][T11465] netlink: zone id is out of range [ 1007.136993][T11465] netlink: zone id is out of range [ 1007.142208][T11465] netlink: zone id is out of range [ 1007.154328][T11465] netlink: zone id is out of range [ 1007.214778][T11471] netlink: 32 bytes leftover after parsing attributes in process `syz.1.15644'. [ 1007.321818][T11478] syzkaller0: entered promiscuous mode [ 1007.333186][T11478] syzkaller0: entered allmulticast mode [ 1007.761714][T11506] sctp: [Deprecated]: syz.4.15659 (pid 11506) Use of int in maxseg socket option. [ 1007.761714][T11506] Use struct sctp_assoc_value instead [ 1007.919445][T11945] nci: nci_ntf_packet: unknown ntf opcode 0x128 [ 1007.939944][T11524] __nla_validate_parse: 1 callbacks suppressed [ 1007.939964][T11524] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15664'. [ 1008.028325][T11531] FAULT_INJECTION: forcing a failure. [ 1008.028325][T11531] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1008.040126][T11530] syzkaller0: entered promiscuous mode [ 1008.049326][T11530] syzkaller0: entered allmulticast mode [ 1008.056793][T11531] CPU: 0 UID: 0 PID: 11531 Comm: syz.2.15663 Not tainted syzkaller #0 PREEMPT(full) [ 1008.056818][T11531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1008.056828][T11531] Call Trace: [ 1008.056835][T11531] [ 1008.056843][T11531] dump_stack_lvl+0xe8/0x150 [ 1008.056876][T11531] should_fail_ex+0x40c/0x560 [ 1008.056903][T11531] prepare_alloc_pages+0x230/0x650 [ 1008.056940][T11531] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1008.056969][T11531] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1008.056999][T11531] ? __pfx_policy_nodemask+0x10/0x10 [ 1008.057035][T11531] ? __lock_acquire+0x683/0x2cf0 [ 1008.057062][T11531] alloc_pages_mpol+0x212/0x380 [ 1008.057092][T11531] folio_alloc_mpol_noprof+0x39/0x160 [ 1008.057125][T11531] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1008.057154][T11531] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1008.057181][T11531] ? __pte_offset_map+0x29/0x240 [ 1008.057199][T11531] ? __pte_offset_map+0x29/0x240 [ 1008.057222][T11531] do_pte_missing+0x173a/0x34b0 [ 1008.057263][T11531] handle_mm_fault+0x1b36/0x3080 [ 1008.057304][T11531] ? handle_mm_fault+0xec/0x3080 [ 1008.057333][T11531] ? __pfx_handle_mm_fault+0x10/0x10 [ 1008.057352][T11531] ? lock_vma_under_rcu+0x45a/0x500 [ 1008.057372][T11531] ? __fget_files+0x2a/0x420 [ 1008.057417][T11531] do_user_addr_fault+0xa4d/0x1340 [ 1008.057454][T11531] ? trace_page_fault_user+0x84/0x1e0 [ 1008.057484][T11531] exc_page_fault+0x6a/0xc0 [ 1008.057512][T11531] asm_exc_page_fault+0x26/0x30 [ 1008.057531][T11531] RIP: 0033:0x7f42f1c5f60b [ 1008.057550][T11531] Code: 00 00 00 48 8d 3d 8d a0 1a 00 48 89 c1 31 c0 e8 cb 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d c1 a0 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 1008.057567][T11531] RSP: 002b:00007f42effd3fa0 EFLAGS: 00010206 [ 1008.057583][T11531] RAX: 0000000000000000 RBX: 00007f42f2026090 RCX: 0000000000000000 [ 1008.057596][T11531] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000200000000240 [ 1008.057608][T11531] RBP: 00007f42effd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1008.057620][T11531] R10: 0000200000000240 R11: 0000000000000000 R12: 0000000000000001 [ 1008.057632][T11531] R13: 00007f42f2026128 R14: 00007f42f2026090 R15: 00007fff62873008 [ 1008.057663][T11531] [ 1008.057980][T11531] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 1008.094433][T11533] netlink: 108 bytes leftover after parsing attributes in process `syz.4.15667'. [ 1008.296778][T11533] netlink: 108 bytes leftover after parsing attributes in process `syz.4.15667'. [ 1008.306035][T11533] netlink: 84 bytes leftover after parsing attributes in process `syz.4.15667'. [ 1008.689894][T11551] netlink: 'syz.1.15674': attribute type 1 has an invalid length. [ 1008.732248][T11551] bond23: entered promiscuous mode [ 1008.738195][T11551] 8021q: adding VLAN 0 to HW filter on device bond23 [ 1009.295964][T11570] syzkaller0: entered promiscuous mode [ 1009.301908][T11570] syzkaller0: entered allmulticast mode [ 1009.403084][T11572] netlink: 108 bytes leftover after parsing attributes in process `syz.1.15678'. [ 1009.412547][T11572] netlink: 108 bytes leftover after parsing attributes in process `syz.1.15678'. [ 1009.422146][T11572] netlink: 84 bytes leftover after parsing attributes in process `syz.1.15678'. [ 1010.303403][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1010.749222][T11518] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1010.960833][T11592] netlink: 36 bytes leftover after parsing attributes in process `syz.0.15683'. [ 1011.462472][T11627] syzkaller0: entered promiscuous mode [ 1011.476699][T11627] syzkaller0: entered allmulticast mode [ 1011.510750][T11632] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15699'. [ 1011.543713][T11634] ieee802154 phy0 wpan0: encryption failed: -22 [ 1012.105789][T11670] tipc: Resetting bearer [ 1012.345559][T11670] veth1_vlan: left promiscuous mode [ 1012.358549][T11670] tipc: Resetting bearer [ 1012.551360][ T36] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.581013][ T36] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1012.642003][ T36] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.669046][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1012.825167][T11688] syzkaller0: entered promiscuous mode [ 1012.839829][T11688] syzkaller0: entered allmulticast mode [ 1012.856137][ T36] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.878145][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1012.897826][ T36] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1012.931766][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1012.979675][T11706] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1013.050809][T11715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15720'. [ 1013.211537][T11725] xt_socket: unknown flags 0x50 [ 1016.922676][T11736] netlink: 'syz.4.15724': attribute type 9 has an invalid length. [ 1017.082622][T11742] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15725'. [ 1017.159393][T11748] vcan1: entered promiscuous mode [ 1017.179376][T11748] vcan1: entered allmulticast mode [ 1017.239386][T11744] syzkaller0: entered promiscuous mode [ 1017.255126][T11744] syzkaller0: entered allmulticast mode [ 1017.531832][T11767] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15732'. [ 1017.564633][T11767] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15732'. [ 1017.593540][T11767] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15732'. [ 1017.714011][T11777] tipc: Enabling of bearer rejected, failed to enable media [ 1017.944943][T11784] IPVS: Scheduler module ip_vs_sip not found [ 1018.004872][T11794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15740'. [ 1018.189327][T11803] syzkaller0: entered promiscuous mode [ 1018.209574][T11803] syzkaller0: entered allmulticast mode [ 1018.376382][T11818] ieee802154 phy0 wpan0: encryption failed: -22 [ 1018.428545][T11827] vlan3: entered promiscuous mode [ 1018.454237][T11827] bridge0: entered promiscuous mode [ 1018.565855][T11839] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15750'. [ 1018.908831][T11863] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15755'. [ 1019.033441][T11808] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1019.127014][T11870] netlink: 'syz.3.15756': attribute type 1 has an invalid length. [ 1019.370679][T11870] bond23: entered promiscuous mode [ 1019.401233][T11870] 8021q: adding VLAN 0 to HW filter on device bond23 [ 1019.595156][T11891] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1019.627511][T11895] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15762'. [ 1019.700066][T11891] netlink: 'syz.3.15760': attribute type 5 has an invalid length. [ 1019.747663][T11891] net_ratelimit: 13 callbacks suppressed [ 1019.747682][T11891] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1020.255220][ T127] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1020.257064][T11927] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1022.133469][T11859] Set syz1 is full, maxelem 65536 reached [ 1022.183781][T11971] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15775'. [ 1023.066687][T11915] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1023.229906][T11978] netlink: 'syz.0.15777': attribute type 2 has an invalid length. [ 1023.636332][T12019] xt_hashlimit: invalid rate [ 1023.696023][T12020] netlink: 'syz.1.15789': attribute type 1 has an invalid length. [ 1023.880931][T12037] netlink: 108 bytes leftover after parsing attributes in process `syz.1.15794'. [ 1023.912760][T12037] netlink: 108 bytes leftover after parsing attributes in process `syz.1.15794'. [ 1023.924689][T12037] netlink: 84 bytes leftover after parsing attributes in process `syz.1.15794'. [ 1023.941100][T12041] netlink: 27 bytes leftover after parsing attributes in process `syz.2.15795'. [ 1024.130777][T12055] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15800'. [ 1024.161369][T12055] netlink: 'syz.2.15800': attribute type 1 has an invalid length. [ 1024.209377][T12055] netlink: 'syz.2.15800': attribute type 1 has an invalid length. [ 1024.235345][T12055] netlink: 'syz.2.15800': attribute type 2 has an invalid length. [ 1024.251055][T12055] netlink: 68 bytes leftover after parsing attributes in process `syz.2.15800'. [ 1024.340782][ T5287] veth0_vlan: left promiscuous mode [ 1024.370669][ T5903] veth0_vlan: entered promiscuous mode [ 1024.567852][T12078] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1024.731723][T12086] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15810'. [ 1024.759337][T12086] netlink: 'syz.4.15810': attribute type 5 has an invalid length. [ 1024.786331][T12086] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15810'. [ 1024.833761][T12092] syzkaller0: entered promiscuous mode [ 1024.848418][T12092] syzkaller0: entered allmulticast mode [ 1024.868733][T12098] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15813'. [ 1024.968019][T12102] netlink: 24 bytes leftover after parsing attributes in process `syz.3.15815'. [ 1025.379384][T12123] openvswitch: netlink: Flow actions attr not present in new flow. [ 1025.723625][T12149] netlink: zone id is out of range [ 1025.737839][T12149] netlink: zone id is out of range [ 1025.749440][T12149] netlink: zone id is out of range [ 1025.765618][T12149] netlink: zone id is out of range [ 1025.776089][T12149] netlink: zone id is out of range [ 1025.789722][T12149] netlink: zone id is out of range [ 1025.801142][T12149] netlink: zone id is out of range [ 1025.809473][T12149] netlink: zone id is out of range [ 1025.815277][T12149] netlink: zone id is out of range [ 1025.840058][T12145] syzkaller0: entered promiscuous mode [ 1025.872400][T12145] syzkaller0: entered allmulticast mode [ 1028.906572][T12176] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 1028.913987][T12176] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 1028.921816][T12176] tipc: Resetting bearer [ 1029.237725][T12207] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 1029.317488][T12215] __nla_validate_parse: 8 callbacks suppressed [ 1029.317509][T12215] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15854'. [ 1029.381694][T12219] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15856'. [ 1029.421602][T11935] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.421672][T12219] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15856'. [ 1029.441770][T11935] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.459386][T11935] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.470186][T12222] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 1029.477766][T12222] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 1029.485753][T12222] tipc: Resetting bearer [ 1029.491710][T11935] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.615167][T12230] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1029.627359][T12230] netlink: 56 bytes leftover after parsing attributes in process `syz.0.15859'. [ 1029.807615][T12247] netlink: 52 bytes leftover after parsing attributes in process `syz.2.15867'. [ 1029.898944][T12253] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15869'. [ 1029.996510][T12256] syzkaller0: entered promiscuous mode [ 1030.013238][T12256] syzkaller0: entered allmulticast mode [ 1030.066660][T12262] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15871'. [ 1030.717164][T12281] netlink: 'syz.4.15876': attribute type 2 has an invalid length. [ 1033.247570][T12277] vlan4: entered promiscuous mode [ 1033.421163][T12291] netlink: 'syz.3.15879': attribute type 1 has an invalid length. [ 1033.458966][T12295] netlink: 'syz.0.15881': attribute type 1 has an invalid length. [ 1033.530957][T12299] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15879'. [ 1033.567635][T12297] net_ratelimit: 5 callbacks suppressed [ 1033.567654][T12297] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1033.600117][T12299] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1034.013857][T12320] syzkaller0: entered promiscuous mode [ 1034.030428][T12320] syzkaller0: entered allmulticast mode [ 1034.056507][T12331] vlan4: entered promiscuous mode [ 1034.351431][T12349] netlink: 'syz.1.15898': attribute type 1 has an invalid length. [ 1034.456353][T12355] netlink: 28 bytes leftover after parsing attributes in process `syz.1.15898'. [ 1034.478381][T12356] netlink: 388 bytes leftover after parsing attributes in process `syz.2.15896'. [ 1034.489144][T12356] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1034.501075][T12356] xt_hashlimit: size too large, truncated to 1048576 [ 1037.290461][T12349] workqueue: Failed to create a rescuer kthread for wq "bond24": -EINTR [ 1037.572040][T12374] IPVS: length: 190 != 8 [ 1037.712005][T12372] syzkaller0: entered promiscuous mode [ 1037.728626][T12372] syzkaller0: entered allmulticast mode [ 1041.172630][T12439] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1041.305010][T12451] syzkaller1: entered promiscuous mode [ 1041.310688][T12451] syzkaller1: entered allmulticast mode [ 1041.341535][T12455] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1041.394532][ T5905] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1041.438287][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 1041.487785][T12456] A link change request failed with some changes committed already. Interface dvmrp0 may have been left with an inconsistent configuration, please check. [ 1041.589294][T12465] syzkaller0: entered promiscuous mode [ 1041.595492][T12465] syzkaller0: entered allmulticast mode [ 1041.635030][ T5905] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1042.351949][T12498] netlink: zone id is out of range [ 1042.366685][T12498] netlink: zone id is out of range [ 1042.385384][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 1044.678816][T12485] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1044.834380][T12504] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15941'. [ 1044.994164][T12514] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15943'. [ 1045.015864][T12513] tipc: Enabling of bearer rejected, already enabled [ 1045.033334][T12516] netlink: 3648 bytes leftover after parsing attributes in process `syz.1.15944'. [ 1045.063688][T12516] netlink: 3648 bytes leftover after parsing attributes in process `syz.1.15944'. [ 1045.169279][T12522] FAULT_INJECTION: forcing a failure. [ 1045.169279][T12522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1045.200110][T12522] CPU: 1 UID: 0 PID: 12522 Comm: syz.2.15946 Not tainted syzkaller #0 PREEMPT(full) [ 1045.200158][T12522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1045.200182][T12522] Call Trace: [ 1045.200190][T12522] [ 1045.200200][T12522] dump_stack_lvl+0xe8/0x150 [ 1045.200238][T12522] should_fail_ex+0x40c/0x560 [ 1045.200268][T12522] _copy_from_user+0x2d/0xb0 [ 1045.200297][T12522] ___sys_sendmsg+0x1c6/0x360 [ 1045.200327][T12522] ? __lock_acquire+0x683/0x2cf0 [ 1045.200359][T12522] ? __pfx____sys_sendmsg+0x10/0x10 [ 1045.200423][T12522] ? __fget_files+0x2a/0x420 [ 1045.200449][T12522] ? __fget_files+0x3a2/0x420 [ 1045.200486][T12522] __x64_sys_sendmsg+0x1b1/0x290 [ 1045.200525][T12522] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1045.200572][T12522] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.200595][T12522] do_syscall_64+0x174/0x580 [ 1045.200622][T12522] ? trace_irq_disable+0x3b/0x140 [ 1045.200647][T12522] ? clear_bhb_loop+0x40/0x90 [ 1045.200671][T12522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1045.200691][T12522] RIP: 0033:0x7f42f1d9de59 [ 1045.200709][T12522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1045.200726][T12522] RSP: 002b:00007f42efff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1045.200747][T12522] RAX: ffffffffffffffda RBX: 00007f42f2025fa0 RCX: 00007f42f1d9de59 [ 1045.200762][T12522] RDX: 0000000000008044 RSI: 0000200000000140 RDI: 0000000000000003 [ 1045.200775][T12522] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1045.200787][T12522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1045.200799][T12522] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 1045.200831][T12522] [ 1045.407664][T12527] netlink: 'syz.0.15947': attribute type 4 has an invalid length. [ 1045.503888][T12532] vlan4: entered promiscuous mode [ 1045.522052][T12531] netlink: 68 bytes leftover after parsing attributes in process `syz.0.15951'. [ 1045.642175][T12536] veth1_to_bond: entered promiscuous mode [ 1045.731450][T12542] tipc: Enabling of bearer rejected, failed to enable media [ 1045.818078][T12545] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15957'. [ 1045.896632][T12554] tipc: Enabling of bearer rejected, failed to enable media [ 1046.048866][T12558] syzkaller0: entered promiscuous mode [ 1046.055115][T12558] syzkaller0: entered allmulticast mode [ 1049.295548][T12568] bond0: (slave team0): Releasing backup interface [ 1049.317726][T12568] bridge_slave_0: left allmulticast mode [ 1049.325176][ T5903] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1049.333094][T12568] bridge_slave_0: left promiscuous mode [ 1049.339410][T12568] bridge0: port 1(bridge_slave_0) entered disabled state [ 1049.360436][T12568] bridge_slave_1: left allmulticast mode [ 1049.371083][T12568] bridge_slave_1: left promiscuous mode [ 1049.377665][T12568] bridge0: port 2(bridge_slave_1) entered disabled state [ 1049.393836][T12568] bond0: (slave bond_slave_0): Releasing backup interface [ 1049.409379][T12568] bond0: (slave bond_slave_1): Releasing backup interface [ 1049.426445][T12568] team0: Port device team_slave_1 removed [ 1049.433870][T12568] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1049.456294][T12575] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1049.575997][T12597] netlink: 'syz.4.15969': attribute type 5 has an invalid length. [ 1049.722696][T12601] x_tables: duplicate underflow at hook 1 [ 1049.811269][T12608] netlink: 256 bytes leftover after parsing attributes in process `syz.4.15974'. [ 1049.860991][T12608] x_tables: duplicate entry at hook 2 [ 1049.999180][T12617] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1050.012797][T12626] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1050.030165][T12615] syzkaller0: entered promiscuous mode [ 1050.037272][T12615] syzkaller0: entered allmulticast mode [ 1050.147737][T12635] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15984'. [ 1050.393538][ T5905] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1053.027719][T12632] ip6erspan1: entered allmulticast mode [ 1053.160978][T12659] tipc: Enabling of bearer rejected, failed to enable media [ 1053.249257][T12665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15994'. [ 1053.581253][T12690] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16005'. [ 1053.660177][T12699] tipc: Enabling of bearer rejected, failed to enable media [ 1053.795094][T12704] netlink: 'syz.3.16010': attribute type 1 has an invalid length. [ 1053.810275][T12708] netlink: 16 bytes leftover after parsing attributes in process `syz.1.16011'. [ 1053.855169][T12708] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16011'. [ 1053.910055][T12718] vlan6: entered promiscuous mode [ 1054.089282][T12727] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16018'. [ 1054.107002][T12727] netlink: 'syz.4.16018': attribute type 1 has an invalid length. [ 1054.166639][T12727] 8021q: adding VLAN 0 to HW filter on device bond23 [ 1054.178599][T12736] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16017'. [ 1054.288591][T12745] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1054.354340][T12747] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16022'. [ 1054.377520][T12752] netlink: 'syz.4.16023': attribute type 21 has an invalid length. [ 1054.386997][T12753] netlink: 'syz.2.16025': attribute type 1 has an invalid length. [ 1054.408834][T12752] netlink: 'syz.4.16023': attribute type 21 has an invalid length. [ 1054.465728][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.488217][T12753] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16025'. [ 1054.532151][T12763] netlink: 72 bytes leftover after parsing attributes in process `syz.0.16026'. [ 1054.545682][T12763] syzkaller0: entered promiscuous mode [ 1054.551393][T12763] syzkaller0: entered allmulticast mode [ 1055.229930][T12803] netlink: 'syz.4.16038': attribute type 1 has an invalid length. [ 1055.299630][T12807] __nla_validate_parse: 3 callbacks suppressed [ 1055.299651][T12807] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16037'. [ 1055.322187][T12805] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16037'. [ 1055.348145][T12803] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16038'. [ 1055.387108][T12805] netlink: 92 bytes leftover after parsing attributes in process `syz.0.16037'. [ 1055.520113][T12820] tipc: Enabling of bearer rejected, failed to enable media [ 1055.625062][T12828] netlink: 96 bytes leftover after parsing attributes in process `syz.2.16044'. [ 1055.698248][T12828] vlan4: entered allmulticast mode [ 1055.716415][T12828] erspan0: entered allmulticast mode [ 1055.818139][T12843] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16051'. [ 1055.839746][T12841] netlink: 52 bytes leftover after parsing attributes in process `syz.0.16049'. [ 1056.027409][T12858] netlink: 'syz.0.16055': attribute type 1 has an invalid length. [ 1056.074032][T12865] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1056.091892][T12863] netlink: 108 bytes leftover after parsing attributes in process `syz.4.16056'. [ 1056.106608][T12863] netlink: 108 bytes leftover after parsing attributes in process `syz.4.16056'. [ 1056.117892][T12863] netlink: 84 bytes leftover after parsing attributes in process `syz.4.16056'. [ 1056.332065][T12877] netlink: 'syz.0.16063': attribute type 1 has an invalid length. [ 1056.350435][T12877] netlink: 'syz.0.16063': attribute type 1 has an invalid length. [ 1056.376526][T12877] 8021q: VLANs not supported on bond0 [ 1056.396572][T12877] netlink: 'syz.0.16063': attribute type 9 has an invalid length. [ 1056.437494][T12882] vlan6: entered promiscuous mode [ 1056.683412][T12901] xt_cluster: node mask cannot exceed total number of nodes [ 1056.786445][T12907] 8021q: VLANs not supported on bond0 [ 1057.334342][T12951] FAULT_INJECTION: forcing a failure. [ 1057.334342][T12951] name failslab, interval 1, probability 0, space 0, times 0 [ 1057.388232][T12951] CPU: 0 UID: 0 PID: 12951 Comm: syz.3.16088 Not tainted syzkaller #0 PREEMPT(full) [ 1057.388259][T12951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1057.388271][T12951] Call Trace: [ 1057.388278][T12951] [ 1057.388285][T12951] dump_stack_lvl+0xe8/0x150 [ 1057.388312][T12951] should_fail_ex+0x40c/0x560 [ 1057.388333][T12951] should_failslab+0xa8/0x100 [ 1057.388356][T12951] __kmalloc_cache_noprof+0xa8/0x660 [ 1057.388379][T12951] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1057.388396][T12951] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1057.388416][T12951] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1057.388445][T12951] genl_family_rcv_msg_doit+0x233/0x340 [ 1057.388473][T12951] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1057.388502][T12951] ? bpf_lsm_capable+0x9/0x20 [ 1057.388523][T12951] ? security_capable+0x7e/0x2c0 [ 1057.388552][T12951] genl_rcv_msg+0x614/0x7a0 [ 1057.388576][T12951] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1057.388594][T12951] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 1057.388610][T12951] ? __pfx_ref_tracker_free+0x10/0x10 [ 1057.388638][T12951] netlink_rcv_skb+0x226/0x4a0 [ 1057.388661][T12951] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1057.388680][T12951] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1057.388714][T12951] ? down_read+0x2be/0x330 [ 1057.388734][T12951] genl_rcv+0x28/0x40 [ 1057.388751][T12951] netlink_unicast+0x7bb/0x940 [ 1057.388791][T12951] netlink_sendmsg+0x813/0xb40 [ 1057.388814][T12951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1057.388833][T12951] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1057.388854][T12951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1057.388868][T12951] sock_sendmsg_nosec+0x13a/0x180 [ 1057.388894][T12951] ____sys_sendmsg+0x54e/0x850 [ 1057.388925][T12951] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1057.388960][T12951] ? import_iovec+0x73/0xa0 [ 1057.388989][T12951] ___sys_sendmsg+0x2a5/0x360 [ 1057.389014][T12951] ? __lock_acquire+0x683/0x2cf0 [ 1057.389042][T12951] ? __pfx____sys_sendmsg+0x10/0x10 [ 1057.389100][T12951] ? __fget_files+0x2a/0x420 [ 1057.389121][T12951] ? __fget_files+0x3a2/0x420 [ 1057.389155][T12951] __x64_sys_sendmsg+0x1b1/0x290 [ 1057.389185][T12951] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1057.389226][T12951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.389246][T12951] do_syscall_64+0x174/0x580 [ 1057.389270][T12951] ? trace_irq_disable+0x3b/0x140 [ 1057.389294][T12951] ? clear_bhb_loop+0x40/0x90 [ 1057.389317][T12951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1057.389337][T12951] RIP: 0033:0x7fc956f9de59 [ 1057.389356][T12951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1057.389374][T12951] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1057.389395][T12951] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1057.389409][T12951] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1057.389423][T12951] RBP: 00007fc957dd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1057.389435][T12951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1057.389446][T12951] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1057.389478][T12951] [ 1057.846164][T12959] syzkaller0: entered promiscuous mode [ 1057.851704][T12959] syzkaller0: entered allmulticast mode [ 1058.095036][T12980] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1058.116988][ T36] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1058.196779][T12980] bond24: (slave veth11): Enslaving as a backup interface with a down link [ 1058.474429][T13007] syzkaller0: entered promiscuous mode [ 1058.485529][T13007] syzkaller0: entered allmulticast mode [ 1058.749709][T13018] syzkaller1: entered promiscuous mode [ 1058.781533][T13018] syzkaller1: entered allmulticast mode [ 1058.856820][T13036] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 1058.969833][T13042] validate_nla: 10 callbacks suppressed [ 1058.969847][T13042] netlink: 'syz.4.16117': attribute type 1 has an invalid length. [ 1061.005168][T12974] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1061.218022][T13053] netlink: 'syz.3.16121': attribute type 1 has an invalid length. [ 1061.230430][T13056] __nla_validate_parse: 16 callbacks suppressed [ 1061.230448][T13056] netlink: 24 bytes leftover after parsing attributes in process `syz.4.16122'. [ 1061.247646][T13057] netlink: 108 bytes leftover after parsing attributes in process `syz.2.16123'. [ 1061.261007][T13057] netlink: 108 bytes leftover after parsing attributes in process `syz.2.16123'. [ 1061.271521][T13057] netlink: 84 bytes leftover after parsing attributes in process `syz.2.16123'. [ 1061.345240][T13064] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16125'. [ 1061.355133][T13064] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16125'. [ 1061.365615][T13056] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16122'. [ 1061.391698][T13060] netlink: 1204 bytes leftover after parsing attributes in process `syz.0.16124'. [ 1061.429925][T13065] netlink: 16 bytes leftover after parsing attributes in process `syz.4.16122'. [ 1061.456442][T13072] ip6tnl0: Caught tx_queue_len zero misconfig [ 1061.527600][T13075] netlink: 'syz.3.16128': attribute type 1 has an invalid length. [ 1061.554773][T13076] tc_dump_action: action bad kind [ 1061.570552][T13076] netlink: 'syz.1.16127': attribute type 1 has an invalid length. [ 1061.637914][T13083] netlink: 32 bytes leftover after parsing attributes in process `syz.4.16131'. [ 1061.819487][ T67] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1061.891686][T13107] netlink: 'syz.2.16138': attribute type 1 has an invalid length. [ 1062.138813][T13127] netlink: 'syz.3.16142': attribute type 2 has an invalid length. [ 1062.240353][T13136] netlink: 'syz.0.16147': attribute type 1 has an invalid length. [ 1062.419759][T13149] netlink: 'syz.2.16151': attribute type 1 has an invalid length. [ 1062.540379][T13156] vlan4: entered promiscuous mode [ 1062.551894][T13156] geneve1: entered promiscuous mode [ 1062.557867][T13156] vlan4: entered allmulticast mode [ 1062.564398][T13156] geneve1: entered allmulticast mode [ 1064.714260][T13091] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1064.918573][T13182] netlink: 'syz.0.16165': attribute type 1 has an invalid length. [ 1065.383996][T13215] tipc: Enabling of bearer rejected, failed to enable media [ 1065.442845][T11935] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1065.585014][T13221] netlink: 'syz.1.16177': attribute type 9 has an invalid length. [ 1065.616249][T13224] netlink: 'syz.0.16180': attribute type 1 has an invalid length. [ 1066.766136][T13267] FAULT_INJECTION: forcing a failure. [ 1066.766136][T13267] name failslab, interval 1, probability 0, space 0, times 0 [ 1066.780076][T13267] CPU: 0 UID: 0 PID: 13267 Comm: syz.3.16192 Not tainted syzkaller #0 PREEMPT(full) [ 1066.780105][T13267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1066.780116][T13267] Call Trace: [ 1066.780125][T13267] [ 1066.780133][T13267] dump_stack_lvl+0xe8/0x150 [ 1066.780169][T13267] should_fail_ex+0x40c/0x560 [ 1066.780194][T13267] should_failslab+0xa8/0x100 [ 1066.780233][T13267] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1066.780257][T13267] ? skb_clone+0x212/0x3a0 [ 1066.780275][T13267] ? skb_clone+0x212/0x3a0 [ 1066.780295][T13267] skb_clone+0x212/0x3a0 [ 1066.780315][T13267] __netlink_deliver_tap+0x413/0x860 [ 1066.780353][T13267] ? netlink_deliver_tap+0x2e/0x1b0 [ 1066.780383][T13267] netlink_deliver_tap+0x19c/0x1b0 [ 1066.780408][T13267] netlink_unicast+0x77f/0x940 [ 1066.780444][T13267] netlink_sendmsg+0x813/0xb40 [ 1066.780472][T13267] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1066.780495][T13267] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1066.780521][T13267] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1066.780538][T13267] sock_sendmsg_nosec+0x13a/0x180 [ 1066.780561][T13267] ____sys_sendmsg+0x54e/0x850 [ 1066.780593][T13267] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1066.780630][T13267] ? import_iovec+0x73/0xa0 [ 1066.780661][T13267] ___sys_sendmsg+0x2a5/0x360 [ 1066.780684][T13267] ? __lock_acquire+0x683/0x2cf0 [ 1066.780710][T13267] ? __pfx____sys_sendmsg+0x10/0x10 [ 1066.780775][T13267] ? __fget_files+0x2a/0x420 [ 1066.780798][T13267] ? __fget_files+0x3a2/0x420 [ 1066.780832][T13267] __x64_sys_sendmsg+0x1b1/0x290 [ 1066.780863][T13267] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1066.780909][T13267] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1066.780931][T13267] do_syscall_64+0x174/0x580 [ 1066.780957][T13267] ? trace_irq_disable+0x3b/0x140 [ 1066.780980][T13267] ? clear_bhb_loop+0x40/0x90 [ 1066.781004][T13267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1066.781023][T13267] RIP: 0033:0x7fc956f9de59 [ 1066.781041][T13267] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1066.781058][T13267] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1066.781079][T13267] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1066.781091][T13267] RDX: 0000000000000004 RSI: 0000200000001280 RDI: 0000000000000003 [ 1066.781102][T13267] RBP: 00007fc957dd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1066.781112][T13267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1066.781122][T13267] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1066.781153][T13267] [ 1067.142576][T13272] netlink: 'syz.3.16194': attribute type 1 has an invalid length. [ 1067.182297][T13272] __nla_validate_parse: 12 callbacks suppressed [ 1067.182317][T13272] netlink: 28 bytes leftover after parsing attributes in process `syz.3.16194'. [ 1067.437091][T13282] syzkaller0: entered promiscuous mode [ 1067.443092][T13282] syzkaller0: entered allmulticast mode [ 1068.069565][ T5625] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 1068.083610][ T5625] CPU: 0 UID: 0 PID: 5625 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 1068.083643][ T5625] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1068.083655][ T5625] Call Trace: [ 1068.083663][ T5625] [ 1068.083672][ T5625] dump_stack_lvl+0xe8/0x150 [ 1068.083706][ T5625] dump_header+0xd3/0x4b0 [ 1068.083735][ T5625] oom_kill_process+0x3ab/0x970 [ 1068.083760][ T5625] out_of_memory+0x1064/0x1480 [ 1068.083778][ T5625] ? try_charge_memcg+0xbca/0x1590 [ 1068.083817][ T5625] ? __pfx_out_of_memory+0x10/0x10 [ 1068.083834][ T5625] ? do_raw_spin_unlock+0xf5/0x210 [ 1068.083867][ T5625] try_charge_memcg+0xc74/0x1590 [ 1068.083910][ T5625] ? __pfx_try_charge_memcg+0x10/0x10 [ 1068.083934][ T5625] ? percpu_ref_tryget+0x15/0x180 [ 1068.083985][ T5625] ? charge_memcg+0x20/0x2b0 [ 1068.084013][ T5625] charge_memcg+0x19c/0x2b0 [ 1068.084040][ T5625] ? mem_cgroup_swapin_charge_folio+0x2b/0x390 [ 1068.084064][ T5625] mem_cgroup_swapin_charge_folio+0x25a/0x390 [ 1068.084095][ T5625] swap_cache_alloc_folio+0x4de/0x990 [ 1068.084130][ T5625] swap_cache_read_folio+0x44/0x120 [ 1068.084154][ T5625] swap_cluster_readahead+0x3a0/0x640 [ 1068.084187][ T5625] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 1068.084220][ T5625] ? get_vma_policy+0x27b/0x3c0 [ 1068.084248][ T5625] swapin_readahead+0x19a/0xc10 [ 1068.084271][ T5625] ? swap_table_get+0x1e/0x260 [ 1068.084289][ T5625] ? swap_table_get+0x1e/0x260 [ 1068.084309][ T5625] ? __pfx_swapin_readahead+0x10/0x10 [ 1068.084331][ T5625] ? swap_table_get+0x1e/0x260 [ 1068.084347][ T5625] ? swap_table_get+0x1e/0x260 [ 1068.084364][ T5625] ? swap_table_get+0x1e/0x260 [ 1068.084383][ T5625] ? swap_table_get+0x216/0x260 [ 1068.084401][ T5625] ? swap_cache_get_folio+0x2e7/0x2f0 [ 1068.084427][ T5625] do_swap_page+0x455/0x5060 [ 1068.084457][ T5625] ? __pte_offset_map+0x29/0x240 [ 1068.084482][ T5625] ? __lock_acquire+0x683/0x2cf0 [ 1068.084504][ T5625] ? do_swap_page+0x124/0x5060 [ 1068.084520][ T5625] ? __pfx_do_swap_page+0x10/0x10 [ 1068.084544][ T5625] ? __pte_offset_map+0x1ae/0x240 [ 1068.084566][ T5625] ? pte_offset_map_rw_nolock+0xea/0x160 [ 1068.084587][ T5625] handle_mm_fault+0x124c/0x3080 [ 1068.084620][ T5625] ? handle_mm_fault+0xec/0x3080 [ 1068.084647][ T5625] ? __pfx_handle_mm_fault+0x10/0x10 [ 1068.084663][ T5625] ? lock_vma_under_rcu+0x45a/0x500 [ 1068.084711][ T5625] do_user_addr_fault+0xa4d/0x1340 [ 1068.084747][ T5625] ? trace_page_fault_user+0x84/0x1e0 [ 1068.084773][ T5625] exc_page_fault+0x6a/0xc0 [ 1068.084799][ T5625] asm_exc_page_fault+0x26/0x30 [ 1068.084816][ T5625] RIP: 0033:0x7fc956e6be77 [ 1068.084833][ T5625] Code: 00 00 48 b8 db 34 b6 d7 82 de 1b 43 48 f7 a4 24 98 00 00 00 48 8b 05 40 99 ee 00 48 69 8c 24 90 00 00 00 e8 03 00 00 8b 78 08 <48> 8b 44 24 18 48 c1 ea 12 4c 8b 0d 39 98 ee 00 48 01 d1 39 7c 24 [ 1068.084847][ T5625] RSP: 002b:00007ffcfe9e3270 EFLAGS: 00010202 [ 1068.084861][ T5625] RAX: 0000001b34024000 RBX: 0000000000001c90 RCX: 00000000001047f8 [ 1068.084873][ T5625] RDX: 000000000eb59cbc RSI: 00007ffcfe9e3300 RDI: 000000000000000d [ 1068.084883][ T5625] RBP: 00007ffcfe9e32ac R08: 00000000381cabb8 R09: 3fffffffffffffff [ 1068.084895][ T5625] R10: 4000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 1068.084906][ T5625] R13: 00000000000927c0 R14: 0000000000104a41 R15: 00007ffcfe9e3300 [ 1068.084936][ T5625] [ 1068.084954][ T5625] memory: usage 307200kB, limit 307200kB, failcnt 1209 [ 1068.345137][T13205] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1068.444817][ T5625] memory+swap: usage 307388kB, limit 9007199254740988kB, failcnt 0 [ 1068.452757][ T5625] kmem: usage 307176kB, limit 9007199254740988kB, failcnt 0 [ 1068.547842][ T5625] Memory cgroup stats for /syz3: [ 1068.547987][ T5625] cache 0 [ 1068.593109][ T5625] rss 0 [ 1068.603286][ T5625] rss_huge 0 [ 1068.612805][ T5625] shmem 0 [ 1068.619408][ T5625] mapped_file 0 [ 1068.654429][ T5625] dirty 0 [ 1068.665716][ T5625] writeback 0 [ 1068.676779][ T5625] workingset_refault_anon 90 [ 1068.689830][ T5625] workingset_refault_file 516 [ 1068.709479][ T5625] swap 192512 [ 1068.726068][ T5625] swapcached 684032 [ 1068.740926][ T5625] pgpgin 220810 [ 1068.763322][ T5625] pgpgout 220805 [ 1068.773754][ T5625] pgfault 460619 [ 1068.777375][ T5625] pgmajfault 48 [ 1068.780881][ T5625] inactive_anon 12288 [ 1068.797967][ T5625] active_anon 8192 [ 1068.811216][ T5625] inactive_file 0 [ 1068.824252][ T5625] active_file 0 [ 1068.838623][ T5625] unevictable 0 [ 1068.846860][ T5625] hierarchical_memory_limit 314572800 [ 1068.869406][ T5625] hierarchical_memsw_limit 9223372036854771712 [ 1068.889565][ T5625] total_cache 0 [ 1068.904068][ T5625] total_rss 0 [ 1068.918585][ T5625] total_rss_huge 0 [ 1068.924873][T13301] netlink: 'syz.4.16205': attribute type 1 has an invalid length. [ 1068.928605][ T5625] total_shmem 0 [ 1068.956320][ T5625] total_mapped_file 0 [ 1068.964108][ T5625] total_dirty 0 [ 1068.972830][ T5625] total_writeback 0 [ 1068.996110][ T5625] total_workingset_refault_anon 90 [ 1069.007810][ T5625] total_workingset_refault_file 516 [ 1069.025263][ T5625] total_swap 192512 [ 1069.032158][ T5625] total_swapcached 684032 [ 1069.043186][ T5625] total_pgpgin 220810 [ 1069.060854][ T5625] total_pgpgout 220805 [ 1069.082201][ T5625] total_pgfault 460621 [ 1069.091897][T13301] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16205'. [ 1069.112337][T13313] syzkaller0: entered promiscuous mode [ 1069.112602][ T5625] total_pgmajfault 48 [ 1069.121006][T13313] syzkaller0: entered allmulticast mode [ 1069.133939][ T5625] total_inactive_anon 12288 [ 1069.138998][ T5625] total_active_anon 8192 [ 1069.144790][ T5625] total_inactive_file 0 [ 1069.148995][ T5625] total_active_file 0 [ 1069.156231][ T5625] total_unevictable 0 [ 1069.175821][ T5625] anon_cost 0 [ 1069.179312][ T5625] file_cost 0 [ 1069.190247][ T5625] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz3,task_memcg=/syz3,task=syz.3.16198,pid=13283,uid=0 [ 1069.207424][ T5625] Memory cgroup out of memory: Killed process 13283 (syz.3.16198) total-vm:102304kB, anon-rss:1252kB, file-rss:22344kB, shmem-rss:0kB, UID:0 pgtables:128kB oom_score_adj:1000 [ 1069.388378][T13317] syzkaller0: entered promiscuous mode [ 1069.406646][T13317] syzkaller0: entered allmulticast mode [ 1069.524446][ T36] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1069.697438][T13339] syzkaller0: entered promiscuous mode [ 1069.713438][T13339] syzkaller0: entered allmulticast mode [ 1069.887658][T13347] netlink: 14560 bytes leftover after parsing attributes in process `syz.3.16221'. [ 1069.985851][T13349] syzkaller0: entered promiscuous mode [ 1069.991683][T13349] syzkaller0: entered allmulticast mode [ 1071.146508][T13358] netlink: 'syz.3.16226': attribute type 2 has an invalid length. [ 1071.316240][T13360] FAULT_INJECTION: forcing a failure. [ 1071.316240][T13360] name failslab, interval 1, probability 0, space 0, times 0 [ 1071.353000][T13360] CPU: 0 UID: 0 PID: 13360 Comm: syz.3.16227 Not tainted syzkaller #0 PREEMPT(full) [ 1071.353028][T13360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1071.353039][T13360] Call Trace: [ 1071.353048][T13360] [ 1071.353057][T13360] dump_stack_lvl+0xe8/0x150 [ 1071.353093][T13360] should_fail_ex+0x40c/0x560 [ 1071.353121][T13360] should_failslab+0xa8/0x100 [ 1071.353151][T13360] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1071.353176][T13360] ? skb_clone+0x212/0x3a0 [ 1071.353194][T13360] ? skb_clone+0x212/0x3a0 [ 1071.353218][T13360] skb_clone+0x212/0x3a0 [ 1071.353240][T13360] __netlink_deliver_tap+0x413/0x860 [ 1071.353283][T13360] ? netlink_deliver_tap+0x2e/0x1b0 [ 1071.353314][T13360] netlink_deliver_tap+0x19c/0x1b0 [ 1071.353343][T13360] netlink_unicast+0x77f/0x940 [ 1071.353382][T13360] netlink_sendmsg+0x813/0xb40 [ 1071.353412][T13360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1071.353436][T13360] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1071.353466][T13360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1071.353483][T13360] sock_sendmsg_nosec+0x13a/0x180 [ 1071.353506][T13360] ____sys_sendmsg+0x54e/0x850 [ 1071.353542][T13360] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1071.353577][T13360] ? import_iovec+0x73/0xa0 [ 1071.353605][T13360] ___sys_sendmsg+0x2a5/0x360 [ 1071.353631][T13360] ? __lock_acquire+0x683/0x2cf0 [ 1071.353659][T13360] ? __pfx____sys_sendmsg+0x10/0x10 [ 1071.353719][T13360] ? __fget_files+0x2a/0x420 [ 1071.353743][T13360] ? __fget_files+0x3a2/0x420 [ 1071.353779][T13360] __x64_sys_sendmsg+0x1b1/0x290 [ 1071.353810][T13360] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1071.353858][T13360] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1071.353880][T13360] do_syscall_64+0x174/0x580 [ 1071.353907][T13360] ? trace_irq_disable+0x3b/0x140 [ 1071.353931][T13360] ? clear_bhb_loop+0x40/0x90 [ 1071.353954][T13360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1071.353974][T13360] RIP: 0033:0x7fc956f9de59 [ 1071.353992][T13360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1071.354009][T13360] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1071.354029][T13360] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1071.354043][T13360] RDX: 00000000040000d0 RSI: 0000200000000540 RDI: 0000000000000003 [ 1071.354056][T13360] RBP: 00007fc957dd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1071.354068][T13360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1071.354080][T13360] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1071.354114][T13360] [ 1072.373179][T13321] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1072.659001][T13385] netlink: 68 bytes leftover after parsing attributes in process `syz.1.16230'. [ 1072.698477][T13385] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16230'. [ 1072.733973][T13387] xt_hashlimit: size too large, truncated to 1048576 [ 1072.787163][T13389] netlink: 'syz.2.16237': attribute type 2 has an invalid length. [ 1072.982332][T13400] netlink: 45349 bytes leftover after parsing attributes in process `syz.1.16240'. [ 1073.014392][T13400] 0ªX¹¦Dö»: renamed from gretap0 [ 1073.050083][T13400] tipc: Disabling bearer [ 1073.082068][T13405] xt_bpf: check failed: parse error [ 1073.180236][T13413] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16246'. [ 1073.212610][T13408] netlink: 52 bytes leftover after parsing attributes in process `syz.4.16244'. [ 1073.434771][T13411] syzkaller0: entered promiscuous mode [ 1073.440476][T13411] syzkaller0: entered allmulticast mode [ 1076.886709][T13453] netlink: 'syz.0.16255': attribute type 2 has an invalid length. [ 1076.943699][T13480] tunl0: entered promiscuous mode [ 1076.949048][T13480] netlink: 'syz.2.16259': attribute type 4 has an invalid length. [ 1076.957744][T13480] netlink: 9 bytes leftover after parsing attributes in process `syz.2.16259'. [ 1076.988365][T13480] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 1077.009336][T13480] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 1077.029000][T13480] tipc: Resetting bearer [ 1077.045158][T13480] netlink: 24 bytes leftover after parsing attributes in process `syz.2.16259'. [ 1077.214435][T13499] netlink: 'syz.0.16265': attribute type 2 has an invalid length. [ 1077.232665][T13500] netlink: 'syz.1.16266': attribute type 6 has an invalid length. [ 1077.253746][T13502] netlink: 'syz.1.16266': attribute type 6 has an invalid length. [ 1077.287703][T13504] vlan4: entered allmulticast mode [ 1077.302369][T13504] bond0: entered allmulticast mode [ 1077.401560][T13508] tipc: Enabling of bearer rejected, failed to enable media [ 1077.525310][T13512] syzkaller0: entered promiscuous mode [ 1077.543277][T13512] syzkaller0: entered allmulticast mode [ 1077.552224][T13514] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 1077.648512][T13516] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 1077.663646][T13516] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 1077.672312][T13516] tipc: Resetting bearer [ 1077.820136][T13521] bond0: (slave bond_slave_1): Releasing backup interface [ 1077.849227][T13521] bond_slave_1: left allmulticast mode [ 1077.858637][T13524] netlink: 36 bytes leftover after parsing attributes in process `syz.2.16275'. [ 1077.871009][T13521] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16274'. [ 1077.889713][T13521] team0: entered promiscuous mode [ 1077.928824][T13521] team_slave_1: entered promiscuous mode [ 1077.962203][T13521] geneve1: entered promiscuous mode [ 1078.009307][T13521] team0: left promiscuous mode [ 1078.029792][T13521] team_slave_1: left promiscuous mode [ 1078.050126][T13521] geneve1: left promiscuous mode [ 1078.059353][T13535] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16279'. [ 1078.317987][T13547] netlink: 'syz.1.16284': attribute type 1 has an invalid length. [ 1078.488601][T13547] netlink: 28 bytes leftover after parsing attributes in process `syz.1.16284'. [ 1078.535160][T13547] 8021q: adding VLAN 0 to HW filter on device bond26 [ 1078.635926][T13562] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16285'. [ 1078.654460][T13562] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 1080.007348][T13615] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16309'. [ 1080.075525][T13619] FAULT_INJECTION: forcing a failure. [ 1080.075525][T13619] name failslab, interval 1, probability 0, space 0, times 0 [ 1080.114560][T13619] CPU: 0 UID: 0 PID: 13619 Comm: syz.0.16310 Not tainted syzkaller #0 PREEMPT(full) [ 1080.114587][T13619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1080.114598][T13619] Call Trace: [ 1080.114605][T13619] [ 1080.114613][T13619] dump_stack_lvl+0xe8/0x150 [ 1080.114647][T13619] should_fail_ex+0x40c/0x560 [ 1080.114675][T13619] should_failslab+0xa8/0x100 [ 1080.114704][T13619] __kmalloc_noprof+0xfe/0x720 [ 1080.114731][T13619] ? nft_pernet+0x23/0x240 [ 1080.114866][T13619] ? nf_tables_newrule+0x1524/0x28a0 [ 1080.114916][T13619] ? nf_tables_newrule+0x1524/0x28a0 [ 1080.114946][T13619] nf_tables_newrule+0x1524/0x28a0 [ 1080.114987][T13619] ? __pfx_nf_tables_newrule+0x10/0x10 [ 1080.115010][T13619] ? nfnl_pernet+0x23/0x240 [ 1080.115063][T13619] ? nfnl_pernet+0x23/0x240 [ 1080.115098][T13619] ? __nla_parse+0x40/0x60 [ 1080.115129][T13619] nfnetlink_rcv+0x1288/0x28c0 [ 1080.115190][T13619] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1080.115266][T13619] ? netlink_deliver_tap+0x2e/0x1b0 [ 1080.115303][T13619] ? netlink_deliver_tap+0x2e/0x1b0 [ 1080.115329][T13619] ? netlink_deliver_tap+0x2e/0x1b0 [ 1080.115361][T13619] netlink_unicast+0x7bb/0x940 [ 1080.115398][T13619] netlink_sendmsg+0x813/0xb40 [ 1080.115437][T13619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1080.115461][T13619] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1080.115488][T13619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1080.115506][T13619] sock_sendmsg_nosec+0x13a/0x180 [ 1080.115534][T13619] ____sys_sendmsg+0x54e/0x850 [ 1080.115570][T13619] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1080.115609][T13619] ? import_iovec+0x73/0xa0 [ 1080.115641][T13619] ___sys_sendmsg+0x2a5/0x360 [ 1080.115669][T13619] ? __lock_acquire+0x683/0x2cf0 [ 1080.115701][T13619] ? __pfx____sys_sendmsg+0x10/0x10 [ 1080.115770][T13619] ? __fget_files+0x2a/0x420 [ 1080.115794][T13619] ? __fget_files+0x3a2/0x420 [ 1080.115831][T13619] __x64_sys_sendmsg+0x1b1/0x290 [ 1080.115863][T13619] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1080.115912][T13619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.115933][T13619] do_syscall_64+0x174/0x580 [ 1080.115959][T13619] ? trace_irq_disable+0x3b/0x140 [ 1080.115983][T13619] ? clear_bhb_loop+0x40/0x90 [ 1080.116008][T13619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.116027][T13619] RIP: 0033:0x7f2b06d9de59 [ 1080.116046][T13619] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1080.116064][T13619] RSP: 002b:00007f2b07c06028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1080.116085][T13619] RAX: ffffffffffffffda RBX: 00007f2b07025fa0 RCX: 00007f2b06d9de59 [ 1080.116099][T13619] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1080.116112][T13619] RBP: 00007f2b07c06090 R08: 0000000000000000 R09: 0000000000000000 [ 1080.116125][T13619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1080.116137][T13619] R13: 00007f2b07026038 R14: 00007f2b07025fa0 R15: 00007ffc0a85d368 [ 1080.116171][T13619] [ 1080.863422][T13635] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16314'. [ 1081.140613][T13641] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 1081.155452][T13641] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 1081.436049][T13655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16321'. [ 1081.499398][T13647] syzkaller0: entered promiscuous mode [ 1081.507392][T13660] netlink: 'syz.0.16323': attribute type 1 has an invalid length. [ 1081.520858][T13647] syzkaller0: entered allmulticast mode [ 1081.536722][T13658] netlink: 'syz.4.16322': attribute type 4 has an invalid length. [ 1081.636568][T13666] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16323'. [ 1082.857385][T13685] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16327'. [ 1084.657117][T13676] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1084.667435][T13681] netlink: 40 bytes leftover after parsing attributes in process `syz.1.16325'. [ 1084.679363][T13681] nbd: must specify at least one socket [ 1085.194378][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1086.278228][T13666] 8021q: adding VLAN 0 to HW filter on device bond22 [ 1086.482419][ T67] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1086.577253][T13705] netlink: 'syz.3.16334': attribute type 2 has an invalid length. [ 1089.364904][T13689] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1089.522388][T13712] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16335'. [ 1089.602775][T13721] netlink: zone id is out of range [ 1089.620234][T13721] netlink: del zone limit has 8 unknown bytes [ 1089.685391][T13728] netlink: 'syz.2.16341': attribute type 1 has an invalid length. [ 1089.687855][T13726] syzkaller0: entered promiscuous mode [ 1089.723228][T13726] syzkaller0: entered allmulticast mode [ 1089.773307][T13731] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16343'. [ 1089.851417][T13728] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16341'. [ 1089.929411][T13728] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1089.946226][T13735] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16344'. [ 1089.986720][T13735] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1090.085078][T13739] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 1090.199160][T13750] netlink: 108 bytes leftover after parsing attributes in process `syz.0.16349'. [ 1090.228058][T13750] netlink: 108 bytes leftover after parsing attributes in process `syz.0.16349'. [ 1090.247585][T13750] netlink: 84 bytes leftover after parsing attributes in process `syz.0.16349'. [ 1090.352524][T13758] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16352'. [ 1090.378027][T13754] netlink: 28 bytes leftover after parsing attributes in process `syz.3.16350'. [ 1090.396145][T13760] netlink: del zone limit has 8 unknown bytes [ 1090.584390][T13766] tipc: Enabling of bearer rejected, failed to enable media [ 1090.633553][T13772] netlink: 16 bytes leftover after parsing attributes in process `syz.2.16356'. [ 1090.734502][T13776] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1090.742433][T13769] syzkaller0: entered promiscuous mode [ 1090.763225][T13769] syzkaller0: entered allmulticast mode [ 1091.037988][T13793] netlink: del zone limit has 8 unknown bytes [ 1091.078182][T13795] netlink: 28 bytes leftover after parsing attributes in process `syz.3.16366'. [ 1093.983238][T13806] netlink: 'syz.4.16374': attribute type 4 has an invalid length. [ 1093.999605][T13808] FAULT_INJECTION: forcing a failure. [ 1093.999605][T13808] name failslab, interval 1, probability 0, space 0, times 0 [ 1094.031507][T13808] CPU: 0 UID: 0 PID: 13808 Comm: syz.1.16372 Not tainted syzkaller #0 PREEMPT(full) [ 1094.031534][T13808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1094.031546][T13808] Call Trace: [ 1094.031554][T13808] [ 1094.031563][T13808] dump_stack_lvl+0xe8/0x150 [ 1094.031596][T13808] should_fail_ex+0x40c/0x560 [ 1094.031625][T13808] should_failslab+0xa8/0x100 [ 1094.031654][T13808] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1094.031676][T13808] ? local_lock_release+0x9c/0x160 [ 1094.031703][T13808] ? __alloc_skb+0x1d7/0x7a0 [ 1094.031725][T13808] ? __alloc_skb+0x1d7/0x7a0 [ 1094.031756][T13808] __alloc_skb+0x1d7/0x7a0 [ 1094.031785][T13808] netlink_sendmsg+0x5d4/0xb40 [ 1094.031815][T13808] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.031838][T13808] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1094.031863][T13808] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.031879][T13808] sock_sendmsg_nosec+0x13a/0x180 [ 1094.031904][T13808] ____sys_sendmsg+0x54e/0x850 [ 1094.031940][T13808] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1094.031975][T13808] ? import_iovec+0x73/0xa0 [ 1094.032007][T13808] ___sys_sendmsg+0x2a5/0x360 [ 1094.032033][T13808] ? __lock_acquire+0x683/0x2cf0 [ 1094.032064][T13808] ? __pfx____sys_sendmsg+0x10/0x10 [ 1094.032130][T13808] ? __fget_files+0x2a/0x420 [ 1094.032154][T13808] ? __fget_files+0x3a2/0x420 [ 1094.032205][T13808] __x64_sys_sendmsg+0x1b1/0x290 [ 1094.032237][T13808] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1094.032284][T13808] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.032306][T13808] do_syscall_64+0x174/0x580 [ 1094.032331][T13808] ? trace_irq_disable+0x3b/0x140 [ 1094.032354][T13808] ? clear_bhb_loop+0x40/0x90 [ 1094.032377][T13808] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.032396][T13808] RIP: 0033:0x7ff1cc39de59 [ 1094.032414][T13808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1094.032431][T13808] RSP: 002b:00007ff1ca5f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1094.032450][T13808] RAX: ffffffffffffffda RBX: 00007ff1cc625fa0 RCX: 00007ff1cc39de59 [ 1094.032471][T13808] RDX: 0000000000000004 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1094.032482][T13808] RBP: 00007ff1ca5f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1094.032494][T13808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1094.032504][T13808] R13: 00007ff1cc626038 R14: 00007ff1cc625fa0 R15: 00007ffd2e579e08 [ 1094.032533][T13808] [ 1094.484169][T13829] netlink: del zone limit has 8 unknown bytes [ 1094.865409][T13861] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 1094.866473][T13863] __nla_validate_parse: 4 callbacks suppressed [ 1094.866489][T13863] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16391'. [ 1094.885894][T13861] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 1094.911229][T13861] 0: reclassify loop, rule prio 0, protocol 800 [ 1094.911530][T13863] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16391'. [ 1094.954465][T13868] netlink: 28 bytes leftover after parsing attributes in process `syz.3.16391'. [ 1094.964020][T13869] netlink: del zone limit has 8 unknown bytes [ 1095.063857][T13875] netlink: 'syz.3.16396': attribute type 2 has an invalid length. [ 1095.170963][T13882] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1095.270873][T13893] netlink: 76 bytes leftover after parsing attributes in process `syz.4.16400'. [ 1095.504723][T13904] syzkaller1: entered promiscuous mode [ 1095.525168][T13904] syzkaller1: entered allmulticast mode [ 1095.567199][ T67] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 1095.714556][T13921] netlink: del zone limit has 8 unknown bytes [ 1095.848019][T13926] netlink: 'syz.3.16409': attribute type 2 has an invalid length. [ 1095.877427][T13928] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16410'. [ 1096.110428][T13945] netlink: 24 bytes leftover after parsing attributes in process `syz.4.16415'. [ 1096.170534][T13953] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16416'. [ 1096.369941][T13966] netlink: del zone limit has 8 unknown bytes [ 1096.495450][T13971] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16423'. [ 1096.520990][T13975] tipc: Resetting bearer [ 1096.542244][T13975] tipc: Resetting bearer [ 1096.790751][T13993] netlink: 56 bytes leftover after parsing attributes in process `syz.1.16428'. [ 1096.935226][T13998] ip6tnl0: Caught tx_queue_len zero misconfig [ 1097.008935][T14002] netlink: 188 bytes leftover after parsing attributes in process `syz.0.16433'. [ 1097.070222][T14006] netlink: del zone limit has 8 unknown bytes [ 1097.194354][T14008] macvlan0: entered promiscuous mode [ 1097.511160][T14024] syzkaller0: entered promiscuous mode [ 1097.528231][T14024] syzkaller0: entered allmulticast mode [ 1097.631882][T14039] netlink: 'syz.4.16449': attribute type 1 has an invalid length. [ 1097.712335][T14039] 8021q: adding VLAN 0 to HW filter on device bond30 [ 1098.113534][ T5903] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1098.252876][T14078] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1098.306530][T14086] tipc: Resetting bearer [ 1098.469936][ T5905] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1098.494719][T14101] FAULT_INJECTION: forcing a failure. [ 1098.494719][T14101] name failslab, interval 1, probability 0, space 0, times 0 [ 1098.525718][T14101] CPU: 0 UID: 0 PID: 14101 Comm: syz.2.16470 Not tainted syzkaller #0 PREEMPT(full) [ 1098.525745][T14101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1098.525757][T14101] Call Trace: [ 1098.525765][T14101] [ 1098.525774][T14101] dump_stack_lvl+0xe8/0x150 [ 1098.525806][T14101] should_fail_ex+0x40c/0x560 [ 1098.525834][T14101] should_failslab+0xa8/0x100 [ 1098.525864][T14101] __kmalloc_cache_noprof+0xa8/0x660 [ 1098.525890][T14101] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1098.525910][T14101] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1098.525935][T14101] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 1098.525971][T14101] genl_family_rcv_msg_doit+0x233/0x340 [ 1098.526004][T14101] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1098.526042][T14101] ? bpf_lsm_capable+0x9/0x20 [ 1098.526064][T14101] ? security_capable+0x7e/0x2c0 [ 1098.526101][T14101] genl_rcv_msg+0x614/0x7a0 [ 1098.526132][T14101] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1098.526155][T14101] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 1098.526193][T14101] netlink_rcv_skb+0x226/0x4a0 [ 1098.526223][T14101] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1098.526248][T14101] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1098.526295][T14101] ? down_read+0x2be/0x330 [ 1098.526318][T14101] genl_rcv+0x28/0x40 [ 1098.526339][T14101] netlink_unicast+0x7bb/0x940 [ 1098.526379][T14101] netlink_sendmsg+0x813/0xb40 [ 1098.526408][T14101] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1098.526432][T14101] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1098.526458][T14101] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1098.526476][T14101] sock_sendmsg_nosec+0x13a/0x180 [ 1098.526504][T14101] ____sys_sendmsg+0x54e/0x850 [ 1098.526539][T14101] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1098.526588][T14101] ? import_iovec+0x73/0xa0 [ 1098.526621][T14101] ___sys_sendmsg+0x2a5/0x360 [ 1098.526648][T14101] ? __lock_acquire+0x683/0x2cf0 [ 1098.526679][T14101] ? __pfx____sys_sendmsg+0x10/0x10 [ 1098.526748][T14101] ? __fget_files+0x2a/0x420 [ 1098.526772][T14101] ? __fget_files+0x3a2/0x420 [ 1098.526806][T14101] __x64_sys_sendmsg+0x1b1/0x290 [ 1098.526836][T14101] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1098.526880][T14101] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.526903][T14101] do_syscall_64+0x174/0x580 [ 1098.526929][T14101] ? trace_irq_disable+0x3b/0x140 [ 1098.526953][T14101] ? clear_bhb_loop+0x40/0x90 [ 1098.526978][T14101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1098.526997][T14101] RIP: 0033:0x7f42f1d9de59 [ 1098.527016][T14101] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1098.527033][T14101] RSP: 002b:00007f42efff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1098.527054][T14101] RAX: ffffffffffffffda RBX: 00007f42f2025fa0 RCX: 00007f42f1d9de59 [ 1098.527068][T14101] RDX: 0000000004008094 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1098.527080][T14101] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1098.527091][T14101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1098.527103][T14101] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 1098.527137][T14101] [ 1098.531156][T14102] syzkaller0: entered promiscuous mode [ 1098.861186][T14102] syzkaller0: entered allmulticast mode [ 1098.876370][T14104] netlink: 'syz.1.16468': attribute type 4 has an invalid length. [ 1099.158732][T14123] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1099.168212][T14127] tipc: Resetting bearer [ 1099.175175][T14127] tipc: Resetting bearer [ 1099.181123][T14126] netlink: 'syz.3.16478': attribute type 1 has an invalid length. [ 1099.211306][T14120] sctp: [Deprecated]: syz.0.16476 (pid 14120) Use of int in maxseg socket option. [ 1099.211306][T14120] Use struct sctp_assoc_value instead [ 1099.525500][T14130] bond25: entered allmulticast mode [ 1099.531335][T14130] 8021q: adding VLAN 0 to HW filter on device bond25 [ 1099.539325][T14136] sch_tbf: burst 7 is lower than device syzkaller0 mtu (313) ! [ 1099.842675][T14158] tipc: Resetting bearer [ 1099.915653][T14160] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1100.067743][T14170] __nla_validate_parse: 9 callbacks suppressed [ 1100.067765][T14170] netlink: 104 bytes leftover after parsing attributes in process `syz.2.16493'. [ 1100.262692][T14178] syzkaller0: entered promiscuous mode [ 1100.283414][T14178] syzkaller0: entered allmulticast mode [ 1100.688287][T14200] lo: entered promiscuous mode [ 1100.715228][T14200] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1100.766338][T14207] tipc: Enabling of bearer rejected, failed to enable media [ 1100.918601][T14210] bond0: (slave wireguard0): refused to change device type [ 1100.979904][T14222] netlink: 104 bytes leftover after parsing attributes in process `syz.4.16508'. [ 1101.260174][T14242] netlink: zone id is out of range [ 1101.266048][T14243] tipc: Enabling of bearer rejected, failed to enable media [ 1101.301747][T14242] netlink: zone id is out of range [ 1101.307271][T14242] netlink: zone id is out of range [ 1101.321930][T14242] netlink: zone id is out of range [ 1101.332790][T14242] netlink: zone id is out of range [ 1101.350519][T14242] netlink: zone id is out of range [ 1101.361776][T14242] netlink: zone id is out of range [ 1101.367570][T14242] netlink: zone id is out of range [ 1101.372847][T14242] netlink: zone id is out of range [ 1101.425114][T14247] tipc: Resetting bearer [ 1101.450773][T14247] tipc: Resetting bearer [ 1101.502530][T14260] x_tables: unsorted underflow at hook 3 [ 1101.702586][T14268] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16524'. [ 1101.722047][T14266] netlink: 104 bytes leftover after parsing attributes in process `syz.4.16523'. [ 1101.912093][T14276] FAULT_INJECTION: forcing a failure. [ 1101.912093][T14276] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1101.926107][T14276] CPU: 0 UID: 0 PID: 14276 Comm: syz.4.16528 Not tainted syzkaller #0 PREEMPT(full) [ 1101.926132][T14276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1101.926144][T14276] Call Trace: [ 1101.926152][T14276] [ 1101.926160][T14276] dump_stack_lvl+0xe8/0x150 [ 1101.926195][T14276] should_fail_ex+0x40c/0x560 [ 1101.926233][T14276] _copy_to_user+0x31/0xb0 [ 1101.926263][T14276] simple_read_from_buffer+0xe1/0x170 [ 1101.926294][T14276] proc_fail_nth_read+0x1bb/0x230 [ 1101.926324][T14276] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1101.926354][T14276] ? rw_verify_area+0x24a/0x4c0 [ 1101.926384][T14276] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1101.926409][T14276] vfs_read+0x213/0xa80 [ 1101.926442][T14276] ? __pfx___mutex_lock+0x10/0x10 [ 1101.926472][T14276] ? __pfx_vfs_read+0x10/0x10 [ 1101.926501][T14276] ? __fget_files+0x2a/0x420 [ 1101.926530][T14276] ? __fget_files+0x3a2/0x420 [ 1101.926553][T14276] ? __fget_files+0x2a/0x420 [ 1101.926587][T14276] ksys_read+0x150/0x270 [ 1101.926618][T14276] ? __pfx_ksys_read+0x10/0x10 [ 1101.926656][T14276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1101.926678][T14276] do_syscall_64+0x174/0x580 [ 1101.926706][T14276] ? trace_irq_disable+0x3b/0x140 [ 1101.926731][T14276] ? clear_bhb_loop+0x40/0x90 [ 1101.926755][T14276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1101.926779][T14276] RIP: 0033:0x7fe411b5e68e [ 1101.926797][T14276] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1101.926815][T14276] RSP: 002b:00007fe412b05fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1101.926836][T14276] RAX: ffffffffffffffda RBX: 00007fe412b066c0 RCX: 00007fe411b5e68e [ 1101.926849][T14276] RDX: 000000000000000f RSI: 00007fe412b060a0 RDI: 0000000000000004 [ 1101.926861][T14276] RBP: 00007fe412b06090 R08: 0000000000000000 R09: 0000000000000000 [ 1101.926873][T14276] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1101.926884][T14276] R13: 00007fe411e26038 R14: 00007fe411e25fa0 R15: 00007ffed04dc918 [ 1101.926913][T14276] [ 1102.225771][T14288] netlink: 'syz.3.16532': attribute type 10 has an invalid length. [ 1102.620187][T14304] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16542'. [ 1102.698216][T14315] netlink: 'syz.1.16545': attribute type 10 has an invalid length. [ 1102.715219][T14315] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1102.730059][T14317] netlink: 33 bytes leftover after parsing attributes in process `syz.2.16541'. [ 1102.769186][T14317] netlink: 140 bytes leftover after parsing attributes in process `syz.2.16541'. [ 1102.830485][T14322] netlink: 'syz.4.16547': attribute type 11 has an invalid length. [ 1102.841633][T14322] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16547'. [ 1102.907007][T14323] vcan1: entered promiscuous mode [ 1102.929254][T14323] vcan1: entered allmulticast mode [ 1103.020130][T14327] syzkaller0: entered promiscuous mode [ 1103.037780][T14327] syzkaller0: entered allmulticast mode [ 1103.074114][T14334] tipc: Resetting bearer [ 1103.145198][T14336] netlink: 'syz.0.16552': attribute type 2 has an invalid length. [ 1103.367285][T14352] netlink: 'syz.2.16558': attribute type 1 has an invalid length. [ 1103.449090][T14352] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16558'. [ 1103.468257][T14360] netlink: 'syz.1.16560': attribute type 29 has an invalid length. [ 1103.477883][T14360] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16560'. [ 1103.492726][T14352] 8021q: adding VLAN 0 to HW filter on device bond26 [ 1103.788355][T14376] netlink: 'syz.2.16566': attribute type 2 has an invalid length. [ 1104.082436][T14393] netlink: 'syz.2.16573': attribute type 1 has an invalid length. [ 1104.293698][T14411] 8021q: adding VLAN 0 to HW filter on device bond27 [ 1104.395329][T14421] FAULT_INJECTION: forcing a failure. [ 1104.395329][T14421] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1104.413135][T14421] CPU: 1 UID: 0 PID: 14421 Comm: syz.2.16579 Not tainted syzkaller #0 PREEMPT(full) [ 1104.413162][T14421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1104.413174][T14421] Call Trace: [ 1104.413182][T14421] [ 1104.413191][T14421] dump_stack_lvl+0xe8/0x150 [ 1104.413227][T14421] should_fail_ex+0x40c/0x560 [ 1104.413256][T14421] _copy_to_user+0x31/0xb0 [ 1104.413287][T14421] simple_read_from_buffer+0xe1/0x170 [ 1104.413320][T14421] proc_fail_nth_read+0x1bb/0x230 [ 1104.413349][T14421] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1104.413380][T14421] ? rw_verify_area+0x24a/0x4c0 [ 1104.413410][T14421] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1104.413434][T14421] vfs_read+0x213/0xa80 [ 1104.413465][T14421] ? __pfx___mutex_lock+0x10/0x10 [ 1104.413493][T14421] ? __pfx_vfs_read+0x10/0x10 [ 1104.413517][T14421] ? __fget_files+0x2a/0x420 [ 1104.413545][T14421] ? __fget_files+0x3a2/0x420 [ 1104.413567][T14421] ? __fget_files+0x2a/0x420 [ 1104.413598][T14421] ksys_read+0x150/0x270 [ 1104.413626][T14421] ? __pfx_ksys_read+0x10/0x10 [ 1104.413666][T14421] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1104.413686][T14421] do_syscall_64+0x174/0x580 [ 1104.413707][T14421] ? trace_irq_disable+0x3b/0x140 [ 1104.413731][T14421] ? clear_bhb_loop+0x40/0x90 [ 1104.413754][T14421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1104.413774][T14421] RIP: 0033:0x7f42f1d5e68e [ 1104.413792][T14421] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1104.413809][T14421] RSP: 002b:00007f42efff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1104.413829][T14421] RAX: ffffffffffffffda RBX: 00007f42efff66c0 RCX: 00007f42f1d5e68e [ 1104.413843][T14421] RDX: 000000000000000f RSI: 00007f42efff60a0 RDI: 0000000000000004 [ 1104.413856][T14421] RBP: 00007f42efff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1104.413867][T14421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1104.413878][T14421] R13: 00007f42f2026038 R14: 00007f42f2025fa0 R15: 00007fff62873008 [ 1104.413911][T14421] [ 1104.826357][T14437] tipc: Resetting bearer [ 1104.878965][T14433] hsr0: entered promiscuous mode [ 1104.884719][T14433] hsr0: entered allmulticast mode [ 1104.898494][T14433] hsr_slave_0: entered allmulticast mode [ 1104.916621][T14433] hsr_slave_1: entered allmulticast mode [ 1105.331303][T14463] netlink: 'syz.4.16592': attribute type 4 has an invalid length. [ 1105.343253][T14463] __nla_validate_parse: 11 callbacks suppressed [ 1105.343273][T14463] netlink: 17 bytes leftover after parsing attributes in process `syz.4.16592'. [ 1105.393942][T14463] netlink: 'syz.4.16592': attribute type 1 has an invalid length. [ 1105.450833][T14470] IPv6: NLM_F_CREATE should be specified when creating new route [ 1105.459934][T14469] netlink: 52 bytes leftover after parsing attributes in process `syz.0.16595'. [ 1105.505454][T14470] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1105.667064][T14475] netlink: 'syz.1.16598': attribute type 21 has an invalid length. [ 1105.794238][T14482] vlan6: entered promiscuous mode [ 1105.808775][T14482] erspan0: entered promiscuous mode [ 1105.879986][T14494] netlink: 104 bytes leftover after parsing attributes in process `syz.1.16606'. [ 1105.910454][T14487] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16604'. [ 1106.026043][T14452] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1106.038744][T14452] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1106.061123][T14507] netlink: 52 bytes leftover after parsing attributes in process `syz.1.16607'. [ 1106.082497][T14504] netlink: 'syz.4.16608': attribute type 10 has an invalid length. [ 1106.185689][T14452] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1106.201822][T14452] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1106.261636][T14515] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1106.291896][T14452] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1106.293889][T14517] FAULT_INJECTION: forcing a failure. [ 1106.293889][T14517] name failslab, interval 1, probability 0, space 0, times 0 [ 1106.301742][T14452] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1106.348633][T14517] CPU: 1 UID: 0 PID: 14517 Comm: syz.1.16613 Not tainted syzkaller #0 PREEMPT(full) [ 1106.348657][T14517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1106.348666][T14517] Call Trace: [ 1106.348673][T14517] [ 1106.348679][T14517] dump_stack_lvl+0xe8/0x150 [ 1106.348718][T14517] should_fail_ex+0x40c/0x560 [ 1106.348737][T14517] ? xt_alloc_table_info+0x40/0xb0 [ 1106.348844][T14517] should_failslab+0xa8/0x100 [ 1106.348865][T14517] __kvmalloc_node_noprof+0x176/0x860 [ 1106.348889][T14517] ? xt_alloc_table_info+0x40/0xb0 [ 1106.348911][T14517] xt_alloc_table_info+0x40/0xb0 [ 1106.348929][T14517] do_ipt_set_ctl+0x962/0xe20 [ 1106.348990][T14517] ? rcu_is_watching+0x15/0xb0 [ 1106.349012][T14517] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 1106.349046][T14517] ? __mutex_unlock_slowpath+0x731/0x900 [ 1106.349067][T14517] ? aa_sk_perm+0x6d5/0x900 [ 1106.349090][T14517] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1106.349113][T14517] ? __pfx_aa_sk_perm+0x10/0x10 [ 1106.349139][T14517] nf_setsockopt+0x26f/0x290 [ 1106.349159][T14517] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1106.349180][T14517] do_sock_setsockopt+0x17c/0x1b0 [ 1106.349206][T14517] __x64_sys_setsockopt+0x13d/0x1b0 [ 1106.349228][T14517] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.349244][T14517] do_syscall_64+0x174/0x580 [ 1106.349263][T14517] ? trace_irq_disable+0x3b/0x140 [ 1106.349280][T14517] ? clear_bhb_loop+0x40/0x90 [ 1106.349298][T14517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.349312][T14517] RIP: 0033:0x7ff1cc39de59 [ 1106.349328][T14517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1106.349341][T14517] RSP: 002b:00007ff1ca5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1106.349358][T14517] RAX: ffffffffffffffda RBX: 00007ff1cc625fa0 RCX: 00007ff1cc39de59 [ 1106.349368][T14517] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004 [ 1106.349376][T14517] RBP: 00007ff1ca5f6090 R08: 0000000000000520 R09: 0000000000000000 [ 1106.349385][T14517] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1106.349394][T14517] R13: 00007ff1cc626038 R14: 00007ff1cc625fa0 R15: 00007ffd2e579e08 [ 1106.349418][T14517] [ 1106.585173][T14523] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1106.598815][T14452] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1106.626417][T14452] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1106.731116][T14533] netlink: 'syz.1.16616': attribute type 2 has an invalid length. [ 1106.752496][T14452] tipc: Resetting bearer [ 1106.786677][T14452] ------------[ cut here ]------------ [ 1106.794817][T14452] sdata->crypto_tx_tailroom_needed_cnt != master->crypto_tx_tailroom_needed_cnt [ 1106.794864][T14452] WARNING: net/mac80211/key.c:1172 at ieee80211_free_keys+0x56e/0x680, CPU#0: syz.3.16589/14452 [ 1106.815014][T14452] Modules linked in: [ 1106.820689][T14452] CPU: 0 UID: 0 PID: 14452 Comm: syz.3.16589 Not tainted syzkaller #0 PREEMPT(full) [ 1106.830707][T14452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1106.842752][T14452] RIP: 0010:ieee80211_free_keys+0x56e/0x680 [ 1106.848805][T14452] Code: 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 57 22 86 00 cc e8 71 7e 7a f6 90 0f 0b 90 e9 22 fc ff ff e8 63 7e 7a f6 90 <0f> 0b 90 e9 30 fe ff ff e8 55 7e 7a f6 e9 1b fe ff ff 48 c7 c1 00 [ 1106.869199][T14452] RSP: 0018:ffffc90003537580 EFLAGS: 00010287 [ 1106.876638][T14452] RAX: ffffffff8b4bf3dd RBX: ffff8880351c4ec0 RCX: 0000000000080000 [ 1106.884698][T14452] RDX: ffffc9000dca3000 RSI: 0000000000073b10 RDI: 0000000000073b11 [ 1106.892702][T14452] RBP: ffffc90003537650 R08: ffffc90003537367 R09: 1ffff920006a6e6c [ 1106.901309][T14452] R10: dffffc0000000000 R11: fffff520006a6e6d R12: dffffc0000000000 [ 1106.909425][T14452] R13: 1ffff920006a6eb8 R14: 0000000000000002 R15: 0000000000000001 [ 1106.918178][T14452] FS: 00007fc957dd06c0(0000) GS:ffff888124f58000(0000) knlGS:0000000000000000 [ 1106.927722][T14452] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1106.934381][T14452] CR2: 0000001b34323ffc CR3: 000000004bb38000 CR4: 00000000003526f0 [ 1106.942384][T14452] Call Trace: [ 1106.945790][T14452] [ 1106.948755][T14452] ? __pfx_ieee80211_free_keys+0x10/0x10 [ 1106.954986][T14452] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1106.960835][T14452] ieee80211_do_stop+0x11fd/0x2410 [ 1106.966139][T14452] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 1106.971650][T14452] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1106.977617][T14452] ieee80211_stop+0x1ab/0x200 [ 1106.982375][T14452] ? __pfx_ieee80211_stop+0x10/0x10 [ 1106.988297][T14452] __dev_close_many+0x366/0x6e0 [ 1106.993471][T14452] ? __pfx___dev_close_many+0x10/0x10 [ 1106.998896][T14452] ? __mutex_trylock_common+0x15f/0x270 [ 1107.004544][T14452] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1107.010466][T14452] netif_close_many+0x222/0x410 [ 1107.015902][T14452] ? __pfx_netif_close_many+0x10/0x10 [ 1107.021312][T14452] ? __mutex_lock+0x30d/0x1550 [ 1107.026202][T14452] ? rfkill_fill_event+0x29c/0x3f0 [ 1107.031503][T14452] netif_close+0x160/0x220 [ 1107.036122][T14452] ? __pfx_netif_close+0x10/0x10 [ 1107.041081][T14452] ? __pfx___mutex_lock+0x10/0x10 [ 1107.046762][T14452] ? do_raw_spin_lock+0x12b/0x2f0 [ 1107.051824][T14452] dev_close+0xf7/0x210 [ 1107.056233][T14452] cfg80211_shutdown_all_interfaces+0xb0/0x220 [ 1107.062519][T14452] ? __pfx_cfg80211_rfkill_set_block+0x10/0x10 [ 1107.068807][T14452] cfg80211_rfkill_set_block+0x2d/0x50 [ 1107.074878][T14452] rfkill_set_block+0x19f/0x4d0 [ 1107.079775][T14452] rfkill_fop_write+0x43b/0x560 [ 1107.084724][T14452] ? apparmor_file_permission+0x1f4/0x300 [ 1107.090487][T14452] ? __pfx_rfkill_fop_write+0x10/0x10 [ 1107.095952][T14452] ? security_file_permission+0x40/0x260 [ 1107.101625][T14452] ? rw_verify_area+0x203/0x4c0 [ 1107.107178][T14452] ? __pfx_rfkill_fop_write+0x10/0x10 [ 1107.112596][T14452] vfs_write+0x296/0xba0 [ 1107.116962][T14452] ? __pfx_vfs_write+0x10/0x10 [ 1107.121805][T14452] ? __fget_files+0x2a/0x420 [ 1107.126522][T14452] ? __fget_files+0x2a/0x420 [ 1107.131139][T14452] ? __fget_files+0x3a2/0x420 [ 1107.136420][T14452] ? __fget_files+0x2a/0x420 [ 1107.141060][T14452] ksys_write+0x150/0x270 [ 1107.145521][T14452] ? __pfx_ksys_write+0x10/0x10 [ 1107.150418][T14452] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1107.156593][T14452] do_syscall_64+0x174/0x580 [ 1107.161256][T14452] ? trace_irq_disable+0x3b/0x140 [ 1107.166886][T14452] ? clear_bhb_loop+0x40/0x90 [ 1107.171601][T14452] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1107.177593][T14452] RIP: 0033:0x7fc956f9de59 [ 1107.182036][T14452] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1107.202258][T14452] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1107.210805][T14452] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1107.218893][T14452] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000008 [ 1107.227445][T14452] RBP: 00007fc957033e6f R08: 0000000000000000 R09: 0000000000000000 [ 1107.235499][T14452] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1107.243537][T14452] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1107.251555][T14452] [ 1107.255306][T14452] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1107.262596][T14452] CPU: 0 UID: 0 PID: 14452 Comm: syz.3.16589 Not tainted syzkaller #0 PREEMPT(full) [ 1107.272047][T14452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1107.282094][T14452] Call Trace: [ 1107.285366][T14452] [ 1107.288289][T14452] vpanic+0x56c/0xa60 [ 1107.292275][T14452] ? __pfx__printk+0x10/0x10 [ 1107.296868][T14452] ? __pfx_vpanic+0x10/0x10 [ 1107.301375][T14452] ? is_bpf_text_address+0x292/0x2b0 [ 1107.306659][T14452] ? is_bpf_text_address+0x26/0x2b0 [ 1107.311870][T14452] panic+0xc5/0xd0 [ 1107.315594][T14452] ? __pfx_panic+0x10/0x10 [ 1107.320028][T14452] __warn+0x315/0x4c0 [ 1107.324001][T14452] ? ieee80211_free_keys+0x56e/0x680 [ 1107.329282][T14452] ? ieee80211_free_keys+0x56e/0x680 [ 1107.334583][T14452] __report_bug+0x331/0x530 [ 1107.339256][T14452] ? ieee80211_free_keys+0x56e/0x680 [ 1107.344545][T14452] ? __pfx___report_bug+0x10/0x10 [ 1107.349580][T14452] ? schedule+0x16e/0x2b0 [ 1107.353911][T14452] ? synchronize_rcu_expedited+0x663/0x770 [ 1107.359726][T14452] ? __pfx_synchronize_rcu_expedited+0x10/0x10 [ 1107.365880][T14452] ? ieee80211_free_keys+0x56e/0x680 [ 1107.371167][T14452] report_bug+0x16a/0x220 [ 1107.375504][T14452] ? ieee80211_free_keys+0x56e/0x680 [ 1107.380785][T14452] ? ieee80211_free_keys+0x570/0x680 [ 1107.386066][T14452] handle_bug+0x9c/0x200 [ 1107.390306][T14452] exc_invalid_op+0x1a/0x50 [ 1107.394807][T14452] asm_exc_invalid_op+0x1a/0x20 [ 1107.399676][T14452] RIP: 0010:ieee80211_free_keys+0x56e/0x680 [ 1107.405595][T14452] Code: 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 57 22 86 00 cc e8 71 7e 7a f6 90 0f 0b 90 e9 22 fc ff ff e8 63 7e 7a f6 90 <0f> 0b 90 e9 30 fe ff ff e8 55 7e 7a f6 e9 1b fe ff ff 48 c7 c1 00 [ 1107.425298][T14452] RSP: 0018:ffffc90003537580 EFLAGS: 00010287 [ 1107.431371][T14452] RAX: ffffffff8b4bf3dd RBX: ffff8880351c4ec0 RCX: 0000000000080000 [ 1107.439345][T14452] RDX: ffffc9000dca3000 RSI: 0000000000073b10 RDI: 0000000000073b11 [ 1107.447316][T14452] RBP: ffffc90003537650 R08: ffffc90003537367 R09: 1ffff920006a6e6c [ 1107.455286][T14452] R10: dffffc0000000000 R11: fffff520006a6e6d R12: dffffc0000000000 [ 1107.463265][T14452] R13: 1ffff920006a6eb8 R14: 0000000000000002 R15: 0000000000000001 [ 1107.471263][T14452] ? ieee80211_free_keys+0x56d/0x680 [ 1107.476579][T14452] ? __pfx_ieee80211_free_keys+0x10/0x10 [ 1107.482214][T14452] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1107.488022][T14452] ieee80211_do_stop+0x11fd/0x2410 [ 1107.493154][T14452] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 1107.498632][T14452] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1107.504448][T14452] ieee80211_stop+0x1ab/0x200 [ 1107.509123][T14452] ? __pfx_ieee80211_stop+0x10/0x10 [ 1107.514315][T14452] __dev_close_many+0x366/0x6e0 [ 1107.519180][T14452] ? __pfx___dev_close_many+0x10/0x10 [ 1107.524541][T14452] ? __mutex_trylock_common+0x15f/0x270 [ 1107.530085][T14452] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1107.535974][T14452] netif_close_many+0x222/0x410 [ 1107.540841][T14452] ? __pfx_netif_close_many+0x10/0x10 [ 1107.546207][T14452] ? __mutex_lock+0x30d/0x1550 [ 1107.551000][T14452] ? rfkill_fill_event+0x29c/0x3f0 [ 1107.556121][T14452] netif_close+0x160/0x220 [ 1107.560566][T14452] ? __pfx_netif_close+0x10/0x10 [ 1107.565506][T14452] ? __pfx___mutex_lock+0x10/0x10 [ 1107.570554][T14452] ? do_raw_spin_lock+0x12b/0x2f0 [ 1107.575577][T14452] dev_close+0xf7/0x210 [ 1107.579742][T14452] cfg80211_shutdown_all_interfaces+0xb0/0x220 [ 1107.585899][T14452] ? __pfx_cfg80211_rfkill_set_block+0x10/0x10 [ 1107.592057][T14452] cfg80211_rfkill_set_block+0x2d/0x50 [ 1107.597608][T14452] rfkill_set_block+0x19f/0x4d0 [ 1107.602488][T14452] rfkill_fop_write+0x43b/0x560 [ 1107.607340][T14452] ? apparmor_file_permission+0x1f4/0x300 [ 1107.613066][T14452] ? __pfx_rfkill_fop_write+0x10/0x10 [ 1107.618575][T14452] ? security_file_permission+0x40/0x260 [ 1107.624209][T14452] ? rw_verify_area+0x203/0x4c0 [ 1107.629067][T14452] ? __pfx_rfkill_fop_write+0x10/0x10 [ 1107.634449][T14452] vfs_write+0x296/0xba0 [ 1107.638713][T14452] ? __pfx_vfs_write+0x10/0x10 [ 1107.643484][T14452] ? __fget_files+0x2a/0x420 [ 1107.648084][T14452] ? __fget_files+0x2a/0x420 [ 1107.652677][T14452] ? __fget_files+0x3a2/0x420 [ 1107.657359][T14452] ? __fget_files+0x2a/0x420 [ 1107.661959][T14452] ksys_write+0x150/0x270 [ 1107.666305][T14452] ? __pfx_ksys_write+0x10/0x10 [ 1107.671165][T14452] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1107.677226][T14452] do_syscall_64+0x174/0x580 [ 1107.681824][T14452] ? trace_irq_disable+0x3b/0x140 [ 1107.686864][T14452] ? clear_bhb_loop+0x40/0x90 [ 1107.691565][T14452] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1107.697469][T14452] RIP: 0033:0x7fc956f9de59 [ 1107.701889][T14452] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1107.721505][T14452] RSP: 002b:00007fc957dd0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1107.729923][T14452] RAX: ffffffffffffffda RBX: 00007fc957225fa0 RCX: 00007fc956f9de59 [ 1107.737890][T14452] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000008 [ 1107.745854][T14452] RBP: 00007fc957033e6f R08: 0000000000000000 R09: 0000000000000000 [ 1107.753840][T14452] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1107.761829][T14452] R13: 00007fc957226038 R14: 00007fc957225fa0 R15: 00007ffcfe9e2f08 [ 1107.769812][T14452] [ 1107.773145][T14452] Kernel Offset: disabled [ 1107.777465][T14452] Rebooting in 86400 seconds..