last executing test programs: 3.271254704s ago: executing program 3 (id=16702): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={0x24, 0x1, 0x1, 0x101, 0x0, 0x0, {}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x42e}]}, @CTA_TUPLE_REPLY={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x240440e5}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000340)=0x1d, 0x4) sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={0x0, 0x1b, &(0x7f00000000c0)={&(0x7f0000000740)=ANY=[], 0xc0}, 0x1, 0x0, 0x0, 0x4050}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e000000030100000000040000000000000008001f0001"], 0xd4}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f00000006c0)="db8d629e71", 0x5) syz_emit_ethernet(0xbe, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaabeaabb0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab9cdb042d2643fcbb2c5a57df67d074af6e8dafe09"], 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000300)={0x1, 'veth1_to_bond\x00', 0x1}, 0x18) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SIOCGSKNS(r4, 0x894c, 0x0) connect$can_bcm(r3, &(0x7f0000000100), 0x10) sendmsg$can_bcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x1d, r5}, 0x10, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000300)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r2, &(0x7f0000000940)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x10003, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000280)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9}, &(0x7f0000000140)=0x20) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(rfc4106(gcm(aes)))\x00'}, 0x58) close(0x3) 2.171759488s ago: executing program 3 (id=16710): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000023000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d0000009700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd01797bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1b1b71b5f7ec6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492aba0883783d2831210e00d2bfea3bf97ff8836d000000000000946bdb747e416b3064edb4f5aea06eba207ddab9f9baf98bc5192f23d95d33357fc55f92e5937e10995059f3348f69667b9260d504ba96446e1437af6fa875d9d32fdaaae01e6c74f192a23572ef582b7dd867c163c8cedaa2a2c5baceb37d4a40244c9bdca541cc7e65e20f5b5b735e2f33df9bd0614431d7dc5e47bb31c5b827d51733b64ddad4de1cdadce076d19d62e821b435619fb89fc07f81938200b4ebce83db57a6f5e9b1c2cf4b6ee90772d4865bf448d200e5c4e1e044d3587498128273b65670c02ff5c3c3ca633c41324fdc09e0b2621087db26bb0553612f2be27579ede2344a809e6b27d0044f2337895323357caddb54642dac82ae25deb08e111e0b9fa133c9da85dc50c3454ee0ff915331bd7f32f96fb55c7990334b1a1bc4d5d817b82f9fc278cc4858fbfa4d0f32a863c1ce050caddc5ca3b10c3e63daebba039e9f80fdef113a145ace522e8379474aa8849dcc2501df3ffcb02d29d55a1a2cbe00e836db0e6b0a7ffd680dbcf7b982a956998df3dce0e9091a4d736db69038061e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x1f00, 0x18, 0x19, &(0x7f00000007c0)="9f44948721919580684010a40566", 0x0, 0x7ff, 0x0, 0xb1, 0x0, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39", &(0x7f0000000380)="8c5911c525f5cf4c4ecf207ad2ec", 0x0, 0x0, 0xffffffff}, 0x23) (fail_nth: 10) 1.867900042s ago: executing program 3 (id=16714): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c000000020603000000000000000000000000001400078008001240000000000500150002000000050001000600000005000500020000000500040000000000090002"], 0x4c}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200e19}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffff7fff}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) 1.500767692s ago: executing program 3 (id=16721): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={0x24, 0x1, 0x1, 0x101, 0x0, 0x0, {}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x42e}]}, @CTA_TUPLE_REPLY={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x240440e5}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000340)=0x1d, 0x4) sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={0x0, 0x1b, &(0x7f00000000c0)={&(0x7f0000000740)=ANY=[], 0xc0}, 0x1, 0x0, 0x0, 0x4050}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e000000030100000000040000000000000008001f0001"], 0xd4}}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f00000006c0)="db8d629e71", 0x5) syz_emit_ethernet(0xbe, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaabeaabb0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab9cdb042d2643fcbb2c5a57df67d074af6e8dafe09"], 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000300)={0x1, 'veth1_to_bond\x00', 0x1}, 0x18) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$SIOCGSKNS(r4, 0x894c, 0x0) connect$can_bcm(r3, &(0x7f0000000100), 0x10) sendmsg$can_bcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r3, &(0x7f00000001c0)={&(0x7f0000000000)={0x1d, r5}, 0x10, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070}, 0x94) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000300)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r2, &(0x7f0000000940)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x10003, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000280)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9}, &(0x7f0000000140)=0x20) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(rfc4106(gcm(aes)))\x00'}, 0x58) close(0x3) 1.386128983s ago: executing program 0 (id=16725): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0100001000130700000000fcdbdf2520010000000000000000000000001a0120010000000000000000000000000001000000004e2100020a0000006c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe3200000000000000000000000000ffffac1414bb000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000050000000000000043050000000000000700000000000000ffffffffffffff7f000000000000000000000000000000000000000000000000000000002cbd7000003500000200040050000000000000004c001200726663343130362867636d28616573292900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060"], 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x0) 1.279114735s ago: executing program 0 (id=16726): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r2, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x2100000000000000, 0x20000011}, 0x4000810) 1.115214263s ago: executing program 1 (id=16730): syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x18, 0xfffe, 0x0, 0xa0, 0x2f, 0x0, @loopback, @multicast1}, {0x2001, 0x880b, 0x8}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="558000000206010200000000000000000c000000040007800500010006000000050005000a00003335000000000000310000000016561300030068617368726574000000000000000000000060e1384c92c1245dff26ca44b687059a1ca7dba37a7a50758fb99b4fa6a42d81f10c6bcc91ef35854ed2fc06f605e12c0a951548e8c32a888f1898ae1b3bf8086d2685847a979c95652faa2637a2fae76dc59b6e9dd0480e0d123a065ab25c6d303926de1f7baea7edb672ed78e0e13e37"], 0x4c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4000000010003b050c00"/20, @ANYRES32=0x0, @ANYBLOB="c1900000815c000018001280080001dff288c219dc07d342af101482264801cf43b8478008000200", @ANYRES32=r2, @ANYBLOB="03000a00", @ANYRESOCT=r2], 0x40}}, 0x48010) 1.109198202s ago: executing program 0 (id=16731): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000040)=@ethtool_channels={0x3d, 0x4, 0x1, 0xfe, 0x8000, 0x3, 0x9, 0x9, 0x9}}) 1.067695053s ago: executing program 0 (id=16732): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="350a00000000000061114c000000001d180000000000000000000000000000009500000000000000149fb8aa13db8de90b01b0e2eb0bb8ba99fb6d1b0a1cc6ee0290de496a9512e5523c29ff8ea81eb335343f9d7433dab37d973df498169ea4fa5b9821edb7a296dfb6182e0cd28c6abfd8efc0"], &(0x7f0000000440)='GPL\x00'}, 0x90) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="1a0000004a00010000010000000000000a"], 0x1c}}, 0x0) accept4(r0, &(0x7f00000001c0)=@pptp={0x18, 0x2, {0x0, @local}}, &(0x7f0000000240)=0x80, 0x80800) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e23, 0x2, @loopback}}}, 0x84) socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000440), 0x10) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000400)={0x4, 0x5, 0x80, 0x80000001}, 0x10) listen(r3, 0x709) r4 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$SIOCAX25OPTRT(r0, 0x89e7, &(0x7f0000000280)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null}) connect$vsock_stream(r4, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) close(0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000000c0)={0x6}, 0xaf) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r2) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000020000000c000000180001801400020076657468315f766972745f77696669001800038014"], 0x44}, 0x1, 0x0, 0x0, 0x4054}, 0x0) 1.04754192s ago: executing program 4 (id=16733): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x2, 0x5, 0x628, 0x0, 0x488, 0xffffffff, 0x0, 0x268, 0x558, 0x558, 0xffffffff, 0x558, 0x558, 0x5, 0x0, {[{{@uncond, 0x0, 0x220, 0x268, 0x0, {}, [@common=@rt={{0x138}, {0x4, [0x3, 0x800], 0x0, 0xf23d8cefb056ae2b, 0x7, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @private0, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @remote}, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @dev={0xfe, 0x80, '\x00', 0x2b}, @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote], 0x9}}, @common=@unspec=@connlimit={{0x40}, {[0x0, 0xffffffff, 0xffffffff, 0xff000000], 0xffffff7f, 0x1, {0x4}}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote}}}, {{@ipv6={@dev, @loopback, [0x0, 0x0, 0x1000000], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x1b}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [0x0, 0xff000000], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x688) 1.046857016s ago: executing program 1 (id=16734): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f00000010c0)}], 0x1, 0x1) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_channels={0x1, 0x7c4d2537, 0x0, 0xfffffffd}}) 971.26328ms ago: executing program 0 (id=16735): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) accept4$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c, 0x800) (async, rerun: 64) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x523, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x21b6b}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x3c}}, 0x0) (rerun: 64) 934.208679ms ago: executing program 4 (id=16736): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000008c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000200000000000000300000028000180"], 0x3c}}, 0x0) 924.642471ms ago: executing program 1 (id=16737): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}]}}]}, 0x3c}, 0x1, 0xf2ff0000, 0x0, 0xc804}, 0x2) 853.684643ms ago: executing program 2 (id=16738): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0xe22, 0x40, @ipv4={'\x00', '\xff\xff', @multicast2}, 0xfffffffc}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 783.220168ms ago: executing program 4 (id=16739): syz_emit_ethernet(0x7e, &(0x7f0000000000)={@broadcast, @random="6c7621d7cc94", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "fec000", 0x48, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "98a350", 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x2}, @private1, [@hopopts={0x11}], "fafb17c103001c193eb46558f48ce6b9"}}}}}}}, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x25dfdbfc, {}, [@RTA_DPORT={0x6, 0x1d, 0x4e24}, @RTA_SPORT={0x6, 0x1c, 0x4e21}]}, 0x2c}}, 0x0) (async) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000080)={'wg0\x00'}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a68010000000a01030000000000000000010000000900010073797a30000000006800060099b6770cba4b96d54e0564fd3c29e674a6c6be9a0295878f456b889ac018bc219c81c9372d53b32694e190b7df65b5b446607b201c2fc4b8e2de353661987744188fe1f37a67a472f667adffb0a44f6a6ef555777e87b5a9f79b4b79363dece9ee9c28dd690006008301f0dfeff0619747d132396e4b37ad571180f66e9e5f6f88d8a432e3d5c27fe0a7eba19570ecf7514b6d116494fe6ae662fa12a42d95f777e9127c7ecf7aa6b7923483deedfce5cae91d4b7214a8499f5e175d933e68cf800b2a82927d602120babbaa4d0000000c000440000000000000000365000600a80f2f2108305d71c694fc24d3421d6574273a64dd17588dcda7987e8604c6c4f7113836d86465a827066acdfa1180c5758cb9e80a8f9e37a6181e9027386ffe29431b612e8de28fd5e36c9785ed2a3c0e599ef02bffe176bde8f1d348d071ec4900000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100060008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000340000000010800014000000002080002400000000114000000110001"], 0x224}}, 0x0) 764.939763ms ago: executing program 1 (id=16740): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="30000000111401002dbd7000ffdbdf2608004a000000000008004b00130000000800010000000000080003"], 0x30}, 0x1, 0x0, 0x0, 0x24040051}, 0x48884) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f00000003c0)={0x0, 0x4, 0x8, 0x1}) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f00000007c0)={r3, "ec7b272a8e13f395c87a7d12e2304e70"}) sendmsg$nl_route_sched(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@delchain={0x1c, 0x5f, 0x333, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x5, 0xfff6}, {0x1, 0xe}}}, 0x24}}, 0x0) 763.707738ms ago: executing program 2 (id=16741): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0xc9d7, 0x9, 0x1}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000140), &(0x7f0000000000)=@tcp6, 0x3}, 0x20) r1 = socket$rxrpc(0x21, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)) r2 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r2, &(0x7f0000000380)={&(0x7f0000000080)=@alg, 0x80, &(0x7f0000000300)=[{&(0x7f0000000200)=""/226, 0xe2}], 0x1, &(0x7f0000000340)=""/54, 0x36}, 0x12040) ioctl$INCFS_IOC_FILL_BLOCKS(r2, 0x80106720, 0x0) 691.328859ms ago: executing program 4 (id=16742): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000040)=@ethtool_channels={0x33, 0x4, 0x1, 0xfe, 0x8000, 0x3, 0x9, 0x9, 0x9}}) 665.558374ms ago: executing program 2 (id=16743): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x110, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@private1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000, 0xad, 0x3f000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x74}, [@coaddr={0x14, 0xe, @in=@dev={0xac, 0x14, 0x14, 0x36}}, @offload={0xc, 0x1c, {0x0, 0x1}}]}, 0x110}}, 0x20000800) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2711, 0x0, &(0x7f0000000280)) 580.90454ms ago: executing program 1 (id=16744): r0 = socket(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0xc08, 0x3, 0x440, 0x310, 0x5002004a, 0xb, 0x310, 0xea13, 0x3a8, 0x3c8, 0x3c8, 0x3a8, 0x3c8, 0x3, 0x0, {[{{@ip={@multicast2, @private=0xa010101, 0xff, 0xffffffff, 'bridge0\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x5c, 0x3, 0x2}, 0x0, 0x2c8, 0x310, 0x0, {0x500}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0x2, 0x0, [{}, {0x16}, {0x4}, {}, {}, {0x0, 0x0, 0x5e}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x6}, {0x0, 0x0, 0x4}, {}, {0x4, 0x8}, {}, {}, {0x1}, {0x0, 0x0, 0x0, 0x7f}, {0x0, 0x4}, {}, {}, {}, {0xfffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {0x0, 0x0, 0x40}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x80}, {}, {}, {}, {}, {}, {0x0, 0x0, 0xfd}]}}, @common=@inet=@socket3={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x4a0) 539.180697ms ago: executing program 3 (id=16745): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@dev={0xfe, 0x80, '\x00', 0x3a}, 0x800, 0x1, 0xff, 0x8, 0x0, 0xfa}, 0x20) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f00000000c0)=ANY=[@ANYRES64=r2], 0x6) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=@newae={0x5c, 0x1e, 0x468bbc8229e18b43, 0x0, 0x0, {{}, @in6=@empty}, [@replay_esn_val={0x1c}]}, 0x5c}}, 0x0) ioctl$TUNSETIFF(r1, 0x80111500, &(0x7f0000000040)={'wlan0\x00'}) socket$inet_smc(0x2b, 0x1, 0x0) 538.978173ms ago: executing program 4 (id=16746): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'erspan0\x00', &(0x7f0000000040)=@ethtool_channels={0x3d, 0x4, 0x1, 0xfe, 0x8000, 0x3, 0x9, 0x9, 0x9}}) (fail_nth: 4) 428.460902ms ago: executing program 2 (id=16747): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r2, 0x0, 0x0}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x8, 0xc, 0x3, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r3}, 0x38) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x23}, 0x38) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c4000000190001000000000010000000ff0100000000000000000000000000016401010200000000000000000000000000000000000200000a00008006000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000a7c9043d000000000000000000000000000000000000000008000000000000000000000000000000fbffffffffffffff00000000000000000200000000ee00000000000000000000030000000000000000000000b86b6e00"], 0xc4}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=r5, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}, 0x1, 0x0, 0x0, 0x240080c0}, 0x0) 375.177736ms ago: executing program 3 (id=16748): openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_xfrm(0x10, 0x3, 0x6) close(0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) sendmsg$inet(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{0x0}], 0x1}, 0x40000300) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close(0x3) 47.170569ms ago: executing program 4 (id=16749): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r0, 0x0, 0x14, 0x0, &(0x7f00000006c0)="f6f4e9a1d78ad62ceef1884366a578bb3fb7dbfc", 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000700)='Ir;', 0x0}, 0x50) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x1, @null, @bpq0, 0x9, 'syz0\x00', @null, 0x1, 0x0, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast]}) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000080)={0x1, @default, @bpq0, 0x3ff, 'syz1\x00', @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, 0x7, [@bcast, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @bcast]}) 46.843302ms ago: executing program 2 (id=16750): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, 0x0) 19.669354ms ago: executing program 0 (id=16751): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}]}}]}, 0x3c}, 0x1, 0xffffa888, 0x0, 0xc804}, 0x2) 16.569088ms ago: executing program 2 (id=16752): r0 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000580)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000300)="a905000000407464000100000000000000e5c0d8af7a6417e436a106993e1e5ad8311dab", 0x24}], 0x1}}, {{&(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\a'], 0x28}}], 0x2, 0x800) 0s ago: executing program 1 (id=16753): bpf$MAP_CREATE(0x0, &(0x7f0000004080)=@base={0x2, 0x4, 0x4, 0xbf22, 0x400}, 0x48) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x2e, &(0x7f00000001c0)=0xb1e0, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r7) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$kcm(0x29, 0x5, 0x0) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x4ac, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x5, 0x4}, {}, {0xa}}, [@filter_kind_options=@f_matchall={{0xd}, {0x478, 0x2, [@TCA_MATCHALL_ACT={0x474, 0x2, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0x5, 0x4, 0x2, 0x4, 0x5, 0x2234, 0x83, 0x81b, 0x7fe, 0x8, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x800004, 0x58b, 0x85a, 0x3ff, 0x46, 0x2, 0x1, 0x0, 0x80000000, 0x1, 0x790, 0x5, 0x1, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x0, 0xffffffff, 0x1, 0x3, 0x3, 0x5b1f, 0x7b0, 0x3, 0x100, 0xfffffffe, 0xd, 0xff, 0x1, 0xfffc, 0x6, 0x10a4, 0x11ff, 0x80, 0x104, 0x7, 0x3, 0x1, 0x3, 0x2, 0x9, 0x81, 0x7, 0x8, 0x5, 0x10001, 0x3, 0x3, 0xfffffef9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0xffffca9a, 0x6, 0x7, 0x8, 0x100, 0xc0000000, 0x0, 0x6, 0x6, 0x8, 0x7ffffffe, 0x8, 0x1d24, 0x2, 0x7, 0x80000000, 0x7f, 0x7, 0x9, 0xff, 0x24, 0x5, 0x8, 0x6, 0x10007e, 0x8, 0x0, 0x5, 0x470, 0x7f, 0xe, 0x0, 0x1, 0x0, 0x4, 0x10009, 0x61, 0x200, 0x9, 0x2, 0x1, 0x6, 0x3ff, 0x8, 0x7, 0x11, 0xda56, 0x7ffffffe, 0x180, 0x2f0cb955, 0x7, 0x8, 0xf, 0x6ae, 0x9, 0x0, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0x9, 0x7, 0x6, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0xf7800000, 0x40ac, 0x8, 0x3, 0x13, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0x3, 0xa, 0x3, 0xffffffff, 0x8, 0xffffb16b, 0x7, 0x7f, 0x5, 0x3, 0xa, 0x1, 0x0, 0xa, 0x300, 0x5, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x3, 0x8, 0x3, 0x2, 0x9, 0xb, 0x399d, 0x5, 0x8ab6, 0x18000, 0x2, 0xfffffffb, 0x2, 0x2, 0x528c, 0x206, 0x5f, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x761, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x6, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x80001, 0x5, 0x354d, 0x4, 0x2, 0x1, 0x200, 0x0, 0x8, 0x7, 0x0, 0x80, 0x5, 0x8, 0x1, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0xafb, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_TBF={0x3c, 0x1, {0xfffffe00, 0x20000000, 0x5, 0x1, 0xdbec, {0x8, 0x0, 0xb55, 0x5, 0xa, 0xb}, {0x6, 0x1, 0xd, 0x800, 0x1}, 0x2, 0x0, 0x6}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x4ac}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r6, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) kernel console output (not intermixed with test programs): 822838][T12693] ? __pfx___mutex_lock+0x10/0x10 [ 1231.822862][T12693] ? __pfx_vfs_read+0x10/0x10 [ 1231.822894][T12693] ? __fget_files+0x2a/0x420 [ 1231.822921][T12693] ? __fget_files+0x3a0/0x420 [ 1231.822941][T12693] ? __fget_files+0x2a/0x420 [ 1231.822970][T12693] ksys_read+0x150/0x270 [ 1231.822995][T12693] ? __pfx_ksys_read+0x10/0x10 [ 1231.823025][T12693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1231.823043][T12693] do_syscall_64+0x15f/0xf80 [ 1231.823060][T12693] ? trace_irq_disable+0x3b/0x140 [ 1231.823077][T12693] ? clear_bhb_loop+0x40/0x90 [ 1231.823098][T12693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1231.823116][T12693] RIP: 0033:0x7feb5b75d04e [ 1231.823133][T12693] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1231.823148][T12693] RSP: 002b:00007feb5c5f2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1231.823166][T12693] RAX: ffffffffffffffda RBX: 00007feb5c5f36c0 RCX: 00007feb5b75d04e [ 1231.823180][T12693] RDX: 000000000000000f RSI: 00007feb5c5f30a0 RDI: 0000000000000003 [ 1231.823191][T12693] RBP: 00007feb5c5f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1231.823203][T12693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1231.823215][T12693] R13: 00007feb5ba16038 R14: 00007feb5ba15fa0 R15: 00007ffe905ccca8 [ 1231.823243][T12693] [ 1232.135155][T12660] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 40872 - 0 [ 1232.146966][T12660] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1232.166672][T12660] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1232.224483][T12696] netlink: 32 bytes leftover after parsing attributes in process `syz.0.15090'. [ 1232.233924][T12699] netlink: 'syz.3.15091': attribute type 13 has an invalid length. [ 1232.249250][T12699] netlink: 4 bytes leftover after parsing attributes in process `syz.3.15091'. [ 1232.292520][T12706] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1232.311510][T12706] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1232.380248][T12699] netlink: 'syz.3.15091': attribute type 13 has an invalid length. [ 1232.406076][T12660] bond0: (slave ): Releasing backup interface [ 1232.419436][T12713] IPVS: set_ctl: invalid protocol: 33 224.0.0.1:20000 [ 1232.440564][T12660] netdevsim netdevsim4  (unregistering): unset [1, 0] type 2 family 0 port 40872 - 0 [ 1232.450543][T12660] netdevsim netdevsim4  (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1232.460479][T12660] netdevsim netdevsim4  (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1232.537745][T12706] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1232.573523][T12706] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1232.697865][T12724] xt_hashlimit: size too large, truncated to 1048576 [ 1232.714249][T12706] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1232.745936][T12706] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1233.144161][T12706] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.172780][T12706] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1233.198593][T20789] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 1233.211802][T20789] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 1233.221049][T20789] netdevsim netdevsim4 eth0: set [1, 2] type 2 family 0 port 40872 - 0 [ 1233.230687][T20789] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 1233.239876][T20789] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 1233.248875][T20789] netdevsim netdevsim4 eth1: set [1, 2] type 2 family 0 port 40872 - 0 [ 1233.385745][ T9914] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 1233.415927][ T9914] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 1233.442413][ T9914] netdevsim netdevsim4 eth2: set [1, 2] type 2 family 0 port 40872 - 0 [ 1233.469188][T12761] netlink: 'syz.0.15104': attribute type 10 has an invalid length. [ 1233.480598][T20789] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 1233.503407][T20789] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 1233.514125][T20789] netdevsim netdevsim4 eth3: set [1, 2] type 2 family 0 port 40872 - 0 [ 1233.640372][ T35] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1233.652122][ T35] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1233.715910][ T35] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1233.724578][ T35] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1233.744784][T12775] netlink: 'syz.2.15109': attribute type 1 has an invalid length. [ 1233.809044][T12775] 8021q: adding VLAN 0 to HW filter on device bond26 [ 1233.817468][ T9916] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1233.840592][ T9916] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1233.873805][T12780] bond26: (slave geneve4): making interface the new active one [ 1233.883510][T12780] bond26: (slave geneve4): Enslaving as an active interface with an up link [ 1233.938873][ T9916] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1233.955913][ T9916] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1233.977900][ T9916] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1233.982529][T12786] xt_hashlimit: size too large, truncated to 1048576 [ 1234.016074][T20789] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1234.042504][T20789] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1234.071276][T20789] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1234.104954][T32352] lo speed is unknown, defaulting to 1000 [ 1234.114135][T32352] syz2: Port: 1 Link DOWN [ 1234.142270][ T5932] lo speed is unknown, defaulting to 1000 [ 1234.531350][T12821] netlink: 'syz.2.15121': attribute type 2 has an invalid length. [ 1234.566740][T12825] netlink: 'syz.0.15122': attribute type 1 has an invalid length. [ 1234.601274][T12825] bond36: entered promiscuous mode [ 1234.607047][T12825] 8021q: adding VLAN 0 to HW filter on device bond36 [ 1234.634831][T12825] bond36: (slave bridge31): making interface the new active one [ 1234.643141][T12825] bridge31: entered promiscuous mode [ 1234.656364][T12825] bridge31: left promiscuous mode [ 1234.761949][T12835] netlink: 'syz.2.15124': attribute type 7 has an invalid length. [ 1234.770332][T12835] __nla_validate_parse: 15 callbacks suppressed [ 1234.770350][T12835] netlink: 16 bytes leftover after parsing attributes in process `syz.2.15124'. [ 1235.120012][T12855] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 1235.190594][T12860] netlink: 'syz.1.15130': attribute type 4 has an invalid length. [ 1235.204284][T12860] netlink: 244 bytes leftover after parsing attributes in process `syz.1.15130'. [ 1235.321178][T12862] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.15129'. [ 1235.324291][T12874] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15132'. [ 1235.340567][T12874] macvtap0: Device is already in use. [ 1235.368924][T12862] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15129'. [ 1235.401579][T12862] netlink: 24 bytes leftover after parsing attributes in process `syz.4.15129'. [ 1235.989252][T12918] netlink: 36 bytes leftover after parsing attributes in process `syz.2.15146'. [ 1236.001806][T12919] netlink: 65039 bytes leftover after parsing attributes in process `syz.3.15147'. [ 1236.011907][T12918] netlink: 36 bytes leftover after parsing attributes in process `syz.2.15146'. [ 1236.404104][T12942] netlink: 64 bytes leftover after parsing attributes in process `syz.3.15152'. [ 1236.988885][T12985] xt_hashlimit: size too large, truncated to 1048576 [ 1237.040795][T12976] xt_CT: No such helper "pptp" [ 1237.682460][T13034] FAULT_INJECTION: forcing a failure. [ 1237.682460][T13034] name failslab, interval 1, probability 0, space 0, times 0 [ 1237.701702][T13034] CPU: 0 UID: 0 PID: 13034 Comm: syz.3.15177 Not tainted syzkaller #0 PREEMPT(full) [ 1237.701728][T13034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1237.701749][T13034] Call Trace: [ 1237.701761][T13034] [ 1237.701769][T13034] dump_stack_lvl+0xe8/0x150 [ 1237.701817][T13034] should_fail_ex+0x412/0x560 [ 1237.701852][T13034] should_failslab+0xa8/0x100 [ 1237.701869][T13034] ? skb_clone+0x212/0x3a0 [ 1237.701889][T13034] kmem_cache_alloc_noprof+0x87/0x650 [ 1237.701917][T13034] ? __netlink_lookup+0xc6/0x8b0 [ 1237.701946][T13034] skb_clone+0x212/0x3a0 [ 1237.701967][T13034] __netlink_deliver_tap+0x404/0x850 [ 1237.702001][T13034] ? netlink_deliver_tap+0x2e/0x1b0 [ 1237.702024][T13034] netlink_deliver_tap+0x19c/0x1b0 [ 1237.702047][T13034] netlink_unicast+0x730/0x8e0 [ 1237.702079][T13034] netlink_sendmsg+0x813/0xb40 [ 1237.702111][T13034] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1237.702137][T13034] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1237.702163][T13034] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1237.702189][T13034] ____sys_sendmsg+0x972/0x9f0 [ 1237.702213][T13034] ? __might_fault+0xaf/0x130 [ 1237.702251][T13034] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1237.702286][T13034] ? import_iovec+0x73/0xa0 [ 1237.702309][T13034] ___sys_sendmsg+0x2a5/0x360 [ 1237.702332][T13034] ? __lock_acquire+0x6b5/0x2cf0 [ 1237.702358][T13034] ? __pfx____sys_sendmsg+0x10/0x10 [ 1237.702415][T13034] ? __fget_files+0x2a/0x420 [ 1237.702441][T13034] ? __fget_files+0x3a0/0x420 [ 1237.702470][T13034] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1237.702499][T13034] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1237.702531][T13034] ? __pfx_ksys_write+0x10/0x10 [ 1237.702562][T13034] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1237.702581][T13034] do_syscall_64+0x15f/0xf80 [ 1237.702600][T13034] ? trace_irq_disable+0x3b/0x140 [ 1237.702619][T13034] ? clear_bhb_loop+0x40/0x90 [ 1237.702640][T13034] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1237.702659][T13034] RIP: 0033:0x7feb5b79c819 [ 1237.702677][T13034] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1237.702692][T13034] RSP: 002b:00007feb5c5f3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1237.702711][T13034] RAX: ffffffffffffffda RBX: 00007feb5ba15fa0 RCX: 00007feb5b79c819 [ 1237.702724][T13034] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1237.702740][T13034] RBP: 00007feb5c5f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1237.702751][T13034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1237.702762][T13034] R13: 00007feb5ba16038 R14: 00007feb5ba15fa0 R15: 00007ffe905ccca8 [ 1237.702791][T13034] [ 1237.984381][T13033] netlink: 'syz.2.15178': attribute type 9 has an invalid length. [ 1238.103519][T13036] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1238.129320][T13036] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1238.152476][T13044] xt_hashlimit: size too large, truncated to 1048576 [ 1238.826484][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 1238.834606][ T1297] clip:clip_start_xmit: skb_dst(skb) == NULL [ 1238.870003][T13082] xt_CT: No such helper "pptp" [ 1239.349881][T13123] xt_hashlimit: size too large, truncated to 1048576 [ 1239.509921][T13131] openvswitch: netlink: Message has 3 unknown bytes. [ 1239.865821][T13155] __nla_validate_parse: 12 callbacks suppressed [ 1239.865842][T13155] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15206'. [ 1240.885362][T13193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15216'. [ 1240.920949][T13193] netlink: 'syz.4.15216': attribute type 30 has an invalid length. [ 1241.194426][T13211] netlink: 196 bytes leftover after parsing attributes in process `syz.2.15225'. [ 1241.237677][T13211] netlink: 196 bytes leftover after parsing attributes in process `syz.2.15225'. [ 1241.248425][T13215] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15229'. [ 1241.258088][T13211] netlink: 19 bytes leftover after parsing attributes in process `syz.2.15225'. [ 1241.266822][T13220] netlink: 248 bytes leftover after parsing attributes in process `syz.2.15225'. [ 1241.271834][T13215] macvtap0: Device is already in use. [ 1241.395223][T13222] xt_CT: No such helper "pptp" [ 1241.483915][T13234] xt_hashlimit: size too large, truncated to 1048576 [ 1241.535974][T13229] xt_hashlimit: size too large, truncated to 1048576 [ 1241.556910][T13237] FAULT_INJECTION: forcing a failure. [ 1241.556910][T13237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1241.602336][T13237] CPU: 0 UID: 0 PID: 13237 Comm: syz.3.15234 Not tainted syzkaller #0 PREEMPT(full) [ 1241.602363][T13237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1241.602373][T13237] Call Trace: [ 1241.602381][T13237] [ 1241.602389][T13237] dump_stack_lvl+0xe8/0x150 [ 1241.602418][T13237] should_fail_ex+0x412/0x560 [ 1241.602446][T13237] _copy_from_user+0x2d/0xb0 [ 1241.602464][T13237] kstrtouint_from_user+0xd6/0x180 [ 1241.602490][T13237] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1241.602525][T13237] proc_fail_nth_write+0x8e/0x210 [ 1241.602549][T13237] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1241.602578][T13237] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1241.602602][T13237] vfs_write+0x29a/0xb90 [ 1241.602643][T13237] ? __pfx_vfs_write+0x10/0x10 [ 1241.602670][T13237] ? __fget_files+0x2a/0x420 [ 1241.602693][T13237] ? __fget_files+0x3a0/0x420 [ 1241.602712][T13237] ? __fget_files+0x2a/0x420 [ 1241.602740][T13237] ksys_write+0x150/0x270 [ 1241.602763][T13237] ? __pfx_ksys_write+0x10/0x10 [ 1241.602793][T13237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1241.602813][T13237] do_syscall_64+0x15f/0xf80 [ 1241.602833][T13237] ? trace_irq_disable+0x3b/0x140 [ 1241.602853][T13237] ? clear_bhb_loop+0x40/0x90 [ 1241.602873][T13237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1241.602889][T13237] RIP: 0033:0x7feb5b75d04e [ 1241.602907][T13237] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1241.602922][T13237] RSP: 002b:00007feb5c5d1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1241.602942][T13237] RAX: ffffffffffffffda RBX: 00007feb5c5d26c0 RCX: 00007feb5b75d04e [ 1241.602955][T13237] RDX: 0000000000000001 RSI: 00007feb5c5d20a0 RDI: 0000000000000005 [ 1241.602966][T13237] RBP: 00007feb5c5d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1241.602978][T13237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1241.602989][T13237] R13: 00007feb5ba16128 R14: 00007feb5ba16090 R15: 00007ffe905ccca8 [ 1241.603021][T13237] [ 1242.266992][T13260] ±ÿ: renamed from team_slave_1 [ 1242.305222][T13262] netlink: 196 bytes leftover after parsing attributes in process `syz.4.15243'. [ 1242.327739][T13262] netlink: 196 bytes leftover after parsing attributes in process `syz.4.15243'. [ 1242.338644][T13262] netlink: 19 bytes leftover after parsing attributes in process `syz.4.15243'. [ 1242.455631][T13277] xt_hashlimit: size too large, truncated to 1048576 [ 1242.861922][T13300] nbd: couldn't find device at index 4 [ 1242.956518][T13308] netlink: 'syz.3.15260': attribute type 2 has an invalid length. [ 1243.498880][T13343] nbd: must specify at least one socket [ 1243.505163][T13343] nbd: couldn't find device at index 4 [ 1243.628487][T13350] netlink: 'syz.1.15277': attribute type 24 has an invalid length. [ 1243.690587][T13350] netlink: 'syz.1.15277': attribute type 5 has an invalid length. [ 1243.878420][T13365] xt_hashlimit: size too large, truncated to 1048576 [ 1243.927443][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5100 ms [ 1243.935646][ C1] lec:lec_tx_timeout: lec0 [ 1244.121426][T13379] nbd: must specify at least one socket [ 1244.152004][T13379] block nbd3: NBD_DISCONNECT [ 1244.175397][T13379] block nbd3: Send disconnect failed -104 [ 1244.192447][T13379] block nbd3: shutting down sockets [ 1244.490629][T13400] mac80211_hwsim hwsim6 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1244.650188][T13412] tipc: Enabling of bearer rejected, failed to enable media [ 1244.728138][T13412] tipc: Enabled bearer , priority 24 [ 1244.945171][T13429] xt_hashlimit: size too large, truncated to 1048576 [ 1244.978491][T13435] __nla_validate_parse: 20 callbacks suppressed [ 1244.978515][T13435] netlink: 28 bytes leftover after parsing attributes in process `syz.1.15309'. [ 1245.032556][T13438] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15310'. [ 1245.063679][T13440] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15312'. [ 1245.083937][T13438] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15310'. [ 1245.105273][T13440] macvtap0: Device is already in use. [ 1245.405880][T13463] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15320'. [ 1245.433140][T13463] netlink: 24 bytes leftover after parsing attributes in process `syz.4.15320'. [ 1245.556319][T13471] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15323'. [ 1245.594890][T13474] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15325'. [ 1245.634241][T13474] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15325'. [ 1245.946962][T13501] netlink: 196 bytes leftover after parsing attributes in process `syz.0.15332'. [ 1246.096607][T13505] xt_hashlimit: size too large, truncated to 1048576 [ 1246.261833][T13517] netlink: 'syz.4.15340': attribute type 1 has an invalid length. [ 1246.372759][T13517] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1246.385207][T26018] lec:lec_start_xmit: lec0:No lecd attached [ 1246.433098][T13521] bond19: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1246.476139][T13517] bond19: entered promiscuous mode [ 1246.494796][T13517] bond19: entered allmulticast mode [ 1246.525394][T13531] macvlan0: entered promiscuous mode [ 1246.899659][T13553] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 1246.994622][T13561] netlink: 'syz.2.15356': attribute type 2 has an invalid length. [ 1247.111623][T13566] xt_hashlimit: size too large, truncated to 1048576 [ 1247.432355][T13591] bond13: option mode: unable to set because the bond device has slaves [ 1247.451285][T13591] bond13: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1247.498540][T13591] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1248.341913][T13653] netlink: zone id is out of range [ 1248.615685][T13674] netlink: 'syz.3.15391': attribute type 10 has an invalid length. [ 1248.836297][T13690] openvswitch: netlink: Actions may not be safe on all matching packets [ 1248.872503][T13692] gtp2: entered promiscuous mode [ 1248.877876][T13692] gtp2: entered allmulticast mode [ 1248.890076][T13682] lo speed is unknown, defaulting to 1000 [ 1249.087714][T13703] x_tables: duplicate underflow at hook 2 [ 1249.362420][T13720] FAULT_INJECTION: forcing a failure. [ 1249.362420][T13720] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1249.378559][T13720] CPU: 0 UID: 0 PID: 13720 Comm: syz.4.15410 Not tainted syzkaller #0 PREEMPT(full) [ 1249.378585][T13720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1249.378595][T13720] Call Trace: [ 1249.378602][T13720] [ 1249.378610][T13720] dump_stack_lvl+0xe8/0x150 [ 1249.378641][T13720] should_fail_ex+0x412/0x560 [ 1249.378670][T13720] _copy_from_user+0x2d/0xb0 [ 1249.378689][T13720] get_user_ifreq+0x6b/0x180 [ 1249.378711][T13720] sock_ioctl+0x704/0x7f0 [ 1249.378732][T13720] ? __pfx_sock_ioctl+0x10/0x10 [ 1249.378754][T13720] ? __fget_files+0x3a0/0x420 [ 1249.378776][T13720] ? __fget_files+0x2a/0x420 [ 1249.378799][T13720] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1249.378818][T13720] ? __pfx_sock_ioctl+0x10/0x10 [ 1249.378837][T13720] __se_sys_ioctl+0xfc/0x170 [ 1249.378853][T13720] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1249.378873][T13720] do_syscall_64+0x15f/0xf80 [ 1249.378894][T13720] ? trace_irq_disable+0x3b/0x140 [ 1249.378914][T13720] ? clear_bhb_loop+0x40/0x90 [ 1249.378943][T13720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1249.378960][T13720] RIP: 0033:0x7fc2f5f9c819 [ 1249.378977][T13720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1249.378992][T13720] RSP: 002b:00007fc2f6eaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1249.379012][T13720] RAX: ffffffffffffffda RBX: 00007fc2f6215fa0 RCX: 00007fc2f5f9c819 [ 1249.379025][T13720] RDX: 0000200000000080 RSI: 00000000000089f2 RDI: 0000000000000003 [ 1249.379037][T13720] RBP: 00007fc2f6eaa090 R08: 0000000000000000 R09: 0000000000000000 [ 1249.379048][T13720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1249.379060][T13720] R13: 00007fc2f6216038 R14: 00007fc2f6215fa0 R15: 00007fff5b06f558 [ 1249.379089][T13720] [ 1249.836250][T13740] netlink: 'syz.2.15416': attribute type 2 has an invalid length. [ 1249.890908][T13742] x_tables: duplicate underflow at hook 2 [ 1249.953668][T13682] lo speed is unknown, defaulting to 1000 [ 1250.022552][T13748] __nla_validate_parse: 26 callbacks suppressed [ 1250.022574][T13748] netlink: 24 bytes leftover after parsing attributes in process `syz.3.15419'. [ 1250.052282][T13748] netlink: 24 bytes leftover after parsing attributes in process `syz.3.15419'. [ 1250.226487][T13758] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 1250.524029][T13770] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1251.304594][T13809] netlink: 4104 bytes leftover after parsing attributes in process `syz.2.15442'. [ 1251.319836][T13809] openvswitch: netlink: Flow key attr not present in new flow. [ 1251.377811][T13813] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15445'. [ 1251.402669][T13813] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15445'. [ 1251.415963][T13815] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15447'. [ 1251.568259][T13823] FAULT_INJECTION: forcing a failure. [ 1251.568259][T13823] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1251.646719][T13823] CPU: 1 UID: 0 PID: 13823 Comm: syz.4.15450 Not tainted syzkaller #0 PREEMPT(full) [ 1251.646744][T13823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1251.646754][T13823] Call Trace: [ 1251.646762][T13823] [ 1251.646770][T13823] dump_stack_lvl+0xe8/0x150 [ 1251.646798][T13823] should_fail_ex+0x412/0x560 [ 1251.646824][T13823] _copy_from_user+0x2d/0xb0 [ 1251.646841][T13823] ___sys_sendmsg+0x1c6/0x360 [ 1251.646867][T13823] ? __lock_acquire+0x6b5/0x2cf0 [ 1251.646890][T13823] ? __pfx____sys_sendmsg+0x10/0x10 [ 1251.646941][T13823] ? __fget_files+0x2a/0x420 [ 1251.646960][T13823] ? __fget_files+0x3a0/0x420 [ 1251.646986][T13823] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1251.647010][T13823] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1251.647040][T13823] ? __pfx_ksys_write+0x10/0x10 [ 1251.647069][T13823] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1251.647085][T13823] do_syscall_64+0x15f/0xf80 [ 1251.647103][T13823] ? trace_irq_disable+0x3b/0x140 [ 1251.647118][T13823] ? clear_bhb_loop+0x40/0x90 [ 1251.647137][T13823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1251.647152][T13823] RIP: 0033:0x7fc2f5f9c819 [ 1251.647167][T13823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1251.647180][T13823] RSP: 002b:00007fc2f6eaa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1251.647197][T13823] RAX: ffffffffffffffda RBX: 00007fc2f6215fa0 RCX: 00007fc2f5f9c819 [ 1251.647208][T13823] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1251.647218][T13823] RBP: 00007fc2f6eaa090 R08: 0000000000000000 R09: 0000000000000000 [ 1251.647227][T13823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1251.647236][T13823] R13: 00007fc2f6216038 R14: 00007fc2f6215fa0 R15: 00007fff5b06f558 [ 1251.647262][T13823] [ 1251.878213][T13835] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15455'. [ 1251.927199][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5540 ms [ 1251.935263][ C1] lec:lec_tx_timeout: lec0 [ 1252.108768][T13846] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15461'. [ 1252.118067][T13846] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15461'. [ 1252.285449][T13859] netlink: 20 bytes leftover after parsing attributes in process `syz.3.15467'. [ 1252.339943][T13859] netlink: 'syz.3.15467': attribute type 3 has an invalid length. [ 1252.344292][T13866] macvtap0: Device is already in use. [ 1252.618615][T13879] syzkaller0: entered promiscuous mode [ 1252.632579][T13879] syzkaller0: entered allmulticast mode [ 1252.849466][T13889] ip6erspan1: entered allmulticast mode [ 1253.417758][T13934] bond25: invalid ARP target 0.0.0.0 specified for addition [ 1253.425826][T13934] bond25: option arp_ip_target: invalid value (0) [ 1253.436459][T13934] bond25 (unregistering): Released all slaves [ 1253.557321][T13938] lo speed is unknown, defaulting to 1000 [ 1253.879367][T13951] bond25: option xmit_hash_policy: invalid value (64) [ 1253.903295][T13951] bond25 (unregistering): Released all slaves [ 1254.324724][T13976] netlink: 'syz.0.15513': attribute type 2 has an invalid length. [ 1254.405616][T13976] vþ: entered promiscuous mode [ 1254.452509][T13938] lo speed is unknown, defaulting to 1000 [ 1254.829904][T14005] macvtap0: Device is already in use. [ 1254.951367][T14008] xt_hashlimit: size too large, truncated to 1048576 [ 1255.330626][T14035] __nla_validate_parse: 13 callbacks suppressed [ 1255.330645][T14035] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15536'. [ 1255.377331][T14039] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15537'. [ 1255.452052][T14042] 8021q: adding VLAN 0 to HW filter on device bond38 [ 1255.472608][T14042] bond37: (slave bond38): Enslaving as an active interface with an up link [ 1255.743382][T14065] netlink: 'syz.3.15545': attribute type 1 has an invalid length. [ 1255.876358][T14065] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15545'. [ 1256.081453][T14077] netlink: 220 bytes leftover after parsing attributes in process `syz.2.15547'. [ 1256.094082][T14077] netlink: 'syz.2.15547': attribute type 2 has an invalid length. [ 1256.209848][T14076] syzkaller0: entered promiscuous mode [ 1256.234562][T14076] syzkaller0: entered allmulticast mode [ 1256.431707][T14099] netlink: 36 bytes leftover after parsing attributes in process `syz.0.15553'. [ 1256.470311][T14099] netlink: 36 bytes leftover after parsing attributes in process `syz.0.15553'. [ 1256.608753][T14105] : entered promiscuous mode [ 1256.766267][T14109] mac80211_hwsim hwsim6 syzkaller0: left promiscuous mode [ 1256.795247][T14109] mac80211_hwsim hwsim6 syzkaller0: left allmulticast mode [ 1256.804091][T14117] nbd3: detected capacity change from 0 to 63 [ 1256.814517][T14122] block nbd1: NBD_DISCONNECT [ 1256.823098][T14123] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1256.855215][T14122] block nbd1: Send disconnect failed -32 [ 1256.874648][T14122] block nbd1: shutting down sockets [ 1256.929180][ T5822] block nbd3: Receive control failed (result -104) [ 1257.350589][T14152] netlink: 96 bytes leftover after parsing attributes in process `syz.4.15574'. [ 1257.362510][T14155] netlink: 8 bytes leftover after parsing attributes in process `syz.2.15575'. [ 1257.387386][T14155] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15575'. [ 1257.480050][T14164] nbd: must specify at least one socket [ 1257.486088][T14164] nbd: couldn't find device at index 4 [ 1257.492413][T14166] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15579'. [ 1257.521078][T14166] chnl_net:caif_netlink_parms(): no params data found [ 1257.781007][T14186] FAULT_INJECTION: forcing a failure. [ 1257.781007][T14186] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1257.799493][T14186] CPU: 0 UID: 0 PID: 14186 Comm: syz.2.15586 Not tainted syzkaller #0 PREEMPT(full) [ 1257.799520][T14186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1257.799532][T14186] Call Trace: [ 1257.799540][T14186] [ 1257.799547][T14186] dump_stack_lvl+0xe8/0x150 [ 1257.799578][T14186] should_fail_ex+0x412/0x560 [ 1257.799608][T14186] _copy_from_user+0x2d/0xb0 [ 1257.799627][T14186] ___sys_sendmsg+0x1c6/0x360 [ 1257.799653][T14186] ? __lock_acquire+0x6b5/0x2cf0 [ 1257.799680][T14186] ? __pfx____sys_sendmsg+0x10/0x10 [ 1257.799736][T14186] ? __fget_files+0x2a/0x420 [ 1257.799757][T14186] ? __fget_files+0x3a0/0x420 [ 1257.799787][T14186] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1257.799815][T14186] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1257.799851][T14186] ? __pfx_ksys_write+0x10/0x10 [ 1257.799893][T14186] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1257.799912][T14186] do_syscall_64+0x15f/0xf80 [ 1257.799932][T14186] ? trace_irq_disable+0x3b/0x140 [ 1257.799949][T14186] ? clear_bhb_loop+0x40/0x90 [ 1257.799971][T14186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1257.799989][T14186] RIP: 0033:0x7f2c7ed9c819 [ 1257.800006][T14186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1257.800022][T14186] RSP: 002b:00007f2c7fcdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1257.800043][T14186] RAX: ffffffffffffffda RBX: 00007f2c7f015fa0 RCX: 00007f2c7ed9c819 [ 1257.800056][T14186] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1257.800068][T14186] RBP: 00007f2c7fcdf090 R08: 0000000000000000 R09: 0000000000000000 [ 1257.800080][T14186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1257.800091][T14186] R13: 00007f2c7f016038 R14: 00007f2c7f015fa0 R15: 00007ffe6c3e60e8 [ 1257.800121][T14186] [ 1258.186304][T14196] nbd: must specify at least one socket [ 1258.364315][T14203] netlink: 'syz.4.15593': attribute type 13 has an invalid length. [ 1258.382675][T14203] macvtap0: entered allmulticast mode [ 1258.399289][T14203] macvtap0: refused to change device tx_queue_len [ 1258.564130][T14214] FAULT_INJECTION: forcing a failure. [ 1258.564130][T14214] name failslab, interval 1, probability 0, space 0, times 0 [ 1258.597454][T14214] CPU: 0 UID: 0 PID: 14214 Comm: syz.1.15599 Not tainted syzkaller #0 PREEMPT(full) [ 1258.597481][T14214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1258.597493][T14214] Call Trace: [ 1258.597500][T14214] [ 1258.597509][T14214] dump_stack_lvl+0xe8/0x150 [ 1258.597540][T14214] should_fail_ex+0x412/0x560 [ 1258.597569][T14214] should_failslab+0xa8/0x100 [ 1258.597589][T14214] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1258.597615][T14214] ? __alloc_skb+0x186/0x7d0 [ 1258.597640][T14214] ? __alloc_skb+0x1d0/0x7d0 [ 1258.597658][T14214] ? __local_bh_enable_ip+0xd0/0x130 [ 1258.597686][T14214] __alloc_skb+0x1d0/0x7d0 [ 1258.597713][T14214] netlink_sendmsg+0x5d4/0xb40 [ 1258.597753][T14214] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1258.597777][T14214] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1258.597802][T14214] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1258.597829][T14214] ____sys_sendmsg+0x972/0x9f0 [ 1258.597855][T14214] ? __might_fault+0xaf/0x130 [ 1258.597883][T14214] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1258.597916][T14214] ? import_iovec+0x73/0xa0 [ 1258.597939][T14214] ___sys_sendmsg+0x2a5/0x360 [ 1258.597963][T14214] ? __lock_acquire+0x6b5/0x2cf0 [ 1258.597987][T14214] ? __pfx____sys_sendmsg+0x10/0x10 [ 1258.598043][T14214] ? __fget_files+0x2a/0x420 [ 1258.598062][T14214] ? __fget_files+0x3a0/0x420 [ 1258.598090][T14214] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1258.598127][T14214] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1258.598161][T14214] ? __pfx_ksys_write+0x10/0x10 [ 1258.598192][T14214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.598211][T14214] do_syscall_64+0x15f/0xf80 [ 1258.598231][T14214] ? trace_irq_disable+0x3b/0x140 [ 1258.598251][T14214] ? clear_bhb_loop+0x40/0x90 [ 1258.598273][T14214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.598289][T14214] RIP: 0033:0x7f67dfd9c819 [ 1258.598305][T14214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1258.598323][T14214] RSP: 002b:00007f67e0d1a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1258.598342][T14214] RAX: ffffffffffffffda RBX: 00007f67e0015fa0 RCX: 00007f67dfd9c819 [ 1258.598353][T14214] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1258.598364][T14214] RBP: 00007f67e0d1a090 R08: 0000000000000000 R09: 0000000000000000 [ 1258.598373][T14214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1258.598383][T14214] R13: 00007f67e0016038 R14: 00007f67e0015fa0 R15: 00007ffd85b55d08 [ 1258.598408][T14214] [ 1258.864004][T14218] x_tables: unsorted underflow at hook 2 [ 1258.922346][T14227] nbd: must specify at least one socket [ 1258.931777][T14227] nbd: couldn't find device at index 2 [ 1259.153290][T14235] sctp: [Deprecated]: syz.1.15608 (pid 14235) Use of int in maxseg socket option. [ 1259.153290][T14235] Use struct sctp_assoc_value instead [ 1259.401306][T14256] syzkaller0: entered promiscuous mode [ 1259.417079][T14256] syzkaller0: entered allmulticast mode [ 1259.441315][T14257] tipc: Enabled bearer , priority 0 [ 1259.493164][T14257] syzkaller0: entered promiscuous mode [ 1259.499800][T14257] syzkaller0: entered allmulticast mode [ 1259.507971][T14264] FAULT_INJECTION: forcing a failure. [ 1259.507971][T14264] name failslab, interval 1, probability 0, space 0, times 0 [ 1259.517863][T14257] tipc: Resetting bearer [ 1259.531508][T14264] CPU: 1 UID: 0 PID: 14264 Comm: syz.2.15618 Not tainted syzkaller #0 PREEMPT(full) [ 1259.531534][T14264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1259.531544][T14264] Call Trace: [ 1259.531551][T14264] [ 1259.531559][T14264] dump_stack_lvl+0xe8/0x150 [ 1259.531589][T14264] should_fail_ex+0x412/0x560 [ 1259.531616][T14264] should_failslab+0xa8/0x100 [ 1259.531642][T14264] ? skb_clone+0x212/0x3a0 [ 1259.531658][T14264] kmem_cache_alloc_noprof+0x87/0x650 [ 1259.531691][T14264] skb_clone+0x212/0x3a0 [ 1259.531712][T14264] __netlink_deliver_tap+0x404/0x850 [ 1259.531748][T14264] ? netlink_deliver_tap+0x2e/0x1b0 [ 1259.531774][T14264] netlink_deliver_tap+0x19c/0x1b0 [ 1259.531799][T14264] netlink_sendskb+0x68/0x140 [ 1259.531824][T14264] netlink_rcv_skb+0x2b6/0x4b0 [ 1259.531849][T14264] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1259.531873][T14264] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1259.531913][T14264] ? netlink_deliver_tap+0x2e/0x1b0 [ 1259.531936][T14264] ? netlink_deliver_tap+0x2e/0x1b0 [ 1259.531965][T14264] netlink_unicast+0x75c/0x8e0 [ 1259.531998][T14264] netlink_sendmsg+0x813/0xb40 [ 1259.532030][T14264] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1259.532057][T14264] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1259.532082][T14264] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1259.532108][T14264] ____sys_sendmsg+0x972/0x9f0 [ 1259.532133][T14264] ? __might_fault+0xaf/0x130 [ 1259.532163][T14264] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1259.532198][T14264] ? import_iovec+0x73/0xa0 [ 1259.532220][T14264] ___sys_sendmsg+0x2a5/0x360 [ 1259.532244][T14264] ? __lock_acquire+0x6b5/0x2cf0 [ 1259.532272][T14264] ? __pfx____sys_sendmsg+0x10/0x10 [ 1259.532333][T14264] ? __fget_files+0x2a/0x420 [ 1259.532353][T14264] ? __fget_files+0x3a0/0x420 [ 1259.532385][T14264] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1259.532413][T14264] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1259.532448][T14264] ? __pfx_ksys_write+0x10/0x10 [ 1259.532480][T14264] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1259.532500][T14264] do_syscall_64+0x15f/0xf80 [ 1259.532521][T14264] ? trace_irq_disable+0x3b/0x140 [ 1259.532540][T14264] ? clear_bhb_loop+0x40/0x90 [ 1259.532562][T14264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1259.532580][T14264] RIP: 0033:0x7f2c7ed9c819 [ 1259.532598][T14264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1259.532614][T14264] RSP: 002b:00007f2c7fcdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1259.532639][T14264] RAX: ffffffffffffffda RBX: 00007f2c7f015fa0 RCX: 00007f2c7ed9c819 [ 1259.532653][T14264] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1259.532666][T14264] RBP: 00007f2c7fcdf090 R08: 0000000000000000 R09: 0000000000000000 [ 1259.532678][T14264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1259.532689][T14264] R13: 00007f2c7f016038 R14: 00007f2c7f015fa0 R15: 00007ffe6c3e60e8 [ 1259.532721][T14264] [ 1259.533068][T14254] tipc: Resetting bearer [ 1259.862148][T14254] tipc: Disabling bearer [ 1260.214405][T14292] ipvlan2: entered allmulticast mode [ 1260.227567][T14292] syz_tun: entered allmulticast mode [ 1260.235787][T14296] netlink: 'syz.1.15627': attribute type 2 has an invalid length. [ 1260.402581][T14309] __nla_validate_parse: 8 callbacks suppressed [ 1260.402600][T14309] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15631'. [ 1260.699633][T14334] netlink: 68 bytes leftover after parsing attributes in process `syz.2.15639'. [ 1260.731491][T14340] FAULT_INJECTION: forcing a failure. [ 1260.731491][T14340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1260.750099][T14331] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15640'. [ 1260.765527][T14341] FAULT_INJECTION: forcing a failure. [ 1260.765527][T14341] name failslab, interval 1, probability 0, space 0, times 0 [ 1260.798164][T14340] CPU: 0 UID: 0 PID: 14340 Comm: syz.3.15642 Not tainted syzkaller #0 PREEMPT(full) [ 1260.798186][T14340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1260.798197][T14340] Call Trace: [ 1260.798205][T14340] [ 1260.798212][T14340] dump_stack_lvl+0xe8/0x150 [ 1260.798244][T14340] should_fail_ex+0x412/0x560 [ 1260.798273][T14340] _copy_to_user+0x31/0xb0 [ 1260.798294][T14340] simple_read_from_buffer+0xe1/0x170 [ 1260.798321][T14340] proc_fail_nth_read+0x1bb/0x230 [ 1260.798347][T14340] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1260.798372][T14340] ? rw_verify_area+0x2a6/0x4d0 [ 1260.798396][T14340] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1260.798419][T14340] vfs_read+0x20c/0xa70 [ 1260.798447][T14340] ? __pfx___mutex_lock+0x10/0x10 [ 1260.798468][T14340] ? __pfx_vfs_read+0x10/0x10 [ 1260.798491][T14340] ? __fget_files+0x2a/0x420 [ 1260.798517][T14340] ? __fget_files+0x3a0/0x420 [ 1260.798535][T14340] ? __fget_files+0x2a/0x420 [ 1260.798563][T14340] ksys_read+0x150/0x270 [ 1260.798589][T14340] ? __pfx_ksys_read+0x10/0x10 [ 1260.798613][T14340] ? fput+0xa0/0xd0 [ 1260.798638][T14340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.798657][T14340] do_syscall_64+0x15f/0xf80 [ 1260.798676][T14340] ? trace_irq_disable+0x3b/0x140 [ 1260.798694][T14340] ? clear_bhb_loop+0x40/0x90 [ 1260.798715][T14340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.798740][T14340] RIP: 0033:0x7feb5b75d04e [ 1260.798758][T14340] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1260.798774][T14340] RSP: 002b:00007feb5c5f2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1260.798794][T14340] RAX: ffffffffffffffda RBX: 00007feb5c5f36c0 RCX: 00007feb5b75d04e [ 1260.798807][T14340] RDX: 000000000000000f RSI: 00007feb5c5f30a0 RDI: 0000000000000004 [ 1260.798818][T14340] RBP: 00007feb5c5f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1260.798829][T14340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1260.798840][T14340] R13: 00007feb5ba16038 R14: 00007feb5ba15fa0 R15: 00007ffe905ccca8 [ 1260.798871][T14340] [ 1260.824002][T14341] CPU: 1 UID: 0 PID: 14341 Comm: syz.1.15643 Not tainted syzkaller #0 PREEMPT(full) [ 1260.824027][T14341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1260.824038][T14341] Call Trace: [ 1260.824046][T14341] [ 1260.824054][T14341] dump_stack_lvl+0xe8/0x150 [ 1260.824085][T14341] should_fail_ex+0x412/0x560 [ 1260.824113][T14341] should_failslab+0xa8/0x100 [ 1260.824133][T14341] __kmalloc_noprof+0xe8/0x760 [ 1260.824158][T14341] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1260.824189][T14341] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1260.824214][T14341] ? tomoyo_domain+0xd7/0x130 [ 1260.824242][T14341] ? tomoyo_path_number_perm+0x219/0x630 [ 1260.824263][T14341] tomoyo_path_number_perm+0x246/0x630 [ 1260.824286][T14341] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1260.824305][T14341] ? __lock_acquire+0x6b5/0x2cf0 [ 1260.824340][T14341] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1260.824381][T14341] ? __fget_files+0x2a/0x420 [ 1260.824405][T14341] ? __fget_files+0x2a/0x420 [ 1260.824436][T14341] ? __fget_files+0x3a0/0x420 [ 1260.824456][T14341] ? __fget_files+0x2a/0x420 [ 1260.824487][T14341] security_file_ioctl+0xc3/0x2a0 [ 1260.824508][T14341] __se_sys_ioctl+0x47/0x170 [ 1260.824524][T14341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.824549][T14341] do_syscall_64+0x15f/0xf80 [ 1260.824568][T14341] ? trace_irq_disable+0x3b/0x140 [ 1260.824587][T14341] ? clear_bhb_loop+0x40/0x90 [ 1260.824608][T14341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.824625][T14341] RIP: 0033:0x7f67dfd9c819 [ 1260.824642][T14341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1260.824656][T14341] RSP: 002b:00007f67e0d1a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1260.824675][T14341] RAX: ffffffffffffffda RBX: 00007f67e0015fa0 RCX: 00007f67dfd9c819 [ 1260.824688][T14341] RDX: 0000200000000080 RSI: 0000000000008914 RDI: 0000000000000004 [ 1260.824699][T14341] RBP: 00007f67e0d1a090 R08: 0000000000000000 R09: 0000000000000000 [ 1260.824710][T14341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1260.824721][T14341] R13: 00007f67e0016038 R14: 00007f67e0015fa0 R15: 00007ffd85b55d08 [ 1260.824749][T14341] [ 1260.825302][T14341] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1261.151249][T14352] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.15645'. [ 1261.291023][T14354] netlink: 44 bytes leftover after parsing attributes in process `syz.3.15645'. [ 1261.419592][T14359] FAULT_INJECTION: forcing a failure. [ 1261.419592][T14359] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1261.433057][T14359] CPU: 1 UID: 0 PID: 14359 Comm: syz.4.15647 Not tainted syzkaller #0 PREEMPT(full) [ 1261.433083][T14359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1261.433095][T14359] Call Trace: [ 1261.433103][T14359] [ 1261.433111][T14359] dump_stack_lvl+0xe8/0x150 [ 1261.433143][T14359] should_fail_ex+0x412/0x560 [ 1261.433173][T14359] _copy_to_user+0x31/0xb0 [ 1261.433194][T14359] simple_read_from_buffer+0xe1/0x170 [ 1261.433221][T14359] proc_fail_nth_read+0x1bb/0x230 [ 1261.433249][T14359] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1261.433275][T14359] ? rw_verify_area+0x2a6/0x4d0 [ 1261.433300][T14359] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1261.433323][T14359] vfs_read+0x20c/0xa70 [ 1261.433350][T14359] ? __pfx___mutex_lock+0x10/0x10 [ 1261.433372][T14359] ? __pfx_vfs_read+0x10/0x10 [ 1261.433396][T14359] ? __fget_files+0x2a/0x420 [ 1261.433422][T14359] ? __fget_files+0x3a0/0x420 [ 1261.433441][T14359] ? __fget_files+0x2a/0x420 [ 1261.433467][T14359] ksys_read+0x150/0x270 [ 1261.433490][T14359] ? __pfx_ksys_read+0x10/0x10 [ 1261.433518][T14359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1261.433539][T14359] do_syscall_64+0x15f/0xf80 [ 1261.433557][T14359] ? trace_irq_disable+0x3b/0x140 [ 1261.433575][T14359] ? clear_bhb_loop+0x40/0x90 [ 1261.433595][T14359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1261.433612][T14359] RIP: 0033:0x7fc2f5f5d04e [ 1261.433629][T14359] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1261.433642][T14359] RSP: 002b:00007fc2f6ea9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1261.433660][T14359] RAX: ffffffffffffffda RBX: 00007fc2f6eaa6c0 RCX: 00007fc2f5f5d04e [ 1261.433672][T14359] RDX: 000000000000000f RSI: 00007fc2f6eaa0a0 RDI: 0000000000000004 [ 1261.433682][T14359] RBP: 00007fc2f6eaa090 R08: 0000000000000000 R09: 0000000000000000 [ 1261.433691][T14359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1261.433710][T14359] R13: 00007fc2f6216038 R14: 00007fc2f6215fa0 R15: 00007fff5b06f558 [ 1261.433736][T14359] [ 1261.655492][T14362] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15649'. [ 1261.897327][T14377] FAULT_INJECTION: forcing a failure. [ 1261.897327][T14377] name failslab, interval 1, probability 0, space 0, times 0 [ 1261.926903][T14377] CPU: 0 UID: 0 PID: 14377 Comm: syz.2.15654 Not tainted syzkaller #0 PREEMPT(full) [ 1261.926929][T14377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1261.926939][T14377] Call Trace: [ 1261.926947][T14377] [ 1261.926955][T14377] dump_stack_lvl+0xe8/0x150 [ 1261.926985][T14377] should_fail_ex+0x412/0x560 [ 1261.927014][T14377] ? __d_alloc+0x37/0x6f0 [ 1261.927038][T14377] should_failslab+0xa8/0x100 [ 1261.927058][T14377] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 1261.927090][T14377] __d_alloc+0x37/0x6f0 [ 1261.927110][T14377] ? rcu_is_watching+0x15/0xb0 [ 1261.927137][T14377] d_alloc_pseudo+0x21/0xc0 [ 1261.927159][T14377] alloc_file_pseudo+0xdd/0x240 [ 1261.927175][T14377] ? kmem_cache_alloc_noprof+0x15a/0x650 [ 1261.927198][T14377] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1261.927216][T14377] ? evm_inode_alloc_security+0x40/0xb0 [ 1261.927234][T14377] ? security_inode_alloc+0xd5/0x310 [ 1261.927265][T14377] sock_alloc_file+0xb8/0x2e0 [ 1261.927288][T14377] do_accept+0x3a0/0x760 [ 1261.927314][T14377] ? __pfx_do_accept+0x10/0x10 [ 1261.927356][T14377] __sys_accept4+0x139/0x230 [ 1261.927381][T14377] ? __pfx___sys_accept4+0x10/0x10 [ 1261.927403][T14377] ? __pfx_ksys_write+0x10/0x10 [ 1261.927434][T14377] __x64_sys_accept4+0x9a/0xb0 [ 1261.927455][T14377] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1261.927474][T14377] do_syscall_64+0x15f/0xf80 [ 1261.927494][T14377] ? trace_irq_disable+0x3b/0x140 [ 1261.927512][T14377] ? clear_bhb_loop+0x40/0x90 [ 1261.927532][T14377] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1261.927550][T14377] RIP: 0033:0x7f2c7ed9c819 [ 1261.927568][T14377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1261.927583][T14377] RSP: 002b:00007f2c7fcdf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 1261.927604][T14377] RAX: ffffffffffffffda RBX: 00007f2c7f015fa0 RCX: 00007f2c7ed9c819 [ 1261.927617][T14377] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 1261.927628][T14377] RBP: 00007f2c7fcdf090 R08: 0000000000000000 R09: 0000000000000000 [ 1261.927638][T14377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1261.927648][T14377] R13: 00007f2c7f016038 R14: 00007f2c7f015fa0 R15: 00007ffe6c3e60e8 [ 1261.927678][T14377] [ 1262.287010][T14389] netlink: 'syz.2.15656': attribute type 10 has an invalid length. [ 1262.702677][T14414] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15665'. [ 1262.709725][T14415] netlink: 68 bytes leftover after parsing attributes in process `syz.2.15664'. [ 1262.726031][T14414] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15665'. [ 1262.759808][T14417] netlink: 'syz.3.15666': attribute type 7 has an invalid length. [ 1262.810155][T14421] FAULT_INJECTION: forcing a failure. [ 1262.810155][T14421] name failslab, interval 1, probability 0, space 0, times 0 [ 1262.855612][T14421] CPU: 0 UID: 0 PID: 14421 Comm: syz.4.15668 Not tainted syzkaller #0 PREEMPT(full) [ 1262.855638][T14421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1262.855649][T14421] Call Trace: [ 1262.855657][T14421] [ 1262.855666][T14421] dump_stack_lvl+0xe8/0x150 [ 1262.855697][T14421] should_fail_ex+0x412/0x560 [ 1262.855727][T14421] should_failslab+0xa8/0x100 [ 1262.855746][T14421] ? alloc_empty_file+0x5b/0x1d0 [ 1262.855767][T14421] kmem_cache_alloc_noprof+0x87/0x650 [ 1262.855800][T14421] alloc_empty_file+0x5b/0x1d0 [ 1262.855823][T14421] alloc_file_pseudo+0x155/0x240 [ 1262.855843][T14421] ? kmem_cache_alloc_noprof+0x15a/0x650 [ 1262.855868][T14421] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1262.855889][T14421] ? evm_inode_alloc_security+0x40/0xb0 [ 1262.855908][T14421] ? security_inode_alloc+0xd5/0x310 [ 1262.855943][T14421] sock_alloc_file+0xb8/0x2e0 [ 1262.855968][T14421] do_accept+0x3a0/0x760 [ 1262.855995][T14421] ? __pfx_do_accept+0x10/0x10 [ 1262.856039][T14421] __sys_accept4+0x139/0x230 [ 1262.856064][T14421] ? __pfx___sys_accept4+0x10/0x10 [ 1262.856087][T14421] ? __pfx_ksys_write+0x10/0x10 [ 1262.856119][T14421] __x64_sys_accept4+0x9a/0xb0 [ 1262.856141][T14421] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1262.856160][T14421] do_syscall_64+0x15f/0xf80 [ 1262.856182][T14421] ? trace_irq_disable+0x3b/0x140 [ 1262.856201][T14421] ? clear_bhb_loop+0x40/0x90 [ 1262.856223][T14421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1262.856241][T14421] RIP: 0033:0x7fc2f5f9c819 [ 1262.856258][T14421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1262.856274][T14421] RSP: 002b:00007fc2f6eaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 1262.856295][T14421] RAX: ffffffffffffffda RBX: 00007fc2f6215fa0 RCX: 00007fc2f5f9c819 [ 1262.856309][T14421] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 1262.856319][T14421] RBP: 00007fc2f6eaa090 R08: 0000000000000000 R09: 0000000000000000 [ 1262.856330][T14421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1262.856341][T14421] R13: 00007fc2f6216038 R14: 00007fc2f6215fa0 R15: 00007fff5b06f558 [ 1262.856377][T14421] [ 1263.471657][T14450] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15674'. [ 1263.488847][T14442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1263.527910][T14442] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1263.769556][T14465] FAULT_INJECTION: forcing a failure. [ 1263.769556][T14465] name failslab, interval 1, probability 0, space 0, times 0 [ 1263.819658][T14465] CPU: 1 UID: 0 PID: 14465 Comm: syz.0.15682 Not tainted syzkaller #0 PREEMPT(full) [ 1263.819686][T14465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1263.819697][T14465] Call Trace: [ 1263.819705][T14465] [ 1263.819713][T14465] dump_stack_lvl+0xe8/0x150 [ 1263.819743][T14465] should_fail_ex+0x412/0x560 [ 1263.819772][T14465] should_failslab+0xa8/0x100 [ 1263.819791][T14465] ? security_file_alloc+0x34/0x310 [ 1263.819810][T14465] kmem_cache_alloc_noprof+0x87/0x650 [ 1263.819834][T14465] ? rcu_is_watching+0x15/0xb0 [ 1263.819859][T14465] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1263.819885][T14465] security_file_alloc+0x34/0x310 [ 1263.819906][T14465] init_file+0x90/0x2b0 [ 1263.819928][T14465] alloc_empty_file+0x74/0x1d0 [ 1263.819950][T14465] alloc_file_pseudo+0x155/0x240 [ 1263.819969][T14465] ? kmem_cache_alloc_noprof+0x15a/0x650 [ 1263.819994][T14465] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1263.820013][T14465] ? evm_inode_alloc_security+0x40/0xb0 [ 1263.820033][T14465] ? security_inode_alloc+0xd5/0x310 [ 1263.820066][T14465] sock_alloc_file+0xb8/0x2e0 [ 1263.820089][T14465] do_accept+0x3a0/0x760 [ 1263.820116][T14465] ? __pfx_do_accept+0x10/0x10 [ 1263.820158][T14465] __sys_accept4+0x139/0x230 [ 1263.820183][T14465] ? __pfx___sys_accept4+0x10/0x10 [ 1263.820206][T14465] ? __pfx_ksys_write+0x10/0x10 [ 1263.820235][T14465] __x64_sys_accept4+0x9a/0xb0 [ 1263.820254][T14465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1263.820272][T14465] do_syscall_64+0x15f/0xf80 [ 1263.820290][T14465] ? trace_irq_disable+0x3b/0x140 [ 1263.820308][T14465] ? clear_bhb_loop+0x40/0x90 [ 1263.820328][T14465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1263.820345][T14465] RIP: 0033:0x7fae6e19c819 [ 1263.820362][T14465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1263.820378][T14465] RSP: 002b:00007fae6f04b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 1263.820398][T14465] RAX: ffffffffffffffda RBX: 00007fae6e415fa0 RCX: 00007fae6e19c819 [ 1263.820410][T14465] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 1263.820421][T14465] RBP: 00007fae6f04b090 R08: 0000000000000000 R09: 0000000000000000 [ 1263.820431][T14465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1263.820441][T14465] R13: 00007fae6e416038 R14: 00007fae6e415fa0 R15: 00007ffc2ca11578 [ 1263.820470][T14465] [ 1264.073008][T14469] x_tables: duplicate underflow at hook 2 [ 1264.831730][T14511] xt_hashlimit: size too large, truncated to 1048576 [ 1265.101108][T14533] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1265.128133][T14533] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1265.382068][T14544] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 1265.417316][T14545] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1265.420278][T14549] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 1265.502712][T14557] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 1265.636197][T14568] openvswitch: netlink: Key type 343 is out of range max 32 [ 1265.783324][T14580] __nla_validate_parse: 5 callbacks suppressed [ 1265.783342][T14580] netlink: 88 bytes leftover after parsing attributes in process `syz.4.15721'. [ 1265.846692][T14587] netlink: 68 bytes leftover after parsing attributes in process `syz.0.15722'. [ 1265.973966][T14590] xt_CT: No such helper "pptp" [ 1266.033567][T14596] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15726'. [ 1266.051405][T14596] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15726'. [ 1266.531377][T14624] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15740'. [ 1266.549174][T14624] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15740'. [ 1266.965642][T14651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15751'. [ 1267.027713][T14658] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 1267.170093][T14664] netlink: 68 bytes leftover after parsing attributes in process `syz.1.15756'. [ 1267.284035][T14678] netlink: 96 bytes leftover after parsing attributes in process `syz.0.15758'. [ 1267.326372][T14677] netlink: 36 bytes leftover after parsing attributes in process `syz.3.15759'. [ 1268.196495][T14724] syzkaller1: entered promiscuous mode [ 1268.225188][T14724] syzkaller1: entered allmulticast mode [ 1268.739768][T14765] FAULT_INJECTION: forcing a failure. [ 1268.739768][T14765] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1268.786065][T14765] CPU: 0 UID: 0 PID: 14765 Comm: syz.0.15786 Not tainted syzkaller #0 PREEMPT(full) [ 1268.786093][T14765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1268.786104][T14765] Call Trace: [ 1268.786111][T14765] [ 1268.786119][T14765] dump_stack_lvl+0xe8/0x150 [ 1268.786148][T14765] should_fail_ex+0x412/0x560 [ 1268.786176][T14765] _copy_from_iter+0x1d3/0x1670 [ 1268.786205][T14765] ? rcu_is_watching+0x15/0xb0 [ 1268.786235][T14765] ? __pfx__copy_from_iter+0x10/0x10 [ 1268.786265][T14765] ? netlink_sendmsg+0x650/0xb40 [ 1268.786288][T14765] ? skb_put+0x11b/0x210 [ 1268.786313][T14765] netlink_sendmsg+0x6c0/0xb40 [ 1268.786344][T14765] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1268.786367][T14765] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1268.786390][T14765] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1268.786421][T14765] ____sys_sendmsg+0x972/0x9f0 [ 1268.786446][T14765] ? __might_fault+0xaf/0x130 [ 1268.786471][T14765] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1268.786501][T14765] ? import_iovec+0x73/0xa0 [ 1268.786520][T14765] ___sys_sendmsg+0x2a5/0x360 [ 1268.786542][T14765] ? __lock_acquire+0x6b5/0x2cf0 [ 1268.786567][T14765] ? __pfx____sys_sendmsg+0x10/0x10 [ 1268.786623][T14765] ? __fget_files+0x2a/0x420 [ 1268.786644][T14765] ? __fget_files+0x3a0/0x420 [ 1268.786673][T14765] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1268.786700][T14765] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1268.786732][T14765] ? __pfx_ksys_write+0x10/0x10 [ 1268.786766][T14765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.786785][T14765] do_syscall_64+0x15f/0xf80 [ 1268.786806][T14765] ? trace_irq_disable+0x3b/0x140 [ 1268.786826][T14765] ? clear_bhb_loop+0x40/0x90 [ 1268.786848][T14765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.786866][T14765] RIP: 0033:0x7fae6e19c819 [ 1268.786884][T14765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1268.786909][T14765] RSP: 002b:00007fae6f02a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1268.786930][T14765] RAX: ffffffffffffffda RBX: 00007fae6e416090 RCX: 00007fae6e19c819 [ 1268.786943][T14765] RDX: 0000000010004044 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1268.786956][T14765] RBP: 00007fae6f02a090 R08: 0000000000000000 R09: 0000000000000000 [ 1268.786968][T14765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1268.786979][T14765] R13: 00007fae6e416128 R14: 00007fae6e416090 R15: 00007ffc2ca11578 [ 1268.787008][T14765] [ 1268.917961][T14772] Bluetooth: hci1: Opcode 0x0401 failed: -22 [ 1269.357977][T14786] netlink: 'syz.0.15795': attribute type 2 has an invalid length. [ 1269.583967][T14804] openvswitch: netlink: Missing valid actions attribute. [ 1269.615817][T14804] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1270.445689][T14860] xt_TCPMSS: Only works on TCP SYN packets [ 1270.720663][T14877] IPVS: set_ctl: invalid protocol: 58 172.20.20.170:20002 [ 1270.863440][T14883] __nla_validate_parse: 16 callbacks suppressed [ 1270.863462][T14883] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15828'. [ 1270.963064][T14895] netlink: 96 bytes leftover after parsing attributes in process `syz.2.15830'. [ 1271.166866][T14909] netlink: 12 bytes leftover after parsing attributes in process `syz.2.15836'. [ 1271.246724][T14912] netlink: 56 bytes leftover after parsing attributes in process `syz.0.15837'. [ 1271.278260][T14912] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15837'. [ 1271.303842][T14912] netlink: 31 bytes leftover after parsing attributes in process `syz.0.15837'. [ 1271.328877][T14912] netlink: 'syz.0.15837': attribute type 3 has an invalid length. [ 1271.336927][T14912] netlink: 'syz.0.15837': attribute type 2 has an invalid length. [ 1271.365762][T14912] netlink: 31 bytes leftover after parsing attributes in process `syz.0.15837'. [ 1271.420760][T14921] bond27 (unregistering): Released all slaves [ 1271.591049][T14937] netlink: 96 bytes leftover after parsing attributes in process `syz.4.15846'. [ 1271.954268][T14956] lo speed is unknown, defaulting to 1000 [ 1272.285188][T14981] xt_hashlimit: size too large, truncated to 1048576 [ 1272.289559][T14982] netlink: 60 bytes leftover after parsing attributes in process `syz.3.15857'. [ 1272.523895][T14956] lo speed is unknown, defaulting to 1000 [ 1272.593925][T14999] netlink: 20 bytes leftover after parsing attributes in process `syz.2.15864'. [ 1272.748631][T14995] workqueue: Failed to create a rescuer kthread for wq "bond31": -EINTR [ 1273.001486][T15023] netlink: 'syz.3.15870': attribute type 1 has an invalid length. [ 1273.033077][T15023] netlink: 'syz.3.15870': attribute type 1 has an invalid length. [ 1273.042163][T15023] netlink: 'syz.3.15870': attribute type 1 has an invalid length. [ 1273.280908][T15034] netlink: 'syz.1.15876': attribute type 10 has an invalid length. [ 1273.530680][T15046] x_tables: duplicate underflow at hook 2 [ 1273.732946][T15058] ip6erspan0: entered promiscuous mode [ 1273.956595][T15067] IPVS: set_ctl: invalid protocol: 44 224.0.0.2:20000 [ 1274.364210][T15089] xt_CT: No such helper "pptp" [ 1274.378770][T15096] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1274.398215][T15096] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1274.560805][T15103] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 1274.647367][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1274.746929][T15123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1274.750470][T15120] bond27: option packets_per_slave: invalid value (18446744073709551615) [ 1274.765318][T15120] bond27: option packets_per_slave: allowed values 0 - 65535 [ 1274.780509][T15120] bond27 (unregistering): Released all slaves [ 1274.922622][T15131] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1274.943850][T15131] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1275.490870][T15169] sctp: [Deprecated]: syz.1.15924 (pid 15169) Use of int in maxseg socket option. [ 1275.490870][T15169] Use struct sctp_assoc_value instead [ 1275.548174][T15158] nbd0: detected capacity change from 0 to 63 [ 1275.555079][T15162] block nbd0: NBD_DISCONNECT [ 1275.590956][T15162] block nbd0: Disconnected due to user request. [ 1275.623796][T15162] block nbd0: shutting down sockets [ 1275.660949][ C1] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.670541][ C1] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1275.705291][ C1] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.714561][ C1] Buffer I/O error on dev nbd0, logical block 1, async page read [ 1275.723633][ C1] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.732768][ C1] Buffer I/O error on dev nbd0, logical block 2, async page read [ 1275.740680][ C1] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.749771][ C1] Buffer I/O error on dev nbd0, logical block 3, async page read [ 1275.757764][T10937] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.783597][T10937] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1275.807956][T10937] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.829488][T10937] Buffer I/O error on dev nbd0, logical block 1, async page read [ 1275.848271][T10937] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.859979][T10937] Buffer I/O error on dev nbd0, logical block 2, async page read [ 1275.889049][T10937] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.914203][T10937] Buffer I/O error on dev nbd0, logical block 3, async page read [ 1275.936705][T10937] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1275.965953][T10937] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1275.980736][T10937] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1276.000258][T10937] Buffer I/O error on dev nbd0, logical block 1, async page read [ 1276.028776][T10937] ldm_validate_partition_table(): Disk read failed. [ 1276.048435][T15189] sctp: [Deprecated]: syz.0.15931 (pid 15189) Use of int in maxseg socket option. [ 1276.048435][T15189] Use struct sctp_assoc_value instead [ 1276.085643][T10937] Dev nbd0: unable to read RDB block 0 [ 1276.112431][T10937] nbd0: unable to read partition table [ 1276.141781][T15196] __nla_validate_parse: 13 callbacks suppressed [ 1276.141799][T15196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15932'. [ 1276.202904][T10937] ldm_validate_partition_table(): Disk read failed. [ 1276.213441][T15197] netlink: 'syz.1.15932': attribute type 10 has an invalid length. [ 1276.239367][T10937] Dev nbd0: unable to read RDB block 0 [ 1276.260238][T10937] nbd0: unable to read partition table [ 1276.506525][T15208] netlink: 24 bytes leftover after parsing attributes in process `syz.4.15936'. [ 1276.602571][T15222] netlink: 96 bytes leftover after parsing attributes in process `syz.3.15937'. [ 1276.641996][T15223] netlink: 96 bytes leftover after parsing attributes in process `syz.2.15938'. [ 1276.910012][T15236] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15940'. [ 1276.914393][T15237] netlink: 48 bytes leftover after parsing attributes in process `syz.4.15941'. [ 1277.081162][T15241] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15944'. [ 1277.123858][T15244] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15941'. [ 1277.448142][T15267] netlink: 96 bytes leftover after parsing attributes in process `syz.0.15950'. [ 1277.586242][T15275] netlink: 96 bytes leftover after parsing attributes in process `syz.2.15953'. [ 1277.645483][T15277] macvtap2: entered promiscuous mode [ 1277.657892][T15277] macvtap2: entered allmulticast mode [ 1277.663418][T15277] veth1_vlan: entered allmulticast mode [ 1277.761849][T15278] macvtap3: entered promiscuous mode [ 1277.776237][T15278] macvtap3: entered allmulticast mode [ 1278.123842][T15309] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 1278.363477][T15326] netlink: 'syz.2.15972': attribute type 10 has an invalid length. [ 1278.462925][T15324] xt_CT: No such helper "pptp" [ 1278.866877][T15357] netlink: 'syz.3.15984': attribute type 2 has an invalid length. [ 1278.930791][T15364] netlink: 'syz.4.15985': attribute type 10 has an invalid length. [ 1278.952063][T15365] : entered promiscuous mode [ 1278.963288][T15366] netlink: 'syz.3.15984': attribute type 1 has an invalid length. [ 1279.110188][T15369] xt_hashlimit: size too large, truncated to 1048576 [ 1279.469677][T15394] netlink: 'syz.0.15997': attribute type 10 has an invalid length. [ 1279.481055][T15385] nbd2: detected capacity change from 0 to 63 [ 1279.497830][T15389] block nbd2: NBD_DISCONNECT [ 1279.506891][T15389] block nbd2: Disconnected due to user request. [ 1279.525681][T15389] block nbd2: shutting down sockets [ 1279.539387][T15392] ldm_validate_partition_table(): Disk read failed. [ 1279.570916][T15392] Dev nbd2: unable to read RDB block 0 [ 1279.605134][T15392] nbd2: unable to read partition table [ 1279.656527][T15392] ldm_validate_partition_table(): Disk read failed. [ 1279.693587][T15392] Dev nbd2: unable to read RDB block 0 [ 1279.722963][T15392] nbd2: unable to read partition table [ 1279.873224][T15415] xt_CT: No such helper "pptp" [ 1279.885852][T15412] xt_hashlimit: size too large, truncated to 1048576 [ 1279.962702][T15421] syzkaller0: entered promiscuous mode [ 1279.977344][T15421] syzkaller0: entered allmulticast mode [ 1280.079476][T15430] xt_hashlimit: size too large, truncated to 1048576 [ 1280.553101][T15456] FAULT_INJECTION: forcing a failure. [ 1280.553101][T15456] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1280.576850][T15456] CPU: 0 UID: 0 PID: 15456 Comm: syz.3.16018 Not tainted syzkaller #0 PREEMPT(full) [ 1280.576879][T15456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1280.576890][T15456] Call Trace: [ 1280.576896][T15456] [ 1280.576904][T15456] dump_stack_lvl+0xe8/0x150 [ 1280.576934][T15456] should_fail_ex+0x412/0x560 [ 1280.576959][T15456] _copy_from_user+0x2d/0xb0 [ 1280.576978][T15456] ___sys_sendmsg+0x1c6/0x360 [ 1280.577001][T15456] ? __lock_acquire+0x6b5/0x2cf0 [ 1280.577026][T15456] ? __pfx____sys_sendmsg+0x10/0x10 [ 1280.577081][T15456] ? __fget_files+0x2a/0x420 [ 1280.577104][T15456] ? __fget_files+0x3a0/0x420 [ 1280.577131][T15456] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1280.577158][T15456] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1280.577191][T15456] ? __pfx_ksys_write+0x10/0x10 [ 1280.577220][T15456] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1280.577238][T15456] do_syscall_64+0x15f/0xf80 [ 1280.577258][T15456] ? trace_irq_disable+0x3b/0x140 [ 1280.577277][T15456] ? clear_bhb_loop+0x40/0x90 [ 1280.577298][T15456] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1280.577315][T15456] RIP: 0033:0x7feb5b79c819 [ 1280.577332][T15456] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1280.577346][T15456] RSP: 002b:00007feb5c5f3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1280.577365][T15456] RAX: ffffffffffffffda RBX: 00007feb5ba15fa0 RCX: 00007feb5b79c819 [ 1280.577378][T15456] RDX: 0000000020044000 RSI: 0000200000000280 RDI: 0000000000000005 [ 1280.577390][T15456] RBP: 00007feb5c5f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1280.577399][T15456] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1280.577410][T15456] R13: 00007feb5ba16038 R14: 00007feb5ba15fa0 R15: 00007ffe905ccca8 [ 1280.577437][T15456] [ 1280.606399][T15458] xt_CT: No such helper "pptp" [ 1280.907591][T15468] nbd0: detected capacity change from 0 to 63 [ 1280.916314][T15469] block nbd3: NBD_DISCONNECT [ 1280.944142][T15469] block nbd3: Send disconnect failed -32 [ 1280.950157][T15469] block nbd3: shutting down sockets [ 1280.974965][ C1] blk_print_req_error: 286 callbacks suppressed [ 1280.974987][ C1] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1280.990629][ C1] buffer_io_error: 286 callbacks suppressed [ 1280.990648][ C1] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1281.012420][ C1] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.021603][ C1] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1281.029555][ C1] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.030006][ T5822] block nbd0: Receive control failed (result -104) [ 1281.038673][ C1] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1281.038755][ C1] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.038777][ C1] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1281.088827][T12043] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.115961][T12043] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1281.124698][T12043] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.134038][T12043] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1281.142103][T12043] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.154174][T12043] Buffer I/O error on dev nbd3, logical block 2, async page read [ 1281.168941][T12043] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.187357][T12043] Buffer I/O error on dev nbd3, logical block 3, async page read [ 1281.197344][T12043] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.206512][T12043] Buffer I/O error on dev nbd3, logical block 0, async page read [ 1281.222489][T15488] xt_hashlimit: size too large, truncated to 1048576 [ 1281.230483][T12043] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1281.241550][T12043] Buffer I/O error on dev nbd3, logical block 1, async page read [ 1281.253408][T12043] ldm_validate_partition_table(): Disk read failed. [ 1281.262589][T12043] Dev nbd3: unable to read RDB block 0 [ 1281.281472][T12043] nbd3: unable to read partition table [ 1281.300032][T12043] ldm_validate_partition_table(): Disk read failed. [ 1281.311433][T12043] Dev nbd3: unable to read RDB block 0 [ 1281.319895][T12043] nbd3: unable to read partition table [ 1281.548733][T15503] xt_CT: No such helper "pptp" [ 1281.666123][T15513] __nla_validate_parse: 12 callbacks suppressed [ 1281.666140][T15513] netlink: 36 bytes leftover after parsing attributes in process `syz.4.16038'. [ 1281.738564][T15516] lo speed is unknown, defaulting to 1000 [ 1281.775089][T15525] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 1281.786077][T15522] nbd: must specify at least one socket [ 1282.026135][T15536] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16043'. [ 1282.067444][T15532] nbd1: detected capacity change from 0 to 63 [ 1282.080767][T15539] block nbd1: NBD_DISCONNECT [ 1282.093229][T15539] block nbd1: Disconnected due to user request. [ 1282.111552][T15539] block nbd1: shutting down sockets [ 1282.135048][T12043] ldm_validate_partition_table(): Disk read failed. [ 1282.144835][T12043] Dev nbd1: unable to read RDB block 0 [ 1282.165874][T12043] nbd1: unable to read partition table [ 1282.194888][T12043] ldm_validate_partition_table(): Disk read failed. [ 1282.206203][T12043] Dev nbd1: unable to read RDB block 0 [ 1282.214215][T12043] nbd1: unable to read partition table [ 1282.350027][T15551] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16047'. [ 1282.383268][T15551] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16047'. [ 1282.622942][T15516] lo speed is unknown, defaulting to 1000 [ 1282.634036][T15573] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16056'. [ 1282.705668][T15579] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1282.826911][T15584] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16061'. [ 1282.866793][T15588] nbd: device at index 0 is going down [ 1282.880364][T15588] block nbd0: NBD_DISCONNECT [ 1282.895161][T15588] block nbd0: Send disconnect failed -32 [ 1282.911259][T15588] block nbd0: shutting down sockets [ 1282.949860][T15392] ldm_validate_partition_table(): Disk read failed. [ 1282.996580][T15392] Dev nbd0: unable to read RDB block 0 [ 1283.020239][T15392] nbd0: unable to read partition table [ 1283.084737][T15392] ldm_validate_partition_table(): Disk read failed. [ 1283.109148][T15392] Dev nbd0: unable to read RDB block 0 [ 1283.116466][T15392] nbd0: unable to read partition table [ 1283.149990][T15392] block nbd0: NBD_DISCONNECT [ 1283.159528][T15392] block nbd0: Send disconnect failed -32 [ 1283.342024][T15611] netlink: 100 bytes leftover after parsing attributes in process `syz.0.16068'. [ 1283.354754][T15596] nbd4: detected capacity change from 0 to 63 [ 1283.358843][T15392] udevd[15392]: inotify_add_watch(7, /dev/nbd0, 10) failed: No such file or directory [ 1283.361949][T15601] block nbd4: NBD_DISCONNECT [ 1283.395307][T15601] block nbd4: Disconnected due to user request. [ 1283.402252][T15601] block nbd4: shutting down sockets [ 1283.406985][T12043] ldm_validate_partition_table(): Disk read failed. [ 1283.426535][T12043] Dev nbd4: unable to read RDB block 0 [ 1283.437050][T12043] nbd4: unable to read partition table [ 1283.454645][T12043] ldm_validate_partition_table(): Disk read failed. [ 1283.464908][T12043] Dev nbd4: unable to read RDB block 0 [ 1283.492206][T12043] nbd4: unable to read partition table [ 1283.632069][T15615] netlink: 224 bytes leftover after parsing attributes in process `syz.0.16069'. [ 1283.641333][T15618] netlink: 28 bytes leftover after parsing attributes in process `syz.4.16071'. [ 1283.658938][T15615] netlink: 'syz.0.16069': attribute type 9 has an invalid length. [ 1283.703109][T15619] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16072'. [ 1284.199933][T15645] nbd4: detected capacity change from 0 to 63 [ 1284.226795][T15646] block nbd4: NBD_DISCONNECT [ 1284.242855][T15646] block nbd4: Disconnected due to user request. [ 1284.252463][T15651] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1284.274779][T15651] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1284.286822][T15646] block nbd4: shutting down sockets [ 1284.320312][T15392] ldm_validate_partition_table(): Disk read failed. [ 1284.343883][T15392] Dev nbd4: unable to read RDB block 0 [ 1284.360770][T15657] netlink: 'syz.1.16085': attribute type 10 has an invalid length. [ 1284.388940][T15392] nbd4: unable to read partition table [ 1284.423108][T15392] ldm_validate_partition_table(): Disk read failed. [ 1284.426656][ T35] tipc: Subscription rejected, illegal request [ 1284.439597][T15657] wlan1: mtu greater than device maximum [ 1284.448425][T15657] bond0: (slave wlan1): Error -22 calling dev_set_mtu [ 1284.461661][T15392] Dev nbd4: unable to read RDB block 0 [ 1284.469562][T15392] nbd4: unable to read partition table [ 1284.499529][T15662] A link change request failed with some changes committed already. Interface gtp3 may have been left with an inconsistent configuration, please check. [ 1284.680476][T15672] tipc: Enabling of bearer rejected, failed to enable media [ 1284.820644][T15678] FAULT_INJECTION: forcing a failure. [ 1284.820644][T15678] name failslab, interval 1, probability 0, space 0, times 0 [ 1284.834363][T15678] CPU: 1 UID: 0 PID: 15678 Comm: syz.3.16092 Not tainted syzkaller #0 PREEMPT(full) [ 1284.834387][T15678] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1284.834397][T15678] Call Trace: [ 1284.834404][T15678] [ 1284.834411][T15678] dump_stack_lvl+0xe8/0x150 [ 1284.834441][T15678] should_fail_ex+0x412/0x560 [ 1284.834470][T15678] should_failslab+0xa8/0x100 [ 1284.834492][T15678] __kmalloc_noprof+0xe8/0x760 [ 1284.834517][T15678] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1284.834548][T15678] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1284.834575][T15678] ? tomoyo_domain+0xd7/0x130 [ 1284.834604][T15678] ? tomoyo_path_number_perm+0x219/0x630 [ 1284.834626][T15678] tomoyo_path_number_perm+0x246/0x630 [ 1284.834650][T15678] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1284.834669][T15678] ? __lock_acquire+0x6b5/0x2cf0 [ 1284.834706][T15678] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1284.834748][T15678] ? __fget_files+0x2a/0x420 [ 1284.834771][T15678] ? __fget_files+0x2a/0x420 [ 1284.834791][T15678] ? __fget_files+0x3a0/0x420 [ 1284.834811][T15678] ? __fget_files+0x2a/0x420 [ 1284.834836][T15678] security_file_ioctl+0xc3/0x2a0 [ 1284.834859][T15678] __se_sys_ioctl+0x47/0x170 [ 1284.834876][T15678] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.834896][T15678] do_syscall_64+0x15f/0xf80 [ 1284.834916][T15678] ? trace_irq_disable+0x3b/0x140 [ 1284.834935][T15678] ? clear_bhb_loop+0x40/0x90 [ 1284.834957][T15678] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.834975][T15678] RIP: 0033:0x7feb5b79c819 [ 1284.834993][T15678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1284.835008][T15678] RSP: 002b:00007feb5c5f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1284.835036][T15678] RAX: ffffffffffffffda RBX: 00007feb5ba15fa0 RCX: 00007feb5b79c819 [ 1284.835050][T15678] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000005 [ 1284.835062][T15678] RBP: 00007feb5c5f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1284.835073][T15678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1284.835083][T15678] R13: 00007feb5ba16038 R14: 00007feb5ba15fa0 R15: 00007ffe905ccca8 [ 1284.835114][T15678] [ 1284.835184][T15678] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1285.316969][T15694] nbd2: detected capacity change from 0 to 63 [ 1285.346324][T15700] block nbd2: NBD_DISCONNECT [ 1285.369957][T15700] block nbd2: Disconnected due to user request. [ 1285.389346][T15700] block nbd2: shutting down sockets [ 1285.420369][T15392] ldm_validate_partition_table(): Disk read failed. [ 1285.429141][T15703] gre6: entered promiscuous mode [ 1285.434308][T15703] gre6: entered allmulticast mode [ 1285.449976][T15392] Dev nbd2: unable to read RDB block 0 [ 1285.465307][T15392] nbd2: unable to read partition table [ 1285.520858][T15392] ldm_validate_partition_table(): Disk read failed. [ 1285.552876][T15392] Dev nbd2: unable to read RDB block 0 [ 1285.581346][T15392] nbd2: unable to read partition table [ 1285.809279][T15730] netlink: 'syz.0.16111': attribute type 83 has an invalid length. [ 1285.915104][T15741] xt_hashlimit: size too large, truncated to 1048576 [ 1285.979133][T15725] delete_channel: no stack [ 1286.234386][T15764] x_tables: duplicate underflow at hook 2 [ 1286.495586][T15781] mac80211_hwsim hwsim6 syzkaller0: entered promiscuous mode [ 1286.526247][T15781] mac80211_hwsim hwsim6 syzkaller0: entered allmulticast mode [ 1286.851814][T15800] xt_CT: No such helper "pptp" [ 1287.270112][T15833] __nla_validate_parse: 15 callbacks suppressed [ 1287.270133][T15833] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16136'. [ 1287.364435][T15839] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16137'. [ 1287.608931][T15859] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1287.624847][T15858] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1287.642848][T15860] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16145'. [ 1287.664134][T15858] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1287.767894][ T29] audit: type=1107 audit(1776281838.241:4): pid=15865 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1287.955532][T15880] netlink: 36 bytes leftover after parsing attributes in process `syz.4.16153'. [ 1288.062398][T15885] xt_hashlimit: size too large, truncated to 1048576 [ 1288.107643][T15880] netlink: 36 bytes leftover after parsing attributes in process `syz.4.16153'. [ 1288.326731][T15896] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16160'. [ 1288.356834][T15896] netlink: 24 bytes leftover after parsing attributes in process `syz.1.16160'. [ 1288.393925][T15898] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1288.418890][T15898] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1288.446472][T15902] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16162'. [ 1288.942223][T15933] netlink: 112 bytes leftover after parsing attributes in process `syz.1.16173'. [ 1288.981901][T15935] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1289.011699][T15935] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1289.022544][T15931] xt_CT: No such helper "pptp" [ 1289.173550][T15947] netlink: 'syz.1.16179': attribute type 4 has an invalid length. [ 1289.277801][T15951] nbd4: detected capacity change from 0 to 63 [ 1289.293621][T15959] block nbd4: NBD_DISCONNECT [ 1289.309384][T15959] block nbd4: Disconnected due to user request. [ 1289.330935][T15960] FAULT_INJECTION: forcing a failure. [ 1289.330935][T15960] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1289.333182][T15959] block nbd4: shutting down sockets [ 1289.382766][ C0] blk_print_req_error: 875 callbacks suppressed [ 1289.382786][ C0] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.388745][T15960] CPU: 1 UID: 0 PID: 15960 Comm: syz.0.16184 Not tainted syzkaller #0 PREEMPT(full) [ 1289.388771][T15960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1289.388783][T15960] Call Trace: [ 1289.388790][T15960] [ 1289.388798][T15960] dump_stack_lvl+0xe8/0x150 [ 1289.388828][T15960] should_fail_ex+0x412/0x560 [ 1289.388856][T15960] _copy_from_user+0x2d/0xb0 [ 1289.388875][T15960] nr_rt_ioctl+0x966/0xf90 [ 1289.388907][T15960] ? kasan_quarantine_put+0xbb/0x1f0 [ 1289.388931][T15960] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 1289.388963][T15960] ? apparmor_capable+0x126/0x170 [ 1289.388989][T15960] ? capable+0x88/0xe0 [ 1289.389011][T15960] ? nr_ioctl+0x1b1/0x3b0 [ 1289.389033][T15960] sock_do_ioctl+0x101/0x320 [ 1289.389055][T15960] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1289.389072][T15960] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1289.389107][T15960] sock_ioctl+0x5c6/0x7f0 [ 1289.389128][T15960] ? __pfx_sock_ioctl+0x10/0x10 [ 1289.389147][T15960] ? __fget_files+0x2a/0x420 [ 1289.389164][T15960] ? __fget_files+0x3a0/0x420 [ 1289.389181][T15960] ? __fget_files+0x2a/0x420 [ 1289.389201][T15960] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1289.389219][T15960] ? __pfx_sock_ioctl+0x10/0x10 [ 1289.389234][T15960] __se_sys_ioctl+0xfc/0x170 [ 1289.389250][T15960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1289.389268][T15960] do_syscall_64+0x15f/0xf80 [ 1289.389288][T15960] ? trace_irq_disable+0x3b/0x140 [ 1289.389306][T15960] ? clear_bhb_loop+0x40/0x90 [ 1289.389326][T15960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1289.389343][T15960] RIP: 0033:0x7fae6e19c819 [ 1289.389361][T15960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1289.389376][T15960] RSP: 002b:00007fae6f02a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1289.389397][T15960] RAX: ffffffffffffffda RBX: 00007fae6e416090 RCX: 00007fae6e19c819 [ 1289.389409][T15960] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000005 [ 1289.389420][T15960] RBP: 00007fae6f02a090 R08: 0000000000000000 R09: 0000000000000000 [ 1289.389431][T15960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1289.389441][T15960] R13: 00007fae6e416128 R14: 00007fae6e416090 R15: 00007ffc2ca11578 [ 1289.389469][T15960] [ 1289.622555][ C0] buffer_io_error: 878 callbacks suppressed [ 1289.622575][ C0] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1289.636563][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.645970][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1289.654003][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.663289][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 1289.671229][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.680622][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 1289.688646][T15392] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.730601][T15392] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1289.763379][T15392] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.825352][T15392] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1289.867419][T15392] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.889000][T15985] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1289.908248][T15392] Buffer I/O error on dev nbd4, logical block 2, async page read [ 1289.916315][T15985] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1289.938964][T15392] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1289.962242][T15392] Buffer I/O error on dev nbd4, logical block 3, async page read [ 1289.990770][T15392] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1290.019692][T15392] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1290.030006][T15988] xt_CT: No such helper "pptp" [ 1290.039471][T15994] netlink: 212344 bytes leftover after parsing attributes in process `syz.1.16193'. [ 1290.062167][T15392] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1290.092092][T15392] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1290.119747][T15392] ldm_validate_partition_table(): Disk read failed. [ 1290.143298][T15392] Dev nbd4: unable to read RDB block 0 [ 1290.169749][T15392] nbd4: unable to read partition table [ 1290.193003][T15392] ldm_validate_partition_table(): Disk read failed. [ 1290.231333][T15392] Dev nbd4: unable to read RDB block 0 [ 1290.270927][T16004] x_tables: duplicate underflow at hook 2 [ 1290.278914][T15392] nbd4: unable to read partition table [ 1290.598332][T16020] syzkaller1: entered promiscuous mode [ 1290.603848][T16020] syzkaller1: entered allmulticast mode [ 1290.813911][T16037] unsupported nlmsg_type 40 [ 1291.444114][T16087] IPVS: length: 239 != 24 [ 1291.489141][T16090] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1291.665838][T16105] SET target dimension over the limit! [ 1291.674770][T16101] xt_CT: No such helper "pptp" [ 1292.380167][T16148] xt_hashlimit: size too large, truncated to 1048576 [ 1292.497599][T16154] Cannot find del_set index 49151 as target [ 1292.611585][T16160] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1292.631491][T16160] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1292.876173][T16179] __nla_validate_parse: 8 callbacks suppressed [ 1292.876200][T16179] netlink: 68 bytes leftover after parsing attributes in process `syz.3.16246'. [ 1293.070924][T16188] netlink: 'syz.1.16250': attribute type 1 has an invalid length. [ 1294.336997][T16258] x_tables: duplicate underflow at hook 2 [ 1294.455174][T16262] netlink: 68 bytes leftover after parsing attributes in process `syz.1.16273'. [ 1294.527246][T16269] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1294.530586][T16270] netlink: 44 bytes leftover after parsing attributes in process `syz.0.16277'. [ 1294.537445][T16269] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1294.791253][T16280] xt_hashlimit: size too large, truncated to 1048576 [ 1294.879548][T16288] netlink: 48 bytes leftover after parsing attributes in process `syz.4.16282'. [ 1294.915170][T16288] netlink: 48 bytes leftover after parsing attributes in process `syz.4.16282'. [ 1294.982669][T16289] lo speed is unknown, defaulting to 1000 [ 1295.276862][T16299] netlink: 16 bytes leftover after parsing attributes in process `syz.4.16286'. [ 1295.493399][T16305] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1295.517221][T16305] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1295.543468][T16289] lo speed is unknown, defaulting to 1000 [ 1295.703400][T16315] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16293'. [ 1295.739016][T16315] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16293'. [ 1295.926527][T16330] netlink: 68 bytes leftover after parsing attributes in process `syz.3.16297'. [ 1296.417346][T16343] nbd1: detected capacity change from 0 to 63 [ 1296.439694][T16347] block nbd1: NBD_DISCONNECT [ 1296.458767][T16347] block nbd1: Disconnected due to user request. [ 1296.473347][T16347] block nbd1: shutting down sockets [ 1296.490845][ C0] blk_print_req_error: 138 callbacks suppressed [ 1296.490869][ C0] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.506680][ C0] buffer_io_error: 138 callbacks suppressed [ 1296.506701][ C0] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1296.522173][ C0] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.531338][ C0] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1296.539186][ C0] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.548288][ C0] Buffer I/O error on dev nbd1, logical block 2, async page read [ 1296.556224][ C0] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.565445][ C0] Buffer I/O error on dev nbd1, logical block 3, async page read [ 1296.582401][T15392] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.619142][T15392] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1296.620951][T16352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16307'. [ 1296.644249][T15392] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.690870][T15392] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1296.699397][T15392] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.712624][T15392] Buffer I/O error on dev nbd1, logical block 2, async page read [ 1296.722706][T15392] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.745326][T15392] Buffer I/O error on dev nbd1, logical block 3, async page read [ 1296.809405][T15392] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.841801][T15392] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1296.877359][T15392] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1296.911855][T15392] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1296.942988][T15392] ldm_validate_partition_table(): Disk read failed. [ 1296.988497][T15392] Dev nbd1: unable to read RDB block 0 [ 1297.018648][T15392] nbd1: unable to read partition table [ 1297.053444][T15392] ldm_validate_partition_table(): Disk read failed. [ 1297.074942][T15392] Dev nbd1: unable to read RDB block 0 [ 1297.098149][T15392] nbd1: unable to read partition table [ 1298.052434][T16411] __nla_validate_parse: 7 callbacks suppressed [ 1298.052453][T16411] netlink: 24 bytes leftover after parsing attributes in process `syz.3.16329'. [ 1298.165019][T16422] netlink: 'syz.4.16331': attribute type 24 has an invalid length. [ 1298.227343][T16422] nbd4: detected capacity change from 0 to 63 [ 1298.288489][T16427] netlink: 48 bytes leftover after parsing attributes in process `syz.3.16333'. [ 1298.314305][T16427] netlink: 48 bytes leftover after parsing attributes in process `syz.3.16333'. [ 1298.323760][T16429] x_tables: duplicate underflow at hook 2 [ 1298.336171][T16430] block nbd4: NBD_DISCONNECT [ 1298.346978][T16430] block nbd4: Disconnected due to user request. [ 1298.373812][T16430] block nbd4: shutting down sockets [ 1298.412678][T15392] ldm_validate_partition_table(): Disk read failed. [ 1298.458548][T15392] Dev nbd4: unable to read RDB block 0 [ 1298.490559][T15392] nbd4: unable to read partition table [ 1298.531967][T15392] ldm_validate_partition_table(): Disk read failed. [ 1298.535051][T16441] netlink: 48 bytes leftover after parsing attributes in process `syz.0.16339'. [ 1298.560244][T16440] xt_hashlimit: size too large, truncated to 1048576 [ 1298.563576][T15392] Dev nbd4: unable to read RDB block 0 [ 1298.604920][T16442] syzkaller0: entered promiscuous mode [ 1298.614949][T15392] nbd4: unable to read partition table [ 1298.634815][T16442] syzkaller0: entered allmulticast mode [ 1298.870620][T16453] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16341'. [ 1299.000833][T16464] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1299.053564][T16469] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16347'. [ 1299.074902][T16469] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16347'. [ 1299.083008][T16467] netlink: 68 bytes leftover after parsing attributes in process `syz.3.16348'. [ 1299.158239][T16471] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 1299.175894][T16477] FAULT_INJECTION: forcing a failure. [ 1299.175894][T16477] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1299.191566][T16471] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16346'. [ 1299.212532][T16477] CPU: 0 UID: 0 PID: 16477 Comm: syz.1.16350 Not tainted syzkaller #0 PREEMPT(full) [ 1299.212557][T16477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1299.212568][T16477] Call Trace: [ 1299.212575][T16477] [ 1299.212583][T16477] dump_stack_lvl+0xe8/0x150 [ 1299.212614][T16477] should_fail_ex+0x412/0x560 [ 1299.212643][T16477] _copy_from_user+0x2d/0xb0 [ 1299.212662][T16477] ____sys_sendmsg+0x308/0x9f0 [ 1299.212694][T16477] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1299.212725][T16477] ? import_iovec+0x73/0xa0 [ 1299.212747][T16477] ___sys_sendmsg+0x2a5/0x360 [ 1299.212770][T16477] ? __lock_acquire+0x6b5/0x2cf0 [ 1299.212796][T16477] ? __pfx____sys_sendmsg+0x10/0x10 [ 1299.212853][T16477] ? __fget_files+0x2a/0x420 [ 1299.212874][T16477] ? __fget_files+0x3a0/0x420 [ 1299.212905][T16477] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1299.212934][T16477] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1299.212968][T16477] ? __pfx_ksys_write+0x10/0x10 [ 1299.213001][T16477] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1299.213021][T16477] do_syscall_64+0x15f/0xf80 [ 1299.213042][T16477] ? trace_irq_disable+0x3b/0x140 [ 1299.213061][T16477] ? clear_bhb_loop+0x40/0x90 [ 1299.213083][T16477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1299.213100][T16477] RIP: 0033:0x7f67dfd9c819 [ 1299.213121][T16477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1299.213136][T16477] RSP: 002b:00007f67e0d1a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1299.213156][T16477] RAX: ffffffffffffffda RBX: 00007f67e0015fa0 RCX: 00007f67dfd9c819 [ 1299.213170][T16477] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000005 [ 1299.213182][T16477] RBP: 00007f67e0d1a090 R08: 0000000000000000 R09: 0000000000000000 [ 1299.213194][T16477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1299.213205][T16477] R13: 00007f67e0016038 R14: 00007f67e0015fa0 R15: 00007ffd85b55d08 [ 1299.213234][T16477] [ 1299.502749][T16485] netlink: 294 bytes leftover after parsing attributes in process `syz.1.16354'. [ 1299.512562][T16485] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1300.255795][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 1300.264661][ T1297] clip:clip_start_xmit: skb_dst(skb) == NULL [ 1300.438512][T16538] netlink: 'syz.1.16377': attribute type 64 has an invalid length. [ 1300.633615][T16553] xt_CT: No such helper "pptp" [ 1300.741581][T16559] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 1302.491892][T16665] FAULT_INJECTION: forcing a failure. [ 1302.491892][T16665] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1302.515654][T16665] CPU: 0 UID: 0 PID: 16665 Comm: syz.2.16411 Not tainted syzkaller #0 PREEMPT(full) [ 1302.515679][T16665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1302.515689][T16665] Call Trace: [ 1302.515697][T16665] [ 1302.515704][T16665] dump_stack_lvl+0xe8/0x150 [ 1302.515732][T16665] should_fail_ex+0x412/0x560 [ 1302.515761][T16665] _copy_from_user+0x2d/0xb0 [ 1302.515781][T16665] copy_from_sockptr+0x5e/0x90 [ 1302.515803][T16665] memdup_sockptr_noprof+0x44/0x90 [ 1302.515823][T16665] do_ip_setsockopt+0x2041/0x2ea0 [ 1302.515853][T16665] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 1302.515874][T16665] ? aa_sk_perm+0x6d5/0x900 [ 1302.515897][T16665] ? __fget_files+0x2a/0x420 [ 1302.515923][T16665] ? __pfx_aa_sk_perm+0x10/0x10 [ 1302.515947][T16665] ? __fget_files+0x2a/0x420 [ 1302.515963][T16665] ? aa_sock_opt_perm+0xff/0x1a0 [ 1302.515988][T16665] ip_setsockopt+0x66/0x110 [ 1302.516006][T16665] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1302.516030][T16665] do_sock_setsockopt+0x17c/0x1b0 [ 1302.516060][T16665] __x64_sys_setsockopt+0x13d/0x1b0 [ 1302.516086][T16665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1302.516106][T16665] do_syscall_64+0x15f/0xf80 [ 1302.516125][T16665] ? trace_irq_disable+0x3b/0x140 [ 1302.516140][T16665] ? clear_bhb_loop+0x40/0x90 [ 1302.516162][T16665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1302.516187][T16665] RIP: 0033:0x7f2c7ed9c819 [ 1302.516205][T16665] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1302.516220][T16665] RSP: 002b:00007f2c7fcdf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1302.516240][T16665] RAX: ffffffffffffffda RBX: 00007f2c7f015fa0 RCX: 00007f2c7ed9c819 [ 1302.516253][T16665] RDX: 0000000000000029 RSI: 0000000000000000 RDI: 0000000000000003 [ 1302.516264][T16665] RBP: 00007f2c7fcdf090 R08: 0000000000000010 R09: 0000000000000000 [ 1302.516276][T16665] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000001 [ 1302.516287][T16665] R13: 00007f2c7f016038 R14: 00007f2c7f015fa0 R15: 00007ffe6c3e60e8 [ 1302.516319][T16665] [ 1302.764464][T16669] IPVS: Unknown mcast interface: vcan0 [ 1302.832972][T16671] netlink: 'syz.1.16412': attribute type 4 has an invalid length. [ 1303.180812][T16684] xt_CT: No such helper "pptp" [ 1303.316884][T16706] __nla_validate_parse: 23 callbacks suppressed [ 1303.316904][T16706] netlink: 68 bytes leftover after parsing attributes in process `syz.2.16423'. [ 1303.529137][T16713] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16426'. [ 1303.650464][T16725] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16427'. [ 1304.524065][T16767] netlink: 'syz.2.16444': attribute type 1 has an invalid length. [ 1304.544658][T16767] netlink: 96 bytes leftover after parsing attributes in process `syz.2.16444'. [ 1304.566741][T16767] netlink: 658 bytes leftover after parsing attributes in process `syz.2.16444'. [ 1304.588296][T16767] netlink: 1 bytes leftover after parsing attributes in process `syz.2.16444'. [ 1304.613374][T16774] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16444'. [ 1304.645348][T16777] netlink: 68 bytes leftover after parsing attributes in process `syz.3.16448'. [ 1304.879064][T16787] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16453'. [ 1304.882262][T16784] netlink: 'syz.0.16451': attribute type 2 has an invalid length. [ 1304.918979][T16784] netlink: 'syz.0.16451': attribute type 2 has an invalid length. [ 1304.945898][T16790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16454'. [ 1305.119303][T16801] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1305.776495][T16844] netlink: 'syz.4.16471': attribute type 4 has an invalid length. [ 1305.927406][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5670 ms [ 1305.935626][ C1] lec:lec_tx_timeout: lec0 [ 1306.097452][T16859] nbd1: detected capacity change from 0 to 63 [ 1306.111803][T16863] block nbd1: NBD_DISCONNECT [ 1306.130371][T16863] block nbd1: Disconnected due to user request. [ 1306.140396][T16863] block nbd1: shutting down sockets [ 1306.157988][ C0] blk_print_req_error: 286 callbacks suppressed [ 1306.158006][ C0] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.173978][ C0] buffer_io_error: 286 callbacks suppressed [ 1306.173999][ C0] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1306.188462][ C0] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.197573][ C0] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1306.205385][ C0] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.214516][ C0] Buffer I/O error on dev nbd1, logical block 2, async page read [ 1306.222369][ C0] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.231607][ C0] Buffer I/O error on dev nbd1, logical block 3, async page read [ 1306.248709][T15392] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.266103][T15392] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1306.280669][T16867] block nbd2: Unsupported socket: should be TCP or UNIX. [ 1306.299555][T15392] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.330946][T15392] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1306.353405][T15392] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.397903][T15392] Buffer I/O error on dev nbd1, logical block 2, async page read [ 1306.431521][T15392] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.450847][T15392] Buffer I/O error on dev nbd1, logical block 3, async page read [ 1306.475528][T15392] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.513358][T15392] Buffer I/O error on dev nbd1, logical block 0, async page read [ 1306.536309][T15392] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1306.558960][T15392] Buffer I/O error on dev nbd1, logical block 1, async page read [ 1306.579869][T15392] ldm_validate_partition_table(): Disk read failed. [ 1306.586957][T16881] netlink: zone id is out of range [ 1306.608557][T16881] netlink: zone id is out of range [ 1306.623933][T16881] netlink: zone id is out of range [ 1306.629941][T15392] Dev nbd1: unable to read RDB block 0 [ 1306.659840][T15392] nbd1: unable to read partition table [ 1306.666617][T16881] netlink: zone id is out of range [ 1306.695276][T16881] netlink: zone id is out of range [ 1306.714118][T15392] ldm_validate_partition_table(): Disk read failed. [ 1306.738347][T16881] netlink: zone id is out of range [ 1306.751982][T15392] Dev nbd1: unable to read RDB block 0 [ 1306.769613][T16881] netlink: zone id is out of range [ 1306.778279][T16881] netlink: zone id is out of range [ 1306.783074][T15392] nbd1: unable to read partition table [ 1306.793765][T16881] netlink: zone id is out of range [ 1306.824527][T16881] netlink: zone id is out of range [ 1307.015504][T16898] FAULT_INJECTION: forcing a failure. [ 1307.015504][T16898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1307.044941][T16898] CPU: 1 UID: 0 PID: 16898 Comm: syz.0.16491 Not tainted syzkaller #0 PREEMPT(full) [ 1307.044972][T16898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1307.044983][T16898] Call Trace: [ 1307.044990][T16898] [ 1307.044998][T16898] dump_stack_lvl+0xe8/0x150 [ 1307.045027][T16898] should_fail_ex+0x412/0x560 [ 1307.045054][T16898] _copy_from_user+0x2d/0xb0 [ 1307.045073][T16898] ___sys_recvmsg+0x175/0x590 [ 1307.045089][T16898] ? get_pid_task+0x20/0x1f0 [ 1307.045104][T16898] ? get_pid_task+0x20/0x1f0 [ 1307.045124][T16898] ? __pfx____sys_recvmsg+0x10/0x10 [ 1307.045146][T16898] ? __fget_files+0x2a/0x420 [ 1307.045180][T16898] ? __fget_files+0x3a0/0x420 [ 1307.045210][T16898] __x64_sys_recvmsg+0x1ba/0x2a0 [ 1307.045230][T16898] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1307.045255][T16898] ? __pfx_ksys_write+0x10/0x10 [ 1307.045285][T16898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1307.045303][T16898] do_syscall_64+0x15f/0xf80 [ 1307.045322][T16898] ? trace_irq_disable+0x3b/0x140 [ 1307.045342][T16898] ? clear_bhb_loop+0x40/0x90 [ 1307.045364][T16898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1307.045380][T16898] RIP: 0033:0x7fae6e19c819 [ 1307.045397][T16898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1307.045412][T16898] RSP: 002b:00007fae6f04b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1307.045433][T16898] RAX: ffffffffffffffda RBX: 00007fae6e415fa0 RCX: 00007fae6e19c819 [ 1307.045446][T16898] RDX: 0000000000000120 RSI: 0000200000000500 RDI: 0000000000000004 [ 1307.045457][T16898] RBP: 00007fae6f04b090 R08: 0000000000000000 R09: 0000000000000000 [ 1307.045468][T16898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1307.045479][T16898] R13: 00007fae6e416038 R14: 00007fae6e415fa0 R15: 00007ffc2ca11578 [ 1307.045509][T16898] [ 1307.087427][ T9924] netdevsim netdevsim3 netdevsim0: set [1, 2] type 2 family 0 port 20002 - 0 [ 1307.298169][ T9924] netdevsim netdevsim3 netdevsim1: set [1, 2] type 2 family 0 port 20002 - 0 [ 1307.317316][ T9924] netdevsim netdevsim3 netdevsim2: set [1, 2] type 2 family 0 port 20002 - 0 [ 1307.335531][ T9924] netdevsim netdevsim3 netdevsim3: set [1, 2] type 2 family 0 port 20002 - 0 [ 1307.423315][T16912] IPVS: Unknown mcast interface: vcan0 [ 1307.693053][T16933] netlink: 'syz.4.16507': attribute type 9 has an invalid length. [ 1307.704859][T16933] netlink: 'syz.4.16507': attribute type 9 has an invalid length. [ 1307.886848][T16947] IPVS: Unknown mcast interface: vcan0 [ 1308.011308][T16959] netlink: 'syz.0.16512': attribute type 10 has an invalid length. [ 1308.288448][T16969] lo speed is unknown, defaulting to 1000 [ 1308.520154][T16988] netlink: 'syz.0.16520': attribute type 9 has an invalid length. [ 1308.571444][T16988] __nla_validate_parse: 18 callbacks suppressed [ 1308.571465][T16988] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16520'. [ 1308.674481][T16988] netlink: 'syz.0.16520': attribute type 9 has an invalid length. [ 1308.713343][T16988] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16520'. [ 1308.852974][T16969] lo speed is unknown, defaulting to 1000 [ 1308.918804][T17007] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16525'. [ 1308.936526][T17005] IPVS: Unknown mcast interface: vcan0 [ 1309.213028][T17022] x_tables: duplicate underflow at hook 2 [ 1309.426291][T26018] lec:lec_start_xmit: lec0:No lecd attached [ 1309.512307][T17036] netlink: 'syz.4.16531': attribute type 10 has an invalid length. [ 1309.527046][T17021] syzkaller0: entered promiscuous mode [ 1309.533511][T17021] syzkaller0: entered allmulticast mode [ 1313.112257][T17054] IPVS: Unknown mcast interface: vcan0 [ 1313.523979][T17076] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16538'. [ 1313.764461][T17087] netlink: 'syz.0.16543': attribute type 10 has an invalid length. [ 1313.924257][T17091] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1313.939506][T17094] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16545'. [ 1314.024555][T17098] bond0: Caught tx_queue_len zero misconfig [ 1314.053802][T17098] bond14: (slave C): Releasing backup interface [ 1314.062237][T17098] bond14: (slave C): last VLAN challenged slave left bond - VLAN blocking is removed [ 1314.093518][T17098] net_ratelimit: 2 callbacks suppressed [ 1314.093602][T17098] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1314.887167][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5460 ms [ 1314.895268][ C1] lec:lec_tx_timeout: lec0 [ 1314.963069][T17151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16556'. [ 1315.094626][T17158] netlink: 60 bytes leftover after parsing attributes in process `syz.1.16561'. [ 1315.122645][T17158] netlink: 60 bytes leftover after parsing attributes in process `syz.1.16561'. [ 1315.188618][T17168] netlink: 48 bytes leftover after parsing attributes in process `syz.0.16564'. [ 1315.363754][T17175] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16566'. [ 1315.542234][T17187] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16570'. [ 1315.786377][T17200] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16573'. [ 1315.795006][T17201] x_tables: duplicate underflow at hook 2 [ 1315.813547][T17200] netlink: 24 bytes leftover after parsing attributes in process `syz.4.16573'. [ 1316.242494][T17230] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16578'. [ 1316.670838][T17257] netlink: 'syz.1.16586': attribute type 9 has an invalid length. [ 1316.699693][T17257] netlink: 'syz.1.16586': attribute type 9 has an invalid length. [ 1317.100019][T17276] nbd4: detected capacity change from 0 to 63 [ 1317.128293][ T5822] block nbd4: Receive control failed (result -104) [ 1317.204631][T17286] atomic_op ffff8880ab2df998 conn xmit_atomic 0000000000000000 [ 1317.846198][T17331] x_tables: duplicate underflow at hook 2 [ 1318.003160][T17340] netlink: 'syz.2.16610': attribute type 1 has an invalid length. [ 1318.164467][T17353] bond20: entered promiscuous mode [ 1318.170768][T17353] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1318.375772][T17366] xt_recent: Unsupported userspace flags (000000b1) [ 1318.654250][T17374] IPVS: stopping master sync thread 6172 ... [ 1319.103870][T17397] __nla_validate_parse: 12 callbacks suppressed [ 1319.103884][T17397] netlink: 36 bytes leftover after parsing attributes in process `syz.2.16632'. [ 1319.123740][T17397] netlink: 36 bytes leftover after parsing attributes in process `syz.2.16632'. [ 1319.307278][T17412] x_tables: duplicate underflow at hook 2 [ 1319.362933][T17407] netlink: 40 bytes leftover after parsing attributes in process `syz.2.16634'. [ 1319.487423][T17417] nbd3: detected capacity change from 0 to 63 [ 1319.511298][ T5822] block nbd3: Receive control failed (result -104) [ 1319.606673][T17432] bridge0: port 3(syz_tun) entered blocking state [ 1319.650632][T17432] bridge0: port 3(syz_tun) entered disabled state [ 1319.694231][T17432] syz_tun: entered allmulticast mode [ 1319.709721][T17436] xt_CT: No such helper "pptp" [ 1319.718606][T17432] syz_tun: entered promiscuous mode [ 1319.806226][T17444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16651'. [ 1319.818618][T17444] openvswitch: netlink: Flow actions attr not present in new flow. [ 1319.882517][T17450] netlink: 'syz.1.16652': attribute type 9 has an invalid length. [ 1319.893440][T17450] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16652'. [ 1320.084563][T17450] netlink: 'syz.1.16652': attribute type 9 has an invalid length. [ 1320.092489][T17450] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16652'. [ 1320.153888][T17459] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16655'. [ 1320.615551][T17480] netlink: 'syz.2.16663': attribute type 1 has an invalid length. [ 1320.883697][T17488] x_tables: duplicate underflow at hook 2 [ 1320.949327][T17491] netlink: 'syz.2.16667': attribute type 4 has an invalid length. [ 1320.950426][T17490] netlink: 'syz.2.16667': attribute type 4 has an invalid length. [ 1320.998923][T17490] netlink: 'syz.2.16667': attribute type 4 has an invalid length. [ 1321.026517][T17490] netlink: 'syz.2.16667': attribute type 4 has an invalid length. [ 1321.359788][T17508] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16674'. [ 1321.381699][T17508] netlink: 24 bytes leftover after parsing attributes in process `syz.1.16674'. [ 1321.430862][T17504] xt_CT: No such helper "pptp" [ 1321.587912][T17523] netlink: 12 bytes leftover after parsing attributes in process `syz.2.16679'. [ 1321.603717][T17518] openvswitch: netlink: Message has 8 unknown bytes. [ 1321.611586][T17518] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1321.791020][T17526] netlink: 'syz.1.16680': attribute type 3 has an invalid length. [ 1321.821002][T17526] netlink: 'syz.1.16680': attribute type 1 has an invalid length. [ 1322.327888][T17552] netlink: 'syz.3.16687': attribute type 10 has an invalid length. [ 1322.337919][T17552] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1322.349214][T17554] syzkaller0: entered promiscuous mode [ 1322.354914][T17554] syzkaller0: entered allmulticast mode [ 1322.598137][T17570] FAULT_INJECTION: forcing a failure. [ 1322.598137][T17570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1322.687448][T17570] CPU: 0 UID: 0 PID: 17570 Comm: syz.3.16693 Not tainted syzkaller #0 PREEMPT(full) [ 1322.687474][T17570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1322.687485][T17570] Call Trace: [ 1322.687493][T17570] [ 1322.687501][T17570] dump_stack_lvl+0xe8/0x150 [ 1322.687532][T17570] should_fail_ex+0x412/0x560 [ 1322.687561][T17570] _copy_from_user+0x2d/0xb0 [ 1322.687580][T17570] ___sys_sendmsg+0x1c6/0x360 [ 1322.687606][T17570] ? __lock_acquire+0x6b5/0x2cf0 [ 1322.687633][T17570] ? __pfx____sys_sendmsg+0x10/0x10 [ 1322.687691][T17570] ? __fget_files+0x2a/0x420 [ 1322.687712][T17570] ? __fget_files+0x3a0/0x420 [ 1322.687741][T17570] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1322.687768][T17570] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1322.687801][T17570] ? __pfx_ksys_write+0x10/0x10 [ 1322.687833][T17570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.687852][T17570] do_syscall_64+0x15f/0xf80 [ 1322.687873][T17570] ? trace_irq_disable+0x3b/0x140 [ 1322.687891][T17570] ? clear_bhb_loop+0x40/0x90 [ 1322.687912][T17570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1322.687932][T17570] RIP: 0033:0x7feb5b79c819 [ 1322.687950][T17570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1322.687966][T17570] RSP: 002b:00007feb5c5f3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1322.687987][T17570] RAX: ffffffffffffffda RBX: 00007feb5ba15fa0 RCX: 00007feb5b79c819 [ 1322.688001][T17570] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1322.688014][T17570] RBP: 00007feb5c5f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1322.688025][T17570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1322.688037][T17570] R13: 00007feb5ba16038 R14: 00007feb5ba15fa0 R15: 00007ffe905ccca8 [ 1322.688074][T17570] [ 1322.902269][T17576] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 1322.911108][T17576] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1323.618441][T17620] FAULT_INJECTION: forcing a failure. [ 1323.618441][T17620] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1323.645168][T17620] CPU: 1 UID: 0 PID: 17620 Comm: syz.0.16705 Not tainted syzkaller #0 PREEMPT(full) [ 1323.645197][T17620] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1323.645209][T17620] Call Trace: [ 1323.645216][T17620] [ 1323.645225][T17620] dump_stack_lvl+0xe8/0x150 [ 1323.645257][T17620] should_fail_ex+0x412/0x560 [ 1323.645287][T17620] _copy_to_user+0x31/0xb0 [ 1323.645309][T17620] simple_read_from_buffer+0xe1/0x170 [ 1323.645337][T17620] proc_fail_nth_read+0x1bb/0x230 [ 1323.645368][T17620] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1323.645395][T17620] ? rw_verify_area+0x2a6/0x4d0 [ 1323.645419][T17620] ? tun_chr_write_iter+0xe0/0x200 [ 1323.645438][T17620] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1323.645463][T17620] vfs_read+0x20c/0xa70 [ 1323.645494][T17620] ? __pfx___mutex_lock+0x10/0x10 [ 1323.645517][T17620] ? __pfx_vfs_read+0x10/0x10 [ 1323.645543][T17620] ? __fget_files+0x2a/0x420 [ 1323.645569][T17620] ? __fget_files+0x3a0/0x420 [ 1323.645589][T17620] ? __fget_files+0x2a/0x420 [ 1323.645619][T17620] ksys_read+0x150/0x270 [ 1323.645647][T17620] ? __pfx_ksys_read+0x10/0x10 [ 1323.645668][T17620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1323.645696][T17620] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1323.645716][T17620] do_syscall_64+0x15f/0xf80 [ 1323.645736][T17620] ? trace_irq_disable+0x3b/0x140 [ 1323.645755][T17620] ? clear_bhb_loop+0x40/0x90 [ 1323.645778][T17620] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1323.645796][T17620] RIP: 0033:0x7fae6e15d04e [ 1323.645814][T17620] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1323.645829][T17620] RSP: 002b:00007fae6f008fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1323.645850][T17620] RAX: ffffffffffffffda RBX: 00007fae6f0096c0 RCX: 00007fae6e15d04e [ 1323.645863][T17620] RDX: 000000000000000f RSI: 00007fae6f0090a0 RDI: 0000000000000006 [ 1323.645882][T17620] RBP: 00007fae6f009090 R08: 0000000000000000 R09: 0000000000000000 [ 1323.645893][T17620] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1323.645904][T17620] R13: 00007fae6e416218 R14: 00007fae6e416180 R15: 00007ffc2ca11578 [ 1323.645935][T17620] [ 1324.244492][T21604] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 19999 - 0 [ 1324.268585][T21604] netdevsim netdevsim4 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1324.286610][T21604] netdevsim netdevsim4 eth0: unset [1, 2] type 2 family 0 port 40872 - 0 [ 1324.311758][T21604] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 19999 - 0 [ 1324.321338][T21604] netdevsim netdevsim4 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1324.331471][T21604] netdevsim netdevsim4 eth1: unset [1, 2] type 2 family 0 port 40872 - 0 [ 1324.357856][T21604] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 19999 - 0 [ 1324.383313][T21604] netdevsim netdevsim4 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1324.413709][T17636] __nla_validate_parse: 9 callbacks suppressed [ 1324.413727][T17636] netlink: 16 bytes leftover after parsing attributes in process `syz.1.16707'. [ 1324.430460][T21604] netdevsim netdevsim4 eth2: unset [1, 2] type 2 family 0 port 40872 - 0 [ 1324.615219][T17651] netlink: 48 bytes leftover after parsing attributes in process `syz.2.16712'. [ 1324.710247][T21604] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 19999 - 0 [ 1324.731972][T21604] netdevsim netdevsim4 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 1324.743068][T21604] netdevsim netdevsim4 eth3: unset [1, 2] type 2 family 0 port 40872 - 0 [ 1325.032215][T17679] netlink: 156 bytes leftover after parsing attributes in process `syz.0.16720'. [ 1325.044871][T17679] validate_nla: 1 callbacks suppressed [ 1325.044891][T17679] netlink: 'syz.0.16720': attribute type 9 has an invalid length. [ 1325.059688][T17679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16720'. [ 1325.069530][T17679] netlink: 'syz.0.16720': attribute type 9 has an invalid length. [ 1325.079159][T17679] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16720'. [ 1325.106560][T17681] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16721'. [ 1325.154522][T17686] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16723'. [ 1325.411035][T17695] nbd0: detected capacity change from 0 to 63 [ 1325.420317][ T5822] block nbd0: Receive control failed (result -104) [ 1325.449423][T17705] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16730'. [ 1325.460724][T17705] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16730'. [ 1325.613260][T17716] vcan0: entered promiscuous mode [ 1325.618941][T17716] vcan0: entered allmulticast mode [ 1325.705596][T17718] netlink: 36 bytes leftover after parsing attributes in process `syz.4.16736'. [ 1325.731204][T17716] vcan0: entered promiscuous mode [ 1325.750292][T17716] vcan0: entered allmulticast mode [ 1325.859786][T17716] vcan0: entered promiscuous mode [ 1325.880250][T17716] vcan0: entered allmulticast mode [ 1325.979621][T17716] vcan0: entered promiscuous mode [ 1326.008180][T17716] vcan0: entered allmulticast mode [ 1326.122253][T17742] FAULT_INJECTION: forcing a failure. [ 1326.122253][T17742] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1326.159568][T17742] CPU: 0 UID: 0 PID: 17742 Comm: syz.4.16746 Not tainted syzkaller #0 PREEMPT(full) [ 1326.159595][T17742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1326.159607][T17742] Call Trace: [ 1326.159614][T17742] [ 1326.159623][T17742] dump_stack_lvl+0xe8/0x150 [ 1326.159655][T17742] should_fail_ex+0x412/0x560 [ 1326.159683][T17742] _copy_from_user+0x2d/0xb0 [ 1326.159703][T17742] dev_ethtool+0xcf/0x1ae0 [ 1326.159727][T17742] ? inet_ioctl+0x484/0x560 [ 1326.159750][T17742] ? __pfx_dev_ethtool+0x10/0x10 [ 1326.159775][T17742] ? dev_load+0x21/0x1f0 [ 1326.159804][T17742] ? dev_load+0x21/0x1f0 [ 1326.159827][T17742] ? dev_load+0x21/0x1f0 [ 1326.159850][T17742] dev_ioctl+0x392/0x1150 [ 1326.159876][T17742] sock_do_ioctl+0x23e/0x320 [ 1326.159900][T17742] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1326.159918][T17742] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1326.160030][T17742] sock_ioctl+0x5c6/0x7f0 [ 1326.160055][T17742] ? __pfx_sock_ioctl+0x10/0x10 [ 1326.160076][T17742] ? __fget_files+0x2a/0x420 [ 1326.160097][T17742] ? __fget_files+0x3a0/0x420 [ 1326.160117][T17742] ? __fget_files+0x2a/0x420 [ 1326.160142][T17742] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1326.160161][T17742] ? __pfx_sock_ioctl+0x10/0x10 [ 1326.160178][T17742] __se_sys_ioctl+0xfc/0x170 [ 1326.160194][T17742] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1326.160216][T17742] do_syscall_64+0x15f/0xf80 [ 1326.160237][T17742] ? trace_irq_disable+0x3b/0x140 [ 1326.160257][T17742] ? clear_bhb_loop+0x40/0x90 [ 1326.160281][T17742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1326.160300][T17742] RIP: 0033:0x7fc2f5f9c819 [ 1326.160322][T17742] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1326.160338][T17742] RSP: 002b:00007fc2f6eaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1326.160361][T17742] RAX: ffffffffffffffda RBX: 00007fc2f6215fa0 RCX: 00007fc2f5f9c819 [ 1326.160375][T17742] RDX: 0000200000000000 RSI: 0000000000008946 RDI: 0000000000000003 [ 1326.160387][T17742] RBP: 00007fc2f6eaa090 R08: 0000000000000000 R09: 0000000000000000 [ 1326.160399][T17742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1326.160411][T17742] R13: 00007fc2f6216038 R14: 00007fc2f6215fa0 R15: 00007fff5b06f558 [ 1326.160443][T17742] [ 1326.457424][T17739] xt_CT: No such helper "pptp" [ 1326.601819][T17752] [ 1326.604195][T17752] ====================================================== [ 1326.611514][T17752] WARNING: possible circular locking dependency detected [ 1326.619263][T17752] syzkaller #0 Not tainted [ 1326.624033][T17752] ------------------------------------------------------ [ 1326.631573][T17752] syz.4.16749/17752 is trying to acquire lock: [ 1326.637903][T17752] ffffffff8ff4be18 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 1326.647227][T17752] [ 1326.647227][T17752] but task is already holding lock: [ 1326.654618][T17752] ffff888067c0b470 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 1326.664048][T17752] [ 1326.664048][T17752] which lock already depends on the new lock. [ 1326.664048][T17752] [ 1326.674645][T17752] [ 1326.674645][T17752] the existing dependency chain (in reverse order) is: [ 1326.683650][T17752] [ 1326.683650][T17752] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 1326.691733][T17752] _raw_spin_lock_bh+0x36/0x50 [ 1326.697105][T17752] nr_rt_device_down+0x153/0x860 [ 1326.702649][T17752] nr_device_event+0x137/0x150 [ 1326.708034][T17752] notifier_call_chain+0x1ad/0x3d0 [ 1326.713684][T17752] __dev_notify_flags+0x16d/0x310 [ 1326.719506][T17752] netif_change_flags+0xe8/0x1a0 [ 1326.725169][T17752] dev_change_flags+0x130/0x260 [ 1326.730545][T17752] dev_ioctl+0x7b4/0x1150 [ 1326.736000][T17752] sock_do_ioctl+0x23e/0x320 [ 1326.741244][T17752] sock_ioctl+0x5c6/0x7f0 [ 1326.746106][T17752] __se_sys_ioctl+0xfc/0x170 [ 1326.751403][T17752] do_syscall_64+0x15f/0xf80 [ 1326.756543][T17752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1326.762954][T17752] [ 1326.762954][T17752] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 1326.771047][T17752] _raw_spin_lock_bh+0x36/0x50 [ 1326.776418][T17752] nr_rt_device_down+0xbe/0x860 [ 1326.781789][T17752] nr_device_event+0x137/0x150 [ 1326.787096][T17752] notifier_call_chain+0x1ad/0x3d0 [ 1326.792845][T17752] __dev_notify_flags+0x16d/0x310 [ 1326.798582][T17752] netif_change_flags+0xe8/0x1a0 [ 1326.804328][T17752] dev_change_flags+0x130/0x260 [ 1326.809801][T17752] dev_ioctl+0x7b4/0x1150 [ 1326.814665][T17752] sock_do_ioctl+0x23e/0x320 [ 1326.819940][T17752] sock_ioctl+0x5c6/0x7f0 [ 1326.824965][T17752] __se_sys_ioctl+0xfc/0x170 [ 1326.830805][T17752] do_syscall_64+0x15f/0xf80 [ 1326.836451][T17752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1326.843056][T17752] [ 1326.843056][T17752] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 1326.850970][T17752] __lock_acquire+0x15a5/0x2cf0 [ 1326.856373][T17752] lock_acquire+0x106/0x350 [ 1326.861589][T17752] _raw_spin_lock_bh+0x36/0x50 [ 1326.866869][T17752] nr_remove_neigh+0x25/0xe0 [ 1326.872008][T17752] nr_add_node+0x1e41/0x2630 [ 1326.877339][T17752] nr_rt_ioctl+0xe59/0xf90 [ 1326.882315][T17752] sock_do_ioctl+0x101/0x320 [ 1326.887438][T17752] sock_ioctl+0x5c6/0x7f0 [ 1326.892291][T17752] __se_sys_ioctl+0xfc/0x170 [ 1326.897438][T17752] do_syscall_64+0x15f/0xf80 [ 1326.902555][T17752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1326.908965][T17752] [ 1326.908965][T17752] other info that might help us debug this: [ 1326.908965][T17752] [ 1326.919458][T17752] Chain exists of: [ 1326.919458][T17752] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 1326.919458][T17752] [ 1326.933280][T17752] Possible unsafe locking scenario: [ 1326.933280][T17752] [ 1326.940731][T17752] CPU0 CPU1 [ 1326.946091][T17752] ---- ---- [ 1326.951533][T17752] lock(&nr_node->node_lock); [ 1326.956300][T17752] lock(nr_node_list_lock); [ 1326.963400][T17752] lock(&nr_node->node_lock); [ 1326.970676][T17752] lock(nr_neigh_list_lock); [ 1326.975363][T17752] [ 1326.975363][T17752] *** DEADLOCK *** [ 1326.975363][T17752] [ 1326.983500][T17752] 1 lock held by syz.4.16749/17752: [ 1326.988751][T17752] #0: ffff888067c0b470 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 1326.998610][T17752] [ 1326.998610][T17752] stack backtrace: [ 1327.004503][T17752] CPU: 1 UID: 0 PID: 17752 Comm: syz.4.16749 Not tainted syzkaller #0 PREEMPT(full) [ 1327.004523][T17752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1327.004533][T17752] Call Trace: [ 1327.004543][T17752] [ 1327.004551][T17752] dump_stack_lvl+0xe8/0x150 [ 1327.004575][T17752] print_circular_bug+0x2e1/0x300 [ 1327.004601][T17752] check_noncircular+0x12e/0x150 [ 1327.004626][T17752] __lock_acquire+0x15a5/0x2cf0 [ 1327.004652][T17752] ? __lock_acquire+0x6b5/0x2cf0 [ 1327.004671][T17752] ? nr_remove_neigh+0x25/0xe0 [ 1327.004691][T17752] lock_acquire+0x106/0x350 [ 1327.004709][T17752] ? nr_remove_neigh+0x25/0xe0 [ 1327.004731][T17752] ? do_raw_spin_lock+0x12b/0x2f0 [ 1327.004747][T17752] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1327.004767][T17752] ? nr_remove_neigh+0x25/0xe0 [ 1327.004787][T17752] _raw_spin_lock_bh+0x36/0x50 [ 1327.004803][T17752] ? nr_remove_neigh+0x25/0xe0 [ 1327.004823][T17752] nr_remove_neigh+0x25/0xe0 [ 1327.004845][T17752] nr_add_node+0x1e41/0x2630 [ 1327.004868][T17752] ? nr_call_to_digi+0x126/0x1b0 [ 1327.004888][T17752] nr_rt_ioctl+0xe59/0xf90 [ 1327.004911][T17752] ? kasan_quarantine_put+0xbb/0x1f0 [ 1327.004933][T17752] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 1327.004957][T17752] ? apparmor_capable+0x126/0x170 [ 1327.004975][T17752] ? capable+0x88/0xe0 [ 1327.004994][T17752] ? nr_ioctl+0x1b1/0x3b0 [ 1327.005012][T17752] sock_do_ioctl+0x101/0x320 [ 1327.005031][T17752] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1327.005046][T17752] ? do_futex+0x333/0x420 [ 1327.005072][T17752] sock_ioctl+0x5c6/0x7f0 [ 1327.005089][T17752] ? __pfx_sock_ioctl+0x10/0x10 [ 1327.005104][T17752] ? __fget_files+0x2a/0x420 [ 1327.005122][T17752] ? __fget_files+0x3a0/0x420 [ 1327.005139][T17752] ? __fget_files+0x2a/0x420 [ 1327.005158][T17752] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1327.005174][T17752] ? __pfx_sock_ioctl+0x10/0x10 [ 1327.005189][T17752] __se_sys_ioctl+0xfc/0x170 [ 1327.005203][T17752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.005219][T17752] do_syscall_64+0x15f/0xf80 [ 1327.005236][T17752] ? trace_irq_disable+0x3b/0x140 [ 1327.005252][T17752] ? clear_bhb_loop+0x40/0x90 [ 1327.005269][T17752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1327.005284][T17752] RIP: 0033:0x7fc2f5f9c819 [ 1327.005299][T17752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1327.005314][T17752] RSP: 002b:00007fc2f6eaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1327.005330][T17752] RAX: ffffffffffffffda RBX: 00007fc2f6215fa0 RCX: 00007fc2f5f9c819 [ 1327.005341][T17752] RDX: 0000200000000080 RSI: 000000000000890b RDI: 0000000000000005 [ 1327.005352][T17752] RBP: 00007fc2f6032c91 R08: 0000000000000000 R09: 0000000000000000 [ 1327.005361][T17752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1327.005371][T17752] R13: 00007fc2f6216038 R14: 00007fc2f6215fa0 R15: 00007fff5b06f558 [ 1327.005389][T17752] [ 1327.340430][T17759] syzkaller0: entered promiscuous mode [ 1327.346099][T17759] syzkaller0: entered allmulticast mode