last executing test programs: 2.614594907s ago: executing program 0 (id=9923): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000000000050000001f0800040001000000", 0x24) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b000000000000000000000000000400000008"], 0x50) 2.429099648s ago: executing program 3 (id=9924): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x70bd28, 0x25dfdbfc, {0x2, 0x20, 0x1, 0xc8, r2}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x40000c0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r3, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x58, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_OKEY={0x8, 0x5, 0x8c}, @IFLA_GRE_LOCAL={0x14, 0x6, @private1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x58}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), 0xffffffffffffffff) r6 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(r6, 0x111, 0x3, 0x20000008, 0x4) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f0000000100)={0xfa, 0x3, 0xb30, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{0x1, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)}, 0x20) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x1b, &(0x7f0000000440)=@raw=[@map_val={0x18, 0x8, 0x2, 0x0, r7, 0x0, 0x0, 0x0, 0x101}, @ldst={0x0, 0x2, 0x4, 0x2, 0x8, 0xfffffffffffffffe, 0x3}, @map_val={0x18, 0x4, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1ff}, @ldst={0x0, 0x0, 0x2, 0x7, 0x5, 0x1, 0x10}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @generic={0xc, 0xc, 0xd, 0x101, 0xffff}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x80000001}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2}], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x0, 0x2107, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{}, &(0x7f0000000340), &(0x7f0000000380)}, 0x20) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r1, 0x89fb, &(0x7f0000000680)={'sit0\x00', &(0x7f00000005c0)={@mcast1, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xb, 0x15}}) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000240)={0x0, 0xfffffffffffffcfe, &(0x7f0000000200)={&(0x7f0000000000)={0x20, r5, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000845}, 0x4000004) 2.315810105s ago: executing program 2 (id=9926): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7020000c3000000bf230000000000002703000000fefeff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400011000000404000001007d60b7030000000000006a0a00fe800000008500000026000000b7000000000000009500001000000000acaa8e53a53cb864c300094c07000000000000d94cf0987b00a749a8e53b5c9491cd1f2b94a64f1de23d03a8f0362ebfc44c77511e60070e25510070f7778d3e77ad85319f0113abbac795f8c24abca246150226eb93fe39233add8f68f87699162334343befce832cb8075c5f0ae30cde221371ff00000067e4b75da95370ae6fd2b99ac18f98403494d4a94e95fb8dcd813487b2bdb006c6465c15f04485a9f8c8e49d00000097184c8e9d34b1e382b25e9614634e8e09194f7b83138f5275d9ab463797a2f6dcb45d5f278cd4fb74559575da3560c01cdf1eaa3fc72a694efc62f9ef9c8c0ea1efa5b949ce22827f6fd1dfc69d03482d8ec20bc22573f8594b91781cd8ff7f000000000000299ebf94588e60abe9a565c5bbdc0358226f8580dc1a83c6a44408de23475a74ef0deda8da4089269ccb4e728dee6320444576c87cc576291e5367a5f1a5d5a12f8313ffff0b7f73335279aa2b68c9f045831119881764c71bb65b5138c50e06024e80fd9656bc077e4e259695748989335ba9eeef288de73815f20fefd4acfb6813ffff00000b971aec1a3e618a08a94ecbd401c8109c87ee3f5c0501857538d2a766bfcf4128fbe726903aca577aa8943af747760718dee5a21396dce6f61c6f3c7e000000cb0868b48719e47296f2299df3ecfb5f3f0e42f6f1eb1dc64dcc8e397366d12033f6288edbda3b838100000000000000000000800000edd4e1266dc9d73223fe614f025a7f284de76b3b676a13c57a0ed24f6270c4cbbf93472eb8093d8296c68dfbb03ddedc3e029b08959b145a7b110068ba071e75d75716243052ad24b624fddc2f0f3a018c0085c2319c248d643cd09fa855b20a6d453f2e954ff0e55c010000008547c5a0ecefcc44cc9532f729167f215937357a4bb9746193c1ec000000000000dd43c108c2109d221b7b26b7c9c209000005b7918a6cd856b8fa806c85480443159c6bed51a0e021f05f7caa1b99cdb4d08d9031210ac00e67d8c40a18503cb7aabcc066dfbfd7f87abe1122f00e5454bec3563a19582e0000000000000000000000000084b27fc6a3f95bf02b4eb5f1599dd46edcad432cc216316fe07afe27649c89cf022a90d895a2d70fcde7a9c37ede0c47c27f44595ab4b1fb1ed5b1d91314b2d50f94a768fb605679485041a6376b8344a39af68aed2be39794dd86ae82f9660cf4f935255d71f9fab2e430ac42bba1f54141cf39d4d50c4ded504beacb0de210d7a3716dca7362c134b91cef3efc514fbcb4747e6814ac16449ac02a43d9d4151697b4b7890ec6b481c5f0ca8c52a6322f34a796fa5941d23409ecf73458223baaffb94a89ee2884df000000000000009370d8dacf8b3ff404971100"/1111], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x36}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r1, 0x40000f0, 0xe40, 0xffffffff, &(0x7f0000000280)="7b5515ccc8bca12641e65d58fd1a12f639", 0x0, 0x71e}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r2, 0x26, 0x0, @void}, 0x10) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r0, r2, 0x26, 0x0, @void}, 0x10) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000440)={r0, r2, 0x5, 0x0, @val=@tracing={0x0, 0xfff}}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="b400000000000000dd0a00000000000073016200000000009500000000000000a6692aae1a43fa0bf68bbf0c19b1e9020b3ed65b5d9fdfc2ca5fe8966d8b6e8212a5c72a2c32d3e821d446355e043be398137c9733d3925e4280e1224bd05ba6f04f93f5ac29bc54caed1fc7f417b74304197b062f10950ce043bf3bddf4d824304dbe407b281b030f592f85bc23d29dd493b9003386"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000)={0xa}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 2.261150139s ago: executing program 0 (id=9927): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0x503, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6230}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_CREATE_SOCKETS={0x5, 0x5, 0x1}, @IFLA_GTP_RESTART_COUNT={0x5, 0x6, 0x4}]}}}, @IFLA_ADDRESS={0xa, 0x3, @random="3a712f0756b8"}]}, 0x4c}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="00000300000000020000000000", @ANYRES32=0x0, @ANYRES32], 0x48) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000100)=0x9, 0x4) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000500)={r1, &(0x7f0000000400)='netdevsim0\x00', 0x22200, &(0x7f0000000440)={@_ha_fsid={[0xfffffc01, 0x5]}, {0x4, 0x7, 0x9, 0x9}}, 0x10, &(0x7f0000000480), &(0x7f00000004c0)=0x10}) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000540)={0x8, 0x3, 0x9, 0x1b, 0x9, 0xb, 0xff, 0xcb, 0x2, 0x0, 0x4, 0x8, 0xff, 0x1}, 0xe) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_SIOCSIFBR(r4, 0x8941, &(0x7f0000002180)=@get={0x1, &(0x7f0000001180)=""/4096, 0x9}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_coalesce={0xe, 0x3, 0x4, 0x4, 0x2, 0x1, 0x2a9, 0x8a10, 0x0, 0x2, 0x8, 0xfffffffa, 0x8, 0x800, 0x8, 0xc, 0x4, 0x9, 0x3, 0x8, 0x101, 0x5, 0x1}}) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="900000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="adffa88800000000600012800b0001006772657461700000500002800800140006000000050016000200000006000e0000000000060018000400000004001200050013"], 0x90}, 0x1, 0x0, 0x0, 0x4001050}, 0x40408c4) getsockopt$IP_SET_OP_VERSION(r3, 0x1, 0x53, &(0x7f0000000340), &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000300)={0x1, [0x0]}, &(0x7f00000002c0)=0x8) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000003c0)=@ccm_128={{0x304}, "d3b1d43f94fb17e0", "09ae6ded8956e09ef7f78fb19dc691e7", "3b693dc2", "fb6bc7b4f357b4e5"}, 0x28) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000001c0)=ANY=[@ANYRES32=r8, @ANYBLOB="e9e66f27918f39271040259424029b0b0ca36624325baba33f2c569b9ea1e1bd26aa14a3f38bea759516f0cc227ff1420abaed71a32d8fc595caa6deb3ff547c3d6faac590310b4c19fa71b84da02925b2cc6399c92c7927760a4f65d5c0eab6b6148f79b631bc1b7eb2a760b700a2405bd81e9e6ec7b1afcfa6cf710f295f"], 0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000580)={r7, @in={{0x2, 0x4e23, @remote}}}, &(0x7f0000000640)=0x84) sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0xfffffe7b, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20040004}, 0x84) 2.158791333s ago: executing program 2 (id=9928): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014004000000035c1f61c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cee0090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6cc", 0xd8}], 0x1, 0x0, 0x0, 0x7c}, 0x0) 1.344813443s ago: executing program 1 (id=9930): socket$kcm(0x10, 0x2, 0x0) (async) socket$igmp(0x2, 0x3, 0x2) (async) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket(0x10, 0x3, 0x0) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x4c, 0x0, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r3, &(0x7f0000000380)="0099", &(0x7f0000000480)=@udp6=r2, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) 1.341462254s ago: executing program 4 (id=9931): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8}, 0x48) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r1, 0x0, 0xd1, &(0x7f0000000000)=0x3, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="fae77c2efde412fe4772cbc52100000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={r2, &(0x7f0000000300)='M', &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r2, &(0x7f00000001c0)='M', 0x0}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32, @ANYBLOB="800066180a000200aaaaaaaaaa0c"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001e000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00'], 0x28}, 0x1, 0x0, 0x0, 0x20000001}, 0x40040) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0xfffffff8, 0x0, r0}, 0x48) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f00000000c0)={'veth0_to_batadv\x00', 0x1}) 1.261147267s ago: executing program 0 (id=9932): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2a, &(0x7f00000000c0)=0x7a, 0x30) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x9, [@volatile={0x9, 0x0, 0x0, 0x9, 0x2000004}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}, @func={0x7}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x45, 0x0, 0x0, 0x10000}, 0x28) r2 = socket$alg(0x26, 0x5, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000003c0007010000000000000000010900001c1b355d7f6f4621cb7876f2dc554beeb1a9215bdb357bde305fa6f7f717edddff028289b1e1022a1916ae727245adaecb14e9e75b"], 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='blkio.bfq.dequeue\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002042, &(0x7f0000000740)={0x77359400}) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r4 = accept4(r2, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f00000001c0)=ANY=[@ANYRES16=r4, @ANYRES16=r2, @ANYRESHEX=r2, @ANYRESOCT=r1, @ANYRES16=r1], 0x12f4}}, 0x0) recvmsg$can_raw(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/234, 0xea}, {&(0x7f0000000a80)=""/133, 0x85}], 0x2}, 0x200) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4020000000000007911000000000000850000006b0000009500000000000000359bb9f4ffffb136000440c89844f3cec063027b45b1bf3fa2cef4363021028e2b63040fcfd3a9b59fed6aa4172c30b77f38d6daaed700"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000300)=""/197, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000002c0), 0xffffffffffffff35}, 0x54) close(r0) socket$inet(0x2, 0x4000000000000001, 0x0) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x2a, &(0x7f00000000c0)=0x7a, 0x30) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x9, [@volatile={0x9, 0x0, 0x0, 0x9, 0x2000004}, @volatile={0x0, 0x0, 0x0, 0x9, 0x3}, @func={0x7}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x45, 0x0, 0x0, 0x10000}, 0x28) (async) socket$alg(0x26, 0x5, 0x0) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000003c0007010000000000000000010900001c1b355d7f6f4621cb7876f2dc554beeb1a9215bdb357bde305fa6f7f717edddff028289b1e1022a1916ae727245adaecb14e9e75b"], 0x14}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='blkio.bfq.dequeue\x00', 0x275a, 0x0) (async) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002042, &(0x7f0000000740)={0x77359400}) (async) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) (async) accept4(r2, 0x0, 0x0, 0x0) (async) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f00000001c0)=ANY=[@ANYRES16=r4, @ANYRES16=r2, @ANYRESHEX=r2, @ANYRESOCT=r1, @ANYRES16=r1], 0x12f4}}, 0x0) (async) recvmsg$can_raw(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000880)=""/234, 0xea}, {&(0x7f0000000a80)=""/133, 0x85}], 0x2}, 0x200) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4020000000000007911000000000000850000006b0000009500000000000000359bb9f4ffffb136000440c89844f3cec063027b45b1bf3fa2cef4363021028e2b63040fcfd3a9b59fed6aa4172c30b77f38d6daaed700"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000300)=""/197, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000002c0), 0xffffffffffffff35}, 0x54) (async) close(r0) (async) 1.260230972s ago: executing program 2 (id=9933): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x37}], {0x95, 0x0, 0x700}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, r3, 0x20, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x14, 0x13, @l2={'ib', 0x3a, 'ip6erspan0\x00'}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x1f8, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe8}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x2, 0xffffffff}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x9}, 0x0, 0x0, 0xf, 0x6, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}}, {}, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 'wlan1\x00', 'netpci0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="24e42909e863", @empty, @dev={0xac, 0x14, 0x14, 0x18}, @empty, 0x18}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0xffffffffffffff17, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x4801c}, 0x20040840) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x37}], {0x95, 0x0, 0x700}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) (async) socket$igmp(0x2, 0x3, 0x2) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000480), 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, r3, 0x20, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x14, 0x13, @l2={'ib', 0x3a, 'ip6erspan0\x00'}}}, ["", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000) (async) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x1f8, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe8}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x2, 0xffffffff}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x9}, 0x0, 0x0, 0xf, 0x6, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}}, {}, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 'wlan1\x00', 'netpci0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="24e42909e863", @empty, @dev={0xac, 0x14, 0x14, 0x18}, @empty, 0x18}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0xffffffffffffff17, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x4801c}, 0x20040840) (async) 1.239495297s ago: executing program 3 (id=9934): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000002030500000000000000000000000000080001000100000b09000200172c126102000000a4b665b0ab1196a7c3dea47bafddefdb409b72b262cc4b04aa9dfe3e372cb38553e7ed09e8cfa735f1b849f41a0bbb3651a1de39f6d562"], 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000001400030540008000ffdbdf250218e4ff", @ANYRES32, @ANYBLOB="080002"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x20008840) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000000000000100001302000000030000000000000000000000e3ffffff97974e219a1bc847941594b057889c9f87889ce12fad11a0cc6f4de26304dbb9ea68607767f19d47be0706f56790ae3618b2bc88d2b7cdb418052fc010cbdcbf16eed40f8783e9c3fad0b8403eba828945359a65ae17085dd092725ede1d119d700f92c968a3d2e1b3019bed9c633a0bf87324e44ce4c84f1eeef04551eb6628f1ee48ef79afb0974eeeac83bf749bbc5e242f91143cd470f0"], 0x0, 0x34}, 0x20) 1.160993833s ago: executing program 1 (id=9935): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000000000)=@raw=[@call={0x85, 0x0, 0x0, 0xb9}, @exit], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x51}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="b4050000200080066110480000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498909714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442e05d9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002add8b8ed61d995c1258ea2c22e218f2122a75d10d77aa735e3aa4988bc267d698cc01e56f8ed8b7877f8d217269ab71a634fed1261c399b31bc3f89f6d76816b9e08bed85b33c7cf8527b20ec14f462dad0e1cb64d49d4fa180e0cb32d9f84ffdb28286a810c1d10fdb67ee5148f8c21ddc16c9417570fb3b8c949a940967d71f6441c5f6dbd7fba76ec0bc54575ffea4ac586994450612a3b1080365753cd59300858929c24d40c4f5e6cde531a3be5fb86a50a77187aa095fdd8b3f959b4e47b2053cfafc22ca"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 1.135404639s ago: executing program 4 (id=9936): socket$inet6_sctp(0xa, 0x5, 0x84) (async) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x5, 0xf0}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0x11, @loopback, 0x15, 0x0, 'wlc\x00', 0x39, 0x6, 0x1f}, 0x2c) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x14, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) (async) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x14, @dev={0xac, 0x14, 0x14, 0x16}}, 0x10) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x2, 0xd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x50}}, 0x0) (async) sendmsg$key(r3, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)={0x2, 0xd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}]}, 0x50}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xc09, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="cc0000002100010027bd7000fefffffffc020000000000000000000000000000fc020000000000000000000000000001dffc0000000000000a00e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="020000000000000050001100fe800000000000000000000000000011ac1414aa000000000000000000000000ac1414aa000000000000000000000000fe8000000000000000000000000000bb3c000000000000000a000a002c0013"], 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x0) r6 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r6, &(0x7f0000003480)=[{{&(0x7f0000000640)={0xa, 0x0, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000680)=[@flowinfo={{0x14, 0x29, 0xb, 0x1}}, @flowinfo={{0x14, 0x29, 0xb, 0x20000000}}], 0x30}}], 0x1, 0x0) (async) sendmmsg$inet6(r6, &(0x7f0000003480)=[{{&(0x7f0000000640)={0xa, 0x0, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000680)=[@flowinfo={{0x14, 0x29, 0xb, 0x1}}, @flowinfo={{0x14, 0x29, 0xb, 0x20000000}}], 0x30}}], 0x1, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000200)={'wlan0\x00', {0x2, 0x4e21, @empty}}) (async) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000200)={'wlan0\x00', {0x2, 0x4e21, @empty}}) shutdown(r1, 0x1) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r1, &(0x7f0000000100)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x2, 0x7, 0x801, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x2d9747a0b9b95caf}, 0x4000) 1.021669095s ago: executing program 2 (id=9937): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'wlan0\x00', 0x4132}) (async) r1 = socket$packet(0x11, 0x3, 0x300) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000200)={r5}, &(0x7f0000000080)=0x8) (async) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000100)={0x1d, r7, 0x0, {}, 0xff}, 0x18) (async) sendmsg$can_j1939(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x800) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) (async) ioctl$TUNSETQUEUE(r0, 0x400454d9, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'vlan0\x00'}) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r8, @ANYRES32=r1], 0x20}}, 0x0) 973.209693ms ago: executing program 0 (id=9938): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000007c0)={0x0, 0x8, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000780)=0x10) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x24000000, &(0x7f0000000400)={0xa, 0x4e22, 0x0, @empty, 0xa}, 0x1c) 970.804756ms ago: executing program 3 (id=9939): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x18, 0x3, &(0x7f00000013c0)=@framed, &(0x7f0000001400)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$OBJ_PIN_PROG(0x11, &(0x7f0000000240)=@o_path={0x0, r1}, 0x18) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000fffddbdf25017c0000"], 0x14}, 0x1, 0x0, 0x0, 0x48815}, 0x20084880) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000440)={0x4, 0x1}, 0x4) sendmsg$NFQNL_MSG_CONFIG(r3, 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000400)={r1, &(0x7f00000002c0)='()X\x00', 0x440801, &(0x7f0000000340)={@align=0x4, {0x5c40, 0x5, 0xfffffffb, 0x5}}, 0x0, &(0x7f0000000380)={@_ha_fsid}, &(0x7f00000003c0)=0x7}) sendto$rxrpc(r4, 0x0, 0x0, 0x8010, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_devices(r5, &(0x7f0000000040)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f0000000100)={'a', ' *:* ', 'rw\x00'}, 0x9) recvmsg$unix(0xffffffffffffffff, 0x0, 0x80032002) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) socketpair$tipc(0x1e, 0x2, 0x0, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(0xffffffffffffffff, 0x110, 0x3) r7 = socket(0x2, 0x2, 0x1) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'veth1_virt_wifi\x00'}) sendmsg$AUDIT_TTY_SET(r7, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x18, 0x3f9, 0x400, 0x70bd27, 0x25dfdbfc, {0x1}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x84}, 0x40000) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r2, 0x200, 0x70bd25, 0x25dfdbfe, {{}, {}, {0x14, 0x19, {0x0, 0x5, 0x7, 0xff}}}, ["", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20008000}, 0x40) 970.204722ms ago: executing program 1 (id=9940): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket(0x15, 0x5, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, 0x0) getsockopt(r1, 0x200000000114, 0x2714, 0x0, &(0x7f0000000040)) bind$inet6(r1, 0x0, 0x0) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x3, &(0x7f00000001c0)=""/207, &(0x7f0000000000)=0x18) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'netdevsim0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001180), 0xffffffffffffffff) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_STATION(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)={0x2c, r8, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_WME={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x4004014) sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f0000001280)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000001240)={&(0x7f00000011c0)={0x58, r5, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0xe, 0x41}}}}, [@NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x7}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x17}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x1ff}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0xfffa}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x9}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x200040c1}, 0x1) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x54, '\x00', 0x2, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r11, 0xa17, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4800}, 0xc114) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000003c0)=@nat={'nat\x00', 0x670, 0x2, 0x328, 0x140, 0xa8, 0xfeffffff, 0x140, 0x1e8, 0x290, 0x290, 0xffffffff, 0x290, 0x290, 0x5, 0x0, {[{{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x6800, {0x0, @multicast2, @rand_addr, @port, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0x98, 0x0, {0x0, 0x7}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xa8}}, {{@uncond, 0x0, 0x70, 0xa8}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x0, @rand_addr, @local}}}}, {{@ip={@multicast2, @multicast1, 0x0, 0x0, 'veth1_virt_wifi\x00', 'pim6reg0\x00'}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @initdev={0xac, 0x1e, 0xfd, 0x0}, @multicast2, @port, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x388) r12 = socket$inet6(0xa, 0x805, 0x0) r13 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r13, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000001140)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r13, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r12, 0x84, 0x6f, &(0x7f0000000080)={r14, 0x0, 0x0}, 0x0) getsockopt$bt_hci(r12, 0x84, 0x85, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/4096, &(0x7f0000001000)=0x1000) 953.46679ms ago: executing program 4 (id=9941): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket(0x18, 0x0, 0x0) (async) r1 = socket(0x18, 0x0, 0x0) close(r1) (async) close(r1) socket$can_j1939(0x1d, 0x2, 0x7) getsockname$packet(r1, 0x0, &(0x7f0000000080)) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet(0x2, 0x3, 0x7f) (async) r4 = socket$inet(0x2, 0x3, 0x7f) setsockopt$inet_int(r4, 0x0, 0x3, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x2, "000000000000000000000500"}}}]}, 0x48}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=@newtaction={0x14, 0x12, 0xbf68af9d17701211, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) ioctl$F2FS_IOC_DECOMPRESS_FILE(r1, 0xf517, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000ebc1998aafab18592cd4dfd7940000000000000085000000b200000095e5000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_OPER(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000080)={0x28, r7, 0x1, 0x0, 0x25dfdbfd, {{0x8}, {@val={0x8}, @val={0xc, 0x99, {0x1, 0x1}}}}}, 0x28}}, 0x0) 857.694478ms ago: executing program 0 (id=9942): sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x80}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_flow={{0x9}, {0x58, 0x2, [@TCA_FLOW_ACT={0x54, 0x9, 0x0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x4000000, 0x20000001, 0x4, 0x2}, 0x1, r2}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 741.116036ms ago: executing program 1 (id=9943): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000010c0)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRESDEC=r0], 0xcc}}, 0x0) 644.900605ms ago: executing program 3 (id=9944): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x3000004, 0x3032, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/243, 0xfffffdef}], 0x1) write$cgroup_subtree(r1, &(0x7f0000000700)=ANY=[], 0xfe33) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_INITSTATE(r3, 0x113, 0x4, 0x0, 0x0) sendmsg$netlink(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000a40)={0x14, 0x56, 0x601, 0x0, 0x0, "", [@generic="f4"]}, 0x14}], 0x1}, 0x0) 586.522205ms ago: executing program 1 (id=9945): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="180000002f040000000400520e8066e6c1db8f0e721f11f6ba168142d8dbbecb49968bc22126f179a1a44ef32103dadd8c0c25532ed5495c7203e9e869d5da9f16ea1b181a31fd860a19cd52ac973b8d6243c47d94fee8c02c2d49e0449e2eba36fba35a"], 0x18}, 0x1, 0x0, 0x0, 0x4042800}, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) 473.715692ms ago: executing program 2 (id=9946): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xfffe, 0x2}, 0x6) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmsg$nl_route(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000180000042dbd7000fbdbdf251c001407fe02c8020028000005001a00020000000c00090082b33518", @ANYRES8, @ANYRES32=r0], 0x30}, 0x1, 0x0, 0x0, 0x48804}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xfffe, 0x2}, 0x6) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) sendmsg$nl_route(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000180000042dbd7000fbdbdf251c001407fe02c8020028000005001a00020000000c00090082b33518", @ANYRES8, @ANYRES32=r0], 0x30}, 0x1, 0x0, 0x0, 0x48804}, 0x0) (async) 421.20435ms ago: executing program 4 (id=9947): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r0, 0x8983, &(0x7f0000000c40)) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407030000020000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) (async) socketpair(0xb, 0x1, 0xc2, &(0x7f0000000c80)={0xffffffffffffffff}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) (async) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x24, r5, 0x11, 0x0, 0xffffffff, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x24}}, 0x0) (async) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000cc0)={@mcast2, 0x7c, r4}) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={@cgroup, 0x14, 0x1, 0x4, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f0000000080)=[0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r7, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071127e000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={@cgroup=r7, r1, 0x2c, 0x0, 0x0, @void, @value=r1, @void, @void, r6}, 0x20) 420.643967ms ago: executing program 0 (id=9948): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000001340)="58ddb007a47a8b1f458ab677d557ca8ba67f02ea51b25550def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2abc5c6d88b78df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a6f32d9dc4ef5d8ffab269557bc053d9be903", 0xa7}, {&(0x7f0000001400)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0x9f}, {&(0x7f0000000440)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xcb}, {&(0x7f0000000000)="de21cff472aa580c2ee9f858", 0xc}, {&(0x7f0000000540)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a085852456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7aa36b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe125b", 0xdea}], 0x5) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0xf2f, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}, 0xffffff00}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 404.854754ms ago: executing program 1 (id=9949): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000280)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00a8bc", 0x1c, 0x6, 0xfc, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}]}}}}}}}}, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)='blkio.reset_stats\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a00)={0x24, 0x41, 0x107, 0x70bd30, 0x25dfdbfe, {0x2, 0x7c}, [@nested={0x4, 0x2d}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x1f}]}, @typed={0x4, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000440)=@ethtool_eeprom={0xc, 0x7, 0x7f}}) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x2}, 0x48) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000008300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockname$l2tp6(r4, &(0x7f0000000140)={0xa, 0x0, 0x0, @empty}, &(0x7f00000001c0)=0x20) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@gettaction={0x20, 0x5a, 0x1, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc}]}, 0x20}}, 0x0) 260.170335ms ago: executing program 2 (id=9950): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e23, 0x100006, @ipv4={'\x00', '\xff\xff', @local}, 0xffff}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000680)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xab, @loopback, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x20000014) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000000)={0x0, 0x28, "21b229ffd223f97c8e17e805752b7196a42333b98fc7411a1aefd6593ea97df3bf2ffa3a044c94b1"}, &(0x7f00000000c0)=0x30) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0xfffa, 0x5, 0x8008, 0x4, 0x0, 0x7ab5f6b8, 0x6d000, 0x4, r1}, 0x20) r2 = socket(0x22, 0x80000, 0x3a) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000040)={0x1, 0x1, 0x40}, 0xc) setsockopt$MRT6_FLUSH(r2, 0x29, 0xd4, &(0x7f0000000080)=0x8, 0x4) 177.334196ms ago: executing program 3 (id=9951): r0 = socket$netlink(0x10, 0x3, 0x8000000004) ioctl$SIOCSIFHWADDR(r0, 0x8b06, &(0x7f0000000240)={'wlan1\x00', @multicast}) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9c, 0x9c, 0x9, [@enum={0x5, 0x3, 0x0, 0x6, 0x4, [{0xe, 0x6}, {0x8, 0xfffffe4f}, {0x10, 0x8}]}, @type_tag={0x8, 0x0, 0x0, 0x12, 0x3}, @struct={0xe, 0x4, 0x0, 0x4, 0x1, 0x7, [{0xc, 0x2, 0x9}, {0xd, 0x1, 0x3}, {0xe, 0x2, 0x8}, {0xa, 0x2, 0x2c0c}]}, @func={0xa, 0x0, 0x0, 0xc, 0x4}, @restrict={0xf, 0x0, 0x0, 0xb, 0x3}, @volatile={0x5, 0x0, 0x0, 0x9, 0x1}, @volatile={0xe, 0x0, 0x0, 0x9, 0x3}]}, {0x0, [0x0, 0x61, 0x2e, 0x61, 0x79, 0x61, 0x30]}}, &(0x7f00000002c0)=""/140, 0xbd, 0x8c, 0x1, 0x99}, 0x28) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r1}, 0x8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000200)) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x7fffffff}, {{0x18, 0x4, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5a}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x7}}, [], {{0x6, 0x1, 0x3, 0x8}, {0x6, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 176.844507ms ago: executing program 4 (id=9952): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'gretap0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x700, 0x1, 0x4, 0x4b8a, {{0x7, 0x4, 0x0, 0x3b, 0x1c, 0x65, 0x0, 0x1, 0x4, 0x0, @rand_addr=0x64010100, @broadcast, {[@generic={0x88, 0x5, "4bd53c"}, @end]}}}}}) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)={0x0, @rand_addr, @local}, &(0x7f00000001c0)=0xc) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000200)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x9, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x99, &(0x7f00000002c0)=[{}], 0x8, 0x10, &(0x7f0000000300), &(0x7f0000000340), 0x8, 0xa0, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) (async) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000500)={0x0, @empty, @private}, &(0x7f0000000540)=0xc) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000580)={@mcast1, 0x0}, &(0x7f00000005c0)=0x14) (async) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xffea, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000070000100000000000000000007000000", @ANYRES32=r7, @ANYBLOB="0c00018008000100000001000c0002"], 0x30}}, 0x0) (async) r8 = socket(0x400000000010, 0x3, 0x0) (async) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0xfffffff9, 0x57, 0x1bc4, 0x1, 0x4, 0x5, 0x400, 0x36}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008094}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001b00)=@newtfilter={0x158, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x12c, 0x2, [@TCA_U32_SEL={0x114, 0x5, {0x9, 0x0, 0x10, 0x8, 0x8, 0x5, 0x64, 0x80000001, [{0x6, 0xffffffff, 0x0, 0xaa2f}, {0x9, 0x1, 0x6, 0x8}, {0xd0e, 0xfffff9e2, 0x10001, 0x4}, {0x5, 0x9, 0x0, 0x101}, {0x0, 0x5, 0xd689a94, 0x10000}, {0xffffffff, 0x4, 0x5, 0x3}, {0x6, 0x74, 0x8, 0x40}, {0x493, 0x0, 0x9, 0x7}, {0xb, 0x401, 0xd}, {0x8, 0x23fd, 0x38, 0x2}, {0x2, 0x58e, 0xe0000, 0x6}, {0x100, 0x26, 0x0, 0x7fffffff}, {0x6, 0x2, 0x0, 0x7}, {0x0, 0x9d, 0x100, 0xbc}, {0x10, 0xfff, 0xe, 0xb}, {0x5, 0x5, 0x5, 0xb}]}}, @TCA_U32_INDEV={0x14, 0x8, 'batadv_slave_0\x00'}]}}]}, 0x158}}, 0x20000000) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x170b923, 0x80000, {0x0, 0x0, 0x0, r13, {0x0, 0xd}, {0xb, 0xb}, {0xfff2, 0xb}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x10, 0x7, 0x3d58, 0x1, 0x1, 0x3}}, {0x4}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x2001c061}, 0x4008000) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl2\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x2f, 0x4, 0x22, 0x4, 0x45, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, @local, 0x7800, 0x8, 0x7fffffff, 0xfff}}) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000006c0)=0x0, &(0x7f0000000700)=0x4) (async) r16 = socket(0x10, 0x803, 0x0) (async) r17 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000740)={'veth0_macvtap\x00', 0x0}) sendmsg$nl_route_sched(r17, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r18, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffff, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x6}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$nl_route_sched(r16, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtfilter={0x10c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r18, {0xe, 0x7}, {}, {0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xd8, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x7, 0xef, 0x8, 0x8, 0x5, 0x9, 0x7, 0x0, [{0x1000, 0x4, 0x401, 0x6}, {0x6, 0x7, 0x7, 0x4}, {0xfffffff9, 0x43, 0x1, 0x7}, {0x7fde, 0x40, 0x51, 0x3ff}, {0x5, 0xb, 0x8, 0x42}, {0x8, 0x4, 0x8, 0x8}, {0x8001, 0x0, 0x0, 0x8001}, {0x1, 0x1800004, 0xfffffff8, 0x400}]}}, @TCA_U32_POLICE={0x40, 0x6, [@TCA_POLICE_TBF={0x3c, 0x1, {0x28bf, 0x0, 0xc, 0x1, 0x2, {0x1, 0x2, 0x3, 0x2, 0x6}, {0xf3, 0x1, 0x7f, 0x6f4, 0x6, 0x6}, 0x6, 0x0, 0xfafd}}]}]}}, @TCA_RATE={0x6, 0x5, {0xfe}}]}, 0x10c}, 0x1, 0x0, 0x0, 0x80}, 0xc040) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r0, &(0x7f0000001240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001200)={&(0x7f0000001000)=ANY=[@ANYBLOB="d8010000", @ANYRES16=0x0, @ANYBLOB="000229bd7000fbdbdf2506000000200001800800030003000000140002006772653000000000000000000000000020000180140002006970366772653000000000000000000008000100", @ANYRES32=r1, @ANYBLOB="3c00018014000200776c616e30000000000000000000000008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="1400020076657468315f766972745f77696669003c0001801400020076657468315f746f5f626f6e640000001400020070696d3672656731000000000000000008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="1400018008000100", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="580001801400020064766d72703100000000000000000000080003000100000008000100", @ANYRES32=r10, @ANYBLOB="080003000300000008000100", @ANYRES32=0x0, @ANYBLOB="080003000300000008000100", @ANYRES32=r13, @ANYBLOB="08000300905168fb457c9400", @ANYRES32=r14, @ANYBLOB="1800018014000200766972745f77696669300000000000008400018008000100", @ANYRES32=0x0, @ANYBLOB="140002006261746164763000000000000000000008000100", @ANYRES32=r15, @ANYBLOB="1400020076657468315f766c616e00000000000008000300020000000800030001000000080003000200000008000100", @ANYRES32=r18, @ANYBLOB="14000200767863616e3100000000000000000000140002006970766c616e3100000000000000000004000180"], 0x1d8}, 0x1, 0x0, 0x0, 0x4040001}, 0x4) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa00000000000001503000008004e002d3501000000000095004100000000006916000000000000bf67000000000000350605000fff07206706000014000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffbd4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b33e0f32f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3cd3cedd01fdc59589ea6bacde1e40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8b0100010000000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d5454d127edab14ba61ba1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7a7216f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf855689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684e62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961cf4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fd0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bbff4bbe00000000000000000000000000fdba1133066c4a21a7149f32"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) 11.402019ms ago: executing program 3 (id=9953): socket$nl_route(0x10, 0x3, 0x0) (async) socket$netlink(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket(0x8000000010, 0x2, 0x0) write(r0, 0x0, 0x0) r1 = socket(0x840000000002, 0x3, 0x100) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="10002dbd7000fddbdf25050000000400028004006e6d"], 0x1c}}, 0x80c0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', 0x0, 0x0, 0x2000000026fe, 0x0, 0x1}}, 0x40) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuset.effective_mems\x00', 0x275a, 0x0) sendfile(r3, r4, 0x0, 0x2) (async) close(r4) (async) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) (async) sendmmsg$inet(r1, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="300000001000010029bd7000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="3a8904004a90000008001b000000f9ff070004000700000071353e75a31f167bbe6495d6701a93201dc649f3d1e5428e9de3d218558927edf93f318f70018c"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) syz_init_net_socket$llc(0x1a, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) (async) socket(0x10, 0x803, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) splice(r7, &(0x7f0000000040), r6, 0x0, 0x800000000ff, 0x0) 0s ago: executing program 4 (id=9954): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x2041) setsockopt$sock_int(r1, 0x1, 0x4, &(0x7f0000000000), 0x4) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="540000000206050000000000000000000000000005000400000000000900020073797a320000000005000100070000000500050002000000050001000600000011000300686173683a6e65742c6e657400000067"], 0x54}}, 0x0) close(0xffffffffffffffff) kernel console output (not intermixed with test programs): pan0) entered blocking state [ 882.927001][T32618] bridge11: port 1(erspan0) entered disabled state [ 882.971988][T32618] erspan0: entered allmulticast mode [ 882.982008][T32618] erspan0: left allmulticast mode [ 883.201196][ T29] audit: type=1804 audit(1784154289.428:39): pid=32651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.8167" name="/newroot/1645/cgroup.controllers" dev="tmpfs" ino=8385 res=1 errno=0 [ 883.225880][T32653] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8168'. [ 883.248716][T32651] tipc: Enabling of bearer rejected, already enabled [ 883.253450][T32653] openvswitch: netlink: Missing key (keys=40, expected=80) [ 883.282293][ T29] audit: type=1800 audit(1784154289.428:40): pid=32651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.8167" name="cgroup.controllers" dev="tmpfs" ino=8385 res=0 errno=0 [ 883.865437][T32684] netlink: 84 bytes leftover after parsing attributes in process `syz.0.8175'. [ 883.875683][T32690] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8177'. [ 883.917144][T32684] netlink: 'syz.0.8175': attribute type 1 has an invalid length. [ 883.928064][T32690] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8177'. [ 883.958226][T32693] netlink: 'syz.2.8179': attribute type 1 has an invalid length. [ 883.987127][T32686] bridge12: port 1(erspan0) entered blocking state [ 884.009048][T32686] bridge12: port 1(erspan0) entered disabled state [ 884.021050][T32686] erspan0: entered allmulticast mode [ 884.028863][T32686] erspan0: left allmulticast mode [ 884.058374][T32697] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8180'. [ 884.195938][T32701] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8182'. [ 884.243985][T32699] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8181'. [ 884.495727][T32720] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 884.758931][T32729] bridge23: port 1(erspan0) entered blocking state [ 884.806503][T32729] bridge23: port 1(erspan0) entered disabled state [ 884.845544][T32729] erspan0: entered allmulticast mode [ 884.849925][T32735] IPVS: set_ctl: invalid protocol: 2 10.1.1.1:20001 [ 884.904652][T32736] netlink: 'syz.4.8193': attribute type 27 has an invalid length. [ 884.944336][T32736] netlink: 'syz.4.8193': attribute type 4 has an invalid length. [ 885.618246][ T312] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 885.928077][ T321] netlink: 'syz.4.8207': attribute type 5 has an invalid length. [ 887.229032][ T385] netlink: 'syz.4.8221': attribute type 1 has an invalid length. [ 887.263567][ T385] netlink: 'syz.4.8221': attribute type 1 has an invalid length. [ 887.545402][ T408] netlink: 'syz.1.8233': attribute type 2 has an invalid length. [ 887.828171][ T429] Cannot find del_set index 3 as target [ 888.074386][ T439] openvswitch: netlink: IP tunnel dst address not specified [ 888.235938][ T446] netlink: get zone limit has 4 unknown bytes [ 888.452152][ T452] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 888.711044][ T470] Cannot find add_set index 2 as target [ 888.803815][ T472] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 888.909056][ T478] can: request_module (can-proto-0) failed. [ 889.197484][ T500] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 889.522281][ T519] netlink: 'syz.2.8265': attribute type 21 has an invalid length. [ 889.531904][ T519] __nla_validate_parse: 14 callbacks suppressed [ 889.531943][ T519] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8265'. [ 889.548400][ T513] xt_CT: No such helper "syz0" [ 889.630460][ T474] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 889.633098][ T523] sctp: [Deprecated]: syz.0.8267 (pid 523) Use of int in maxseg socket option. [ 889.633098][ T523] Use struct sctp_assoc_value instead [ 890.030621][ T538] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8272'. [ 892.010113][ T491] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 892.231089][ T552] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8276'. [ 892.305184][ T560] netlink: 1204 bytes leftover after parsing attributes in process `syz.2.8277'. [ 892.748198][ T584] netlink: 72 bytes leftover after parsing attributes in process `syz.3.8285'. [ 892.796153][ T586] --map-set only usable from mangle table [ 893.171893][ T606] syzkaller1: entered promiscuous mode [ 893.177922][ T606] syzkaller1: entered allmulticast mode [ 893.312446][ T617] netlink: 'syz.2.8296': attribute type 22 has an invalid length. [ 893.341428][ T617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8296'. [ 893.433475][ T621] netlink: 'syz.4.8297': attribute type 21 has an invalid length. [ 893.455036][ T617] netlink: 'syz.2.8296': attribute type 22 has an invalid length. [ 893.462404][ T621] netlink: 132 bytes leftover after parsing attributes in process `syz.4.8297'. [ 893.499669][ T617] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8296'. [ 893.587509][ T631] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8301'. [ 893.606419][ T632] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8300'. [ 893.857088][ T649] netlink: 'syz.0.8305': attribute type 1 has an invalid length. [ 893.898695][ T649] netlink: 'syz.0.8305': attribute type 2 has an invalid length. [ 894.176156][ T671] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 894.347467][ T677] netlink: 'syz.1.8314': attribute type 21 has an invalid length. [ 894.380486][ T681] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 894.388596][ T681] IPv6: NLM_F_CREATE should be set when creating new route [ 894.398458][ T678] A link change request failed with some changes committed already. Interface ip6tnl0 may have been left with an inconsistent configuration, please check. [ 894.544311][ T686] x_tables: duplicate underflow at hook 1 [ 894.887561][ T702] __nla_validate_parse: 4 callbacks suppressed [ 894.887579][ T702] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8323'. [ 894.913110][ T704] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8324'. [ 894.986489][ T707] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8326'. [ 895.130201][ T715] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8328'. [ 895.338505][ T729] netlink: 'syz.4.8332': attribute type 11 has an invalid length. [ 895.402521][ T729] netlink: 'syz.4.8332': attribute type 1 has an invalid length. [ 895.446511][ T729] netlink: 64 bytes leftover after parsing attributes in process `syz.4.8332'. [ 895.483242][ T735] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8334'. [ 895.551059][ T740] lo: entered allmulticast mode [ 895.571707][ T740] tunl0: left promiscuous mode [ 895.591090][ T740] tunl0: entered allmulticast mode [ 895.616339][ T740] gre0: left promiscuous mode [ 895.662618][ T744] netlink: 'syz.4.8339': attribute type 10 has an invalid length. [ 895.673528][ T740] gretap0: entered allmulticast mode [ 895.710925][ T740] ip_vti0: entered allmulticast mode [ 895.728853][ T740] ip6_vti0: entered allmulticast mode [ 895.746395][ T740] sit0: entered allmulticast mode [ 895.761442][ T740] ip6tnl0: entered allmulticast mode [ 895.773075][ T740] ip6gre0: entered allmulticast mode [ 895.791772][ T750] netlink: 'syz.4.8339': attribute type 10 has an invalid length. [ 896.267860][ T774] netlink: 144 bytes leftover after parsing attributes in process `syz.4.8348'. [ 896.455101][ T779] syzkaller1: entered promiscuous mode [ 896.490056][ T779] syzkaller1: entered allmulticast mode [ 896.739024][ T791] gre3: entered promiscuous mode [ 896.803783][ T800] gre3: entered promiscuous mode [ 896.853446][ T802] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 897.134463][ T809] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 897.408707][ T821] can: request_module (can-proto-0) failed. [ 897.438310][ T829] netlink: 'syz.3.8363': attribute type 1 has an invalid length. [ 897.452130][ T830] netlink: 'syz.3.8363': attribute type 1 has an invalid length. [ 897.666006][ T840] tipc: Enabling of bearer rejected, already enabled [ 898.033678][ T859] syzkaller1: entered promiscuous mode [ 898.048673][ T859] syzkaller1: entered allmulticast mode [ 898.089557][ T859] ¾x9ÿ: renamed from bridge_slave_0 [ 898.182008][ T870] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8377'. [ 898.292198][ T874] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8377'. [ 898.447922][ T885] netlink: 'syz.1.8383': attribute type 21 has an invalid length. [ 898.478519][ T885] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8383'. [ 898.647360][ T891] netlink: 'syz.1.8385': attribute type 10 has an invalid length. [ 898.657210][ T893] netlink: 'syz.1.8385': attribute type 10 has an invalid length. [ 898.717602][ T897] xt_l2tp: v2 doesn't support IP mode [ 899.098866][ T906] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 899.735101][ T954] Cannot find del_set index 3 as target [ 899.786739][ T29] audit: type=1107 audit(1784154306.018:41): pid=953 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='N÷ÿ2Fò{×Ê_²~û¬âº‡Áa[!#²Â¼×ìõ¶x™s1=á/)¦I™mXýé@èVH pàk [ 899.786739][ T29] ÏCÑ-õÄ5†¿5A¨^ˆ[†©›²CXꦭ;oô0¤YŠ ½k´]=!‰¸±àïÉɤÒÒ»L;Ùü[¶5M×,^²°2T´.Ú:Ÿ×u [.¸éÈÂÔ4¯¯‚' [ 899.980510][ T974] netlink: 'syz.4.8402': attribute type 8 has an invalid length. [ 900.056202][ T974] __nla_validate_parse: 1 callbacks suppressed [ 900.056221][ T974] netlink: 224 bytes leftover after parsing attributes in process `syz.4.8402'. [ 900.165291][ T926] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8395'. [ 900.208404][ T926] netlink: 14 bytes leftover after parsing attributes in process `syz.0.8395'. [ 900.255855][ T982] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8406'. [ 900.368890][ T991] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8409'. [ 900.517387][ T998] validate_nla: 1 callbacks suppressed [ 900.517405][ T998] netlink: 'syz.3.8410': attribute type 1 has an invalid length. [ 900.579780][ T998] netlink: 224 bytes leftover after parsing attributes in process `syz.3.8410'. [ 900.673559][ T1000] netlink: 'syz.3.8410': attribute type 1 has an invalid length. [ 900.719374][ T1000] netlink: 224 bytes leftover after parsing attributes in process `syz.3.8410'. [ 900.768842][ T1007] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8413'. [ 900.820561][ T1007] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8413'. [ 900.865562][ T1007] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8413'. [ 900.887081][ T1017] netlink: 'syz.0.8415': attribute type 21 has an invalid length. [ 901.877360][ T1076] netlink: 'syz.0.8431': attribute type 1 has an invalid length. [ 901.929054][ T1085] FAULT_INJECTION: forcing a failure. [ 901.929054][ T1085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 901.958973][ T1085] CPU: 1 UID: 0 PID: 1085 Comm: syz.3.8433 Not tainted syzkaller #0 PREEMPT(full) [ 901.958999][ T1085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 901.959010][ T1085] Call Trace: [ 901.959018][ T1085] [ 901.959027][ T1085] dump_stack_lvl+0xe8/0x150 [ 901.959059][ T1085] should_fail_ex+0x40c/0x560 [ 901.959085][ T1085] _copy_from_user+0x2d/0xb0 [ 901.959115][ T1085] ___sys_sendmsg+0x1c6/0x360 [ 901.959153][ T1085] ? __lock_acquire+0x683/0x2cf0 [ 901.959181][ T1085] ? __pfx____sys_sendmsg+0x10/0x10 [ 901.959241][ T1085] ? __fget_files+0x2a/0x420 [ 901.959264][ T1085] ? __fget_files+0x3a2/0x420 [ 901.959299][ T1085] __x64_sys_sendmsg+0x1b1/0x290 [ 901.959331][ T1085] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 901.959377][ T1085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.959398][ T1085] do_syscall_64+0x174/0x580 [ 901.959425][ T1085] ? trace_irq_disable+0x3b/0x140 [ 901.959449][ T1085] ? clear_bhb_loop+0x40/0x90 [ 901.959472][ T1085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 901.959490][ T1085] RIP: 0033:0x7f988359de59 [ 901.959509][ T1085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 901.959526][ T1085] RSP: 002b:00007f9884463028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 901.959546][ T1085] RAX: ffffffffffffffda RBX: 00007f9883825fa0 RCX: 00007f988359de59 [ 901.959559][ T1085] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 901.959571][ T1085] RBP: 00007f9884463090 R08: 0000000000000000 R09: 0000000000000000 [ 901.959583][ T1085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 901.959595][ T1085] R13: 00007f9883826038 R14: 00007f9883825fa0 R15: 00007ffe72b0bde8 [ 901.959626][ T1085] [ 903.085771][ T1135] netlink: 'syz.0.8448': attribute type 12 has an invalid length. [ 903.170452][ T1143] netlink: 'syz.3.8450': attribute type 1 has an invalid length. [ 903.183563][ T1146] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 903.619077][ T1165] sock: sock_set_timeout: `syz.0.8456' (pid 1165) tries to set negative timeout [ 904.010926][ T1184] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 904.018218][ T1184] IPv6: NLM_F_CREATE should be set when creating new route [ 904.158064][ T1187] netlink: 'syz.1.8464': attribute type 2 has an invalid length. [ 904.566740][ T1217] netlink: 'syz.4.8473': attribute type 1 has an invalid length. [ 904.701664][ T1217] 8021q: adding VLAN 0 to HW filter on device bond25 [ 904.815367][ T1229] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 904.823017][ T1229] IPv6: NLM_F_CREATE should be set when creating new route [ 904.883984][ T1223] bond25: (slave geneve4): making interface the new active one [ 904.921791][ T1236] netlink: 'syz.3.8480': attribute type 21 has an invalid length. [ 904.933926][ T1223] bond25: (slave geneve4): Enslaving as an active interface with an up link [ 905.336058][ T1258] __nla_validate_parse: 37 callbacks suppressed [ 905.336085][ T1258] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8487'. [ 905.496734][ T1262] vlan4: left allmulticast mode [ 905.522499][ T1262] bridge3: left allmulticast mode [ 905.540866][ T1262] bond10: left allmulticast mode [ 905.566624][ T1262] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 905.586501][ T1262] vlan5: left allmulticast mode [ 905.595193][ T1262] bridge10: left allmulticast mode [ 905.604342][ T1262] vlan6: left allmulticast mode [ 905.612250][ T1262] bridge11: left allmulticast mode [ 905.617834][ T1274] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8491'. [ 905.623061][ T1262] vlan7: left allmulticast mode [ 905.629088][ T1274] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 905.641780][ T1262] bridge15: left allmulticast mode [ 905.658524][ T1262] vlan8: left allmulticast mode [ 905.670081][ T1262] bridge16: left allmulticast mode [ 905.684963][ T1262] vlan9: left allmulticast mode [ 905.700836][ T1262] bridge17: left allmulticast mode [ 905.710188][ T1262] macvtap0: left allmulticast mode [ 905.736899][ T1262] gtp2: left allmulticast mode [ 905.751251][ T1262] vlan10: left allmulticast mode [ 905.756587][ T1262] bridge18: left allmulticast mode [ 905.990403][ T1290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8494'. [ 906.032303][ T1293] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8495'. [ 906.093920][ T1295] vlan11: entered allmulticast mode [ 906.113132][ T1295] bond0: entered allmulticast mode [ 906.141223][ T1300] netlink: 'syz.4.8496': attribute type 1 has an invalid length. [ 906.192355][ T1295] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8496'. [ 906.207499][ T1303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8497'. [ 906.516688][ T1318] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8502'. [ 906.551552][ T1318] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 906.559805][ T1318] IPv6: NLM_F_CREATE should be set when creating new route [ 906.958420][ T1341] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8506'. [ 907.121186][ T1349] FAULT_INJECTION: forcing a failure. [ 907.121186][ T1349] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 907.176587][ T1349] CPU: 0 UID: 0 PID: 1349 Comm: syz.4.8510 Not tainted syzkaller #0 PREEMPT(full) [ 907.176613][ T1349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 907.176625][ T1349] Call Trace: [ 907.176634][ T1349] [ 907.176643][ T1349] dump_stack_lvl+0xe8/0x150 [ 907.176677][ T1349] should_fail_ex+0x40c/0x560 [ 907.176705][ T1349] _copy_from_user+0x2d/0xb0 [ 907.176733][ T1349] __sys_sendto+0x2a9/0x5a0 [ 907.176761][ T1349] ? ksys_write+0x1e6/0x270 [ 907.176793][ T1349] ? __pfx___sys_sendto+0x10/0x10 [ 907.176817][ T1349] ? __mutex_unlock_slowpath+0x731/0x900 [ 907.176875][ T1349] ? __pfx_ksys_write+0x10/0x10 [ 907.176909][ T1349] __x64_sys_sendto+0xde/0x100 [ 907.176935][ T1349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 907.177027][ T1349] do_syscall_64+0x174/0x580 [ 907.177063][ T1349] ? trace_irq_disable+0x3b/0x140 [ 907.177088][ T1349] ? clear_bhb_loop+0x40/0x90 [ 907.177113][ T1349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 907.177132][ T1349] RIP: 0033:0x7f4f33d5e68e [ 907.177150][ T1349] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 907.177174][ T1349] RSP: 002b:00007f4f34bc0e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 907.177196][ T1349] RAX: ffffffffffffffda RBX: 00007f4f34bc26c0 RCX: 00007f4f33d5e68e [ 907.177211][ T1349] RDX: 0000000000000020 RSI: 00007f4f34bc1000 RDI: 0000000000000003 [ 907.177224][ T1349] RBP: 0000000000000000 R08: 00007f4f34bc0f04 R09: 000000000000000c [ 907.177237][ T1349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 907.177249][ T1349] R13: 00007f4f34bc0f58 R14: 00007f4f34bc1000 R15: 0000000000000000 [ 907.177283][ T1349] [ 907.480305][ T1354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8512'. [ 907.496908][ T1365] netlink: ct family unspecified [ 907.498917][ T1361] netlink: ct family unspecified [ 907.505437][ T1365] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 907.511680][ T1366] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8514'. [ 907.537374][ T1361] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 907.632230][ T1369] syzkaller1: entered promiscuous mode [ 907.638703][ T1369] syzkaller1: entered allmulticast mode [ 907.660274][ T1370] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 907.824411][ T1378] netlink: 'syz.4.8519': attribute type 1 has an invalid length. [ 907.877447][ T1378] netlink: 'syz.4.8519': attribute type 11 has an invalid length. [ 908.423194][ T1407] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 908.772691][ T1423] erspan0: left allmulticast mode [ 908.778351][ T1423] bridge23: port 1(erspan0) entered disabled state [ 908.826776][ T1423] bond27: (slave bridge21): Releasing backup interface [ 908.851340][ T1423] bridge21: left promiscuous mode [ 909.108513][ T1445] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 909.959486][ T1469] lo: Caught tx_queue_len zero misconfig [ 910.046381][ T1465] syzkaller1: entered promiscuous mode [ 910.054720][ T1465] syzkaller1: entered allmulticast mode [ 910.078240][ T1486] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 910.305964][ T1500] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 910.320811][ T1500] gretap4: default qdisc (pfifo_fast) fail, fallback to noqueue [ 910.331889][ T1500] gretap4: entered promiscuous mode [ 910.337909][ T1500] gretap4: entered allmulticast mode [ 910.348869][ T1500] netlink: 'syz.3.8563': attribute type 4 has an invalid length. [ 910.360074][ T1500] __nla_validate_parse: 16 callbacks suppressed [ 910.360307][ T1500] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8563'. [ 910.379898][ T1500] .`: renamed from bond0 [ 910.618769][ T1472] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 910.946066][ T1515] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8569'. [ 911.050038][ T1515] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 911.354096][ T1538] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 911.595018][ T1551] sctp: [Deprecated]: syz.2.8579 (pid 1551) Use of struct sctp_assoc_value in delayed_ack socket option. [ 911.595018][ T1551] Use struct sctp_sack_info instead [ 911.617151][ T1554] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8581'. [ 911.653542][ T1551] netlink: 1044 bytes leftover after parsing attributes in process `syz.2.8579'. [ 911.676365][ T1555] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8580'. [ 911.752490][ T1566] openvswitch: netlink: IP tunnel dst address not specified [ 912.209067][ T1591] Cannot find del_set index 3 as target [ 912.251417][ T1592] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8587'. [ 912.676525][ T1606] netlink: 76 bytes leftover after parsing attributes in process `syz.2.8594'. [ 912.933280][ T1617] netlink: 'syz.2.8597': attribute type 21 has an invalid length. [ 912.961533][ T1617] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8597'. [ 913.294033][ T1636] netlink: 48 bytes leftover after parsing attributes in process `syz.2.8602'. [ 913.375968][ T1640] Cannot find del_set index 3 as target [ 913.905436][ T1662] openvswitch: netlink: Duplicate or invalid key (type 0). [ 913.942859][ T1662] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 913.961271][ T1668] netlink: 'syz.2.8612': attribute type 21 has an invalid length. [ 914.033838][ T1661] bond29: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-xor(2) [ 914.086685][ T1661] bond29 (unregistering): Released all slaves [ 914.134854][ T1668] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8612'. [ 914.521851][ T1683] xt_CT: No such helper "syz0" [ 914.751872][ T1700] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 914.819917][ T1691] bond33: Removing last ns target with arp_interval on [ 915.001302][ T1716] netlink: 'syz.4.8625': attribute type 21 has an invalid length. [ 915.683495][ T1743] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 915.766208][ T1762] __nla_validate_parse: 2 callbacks suppressed [ 915.766227][ T1762] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8636'. [ 917.183532][ T1831] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8658'. [ 917.242256][ T1837] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 917.490664][ T1841] xt_hashlimit: max too large, truncated to 1048576 [ 917.524265][ T1841] No such timeout policy "syz1" [ 917.885464][ T1865] netlink: 'syz.0.8662': attribute type 4 has an invalid length. [ 917.917915][ T1865] netlink: 152 bytes leftover after parsing attributes in process `syz.0.8662'. [ 918.329030][ T1884] netlink: 'syz.3.8670': attribute type 1 has an invalid length. [ 918.398665][ T1886] netlink: 'syz.3.8670': attribute type 1 has an invalid length. [ 918.445558][ T1891] netlink: 'syz.1.8671': attribute type 2 has an invalid length. [ 918.475585][ T1884] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 918.587369][ T1886] bond0: entered promiscuous mode [ 918.608275][ T1898] Cannot find del_set index 3 as target [ 918.630465][ T1886] 8021q: adding VLAN 0 to HW filter on device bond0 [ 918.841643][ T1908] geneve5: entered promiscuous mode [ 918.848480][ T1908] geneve5: entered allmulticast mode [ 918.911695][ T1914] syzkaller1: entered promiscuous mode [ 918.938313][ T1914] syzkaller1: entered allmulticast mode [ 918.990806][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.029861][ T1922] netlink: 'syz.0.8680': attribute type 32 has an invalid length. [ 919.036883][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.066604][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.106895][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.128807][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.177957][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.187838][ T1920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8679'. [ 919.360067][ T1940] openvswitch: netlink: IPv6 tunnel dst address is zero [ 919.387175][ T1938] netlink: 'syz.0.8683': attribute type 10 has an invalid length. [ 919.428934][ T1938] openvswitch: netlink: Flow key attr not present in new flow. [ 919.641822][ T1959] netlink: 'syz.4.8685': attribute type 1 has an invalid length. [ 920.180960][ T1980] bond29: Invalid ad_actor_system MAC address. [ 920.191681][ T1980] bond29: option ad_actor_system: invalid value (1) [ 920.204075][ T1980] bond29 (unregistering): Released all slaves [ 920.372817][ T1985] syzkaller0: entered promiscuous mode [ 920.379729][ T1985] syzkaller0: entered allmulticast mode [ 924.566815][ T2015] vlan0: Caught tx_queue_len zero misconfig [ 924.792389][ T2025] __nla_validate_parse: 205 callbacks suppressed [ 924.792410][ T2025] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8706'. [ 925.194238][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.214276][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.237843][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.262128][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.280957][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.311058][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.333580][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.350395][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.365055][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8712'. [ 925.401340][ T2052] syzkaller1: entered promiscuous mode [ 925.407487][ T2052] syzkaller1: entered allmulticast mode [ 925.650944][ T2066] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 926.144684][T20842] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 926.186891][T20842] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 926.198623][T23733] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 926.360251][T23733] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 926.524270][ T2111] netlink: 'syz.0.8731': attribute type 21 has an invalid length. [ 926.608149][ T2109] syzkaller1: entered promiscuous mode [ 926.622193][ T2109] syzkaller1: entered allmulticast mode [ 926.701417][T23733] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 926.856592][ T2128] netlink: 'syz.3.8738': attribute type 83 has an invalid length. [ 927.027541][ T2140] 8021q: VLANs not supported on gre0 [ 927.265501][ T2158] netlink: 'syz.4.8746': attribute type 1 has an invalid length. [ 927.589155][ T2177] netlink: 'syz.1.8753': attribute type 7 has an invalid length. [ 927.724827][ T2183] Cannot find del_set index 3 as target [ 928.184059][ T2208] netlink: 'syz.2.8766': attribute type 1 has an invalid length. [ 928.332157][ T2208] bond34: entered promiscuous mode [ 928.359450][ T2208] 8021q: adding VLAN 0 to HW filter on device bond34 [ 928.613662][ T2237] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 929.094166][ T2254] openvswitch: netlink: Message has 12 unknown bytes. [ 929.101573][ T2254] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 929.277790][ T2254] syzkaller0: entered promiscuous mode [ 929.293896][ T2254] syzkaller0: entered allmulticast mode [ 929.304129][ T2267] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 929.430871][ T2273] FAULT_INJECTION: forcing a failure. [ 929.430871][ T2273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 929.445431][ T2273] CPU: 1 UID: 0 PID: 2273 Comm: syz.0.8787 Not tainted syzkaller #0 PREEMPT(full) [ 929.445459][ T2273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 929.445471][ T2273] Call Trace: [ 929.445479][ T2273] [ 929.445489][ T2273] dump_stack_lvl+0xe8/0x150 [ 929.445527][ T2273] should_fail_ex+0x40c/0x560 [ 929.445556][ T2273] _copy_from_iter+0x1d3/0x1660 [ 929.445580][ T2273] ? kmem_cache_alloc_node_noprof+0x1a1/0x610 [ 929.445606][ T2273] ? rcu_is_watching+0x15/0xb0 [ 929.445637][ T2273] ? trace_kmem_cache_alloc+0x29/0xe0 [ 929.445663][ T2273] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 929.445686][ T2273] ? __pfx__copy_from_iter+0x10/0x10 [ 929.445720][ T2273] ? __alloc_skb+0x276/0x7a0 [ 929.445746][ T2273] ? __alloc_skb+0x276/0x7a0 [ 929.445777][ T2273] ? netlink_sendmsg+0x650/0xb40 [ 929.445801][ T2273] ? skb_put+0x112/0x210 [ 929.445830][ T2273] netlink_sendmsg+0x6c0/0xb40 [ 929.445860][ T2273] ? __pfx_netlink_sendmsg+0x10/0x10 [ 929.445884][ T2273] ? aa_sock_msg_perm+0xf1/0x1b0 [ 929.445911][ T2273] ? __pfx_netlink_sendmsg+0x10/0x10 [ 929.445929][ T2273] sock_sendmsg_nosec+0x13a/0x180 [ 929.445956][ T2273] ____sys_sendmsg+0x54e/0x850 [ 929.445990][ T2273] ? __pfx_____sys_sendmsg+0x10/0x10 [ 929.446029][ T2273] ? import_iovec+0x73/0xa0 [ 929.446060][ T2273] ___sys_sendmsg+0x2a5/0x360 [ 929.446087][ T2273] ? __lock_acquire+0x683/0x2cf0 [ 929.446118][ T2273] ? __pfx____sys_sendmsg+0x10/0x10 [ 929.446184][ T2273] ? __fget_files+0x2a/0x420 [ 929.446207][ T2273] ? __fget_files+0x3a2/0x420 [ 929.446242][ T2273] __x64_sys_sendmsg+0x1b1/0x290 [ 929.446273][ T2273] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 929.446315][ T2273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.446336][ T2273] do_syscall_64+0x174/0x580 [ 929.446363][ T2273] ? trace_irq_disable+0x3b/0x140 [ 929.446389][ T2273] ? clear_bhb_loop+0x40/0x90 [ 929.446413][ T2273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 929.446433][ T2273] RIP: 0033:0x7fea7ad9de59 [ 929.446452][ T2273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 929.446470][ T2273] RSP: 002b:00007fea7bc92028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 929.446491][ T2273] RAX: ffffffffffffffda RBX: 00007fea7b025fa0 RCX: 00007fea7ad9de59 [ 929.446506][ T2273] RDX: 0000000004000080 RSI: 0000200000000100 RDI: 0000000000000003 [ 929.446520][ T2273] RBP: 00007fea7bc92090 R08: 0000000000000000 R09: 0000000000000000 [ 929.446531][ T2273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 929.446543][ T2273] R13: 00007fea7b026038 R14: 00007fea7b025fa0 R15: 00007ffd357dc308 [ 929.446576][ T2273] [ 930.119822][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 933.948833][ T2296] __nla_validate_parse: 203 callbacks suppressed [ 933.948853][ T2296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8792'. [ 933.977062][ T2299] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8793'. [ 934.312403][ T2315] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8797'. [ 934.355679][ T2316] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8798'. [ 934.373227][ T2315] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 934.428319][ T2319] netlink: 'syz.0.8799': attribute type 1 has an invalid length. [ 934.653433][ T2319] 8021q: adding VLAN 0 to HW filter on device bond28 [ 934.701703][ T2328] veth1_to_bond: entered allmulticast mode [ 934.726614][ T2337] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8803'. [ 934.744179][ T2330] veth1_to_bond: entered promiscuous mode [ 934.754401][ T2341] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8802'. [ 934.838622][ T2341] veth1_to_bond (unregistering): left allmulticast mode [ 934.860045][ T2341] veth1_to_bond (unregistering): left promiscuous mode [ 934.911901][ T2344] x_tables: duplicate underflow at hook 1 [ 934.971548][ T2352] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8808'. [ 935.083081][ T2361] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8807'. [ 935.252356][ T2371] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8811'. [ 935.275763][ T2371] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 935.300986][ T2369] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.8810'. [ 935.466547][ T2365] syzkaller1: entered promiscuous mode [ 935.497504][ T2365] syzkaller1: entered allmulticast mode [ 935.729053][ T2385] smc: net device team0 applied user defined pnetid SYZ2 [ 935.765123][ T2385] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 935.928814][ T2398] FAULT_INJECTION: forcing a failure. [ 935.928814][ T2398] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 936.010467][ T2398] CPU: 0 UID: 0 PID: 2398 Comm: syz.0.8819 Not tainted syzkaller #0 PREEMPT(full) [ 936.010493][ T2398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 936.010504][ T2398] Call Trace: [ 936.010512][ T2398] [ 936.010521][ T2398] dump_stack_lvl+0xe8/0x150 [ 936.010555][ T2398] should_fail_ex+0x40c/0x560 [ 936.010583][ T2398] _copy_to_user+0x31/0xb0 [ 936.010613][ T2398] simple_read_from_buffer+0xe1/0x170 [ 936.010645][ T2398] proc_fail_nth_read+0x1bb/0x230 [ 936.010675][ T2398] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 936.010705][ T2398] ? rw_verify_area+0x24a/0x4c0 [ 936.010735][ T2398] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 936.010761][ T2398] vfs_read+0x213/0xa80 [ 936.010793][ T2398] ? __pfx___mutex_lock+0x10/0x10 [ 936.010823][ T2398] ? __pfx_vfs_read+0x10/0x10 [ 936.010853][ T2398] ? __fget_files+0x2a/0x420 [ 936.010882][ T2398] ? __fget_files+0x3a2/0x420 [ 936.010906][ T2398] ? __fget_files+0x2a/0x420 [ 936.010940][ T2398] ksys_read+0x150/0x270 [ 936.010970][ T2398] ? __pfx_ksys_read+0x10/0x10 [ 936.011011][ T2398] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.011040][ T2398] do_syscall_64+0x174/0x580 [ 936.011067][ T2398] ? trace_irq_disable+0x3b/0x140 [ 936.011091][ T2398] ? clear_bhb_loop+0x40/0x90 [ 936.011116][ T2398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.011135][ T2398] RIP: 0033:0x7fea7ad5e68e [ 936.011154][ T2398] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 936.011171][ T2398] RSP: 002b:00007fea7bc91fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 936.011191][ T2398] RAX: ffffffffffffffda RBX: 00007fea7bc926c0 RCX: 00007fea7ad5e68e [ 936.011205][ T2398] RDX: 000000000000000f RSI: 00007fea7bc920a0 RDI: 0000000000000004 [ 936.011217][ T2398] RBP: 00007fea7bc92090 R08: 0000000000000000 R09: 0000000000000000 [ 936.011230][ T2398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 936.011241][ T2398] R13: 00007fea7b026038 R14: 00007fea7b025fa0 R15: 00007ffd357dc308 [ 936.011276][ T2398] [ 936.538604][ T2432] veth0: Caught tx_queue_len zero misconfig [ 936.603660][ T2432] netlink: 'syz.0.8825': attribute type 3 has an invalid length. [ 936.671537][ T2444] netlink: 'syz.3.8828': attribute type 17 has an invalid length. [ 936.937742][ T2453] syzkaller1: entered promiscuous mode [ 936.950146][ T2453] syzkaller1: entered allmulticast mode [ 937.105319][ T2468] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 937.182600][ T2464] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 937.442384][ T2475] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 938.046544][ T2532] netlink: 'syz.4.8850': attribute type 8 has an invalid length. [ 938.104133][ T2532] netlink: 'syz.4.8850': attribute type 1 has an invalid length. [ 938.169389][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 938.264286][ T2522] syzkaller0: entered promiscuous mode [ 938.291331][ T2522] syzkaller0: entered allmulticast mode [ 938.685648][ T2568] bridge16: entered promiscuous mode [ 938.746060][ T2564] veth7: left promiscuous mode [ 938.766048][ T2564] veth9: left promiscuous mode [ 938.782991][ T2564] veth11: left promiscuous mode [ 938.798658][ T2564] veth13: left promiscuous mode [ 938.813065][ T2564] veth15: left promiscuous mode [ 938.829125][ T2564] veth17: left promiscuous mode [ 938.837452][ T2564] xfrm1: left allmulticast mode [ 938.843580][ T2564] bridge0: left allmulticast mode [ 938.849104][ T2564] veth19: left promiscuous mode [ 938.856600][ T2564] bond18: left promiscuous mode [ 938.871721][ T2564] bond18: left allmulticast mode [ 938.883786][ T2564] bridge3: left promiscuous mode [ 938.909973][ T2564] bridge3: left allmulticast mode [ 938.930052][ T2564] geneve2: left promiscuous mode [ 938.940637][ T2564] bond19: left promiscuous mode [ 938.946986][ T2564] sit3: left promiscuous mode [ 938.966438][ T2564] sit3: left allmulticast mode [ 938.972949][ T2564] gretap3: left promiscuous mode [ 938.978266][ T2564] bond21: left promiscuous mode [ 938.984650][ T2564] gtp2: left promiscuous mode [ 938.990558][ T2564] gtp2: left allmulticast mode [ 938.995845][ T2564] vlan2: left allmulticast mode [ 939.001455][ T2564] bridge5: left allmulticast mode [ 939.006919][ T2564] vlan3: left allmulticast mode [ 939.015373][ T2564] bridge6: left allmulticast mode [ 939.021895][ T2564] bond23: left promiscuous mode [ 939.027636][ T2564] mac80211_hwsim hwsim27 syzkaller0: left promiscuous mode [ 939.036127][ T2564] mac80211_hwsim hwsim27 syzkaller0: left allmulticast mode [ 939.045403][ T2564] vlan4: left allmulticast mode [ 939.051053][ T2564] bridge8: left allmulticast mode [ 939.056796][ T2564] vlan5: left allmulticast mode [ 939.062745][ T2564] bridge9: left allmulticast mode [ 939.071544][ T2564] gtp3: left allmulticast mode [ 939.076862][ T2564] ip6gre3: left allmulticast mode [ 939.088315][ T2564] bond25: left allmulticast mode [ 939.097652][ T2564] bond26: left promiscuous mode [ 939.104884][ T2564] bond26: left allmulticast mode [ 939.112033][ T2564] bond27: left promiscuous mode [ 939.128133][ T2564] gretap4: left promiscuous mode [ 939.133905][ T2564] gretap4: left allmulticast mode [ 939.142081][ T2564] bond0: left promiscuous mode [ 939.153181][ T2564] bridge16: left promiscuous mode [ 939.172559][ T2590] syzkaller1: entered promiscuous mode [ 939.191397][ T2590] syzkaller1: entered allmulticast mode [ 939.795960][ T2647] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 939.807513][ T2632] smc: net device team0 applied user defined pnetid SYZ2 [ 939.825416][ T2644] __nla_validate_parse: 8 callbacks suppressed [ 939.825436][ T2644] netlink: 128 bytes leftover after parsing attributes in process `syz.0.8871'. [ 939.858268][ T2644] netlink: 128 bytes leftover after parsing attributes in process `syz.0.8871'. [ 940.014510][ T2654] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8874'. [ 940.078317][ T2661] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8875'. [ 940.215074][ T2664] syzkaller1: entered promiscuous mode [ 940.235281][ T2664] syzkaller1: entered allmulticast mode [ 940.562437][ T2686] netlink: 80 bytes leftover after parsing attributes in process `syz.3.8880'. [ 940.863325][ T2708] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8884'. [ 940.865689][ T2710] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8885'. [ 940.885296][ T2704] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 940.891569][ T2712] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8886'. [ 940.928066][ T2708] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 940.930599][ T2710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8885'. [ 940.976192][ T2710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8885'. [ 941.064745][ T2715] erspan0: left allmulticast mode [ 941.096575][ T2715] erspan0: left promiscuous mode [ 941.111060][ T2715] bridge18: port 1(erspan0) entered disabled state [ 941.153566][ T2715] bond21: (slave veth0_to_bond): Releasing active interface [ 941.217975][ T2715] bond20: (slave geneve2): Releasing active interface [ 941.244479][ T2715] bond25: (slave geneve4): Releasing active interface [ 941.302485][T30391] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 941.584368][ T2756] ip6gre0: Master is either lo or non-ether device [ 941.884530][ T48] tipc: Subscription rejected, illegal request [ 941.979472][T30391] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 942.063059][ T5290] veth0_vlan: left promiscuous mode [ 942.098993][ T24] veth0_vlan: entered promiscuous mode [ 942.268172][ T2788] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 942.424805][ T2796] netlink: 'syz.3.8901': attribute type 12 has an invalid length. [ 942.446958][ T2791] syzkaller1: entered promiscuous mode [ 942.450141][ T2796] netlink: 'syz.3.8901': attribute type 1 has an invalid length. [ 942.484537][ T2791] syzkaller1: entered allmulticast mode [ 942.526096][ T2797] team0: Device gtp4 is up. Set it down before adding it as a team port [ 942.564122][ T2799] erspan0: left promiscuous mode [ 942.571720][ T2799] bridge0: port 1(erspan0) entered disabled state [ 942.592667][ T2799] vlan5: left promiscuous mode [ 942.607091][ T2799] geneve0: left promiscuous mode [ 942.614595][ T2808] netlink: 'syz.3.8901': attribute type 2 has an invalid length. [ 942.650458][ T2799] team0: Port device bridge11 removed [ 942.687070][ T2799] bond30: (slave bridge12): Releasing backup interface [ 942.700832][ T2799] bridge12: left promiscuous mode [ 942.706686][ T2799] bridge12: left allmulticast mode [ 942.722435][ T2814] sctp: [Deprecated]: syz.0.8905 (pid 2814) Use of int in max_burst socket option deprecated. [ 942.722435][ T2814] Use struct sctp_assoc_value instead [ 942.727839][ T2799] vlan5: left allmulticast mode [ 942.763139][ T2799] geneve0: left allmulticast mode [ 942.771773][ T2799] bridge0: port 2(vlan5) entered disabled state [ 943.331396][ T2850] netlink: 'syz.4.8911': attribute type 23 has an invalid length. [ 943.360591][ T2846] 8021q: adding VLAN 0 to HW filter on device bond35 [ 943.478630][ T2846] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 943.503533][ T2866] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 943.793604][ T2878] FAULT_INJECTION: forcing a failure. [ 943.793604][ T2878] name failslab, interval 1, probability 0, space 0, times 0 [ 943.827249][ T2878] CPU: 0 UID: 0 PID: 2878 Comm: syz.4.8915 Not tainted syzkaller #0 PREEMPT(full) [ 943.827276][ T2878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 943.827288][ T2878] Call Trace: [ 943.827296][ T2878] [ 943.827306][ T2878] dump_stack_lvl+0xe8/0x150 [ 943.827340][ T2878] should_fail_ex+0x40c/0x560 [ 943.827367][ T2878] should_failslab+0xa8/0x100 [ 943.827396][ T2878] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 943.827419][ T2878] ? local_lock_release+0x9c/0x160 [ 943.827456][ T2878] ? __alloc_skb+0x1d7/0x7a0 [ 943.827483][ T2878] ? __alloc_skb+0x1d7/0x7a0 [ 943.827514][ T2878] __alloc_skb+0x1d7/0x7a0 [ 943.827544][ T2878] netlink_ack+0x136/0xb30 [ 943.827571][ T2878] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 943.827599][ T2878] ? __lock_acquire+0x683/0x2cf0 [ 943.827637][ T2878] netlink_rcv_skb+0x2a4/0x4a0 [ 943.827668][ T2878] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 943.827696][ T2878] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 943.827737][ T2878] ? netlink_deliver_tap+0x2e/0x1b0 [ 943.827765][ T2878] ? netlink_deliver_tap+0x2e/0x1b0 [ 943.827799][ T2878] netlink_unicast+0x7bb/0x940 [ 943.827837][ T2878] netlink_sendmsg+0x813/0xb40 [ 943.827866][ T2878] ? __pfx_netlink_sendmsg+0x10/0x10 [ 943.827893][ T2878] ? aa_sock_msg_perm+0xf1/0x1b0 [ 943.827918][ T2878] ? __pfx_netlink_sendmsg+0x10/0x10 [ 943.827935][ T2878] sock_sendmsg_nosec+0x13a/0x180 [ 943.827961][ T2878] ____sys_sendmsg+0x54e/0x850 [ 943.827996][ T2878] ? __pfx_____sys_sendmsg+0x10/0x10 [ 943.828033][ T2878] ? import_iovec+0x73/0xa0 [ 943.828064][ T2878] ___sys_sendmsg+0x2a5/0x360 [ 943.828090][ T2878] ? __lock_acquire+0x683/0x2cf0 [ 943.828119][ T2878] ? __pfx____sys_sendmsg+0x10/0x10 [ 943.828183][ T2878] ? __fget_files+0x2a/0x420 [ 943.828207][ T2878] ? __fget_files+0x3a2/0x420 [ 943.828242][ T2878] __x64_sys_sendmsg+0x1b1/0x290 [ 943.828274][ T2878] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 943.828321][ T2878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.828343][ T2878] do_syscall_64+0x174/0x580 [ 943.828370][ T2878] ? trace_irq_disable+0x3b/0x140 [ 943.828393][ T2878] ? clear_bhb_loop+0x40/0x90 [ 943.828416][ T2878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 943.828442][ T2878] RIP: 0033:0x7f4f33d9de59 [ 943.828460][ T2878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 943.828476][ T2878] RSP: 002b:00007f4f34bc2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 943.828498][ T2878] RAX: ffffffffffffffda RBX: 00007f4f34025fa0 RCX: 00007f4f33d9de59 [ 943.828513][ T2878] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 943.828524][ T2878] RBP: 00007f4f34bc2090 R08: 0000000000000000 R09: 0000000000000000 [ 943.828536][ T2878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 943.828547][ T2878] R13: 00007f4f34026038 R14: 00007f4f34025fa0 R15: 00007ffebfb5fb48 [ 943.828580][ T2878] [ 944.220325][ T2889] mac80211_hwsim hwsim27 syzkaller0: entered promiscuous mode [ 944.257593][ T2889] mac80211_hwsim hwsim27 syzkaller0: entered allmulticast mode [ 944.291019][ T2895] netlink: zone id is out of range [ 944.296623][ T2895] netlink: zone id is out of range [ 944.302266][ T2895] netlink: zone id is out of range [ 944.311057][ T2895] netlink: zone id is out of range [ 944.317044][ T2895] netlink: zone id is out of range [ 944.322361][ T2895] netlink: zone id is out of range [ 944.328095][ T2895] netlink: zone id is out of range [ 944.373856][ T2899] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 944.455700][ T2907] IPv6: NLM_F_CREATE should be specified when creating new route [ 944.478443][ T2907] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 944.486273][ T2907] IPv6: NLM_F_CREATE should be set when creating new route [ 944.683194][ T2919] lo: entered promiscuous mode [ 945.126299][ T2941] __nla_validate_parse: 15 callbacks suppressed [ 945.126320][ T2941] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8931'. [ 945.226308][ T2941] FAULT_INJECTION: forcing a failure. [ 945.226308][ T2941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 945.251031][ T2941] CPU: 1 UID: 0 PID: 2941 Comm: syz.3.8931 Not tainted syzkaller #0 PREEMPT(full) [ 945.251058][ T2941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 945.251070][ T2941] Call Trace: [ 945.251078][ T2941] [ 945.251086][ T2941] dump_stack_lvl+0xe8/0x150 [ 945.251122][ T2941] should_fail_ex+0x40c/0x560 [ 945.251159][ T2941] _copy_to_user+0x31/0xb0 [ 945.251190][ T2941] simple_read_from_buffer+0xe1/0x170 [ 945.251221][ T2941] proc_fail_nth_read+0x1bb/0x230 [ 945.251250][ T2941] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 945.251276][ T2941] ? rw_verify_area+0x24a/0x4c0 [ 945.251304][ T2941] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 945.251330][ T2941] vfs_read+0x213/0xa80 [ 945.251364][ T2941] ? __pfx___mutex_lock+0x10/0x10 [ 945.251393][ T2941] ? __pfx_vfs_read+0x10/0x10 [ 945.251423][ T2941] ? __fget_files+0x2a/0x420 [ 945.251450][ T2941] ? __fget_files+0x3a2/0x420 [ 945.251471][ T2941] ? __fget_files+0x2a/0x420 [ 945.251502][ T2941] ksys_read+0x150/0x270 [ 945.251532][ T2941] ? __pfx_ksys_read+0x10/0x10 [ 945.251569][ T2941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.251591][ T2941] do_syscall_64+0x174/0x580 [ 945.251618][ T2941] ? trace_irq_disable+0x3b/0x140 [ 945.251641][ T2941] ? clear_bhb_loop+0x40/0x90 [ 945.251665][ T2941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 945.251684][ T2941] RIP: 0033:0x7f988355e68e [ 945.251703][ T2941] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 945.251718][ T2941] RSP: 002b:00007f9884462fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 945.251737][ T2941] RAX: ffffffffffffffda RBX: 00007f98844636c0 RCX: 00007f988355e68e [ 945.251750][ T2941] RDX: 000000000000000f RSI: 00007f98844630a0 RDI: 0000000000000006 [ 945.251761][ T2941] RBP: 00007f9884463090 R08: 0000000000000000 R09: 0000000000000000 [ 945.251772][ T2941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 945.251781][ T2941] R13: 00007f9883826038 R14: 00007f9883825fa0 R15: 00007ffe72b0bde8 [ 945.251812][ T2941] [ 945.550086][ T2955] netlink: 'syz.1.8937': attribute type 1 has an invalid length. [ 945.598512][ T2955] netlink: 228 bytes leftover after parsing attributes in process `syz.1.8937'. [ 945.642607][ T2969] smc: net device team0 applied user defined pnetid SYZ2 [ 946.020731][ T2982] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8940'. [ 946.043514][ T2983] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 946.083118][ T2984] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8940'. [ 946.123640][ T2983] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 946.667820][ T3017] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8951'. [ 946.684214][ T3020] xt_hashlimit: invalid rate [ 946.706272][ T3023] net_ratelimit: 515 callbacks suppressed [ 946.706292][ T3023] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 946.736863][ T3020] netlink: 'syz.0.8950': attribute type 1 has an invalid length. [ 946.760137][ T3020] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8950'. [ 946.812510][ T3027] IPVS: length: 159 != 8 [ 946.853882][ T3027] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8953'. [ 946.865117][ T3027] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 946.872775][ T3027] IPv6: NLM_F_CREATE should be set when creating new route [ 946.888042][ T3029] x_tables: duplicate underflow at hook 1 [ 947.062396][ T3037] tipc: New replicast peer: 255.255.255.255 [ 947.080493][ T24] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 947.104574][ T3045] netlink: 'syz.0.8958': attribute type 3 has an invalid length. [ 947.120566][ T3045] netlink: 3 bytes leftover after parsing attributes in process `syz.0.8958'. [ 947.122251][ T3037] tipc: Enabled bearer , priority 10 [ 947.163535][ T3036] tipc: Enabling of bearer rejected, already enabled [ 947.206495][ T3048] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8959'. [ 947.602129][ T3067] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8965'. [ 947.643716][ T3073] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 947.687556][ T3074] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 947.860081][T30384] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 947.977710][ T3091] IPVS: set_ctl: invalid protocol: 59 172.20.20.170:20002 [ 948.464410][ T3118] netlink: 'syz.1.8981': attribute type 10 has an invalid length. [ 948.530771][ T3118] geneve4: entered promiscuous mode [ 948.552075][ T3118] geneve4: entered allmulticast mode [ 948.645490][ T3127] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 948.713117][ T3132] netlink: 'syz.4.8985': attribute type 19 has an invalid length. [ 949.091268][ T3155] netlink: 'syz.2.8990': attribute type 1 has an invalid length. [ 949.705442][ T3179] netlink: 'syz.1.8997': attribute type 21 has an invalid length. [ 950.691482][ T3245] __nla_validate_parse: 12 callbacks suppressed [ 950.691504][ T3245] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9012'. [ 951.385905][ T3276] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9023'. [ 951.455117][ T3278] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9024'. [ 951.456752][ T3276] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 951.504186][ T3276] gretap4: default qdisc (pfifo_fast) fail, fallback to noqueue [ 951.513088][ T3276] gretap4: entered promiscuous mode [ 951.518678][ T3276] gretap4: entered allmulticast mode [ 951.580851][ T3254] siw: device registration error -23 [ 951.927356][ T3300] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9031'. [ 951.978986][ T3300] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9031'. [ 952.086842][ T3307] netlink: 'syz.1.9033': attribute type 1 has an invalid length. [ 952.111095][ T3310] netlink: 68 bytes leftover after parsing attributes in process `syz.4.9034'. [ 952.136714][ T3312] netlink: 9 bytes leftover after parsing attributes in process `syz.3.9035'. [ 952.143263][ T3307] netlink: 'syz.1.9033': attribute type 1 has an invalid length. [ 952.166189][ T3314] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9036'. [ 952.186790][ T3307] netlink: 'syz.1.9033': attribute type 11 has an invalid length. [ 952.211897][ T3307] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9033'. [ 952.634666][ T3344] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9044'. [ 953.024869][ T3358] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 953.866641][ T3397] netlink: 'syz.0.9063': attribute type 1 has an invalid length. [ 953.935225][ T3397] 8021q: adding VLAN 0 to HW filter on device bond29 [ 954.169386][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 954.365248][ T3429] netlink: 'syz.1.9072': attribute type 5 has an invalid length. [ 954.453565][ T3442] netlink: 'syz.3.9075': attribute type 1 has an invalid length. [ 954.500856][ T3442] netlink: 'syz.3.9075': attribute type 11 has an invalid length. [ 954.596460][ T3452] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 954.728166][ T3459] netlink: 'syz.3.9080': attribute type 1 has an invalid length. [ 954.775320][ T3460] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 954.819151][ T3459] 8021q: adding VLAN 0 to HW filter on device bond28 [ 954.848690][ T3471] bond28: (slave dummy0): making interface the new active one [ 954.860141][ T3471] bond28: (slave dummy0): Enslaving as an active interface with an up link [ 954.922427][ T3459] : renamed from dummy0 (while UP) [ 955.049055][ T3479] bridge25: entered promiscuous mode [ 955.093016][ T3478] syzkaller0: entered promiscuous mode [ 955.103018][ T3478] syzkaller0: entered allmulticast mode [ 955.677974][ T3500] syzkaller1: entered promiscuous mode [ 955.709518][ T3500] syzkaller1: entered allmulticast mode [ 955.726238][ T3504] bond28: (slave ): Releasing active interface [ 956.015037][ T3517] bridge20: entered promiscuous mode [ 956.083097][ T3522] vlan1: Caught tx_queue_len zero misconfig [ 956.142356][ T3524] __nla_validate_parse: 14 callbacks suppressed [ 956.142378][ T3524] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9098'. [ 956.377312][ T3533] veth1: Caught tx_queue_len zero misconfig [ 956.404482][ T3533] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9101'. [ 957.428599][ T3566] team0: Master is either lo or non-ether device [ 957.626432][ T3580] lo: left promiscuous mode [ 957.646799][ T3580] tunl0: left promiscuous mode [ 957.677858][ T3580] gre0: left promiscuous mode [ 957.704594][ T3580] gretap0: left promiscuous mode [ 957.719126][ T3580] erspan0: left promiscuous mode [ 957.731179][ T3580] ip_vti0: left promiscuous mode [ 957.760346][ T3580] ip6_vti0: left promiscuous mode [ 957.783774][ T3580] sit0: left promiscuous mode [ 957.801936][ T3580] ip6tnl0: left promiscuous mode [ 957.813761][ T3580] ip6gre0: left promiscuous mode [ 957.829726][ T3580] syz_tun: left promiscuous mode [ 957.844779][ T3580] ip6gretap0: left promiscuous mode [ 957.860337][ T3580] : left promiscuous mode [ 957.873708][ T3580] nlmon0: left promiscuous mode [ 957.883493][ T3580] batadv0: left promiscuous mode [ 957.889051][ T3580] veth0: left promiscuous mode [ 957.897357][ T3580] veth1: left promiscuous mode [ 957.932269][ T3580] wg0: left promiscuous mode [ 957.954749][ T3580] wg2: left promiscuous mode [ 957.969515][ T3580] veth1_to_bridge: left promiscuous mode [ 957.983394][ T3580] bridge_slave_1: left promiscuous mode [ 957.992046][ T3580] veth0_to_bond: left promiscuous mode [ 957.998508][ T3580] ªªªªªª: left promiscuous mode [ 958.005034][ T3580] veth0_to_team: left promiscuous mode [ 958.012685][ T3580] team_slave_0: left promiscuous mode [ 958.019532][ T3580] veth1_to_team: left promiscuous mode [ 958.025609][ T3580] team_slave_1: left promiscuous mode [ 958.032338][ T3580] veth0_to_batadv: left promiscuous mode [ 958.039569][ T3580] veth1_to_batadv: left promiscuous mode [ 958.047049][ T3580] batadv_slave_1: left promiscuous mode [ 958.053650][ T3580] xfrm0: left promiscuous mode [ 958.060972][ T3580] veth0_to_hsr: left promiscuous mode [ 958.067179][ T3580] hsr_slave_0: left promiscuous mode [ 958.067447][ T3596] netlink: 'syz.4.9115': attribute type 2 has an invalid length. [ 958.073288][ T3580] veth1_to_hsr: left promiscuous mode [ 958.090169][ T3580] hsr_slave_1: left promiscuous mode [ 958.096421][ T3580] veth1_virt_wifi: left promiscuous mode [ 958.103799][ T3580] veth0_virt_wifi: left promiscuous mode [ 958.110108][ T3580] virt_wifi0: left promiscuous mode [ 958.115970][ T3580] vlan0: left promiscuous mode [ 958.121898][ T3580] vlan1: left promiscuous mode [ 958.127718][ T3580] v: left promiscuous mode [ 958.134028][ T3580] macvlan0: left promiscuous mode [ 958.140677][ T3580] macvlan1: left promiscuous mode [ 958.146973][ T3580] ipvlan0: left promiscuous mode [ 958.154237][ T3580] ipvlan1: left promiscuous mode [ 958.170409][ T3580] macvtap0: left promiscuous mode [ 958.176059][ T3580] macsec0: left promiscuous mode [ 958.183018][ T3580] geneve1: left promiscuous mode [ 958.188866][ T3580] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 958.198255][ T3580] netdevsim netdevsim1 netdevsim1: left promiscuous mode [ 958.206475][ T3580] netdevsim netdevsim1 netdevsim2: left promiscuous mode [ 958.214333][ T3580] netdevsim netdevsim1 netdevsim3: left promiscuous mode [ 958.222166][ T3580] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 958.230480][ T3580] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 958.237827][ T3580] ipip0: left promiscuous mode [ 958.243386][ T3580] macvlan2: left promiscuous mode [ 958.248665][ T3580] gre1: left promiscuous mode [ 958.254432][ T3580] ip6tnl1: left promiscuous mode [ 958.259988][ T3580] veth2: left promiscuous mode [ 958.265133][ T3580] veth3: left promiscuous mode [ 958.270634][ T3580] bridge1: left promiscuous mode [ 958.276051][ T3580] gtp0: left promiscuous mode [ 958.281816][ T3580] bond1: left promiscuous mode [ 958.286930][ T3580] ip6gretap1: left promiscuous mode [ 958.292740][ T3580] bridge2: left promiscuous mode [ 958.298105][ T3580] bond2: left promiscuous mode [ 958.303547][ T3580] veth4: left promiscuous mode [ 958.308563][ T3580] veth5: left promiscuous mode [ 958.314463][ T3580] : left promiscuous mode [ 958.319254][ T3580] veth6: left promiscuous mode [ 958.324547][ T3580] veth7: left promiscuous mode [ 958.330148][ T3580] bond3: left promiscuous mode [ 958.336608][ T3580] sit1: left promiscuous mode [ 958.342505][ T3580] sit2: left promiscuous mode [ 958.347606][ T3580] ip6tnl2: left promiscuous mode [ 958.353015][ T3580] sit3: left promiscuous mode [ 958.358001][ T3580] bond4: left promiscuous mode [ 958.363991][ T3580] bridge3: left promiscuous mode [ 958.370368][ T3580] bridge4: left promiscuous mode [ 958.375786][ T3580] dvmrp0: left promiscuous mode [ 958.381177][ T3580] bond5: left promiscuous mode [ 958.386280][ T3580] veth8: left promiscuous mode [ 958.391676][ T3580] veth9: left promiscuous mode [ 958.396935][ T3580] batadv_slave_0.: left promiscuous mode [ 958.403229][ T3580] batadv_slave_0: left promiscuous mode [ 958.409642][ T3580] gretap1: left promiscuous mode [ 958.414962][ T3580] bond6: left promiscuous mode [ 958.422068][ T3580] ip6gretap2: left promiscuous mode [ 958.427490][ T3580] veth10: left promiscuous mode [ 958.448827][ T3580] veth11: left promiscuous mode [ 958.455258][ T3580] mac80211_hwsim hwsim15 wlan2: left promiscuous mode [ 958.463031][ T3580] mac80211_hwsim hwsim16 wlan3: left promiscuous mode [ 958.477815][ T3580] bridge5: left promiscuous mode [ 958.483435][ T3580] bond7: left promiscuous mode [ 958.488354][ T3580] veth12: left promiscuous mode [ 958.494454][ T3580] veth13: left promiscuous mode [ 958.500005][ T3580] geneve2: left promiscuous mode [ 958.505643][ T3580] bridge6: left promiscuous mode [ 958.511391][ T3580] macvlan3: left promiscuous mode [ 958.516825][ T3580] mac80211_hwsim hwsim21 wlan4: left promiscuous mode [ 958.525065][ T3580] mac80211_hwsim hwsim22 wlan5: left promiscuous mode [ 958.533085][ T3580] erspan1: left promiscuous mode [ 958.538716][ T3580] ip6gre1: left promiscuous mode [ 958.544542][ T3580] ip6erspan0: left promiscuous mode [ 958.550411][ T3580] bond8: left promiscuous mode [ 958.555469][ T3580] mac80211_hwsim hwsim23 wlan6: left promiscuous mode [ 958.563489][ T3580] bond9: left promiscuous mode [ 958.568546][ T3580] bond10: left promiscuous mode [ 958.573916][ T3580] ip6gre2: left promiscuous mode [ 958.579981][ T3580] bond11: left promiscuous mode [ 958.585091][ T3580] mac80211_hwsim hwsim24 wlan7: left promiscuous mode [ 958.593136][ T3580] bond12: left promiscuous mode [ 958.598314][ T3580] wireguard0: left promiscuous mode [ 958.603963][ T3580] mac80211_hwsim hwsim30 wlan8: left promiscuous mode [ 958.611756][ T3580] bond13: left promiscuous mode [ 958.617054][ T3580] veth14: left promiscuous mode [ 958.622244][ T3580] veth15: left promiscuous mode [ 958.627595][ T3580] bond14: left promiscuous mode [ 958.633111][ T3580] veth16: left promiscuous mode [ 958.638304][ T3580] veth17: left promiscuous mode [ 958.644088][ T3580] vlan2: left promiscuous mode [ 958.649076][ T3580] geneve0: left promiscuous mode [ 958.655116][ T3580] bond0: left promiscuous mode [ 958.660326][ T3580] gretap2: left promiscuous mode [ 958.665624][ T3580] bond15: left promiscuous mode [ 958.671303][ T3580] veth18: left promiscuous mode [ 958.676410][ T3580] veth19: left promiscuous mode [ 958.681796][ T3580] bond16: left promiscuous mode [ 958.687397][ T3580] veth20: left promiscuous mode [ 958.692797][ T3580] veth21: left promiscuous mode [ 958.698177][ T3580] batadv1: left promiscuous mode [ 958.704170][ T3580] bond17: left promiscuous mode [ 958.709811][ T3580] gretap3: left promiscuous mode [ 958.714917][ T3580] bond18: left promiscuous mode [ 958.720219][ T3580] macsec1: left promiscuous mode [ 958.725584][ T3580] mac80211_hwsim hwsim37 wlan9: left promiscuous mode [ 958.734122][ T3580] bond19: left promiscuous mode [ 958.739831][ T3580] bridge7: left promiscuous mode [ 958.745212][ T3580] bridge8: left promiscuous mode [ 958.750597][ T3580] ip6erspan1: left promiscuous mode [ 958.755978][ T3580] sit4: left promiscuous mode [ 958.761641][ T3580] bridge9: left promiscuous mode [ 958.766983][ T3580] mac80211_hwsim hwsim40 wlan10: left promiscuous mode [ 958.774254][ T3580] sit5: left promiscuous mode [ 958.779105][ T3580] sit6: left promiscuous mode [ 958.784281][ T3580] sit7: left promiscuous mode [ 958.790255][ T3580] sit8: left promiscuous mode [ 958.795452][ T3580] sit9: left promiscuous mode [ 958.800644][ T3580] macsec2: left promiscuous mode [ 958.805992][ T3580] bond20: left promiscuous mode [ 958.811274][ T3580] bridge10: left promiscuous mode [ 958.816832][ T3580] mac80211_hwsim hwsim50 wlan11: left promiscuous mode [ 958.824749][ T3580] mac80211_hwsim hwsim51 wlan12: left promiscuous mode [ 958.832047][ T3580] bridge11: left promiscuous mode [ 958.837529][ T3580] erspan2: left promiscuous mode [ 958.843984][ T3580] vlan3: left promiscuous mode [ 958.850232][ T3580] bridge12: left promiscuous mode [ 958.855955][ T3580] veth22: left promiscuous mode [ 958.861742][ T3580] veth23: left promiscuous mode [ 958.867006][ T3580] mac80211_hwsim hwsim58 wlan13: left promiscuous mode [ 958.874895][ T3580] bridge13: left promiscuous mode [ 958.880912][ T3580] bridge14: left promiscuous mode [ 958.886754][ T3580] bond21: left promiscuous mode [ 958.893965][ T3580] bridge15: left promiscuous mode [ 958.900566][ T3580] bridge16: left promiscuous mode [ 958.906025][ T3580] bond22: left promiscuous mode [ 958.911613][ T3580] vlan4: left promiscuous mode [ 958.916451][ T3580] bridge17: left promiscuous mode [ 958.922486][ T3580] vlan5: left promiscuous mode [ 958.927497][ T3580] bridge18: left promiscuous mode [ 958.933680][ T3580] vxcan0: left promiscuous mode [ 958.938794][ T3580] vxcan1: left promiscuous mode [ 958.944534][ T3580] bridge19: left promiscuous mode [ 958.950123][ T3580] mac80211_hwsim hwsim66 wlan14: left promiscuous mode [ 958.958080][ T3580] bond23: left promiscuous mode [ 958.964540][ T3580] bond23: left allmulticast mode [ 958.974672][ T3580] vti0: left promiscuous mode [ 958.980084][ T3580] vti0: left allmulticast mode [ 958.991777][ T3580] bond26: left promiscuous mode [ 959.001455][ T3580] geneve3: left promiscuous mode [ 959.006835][ T3580] geneve3: left allmulticast mode [ 959.015164][ T3580] bond27: left promiscuous mode [ 959.072614][T20840] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 959.105270][T20840] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 256 - 0 [ 959.143335][T20840] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 959.164481][T20840] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 256 - 0 [ 959.223781][T20840] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 959.258783][T20840] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 256 - 0 [ 959.272601][T20840] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 959.290557][T20840] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 256 - 0 [ 959.479400][ T3616] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9122'. [ 959.505970][ T3616] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9122'. [ 959.747230][ T3637] mac80211_hwsim hwsim27 syzkaller0: left promiscuous mode [ 959.759000][ T3637] mac80211_hwsim hwsim27 syzkaller0: left allmulticast mode [ 959.978038][ T3644] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 960.246302][ T3661] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9140'. [ 960.262241][ T3665] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9138'. [ 960.289516][ T3661] tunl0: Caught tx_queue_len zero misconfig [ 960.296749][ T3658] syzkaller1: entered promiscuous mode [ 960.308616][ T3658] syzkaller1: entered allmulticast mode [ 960.339306][ T3668] netlink: 65011 bytes leftover after parsing attributes in process `syz.0.9140'. [ 960.779780][ T3694] netlink: 'syz.1.9151': attribute type 2 has an invalid length. [ 960.780691][ T3696] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9152'. [ 960.998074][ T3710] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 961.134368][ T3718] x_tables: unsorted underflow at hook 1 [ 961.270673][T30391] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 961.596004][ T3744] syzkaller1: entered promiscuous mode [ 961.634718][ T3744] syzkaller1: entered allmulticast mode [ 961.782199][T30391] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 962.000119][ T3762] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9169'. [ 962.186183][ T3774] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9172'. [ 962.201343][ T3774] netlink: 'syz.1.9172': attribute type 30 has an invalid length. [ 962.221807][T20837] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.238809][ T3777] netlink: 'syz.3.9174': attribute type 2 has an invalid length. [ 962.252152][T20837] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.262227][T20837] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.272573][T20837] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 962.293033][ T3782] netlink: 'syz.0.9177': attribute type 8 has an invalid length. [ 962.335887][ T3782] sch_fq: defrate 0 ignored. [ 962.546026][ T3795] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9180'. [ 962.561590][ T3794] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9181'. [ 962.768395][ T3813] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9185'. [ 962.868494][ T3818] netlink: 'syz.3.9184': attribute type 12 has an invalid length. [ 963.026698][ T3824] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9188'. [ 963.063681][ T3830] netlink: 404 bytes leftover after parsing attributes in process `syz.0.9187'. [ 963.093447][ T3830] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9187'. [ 963.114880][ T3830] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9187'. [ 963.167194][ T3838] netlink: 'syz.3.9190': attribute type 4 has an invalid length. [ 963.194480][ T3830] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9187'. [ 963.487351][ T3849] : renamed from bond0 [ 963.645187][ T3854] netlink: 'syz.3.9196': attribute type 1 has an invalid length. [ 963.671523][ T3854] netlink: 'syz.3.9196': attribute type 2 has an invalid length. [ 963.851253][ T3869] netlink: 'syz.1.9200': attribute type 2 has an invalid length. [ 964.116806][ T3878] macsec2: entered promiscuous mode [ 964.136713][ T3878] bridge0: entered promiscuous mode [ 964.142952][ T3878] macsec2: entered allmulticast mode [ 964.152836][ T3878] bridge0: entered allmulticast mode [ 964.165683][ T3878] bridge0: port 2(macsec2) entered blocking state [ 964.177110][ T3878] bridge0: port 2(macsec2) entered disabled state [ 964.222649][ T3878] bridge0: left allmulticast mode [ 964.237301][ T3878] bridge0: left promiscuous mode [ 964.271934][ T3892] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 964.532168][ T3907] netlink: 'syz.2.9214': attribute type 1 has an invalid length. [ 964.635672][ T3907] bond37: entered promiscuous mode [ 964.661799][ T3907] 8021q: adding VLAN 0 to HW filter on device bond37 [ 964.777315][ T3918] 8021q: adding VLAN 0 to HW filter on device bond37 [ 964.797999][ T3918] bond37: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 964.816212][ T3918] bond37: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 964.841906][ T3918] bond37: (slave ip6gre1): making interface the new active one [ 964.859295][ T3918] ip6gre1: entered promiscuous mode [ 964.866339][ T3918] bond37: (slave ip6gre1): Enslaving as an active interface with an up link [ 964.886891][ T8314] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 964.900690][ T8314] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 964.975926][ T8314] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 964.993092][ T8314] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 965.218598][ T3941] 8021q: adding VLAN 0 to HW filter on device bond29 [ 965.261104][ T3946] vlan6: entered promiscuous mode [ 965.267041][ T3946] bond29: entered promiscuous mode [ 965.273608][ T3946] vlan6: entered allmulticast mode [ 965.279877][ T3946] bond29: entered allmulticast mode [ 965.314516][ T3947] team_slave_1: Caught tx_queue_len zero misconfig [ 965.398876][ T3941] bond29: (slave bridge20): making interface the new active one [ 965.421385][ T3941] bridge20: entered promiscuous mode [ 965.428146][ T3941] bridge20: entered allmulticast mode [ 965.435735][ T3941] bond29: (slave bridge20): Enslaving as an active interface with an up link [ 965.487502][ T3952] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 965.855562][ T3976] lo: left promiscuous mode [ 965.867048][ T3973] xt_hashlimit: size too large, truncated to 1048576 [ 965.875042][ T3976] tunl0: left promiscuous mode [ 965.893313][ T3976] gre0: left promiscuous mode [ 965.911911][ T3976] gretap0: left promiscuous mode [ 965.957101][ T3976] ip_vti0: left promiscuous mode [ 965.987244][ T3976] netdevsim netdevsim0 : left promiscuous mode [ 966.014433][ T3976] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 966.082005][ T3976] veth3: left promiscuous mode [ 966.104571][ T3976] veth5: left promiscuous mode [ 966.149941][ T3976] veth7: left promiscuous mode [ 966.180026][ T3976] bridge1: left promiscuous mode [ 966.204353][ T3976] bridge1: left allmulticast mode [ 966.220373][ T3976] veth13: left promiscuous mode [ 966.231153][ T3976] veth15: left promiscuous mode [ 966.247084][ T3976] bond9: left promiscuous mode [ 966.260828][ T3976] veth19: left promiscuous mode [ 966.271766][ T3976] xfrm1: left promiscuous mode [ 966.293600][ T3976] xfrm1: left allmulticast mode [ 966.302070][ T3976] bond12: left promiscuous mode [ 966.320722][ T3976] veth23: left promiscuous mode [ 966.327815][ T3976] veth25: left promiscuous mode [ 966.342614][ T3976] gretap1: left promiscuous mode [ 966.347866][ T3976] gretap1: left allmulticast mode [ 966.355200][ T3976] bridge2: left promiscuous mode [ 966.364591][ T3976] vlan4: left allmulticast mode [ 966.377660][ T3976] bridge9: left allmulticast mode [ 966.392889][ T3976] vlan0: left allmulticast mode [ 966.397978][ T3976] bridge10: left allmulticast mode [ 966.404252][ T3976] veth27: left allmulticast mode [ 966.457950][ T3976] bridge20: left promiscuous mode [ 966.502903][ T3988] 0ªX¹¦Dö»: renamed from gretap0 [ 966.526824][ T3988] 0ªX¹¦Dö»: entered allmulticast mode [ 966.543172][ T3990] gre0: Caught tx_queue_len zero misconfig [ 966.987383][ T4017] ip6erspan1: entered promiscuous mode [ 967.019143][ T4019] __nla_validate_parse: 24 callbacks suppressed [ 967.035513][ T4019] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9243'. [ 967.217048][ T4002] netlink: 1 bytes leftover after parsing attributes in process `syz.0.9237'. [ 967.288285][ T4002] xt_policy: neither incoming nor outgoing policy selected [ 967.593311][ T4057] bond29: (slave bridge20): Releasing active interface [ 967.620573][ T4057] bridge20: left promiscuous mode [ 967.643901][ T4057] bridge20: left allmulticast mode [ 967.695940][ T4067] validate_nla: 2 callbacks suppressed [ 967.695961][ T4067] netlink: 'syz.0.9257': attribute type 1 has an invalid length. [ 967.774214][ T4070] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9259'. [ 967.948352][ T4070] bridge24: the hash_elasticity option has been deprecated and is always 16 [ 967.982165][ T4077] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9260'. [ 968.019677][ T4077] netlink: 'syz.4.9260': attribute type 10 has an invalid length. [ 968.038404][ T4077] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9260'. [ 968.115396][ T4077] geneve6: entered promiscuous mode [ 968.136336][ T4077] geneve6: entered allmulticast mode [ 968.396223][ T4101] netlink: 'syz.1.9271': attribute type 1 has an invalid length. [ 968.397106][ T4100] Cannot find del_set index 3 as target [ 968.592770][ T4101] bond29: entered promiscuous mode [ 968.613482][ T4101] 8021q: adding VLAN 0 to HW filter on device bond29 [ 968.803775][ T4101] bond29: (slave bridge25): making interface the new active one [ 968.836451][ T4101] bridge25: entered promiscuous mode [ 968.857400][ T4101] bond29: (slave bridge25): Enslaving as an active interface with an up link [ 968.868452][ T4093] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 969.242336][ T4136] netlink: 'syz.4.9280': attribute type 21 has an invalid length. [ 969.283982][ T4136] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9280'. [ 969.464956][ T4145] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.9284'. [ 969.630550][ T4093] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 969.702189][ T4155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9287'. [ 969.973254][ T4164] netlink: 'syz.4.9291': attribute type 1 has an invalid length. [ 969.993769][ T4164] netlink: 'syz.4.9291': attribute type 3 has an invalid length. [ 970.006298][ T4166] syz.2.9292: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 970.010133][ T4164] netlink: 224 bytes leftover after parsing attributes in process `syz.4.9291'. [ 970.035556][ T4166] CPU: 0 UID: 0 PID: 4166 Comm: syz.2.9292 Not tainted syzkaller #0 PREEMPT(full) [ 970.035585][ T4166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 970.035599][ T4166] Call Trace: [ 970.035606][ T4166] [ 970.035616][ T4166] dump_stack_lvl+0xe8/0x150 [ 970.035651][ T4166] warn_alloc+0x24c/0x270 [ 970.035678][ T4166] ? stack_depot_save_flags+0x33/0x800 [ 970.035706][ T4166] ? __pfx_warn_alloc+0x10/0x10 [ 970.035733][ T4166] ? kasan_save_track+0x3e/0x80 [ 970.035757][ T4166] ? __kasan_kmalloc+0x93/0xb0 [ 970.035784][ T4166] ? xsk_setsockopt+0x52a/0x960 [ 970.035851][ T4166] ? do_sock_setsockopt+0x17c/0x1b0 [ 970.035879][ T4166] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 970.035906][ T4166] ? do_syscall_64+0x174/0x580 [ 970.035933][ T4166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.035965][ T4166] __vmalloc_node_range_noprof+0x12c/0x1730 [ 970.036024][ T4166] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 970.036054][ T4166] ? __kasan_kmalloc+0x93/0xb0 [ 970.036081][ T4166] ? __kmalloc_cache_noprof+0x32d/0x660 [ 970.036106][ T4166] ? __kmalloc_cache_noprof+0x150/0x660 [ 970.036133][ T4166] vmalloc_user_noprof+0xad/0xe0 [ 970.036154][ T4166] ? xskq_create+0xbf/0x170 [ 970.036180][ T4166] xskq_create+0xbf/0x170 [ 970.036210][ T4166] xsk_init_queue+0x8a/0xe0 [ 970.036239][ T4166] xsk_setsockopt+0x52a/0x960 [ 970.036264][ T4166] ? __fget_files+0x2a/0x420 [ 970.036291][ T4166] ? __pfx_xsk_setsockopt+0x10/0x10 [ 970.036315][ T4166] ? __pfx_aa_sk_perm+0x10/0x10 [ 970.036348][ T4166] ? aa_sock_opt_perm+0xff/0x1a0 [ 970.036373][ T4166] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 970.036394][ T4166] ? __pfx_xsk_setsockopt+0x10/0x10 [ 970.036421][ T4166] do_sock_setsockopt+0x17c/0x1b0 [ 970.036459][ T4166] __x64_sys_setsockopt+0x13d/0x1b0 [ 970.036499][ T4166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.036523][ T4166] do_syscall_64+0x174/0x580 [ 970.036549][ T4166] ? trace_irq_disable+0x3b/0x140 [ 970.036574][ T4166] ? clear_bhb_loop+0x40/0x90 [ 970.036599][ T4166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.036620][ T4166] RIP: 0033:0x7f60e7f9de59 [ 970.036640][ T4166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 970.036658][ T4166] RSP: 002b:00007f60e8eca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 970.036679][ T4166] RAX: ffffffffffffffda RBX: 00007f60e8225fa0 RCX: 00007f60e7f9de59 [ 970.036694][ T4166] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 970.036707][ T4166] RBP: 00007f60e8033e6f R08: 0000000000000004 R09: 0000000000000000 [ 970.036720][ T4166] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 970.036733][ T4166] R13: 00007f60e8226038 R14: 00007f60e8225fa0 R15: 00007fff86b92f18 [ 970.036766][ T4166] [ 970.038453][ T4166] Mem-Info: [ 970.275705][ T4176] netlink: 104 bytes leftover after parsing attributes in process `syz.2.9292'. [ 970.300067][ T4166] active_anon:9665 inactive_anon:0 isolated_anon:0 [ 970.300067][ T4166] active_file:1 inactive_file:43782 isolated_file:0 [ 970.300067][ T4166] unevictable:768 dirty:86 writeback:0 [ 970.300067][ T4166] slab_reclaimable:14266 slab_unreclaimable:133060 [ 970.300067][ T4166] mapped:34837 shmem:4175 pagetables:1579 [ 970.300067][ T4166] sec_pagetables:0 bounce:0 [ 970.300067][ T4166] kernel_misc_reclaimable:0 [ 970.300067][ T4166] free:1280616 free_pcp:9476 free_cma:0 [ 970.461806][ T4166] Node 0 active_anon:38460kB inactive_anon:0kB active_file:4kB inactive_file:174932kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:139348kB dirty:344kB writeback:0kB shmem:15164kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:18168kB pagetables:6176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 970.622808][ T4166] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 970.659771][ T4183] A link change request failed with some changes committed already. Interface 00ªX¹¦Dö» may have been left with an inconsistent configuration, please check. [ 970.684787][ T4166] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 970.717506][ T4166] lowmem_reserve[]: 0 2489 2489 2489 2489 [ 970.732378][ T4166] Node 0 DMA32 free:1161508kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:38660kB inactive_anon:0kB active_file:4kB inactive_file:174932kB unevictable:1536kB writepending:344kB zspages:0kB present:3129332kB managed:2548736kB mlocked:0kB bounce:0kB free_pcp:32912kB local_pcp:14176kB free_cma:0kB [ 970.768676][ T4166] lowmem_reserve[]: 0 0 0 0 0 [ 970.774788][ T4166] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:264kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 970.866113][ T4166] lowmem_reserve[]: 0 0 0 0 0 [ 970.887173][ T4166] Node 1 Normal free:3945468kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:5288kB local_pcp:0kB free_cma:0kB [ 970.932818][ T4166] lowmem_reserve[]: 0 0 0 0 0 [ 970.938090][ T4166] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 970.957910][ T4166] Node 0 DMA32: 181*4kB (UE) 10*8kB (UM) 4*16kB (UME) 115*32kB (UME) 17*64kB (UME) 66*128kB (UME) 68*256kB (UM) 15*512kB (UME) 6*1024kB (UM) 9*2048kB (UME) 268*4096kB (UM) = 1161476kB [ 971.018381][ T4166] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 971.052851][ T4166] Node 1 Normal: 1*4kB (M) 1*8kB (M) 1*16kB (M) 1*32kB (M) 1*64kB (M) 1*128kB (M) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 1*2048kB (U) 962*4096kB (UM) = 3945468kB [ 971.095816][ T4166] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 971.110782][ T4166] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 971.132165][ T4166] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 971.143817][ T4166] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 971.155537][ T4166] 47956 total pagecache pages [ 971.169460][ T4166] 0 pages in swap cache [ 971.177463][ T4166] Free swap = 124996kB [ 971.198170][ T4166] Total swap = 124996kB [ 971.228405][ T4166] 2097051 pages RAM [ 971.251483][ T4166] 0 pages HighMem/MovableOnly [ 971.257088][ T4166] 428186 pages reserved [ 971.262166][ T4166] 0 pages cma reserved [ 971.358076][ T4200] syzkaller1: entered promiscuous mode [ 971.371140][ T4200] syzkaller1: entered allmulticast mode [ 971.816908][ T4228] netlink: 'syz.0.9305': attribute type 1 has an invalid length. [ 971.854225][ T4234] netlink: 'syz.3.9303': attribute type 2 has an invalid length. [ 971.886636][ T4234] netlink: 'syz.3.9303': attribute type 2 has an invalid length. [ 972.022308][ T4244] FAULT_INJECTION: forcing a failure. [ 972.022308][ T4244] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 972.052346][ T4244] CPU: 0 UID: 0 PID: 4244 Comm: syz.4.9308 Not tainted syzkaller #0 PREEMPT(full) [ 972.052373][ T4244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 972.052384][ T4244] Call Trace: [ 972.052392][ T4244] [ 972.052401][ T4244] dump_stack_lvl+0xe8/0x150 [ 972.052437][ T4244] should_fail_ex+0x40c/0x560 [ 972.052465][ T4244] _copy_from_iter+0x1d3/0x1660 [ 972.052489][ T4244] ? kmem_cache_alloc_node_noprof+0x1a1/0x610 [ 972.052515][ T4244] ? rcu_is_watching+0x15/0xb0 [ 972.052543][ T4244] ? trace_kmem_cache_alloc+0x29/0xe0 [ 972.052566][ T4244] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 972.052588][ T4244] ? __pfx__copy_from_iter+0x10/0x10 [ 972.052612][ T4244] ? __alloc_skb+0x276/0x7a0 [ 972.052635][ T4244] ? __alloc_skb+0x276/0x7a0 [ 972.052663][ T4244] ? netlink_sendmsg+0x650/0xb40 [ 972.052681][ T4244] ? skb_put+0x112/0x210 [ 972.052709][ T4244] netlink_sendmsg+0x6c0/0xb40 [ 972.052738][ T4244] ? __pfx_netlink_sendmsg+0x10/0x10 [ 972.052761][ T4244] ? aa_sock_msg_perm+0xf1/0x1b0 [ 972.052785][ T4244] ? __pfx_netlink_sendmsg+0x10/0x10 [ 972.052802][ T4244] sock_sendmsg_nosec+0x13a/0x180 [ 972.052828][ T4244] ____sys_sendmsg+0x54e/0x850 [ 972.052861][ T4244] ? __pfx_____sys_sendmsg+0x10/0x10 [ 972.052894][ T4244] ? import_iovec+0x73/0xa0 [ 972.052925][ T4244] ___sys_sendmsg+0x2a5/0x360 [ 972.052953][ T4244] ? __lock_acquire+0x683/0x2cf0 [ 972.052981][ T4244] ? __pfx____sys_sendmsg+0x10/0x10 [ 972.053054][ T4244] ? __fget_files+0x2a/0x420 [ 972.053078][ T4244] ? __fget_files+0x3a2/0x420 [ 972.053110][ T4244] __x64_sys_sendmsg+0x1b1/0x290 [ 972.053138][ T4244] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 972.053183][ T4244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 972.053203][ T4244] do_syscall_64+0x174/0x580 [ 972.053229][ T4244] ? trace_irq_disable+0x3b/0x140 [ 972.053254][ T4244] ? clear_bhb_loop+0x40/0x90 [ 972.053277][ T4244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 972.053301][ T4244] RIP: 0033:0x7f4f33d9de59 [ 972.053320][ T4244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 972.053338][ T4244] RSP: 002b:00007f4f34bc2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 972.053358][ T4244] RAX: ffffffffffffffda RBX: 00007f4f34025fa0 RCX: 00007f4f33d9de59 [ 972.053372][ T4244] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 972.053385][ T4244] RBP: 00007f4f34bc2090 R08: 0000000000000000 R09: 0000000000000000 [ 972.053397][ T4244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 972.053407][ T4244] R13: 00007f4f34026038 R14: 00007f4f34025fa0 R15: 00007ffebfb5fb48 [ 972.053442][ T4244] [ 972.339645][ T4228] 8021q: adding VLAN 0 to HW filter on device bond0 [ 972.488227][ T4239] 8021q: adding VLAN 0 to HW filter on device bond30 [ 972.500473][ T4239] bond0: (slave bond30): Enslaving as an active interface with a down link [ 972.696515][ T4254] sit12: entered promiscuous mode [ 972.717305][ T4254] sit12: entered allmulticast mode [ 972.823555][ T4272] x_tables: ip_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 972.980744][ T4277] bond31 (unregistering): Released all slaves [ 975.744119][ T4261] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 976.031525][ T4311] FAULT_INJECTION: forcing a failure. [ 976.031525][ T4311] name failslab, interval 1, probability 0, space 0, times 0 [ 976.082719][ T4311] CPU: 1 UID: 0 PID: 4311 Comm: syz.1.9323 Not tainted syzkaller #0 PREEMPT(full) [ 976.082770][ T4311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 976.082788][ T4311] Call Trace: [ 976.082797][ T4311] [ 976.082810][ T4311] dump_stack_lvl+0xe8/0x150 [ 976.082849][ T4311] should_fail_ex+0x40c/0x560 [ 976.082891][ T4311] should_failslab+0xa8/0x100 [ 976.082922][ T4311] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 976.082945][ T4311] ? local_lock_release+0x9c/0x160 [ 976.082971][ T4311] ? __alloc_skb+0x1d7/0x7a0 [ 976.083006][ T4311] ? __alloc_skb+0x1d7/0x7a0 [ 976.083049][ T4311] __alloc_skb+0x1d7/0x7a0 [ 976.083079][ T4311] netlink_sendmsg+0x5d4/0xb40 [ 976.083107][ T4311] ? __pfx_netlink_sendmsg+0x10/0x10 [ 976.083137][ T4311] ? aa_sock_msg_perm+0xf1/0x1b0 [ 976.083159][ T4311] ? __pfx_netlink_sendmsg+0x10/0x10 [ 976.083174][ T4311] sock_sendmsg_nosec+0x13a/0x180 [ 976.083197][ T4311] ____sys_sendmsg+0x54e/0x850 [ 976.083226][ T4311] ? __pfx_____sys_sendmsg+0x10/0x10 [ 976.083257][ T4311] ? import_iovec+0x73/0xa0 [ 976.083284][ T4311] ___sys_sendmsg+0x2a5/0x360 [ 976.083306][ T4311] ? __lock_acquire+0x683/0x2cf0 [ 976.083332][ T4311] ? __pfx____sys_sendmsg+0x10/0x10 [ 976.083386][ T4311] ? __fget_files+0x2a/0x420 [ 976.083409][ T4311] ? __fget_files+0x3a2/0x420 [ 976.083441][ T4311] __x64_sys_sendmsg+0x1b1/0x290 [ 976.083473][ T4311] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 976.083525][ T4311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.083546][ T4311] do_syscall_64+0x174/0x580 [ 976.083575][ T4311] ? trace_irq_disable+0x3b/0x140 [ 976.083601][ T4311] ? clear_bhb_loop+0x40/0x90 [ 976.083624][ T4311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 976.083645][ T4311] RIP: 0033:0x7fe7bc79de59 [ 976.083665][ T4311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 976.083684][ T4311] RSP: 002b:00007fe7bd6a3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 976.083711][ T4311] RAX: ffffffffffffffda RBX: 00007fe7bca25fa0 RCX: 00007fe7bc79de59 [ 976.083726][ T4311] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 976.083738][ T4311] RBP: 00007fe7bd6a3090 R08: 0000000000000000 R09: 0000000000000000 [ 976.083752][ T4311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 976.083765][ T4311] R13: 00007fe7bca26038 R14: 00007fe7bca25fa0 R15: 00007fff8244f538 [ 976.083799][ T4311] [ 976.386437][ T4321] __nla_validate_parse: 3 callbacks suppressed [ 976.386457][ T4321] netlink: 52 bytes leftover after parsing attributes in process `syz.3.9322'. [ 976.404769][ T4321] netlink: 76 bytes leftover after parsing attributes in process `syz.3.9322'. [ 976.417294][ T4321] netlink: 52 bytes leftover after parsing attributes in process `syz.3.9322'. [ 977.035089][ T4341] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9333'. [ 977.071248][ T4341] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9333'. [ 977.835098][ T4391] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9342'. [ 978.175363][ T4406] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9347'. [ 978.228069][ T4409] A link change request failed with some changes committed already. Interface 00ªX¹¦Dö» may have been left with an inconsistent configuration, please check. [ 978.525166][ T4428] netlink: 'syz.1.9352': attribute type 1 has an invalid length. [ 978.660108][ T4433] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9352'. [ 978.789703][ T4439] RDS: rds_bind could not find a transport for fe80::23, load rds_tcp or rds_rdma? [ 979.033977][ T4449] netlink: 'syz.3.9357': attribute type 1 has an invalid length. [ 979.060447][ T4449] netlink: 232 bytes leftover after parsing attributes in process `syz.3.9357'. [ 979.096914][ T4449] netlink: 'syz.3.9357': attribute type 1 has an invalid length. [ 979.182254][ T4451] netlink: 'syz.4.9358': attribute type 1 has an invalid length. [ 979.231119][ T4451] netlink: 232 bytes leftover after parsing attributes in process `syz.4.9358'. [ 979.256108][ T4454] netdevsim netdevsim1: Direct firmware load for ÿ failed with error -2 [ 979.279041][ T4451] netlink: 'syz.4.9358': attribute type 1 has an invalid length. [ 979.290475][ T4454] netdevsim netdevsim1: Falling back to sysfs fallback for: ÿ [ 979.546587][ T4460] vlan12: entered promiscuous mode [ 979.565041][ T4460] bridge0: entered promiscuous mode [ 979.914804][ T4476] bond30: Unable to set down delay as MII monitoring is disabled [ 979.958810][ T4476] bond30 (unregistering): Released all slaves [ 980.149072][ T4487] nbd: must specify a device to reconfigure [ 980.627648][ T4494] syzkaller0: entered promiscuous mode [ 980.634005][ T4494] syzkaller0: entered allmulticast mode [ 980.645600][ T29] audit: type=1800 audit(1784154386.878:42): pid=4517 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.9377" name="memory.events" dev="tmpfs" ino=9670 res=0 errno=0 [ 981.345932][ T4521] netlink: 'syz.4.9380': attribute type 8 has an invalid length. [ 984.949418][ T4995] udevd[4995]: worker [30961] /devices/virtual/block/nbd0 is taking a long time [ 985.300593][ T4570] __nla_validate_parse: 5 callbacks suppressed [ 985.300610][ T4570] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9394'. [ 985.361743][ T4572] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9396'. [ 985.483765][ T4582] netlink: 336 bytes leftover after parsing attributes in process `syz.3.9401'. [ 985.599086][ T4585] bond38: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 985.618424][ T4585] bond38 (unregistering): Released all slaves [ 985.992013][ T4612] netlink: 'syz.3.9412': attribute type 21 has an invalid length. [ 986.002513][ T4612] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9412'. [ 986.169343][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 986.200463][ T4618] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9414'. [ 986.211987][ T4616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9415'. [ 986.285444][ T4624] netlink: 64 bytes leftover after parsing attributes in process `syz.1.9416'. [ 986.630764][ T4645] netlink: 'syz.4.9419': attribute type 1 has an invalid length. [ 986.832960][ T4635] netlink: 'syz.4.9419': attribute type 1 has an invalid length. [ 986.876206][ T4635] netlink: 'syz.4.9419': attribute type 3 has an invalid length. [ 986.909963][ T4635] netlink: 172 bytes leftover after parsing attributes in process `syz.4.9419'. [ 986.931302][ T4635] NCSI netlink: No device for ifindex 813332851 [ 987.031890][ T4667] netlink: 33 bytes leftover after parsing attributes in process `syz.1.9426'. [ 987.085049][ T4667] netlink: 140 bytes leftover after parsing attributes in process `syz.1.9426'. [ 987.264394][ T4667] 8021q: adding VLAN 0 to HW filter on device  [ 987.348175][ T4667] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 987.679018][ T4693] sock: sock_set_timeout: `syz.1.9432' (pid 4693) tries to set negative timeout [ 987.757698][ T4703] openvswitch: netlink: ufid size 41726 bytes exceeds the range (1, 16) [ 987.790205][ T4703] openvswitch: netlink: Message has 512 unknown bytes. [ 988.104893][ T4717] netlink: 'syz.3.9434': attribute type 11 has an invalid length. [ 988.653326][ T4707] netlink: 'syz.0.9433': attribute type 3 has an invalid length. [ 988.723873][ T4744] sch_fq: defrate 0 ignored. [ 988.837085][T20836] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 988.887326][T20836] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 988.935823][T20836] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 988.972388][T20836] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 989.232497][ T4767] xt_limit: Overflow, try lower: 271964/0 [ 989.419846][ T4778] netlink: 'syz.4.9453': attribute type 4 has an invalid length. [ 989.658790][ T4794] veth0: entered promiscuous mode [ 989.705109][ T4794] No such timeout policy "syz0" [ 989.716204][ T4798] netlink: 'syz.2.9456': attribute type 21 has an invalid length. [ 989.754402][ T4789] veth0: left promiscuous mode [ 990.441187][ T4845] netlink: 'syz.3.9469': attribute type 21 has an invalid length. [ 990.463966][ T4845] __nla_validate_parse: 12 callbacks suppressed [ 990.463995][ T4845] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9469'. [ 990.732228][ T4862] netlink: 'syz.0.9470': attribute type 1 has an invalid length. [ 990.764766][ T4863] IPv6: sit13: Disabled Multicast RS [ 990.871700][ T4865] pim6reg: entered allmulticast mode [ 991.243739][ T4886] netlink: 92 bytes leftover after parsing attributes in process `syz.4.9480'. [ 991.355288][ T4894] netlink: 'syz.2.9483': attribute type 21 has an invalid length. [ 991.371604][ T4894] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9483'. [ 991.494294][ T4897] syzkaller1: entered promiscuous mode [ 991.516345][ T4897] syzkaller1: entered allmulticast mode [ 991.536378][ T4908] xt_connbytes: Forcing CT accounting to be enabled [ 991.580619][ T4908] Cannot find set identified by id 65534 to match [ 991.795915][ T4926] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9492'. [ 992.057713][ T4938] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9496'. [ 992.096805][ T4949] netlink: 164 bytes leftover after parsing attributes in process `syz.4.9498'. [ 992.116871][ T4938] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9496'. [ 992.133540][ T4938] netlink: 'syz.0.9496': attribute type 14 has an invalid length. [ 992.142784][ T4938] netlink: 'syz.0.9496': attribute type 13 has an invalid length. [ 992.154416][ T4949] netlink: 164 bytes leftover after parsing attributes in process `syz.4.9498'. [ 992.194164][ T4949] netlink: 60 bytes leftover after parsing attributes in process `syz.4.9498'. [ 992.343829][ T4959] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 992.395646][ T4966] syz.0.9503 (4966) used obsolete PPPIOCDETACH ioctl [ 992.684463][ T4988] netlink: 'syz.0.9506': attribute type 1 has an invalid length. [ 992.692933][ T4988] netlink: 'syz.0.9506': attribute type 4 has an invalid length. [ 992.701341][ T4988] netlink: 9491 bytes leftover after parsing attributes in process `syz.0.9506'. [ 992.877532][ T4945] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 993.327505][ T5008] netlink: 'syz.1.9512': attribute type 10 has an invalid length. [ 993.429013][ T5012] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 993.831343][ T5037] block nbd2: Unsupported socket: should be TCP or UNIX. [ 993.944707][ T5039] veth27: entered promiscuous mode [ 994.738263][ T5090] A link change request failed with some changes committed already. Interface veth1_vlan may have been left with an inconsistent configuration, please check. [ 994.950470][ T5106] tipc: Enabling of bearer rejected, already enabled [ 995.036846][ T5110] bridge26: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 995.106085][ T5116] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 995.237389][ T5126] lo: left allmulticast mode [ 995.260081][ T5126] tunl0: left allmulticast mode [ 995.266295][ T5126] gre0: left allmulticast mode [ 995.275821][ T5126] gretap0: left allmulticast mode [ 995.282985][ T5126] erspan0: left allmulticast mode [ 995.290799][ T5126] ip_vti0: left allmulticast mode [ 995.296556][ T5126] ip6_vti0: left allmulticast mode [ 995.302485][ T5126] sit0: left allmulticast mode [ 995.308407][ T5126] ip6tnl0: left allmulticast mode [ 995.314095][ T5126] ip6gre0: left allmulticast mode [ 995.321882][ T5126] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 995.329043][ T5126] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 995.337844][ T5133] netlink: 'syz.4.9550': attribute type 2 has an invalid length. [ 995.346407][ T5133] netlink: 'syz.4.9550': attribute type 2 has an invalid length. [ 995.358343][ T5136] sctp: [Deprecated]: syz.0.9549 (pid 5136) Use of int in maxseg socket option. [ 995.358343][ T5136] Use struct sctp_assoc_value instead [ 995.375930][ T5134] netlink: 'syz.4.9550': attribute type 2 has an invalid length. [ 995.376111][ T5136] netlink: 'syz.0.9549': attribute type 58 has an invalid length. [ 995.405583][ T5126] bridge11: left promiscuous mode [ 995.411600][ T5126] bridge11: left allmulticast mode [ 995.417497][ T5126] bond30: left promiscuous mode [ 995.423329][ T5126] bond30: left allmulticast mode [ 995.434993][ T5126] bond32: left promiscuous mode [ 995.447540][ T5126] gretap3: left promiscuous mode [ 995.458753][ T5126] gretap3: left allmulticast mode [ 995.473692][ T5126] bond34: left promiscuous mode [ 995.495500][ T5126] gretap4: left promiscuous mode [ 995.501677][ T5126] gretap4: left allmulticast mode [ 995.531191][ T5126] bond37: left promiscuous mode [ 995.548002][ T5126] ip6gre1: left promiscuous mode [ 995.579821][ T5126] sit12: left promiscuous mode [ 995.586964][ T5126] sit12: left allmulticast mode [ 996.034660][ T5131] tipc: Resetting bearer [ 996.213877][ T5131] bond29: left promiscuous mode [ 996.222981][ T5131] bridge25: left promiscuous mode [ 996.238581][ T5147] __nla_validate_parse: 11 callbacks suppressed [ 996.238603][ T5147] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9552'. [ 996.256508][ T5147] netlink: 14 bytes leftover after parsing attributes in process `syz.4.9552'. [ 996.274163][T20849] netdevsim netdevsim2 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.289318][T20849] netdevsim netdevsim2 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.307182][ T5137] netlink: 84 bytes leftover after parsing attributes in process `syz.3.9546'. [ 996.350728][ T5146] veth0_to_team: Caught tx_queue_len zero misconfig [ 996.476343][T20849] netdevsim netdevsim2 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.518632][T20849] netdevsim netdevsim2 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.547782][T20849] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.581777][T20849] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.619989][T20849] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.695622][T20849] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 996.760253][ T5170] : renamed from bond0 [ 996.810160][ T5177] netlink: 72 bytes leftover after parsing attributes in process `syz.2.9560'. [ 996.857095][ T5177] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9560'. [ 996.955502][ T5183] syzkaller0: entered promiscuous mode [ 996.961883][ T5183] syzkaller0: entered allmulticast mode [ 997.010620][ T5190] validate_nla: 1 callbacks suppressed [ 997.010633][ T5190] netlink: 'syz.3.9563': attribute type 10 has an invalid length. [ 997.084058][ T5191] bond0 (unregistering): Released all slaves [ 997.592275][ T5171] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 997.898755][ T5197] rdma_rxe: rxe_newlink: failed to add wlan1 [ 998.011934][ T5206] netlink: 'syz.1.9567': attribute type 4 has an invalid length. [ 998.037553][ T5208] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9570'. [ 998.052461][ T5208] openvswitch: netlink: Flow actions attr not present in new flow. [ 998.283679][ T5222] netlink: 'syz.0.9572': attribute type 1 has an invalid length. [ 998.307180][ T5222] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 998.396230][ T5219] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9573'. [ 998.420268][ T5227] : renamed from bond0 [ 998.606883][ T5240] x_tables: duplicate entry at hook 1 [ 998.857513][ T5254] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9582'. [ 998.870074][ T5254] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9582'. [ 998.914799][ T5254] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 999.090251][ T5254] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 999.306452][ T5260] netlink: 'syz.4.9583': attribute type 29 has an invalid length. [ 999.410386][ T5230] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 999.672450][ T5270] x_tables: duplicate underflow at hook 1 [ 999.715780][ T5273] netlink: 'syz.3.9585': attribute type 10 has an invalid length. [ 999.744141][ T5273] .`: (slave team0): refused to change device type [ 999.819910][ T5278] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1000.044230][ T5285] netlink: 52 bytes leftover after parsing attributes in process `syz.1.9590'. [ 1000.443957][ T5322] netlink: 'syz.4.9599': attribute type 4 has an invalid length. [ 1000.787429][ T5347] veth0: entered promiscuous mode [ 1000.795378][ T5346] veth0: left promiscuous mode [ 1001.102126][ T5302] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1001.469863][ T5373] __nla_validate_parse: 1 callbacks suppressed [ 1001.469883][ T5373] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9614'. [ 1001.557960][ T5373] netlink: 25 bytes leftover after parsing attributes in process `syz.0.9614'. [ 1002.549069][ T5393] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1002.867100][ T5435] syzkaller1: entered promiscuous mode [ 1002.878777][ T5435] syzkaller1: entered allmulticast mode [ 1003.521615][ T5472] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9637'. [ 1004.101293][ T5491] 8021q: adding VLAN 0 to HW filter on device .` [ 1004.144382][ T5491] 8021q: adding VLAN 0 to HW filter on device team0 [ 1004.210773][ T5509] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9648'. [ 1004.279050][ T5491] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1004.417224][ T5498] syzkaller1: entered promiscuous mode [ 1004.438888][ T5498] syzkaller1: entered allmulticast mode [ 1004.508866][ T5520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9652'. [ 1004.645538][ T5525] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9653'. [ 1004.807510][ T5536] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9655'. [ 1004.873961][ T5541] netlink: 'syz.1.9659': attribute type 21 has an invalid length. [ 1004.882732][ T5541] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9659'. [ 1005.043590][ T5549] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9663'. [ 1005.078115][ T5553] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9662'. [ 1005.451404][ T5579] IPVS: length: 239 != 24 [ 1005.475589][ T5578] vxcan1: entered allmulticast mode [ 1005.911975][ T5597] bond31: Invalid ad_actor_system MAC address. [ 1005.918703][ T5597] bond31: option ad_actor_system: invalid value (1) [ 1005.929070][ T5597] bond31 (unregistering): Released all slaves [ 1006.054703][ T5561] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1006.704004][ T5650] sctp: [Deprecated]: syz.0.9687 (pid 5650) Use of int in max_burst socket option. [ 1006.704004][ T5650] Use struct sctp_assoc_value instead [ 1006.713794][ T5653] Unsupported xt match [ 1006.718966][ T5653] unable to load match [ 1006.761171][ T5655] netlink: 'syz.3.9690': attribute type 4 has an invalid length. [ 1006.800805][ T5655] netlink: 'syz.3.9690': attribute type 4 has an invalid length. [ 1006.866165][T23730] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 1006.897845][T23730] syú2: Port: 1 Link ACTIVE [ 1006.936006][ T5660] __nla_validate_parse: 6 callbacks suppressed [ 1006.936027][ T5660] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9690'. [ 1006.997175][ T5663] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9691'. [ 1007.285705][ T5675] vlan6: left promiscuous mode [ 1007.296196][ T5677] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9696'. [ 1007.311694][ T5675] bond29: left promiscuous mode [ 1007.326735][ T5675] vlan6: left allmulticast mode [ 1007.338410][ T5675] bond29: left allmulticast mode [ 1007.354242][ T5675] ip6erspan1: left promiscuous mode [ 1007.360775][ T5675] veth27: left promiscuous mode [ 1007.376462][ T24] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 1007.385519][ T5681] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9697'. [ 1007.395678][ T24] syú2: Port: 1 Link DOWN [ 1007.579580][ T5685] mac80211_hwsim hwsim27 syzkaller0: entered promiscuous mode [ 1007.600048][ T5685] mac80211_hwsim hwsim27 syzkaller0: entered allmulticast mode [ 1008.233089][ T5735] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9706'. [ 1008.450072][ T5741] netlink: 284 bytes leftover after parsing attributes in process `syz.0.9708'. [ 1008.541020][ T5690] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 1008.846398][ T5773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9711'. [ 1009.119710][ T5777] netlink: 52 bytes leftover after parsing attributes in process `syz.4.9713'. [ 1009.144730][ T5777] netlink: 52 bytes leftover after parsing attributes in process `syz.4.9713'. [ 1009.203011][ T5781] netlink: 'syz.4.9713': attribute type 7 has an invalid length. [ 1009.213779][ T5784] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9714'. [ 1009.264311][ T5781] netlink: 'syz.4.9713': attribute type 8 has an invalid length. [ 1009.320911][ T5788] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1009.626772][ T5797] : renamed from bond0 [ 1010.032329][ T5818] vlan7: entered promiscuous mode [ 1010.044292][ T5818] bridge0: entered promiscuous mode [ 1012.468809][ T5850] __nla_validate_parse: 3 callbacks suppressed [ 1012.468830][ T5850] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9732'. [ 1012.518312][ T5792] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1013.057102][ T5873] mac80211_hwsim hwsim27 syzkaller0: left promiscuous mode [ 1013.097227][ T5873] mac80211_hwsim hwsim27 syzkaller0: left allmulticast mode [ 1013.119090][ T5875] netlink: 'syz.2.9741': attribute type 11 has an invalid length. [ 1013.154880][ T5875] netlink: 204 bytes leftover after parsing attributes in process `syz.2.9741'. [ 1013.457392][ T5895] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9746'. [ 1013.767086][ T5907] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9749'. [ 1013.823622][ T5907] netlink: 'syz.1.9749': attribute type 16 has an invalid length. [ 1013.876726][ T5907] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9749'. [ 1014.103382][ T5923] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9753'. [ 1014.129979][ T5927] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9754'. [ 1014.397588][ T5925] bond31: (slave bridge27): Enslaving as an active interface with an up link [ 1014.488860][ T5948] lo: left promiscuous mode [ 1014.661419][ T5948] 0ªX¹¦Dö»: left allmulticast mode [ 1014.861937][ T5966] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9758'. [ 1015.653049][ T5948] veth0_vlan: left promiscuous mode [ 1015.691064][ T5948] veth13: left promiscuous mode [ 1015.739637][ T5948] bond11: left promiscuous mode [ 1015.754741][ T5948] veth15: left promiscuous mode [ 1015.776018][ T5948] veth17: left promiscuous mode [ 1015.790267][ T5948] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 1015.801337][ T5948] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 1015.831485][ T5948] gretap3: left promiscuous mode [ 1015.843947][ T5948] : left promiscuous mode [ 1016.112805][ T5948] gtp2: left promiscuous mode [ 1016.254687][ T5948] vlan11: left allmulticast mode [ 1016.269268][ T5948] : left allmulticast mode [ 1016.278392][ T5948] geneve5: left promiscuous mode [ 1016.283614][ T5948] geneve5: left allmulticast mode [ 1016.343984][ T5948] bridge25: left promiscuous mode [ 1016.672080][ T5981] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9762'. [ 1017.133683][ T6001] xt_hashlimit: size too large, truncated to 1048576 [ 1017.588738][ T6016] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1017.628414][ T6025] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9773'. [ 1017.675289][ T6016] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9771'. [ 1018.003333][ T6044] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9779'. [ 1018.229524][ T6053] netlink: 'syz.3.9782': attribute type 12 has an invalid length. [ 1018.372576][ T6058] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9783'. [ 1018.417980][ T6061] netlink: 52 bytes leftover after parsing attributes in process `syz.3.9784'. [ 1018.442139][ T6061] tipc: Invalid UDP bearer configuration [ 1018.442198][ T6061] tipc: Enabling of bearer rejected, failed to enable media [ 1018.984099][ T6089] syzkaller1: entered promiscuous mode [ 1018.997565][ T6093] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9793'. [ 1019.000116][ T6089] syzkaller1: entered allmulticast mode [ 1019.008632][ T6094] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9793'. [ 1019.025100][ T6092] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9794'. [ 1019.207803][ T6102] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9797'. [ 1019.283242][ T6106] netlink: 'syz.3.9799': attribute type 2 has an invalid length. [ 1019.390051][ T6113] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9800'. [ 1019.597839][ T6119] macvtap1: entered allmulticast mode [ 1019.680638][ T6122] bond32: (slave vti1): refused to change device type [ 1019.701450][ T6130] FAULT_INJECTION: forcing a failure. [ 1019.701450][ T6130] name failslab, interval 1, probability 0, space 0, times 0 [ 1019.718107][ T6130] CPU: 1 UID: 0 PID: 6130 Comm: syz.2.9805 Not tainted syzkaller #0 PREEMPT(full) [ 1019.718133][ T6130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1019.718143][ T6130] Call Trace: [ 1019.718150][ T6130] [ 1019.718158][ T6130] dump_stack_lvl+0xe8/0x150 [ 1019.718186][ T6130] should_fail_ex+0x40c/0x560 [ 1019.718207][ T6130] should_failslab+0xa8/0x100 [ 1019.718230][ T6130] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1019.718255][ T6130] ? local_lock_release+0x9c/0x160 [ 1019.718276][ T6130] ? __alloc_skb+0x1d7/0x7a0 [ 1019.718292][ T6130] ? __alloc_skb+0x1d7/0x7a0 [ 1019.718315][ T6130] __alloc_skb+0x1d7/0x7a0 [ 1019.718336][ T6130] netlink_sendmsg+0x5d4/0xb40 [ 1019.718359][ T6130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1019.718376][ T6130] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1019.718396][ T6130] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1019.718409][ T6130] sock_sendmsg_nosec+0x13a/0x180 [ 1019.718435][ T6130] ____sys_sendmsg+0x54e/0x850 [ 1019.718465][ T6130] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1019.718493][ T6130] ? import_iovec+0x73/0xa0 [ 1019.718516][ T6130] ___sys_sendmsg+0x2a5/0x360 [ 1019.718537][ T6130] ? __lock_acquire+0x683/0x2cf0 [ 1019.718560][ T6130] ? __pfx____sys_sendmsg+0x10/0x10 [ 1019.718604][ T6130] ? __fget_files+0x2a/0x420 [ 1019.718622][ T6130] ? __fget_files+0x3a2/0x420 [ 1019.718646][ T6130] __x64_sys_sendmsg+0x1b1/0x290 [ 1019.718669][ T6130] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1019.718703][ T6130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1019.718718][ T6130] do_syscall_64+0x174/0x580 [ 1019.718740][ T6130] ? trace_irq_disable+0x3b/0x140 [ 1019.718759][ T6130] ? clear_bhb_loop+0x40/0x90 [ 1019.718779][ T6130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1019.718793][ T6130] RIP: 0033:0x7f60e7f9de59 [ 1019.718808][ T6130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1019.718821][ T6130] RSP: 002b:00007f60e8eca028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1019.718837][ T6130] RAX: ffffffffffffffda RBX: 00007f60e8225fa0 RCX: 00007f60e7f9de59 [ 1019.718847][ T6130] RDX: 00000000040000d0 RSI: 0000200000000540 RDI: 0000000000000003 [ 1019.718857][ T6130] RBP: 00007f60e8eca090 R08: 0000000000000000 R09: 0000000000000000 [ 1019.718866][ T6130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1019.718875][ T6130] R13: 00007f60e8226038 R14: 00007f60e8225fa0 R15: 00007fff86b92f18 [ 1019.718899][ T6130] [ 1020.070353][ T6127] vlan1: entered promiscuous mode [ 1020.232410][ T6154] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1020.375184][ T6160] syzkaller0: entered promiscuous mode [ 1020.381164][ T6160] syzkaller0: entered allmulticast mode [ 1022.697307][ T6131] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1022.924061][ T6169] netlink: 'syz.1.9815': attribute type 9 has an invalid length. [ 1023.226170][ T6190] macvtap1: left allmulticast mode [ 1023.532695][ T6210] netlink: 'syz.3.9829': attribute type 1 has an invalid length. [ 1023.560701][ T6210] netlink: 'syz.3.9829': attribute type 4 has an invalid length. [ 1023.579570][ T6210] __nla_validate_parse: 1 callbacks suppressed [ 1023.579589][ T6210] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.9829'. [ 1023.681816][ T6216] netlink: 76 bytes leftover after parsing attributes in process `syz.1.9831'. [ 1023.711513][ T6216] nbd: illegal input index -8454144 [ 1023.771459][ T6216] xt_hashlimit: max too large, truncated to 1048576 [ 1023.794097][ T6216] Timeout policy `syz1' can only be used by L3 protocol number 248 [ 1024.168409][ T6247] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9839'. [ 1024.205126][ T6247] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9839'. [ 1024.368717][ T6253] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9842'. [ 1024.394429][ T6253] netlink: 16 bytes leftover after parsing attributes in process `syz.3.9842'. [ 1024.635695][ T6270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9846'. [ 1024.860112][ T6273] syzkaller0: entered promiscuous mode [ 1024.870885][ T6273] syzkaller0: entered allmulticast mode [ 1029.625590][ T6299] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9854'. [ 1029.766628][ T6325] netlink: 'syz.3.9860': attribute type 5 has an invalid length. [ 1029.777309][ T6325] netlink: 140 bytes leftover after parsing attributes in process `syz.3.9860'. [ 1030.305359][ T6357] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9869'. [ 1030.429429][ T6364] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9870'. [ 1030.786492][ T6388] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9876'. [ 1031.041516][ T6402] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1031.486911][ T6429] netlink: 'syz.2.9889': attribute type 1 has an invalid length. [ 1031.509847][ T6429] netlink: 224 bytes leftover after parsing attributes in process `syz.2.9889'. [ 1031.525843][ T6429] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9889'. [ 1031.549961][ T6435] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9891'. [ 1031.745665][ T6446] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9895'. [ 1031.976615][ T6464] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9901'. [ 1032.528185][ T6500] vlan7: entered allmulticast mode [ 1032.542699][ T6500] gretap0: entered allmulticast mode [ 1032.695618][ T6513] FAULT_INJECTION: forcing a failure. [ 1032.695618][ T6513] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1032.744765][ T6513] CPU: 1 UID: 0 PID: 6513 Comm: syz.3.9914 Not tainted syzkaller #0 PREEMPT(full) [ 1032.744794][ T6513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1032.744805][ T6513] Call Trace: [ 1032.744814][ T6513] [ 1032.744822][ T6513] dump_stack_lvl+0xe8/0x150 [ 1032.744856][ T6513] should_fail_ex+0x40c/0x560 [ 1032.744884][ T6513] _copy_from_iter+0x1d3/0x1660 [ 1032.744907][ T6513] ? kmem_cache_alloc_node_noprof+0x1a1/0x610 [ 1032.744932][ T6513] ? rcu_is_watching+0x15/0xb0 [ 1032.744961][ T6513] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1032.744986][ T6513] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1032.745009][ T6513] ? __pfx__copy_from_iter+0x10/0x10 [ 1032.745033][ T6513] ? __alloc_skb+0x276/0x7a0 [ 1032.745059][ T6513] ? __alloc_skb+0x276/0x7a0 [ 1032.745091][ T6513] ? netlink_sendmsg+0x650/0xb40 [ 1032.745109][ T6513] ? skb_put+0x112/0x210 [ 1032.745138][ T6513] netlink_sendmsg+0x6c0/0xb40 [ 1032.745167][ T6513] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1032.745189][ T6513] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1032.745214][ T6513] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1032.745232][ T6513] sock_sendmsg_nosec+0x13a/0x180 [ 1032.745257][ T6513] ____sys_sendmsg+0x54e/0x850 [ 1032.745292][ T6513] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1032.745330][ T6513] ? import_iovec+0x73/0xa0 [ 1032.745367][ T6513] ___sys_sendmsg+0x2a5/0x360 [ 1032.745393][ T6513] ? __lock_acquire+0x683/0x2cf0 [ 1032.745422][ T6513] ? __pfx____sys_sendmsg+0x10/0x10 [ 1032.745484][ T6513] ? __fget_files+0x2a/0x420 [ 1032.745508][ T6513] ? __fget_files+0x3a2/0x420 [ 1032.745542][ T6513] __x64_sys_sendmsg+0x1b1/0x290 [ 1032.745574][ T6513] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1032.745619][ T6513] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.745642][ T6513] do_syscall_64+0x174/0x580 [ 1032.745668][ T6513] ? trace_irq_disable+0x3b/0x140 [ 1032.745697][ T6513] ? clear_bhb_loop+0x40/0x90 [ 1032.745721][ T6513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1032.745740][ T6513] RIP: 0033:0x7f988359de59 [ 1032.745759][ T6513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1032.745777][ T6513] RSP: 002b:00007f9884442028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1032.745797][ T6513] RAX: ffffffffffffffda RBX: 00007f9883826090 RCX: 00007f988359de59 [ 1032.745810][ T6513] RDX: 0000000000008800 RSI: 0000200000000580 RDI: 0000000000000004 [ 1032.745822][ T6513] RBP: 00007f9884442090 R08: 0000000000000000 R09: 0000000000000000 [ 1032.745834][ T6513] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1032.745846][ T6513] R13: 00007f9883826128 R14: 00007f9883826090 R15: 00007ffe72b0bde8 [ 1032.745878][ T6513] [ 1033.165657][T20846] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1033.176819][T20846] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1033.222811][T20846] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1033.260017][ T6526] netlink: 'syz.3.9918': attribute type 64 has an invalid length. [ 1033.294995][T20846] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1033.513357][ T6545] netlink: 'syz.4.9921': attribute type 1 has an invalid length. [ 1033.720376][ T6545] 8021q: adding VLAN 0 to HW filter on device bond27 [ 1033.891247][ T6560] bond0: entered promiscuous mode [ 1033.897109][ T6560] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1033.978161][ T6572] netlink: 'syz.2.9928': attribute type 21 has an invalid length. [ 1034.676984][ T6560] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1034.696608][ T6560] bond0: (slave ip6gre4): The slave device specified does not support setting the MAC address [ 1034.750495][ T6560] bond0: (slave ip6gre4): Error -95 calling set_mac_address [ 1034.792504][ T6572] __nla_validate_parse: 7 callbacks suppressed [ 1034.792525][ T6572] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9928'. [ 1034.997192][ T6594] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9934'. [ 1035.981579][ T6659] netlink: 'syz.1.9949': attribute type 2 has an invalid length. [ 1036.098951][ T30] INFO: task kworker/1:0H:25 blocked for more than 143 seconds. [ 1036.141405][ T30] Not tainted syzkaller #0 [ 1036.159385][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1036.193987][ T30] task:kworker/1:0H state:D stack:26632 pid:25 tgid:25 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1036.229492][ T30] Workqueue: kblockd blk_mq_run_work_fn [ 1036.256713][ T30] Call Trace: [ 1036.269491][ T30] [ 1036.279928][ T30] __schedule+0x17d9/0x56c0 [ 1036.299392][ T30] ? __lock_acquire+0x683/0x2cf0 [ 1036.330308][ T30] ? __pfx___schedule+0x10/0x10 [ 1036.339866][ T30] ? schedule+0x90/0x2b0 [ 1036.352167][ T30] schedule+0x164/0x2b0 [ 1036.368524][ T30] schedule_timeout+0x152/0x2c0 [ 1036.374536][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 1036.389263][ T30] ? __pfx_process_timeout+0x10/0x10 [ 1036.399931][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1036.416737][ T30] ? prepare_to_wait_event+0x436/0x480 [ 1036.427050][ T30] nbd_queue_rq+0x889/0x1150 [ 1036.449806][ T30] ? __pfx_nbd_queue_rq+0x10/0x10 [ 1036.469822][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1036.479709][ T30] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1036.491868][ T30] ? sbitmap_get+0x229/0x390 [ 1036.507072][ T30] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 1036.515463][ T30] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 1036.531290][ T30] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1036.548490][ T30] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 1036.561123][ T30] ? blk_mq_run_work_fn+0x144/0x300 [ 1036.576683][ T30] ? blk_mq_run_work_fn+0x144/0x300 [ 1036.584478][ T30] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1036.599627][ T30] ? blk_mq_run_work_fn+0x144/0x300 [ 1036.610947][ T30] blk_mq_run_work_fn+0x16c/0x300 [ 1036.622262][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 1036.638894][ T30] process_scheduled_works+0xa8e/0x14e0 [ 1036.650647][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 1036.667722][ T30] ? assign_work+0x3cf/0x5d0 [ 1036.676095][ T30] worker_thread+0xa47/0xfb0 [ 1036.687209][ T30] kthread+0x388/0x470 [ 1036.691778][ T30] ? __pfx_worker_thread+0x10/0x10 [ 1036.697133][ T30] ? __pfx_kthread+0x10/0x10 [ 1036.702537][ T30] ret_from_fork+0x514/0xb70 [ 1036.707318][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1036.713364][ T30] ? __switch_to+0xc89/0x1420 [ 1036.718737][ T30] ? __pfx_kthread+0x10/0x10 [ 1036.724668][ T30] ret_from_fork_asm+0x1a/0x30 [ 1036.729989][ T30] [ 1036.748751][ T30] [ 1036.748751][ T30] Showing all locks held in the system: [ 1036.758814][ T30] 4 locks held by kworker/1:0H/25: [ 1036.774850][ T30] #0: ffff88801e6db940 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1036.787382][ T30] #1: ffffc900001f7c40 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1036.801998][ T30] #2: ffff88802825bf98 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x144/0x300 [ 1036.812453][ T30] #3: ffff8880284851f8 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0x1150 [ 1036.822310][ T30] 1 lock held by khungtaskd/30: [ 1036.828167][ T30] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1036.839856][ T30] 2 locks held by getty/5392: [ 1036.844853][ T30] #0: ffff8880365a00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1036.855127][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1036.867518][ T30] 3 locks held by kworker/u8:13/8314: [ 1036.873727][ T30] #0: ffff88801b06c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1036.886102][ T30] #1: ffffc9000539fc40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1036.913989][ T30] #2: ffffffff8eb5fe38 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 1036.924856][ T30] 1 lock held by udevd/30961: [ 1036.930291][ T30] #0: ffff88802835d350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 [ 1036.940060][ T30] 2 locks held by syz.1.9949/6656: [ 1036.945303][ T30] #0: ffff8880328358d0 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x3b/0x100 [ 1036.957656][ T30] #1: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 1036.971015][ T30] 2 locks held by cmp/6695: [ 1036.975706][ T30] [ 1036.978132][ T30] ============================================= [ 1036.978132][ T30] [ 1036.987032][ T30] NMI backtrace for cpu 1 [ 1036.987048][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1036.987069][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1036.987081][ T30] Call Trace: [ 1036.987089][ T30] [ 1036.987097][ T30] dump_stack_lvl+0xe8/0x150 [ 1036.987131][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 1036.987226][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1036.987256][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 1036.987281][ T30] sys_info+0x135/0x170 [ 1036.987320][ T30] watchdog+0xfd7/0x1030 [ 1036.987359][ T30] ? watchdog+0x1c7/0x1030 [ 1036.987393][ T30] kthread+0x388/0x470 [ 1036.987419][ T30] ? __pfx_watchdog+0x10/0x10 [ 1036.987439][ T30] ? __pfx_kthread+0x10/0x10 [ 1036.987466][ T30] ret_from_fork+0x514/0xb70 [ 1036.987496][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1036.987523][ T30] ? __switch_to+0xc89/0x1420 [ 1036.987549][ T30] ? __pfx_kthread+0x10/0x10 [ 1036.987576][ T30] ret_from_fork_asm+0x1a/0x30 [ 1036.987611][ T30] [ 1036.987620][ T30] Sending NMI from CPU 1 to CPUs 0: [ 1037.105894][ C0] NMI backtrace for cpu 0 [ 1037.105913][ C0] CPU: 0 UID: 0 PID: 5628 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 1037.105933][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1037.105944][ C0] RIP: 0033:0x7fe7bc796bf7 [ 1037.105963][ C0] Code: 24 08 64 48 2b 14 25 28 00 00 00 75 05 48 83 c4 18 c3 e8 7c 97 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 05 69 2a 25 00 <48> 85 c0 74 14 48 83 ec 08 ff d0 85 c0 75 1a 31 c0 48 83 c4 08 c3 [ 1037.105978][ C0] RSP: 002b:00007fff8244f898 EFLAGS: 00000206 [ 1037.105994][ C0] RAX: 00007fe7bd6aabc0 RBX: 0000000000001536 RCX: 00007fe7bc79e9b3 [ 1037.106007][ C0] RDX: 0000000000000000 RSI: 00007fff8244f930 RDI: 0000000000000001 [ 1037.106019][ C0] RBP: 00007fff8244f8dc R08: 0000000000000000 R09: 0000000000000000 [ 1037.106030][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 1037.106041][ C0] R13: 00000000000927c0 R14: 00000000000fd141 R15: 00007fff8244f930 [ 1037.106053][ C0] FS: 0000555587a8c500 GS: 0000000000000000 [ 1037.239363][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 1037.246354][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1037.255838][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1037.266531][ T30] Call Trace: [ 1037.270002][ T30] [ 1037.273048][ T30] vpanic+0x56c/0xa60 [ 1037.277240][ T30] ? __pfx___schedule+0x10/0x10 [ 1037.282650][ T30] ? __pfx_vpanic+0x10/0x10 [ 1037.287394][ T30] ? nmi_trigger_cpumask_backtrace+0x207/0x380 [ 1037.294242][ T30] panic+0xc5/0xd0 [ 1037.298511][ T30] ? __pfx_panic+0x10/0x10 [ 1037.303308][ T30] ? preempt_schedule_common+0x82/0xd0 [ 1037.309672][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 1037.315476][ T30] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 1037.321823][ T30] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 1037.328090][ T30] watchdog+0x1030/0x1030 [ 1037.332610][ T30] ? watchdog+0x1c7/0x1030 [ 1037.337140][ T30] kthread+0x388/0x470 [ 1037.341481][ T30] ? __pfx_watchdog+0x10/0x10 [ 1037.346629][ T30] ? __pfx_kthread+0x10/0x10 [ 1037.351780][ T30] ret_from_fork+0x514/0xb70 [ 1037.356737][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1037.362399][ T30] ? __switch_to+0xc89/0x1420 [ 1037.367195][ T30] ? __pfx_kthread+0x10/0x10 [ 1037.372235][ T30] ret_from_fork_asm+0x1a/0x30 [ 1037.377185][ T30] [ 1037.381080][ T30] Kernel Offset: disabled [ 1037.385668][ T30] Rebooting in 86400 seconds..