last executing test programs: 7.224013126s ago: executing program 3 (id=11186): r0 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000017c0)=@newqdisc={0x48, 0x14, 0xf0b, 0xfffffffe, 0x0, {0x2, 0x0, 0x0, 0x0, {0x7, 0xb}, {0xfff1, 0x5}, {0x6, 0xffff}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x8}}, {0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x400c5}, 0x8000) 7.048597514s ago: executing program 3 (id=11188): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x4002, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000440)={@random="d9ea693249ca", @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0xff, @mcast2, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20008810}, 0x4) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2721, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="3b000000010002", 0x7) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x20040084) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="89063ad65d1a3322ad07dc7f91db6cad0eae841fe19a867130bfe8aad0fe440b3952ca316e164b7d69305af4fcb49a4dc147556b87b0dc96b4edee2bf18f877ba7c9f2353eef185a481cc6d09b1b756abc6da72c425aee14c04a103e7417294bba3a30", @ANYRES8=r0], &(0x7f00000001c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe468}, 0x94) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2409c8c1, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, 0x0, 0x0) pipe(0xfffffffffffffffe) r7 = getpid() r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r9, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r7}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 6.121761781s ago: executing program 3 (id=11192): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000c00)=ANY=[@ANYBLOB="200000002f00010000000000fcdbdf251000f2800c00180008ac0f0000000000252fe816bfc9e76fd0c3895538d1ada0fb92e9ed4af26cb5ba2b0a17f27e4b4dea215e212195cbec38ece291da1ba4858b1daa7decb6c500000000"], 0x20}], 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="28010000100007000000000200000000ff020000000000000000000000000001e00000020000000000000000000000004e200000000000000000000002000000", @ANYRES32, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb24000900"], 0x128}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=@newsa={0x10c, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0xffffff7f, 0x2b}, @in6=@private0, {0x300, 0x3, 0x2, 0xfeffff7f00000000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x2}]}, 0x10c}}, 0x0) 6.002167102s ago: executing program 3 (id=11195): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000085000000d000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0x14, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e839e88a8", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x50) 5.847400001s ago: executing program 3 (id=11196): socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x102, 0x0) close(r1) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000200)=ANY=[@ANYRES16=r1, @ANYRES32=r0]) socket$netlink(0x10, 0x3, 0x4) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, 0x0, 0x0, 0x50040, &(0x7f00000001c0)={0x11, 0x3, r3, 0x1, 0xd8, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) 5.502021197s ago: executing program 3 (id=11198): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000040)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000004100000000000000000000000200"/56], 0x48) 2.823554749s ago: executing program 2 (id=11221): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000ac0)=@newqdisc={0x34, 0x24, 0xf0b, 0x70bd2c, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0xd, 0x4}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x15000000, 0x0, 0x20048884}, 0x0) 2.749052542s ago: executing program 1 (id=11222): r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe000001000000000a00120002"], 0x30}}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg(r5, &(0x7f0000001440)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)='\x00', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000200)='&', 0x1}], 0xfe, &(0x7f0000000440)=ANY=[], 0x7}}], 0x2, 0x4044044) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000180)={&(0x7f0000000280)=""/253, 0x104000, 0x800, 0x0, 0x5}, 0x20) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r6, {0xa, 0x9}, {}, {0xc, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x1, 0xd}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 2.539781512s ago: executing program 2 (id=11224): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x8, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) pselect6(0x40, &(0x7f0000000100)={0x3, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x2979}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x2, 0x0, 0x7, 0x40, 0x4}, &(0x7f0000000280), 0x0) 2.511444375s ago: executing program 1 (id=11225): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x3, 0x1000}, 0x4) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000003c0)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x9, 0x0, 0xffffffff}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x48}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000780)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xe, 0x0, &(0x7f0000000380)="fc5cc45c490704289349a8af1d25", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (fail_nth: 30) 2.371890001s ago: executing program 4 (id=11227): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000c80)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="48000000140009052fbd7000fadbdf2502012dcb", @ANYRES32=r2, @ANYBLOB="08000400640101020800081e0801000008000200ffffffff0800090003000000080001"], 0x48}, 0x1, 0x0, 0x0, 0x4040014}, 0x4000884) 2.277716192s ago: executing program 4 (id=11229): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=@newtfilter={0x70, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x4, 0xf}, {}, {0x7, 0xd}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40, 0x2, [@TCA_CGROUP_EMATCHES={0x3c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x800, 0x7, 0x1}, {{0x0, 0x0, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x3, 0x6e4, 0xc}, {0x4, 0x80000000, 0x13, 0x1, 0xf, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xee4}}]}]}}]}, 0x70}, 0x1, 0xe40e0000, 0x0, 0x10}, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000006100)=@delchain={0x24, 0x65, 0x1, 0x70bd2e, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0xffff, 0xc}, {}, {0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004004) 1.600964333s ago: executing program 2 (id=11231): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084000000"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r1, &(0x7f00000015c0)={@val={0x8, 0x800}, @val={0x5, 0x0, 0x2, 0xe7b6, 0x14, 0x2}, @ipv4=@tcp={{0x6, 0x4, 0x0, 0x8, 0xfc0, 0x68, 0x0, 0x3, 0x6, 0x0, @private=0xa010100, @multicast1, {[@ra={0x94, 0x4}]}}, {{0x4e20, 0x4e28, 0x41424344, 0x41424344, 0x1, 0x0, 0xa, 0x10, 0x7, 0x0, 0x8, {[@md5sig={0x13, 0x12, "570ae7f0b905a456f064db0300ffe61e"}]}}, {"ff09eb92334ce7bdbce1cc8ea7c31c4233f717f38859083e7244d871b6582e4b77453efb5c862f933cb39161906e8b6c78ab07fe1b3fe07565e76f3049a8f11350ffa159ce18eb0ce3712cc785657be76b1587f708924c9feb2e292ab97040cca863de23b3b516cc537105bb0404f84119e4260762c50671dc5aab1358ab653fbfb4bbcd3b4664ec16d8f9ec7829cd1af4a5450585bb1de8f968728adf5dec1de9e1e4a8ababf331c67b6c63551249f96344f4f4656e7cd6bf657857a8af5d2df76f377033b968501e40ed92b801d6efaaa61bdc158a6194b1fd1d6380bb7300a70b1d36c1a76ca97d8aec866053ca0d0d4830f966f48a3461bc25fba4dec31acaa7571527df4164e4f6a96c48ac714f8a8e0a4cd14617b52de88f0bee1cffccc96655f4fc658b5a0510e050f6f40aa3d28453590c3af7a4460719f9106f81797c856d60ec8528cc0c9487e69aa50cea9f374fa68593421c48bae1999c875cb205cc55f3c991416ff38e4f093a4c86ad36f19d1b3578242eedcfafd2c931fd2868dc24d9892f790ed560f40a848dd0670f0f611a61640053a2641ddc8ea149145bc5669b176bf12f40d9e0664760a3e476a93a362dd7dfcc3fd9f8be8ee2cd7a0a5fe189031bacbc1ed8e7c15a2bae104b7650c38ed42128a21ad834bac63ed73159e680f90d41475f28567eef33b4c21860ea1cd7a3f56ca286f87608ed49b72d36a1e6b04e4e0ba9ba7f76bece6426a6cad503c8ab33f28772edee91ab52fa29ff4da3893fa0629d1084b2a87f00a468feed92e5fe5aef33ae040aeb89098033fa81bec4535683391297f750f184f06ccb58dfa50ae2d6c159a0208481450bf38bca83f26c50fffe1449895cb8c990aa1cc0dd4cd2d0b4b3cc0006626898fdf274ecfaa1650c61e17f303f41559d75d470da40196aa5dff545903db275a12166b1692f334c70e4c5cf2ca2410989b429e3bc6e2e630adc5d6a039ad7872c4b4754cceeec43a3323d4594fcc28623e65f3067444e098c8817c9eb3f6dc06b6ec407438c09f2c137009c06505d88e0337c765f6c3b16f53bb0d1b235dbdc509ea3fd0996c8cad5bce70eea4d8852e7adfc222b06552d250e70211228251bfb5b95dd3b09bc30fc52337505a6f0689bfca144db622dead3525fbb73056d1b7fa7b08535af3952a8d77a1f34655eb69616c963f4e8b34e88b8405e0e3cd5130c4f98c4e180bfe76ec6cd6ac5e8ccf5d1cf99fdd79bca0a227ee78d2037a55c8593f7ff10bd42d82cd6c4931df7fa6c0c6a8246cef83599095269fb7841aec2cf1afb41d1c7c54136b2737d2c2ae2be604058b657eec27669b99fa669c92a9ebc8e817ed6860070d2fe6bad743ee65d35633de56f026710729102ed175e2ec0af8cc2840af173c71862e90bd370cd3d277a7d2622a5f00946649c1d7894f2a69c3cf8e21276d72c4536149038f9967ec0c748de34376da7971495e0cd783056cdf20cddab2e2201ea43e657e36c54d42c47d1e6a1c9dede599e6c0baac06c2e3fcc5687c5d4706f32337ab639633822dd98089ba20c532fbe4a5e72963d53a86ec34d6a4aa536015a3272c0d4cc0a3a3ab2196ec7a92bf2daf638ba5957941ff0facfe6a161da6a6cbf8e6b40c8b6a601ee91e592f6bb9dc85f84c99e088004ed3f650404934c8b1d436500f3c83333b33be5532076d1a718f80c139db1ac28c953cc23394a5a137567cde82fc681f32e66aa415c2358d02486cb6cb4d6a77e5b27d729e0116773725410332c58b4cc3683fc9dc5235b19a60ea8794986e56e5e8e2ce65655f261ee0c33c8c0b99e7b5bc61fb55040d9e109a3a1182a0f81c2ca081b14cc207b11dad4592add90ff543d2d237421f938af8a010cd197502dbf42f14f1572aabc9f16593a735c07484d61bc43b5f300eb66abe2052cec153f89c1819512316ad728eca65949bf1f903a556ae67871a0d35b0fcb5485e8fae70695cf90547784da27450d6c3e6049bf2f1b923fab49cf4caebccc7a0171aee4364db173c795cc486475427fb92efdbf161ab7a35aecb8e1d5435ea2733cc8dc3f824b00c6d3e05e406de563d1fc6aa77ef76351a3be04557d915df5ed1fd52207872666bbff9ffb84a6e91ae863af42b3e9dd6da62115ab71c6db508875db1a83e631c4cd658a6492cb1a8bd4a42b4546afb74484d519cb5b1a8db29d91ea575a09dc45f63b51b0ace075511556116db62507ed8b163430eea2dcc171890c51afe0ffb22d6595c15112730ce041648d543abf1871bb62b40303b277b2084eaee4895a9e552bcb2d319cbf733d2682940050095fc9499f116e3c828727c2f0755e2c624891a794a1bd9ff52237f13ccf144e67b5311e556333c5b11816fecd78fffb72190480b93e7fe13682b465aad1c2cf564c16d3e8fb07aed4b415f781a52dda6822ed0023b93c07b61e7740470216f29cb9c770ffd33837a6a0bc2990899778c74af304996ec13c1fc935b6d67b23f5190bf8b1bb3cc4e42bb2b9f1e3b330f24fe172396da0c8b52cdb4351a80fcebfcc85e54436327d8ad72d288551540f9a7bda7ecf2f2c41c3e775e26313de86c1b41ea1199321d533abe105ebfd90c9defd30ce9c7ea7a342b310eeca3dd88732dd9d7751c0ae685fbaed556727d2ece266a66ec7adc3a20f377b386ca7c909aba90fef9605ac37d43dd89e4da8455f086c1d2ce9c5b0eb4296ac64b7c244b28b4fd66a8be0442cbeacc7ba871efb11069d7c28dcdaf5798d0025741e461adabb3f270d056b1fe961e6626fc9a533924364687e80aa10e8ae081d743487bcfa97c0e1938dd47fc9075c3b0772284d98e683f0314c4a261845a3e50106e9c0a529b77293c251472a8eb6213ae49b0cc9d569e0a0c4fa1fb10663e4e0b6b0f9cee796aace2a1b42e42758a0180c2ee89119bf9359c6a277a062eda92a932ccf4b72ec1f998224acbe9eb8d594b8861b65ac276f1d401418c7be4d9344b52eb07aa74ba352e347f06e7e923b86cae5c0beb9f7aa0201b6537a82ea8f9281ac6e82a327ea7b879209dd30c1d40c22c402d3e6f09f4b4146b28cac26532eafbb5f6a67f6f734601ab352c804083570087124b23d7d3bff4d31569fcb8c091f157336d11e0e388a91ddf82b05b22dc3cc2ba4355a9453d9329cbca9d52489f15da5849ba32eb11d91184c6a352fe064aae6e85de05288282f911ebf2a932d43413c9bff9cb50f86af7eecca5eb9e3ce7fe9bc1743bcf24d01d02961116a87e4b55ddc1f217fb488c002cd85bb79db625bded4360983abf1e4574a9a46cfe05f0e45da2dd28703599adbae4703aad3ba1cc44813bcdf2432f0e5e9dd67ee8c6b34a9107fb81f21d87dd8fdf270068528685ea3c989beddc08410a59b5ad68d2fd9b37f8b3fddef393433de51b01314e3d6bb08fd7ea5b9abb4d4ccc5a5a43820004ac3870491b8df621be5388e2c3e2c40843d6798c493b308bef505d9f2d2734990a30150b4cefcaeb590118d21f331f201569c778cd5e54e34ec30a73d1fd48cd5d64d444a2a58856a71fa8173713136bdaef1b9cf1776cd7d5be3179ae7a2a95d7138334add686c5b50ca87e41b4c3f5343387cc491e97c280becefd3d72ae959a4fb3e51c15d6dea3210c480342c1748a040879f005f98a8b0d6a32fad631f557694179d117f71ae5fa6d54d4208aca72c5d1e03d34e80b221522c04b1bc7bc1ee008550a1757a1b74a0fea1d22778fd7e7a5f58e41cf72edf60d751bc35223646397457e8f9036838fd3b72e2bc176acc3e1e99a392b1d496cbfbdaa641b2212ef41c1728dd587272849b3a5cbe3b66f7eaf622d2cdf72ada32ccd3e16dddba2c890beaa8dba3773c88415fbcb733084a9bac52b6844f28377ba01fa3a09f74a57d87f31468ee2c64ae05b35fe3d660bcc6ed908b710a1216974db0232d90a124a4e8ee30322a20455feb4d0bef13ce0fafb56f492a99c3fb1c57900330bf75246147b44f23c77554119f1d96a4558d8fff90922af4f9299407344d7292d29ce3446e39bd9277e513e6068394584a08b356e6a0c641108f6e89390290844548a6c8122d8a83cc6c7d7f0c10d330a537d832bc779ea245a37c850b85858885541da0f914e1a41ec5b49ad9b3b41814f66c50bd1f49cd514d027ecd1bd2f002f1989fc621f23d6d5f1b9976ce95c305fa34ebd3404919c3414fd97227a590684ce5af0a18fb4fa6f41d4a3951fb49cc8184b547e9aa2ceb4912975ecf8e956bb29389789b8ceab72e7ae88fb402795ba7712323409fc83cbaf10a523dd4602d9ae7c158a56fee8df04ba4c48cdd63b1ce09bc697ca138f01f261f51bdc05480b7cf5f64836bf8e029d4883d4bc2f53115129cee1d9a9e57b4a5fb4ebef2237a2bdad349baeab05e6b24167ba67ea94f808d9d1386b08b0fd3c92a80ed253db5bb40e6a0c308339c615af56e554ed0d78881228da41706acd8596c52e33abc8a4a3317847dd50b8d77b341063fb29dd02594a540fa737a4dcf9c57ca8717d36e8a8a84eecf9ebb7bb0f4d8cb0f247f982e4fb7a29a7072f08eb1479e278b1084f4faba3c75b6c33438e24e7b454f1e8ee7c64507ef34f37e8655f49cf6871e8012bbf80d2fe2ad9424464d0a408ca50037f1b1221c2d3dbe4dfa75c236f6b59b8a9c8e3a4b1ef73bae3f8d44affc10c72485dee42b73671867221778a6f9ba1ddd5715a6115845af2da8687e0e75f35cca527cb21a07bb2018a574a7e1eb626ad6939990038588cabc63aaafada2c88336f2c764d52cf5c3740371c79ed30f4b7325768c43b9daab5532b4778bdc380bc56bf656eaeea1f7987db28672850e46fce9c9d7dcc7df7b01e9f98ae98890491949c3a9af72cf35227fe88e79d1853ab46903dffd8ceb6060b5a2da5ee061db21e07124b510af4be93a2eda5c9469c73ef661e52d1d3ddf6d0dbd58715730485d26b731da17fb67b1bdedd400cdd472ab88c059e99452b932202fa8500e9b14ec63791857fc33fb97a21469dc318e9799d6b8d3155a9b9ddae7704457f9fbafd0756fcf8464e2398a88b2b4ea3f655cacd390f6df7b195b35b25c6873f0c53ba2939efe513e448ec1c406380ca4e0a6ef53cb183f05bfe99b003429aa5a4709dbf9b6da2fcbc243bcc6b6e8840ed0636af84b6dd3c3b9e50f19c7fda40185dd542f8ff32e7ca9fad274847238e05cf0db24cf7ac1e2cecbcb20bbfe4868b6245899d8e6717a1f9321fd38b87c0c02bb24ed937e9460d03a5a38fa8e0d222105c8527d898f889bbe298b368fff9b951d1b0780352ce8ad10a5dea883292d6cf149618406fc33ca1539da60a1922ee27b7b74aa3507e6a5731bf2c42c879e9efa0750c8bacc63e2225589eab7bf237c259f715248b61278e4ef6f6d238d5bc9bde650795243874b294f228597cf687df0aa8ab1e58548991a1bd903f70408cd4c23f2db7f2ad3f9a0b12a4e52f09270d8f79aa0cde1ffd268d50fcf47c5b2a41898a076e8467cc40de311c26a1f5ff5d1a6693402f927077083490b65e594d5f4e848dc76e03adb210826926ef65e1f63346ad6a14b732cd7a23bf393e72b3c264258d7ea"}}}}, 0xfce) recvfrom(r0, &(0x7f00000001c0)=""/96, 0x60, 0x1, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, 'netpci0\x00'}}, 0x80) r4 = epoll_create1(0x80000) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @mcast1}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}}, 0x5c) ioctl$SIOCGETSGCNT(r5, 0x89e1, &(0x7f0000000000)={@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x25}}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000640)={0x0, @in6={{0xa, 0x4e22, 0x7, @remote, 0x4}}, 0xfda, 0xffff}, &(0x7f0000000140)=0x90) setsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000240)=@assoc_value={r6, 0x9}, 0x8) r7 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r7, &(0x7f0000000100)={0xa0028000}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x204, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}, [@TCA_STAB={0x178, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7d, 0x1, 0x0, 0x9, 0x2, 0xfc1, 0x3, 0x1}}, {0x6, 0x2, [0x1]}}, {{0x1c, 0x1, {0x6b, 0x40, 0x1, 0x2d, 0x0, 0xb2d, 0x4, 0x2}}, {0x8, 0x2, [0x7, 0x7]}}, {{0x1c, 0x1, {0x1d, 0x7, 0x3, 0x7, 0x1, 0x8, 0x1356, 0x3}}, {0xa, 0x2, [0x480, 0xf, 0x96c4]}}, {{0x1c, 0x1, {0x15, 0x19, 0x1, 0x10, 0x0, 0x2, 0x1ff, 0x2}}, {0x8, 0x2, [0x87b1, 0xd]}}, {{0x1c, 0x1, {0x9, 0x3, 0x6, 0x4785, 0x2, 0x3, 0x3, 0x5}}, {0xe, 0x2, [0xb, 0x9, 0x5, 0x0, 0x4]}}, {{0x1c, 0x1, {0xab, 0x1, 0x0, 0x3, 0x2, 0x90a, 0x4, 0x9}}, {0x16, 0x2, [0x6e, 0xfff9, 0x7, 0x9, 0xe, 0x80, 0x1, 0x3, 0x400]}}, {{0x1c, 0x1, {0x4, 0x10, 0x87d, 0x1, 0x0, 0x8, 0x401, 0x5}}, {0xe, 0x2, [0x8e, 0x0, 0xffff, 0x7, 0x1ff]}}, {{0x1c, 0x1, {0x7, 0x9, 0x3, 0xd, 0x0, 0x5, 0x7, 0x4}}, {0xc, 0x2, [0xc047, 0x6, 0x1, 0x52f]}}, {{0x1c, 0x1, {0x5, 0x1, 0x10, 0x3000000, 0x1, 0xe7a7, 0x1, 0x6}}, {0x10, 0x2, [0x9cb, 0x4a3, 0xfff8, 0x3, 0x3, 0x80]}}]}, @TCA_RATE={0x6, 0x5, {0xc9, 0x6e}}, @TCA_STAB={0x60, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x8, 0xff, 0x100, 0x1, 0x7, 0x401, 0x7}}, {0x12, 0x2, [0xa7fb, 0x3, 0xe, 0x8, 0x5, 0x4, 0x0]}}, {{0x1c, 0x1, {0x7f, 0x5, 0x2, 0x3, 0x2, 0x100, 0xe2f, 0x6}}, {0x10, 0x2, [0x5, 0x9, 0x8, 0x9, 0x80, 0x8000]}}]}]}, 0x204}, 0x1, 0x0, 0x0, 0x40010}, 0x840) r8 = socket$netlink(0x10, 0x3, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000b00)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv6={0x86dd, @generic={0xb, 0x6, "5925ab", 0x30, 0x67, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, {[], "ccd8212d969360d3098be45cb7dfcba098ab564e43df94e07d38cc1abf5ae3415ac869de83ee42d5b0c264225602c82a"}}}}}, &(0x7f0000000d80)={0x0, 0x2, [0x304, 0xb43, 0x400, 0x174]}) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73f72cc9f0ba1f848160000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x80054) 1.529322109s ago: executing program 1 (id=11232): ioctl$VFAT_IOCTL_READDIR_SHORT(0xffffffffffffffff, 0x82307202, &(0x7f0000000240)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa4, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x7c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x44, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0xc, 0x5, 0x0, 0x1, [@NFTA_DATA_VALUE={0x7, 0x1, "273cc8"}]}, @NFTA_BITWISE_MASK={0xc, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8a95"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x118}}, 0x0) 1.427205824s ago: executing program 0 (id=11233): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x4000}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x0, 0x95, 0x8, 0x2371}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}}, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x1, @val=@kprobe_multi=@addrs={0x1, 0x3, 0x0, &(0x7f0000000040)=[0x3, 0x7, 0x2], 0x4}}, 0x30) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) write$tun(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[], 0x36) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000700)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000480)="b19ccccf84f531d9ec214627c11430c1", 0x20) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000009c0)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x24000040) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a05d530df65691cf6a3cceb7a97c673856f552ded9530b52fe6d1e662090d2802233ec1adca9eaab9dd6f04b2717ed1552cf46dc28cd3fbf1ec1eaedd80d1da838a00a1e229ce16d2c1a411be06f715e8b6aa7552800d5282e4e0bf3eaf55a60da", 0xbe}, {&(0x7f0000000b00)="2112f3980a4c0902dcb1918da23fb18a9d89c4f0793b7c45b722417a6401d606e033776833d550074c2b667b4e127ea79880d00aeee8d16ca6f011603c22355681cd2e9d0d8a2fea2e9b525389d2e7b95aa129fef95245bffd1ccc58bb9ca56a50cd0b4da05e78cc4aef1e9157a66caefb0ba968710bfbc7baabaa3b06bf6e5fe4fe8ebcbc81a4dbda4b1b65ea2d852cda4881d7ceda7dcbef58471a951ca1851b50dd9276e0ab06fa0e23d023766294c911bff4e6d33acdd316322f4d5a1a4eb5ae51e511f2923f3318d83b9b438b20e0560a4834edb911911c7b557e37e94f6f0a2f1d291ae3049df23212a4b50eeb9c9a0901e880", 0xf6}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f0940cf59647c14b7e6f19ac068f3a0920aed0a27cdd22c711855b5fb9f81ba75787a21c891067a458e010b16fa7d60083beff49c0ad285", 0x58}, {&(0x7f0000000c00)="11bc0436f24447912dce9afd07fe935ecc6bd5eda7c7802f23cc14c83af658aba7129a55512896099992c8d02253e12016902434d12855df0a9b30e55e8f6259b106445aab46f952998eb7f8da0bad476b3c282f94edbd9aec43c836f227ecbc81a2e8dffb14b537cab2cd95a1351f3cdc2b6343f3521eb5638b256c10f93d4465c51329e7aed07efa4bdabe7b511b77df3e3cba7eac72df9b66860cf3b41a664167c6975937e78a75aa6ca347638a9eb31c60880c389de6a8919a67", 0xbc}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000e40)="c4ae7c0462b7d5d0f701a4979574ff8a5d74bf45c9e878972a42062f9b70e92f76ed2c49e2e8a043016efca580e1e24cbf53ef2fdb0d3810e8359c20b3938b1cb8574e51adc3cac209dd1c3b0fa44d9ca5ffbccfd9", 0x55}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-aes-aesni\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r6 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000600), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000680)=ANY=[@ANYBLOB='-memoct -cpuset +io '], 0x1d) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair(0x35, 0x6, 0x10, &(0x7f00000000c0)) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, 0x0, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x881) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002f00010000000000fcdbdf250401f2800c00180008ac0f00000000001400010001000000000000000000ffffac14141650bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43014037115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 1.42668565s ago: executing program 4 (id=11234): r0 = socket(0x10, 0x80002, 0x0) (async) r1 = epoll_create1(0x0) (async) r2 = socket(0x1, 0x80802, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0xa000000d}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f00000000c0)={0x10000001}) (async, rerun: 32) epoll_pwait(r3, &(0x7f0000000080)=[{}], 0x1, 0x80000000, 0x0, 0x0) (async, rerun: 32) shutdown(r2, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x60, &(0x7f0000001680)={&(0x7f0000000580)=@newtaction={0x70, 0x30, 0x53b, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_simple={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0xf, 0x3, '\\^]!${{%@:\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x0, 0x0, 0xe4ffffff}}]}, {0x59}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x70}}, 0x0) (rerun: 32) 1.382776405s ago: executing program 1 (id=11235): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1, 0x0, {0x0, 0x0, 0x4}}, 0x18) sendmsg$can_j1939(r2, &(0x7f0000000000)={&(0x7f00000002c0)={0x1d, r1, 0x8000000000000, {0x1, 0x0, 0x4}, 0xfd}, 0x18, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0xfeffff}, 0x0) 1.309637801s ago: executing program 1 (id=11236): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x2, 0x1000, @empty}, 0x1c) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r1, &(0x7f0000000240)={0xa, 0x4002, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000440)={@random="d9ea693249ca", @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, "fbddf0", 0x8, 0x3a, 0xff, @mcast2, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0x2, 0x4}}}}}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20008810}, 0x4) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt(0xffffffffffffffff, 0x200000000114, 0x2721, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="3b000000010002", 0x7) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x20040084) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x7, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="89063ad65d1a3322ad07dc7f91db6cad0eae841fe19a867130bfe8aad0fe440b3952ca316e164b7d69305af4fcb49a4dc147556b87b0dc96b4edee2bf18f877ba7c9f2353eef185a481cc6d09b1b756abc6da72c425aee14c04a103e7417294bba3a30", @ANYRES8=r0], &(0x7f00000001c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe468}, 0x94) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2409c8c1, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, 0x0, 0x0) pipe(0xfffffffffffffffe) r7 = getpid() r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r9, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r7}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 1.207710545s ago: executing program 4 (id=11237): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) close(r0) socket$inet6_udplite(0xa, 0x2, 0x88) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@restrict={0xf, 0x0, 0x0, 0xb, 0x2}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x2, 0x1}}]}, {0x0, [0x5f, 0x0]}}, 0x0, 0x40, 0x0, 0xfffffffe, 0x5}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x50) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000042c0)=[{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000700)="868218df5178d1efca6153edab4680ec6072354de694819ae33756a37a523faa4cf110db391ffe45c8f05298bd321ef486470bcb9cf85d8424f042dd67797362fdef1149e49585a88d48c9f7093d114142e558450542153b02712f07c73822582787c96c34294479758dd589d5d11e6e27d9b697ae76d923980a222e7e043de0f763a5d23e5728f132eea2c786ad088cda2d196930e1b2d0e003cc43da221a678b2ebef8c826027eeda1f541ed01947cd0083b717ff63925a31115e678e6bb1ae342599173cacfa86c7dfdece7c9e2c19b0868bfd5fa7b0dd4466641fd37b0f354e024d159b3e076241da53fa733b8cb556dbd529f47259fbaf09ae4677509c2df1d34c4138e4875da3e1db518", 0x10d}], 0x1, 0x0, 0x0, 0x4010}], 0x1, 0x20040) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c00000002060108000000000000000000004000050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000000c00078008001240"], 0x5c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8060000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], 0x0}, 0x94) r5 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r4}, 0x8) close(r5) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0xffffff6a) sendfile(r1, 0xffffffffffffffff, 0x0, 0x20000000002) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1, 0x1f, 0x0, &(0x7f0000004380)='syzkaller\x00', 0x6, 0x20, &(0x7f0000000000)=""/32, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x0, '\x00', r6, @sched_cls}, 0x94) 1.182938458s ago: executing program 0 (id=11238): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000340)="0ac878827a65131328975df69c3f01fd3809f6d38c21b2e66214b04f94f1f8bd36612c", 0x23}, {&(0x7f0000000dc0)="ece411a1de1a8f96d3c68ff896f8505b57344865d81e3b508205feb8fe72db6eeb2af79234b8886dff48f595d78248beb44f26c21a636f562da35104ec2e9ee43b9e7f7af9d91ac8d172040a797263c7e684f3d7731db67afe205eea9d7551c5a7cf", 0x62}, {&(0x7f0000000400)="2eccbbefa7", 0x5}, {&(0x7f0000000940)="83e048db1ad3596afb45b2f7d9e26ef4c0f01c1bf0edfc2cd4b6d7827d76c6151de94a3722e51dbbb1e4b4499f", 0x2d}, {&(0x7f0000000f40)="45cfb972aa6835634da231cabb35d39325bc4e86a5", 0x15}, {&(0x7f0000000fc0)="a7878c209e6192eb8078f7858f4d5f3c120213ebae59378e9fc6a5d03b13b2c51abc056d0e268f422fa395a6c6262cf73330dabb3a914e51ecab9273f43c14eada510caf9c6691d7e23839460b2f5304f75e6a401e19e8fa9706fde6b3bed93ec3113baced72b74d7b1a362b35ebe21533ab96a01320d6062735661fcfa69fcaeb1fa079b726ea61b4bea97e0adecf68570dae1c4907a113deb10b8c99267dfe00878f", 0xa3}], 0x6}}], 0x1, 0xc8040) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) splice(r1, 0x0, r0, 0x0, 0x7ffff000, 0x6) 1.122498598s ago: executing program 4 (id=11239): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a30000000000800410072786500140033006c6f0018000000000000000000000009"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x2c020400) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth1_to_bond\x00', 0x0}) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r2, r4, 0x25, 0x2, @val=@perf_event={0x11}}, 0x18) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000680)={r5, r6, 0x4, r2}, 0x10) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$IP_VS_SO_SET_STOPDAEMON(r7, 0x0, 0x48c, &(0x7f00000011c0)={0x2, 'veth0_to_hsr\x00'}, 0x18) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002a40), r9) sendmsg$NLBL_MGMT_C_REMOVEDEF(r9, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000006c0)=ANY=[@ANYRES32=r6, @ANYRESDEC=r4, @ANYBLOB="01002cbd7000fedbdf2505000000"], 0x14}, 0x1, 0x0, 0x0, 0x4c080}, 0x4001081) sendmsg$NLBL_MGMT_C_ADDDEF(r8, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYRES64=r10], 0x58}, 0x1, 0x0, 0x0, 0x44004}, 0x51) r11 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r12) ioctl$IOCTL_GET_NCIDEV_IDX(r11, 0x0, &(0x7f00000000c0)) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4021) r13 = socket$inet6(0xa, 0xa, 0x8) bind$inet6(r13, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty, 0xfffe0000}, 0x1c) recvmmsg(r13, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x80000001}], 0x1, 0x832b, 0x0) r14 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r14, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) 830.564574ms ago: executing program 2 (id=11240): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400ffffffea0000791090000000000062000002000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x4e, 0x0, 0xffffffffffffffff, 0x3000000}, 0x48) 785.920043ms ago: executing program 0 (id=11241): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000001020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000000000cc0006"], 0x138}}, 0x4) 627.81417ms ago: executing program 2 (id=11242): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000200000000001010000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000000000000000900000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000002000000000000020000000000000084010500ac1414aa0000000000000000000000000000000033000000000000004264010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c000000020000"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 627.312064ms ago: executing program 0 (id=11243): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0xe}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3d1, 0x3, 0x2, 0x6, 0x6}, 0x17}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}}, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) sendmmsg$inet(r4, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20, 0x97ff}}], 0x40000000000016c, 0x0) 531.945125ms ago: executing program 2 (id=11244): unshare(0x22020600) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f00000004c0)="a3669abdf2b1ea3f241432ef197282deb2746de0c37bdb10be5106157cca20eae865c9efe7a87656f308129f06b9681737bee9b25e1cab92da9d492c444bb783cb912f54da49fea052c04ac91a172951b2102c85505f30b7f9721637f25605cc907d4b64fada7111df3a00000200"/126, 0xfffffd56, 0x180d4, 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, 0x0) 469.369786ms ago: executing program 4 (id=11245): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, r1, 0x800, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000800}, 0xc044) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000480)={0x118, 0x2e, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x119}, @nested={0x104, 0x11, 0x0, 0x1, [@nested={0x100, 0xcf, 0x0, 0x1, [@generic="e32cc4fbd478b585fc62a92925eb81095df4821c3344fb4ccca51f942f2f62edd3d92e983e841d6e53068187237f5e91a707000000ee05ec6319", @generic="8f3bec68ef62803fe98daf2de4c76a713091d7d093f16995a391c42d5dfc312e9b67f3e831135df00a399b5234733f156436b0ed25721632972efdd7a775655ff99c2abdc650ece6458a5f9db07c36adc6ebcfe60b70e5a54a83041bc8e1c08dc0afd69868eddb1e9634f84ef01b3f9c31b8c76a0e2ac9dba5adc10a3c9a2360cb2fe6e11e9efcaff1b39dd49895a112f947e4923d9b5c428a37b673f33f3ed02d225807d47efe0a590665b49bf5eaa0890c512f2a01eb6713c6b3539790dca05a26"]}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x84}, 0x300) 183.017017ms ago: executing program 0 (id=11246): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000c00)=ANY=[@ANYBLOB="200000002f00010000000000fcdbdf251000f2800c00180008ac0f0000000000252fe816bfc9e76fd0c3895538d1ada0fb92e9ed4af26cb5ba2b0a17f27e4b4dea215e212195cbec38ece291da1ba4858b1daa7decb6c500000000"], 0x20}], 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r1, &(0x7f0000000000)={0x1f, 0x0, @none}, 0xe) listen(r1, 0x1) socket$can_bcm(0x1d, 0x2, 0x2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="28010000100007000000000200000000ff020000000000000000000000000001e00000020000000000000000000000004e200000000000000000000002000000", @ANYRES32, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb24000900"], 0x128}}, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r3, 0x111, 0x2, 0x0, 0x4) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000700)=@newsa={0x10c, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x300, 0x3, 0x2, 0xfeffff7f00000000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, @XFRMA_SET_MARK={0x8, 0x1d, 0x2}]}, 0x10c}, 0x1, 0x200000000000000}, 0x0) 3.849031ms ago: executing program 0 (id=11247): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r1, 0x1, 0x4, @local}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x0, @local}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000000c0)={r1, 0x1, 0x6, @broadcast}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x13, 0x4, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000004000000000020000061107d000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f00000003c0)=0x189, 0x4) sendmmsg$inet6(r4, &(0x7f0000004080)=[{{&(0x7f0000000880)={0xa, 0x4e21, 0x11, @empty, 0x8001}, 0x1c, 0x0}}], 0x1, 0x4004800) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r6, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) setsockopt$inet6_group_source_req(r6, 0x29, 0x2c, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000440)) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000880)={0x14, r5, 0x1, 0x70bd2a, 0x1}, 0x14}}, 0x18) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{}, &(0x7f0000000040), &(0x7f0000000080)=r3}, 0x20) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="10"], 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1e000000000000000400000007"], 0x31) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r7, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r7, 0x0, &(0x7f0000001700)=""/53}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) setsockopt$sock_attach_bpf(r9, 0x1, 0x32, &(0x7f0000000580), 0x4) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0), 0x4) 0s ago: executing program 1 (id=11248): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000096c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x4000}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x0, 0x95, 0x8, 0x2371}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}}, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x25, 0x1, @val=@kprobe_multi=@addrs={0x1, 0x3, 0x0, &(0x7f0000000040)=[0x3, 0x7, 0x2], 0x4}}, 0x30) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) write$tun(0xffffffffffffffff, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x36) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000700)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000480)="b19ccccf84f531d9ec214627c11430c1", 0x20) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000009c0)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x24000040) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a05d530df65691cf6a3cceb7a97c673856f552ded9530b52fe6d1e662090d2802233ec1adca9eaab9dd6f04b2717ed1552cf46dc28cd3fbf1ec1eaedd80d1da838a00a1e229ce16d2c1a411be06f715e8b6aa7552800d5282e4e0bf3eaf55a60da", 0xbe}, {&(0x7f0000000b00)="2112f3980a4c0902dcb1918da23fb18a9d89c4f0793b7c45b722417a6401d606e033776833d550074c2b667b4e127ea79880d00aeee8d16ca6f011603c22355681cd2e9d0d8a2fea2e9b525389d2e7b95aa129fef95245bffd1ccc58bb9ca56a50cd0b4da05e78cc4aef1e9157a66caefb0ba968710bfbc7baabaa3b06bf6e5fe4fe8ebcbc81a4dbda4b1b65ea2d852cda4881d7ceda7dcbef58471a951ca1851b50dd9276e0ab06fa0e23d023766294c911bff4e6d33acdd316322f4d5a1a4eb5ae51e511f2923f3318d83b9b438b20e0560a4834edb911911c7b557e37e94f6f0a2f1d291ae3049df23212a4b50eeb9c9a0901e880", 0xf6}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f0940cf59647c14b7e6f19ac068f3a0920aed0a27cdd22c711855b5fb9f81ba75787a21c891067a458e010b16fa7d60083beff49c0ad285", 0x58}, {&(0x7f0000000c00)="11bc0436f24447912dce9afd07fe935ecc6bd5eda7c7802f23cc14c83af658aba7129a55512896099992c8d02253e12016902434d12855df0a9b30e55e8f6259b106445aab46f952998eb7f8da0bad476b3c282f94edbd9aec43c836f227ecbc81a2e8dffb14b537cab2cd95a1351f3cdc2b6343f3521eb5638b256c10f93d4465c51329e7aed07efa4bdabe7b511b77df3e3cba7eac72df9b66860cf3b41a664167c6975937e78a75aa6ca347638a9eb31c60880c389de6a8919a67", 0xbc}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000e40)="c4ae7c0462b7d5d0f701a4979574ff8a5d74bf45c9e878972a42062f9b70e92f76ed2c49e2e8a043016efca580e1e24cbf53ef2fdb0d3810e8359c20b3938b1cb8574e51adc3cac209dd1c3b0fa44d9ca5ffbccfd9", 0x55}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-aes-aesni\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r6 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000600), 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000680)=ANY=[@ANYBLOB='-memoct -cpuset +io '], 0x1d) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair(0x35, 0x6, 0x10, &(0x7f00000000c0)) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, 0x0, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x881) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002f00010000000000fcdbdf250401f2800c00180008ac0f00000000001400010001000000000000000000ffffac14141650bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43014037115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) kernel console output (not intermixed with test programs): after parsing attributes in process `syz.3.10332'. [ 1382.625034][T12935] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10332'. [ 1382.704751][T12943] syzkaller0: entered promiscuous mode [ 1382.717198][T12943] syzkaller0: entered allmulticast mode [ 1382.732469][T12939] ip6_vti0 speed is unknown, defaulting to 1000 [ 1382.951611][T12947] ip6_vti0 speed is unknown, defaulting to 1000 [ 1383.415586][ T8057] bond0: (slave bond_slave_0): interface is now down [ 1383.427269][T12951] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1383.436366][ T8057] bond0: (slave bond_slave_1): interface is now down [ 1383.454045][T12939] lo speed is unknown, defaulting to 1000 [ 1383.461123][ T8057] bond0: now running without any active interface! [ 1383.793034][T12947] lo speed is unknown, defaulting to 1000 [ 1384.301634][T12962] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10341'. [ 1385.254060][T12914] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1385.423284][T12977] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10345'. [ 1385.661774][T12990] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10349'. [ 1385.688693][T12990] sctp: [Deprecated]: syz.2.10349 (pid 12990) Use of int in max_burst socket option deprecated. [ 1385.688693][T12990] Use struct sctp_assoc_value instead [ 1385.820894][T13009] netlink: 64 bytes leftover after parsing attributes in process `syz.1.10350'. [ 1385.973318][T13016] netlink: 172 bytes leftover after parsing attributes in process `syz.2.10356'. [ 1386.237464][T13032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10360'. [ 1386.285971][T13032] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10360'. [ 1386.320616][T13032] netlink: 'syz.0.10360': attribute type 15 has an invalid length. [ 1386.327163][T13037] netlink: 'syz.4.10363': attribute type 4 has an invalid length. [ 1386.358429][T13041] FAULT_INJECTION: forcing a failure. [ 1386.358429][T13041] name failslab, interval 1, probability 0, space 0, times 0 [ 1386.396555][T13041] CPU: 1 UID: 0 PID: 13041 Comm: syz.3.10362 Not tainted syzkaller #0 PREEMPT(full) [ 1386.396581][T13041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1386.396592][T13041] Call Trace: [ 1386.396600][T13041] [ 1386.396608][T13041] dump_stack_lvl+0xe8/0x150 [ 1386.396643][T13041] should_fail_ex+0x412/0x560 [ 1386.396669][T13041] should_failslab+0xa8/0x100 [ 1386.396690][T13041] __kmalloc_cache_noprof+0x83/0x6e0 [ 1386.396706][T13041] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1386.396728][T13041] ? sctp_add_bind_addr+0x8c/0x370 [ 1386.396752][T13041] sctp_add_bind_addr+0x8c/0x370 [ 1386.396777][T13041] sctp_copy_local_addr_list+0x314/0x4f0 [ 1386.396802][T13041] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1386.396822][T13041] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1386.396841][T13041] ? sctp_v6_is_any+0x64/0x80 [ 1386.396861][T13041] ? sctp_copy_one_addr+0x93/0x360 [ 1386.396883][T13041] sctp_bind_addr_copy+0xb3/0x3c0 [ 1386.396902][T13041] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1386.396925][T13041] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1386.396950][T13041] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1386.396979][T13041] ? __local_bh_enable_ip+0xd0/0x130 [ 1386.396993][T13041] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1386.397009][T13041] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1386.397028][T13041] sctp_sendmsg+0x1528/0x2c10 [ 1386.397066][T13041] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1386.397086][T13041] ? aa_sk_perm+0x15a/0x960 [ 1386.397106][T13041] ? aa_sk_perm+0x82d/0x960 [ 1386.397124][T13041] ? __might_fault+0xaf/0x130 [ 1386.397153][T13041] ? __pfx_aa_sk_perm+0x10/0x10 [ 1386.397176][T13041] ? sock_rps_record_flow+0x19/0x400 [ 1386.397203][T13041] ? inet_sendmsg+0x2f4/0x370 [ 1386.397223][T13041] __sys_sendto+0x627/0x7a0 [ 1386.397247][T13041] ? __pfx___sys_sendto+0x10/0x10 [ 1386.397264][T13041] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1386.397297][T13041] ? __fget_files+0x3a0/0x420 [ 1386.397325][T13041] ? ksys_write+0x242/0x270 [ 1386.397353][T13041] ? __pfx_ksys_write+0x10/0x10 [ 1386.397380][T13041] __x64_sys_sendto+0xde/0x100 [ 1386.397404][T13041] do_syscall_64+0xe2/0xf80 [ 1386.397425][T13041] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1386.397439][T13041] ? trace_irq_disable+0x37/0x100 [ 1386.397453][T13041] ? clear_bhb_loop+0x60/0xb0 [ 1386.397471][T13041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1386.397486][T13041] RIP: 0033:0x7fe89459aeb9 [ 1386.397502][T13041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1386.397516][T13041] RSP: 002b:00007fe89537d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1386.397535][T13041] RAX: ffffffffffffffda RBX: 00007fe894815fa0 RCX: 00007fe89459aeb9 [ 1386.397548][T13041] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 1386.397559][T13041] RBP: 00007fe89537d090 R08: 0000200000000080 R09: 000000000000001c [ 1386.397571][T13041] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000002 [ 1386.397581][T13041] R13: 00007fe894816038 R14: 00007fe894815fa0 R15: 00007fffcc6ac218 [ 1386.397613][T13041] [ 1386.938450][T13053] tipc: Enabled bearer , priority 0 [ 1386.987103][T13053] syzkaller0: entered promiscuous mode [ 1386.992666][T13053] syzkaller0: entered allmulticast mode [ 1386.999272][T13053] tipc: Resetting bearer [ 1387.125496][T13053] tipc: Resetting bearer [ 1387.291278][T13074] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10372'. [ 1387.303767][T13074] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10372'. [ 1387.313629][T13074] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10372'. [ 1387.763551][T13100] netlink: 'syz.0.10376': attribute type 2 has an invalid length. [ 1389.721797][T13053] tipc: Disabling bearer [ 1389.793232][T13108] team0: Port device team_slave_1 removed [ 1389.832761][T13112] macvtap1: entered promiscuous mode [ 1389.838581][T13112] macvtap1: entered allmulticast mode [ 1389.844630][T13112] batadv0: entered promiscuous mode [ 1389.850697][T13112] batadv0: entered allmulticast mode [ 1389.858021][T13112] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1389.865191][T13112] team0: Device macvtap1 failed to register rx_handler [ 1389.877259][T13112] batadv0: left allmulticast mode [ 1389.882549][T13112] batadv0: left promiscuous mode [ 1389.933185][T13122] netlink: 'syz.1.10379': attribute type 4 has an invalid length. [ 1389.973567][T13121] netlink: 'syz.1.10379': attribute type 4 has an invalid length. [ 1390.048504][T13127] vlan2: entered allmulticast mode [ 1390.076563][T13127] veth0_to_bond: entered allmulticast mode [ 1390.096678][T13127] team0: Port device vlan2 added [ 1390.132446][T13129] ipvlan2: entered promiscuous mode [ 1390.142859][T13136] __nla_validate_parse: 2 callbacks suppressed [ 1390.142879][T13136] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10383'. [ 1390.154715][T13129] bridge0: port 1(ipvlan2) entered blocking state [ 1390.171684][T13129] bridge0: port 1(ipvlan2) entered disabled state [ 1390.180796][T13129] ipvlan2: entered allmulticast mode [ 1390.193137][T13129] bridge0: entered allmulticast mode [ 1390.202360][T13129] ipvlan2: left allmulticast mode [ 1390.210543][T13129] bridge0: left allmulticast mode [ 1390.416084][T13147] netlink: 'syz.1.10387': attribute type 2 has an invalid length. [ 1390.468742][T13152] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10390'. [ 1390.490775][T13152] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10390'. [ 1390.770458][T13170] netlink: 48 bytes leftover after parsing attributes in process `syz.3.10391'. [ 1390.779782][T13164] netlink: 200 bytes leftover after parsing attributes in process `syz.2.10394'. [ 1391.212801][T13191] netlink: 'syz.1.10399': attribute type 5 has an invalid length. [ 1391.231697][T13191] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10399'. [ 1391.339105][T13200] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.375729][T13198] vlan3: entered promiscuous mode [ 1391.382188][T13201] netlink: 'syz.0.10402': attribute type 1 has an invalid length. [ 1391.391027][T13201] netlink: 'syz.0.10402': attribute type 2 has an invalid length. [ 1391.391090][T13198] vlan3: entered allmulticast mode [ 1391.400056][T13201] netlink: 'syz.0.10402': attribute type 1 has an invalid length. [ 1391.422450][T13201] netlink: 'syz.0.10402': attribute type 3 has an invalid length. [ 1391.427003][T13198] hsr_slave_1: entered allmulticast mode [ 1391.433335][T13201] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10402'. [ 1391.446044][T13208] FAULT_INJECTION: forcing a failure. [ 1391.446044][T13208] name failslab, interval 1, probability 0, space 0, times 0 [ 1391.488505][T13198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10401'. [ 1391.500307][T13200] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.513944][T13208] CPU: 1 UID: 0 PID: 13208 Comm: syz.1.10403 Not tainted syzkaller #0 PREEMPT(full) [ 1391.513970][T13208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1391.513981][T13208] Call Trace: [ 1391.513989][T13208] [ 1391.513998][T13208] dump_stack_lvl+0xe8/0x150 [ 1391.514034][T13208] should_fail_ex+0x412/0x560 [ 1391.514060][T13208] should_failslab+0xa8/0x100 [ 1391.514081][T13208] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 1391.514105][T13208] ? __alloc_skb+0x186/0x7d0 [ 1391.514125][T13208] ? __alloc_skb+0x1d0/0x7d0 [ 1391.514143][T13208] ? __local_bh_enable_ip+0xd0/0x130 [ 1391.514165][T13208] __alloc_skb+0x1d0/0x7d0 [ 1391.514185][T13208] ? netlink_ack_tlv_len+0x6c/0x210 [ 1391.514208][T13208] netlink_ack+0x146/0xa50 [ 1391.514233][T13208] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 1391.514258][T13208] nfnetlink_rcv+0x2517/0x27b0 [ 1391.514308][T13208] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1391.514368][T13208] ? netlink_deliver_tap+0x2e/0x1b0 [ 1391.514388][T13208] ? netlink_deliver_tap+0x2e/0x1b0 [ 1391.514418][T13208] netlink_unicast+0x80f/0x9b0 [ 1391.514438][T13208] ? __pfx_netlink_unicast+0x10/0x10 [ 1391.514453][T13208] ? netlink_sendmsg+0x650/0xb40 [ 1391.514467][T13208] ? skb_put+0x11b/0x210 [ 1391.514485][T13208] netlink_sendmsg+0x813/0xb40 [ 1391.514507][T13208] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1391.514525][T13208] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1391.514543][T13208] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1391.514559][T13208] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1391.514573][T13208] ____sys_sendmsg+0xa68/0xad0 [ 1391.514591][T13208] ? __might_fault+0xaf/0x130 [ 1391.514614][T13208] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1391.514638][T13208] ? import_iovec+0x73/0xa0 [ 1391.514659][T13208] ___sys_sendmsg+0x2a5/0x360 [ 1391.514675][T13208] ? __lock_acquire+0x6b5/0x2cf0 [ 1391.514696][T13208] ? __pfx____sys_sendmsg+0x10/0x10 [ 1391.514738][T13208] ? __fget_files+0x2a/0x420 [ 1391.514752][T13208] ? __fget_files+0x3a0/0x420 [ 1391.514773][T13208] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1391.514793][T13208] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1391.514817][T13208] ? __pfx_ksys_write+0x10/0x10 [ 1391.514843][T13208] do_syscall_64+0xe2/0xf80 [ 1391.514860][T13208] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.514872][T13208] ? trace_irq_disable+0x37/0x100 [ 1391.514885][T13208] ? clear_bhb_loop+0x60/0xb0 [ 1391.514901][T13208] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1391.514914][T13208] RIP: 0033:0x7fd133b9aeb9 [ 1391.514927][T13208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1391.514939][T13208] RSP: 002b:00007fd131df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1391.514954][T13208] RAX: ffffffffffffffda RBX: 00007fd133e15fa0 RCX: 00007fd133b9aeb9 [ 1391.514965][T13208] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1391.514974][T13208] RBP: 00007fd131df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1391.514982][T13208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1391.514991][T13208] R13: 00007fd133e16038 R14: 00007fd133e15fa0 R15: 00007ffc5a1dcbb8 [ 1391.515013][T13208] [ 1391.961387][T13215] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10404'. [ 1392.024327][T13214] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10405'. [ 1392.373321][T13200] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1392.483620][T13200] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1392.605912][T13232] netlink: 'syz.4.10412': attribute type 1 has an invalid length. [ 1392.711738][T13242] vlan4: entered allmulticast mode [ 1392.871277][ T36] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1392.880369][ T8057] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1392.952512][ T8052] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1393.005713][T13251] ip6_vti0 speed is unknown, defaulting to 1000 [ 1393.038791][ T8057] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1393.101587][T13258] FAULT_INJECTION: forcing a failure. [ 1393.101587][T13258] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1393.137391][T13258] CPU: 0 UID: 0 PID: 13258 Comm: syz.2.10419 Not tainted syzkaller #0 PREEMPT(full) [ 1393.137416][T13258] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1393.137427][T13258] Call Trace: [ 1393.137435][T13258] [ 1393.137443][T13258] dump_stack_lvl+0xe8/0x150 [ 1393.137470][T13258] should_fail_ex+0x412/0x560 [ 1393.137496][T13258] _copy_from_user+0x2d/0xb0 [ 1393.137519][T13258] ___sys_recvmsg+0x175/0x590 [ 1393.137547][T13258] ? __pfx____sys_recvmsg+0x10/0x10 [ 1393.137597][T13258] do_recvmmsg+0x334/0x800 [ 1393.137625][T13258] ? __pfx_do_recvmmsg+0x10/0x10 [ 1393.137656][T13258] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1393.137692][T13258] __x64_sys_recvmmsg+0x198/0x250 [ 1393.137716][T13258] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1393.137748][T13258] do_syscall_64+0xe2/0xf80 [ 1393.137769][T13258] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1393.137785][T13258] ? trace_irq_disable+0x37/0x100 [ 1393.137801][T13258] ? clear_bhb_loop+0x60/0xb0 [ 1393.137821][T13258] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1393.137837][T13258] RIP: 0033:0x7f910159aeb9 [ 1393.137854][T13258] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1393.137868][T13258] RSP: 002b:00007f90ff7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1393.137887][T13258] RAX: ffffffffffffffda RBX: 00007f9101815fa0 RCX: 00007f910159aeb9 [ 1393.137900][T13258] RDX: 03db66e6159adff3 RSI: 0000200000000180 RDI: 0000000000000009 [ 1393.137911][T13258] RBP: 00007f90ff7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1393.137922][T13258] R10: 0000000000010100 R11: 0000000000000246 R12: 0000000000000002 [ 1393.137936][T13258] R13: 00007f9101816038 R14: 00007f9101815fa0 R15: 00007ffd1aeb3128 [ 1393.137961][T13258] [ 1393.471223][T13263] netlink: 'syz.4.10421': attribute type 1 has an invalid length. [ 1393.523910][ T8057] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1393.540204][ T8057] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1393.560954][T13269] netlink: 'syz.0.10420': attribute type 10 has an invalid length. [ 1393.590171][ T8057] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1393.605852][ T8057] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1393.642049][T13269] team0: Device vxcan1 is of different type [ 1393.742022][T13272] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1393.801687][T13278] macvlan3: entered promiscuous mode [ 1393.827744][T13278] macvlan3: entered allmulticast mode [ 1393.850435][T13285] netlink: 'syz.4.10425': attribute type 3 has an invalid length. [ 1393.864814][T13278] bond3: entered allmulticast mode [ 1393.872024][T13278] bond3: entered promiscuous mode [ 1393.878329][T13278] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1393.888188][T13278] team0: Port device macvlan3 added [ 1393.962421][T13281] ip6_vti0 speed is unknown, defaulting to 1000 [ 1394.359790][T13251] lo speed is unknown, defaulting to 1000 [ 1394.931134][T13320] bond5: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 1395.012120][T13320] bond5 (unregistering): Released all slaves [ 1395.353551][T13343] __nla_validate_parse: 10 callbacks suppressed [ 1395.353572][T13343] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10438'. [ 1395.552138][T13281] lo speed is unknown, defaulting to 1000 [ 1395.821744][T13369] syz0: rxe_newlink: already configured on lo [ 1397.478801][T13395] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10449'. [ 1397.489451][T13395] nr0: left promiscuous mode [ 1397.494307][T13395] nr0: left allmulticast mode [ 1397.501866][T13395] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10449'. [ 1397.538533][T13401] netlink: 'syz.4.10450': attribute type 8 has an invalid length. [ 1397.547243][T13401] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10450'. [ 1398.402524][T13346] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1398.755525][T13423] tipc: Enabled bearer , priority 0 [ 1398.867687][T13423] syzkaller0: entered promiscuous mode [ 1398.876332][T13423] syzkaller0: entered allmulticast mode [ 1398.892917][T13423] tipc: Resetting bearer [ 1398.921082][T13433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10459'. [ 1398.970778][T13423] tipc: Resetting bearer [ 1399.953478][T13469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10467'. [ 1399.964869][T13469] netlink: 348 bytes leftover after parsing attributes in process `syz.1.10467'. [ 1399.974205][T13469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10467'. [ 1399.983310][T13469] netlink: 348 bytes leftover after parsing attributes in process `syz.1.10467'. [ 1399.993156][T13469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10467'. [ 1400.742163][T13475] netlink: 'syz.1.10468': attribute type 5 has an invalid length. [ 1400.753777][T13475] __nla_validate_parse: 10 callbacks suppressed [ 1400.753799][T13475] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10468'. [ 1401.568143][T13423] tipc: Disabling bearer [ 1401.749352][T13484] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10471'. [ 1401.902403][T13498] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10474'. [ 1402.424284][T13517] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10478'. [ 1402.528711][T13522] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10480'. [ 1403.121286][T13537] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1403.271163][T13543] syz_tun: entered promiscuous mode [ 1403.309614][T13543] macvtap1: entered promiscuous mode [ 1403.508130][T13552] tipc: Enabled bearer , priority 0 [ 1403.536599][T13552] syzkaller0: entered promiscuous mode [ 1403.542110][T13552] syzkaller0: entered allmulticast mode [ 1403.579845][T13552] tipc: Resetting bearer [ 1403.725704][T13550] tipc: Resetting bearer [ 1403.865568][T13550] tipc: Disabling bearer [ 1403.952710][T13573] sctp: [Deprecated]: syz.1.10490 (pid 13573) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1403.952710][T13573] Use struct sctp_sack_info instead [ 1404.018202][T13576] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10491'. [ 1404.132687][T13580] netlink: 'syz.1.10492': attribute type 1 has an invalid length. [ 1404.145681][T13580] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10492'. [ 1404.172636][T13582] tipc: Enabled bearer , priority 0 [ 1404.186930][T13585] nbd: must specify at least one socket [ 1404.193762][T13585] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10493'. [ 1404.236507][T13585] block nbd0: reconnected socket [ 1404.252436][ T510] block nbd0: Receive control failed (result -32) [ 1404.357330][T13582] syzkaller0: entered promiscuous mode [ 1404.372610][T13582] syzkaller0: entered allmulticast mode [ 1404.407419][T13582] tipc: Resetting bearer [ 1404.530552][T13601] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10498'. [ 1404.814910][ T50] tipc: Resetting bearer [ 1404.845387][T13581] tipc: Resetting bearer [ 1404.906534][T13615] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10500'. [ 1405.145123][T13625] netlink: 'syz.1.10501': attribute type 1 has an invalid length. [ 1405.163064][T13625] netlink: 'syz.1.10501': attribute type 1 has an invalid length. [ 1406.350146][ T11] block nbd3: Possible stuck request ffff8880259a8000: control (read@0,1024B). Runtime 240 seconds [ 1406.361179][ T11] block nbd3: Possible stuck request ffff8880259a8200: control (read@1024,1024B). Runtime 240 seconds [ 1406.372824][ T11] block nbd3: Possible stuck request ffff8880259a8400: control (read@2048,1024B). Runtime 240 seconds [ 1406.384587][ T11] block nbd3: Possible stuck request ffff8880259b0000: control (read@3072,1024B). Runtime 240 seconds [ 1407.242707][T13581] tipc: Disabling bearer [ 1407.284212][T13638] ip6_vti0 speed is unknown, defaulting to 1000 [ 1407.355442][T13651] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10507'. [ 1407.409452][T13651] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10507'. [ 1407.470417][T13655] netlink: 'syz.3.10507': attribute type 10 has an invalid length. [ 1407.499545][ T8049] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1407.514837][T13651] netlink: 'syz.3.10507': attribute type 10 has an invalid length. [ 1407.533414][ T8049] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1407.552675][ T8049] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1407.555113][T13657] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10509'. [ 1407.572187][ T8049] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1407.617168][T13657] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10509'. [ 1407.662720][T13663] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10510'. [ 1407.677412][T13657] vlan3: entered allmulticast mode [ 1407.692857][T13657] team0: entered allmulticast mode [ 1407.726459][T13657] team_slave_0: entered allmulticast mode [ 1407.742239][T13657] team_slave_1: entered allmulticast mode [ 1407.804670][T13663] macvlan3: entered promiscuous mode [ 1407.841967][T13670] syzkaller0: entered promiscuous mode [ 1407.861196][T13670] syzkaller0: entered allmulticast mode [ 1407.944374][ T30] audit: type=1800 audit(1770168272.475:9): pid=13658 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.10508" name="memory.events" dev="tmpfs" ino=292 res=0 errno=0 [ 1408.215903][T13684] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10516'. [ 1408.413946][T13692] netlink: 176 bytes leftover after parsing attributes in process `syz.0.10519'. [ 1408.471579][T13684] team_slave_1 (unregistering): left allmulticast mode [ 1408.495668][T13684] team0: Port device team_slave_1 removed [ 1408.638488][T13706] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10522'. [ 1408.994050][T13718] bridge0: port 2(bridge_slave_1) entered disabled state [ 1409.001835][T13718] bridge0: port 1(bridge_slave_0) entered disabled state [ 1409.113575][T13718] team0: Failed to send port change of device team_slave_0 via netlink (err -105) [ 1409.129815][T13718] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1409.159672][T13718] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1409.249143][T13718] veth0_macvtap: left allmulticast mode [ 1409.297090][ T50] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1409.308040][T13638] lo speed is unknown, defaulting to 1000 [ 1409.328227][ T8052] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1409.359849][ T8052] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1409.386936][ T8052] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1409.488198][T13747] netlink: 164 bytes leftover after parsing attributes in process `syz.4.10531'. [ 1409.536013][T13747] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10531'. [ 1410.018805][T13759] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1410.033585][T13759] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1410.045036][T13759] bond0 (unregistering): Released all slaves [ 1410.222755][T13770] netlink: 'syz.0.10535': attribute type 6 has an invalid length. [ 1410.525890][T13788] netlink: 'syz.1.10543': attribute type 1 has an invalid length. [ 1410.562709][T13783] bond1: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 1410.640996][T13783] bond1 (unregistering): Released all slaves [ 1410.811074][T13793] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1410.867221][T13793] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 1410.939004][T13800] bond2: (slave bridge3): Enslaving as an active interface with a down link [ 1410.994963][T13804] bond2: (slave bridge4): Enslaving as an active interface with a down link [ 1411.032792][T13792] ip6_vti0 speed is unknown, defaulting to 1000 [ 1411.057096][T13788] macvlan4: entered promiscuous mode [ 1411.062582][T13788] macvlan4: entered allmulticast mode [ 1411.077620][T13788] bond2: entered promiscuous mode [ 1411.083817][T13788] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1411.109325][T13788] bond2: left promiscuous mode [ 1411.669209][T13822] delete_channel: no stack [ 1411.730107][T13829] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1411.824944][T13834] bond1: option lacp_rate: invalid value (192) [ 1411.885656][T13834] bond1 (unregistering): Released all slaves [ 1413.095378][T13874] __nla_validate_parse: 6 callbacks suppressed [ 1413.095398][T13874] netlink: 27 bytes leftover after parsing attributes in process `syz.1.10567'. [ 1413.269296][T13881] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10564'. [ 1413.465707][T13792] lo speed is unknown, defaulting to 1000 [ 1413.629973][T13893] syzkaller0: entered promiscuous mode [ 1413.645735][T13893] syzkaller0: entered allmulticast mode [ 1416.200736][T13949] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1416.403835][T13954] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10586'. [ 1416.747774][T13975] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1416.771682][T13974] netlink: 'syz.3.10593': attribute type 13 has an invalid length. [ 1416.783221][T13976] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10591'. [ 1416.816788][T13976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10591'. [ 1416.827334][T13974] netlink: 'syz.3.10593': attribute type 17 has an invalid length. [ 1417.072925][T13974] macvlan3: left promiscuous mode [ 1417.096892][T13974] bond3: left promiscuous mode [ 1417.117064][T13974] macvlan3: left allmulticast mode [ 1417.139488][T13974] bond3: left allmulticast mode [ 1417.202408][T13985] tipc: Enabled bearer , priority 0 [ 1417.310896][T13980] tipc: Resetting bearer [ 1417.401048][T13988] syzkaller0: entered promiscuous mode [ 1417.419554][T13988] syzkaller0: entered allmulticast mode [ 1417.498313][T13983] A link change request failed with some changes committed already. Interface bridge0 may have been left with an inconsistent configuration, please check. [ 1417.674018][T14000] syzkaller0: entered promiscuous mode [ 1417.694375][T14000] syzkaller0: entered allmulticast mode [ 1417.846481][T13977] tipc: Resetting bearer [ 1417.983688][T13977] tipc: Disabling bearer [ 1418.037786][T14020] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10600'. [ 1421.864498][T14111] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10618'. [ 1421.886159][T14111] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10618'. [ 1422.187921][T14081] lec:lec_atm_close: lec0: Shut down! [ 1422.609250][T14139] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1422.620411][T14139] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1422.717498][T14139] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1422.727906][T14139] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1422.752606][T14146] netlink: 72 bytes leftover after parsing attributes in process `syz.1.10627'. [ 1422.769279][T14146] netlink: 296 bytes leftover after parsing attributes in process `syz.1.10627'. [ 1422.782828][T14139] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1422.793476][T14139] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1422.858522][T14139] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1422.870106][T14139] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1423.082651][ T8057] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1423.092912][ T8057] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1423.136189][ T8057] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1423.145984][ T8057] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1423.194402][ T8057] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1423.207406][ T8057] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1423.243007][ T8057] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1423.286478][ T8057] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1423.410151][T14176] netlink: 'syz.0.10634': attribute type 8 has an invalid length. [ 1423.841426][T14190] netlink: 200 bytes leftover after parsing attributes in process `syz.3.10638'. [ 1424.133214][T14203] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1424.165587][T14202] ip6_vti0 speed is unknown, defaulting to 1000 [ 1424.634470][T14218] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1424.868805][T14218] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1425.032365][T14218] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1425.073474][T14228] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10646'. [ 1425.179090][T14218] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1425.210725][T14233] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10648'. [ 1425.339513][ T36] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1425.405211][ T36] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1425.471905][ T36] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1425.511708][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1425.682177][T14253] netlink: 'syz.2.10651': attribute type 11 has an invalid length. [ 1425.710064][T14253] netlink: 199788 bytes leftover after parsing attributes in process `syz.2.10651'. [ 1425.870484][T14261] vcan0: tx drop: invalid da for name 0x0008000000000000 [ 1425.896023][T14202] lo speed is unknown, defaulting to 1000 [ 1426.060508][T14269] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 0 [ 1426.062854][T14266] syzkaller0: entered promiscuous mode [ 1426.074360][T14266] syzkaller0: entered allmulticast mode [ 1426.239138][T14235] lec:lec_atm_close: lec0: Shut down! [ 1426.444407][T14276] syzkaller0: entered promiscuous mode [ 1426.460934][T14276] syzkaller0: entered allmulticast mode [ 1426.544802][T14276] tipc: Enabled bearer , priority 0 [ 1426.621887][T14274] tipc: Resetting bearer [ 1426.661961][T14281] netlink: 'syz.1.10659': attribute type 1 has an invalid length. [ 1426.670833][T14281] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10659'. [ 1426.681881][T14274] tipc: Disabling bearer [ 1427.051238][T14303] vlan3: entered promiscuous mode [ 1427.073904][T14303] vlan3: entered allmulticast mode [ 1427.090088][T14303] hsr_slave_1: entered allmulticast mode [ 1427.148958][T14300] ip6_vti0 speed is unknown, defaulting to 1000 [ 1427.153679][T14303] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10664'. [ 1427.204290][T14307] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10663'. [ 1428.289820][T14322] FAULT_INJECTION: forcing a failure. [ 1428.289820][T14322] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1428.321127][T14322] CPU: 0 UID: 0 PID: 14322 Comm: syz.2.10668 Not tainted syzkaller #0 PREEMPT(full) [ 1428.321158][T14322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1428.321170][T14322] Call Trace: [ 1428.321177][T14322] [ 1428.321185][T14322] dump_stack_lvl+0xe8/0x150 [ 1428.321213][T14322] should_fail_ex+0x412/0x560 [ 1428.321239][T14322] prepare_alloc_pages+0x22a/0x650 [ 1428.321267][T14322] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1428.321291][T14322] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1428.321314][T14322] ? __pfx_policy_nodemask+0x10/0x10 [ 1428.321338][T14322] ? pfn_valid+0xba/0x480 [ 1428.321364][T14322] alloc_pages_mpol+0x232/0x4a0 [ 1428.321390][T14322] vma_alloc_folio_noprof+0xea/0x210 [ 1428.321413][T14322] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1428.321443][T14322] do_wp_page+0x127b/0x5990 [ 1428.321475][T14322] ? ___pte_offset_map+0x29/0x240 [ 1428.321498][T14322] ? ___pte_offset_map+0x29/0x240 [ 1428.321526][T14322] ? __pfx_do_wp_page+0x10/0x10 [ 1428.321545][T14322] ? do_raw_spin_lock+0x12b/0x2f0 [ 1428.321567][T14322] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1428.321597][T14322] handle_mm_fault+0x1520/0x32a0 [ 1428.321633][T14322] ? handle_mm_fault+0xee/0x32a0 [ 1428.321664][T14322] ? __pfx_handle_mm_fault+0x10/0x10 [ 1428.321686][T14322] ? follow_page_pte+0xd6a/0x1460 [ 1428.321718][T14322] ? __pfx_follow_page_pte+0x10/0x10 [ 1428.321752][T14322] __get_user_pages+0x165b/0x29d0 [ 1428.321812][T14322] __gup_longterm_locked+0xdcf/0x1630 [ 1428.321848][T14322] ? sanity_check_pinned_pages+0x1219/0x12d0 [ 1428.321878][T14322] gup_fast_fallback+0x1d82/0x22e0 [ 1428.321932][T14322] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1428.321951][T14322] ? ____sys_recvmsg+0x1e6/0x4a0 [ 1428.321973][T14322] ? __x64_sys_recvmsg+0x1ba/0x2a0 [ 1428.321993][T14322] ? do_syscall_64+0xe2/0xf80 [ 1428.322013][T14322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.322034][T14322] ? pin_user_pages_fast+0x4d/0xb0 [ 1428.322059][T14322] iov_iter_extract_pages+0x37b/0x5f0 [ 1428.322095][T14322] extract_iter_to_sg+0xe62/0x2520 [ 1428.322150][T14322] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 1428.322175][T14322] ? rcu_is_watching+0x15/0xb0 [ 1428.322193][T14322] ? trace_kmalloc+0x1f/0xb0 [ 1428.322209][T14322] ? sock_kmalloc+0xd6/0x160 [ 1428.322236][T14322] ? __asan_memset+0x22/0x50 [ 1428.322262][T14322] af_alg_get_rsgl+0x436/0x810 [ 1428.322304][T14322] skcipher_recvmsg+0x3a3/0x1140 [ 1428.322347][T14322] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1428.322368][T14322] ? __lock_acquire+0x6b5/0x2cf0 [ 1428.322393][T14322] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1428.322410][T14322] ? security_socket_recvmsg+0x7e/0x2c0 [ 1428.322433][T14322] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1428.322457][T14322] sock_recvmsg+0x22c/0x270 [ 1428.322480][T14322] ____sys_recvmsg+0x1e6/0x4a0 [ 1428.322528][T14322] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1428.322566][T14322] ? import_iovec+0x73/0xa0 [ 1428.322593][T14322] ___sys_recvmsg+0x215/0x590 [ 1428.322613][T14322] ? get_pid_task+0x20/0x1f0 [ 1428.322638][T14322] ? __pfx____sys_recvmsg+0x10/0x10 [ 1428.322666][T14322] ? __fget_files+0x2a/0x420 [ 1428.322703][T14322] ? __fget_files+0x3a0/0x420 [ 1428.322732][T14322] __x64_sys_recvmsg+0x1ba/0x2a0 [ 1428.322758][T14322] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1428.322790][T14322] ? __pfx_ksys_write+0x10/0x10 [ 1428.322830][T14322] do_syscall_64+0xe2/0xf80 [ 1428.322850][T14322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.322867][T14322] ? trace_irq_disable+0x37/0x100 [ 1428.322883][T14322] ? clear_bhb_loop+0x60/0xb0 [ 1428.322904][T14322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.322921][T14322] RIP: 0033:0x7f910159aeb9 [ 1428.322938][T14322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1428.322953][T14322] RSP: 002b:00007f90ff7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1428.322972][T14322] RAX: ffffffffffffffda RBX: 00007f9101815fa0 RCX: 00007f910159aeb9 [ 1428.322984][T14322] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 1428.322996][T14322] RBP: 00007f90ff7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1428.323008][T14322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1428.323018][T14322] R13: 00007f9101816038 R14: 00007f9101815fa0 R15: 00007ffd1aeb3128 [ 1428.323050][T14322] [ 1428.957955][T14331] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1429.312697][T14300] lo speed is unknown, defaulting to 1000 [ 1429.436755][T14344] netlink: 'syz.0.10672': attribute type 1 has an invalid length. [ 1429.459366][T14344] netlink: 224 bytes leftover after parsing attributes in process `syz.0.10672'. [ 1429.595358][T14346] ip6_vti0 speed is unknown, defaulting to 1000 [ 1430.571557][T14398] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10691'. [ 1430.625556][T14400] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10690'. [ 1431.427301][T14414] ip6_vti0 speed is unknown, defaulting to 1000 [ 1431.786303][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5550 ms [ 1431.794373][ C0] lec:lec_tx_timeout: lec0 [ 1431.799182][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1432.312926][T14450] FAULT_INJECTION: forcing a failure. [ 1432.312926][T14450] name failslab, interval 1, probability 0, space 0, times 0 [ 1432.327635][T14450] CPU: 0 UID: 0 PID: 14450 Comm: syz.0.10704 Not tainted syzkaller #0 PREEMPT(full) [ 1432.327661][T14450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1432.327673][T14450] Call Trace: [ 1432.327681][T14450] [ 1432.327689][T14450] dump_stack_lvl+0xe8/0x150 [ 1432.327716][T14450] should_fail_ex+0x412/0x560 [ 1432.327741][T14450] should_failslab+0xa8/0x100 [ 1432.327763][T14450] __kmalloc_cache_noprof+0x83/0x6e0 [ 1432.327780][T14450] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1432.327801][T14450] ? sctp_v6_cmp_addr+0x15/0xd0 [ 1432.327820][T14450] ? sctp_add_bind_addr+0x8c/0x370 [ 1432.327845][T14450] sctp_add_bind_addr+0x8c/0x370 [ 1432.327870][T14450] sctp_copy_local_addr_list+0x314/0x4f0 [ 1432.327895][T14450] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1432.327915][T14450] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1432.327936][T14450] ? sctp_v6_is_any+0x64/0x80 [ 1432.327958][T14450] ? sctp_copy_one_addr+0x93/0x360 [ 1432.327981][T14450] sctp_bind_addr_copy+0xb3/0x3c0 [ 1432.328003][T14450] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1432.328026][T14450] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1432.328052][T14450] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1432.328082][T14450] ? __local_bh_enable_ip+0xd0/0x130 [ 1432.328097][T14450] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1432.328114][T14450] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1432.328139][T14450] sctp_sendmsg+0x1528/0x2c10 [ 1432.328158][T14450] ? unwind_next_frame+0xa5/0x23c0 [ 1432.328186][T14450] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1432.328206][T14450] ? aa_sk_perm+0x15a/0x960 [ 1432.328227][T14450] ? aa_sk_perm+0x82d/0x960 [ 1432.328253][T14450] ? __pfx_aa_sk_perm+0x10/0x10 [ 1432.328276][T14450] ? sock_rps_record_flow+0x19/0x400 [ 1432.328324][T14450] ? inet_sendmsg+0x2f4/0x370 [ 1432.328346][T14450] ____sys_sendmsg+0x894/0xad0 [ 1432.328376][T14450] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1432.328406][T14450] ? import_iovec+0x73/0xa0 [ 1432.328432][T14450] ___sys_sendmsg+0x2a5/0x360 [ 1432.328453][T14450] ? __lock_acquire+0x6b5/0x2cf0 [ 1432.328479][T14450] ? __pfx____sys_sendmsg+0x10/0x10 [ 1432.328531][T14450] ? __fget_files+0x2a/0x420 [ 1432.328549][T14450] ? __fget_files+0x3a0/0x420 [ 1432.328577][T14450] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1432.328607][T14450] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1432.328638][T14450] ? __pfx_ksys_write+0x10/0x10 [ 1432.328671][T14450] do_syscall_64+0xe2/0xf80 [ 1432.328692][T14450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1432.328707][T14450] ? trace_irq_disable+0x37/0x100 [ 1432.328723][T14450] ? clear_bhb_loop+0x60/0xb0 [ 1432.328741][T14450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1432.328755][T14450] RIP: 0033:0x7f3d67f9aeb9 [ 1432.328771][T14450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1432.328784][T14450] RSP: 002b:00007f3d68df0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1432.328803][T14450] RAX: ffffffffffffffda RBX: 00007f3d68215fa0 RCX: 00007f3d67f9aeb9 [ 1432.328814][T14450] RDX: 0000000000040000 RSI: 00002000000027c0 RDI: 0000000000000003 [ 1432.328825][T14450] RBP: 00007f3d68df0090 R08: 0000000000000000 R09: 0000000000000000 [ 1432.328834][T14450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1432.328843][T14450] R13: 00007f3d68216038 R14: 00007f3d68215fa0 R15: 00007ffec8435918 [ 1432.328869][T14450] [ 1432.362506][T14346] lo speed is unknown, defaulting to 1000 [ 1432.507911][T14453] netlink: 256 bytes leftover after parsing attributes in process `syz.3.10706'. [ 1432.512307][T14453] x_tables: duplicate entry at hook 2 [ 1432.580432][T14454] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10705'. [ 1434.021676][T14505] netlink: 80 bytes leftover after parsing attributes in process `syz.3.10720'. [ 1434.059326][T14508] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10721'. [ 1434.209337][T14514] SET target dimension over the limit! [ 1434.249739][T14414] lo speed is unknown, defaulting to 1000 [ 1434.487337][T14525] netlink: 'syz.0.10727': attribute type 13 has an invalid length. [ 1434.527309][T14525] netlink: 14589 bytes leftover after parsing attributes in process `syz.0.10727'. [ 1434.690444][T14533] ¾x9ÿ: renamed from bridge_slave_0 [ 1436.000750][T14575] netlink: 'syz.3.10734': attribute type 2 has an invalid length. [ 1436.427780][ T11] block nbd3: Possible stuck request ffff8880259a8000: control (read@0,1024B). Runtime 270 seconds [ 1436.439451][ T11] block nbd3: Possible stuck request ffff8880259a8200: control (read@1024,1024B). Runtime 270 seconds [ 1436.451817][ T11] block nbd3: Possible stuck request ffff8880259a8400: control (read@2048,1024B). Runtime 270 seconds [ 1436.466480][ T11] block nbd3: Possible stuck request ffff8880259b0000: control (read@3072,1024B). Runtime 270 seconds [ 1436.508020][T14591] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1436.535254][T14591] bond5 (unregistering): Released all slaves [ 1436.788987][T14605] ¾x9ÿ: renamed from bridge_slave_0 [ 1436.826691][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 1436.834772][ C0] lec:lec_tx_timeout: lec0 [ 1436.840425][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1437.008378][T14609] syzkaller0: entered promiscuous mode [ 1437.014790][T14609] syzkaller0: entered allmulticast mode [ 1437.199518][T14614] netlink: 65173 bytes leftover after parsing attributes in process `syz.1.10742'. [ 1437.691680][T14629] netlink: 'syz.1.10742': attribute type 6 has an invalid length. [ 1437.788338][T14638] openvswitch: netlink: Message has 572 unknown bytes. [ 1437.795360][T14638] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1437.912060][T14638] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1438.102456][T14545] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1438.521553][T14652] IPVS: set_ctl: invalid protocol: 92 172.20.20.187:20002 [ 1438.554852][T14652] netlink: 'syz.4.10748': attribute type 10 has an invalid length. [ 1438.617552][T14657] netlink: 'syz.4.10748': attribute type 10 has an invalid length. [ 1438.627148][T14652] dummy0: entered allmulticast mode [ 1438.633371][T14652] team0: Port device dummy0 added [ 1438.742929][T14657] dummy0: left allmulticast mode [ 1438.757530][T14657] team0: Port device dummy0 removed [ 1438.798912][T14657] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1438.852092][T14663] netlink: 'syz.2.10753': attribute type 1 has an invalid length. [ 1438.867259][T14663] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10753'. [ 1438.921709][T14665] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1439.079231][T14682] netlink: 'syz.4.10756': attribute type 23 has an invalid length. [ 1439.091623][T14665] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1439.142115][T14682] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10756'. [ 1439.242881][T14665] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1439.307151][T14679] block nbd5: server does not support multiple connections per device. [ 1439.330252][T14665] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1439.348616][T14679] block nbd5: shutting down sockets [ 1439.525034][ T50] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1439.551026][ T50] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1439.572735][ T50] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1439.600047][ T50] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1439.825530][T14702] netlink: 'syz.2.10761': attribute type 1 has an invalid length. [ 1439.834328][T14702] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10761'. [ 1440.145833][T14716] netlink: 'syz.3.10765': attribute type 1 has an invalid length. [ 1440.176777][T14716] netlink: 224 bytes leftover after parsing attributes in process `syz.3.10765'. [ 1440.265179][T14724] ipvlan3: entered promiscuous mode [ 1440.293774][T14724] bridge0: port 4(ipvlan3) entered blocking state [ 1440.315455][T14724] bridge0: port 4(ipvlan3) entered disabled state [ 1440.339266][T14724] ipvlan3: entered allmulticast mode [ 1440.364835][T14724] bridge0: entered allmulticast mode [ 1440.413516][T14724] ipvlan3: left allmulticast mode [ 1440.440003][T14724] bridge0: left allmulticast mode [ 1440.844173][T14751] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10773'. [ 1440.898287][T14751] macvlan4: entered promiscuous mode [ 1440.904607][T14755] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10771'. [ 1440.974440][T14761] netlink: 'syz.3.10774': attribute type 2 has an invalid length. [ 1441.060806][T14761] : entered promiscuous mode [ 1441.128714][T14764] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1441.213315][T14767] ip6_vti0 speed is unknown, defaulting to 1000 [ 1441.460237][T14781] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10781'. [ 1441.486823][T14781] nbd: couldn't find a device at index 458752 [ 1441.606122][T14787] IPVS: set_ctl: invalid protocol: 4 172.20.20.187:20004 [ 1441.697798][T14787] : renamed from bond_slave_0 (while UP) [ 1441.714073][T14792] SET target dimension over the limit! [ 1441.856739][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1441.864814][ C0] lec:lec_tx_timeout: lec0 [ 1441.964698][T14800] sock: sock_set_timeout: `syz.3.10786' (pid 14800) tries to set negative timeout [ 1442.160724][T14809] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1442.290337][T14816] netlink: 256 bytes leftover after parsing attributes in process `syz.4.10791'. [ 1442.360817][T14819] x_tables: duplicate entry at hook 2 [ 1442.396025][T14821] netlink: 'syz.3.10792': attribute type 6 has an invalid length. [ 1442.439554][T14821] FAULT_INJECTION: forcing a failure. [ 1442.439554][T14821] name failslab, interval 1, probability 0, space 0, times 0 [ 1442.468287][T14821] CPU: 1 UID: 0 PID: 14821 Comm: syz.3.10792 Not tainted syzkaller #0 PREEMPT(full) [ 1442.468313][T14821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1442.468324][T14821] Call Trace: [ 1442.468331][T14821] [ 1442.468339][T14821] dump_stack_lvl+0xe8/0x150 [ 1442.468367][T14821] should_fail_ex+0x412/0x560 [ 1442.468393][T14821] should_failslab+0xa8/0x100 [ 1442.468415][T14821] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1442.468437][T14821] ? lockdep_rtnl_is_held+0x26/0x40 [ 1442.468460][T14821] ? fib_table_insert+0x4bb/0x1b50 [ 1442.468484][T14821] fib_table_insert+0x4bb/0x1b50 [ 1442.468503][T14821] ? lwtunnel_valid_encap_type_attr+0x220/0x290 [ 1442.468530][T14821] ? __pfx___mutex_lock+0x10/0x10 [ 1442.468572][T14821] ? fib_new_table+0x10a/0x2d0 [ 1442.468598][T14821] inet_rtm_newroute+0x14f/0x250 [ 1442.468618][T14821] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 1442.468655][T14821] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 1442.468670][T14821] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1442.468694][T14821] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1442.468712][T14821] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1442.468730][T14821] ? __lock_acquire+0x6b5/0x2cf0 [ 1442.468763][T14821] netlink_rcv_skb+0x232/0x4b0 [ 1442.468783][T14821] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1442.468803][T14821] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1442.468833][T14821] ? netlink_deliver_tap+0x2e/0x1b0 [ 1442.468859][T14821] netlink_unicast+0x80f/0x9b0 [ 1442.468885][T14821] ? __pfx_netlink_unicast+0x10/0x10 [ 1442.468911][T14821] ? netlink_sendmsg+0x650/0xb40 [ 1442.468928][T14821] ? skb_put+0x11b/0x210 [ 1442.468952][T14821] netlink_sendmsg+0x813/0xb40 [ 1442.468981][T14821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1442.469002][T14821] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1442.469023][T14821] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1442.469044][T14821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1442.469063][T14821] ____sys_sendmsg+0xa68/0xad0 [ 1442.469084][T14821] ? __might_fault+0xaf/0x130 [ 1442.469112][T14821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1442.469142][T14821] ? import_iovec+0x73/0xa0 [ 1442.469169][T14821] ___sys_sendmsg+0x2a5/0x360 [ 1442.469189][T14821] ? __lock_acquire+0x6b5/0x2cf0 [ 1442.469214][T14821] ? __pfx____sys_sendmsg+0x10/0x10 [ 1442.469273][T14821] ? __fget_files+0x2a/0x420 [ 1442.469291][T14821] ? __fget_files+0x3a0/0x420 [ 1442.469318][T14821] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1442.469344][T14821] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1442.469374][T14821] ? __pfx_ksys_write+0x10/0x10 [ 1442.469409][T14821] do_syscall_64+0xe2/0xf80 [ 1442.469430][T14821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.469446][T14821] ? trace_irq_disable+0x37/0x100 [ 1442.469463][T14821] ? clear_bhb_loop+0x60/0xb0 [ 1442.469484][T14821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.469500][T14821] RIP: 0033:0x7fe89459aeb9 [ 1442.469516][T14821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1442.469530][T14821] RSP: 002b:00007fe89537d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1442.469547][T14821] RAX: ffffffffffffffda RBX: 00007fe894815fa0 RCX: 00007fe89459aeb9 [ 1442.469558][T14821] RDX: 0000000000000894 RSI: 0000200000000080 RDI: 0000000000000003 [ 1442.469577][T14821] RBP: 00007fe89537d090 R08: 0000000000000000 R09: 0000000000000000 [ 1442.469585][T14821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1442.469595][T14821] R13: 00007fe894816038 R14: 00007fe894815fa0 R15: 00007fffcc6ac218 [ 1442.469621][T14821] [ 1443.007485][T14767] lo speed is unknown, defaulting to 1000 [ 1443.192694][T14834] netlink: 72 bytes leftover after parsing attributes in process `syz.2.10796'. [ 1443.316673][T14839] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10797'. [ 1443.517238][T14850] xt_cgroup: invalid path, errno=-2 [ 1444.376735][T14879] netlink: 'syz.4.10804': attribute type 6 has an invalid length. [ 1445.180801][T14896] netlink: 'syz.3.10809': attribute type 1 has an invalid length. [ 1445.194080][T14896] __nla_validate_parse: 1 callbacks suppressed [ 1445.194099][T14896] netlink: 224 bytes leftover after parsing attributes in process `syz.3.10809'. [ 1445.235646][T14898] ip6_vti0 speed is unknown, defaulting to 1000 [ 1445.584058][T14913] xt_hashlimit: size too large, truncated to 1048576 [ 1445.663890][T14916] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10814'. [ 1446.050226][T14924] syzkaller0: entered promiscuous mode [ 1446.082820][T14924] syzkaller0: entered allmulticast mode [ 1446.232824][T14930] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10816'. [ 1446.350663][T14894] ip6_vti0 speed is unknown, defaulting to 1000 [ 1446.541063][T14938] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10817'. [ 1446.912479][T14949] netlink: 'syz.4.10821': attribute type 1 has an invalid length. [ 1446.943497][T14949] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10821'. [ 1447.143798][T14961] netlink: 332 bytes leftover after parsing attributes in process `syz.2.10825'. [ 1447.174797][T14961] netlink: 'syz.2.10825': attribute type 9 has an invalid length. [ 1447.177092][T14943] netlink: 'syz.3.10819': attribute type 2 has an invalid length. [ 1447.193874][T14961] netlink: 108 bytes leftover after parsing attributes in process `syz.2.10825'. [ 1447.225610][T14961] netlink: 32 bytes leftover after parsing attributes in process `syz.2.10825'. [ 1447.407099][T14940] ip6_vti0 speed is unknown, defaulting to 1000 [ 1447.499052][T14978] xt_hashlimit: size too large, truncated to 1048576 [ 1447.646557][T14990] netlink: 7 bytes leftover after parsing attributes in process `syz.4.10831'. [ 1447.705234][T14990] netlink: 7 bytes leftover after parsing attributes in process `syz.4.10831'. [ 1447.750838][T14993] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 1447.946021][T15000] IPVS: set_ctl: invalid protocol: 50 224.0.0.1:20001 [ 1448.083810][T14986] ip6_vti0 speed is unknown, defaulting to 1000 [ 1448.137091][T15004] ip_vti0: entered allmulticast mode [ 1448.169760][T15006] ipvlan3: entered promiscuous mode [ 1448.178515][T15006] bridge0: port 4(ipvlan3) entered blocking state [ 1448.205634][T15006] bridge0: port 4(ipvlan3) entered disabled state [ 1448.223185][T15006] ipvlan3: entered allmulticast mode [ 1448.229265][T15006] bridge0: entered allmulticast mode [ 1448.239760][T15006] ipvlan3: left allmulticast mode [ 1448.245028][T15006] bridge0: left allmulticast mode [ 1448.329365][T14898] lo speed is unknown, defaulting to 1000 [ 1448.339189][ T510] block nbd5: Receive control failed (result -32) [ 1448.650868][T15020] FAULT_INJECTION: forcing a failure. [ 1448.650868][T15020] name failslab, interval 1, probability 0, space 0, times 0 [ 1448.706381][T15020] CPU: 1 UID: 0 PID: 15020 Comm: syz.4.10836 Not tainted syzkaller #0 PREEMPT(full) [ 1448.706408][T15020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1448.706419][T15020] Call Trace: [ 1448.706428][T15020] [ 1448.706436][T15020] dump_stack_lvl+0xe8/0x150 [ 1448.706464][T15020] should_fail_ex+0x412/0x560 [ 1448.706490][T15020] should_failslab+0xa8/0x100 [ 1448.706513][T15020] __kmalloc_cache_noprof+0x83/0x6e0 [ 1448.706530][T15020] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1448.706553][T15020] ? sctp_add_bind_addr+0x8c/0x370 [ 1448.706579][T15020] sctp_add_bind_addr+0x8c/0x370 [ 1448.706604][T15020] sctp_copy_local_addr_list+0x314/0x4f0 [ 1448.706630][T15020] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1448.706651][T15020] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1448.706673][T15020] ? sctp_v6_is_any+0x64/0x80 [ 1448.706695][T15020] ? sctp_copy_one_addr+0x93/0x360 [ 1448.706719][T15020] sctp_bind_addr_copy+0xb3/0x3c0 [ 1448.706741][T15020] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1448.706760][T15020] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1448.706784][T15020] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1448.706811][T15020] ? __local_bh_enable_ip+0xd0/0x130 [ 1448.706825][T15020] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1448.706842][T15020] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1448.706863][T15020] sctp_sendmsg+0x1528/0x2c10 [ 1448.706899][T15020] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1448.706919][T15020] ? aa_sk_perm+0x15a/0x960 [ 1448.706940][T15020] ? aa_sk_perm+0x82d/0x960 [ 1448.706957][T15020] ? __might_fault+0xaf/0x130 [ 1448.706986][T15020] ? __pfx_aa_sk_perm+0x10/0x10 [ 1448.707009][T15020] ? sock_rps_record_flow+0x19/0x400 [ 1448.707035][T15020] ? inet_sendmsg+0x2f4/0x370 [ 1448.707055][T15020] __sys_sendto+0x627/0x7a0 [ 1448.707077][T15020] ? __pfx___sys_sendto+0x10/0x10 [ 1448.707093][T15020] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1448.707125][T15020] ? __fget_files+0x3a0/0x420 [ 1448.707160][T15020] ? ksys_write+0x242/0x270 [ 1448.707183][T15020] ? __pfx_ksys_write+0x10/0x10 [ 1448.707210][T15020] __x64_sys_sendto+0xde/0x100 [ 1448.707231][T15020] do_syscall_64+0xe2/0xf80 [ 1448.707251][T15020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.707268][T15020] ? trace_irq_disable+0x37/0x100 [ 1448.707283][T15020] ? clear_bhb_loop+0x60/0xb0 [ 1448.707304][T15020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1448.707320][T15020] RIP: 0033:0x7efd3c59aeb9 [ 1448.707333][T15020] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1448.707345][T15020] RSP: 002b:00007efd3d38e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1448.707362][T15020] RAX: ffffffffffffffda RBX: 00007efd3c815fa0 RCX: 00007efd3c59aeb9 [ 1448.707372][T15020] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 1448.707381][T15020] RBP: 00007efd3d38e090 R08: 0000200000000080 R09: 000000000000001c [ 1448.707391][T15020] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000002 [ 1448.707400][T15020] R13: 00007efd3c816038 R14: 00007efd3c815fa0 R15: 00007ffce28a1f58 [ 1448.707423][T15020] [ 1449.067926][T15022] mac80211_hwsim hwsim86 syzkaller0: left promiscuous mode [ 1449.075202][T15022] mac80211_hwsim hwsim86 syzkaller0: left allmulticast mode [ 1449.555463][T15046] netlink: 'syz.4.10841': attribute type 21 has an invalid length. [ 1449.587824][T15046] netlink: 'syz.4.10841': attribute type 4 has an invalid length. [ 1449.598093][T15046] netlink: 'syz.4.10841': attribute type 3 has an invalid length. [ 1449.764196][T14894] lo speed is unknown, defaulting to 1000 [ 1450.448333][T15066] __nla_validate_parse: 19 callbacks suppressed [ 1450.448354][T15066] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10842'. [ 1450.477611][T15066] smc: ib device syz2 ibport 1 applied user defined pnetid S [ 1450.607745][T15073] netlink: 'syz.4.10843': attribute type 1 has an invalid length. [ 1450.615604][T15073] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10843'. [ 1450.669935][T14940] lo speed is unknown, defaulting to 1000 [ 1451.210313][T15092] syzkaller0: entered promiscuous mode [ 1451.215817][T15092] syzkaller0: entered allmulticast mode [ 1451.385374][T14986] lo speed is unknown, defaulting to 1000 [ 1452.928520][T15149] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1452.962698][T15147] syzkaller0: entered promiscuous mode [ 1452.970039][T15147] syzkaller0: entered allmulticast mode [ 1453.385960][T15156] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10863'. [ 1453.558981][T15160] vlan3: entered allmulticast mode [ 1454.117283][T15179] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10868'. [ 1454.845075][T15192] ip6_vti0 speed is unknown, defaulting to 1000 [ 1454.874415][T15196] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10870'. [ 1455.045579][T15200] netlink: 'syz.0.10871': attribute type 1 has an invalid length. [ 1455.060136][T15200] netlink: 224 bytes leftover after parsing attributes in process `syz.0.10871'. [ 1455.218865][T15203] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10872'. [ 1455.257627][T15203] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10872'. [ 1455.277257][T15203] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10872'. [ 1455.304341][T15203] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10872'. [ 1455.402963][T15211] vlan2: entered allmulticast mode [ 1455.409350][T15211] veth0_to_bond: entered allmulticast mode [ 1455.747511][T15225] netlink: 'syz.1.10879': attribute type 1 has an invalid length. [ 1455.755592][T15225] __nla_validate_parse: 1 callbacks suppressed [ 1455.755609][T15225] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10879'. [ 1455.773926][T15231] netlink: 48 bytes leftover after parsing attributes in process `syz.3.10880'. [ 1455.931898][T15235] netlink: 'syz.1.10882': attribute type 1 has an invalid length. [ 1455.947480][T15235] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10882'. [ 1455.998157][T15238] pim6reg: entered allmulticast mode [ 1456.005382][T15237] xt_hashlimit: size too large, truncated to 1048576 [ 1456.012228][ T8101] IPVS: starting estimator thread 0... [ 1456.094750][T15242] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 1456.116744][T15239] IPVS: using max 35 ests per chain, 84000 per kthread [ 1456.518501][T15192] lo speed is unknown, defaulting to 1000 [ 1456.560755][T15258] netlink: 'syz.3.10886': attribute type 15 has an invalid length. [ 1457.126083][T15284] FAULT_INJECTION: forcing a failure. [ 1457.126083][T15284] name failslab, interval 1, probability 0, space 0, times 0 [ 1457.149531][T15284] CPU: 0 UID: 0 PID: 15284 Comm: syz.0.10893 Not tainted syzkaller #0 PREEMPT(full) [ 1457.149566][T15284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1457.149576][T15284] Call Trace: [ 1457.149584][T15284] [ 1457.149592][T15284] dump_stack_lvl+0xe8/0x150 [ 1457.149619][T15284] should_fail_ex+0x412/0x560 [ 1457.149643][T15284] should_failslab+0xa8/0x100 [ 1457.149663][T15284] __kmalloc_noprof+0xde/0x7e0 [ 1457.149679][T15284] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 1457.149707][T15284] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 1457.149735][T15284] genl_family_rcv_msg_doit+0xd9/0x330 [ 1457.149764][T15284] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1457.149792][T15284] ? apparmor_capable+0x137/0x1a0 [ 1457.149815][T15284] ? bpf_lsm_capable+0x9/0x20 [ 1457.149834][T15284] ? security_capable+0x7e/0x2c0 [ 1457.149857][T15284] genl_rcv_msg+0x61c/0x7a0 [ 1457.149884][T15284] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1457.149905][T15284] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1457.149921][T15284] ? __pfx_nl80211_tx_mgmt+0x10/0x10 [ 1457.149940][T15284] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1457.149958][T15284] ? __pfx_ref_tracker_free+0x10/0x10 [ 1457.149989][T15284] netlink_rcv_skb+0x232/0x4b0 [ 1457.150009][T15284] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1457.150033][T15284] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1457.150048][T15284] ? genl_rcv+0x19/0x40 [ 1457.150068][T15282] netlink: 'syz.2.10892': attribute type 1 has an invalid length. [ 1457.150083][T15284] ? down_read+0x272/0x2e0 [ 1457.150104][T15284] ? genl_rcv+0xd/0x40 [ 1457.150122][T15284] genl_rcv+0x28/0x40 [ 1457.150139][T15284] netlink_unicast+0x80f/0x9b0 [ 1457.150165][T15284] ? __pfx_netlink_unicast+0x10/0x10 [ 1457.150185][T15284] ? netlink_sendmsg+0x650/0xb40 [ 1457.150202][T15284] ? skb_put+0x11b/0x210 [ 1457.150226][T15284] netlink_sendmsg+0x813/0xb40 [ 1457.150253][T15284] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1457.150275][T15284] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1457.150296][T15284] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1457.150315][T15284] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1457.150333][T15284] ____sys_sendmsg+0xa68/0xad0 [ 1457.150355][T15284] ? __might_fault+0xaf/0x130 [ 1457.150383][T15284] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1457.150412][T15284] ? import_iovec+0x73/0xa0 [ 1457.150438][T15284] ___sys_sendmsg+0x2a5/0x360 [ 1457.150457][T15284] ? __lock_acquire+0x6b5/0x2cf0 [ 1457.150483][T15284] ? __pfx____sys_sendmsg+0x10/0x10 [ 1457.150536][T15284] ? __fget_files+0x2a/0x420 [ 1457.150560][T15284] ? __fget_files+0x3a0/0x420 [ 1457.150587][T15284] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1457.150611][T15284] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1457.150641][T15284] ? __pfx_ksys_write+0x10/0x10 [ 1457.150674][T15284] do_syscall_64+0xe2/0xf80 [ 1457.150694][T15284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.150710][T15284] ? trace_irq_disable+0x37/0x100 [ 1457.150726][T15284] ? clear_bhb_loop+0x60/0xb0 [ 1457.150745][T15284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.150761][T15284] RIP: 0033:0x7f3d67f9aeb9 [ 1457.150778][T15284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1457.150792][T15284] RSP: 002b:00007f3d68df0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1457.150810][T15284] RAX: ffffffffffffffda RBX: 00007f3d68215fa0 RCX: 00007f3d67f9aeb9 [ 1457.150823][T15284] RDX: 0000000000000000 RSI: 0000200000001380 RDI: 0000000000000003 [ 1457.150833][T15284] RBP: 00007f3d68df0090 R08: 0000000000000000 R09: 0000000000000000 [ 1457.150844][T15284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1457.150854][T15284] R13: 00007f3d68216038 R14: 00007f3d68215fa0 R15: 00007ffec8435918 [ 1457.150884][T15284] [ 1457.523098][T15282] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10892'. [ 1457.780031][T15308] xt_hashlimit: size too large, truncated to 1048576 [ 1457.814730][T15301] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10898'. [ 1457.898121][T15314] ¾x9ÿ: renamed from bridge_slave_0 [ 1458.011155][T15301] delete_channel: no stack [ 1458.252324][T15330] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10904'. [ 1458.421578][T15332] syzkaller0: entered promiscuous mode [ 1458.429222][T15337] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10906'. [ 1458.455853][T15332] syzkaller0: entered allmulticast mode [ 1458.887633][T15353] netlink: 'syz.3.10910': attribute type 1 has an invalid length. [ 1458.930994][T15353] netlink: 224 bytes leftover after parsing attributes in process `syz.3.10910'. [ 1459.064458][T15343] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10907'. [ 1459.451872][T15366] FAULT_INJECTION: forcing a failure. [ 1459.451872][T15366] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1459.523529][T15366] CPU: 0 UID: 0 PID: 15366 Comm: syz.1.10913 Not tainted syzkaller #0 PREEMPT(full) [ 1459.523555][T15366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1459.523566][T15366] Call Trace: [ 1459.523573][T15366] [ 1459.523581][T15366] dump_stack_lvl+0xe8/0x150 [ 1459.523608][T15366] should_fail_ex+0x412/0x560 [ 1459.523633][T15366] _copy_to_user+0x31/0xb0 [ 1459.523665][T15366] simple_read_from_buffer+0xe1/0x170 [ 1459.523688][T15366] proc_fail_nth_read+0x1bb/0x230 [ 1459.523714][T15366] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1459.523737][T15366] ? rw_verify_area+0x2a6/0x4d0 [ 1459.523756][T15366] ? tun_chr_write_iter+0x18a/0x200 [ 1459.523772][T15366] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1459.523795][T15366] vfs_read+0x20c/0xa70 [ 1459.523814][T15366] ? fdget_pos+0x246/0x320 [ 1459.523836][T15366] ? __pfx___mutex_lock+0x10/0x10 [ 1459.523859][T15366] ? __pfx_vfs_read+0x10/0x10 [ 1459.523882][T15366] ? __fget_files+0x2a/0x420 [ 1459.523904][T15366] ? __fget_files+0x3a0/0x420 [ 1459.523920][T15366] ? __fget_files+0x2a/0x420 [ 1459.523946][T15366] ksys_read+0x150/0x270 [ 1459.523970][T15366] ? __pfx_ksys_read+0x10/0x10 [ 1459.524003][T15366] do_syscall_64+0xe2/0xf80 [ 1459.524023][T15366] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1459.524039][T15366] ? trace_irq_disable+0x37/0x100 [ 1459.524055][T15366] ? clear_bhb_loop+0x60/0xb0 [ 1459.524075][T15366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1459.524091][T15366] RIP: 0033:0x7fd133b5b78e [ 1459.524107][T15366] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1459.524121][T15366] RSP: 002b:00007fd131df5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1459.524142][T15366] RAX: ffffffffffffffda RBX: 00007fd131df66c0 RCX: 00007fd133b5b78e [ 1459.524154][T15366] RDX: 000000000000000f RSI: 00007fd131df60a0 RDI: 0000000000000003 [ 1459.524166][T15366] RBP: 00007fd131df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1459.524176][T15366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1459.524187][T15366] R13: 00007fd133e16038 R14: 00007fd133e15fa0 R15: 00007ffc5a1dcbb8 [ 1459.524217][T15366] [ 1459.997869][T15372] xt_hashlimit: size too large, truncated to 1048576 [ 1460.136336][T15383] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10917'. [ 1460.481211][T15397] netlink: 'syz.3.10920': attribute type 6 has an invalid length. [ 1460.500170][T15397] FAULT_INJECTION: forcing a failure. [ 1460.500170][T15397] name failslab, interval 1, probability 0, space 0, times 0 [ 1460.535309][T15397] CPU: 0 UID: 0 PID: 15397 Comm: syz.3.10920 Not tainted syzkaller #0 PREEMPT(full) [ 1460.535335][T15397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1460.535346][T15397] Call Trace: [ 1460.535353][T15397] [ 1460.535362][T15397] dump_stack_lvl+0xe8/0x150 [ 1460.535390][T15397] should_fail_ex+0x412/0x560 [ 1460.535417][T15397] should_failslab+0xa8/0x100 [ 1460.535439][T15397] __kmalloc_cache_noprof+0x83/0x6e0 [ 1460.535457][T15397] ? percpu_ref_get_many+0x19/0x140 [ 1460.535475][T15397] ? nsim_fib_event_nb+0x190/0x1210 [ 1460.535498][T15397] nsim_fib_event_nb+0x190/0x1210 [ 1460.535518][T15397] ? atomic_notifier_call_chain+0x26/0x180 [ 1460.535545][T15397] notifier_call_chain+0x19d/0x3a0 [ 1460.535574][T15397] ? atomic_notifier_call_chain+0x26/0x180 [ 1460.535594][T15397] atomic_notifier_call_chain+0xda/0x180 [ 1460.535615][T15397] call_fib_notifiers+0x31/0x60 [ 1460.535638][T15397] call_fib_entry_notifiers+0x158/0x200 [ 1460.535663][T15397] ? __pfx_call_fib_entry_notifiers+0x10/0x10 [ 1460.535690][T15397] ? lockdep_rtnl_is_held+0x26/0x40 [ 1460.535721][T15397] fib_table_insert+0xcce/0x1b50 [ 1460.535744][T15397] ? __pfx___mutex_lock+0x10/0x10 [ 1460.535779][T15397] ? fib_new_table+0x10a/0x2d0 [ 1460.535806][T15397] inet_rtm_newroute+0x14f/0x250 [ 1460.535826][T15397] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 1460.535863][T15397] ? __pfx_inet_rtm_newroute+0x10/0x10 [ 1460.535879][T15397] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1460.535903][T15397] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1460.535922][T15397] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1460.535941][T15397] ? __lock_acquire+0x6b5/0x2cf0 [ 1460.535978][T15397] netlink_rcv_skb+0x232/0x4b0 [ 1460.535999][T15397] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1460.536020][T15397] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1460.536051][T15397] ? netlink_deliver_tap+0x2e/0x1b0 [ 1460.536078][T15397] netlink_unicast+0x80f/0x9b0 [ 1460.536106][T15397] ? __pfx_netlink_unicast+0x10/0x10 [ 1460.536126][T15397] ? netlink_sendmsg+0x650/0xb40 [ 1460.536144][T15397] ? skb_put+0x11b/0x210 [ 1460.536169][T15397] netlink_sendmsg+0x813/0xb40 [ 1460.536198][T15397] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1460.536224][T15397] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1460.536244][T15397] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1460.536261][T15397] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1460.536278][T15397] ____sys_sendmsg+0xa68/0xad0 [ 1460.536298][T15397] ? __might_fault+0xaf/0x130 [ 1460.536324][T15397] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1460.536355][T15397] ? import_iovec+0x73/0xa0 [ 1460.536378][T15397] ___sys_sendmsg+0x2a5/0x360 [ 1460.536396][T15397] ? __lock_acquire+0x6b5/0x2cf0 [ 1460.536419][T15397] ? __pfx____sys_sendmsg+0x10/0x10 [ 1460.536469][T15397] ? __fget_files+0x2a/0x420 [ 1460.536486][T15397] ? __fget_files+0x3a0/0x420 [ 1460.536511][T15397] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1460.536536][T15397] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1460.536576][T15397] ? __pfx_ksys_write+0x10/0x10 [ 1460.536611][T15397] do_syscall_64+0xe2/0xf80 [ 1460.536632][T15397] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.536646][T15397] ? trace_irq_disable+0x37/0x100 [ 1460.536660][T15397] ? clear_bhb_loop+0x60/0xb0 [ 1460.536679][T15397] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.536695][T15397] RIP: 0033:0x7fe89459aeb9 [ 1460.536709][T15397] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1460.536721][T15397] RSP: 002b:00007fe89537d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1460.536739][T15397] RAX: ffffffffffffffda RBX: 00007fe894815fa0 RCX: 00007fe89459aeb9 [ 1460.536752][T15397] RDX: 0000000000000894 RSI: 0000200000000080 RDI: 0000000000000003 [ 1460.536763][T15397] RBP: 00007fe89537d090 R08: 0000000000000000 R09: 0000000000000000 [ 1460.536774][T15397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1460.536784][T15397] R13: 00007fe894816038 R14: 00007fe894815fa0 R15: 00007fffcc6ac218 [ 1460.536813][T15397] [ 1461.076612][T15398] netlink: 64 bytes leftover after parsing attributes in process `syz.1.10919'. [ 1461.154628][T15404] tipc: Enabling of bearer rejected, failed to enable media [ 1461.489352][T15426] netlink: 'syz.3.10930': attribute type 6 has an invalid length. [ 1461.517933][T15428] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10925'. [ 1461.994643][T15455] syzkaller0: entered promiscuous mode [ 1462.006105][T15455] syzkaller0: entered allmulticast mode [ 1462.492101][T15487] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10946'. [ 1462.545387][T15490] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1462.590225][T15493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10949'. [ 1462.600377][T15493] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10949'. [ 1462.611187][T15493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10949'. [ 1462.625926][T15493] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10949'. [ 1462.638913][T15496] netlink: 'syz.0.10949': attribute type 10 has an invalid length. [ 1462.657190][T15496] team0: Device vxcan1 is of different type [ 1462.702532][T15498] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10950'. [ 1462.740770][T15497] ip6_vti0 speed is unknown, defaulting to 1000 [ 1462.766104][T15503] netlink: 72 bytes leftover after parsing attributes in process `syz.0.10951'. [ 1463.440560][T15535] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10959'. [ 1463.532195][T15538] ip6_vti0 speed is unknown, defaulting to 1000 [ 1463.974171][T15548] vlan2: entered allmulticast mode [ 1464.030370][T15497] lo speed is unknown, defaulting to 1000 [ 1464.447284][T15561] syzkaller0: entered promiscuous mode [ 1464.452831][T15561] syzkaller0: entered allmulticast mode [ 1464.885650][T15579] FAULT_INJECTION: forcing a failure. [ 1464.885650][T15579] name failslab, interval 1, probability 0, space 0, times 0 [ 1464.898350][T15579] CPU: 0 UID: 0 PID: 15579 Comm: syz.3.10967 Not tainted syzkaller #0 PREEMPT(full) [ 1464.898375][T15579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1464.898387][T15579] Call Trace: [ 1464.898394][T15579] [ 1464.898402][T15579] dump_stack_lvl+0xe8/0x150 [ 1464.898429][T15579] should_fail_ex+0x412/0x560 [ 1464.898455][T15579] should_failslab+0xa8/0x100 [ 1464.898477][T15579] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1464.898501][T15579] ? skb_clone+0x212/0x3a0 [ 1464.898522][T15579] ? run_filter+0x23/0x270 [ 1464.898547][T15579] skb_clone+0x212/0x3a0 [ 1464.898568][T15579] ? packet_rcv+0x567/0x1720 [ 1464.898591][T15579] packet_rcv+0x65b/0x1720 [ 1464.898623][T15579] __netif_receive_skb_core+0x2797/0x3150 [ 1464.898641][T15579] ? is_bpf_text_address+0x26/0x2b0 [ 1464.898667][T15579] ? is_bpf_text_address+0x292/0x2b0 [ 1464.898690][T15579] ? kernel_text_address+0xa5/0xe0 [ 1464.898713][T15579] ? unwind_get_return_address+0x4d/0x90 [ 1464.898731][T15579] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1464.898757][T15579] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 1464.898796][T15579] ? put_cpu_partial+0x88/0x280 [ 1464.898819][T15579] ? kasan_save_track+0x4f/0x80 [ 1464.898834][T15579] ? kasan_save_track+0x3e/0x80 [ 1464.898848][T15579] ? __kasan_slab_alloc+0x6c/0x80 [ 1464.898864][T15579] ? kmem_cache_alloc_bulk_noprof+0x48c/0x740 [ 1464.898886][T15579] __netif_receive_skb_list_core+0x24d/0x810 [ 1464.898919][T15579] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 1464.898950][T15579] netif_receive_skb_list_internal+0x995/0xcf0 [ 1464.898975][T15579] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 1464.899002][T15579] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 1464.899032][T15579] ? __xdp_build_skb_from_frame+0x34b/0x730 [ 1464.899062][T15579] netif_receive_skb_list+0x54/0x410 [ 1464.899083][T15579] bpf_test_run_xdp_live+0x1946/0x1cf0 [ 1464.899124][T15579] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 1464.899155][T15579] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1464.899197][T15579] ? 0xffffffffa02016dc [ 1464.899240][T15579] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1464.899271][T15579] ? _copy_from_user+0x94/0xb0 [ 1464.899295][T15579] ? bpf_test_init+0x113/0x150 [ 1464.899311][T15579] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1464.899334][T15579] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1464.899367][T15579] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1464.899392][T15579] ? __fget_files+0x2a/0x420 [ 1464.899415][T15579] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1464.899436][T15579] bpf_prog_test_run+0x2c7/0x340 [ 1464.899460][T15579] __sys_bpf+0x5cb/0x920 [ 1464.899481][T15579] ? __pfx___sys_bpf+0x10/0x10 [ 1464.899515][T15579] ? ksys_write+0x242/0x270 [ 1464.899540][T15579] ? __pfx_ksys_write+0x10/0x10 [ 1464.899570][T15579] __x64_sys_bpf+0x7c/0x90 [ 1464.899594][T15579] do_syscall_64+0xe2/0xf80 [ 1464.899615][T15579] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1464.899630][T15579] ? trace_irq_disable+0x37/0x100 [ 1464.899645][T15579] ? clear_bhb_loop+0x60/0xb0 [ 1464.899665][T15579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1464.899681][T15579] RIP: 0033:0x7fe89459aeb9 [ 1464.899695][T15579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1464.899708][T15579] RSP: 002b:00007fe89537d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1464.899728][T15579] RAX: ffffffffffffffda RBX: 00007fe894815fa0 RCX: 00007fe89459aeb9 [ 1464.899741][T15579] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1464.899752][T15579] RBP: 00007fe89537d090 R08: 0000000000000000 R09: 0000000000000000 [ 1464.899762][T15579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1464.899773][T15579] R13: 00007fe894816038 R14: 00007fe894815fa0 R15: 00007fffcc6ac218 [ 1464.899803][T15579] [ 1465.577231][T15538] lo speed is unknown, defaulting to 1000 [ 1465.670752][T15590] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1465.793361][T15590] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1465.842633][T15596] netlink: 'syz.2.10972': attribute type 1 has an invalid length. [ 1466.003935][T15590] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1466.156874][T15590] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1466.294804][T15617] __nla_validate_parse: 3 callbacks suppressed [ 1466.294822][T15617] netlink: 200 bytes leftover after parsing attributes in process `syz.1.10978'. [ 1466.425769][ T1156] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1466.512847][ T11] block nbd3: Possible stuck request ffff8880259a8000: control (read@0,1024B). Runtime 300 seconds [ 1466.524836][ T11] block nbd3: Possible stuck request ffff8880259a8200: control (read@1024,1024B). Runtime 300 seconds [ 1466.537312][ T11] block nbd3: Possible stuck request ffff8880259a8400: control (read@2048,1024B). Runtime 300 seconds [ 1466.549076][ T11] block nbd3: Possible stuck request ffff8880259b0000: control (read@3072,1024B). Runtime 300 seconds [ 1466.658889][ T8049] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1466.668726][ T8049] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1466.679871][ T8049] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1466.868286][T15629] smc: ib device syz2 ibport 1 erased user defined pnetid S [ 1467.196853][T15638] netlink: 'syz.3.10984': attribute type 2 has an invalid length. [ 1467.479514][T15653] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10987'. [ 1467.572676][T15656] netlink: 'syz.1.10988': attribute type 1 has an invalid length. [ 1467.581019][T15656] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10988'. [ 1467.812120][T15667] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1467.837318][T15669] netlink: 'syz.3.10992': attribute type 58 has an invalid length. [ 1467.874539][T15669] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10992'. [ 1468.004578][T15677] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10993'. [ 1468.034042][T15677] nbd: couldn't find a device at index 117440512 [ 1468.249870][T15682] syzkaller0: entered promiscuous mode [ 1468.265772][T15682] syzkaller0: entered allmulticast mode [ 1468.524242][T15693] netlink: 'syz.3.10999': attribute type 1 has an invalid length. [ 1468.537974][T15695] FAULT_INJECTION: forcing a failure. [ 1468.537974][T15695] name failslab, interval 1, probability 0, space 0, times 0 [ 1468.545642][T15693] netlink: 224 bytes leftover after parsing attributes in process `syz.3.10999'. [ 1468.554367][T15662] lec:lec_atm_close: lec0: Shut down! [ 1468.594677][T15695] CPU: 0 UID: 0 PID: 15695 Comm: syz.0.10998 Not tainted syzkaller #0 PREEMPT(full) [ 1468.594703][T15695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1468.594714][T15695] Call Trace: [ 1468.594722][T15695] [ 1468.594730][T15695] dump_stack_lvl+0xe8/0x150 [ 1468.594757][T15695] should_fail_ex+0x412/0x560 [ 1468.594783][T15695] should_failslab+0xa8/0x100 [ 1468.594805][T15695] __kmalloc_cache_noprof+0x83/0x6e0 [ 1468.594822][T15695] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 1468.594843][T15695] ? sctp_add_bind_addr+0x8c/0x370 [ 1468.594868][T15695] sctp_add_bind_addr+0x8c/0x370 [ 1468.594893][T15695] sctp_copy_local_addr_list+0x314/0x4f0 [ 1468.594918][T15695] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1468.594939][T15695] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1468.594960][T15695] ? sctp_v6_is_any+0x64/0x80 [ 1468.594982][T15695] ? sctp_copy_one_addr+0x93/0x360 [ 1468.595005][T15695] sctp_bind_addr_copy+0xb3/0x3c0 [ 1468.595027][T15695] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1468.595050][T15695] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1468.595075][T15695] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1468.595111][T15695] ? __local_bh_enable_ip+0xd0/0x130 [ 1468.595126][T15695] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1468.595144][T15695] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1468.595165][T15695] sctp_sendmsg+0x1528/0x2c10 [ 1468.595202][T15695] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1468.595223][T15695] ? aa_sk_perm+0x15a/0x960 [ 1468.595244][T15695] ? aa_sk_perm+0x82d/0x960 [ 1468.595261][T15695] ? __might_fault+0xaf/0x130 [ 1468.595291][T15695] ? __pfx_aa_sk_perm+0x10/0x10 [ 1468.595314][T15695] ? sock_rps_record_flow+0x19/0x400 [ 1468.595340][T15695] ? inet_sendmsg+0x2f4/0x370 [ 1468.595361][T15695] __sys_sendto+0x627/0x7a0 [ 1468.595385][T15695] ? __pfx___sys_sendto+0x10/0x10 [ 1468.595403][T15695] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1468.595438][T15695] ? __fget_files+0x3a0/0x420 [ 1468.595467][T15695] ? ksys_write+0x242/0x270 [ 1468.595491][T15695] ? __pfx_ksys_write+0x10/0x10 [ 1468.595519][T15695] __x64_sys_sendto+0xde/0x100 [ 1468.595543][T15695] do_syscall_64+0xe2/0xf80 [ 1468.595564][T15695] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1468.595580][T15695] ? trace_irq_disable+0x37/0x100 [ 1468.595597][T15695] ? clear_bhb_loop+0x60/0xb0 [ 1468.595618][T15695] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1468.595635][T15695] RIP: 0033:0x7f3d67f9aeb9 [ 1468.595651][T15695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1468.595665][T15695] RSP: 002b:00007f3d68df0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1468.595685][T15695] RAX: ffffffffffffffda RBX: 00007f3d68215fa0 RCX: 00007f3d67f9aeb9 [ 1468.595698][T15695] RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000003 [ 1468.595709][T15695] RBP: 00007f3d68df0090 R08: 0000200000000080 R09: 000000000000001c [ 1468.595721][T15695] R10: 0000000000000051 R11: 0000000000000246 R12: 0000000000000002 [ 1468.595732][T15695] R13: 00007f3d68216038 R14: 00007f3d68215fa0 R15: 00007ffec8435918 [ 1468.595762][T15695] [ 1469.031243][T15706] mac80211_hwsim hwsim86 syzkaller0: entered promiscuous mode [ 1469.075774][T15706] mac80211_hwsim hwsim86 syzkaller0: entered allmulticast mode [ 1469.252585][T15717] FAULT_INJECTION: forcing a failure. [ 1469.252585][T15717] name failslab, interval 1, probability 0, space 0, times 0 [ 1469.276787][T15717] CPU: 0 UID: 0 PID: 15717 Comm: syz.4.11004 Not tainted syzkaller #0 PREEMPT(full) [ 1469.276812][T15717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1469.276823][T15717] Call Trace: [ 1469.276830][T15717] [ 1469.276838][T15717] dump_stack_lvl+0xe8/0x150 [ 1469.276864][T15717] should_fail_ex+0x412/0x560 [ 1469.276890][T15717] should_failslab+0xa8/0x100 [ 1469.276912][T15717] __kmalloc_cache_noprof+0x83/0x6e0 [ 1469.276929][T15717] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1469.276960][T15717] ? sctp_add_bind_addr+0x8c/0x370 [ 1469.276985][T15717] sctp_add_bind_addr+0x8c/0x370 [ 1469.277010][T15717] sctp_copy_local_addr_list+0x314/0x4f0 [ 1469.277035][T15717] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1469.277054][T15717] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1469.277075][T15717] ? sctp_v6_is_any+0x64/0x80 [ 1469.277095][T15717] ? sctp_copy_one_addr+0x93/0x360 [ 1469.277115][T15717] sctp_bind_addr_copy+0xb3/0x3c0 [ 1469.277136][T15717] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1469.277157][T15717] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1469.277183][T15717] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1469.277211][T15717] ? __local_bh_enable_ip+0xd0/0x130 [ 1469.277225][T15717] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1469.277244][T15717] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1469.277263][T15717] sctp_sendmsg+0x1528/0x2c10 [ 1469.277283][T15717] ? unwind_next_frame+0xa5/0x23c0 [ 1469.277313][T15717] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1469.277331][T15717] ? aa_sk_perm+0x15a/0x960 [ 1469.277351][T15717] ? aa_sk_perm+0x82d/0x960 [ 1469.277377][T15717] ? __pfx_aa_sk_perm+0x10/0x10 [ 1469.277397][T15717] ? sock_rps_record_flow+0x19/0x400 [ 1469.277423][T15717] ? inet_sendmsg+0x2f4/0x370 [ 1469.277441][T15717] ____sys_sendmsg+0x894/0xad0 [ 1469.277470][T15717] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1469.277500][T15717] ? import_iovec+0x73/0xa0 [ 1469.277526][T15717] ___sys_sendmsg+0x2a5/0x360 [ 1469.277547][T15717] ? __lock_acquire+0x6b5/0x2cf0 [ 1469.277573][T15717] ? __pfx____sys_sendmsg+0x10/0x10 [ 1469.277630][T15717] ? __fget_files+0x2a/0x420 [ 1469.277646][T15717] ? __fget_files+0x3a0/0x420 [ 1469.277674][T15717] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1469.277699][T15717] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1469.277728][T15717] ? __pfx_ksys_write+0x10/0x10 [ 1469.277757][T15717] do_syscall_64+0xe2/0xf80 [ 1469.277774][T15717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1469.277790][T15717] ? trace_irq_disable+0x37/0x100 [ 1469.277805][T15717] ? clear_bhb_loop+0x60/0xb0 [ 1469.277825][T15717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1469.277838][T15717] RIP: 0033:0x7efd3c59aeb9 [ 1469.277853][T15717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1469.277865][T15717] RSP: 002b:00007efd3d38e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1469.277881][T15717] RAX: ffffffffffffffda RBX: 00007efd3c815fa0 RCX: 00007efd3c59aeb9 [ 1469.277892][T15717] RDX: 0000000000040000 RSI: 00002000000027c0 RDI: 0000000000000003 [ 1469.277901][T15717] RBP: 00007efd3d38e090 R08: 0000000000000000 R09: 0000000000000000 [ 1469.277910][T15717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1469.277917][T15717] R13: 00007efd3c816038 R14: 00007efd3c815fa0 R15: 00007ffce28a1f58 [ 1469.277938][T15717] [ 1469.752405][T15734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11007'. [ 1469.785446][T15733] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 0 [ 1470.050573][T15747] ip6_vti0 speed is unknown, defaulting to 1000 [ 1470.171446][T15754] pim6reg1: tun_chr_ioctl cmd 1074025677 [ 1470.188174][T15754] pim6reg1: linktype set to 805 [ 1470.571041][T15766] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11016'. [ 1470.577672][T15764] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11014'. [ 1470.611351][T15764] sch_tbf: burst 0 is lower than device syzkaller0 mtu (313) ! [ 1470.678288][T15770] syzkaller0: entered promiscuous mode [ 1470.694063][T15770] syzkaller0: entered allmulticast mode [ 1470.857589][T15782] syzkaller0: entered promiscuous mode [ 1470.867946][T15782] syzkaller0: entered allmulticast mode [ 1471.085587][T15794] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11022'. [ 1471.137002][T15747] lo speed is unknown, defaulting to 1000 [ 1471.148383][T11864] Bluetooth: hci0: command 0x0406 tx timeout [ 1471.482502][T15805] ip6_vti0 speed is unknown, defaulting to 1000 [ 1471.749673][T15818] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11026'. [ 1472.193916][T15835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11029'. [ 1472.230308][T15835] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11029'. [ 1472.299123][T15835] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11029'. [ 1472.308179][ T8049] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1472.308437][ T8049] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1472.308502][ T8049] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1472.308534][ T8049] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1472.322602][T15838] netlink: 'syz.4.11030': attribute type 1 has an invalid length. [ 1472.326718][T15835] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11029'. [ 1472.343571][T15843] netlink: 'syz.1.11029': attribute type 10 has an invalid length. [ 1472.375713][T15838] netlink: 224 bytes leftover after parsing attributes in process `syz.4.11030'. [ 1472.502150][T15843] vxcan1: left allmulticast mode [ 1472.517287][T15843] vxcan1: entered allmulticast mode [ 1472.537868][T15843] team0: Device vxcan1 is of different type [ 1472.630454][T15844] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11031'. [ 1473.010552][T15805] lo speed is unknown, defaulting to 1000 [ 1473.694377][T15875] netlink: 'syz.4.11038': attribute type 32 has an invalid length. [ 1473.766186][T15875] netlink: 60 bytes leftover after parsing attributes in process `syz.4.11038'. [ 1473.786668][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5240 ms [ 1473.794753][ C0] lec:lec_tx_timeout: lec0 [ 1474.061831][T15886] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11040'. [ 1474.372383][T15897] netlink: 'syz.1.11042': attribute type 1 has an invalid length. [ 1474.397678][T15897] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11042'. [ 1475.092223][T15926] lo: left promiscuous mode [ 1475.107781][T15926] lo: left allmulticast mode [ 1475.151217][T15926] tunl0: left promiscuous mode [ 1475.175689][T15926] tunl0: left allmulticast mode [ 1475.190393][T15926] gre0: left promiscuous mode [ 1475.211045][T15926] gre0: left allmulticast mode [ 1475.223820][T15926] gretap0: left promiscuous mode [ 1475.240937][T15926] gretap0: left allmulticast mode [ 1475.252979][T15926] erspan0: left promiscuous mode [ 1475.264090][T15926] erspan0: left allmulticast mode [ 1475.274327][T15926] ip_vti0: left promiscuous mode [ 1475.285440][T15926] ip_vti0: left allmulticast mode [ 1475.293286][T15926] ip6_vti0: left promiscuous mode [ 1475.348437][T15926] ip6_vti0: left allmulticast mode [ 1475.353733][T15926] sit0: left promiscuous mode [ 1475.362175][T15926] sit0: left allmulticast mode [ 1475.372321][T15926] ip6tnl0: left promiscuous mode [ 1475.378554][T15926] ip6tnl0: left allmulticast mode [ 1475.383927][T15926] ip6gre0: left promiscuous mode [ 1475.390008][T15926] ip6gre0: left allmulticast mode [ 1475.395386][T15926] syz_tun: left allmulticast mode [ 1475.420361][T15926] ip6gretap0: left promiscuous mode [ 1475.465849][T15926] ip6gretap0: left allmulticast mode [ 1475.518924][T15941] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1475.536578][T15926] vcan0: left promiscuous mode [ 1475.556818][T15926] vcan0: left allmulticast mode [ 1475.572082][T15926] bond0: left promiscuous mode [ 1475.592374][T15926] bond0: left allmulticast mode [ 1475.622695][T15926] team0: left allmulticast mode [ 1475.649016][T15926] dummy0: left promiscuous mode [ 1475.664124][T15926] dummy0: left allmulticast mode [ 1475.675545][T15926] nlmon0: left promiscuous mode [ 1475.693770][T15926] nlmon0: left allmulticast mode [ 1475.712556][T15926] caif0: left promiscuous mode [ 1475.729668][T15926] caif0: left allmulticast mode [ 1475.760633][T15926] batadv0: left promiscuous mode [ 1475.770887][T15926] batadv0: left allmulticast mode [ 1475.777047][T15926] vxcan0: left promiscuous mode [ 1475.782032][T15926] vxcan0: left allmulticast mode [ 1475.790223][T15926] veth0: left promiscuous mode [ 1475.795122][T15926] veth0: left allmulticast mode [ 1475.800266][T15926] veth1: left promiscuous mode [ 1475.805040][T15926] veth1: left allmulticast mode [ 1475.810467][T15926] wg0: left promiscuous mode [ 1475.815057][T15926] wg0: left allmulticast mode [ 1475.821029][T15926] wg1: left promiscuous mode [ 1475.825738][T15926] wg1: left allmulticast mode [ 1475.831020][T15926] wg2: left promiscuous mode [ 1475.835606][T15926] wg2: left allmulticast mode [ 1475.841170][T15926] veth0_to_bridge: left promiscuous mode [ 1475.847098][T15926] veth0_to_bridge: left allmulticast mode [ 1475.853000][T15926] veth1_to_bridge: left promiscuous mode [ 1475.859289][T15926] veth1_to_bridge: left allmulticast mode [ 1475.865203][T15926] veth0_to_bond: left promiscuous mode [ 1475.877714][T15926] veth0_to_bond: left allmulticast mode [ 1475.883411][T15926] bond_slave_0: left promiscuous mode [ 1475.889229][T15926] bond_slave_0: left allmulticast mode [ 1475.894849][T15926] veth1_to_bond: left promiscuous mode [ 1475.900750][T15926] veth1_to_bond: left allmulticast mode [ 1475.906531][T15926] bond_slave_1: left promiscuous mode [ 1475.911910][T15926] bond_slave_1: left allmulticast mode [ 1475.917756][T15926] veth0_to_team: left promiscuous mode [ 1475.923228][T15926] veth0_to_team: left allmulticast mode [ 1475.929435][T15926] team_slave_0: left allmulticast mode [ 1475.934997][T15926] veth0_to_batadv: left promiscuous mode [ 1475.941152][T15926] veth0_to_batadv: left allmulticast mode [ 1475.947445][T15926] batadv_slave_0: left allmulticast mode [ 1475.953187][T15926] veth1_to_batadv: left promiscuous mode [ 1475.959354][T15926] veth1_to_batadv: left allmulticast mode [ 1475.965190][T15926] batadv_slave_1: left promiscuous mode [ 1475.971266][T15926] batadv_slave_1: left allmulticast mode [ 1475.977633][T15926] xfrm0: left promiscuous mode [ 1475.982417][T15926] xfrm0: left allmulticast mode [ 1475.987949][T15926] veth0_to_hsr: left promiscuous mode [ 1475.993363][T15926] veth0_to_hsr: left allmulticast mode [ 1475.999562][T15926] .70·: left promiscuous mode [ 1476.004240][T15926] .70·: left allmulticast mode [ 1476.009495][T15926] hsr_slave_0: left allmulticast mode [ 1476.015011][T15926] veth1_virt_wifi: left promiscuous mode [ 1476.021049][T15926] veth1_virt_wifi: left allmulticast mode [ 1476.027172][T15926] veth0_virt_wifi: left promiscuous mode [ 1476.032825][T15926] veth0_virt_wifi: left allmulticast mode [ 1476.038825][T15926] net veth1_virt_wifi virt_wifi0: left promiscuous mode [ 1476.045777][T15926] net veth1_virt_wifi virt_wifi0: left allmulticast mode [ 1476.053456][T15926] veth1_vlan: left allmulticast mode [ 1476.059569][T15926] vlan0: left promiscuous mode [ 1476.064443][T15926] vlan0: left allmulticast mode [ 1476.069859][T15926] vlan1: left promiscuous mode [ 1476.074728][T15926] vlan1: left allmulticast mode [ 1476.080326][T15926] macvlan0: left promiscuous mode [ 1476.085367][T15926] macvlan0: left allmulticast mode [ 1476.091093][T15926] macvlan1: left promiscuous mode [ 1476.096113][T15926] macvlan1: left allmulticast mode [ 1476.101979][T15926] ipvlan0: left promiscuous mode [ 1476.107384][T15926] ipvlan0: left allmulticast mode [ 1476.112535][T15926] ipvlan1: left promiscuous mode [ 1476.117994][T15926] ipvlan1: left allmulticast mode [ 1476.123033][T15926] veth0_vlan: left allmulticast mode [ 1476.128906][T15926] veth1_macvtap: left allmulticast mode [ 1476.134569][T15926] veth0_macvtap: left allmulticast mode [ 1476.140682][T15926] macvtap0: left promiscuous mode [ 1476.145802][T15926] macsec0: left promiscuous mode [ 1476.150796][T15926] macsec0: left allmulticast mode [ 1476.155912][T15926] geneve0: left promiscuous mode [ 1476.160997][T15926] geneve0: left allmulticast mode [ 1476.166140][T15926] geneve1: left promiscuous mode [ 1476.171491][T15926] geneve1: left allmulticast mode [ 1476.177087][T15926] mac80211_hwsim hwsim120 wlan0: left promiscuous mode [ 1476.183956][T15926] mac80211_hwsim hwsim120 wlan0: left allmulticast mode [ 1476.191524][T15926] mac80211_hwsim hwsim121 wlan1: left promiscuous mode [ 1476.199700][T15926] mac80211_hwsim hwsim121 wlan1: left allmulticast mode [ 1476.207542][T15926] bridge1: left promiscuous mode [ 1476.212539][T15926] bridge1: left allmulticast mode [ 1476.218161][T15926] macvlan2: left promiscuous mode [ 1476.223187][T15926] macvlan2: left allmulticast mode [ 1476.228861][T15926] macsec1: left promiscuous mode [ 1476.233801][T15926] macsec1: left allmulticast mode [ 1476.239438][T15926] bridge2: left promiscuous mode [ 1476.244377][T15926] bridge2: left allmulticast mode [ 1476.249961][T15926] ip6erspan0: left promiscuous mode [ 1476.255152][T15926] ip6erspan0: left allmulticast mode [ 1476.260973][T15926] vlan2: left promiscuous mode [ 1476.265731][T15926] bridge0: left promiscuous mode [ 1476.270838][T15926] vlan2: left allmulticast mode [ 1476.275697][T15926] bridge0: left allmulticast mode [ 1476.281002][T15926] macvtap1: left promiscuous mode [ 1476.286019][T15926] macvtap1: left allmulticast mode [ 1476.291741][T15926] netdevsim netdevsim1 eth0: left promiscuous mode [ 1476.298698][T15926] netdevsim netdevsim1 eth0: left allmulticast mode [ 1476.305416][T15926] netdevsim netdevsim1 eth1: left promiscuous mode [ 1476.312409][T15926] netdevsim netdevsim1 eth1: left allmulticast mode [ 1476.319770][T15926] netdevsim netdevsim1 eth2: left promiscuous mode [ 1476.326746][T15926] netdevsim netdevsim1 eth2: left allmulticast mode [ 1476.333452][T15926] netdevsim netdevsim1 eth3: left promiscuous mode [ 1476.340397][T15926] netdevsim netdevsim1 eth3: left allmulticast mode [ 1476.347511][T15926] macsec2: left promiscuous mode [ 1476.352447][T15926] macsec2: left allmulticast mode [ 1476.358054][T15926] veth2: left promiscuous mode [ 1476.362812][T15926] veth2: left allmulticast mode [ 1476.368215][T15926] veth3: left promiscuous mode [ 1476.372974][T15926] veth3: left allmulticast mode [ 1476.378347][T15926] mac80211_hwsim hwsim142 wlan2: left promiscuous mode [ 1476.385281][T15926] mac80211_hwsim hwsim142 wlan2: left allmulticast mode [ 1476.392429][T15926] mac80211_hwsim hwsim143 wlan3: left promiscuous mode [ 1476.399419][T15926] mac80211_hwsim hwsim143 wlan3: left allmulticast mode [ 1476.407030][T15926] bond1: left promiscuous mode [ 1476.411800][T15926] bond1: left allmulticast mode [ 1476.418013][T15926] macvlan3: left promiscuous mode [ 1476.434789][T15926] macvlan4: left promiscuous mode [ 1476.575290][ T1156] netdevsim netdevsim1 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1476.584024][ T1156] netdevsim netdevsim1 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1476.603147][ T1156] netdevsim netdevsim1 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1476.646101][ T1156] netdevsim netdevsim1 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1477.075126][T15988] __nla_validate_parse: 4 callbacks suppressed [ 1477.075145][T15988] netlink: 200 bytes leftover after parsing attributes in process `syz.0.11063'. [ 1477.395660][T16005] syzkaller0: entered promiscuous mode [ 1477.409519][T16005] syzkaller0: entered allmulticast mode [ 1477.550187][T16016] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11070'. [ 1477.670656][T16013] ip6_vti0 speed is unknown, defaulting to 1000 [ 1477.787875][T16022] vlan3: entered allmulticast mode [ 1478.127772][T16038] ip6gre1: entered promiscuous mode [ 1478.170829][T16042] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1478.421519][T16052] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11079'. [ 1478.811132][T16064] macvtap2: entered promiscuous mode [ 1478.819284][T16064] macvtap2: entered allmulticast mode [ 1478.834540][T16064] batadv0: entered allmulticast mode [ 1478.851339][T16064] batadv0: entered promiscuous mode [ 1478.870146][T16064] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 1478.880028][T16064] team0: Device macvtap2 failed to register rx_handler [ 1478.890658][T16069] nbd: must specify at least one socket [ 1478.897041][T16069] netlink: 64 bytes leftover after parsing attributes in process `syz.3.11084'. [ 1478.906757][T16069] block nbd0: reconnected socket [ 1478.913752][ T510] block nbd0: Receive control failed (result -32) [ 1478.921708][T16064] batadv0: left allmulticast mode [ 1478.927345][T16064] batadv0: left promiscuous mode [ 1479.091845][T16073] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11085'. [ 1479.257164][T16078] syzkaller0: entered promiscuous mode [ 1479.262678][T16078] syzkaller0: entered allmulticast mode [ 1479.544959][T16013] lo speed is unknown, defaulting to 1000 [ 1480.128029][T16132] FAULT_INJECTION: forcing a failure. [ 1480.128029][T16132] name failslab, interval 1, probability 0, space 0, times 0 [ 1480.143985][T16132] CPU: 0 UID: 0 PID: 16132 Comm: syz.2.11097 Not tainted syzkaller #0 PREEMPT(full) [ 1480.144011][T16132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1480.144023][T16132] Call Trace: [ 1480.144030][T16132] [ 1480.144038][T16132] dump_stack_lvl+0xe8/0x150 [ 1480.144066][T16132] should_fail_ex+0x412/0x560 [ 1480.144091][T16132] should_failslab+0xa8/0x100 [ 1480.144113][T16132] __kmalloc_noprof+0xde/0x7e0 [ 1480.144131][T16132] ? tomoyo_encode+0x28b/0x550 [ 1480.144155][T16132] tomoyo_encode+0x28b/0x550 [ 1480.144179][T16132] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1480.144200][T16132] ? tomoyo_domain+0xd7/0x130 [ 1480.144226][T16132] ? tomoyo_path_number_perm+0x219/0x630 [ 1480.144244][T16132] tomoyo_path_number_perm+0x246/0x630 [ 1480.144267][T16132] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1480.144284][T16132] ? __lock_acquire+0x6b5/0x2cf0 [ 1480.144320][T16132] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1480.144362][T16132] ? __fget_files+0x2a/0x420 [ 1480.144383][T16132] ? __fget_files+0x2a/0x420 [ 1480.144400][T16132] ? __fget_files+0x3a0/0x420 [ 1480.144417][T16132] ? __fget_files+0x2a/0x420 [ 1480.144439][T16132] security_file_ioctl+0xc3/0x2a0 [ 1480.144460][T16132] __se_sys_ioctl+0x47/0x170 [ 1480.144486][T16132] do_syscall_64+0xe2/0xf80 [ 1480.144506][T16132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1480.144524][T16132] ? clear_bhb_loop+0x60/0xb0 [ 1480.144544][T16132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1480.144560][T16132] RIP: 0033:0x7f910159aeb9 [ 1480.144575][T16132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1480.144589][T16132] RSP: 002b:00007f90ff7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1480.144607][T16132] RAX: ffffffffffffffda RBX: 00007f9101815fa0 RCX: 00007f910159aeb9 [ 1480.144619][T16132] RDX: 0000200000000140 RSI: 00000000000089f1 RDI: 0000000000000003 [ 1480.144629][T16132] RBP: 00007f90ff7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1480.144639][T16132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1480.144649][T16132] R13: 00007f9101816038 R14: 00007f9101815fa0 R15: 00007ffd1aeb3128 [ 1480.144679][T16132] [ 1480.144697][T16132] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1480.284088][T16141] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11098'. [ 1480.418829][T16141] macvlan2: entered promiscuous mode [ 1480.572605][T16153] syzkaller0: entered promiscuous mode [ 1480.587221][T16153] syzkaller0: entered allmulticast mode [ 1480.909648][T16168] netlink: 'syz.2.11106': attribute type 13 has an invalid length. [ 1480.927019][T16168] netlink: 'syz.2.11106': attribute type 17 has an invalid length. [ 1481.023418][T16168] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1481.294694][T16179] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11109'. [ 1482.468453][T16189] FAULT_INJECTION: forcing a failure. [ 1482.468453][T16189] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1482.481780][T16189] CPU: 1 UID: 0 PID: 16189 Comm: syz.0.11112 Not tainted syzkaller #0 PREEMPT(full) [ 1482.481804][T16189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1482.481812][T16189] Call Trace: [ 1482.481817][T16189] [ 1482.481821][T16189] dump_stack_lvl+0xe8/0x150 [ 1482.481839][T16189] should_fail_ex+0x412/0x560 [ 1482.481855][T16189] _copy_from_user+0x2d/0xb0 [ 1482.481870][T16189] ___sys_recvmsg+0x175/0x590 [ 1482.481889][T16189] ? __pfx____sys_recvmsg+0x10/0x10 [ 1482.481905][T16189] ? __fget_files+0x2a/0x420 [ 1482.481930][T16189] do_recvmmsg+0x334/0x800 [ 1482.481948][T16189] ? __pfx_do_recvmmsg+0x10/0x10 [ 1482.481968][T16189] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1482.481990][T16189] __x64_sys_recvmmsg+0x198/0x250 [ 1482.482006][T16189] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1482.482025][T16189] do_syscall_64+0xe2/0xf80 [ 1482.482039][T16189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1482.482048][T16189] ? clear_bhb_loop+0x60/0xb0 [ 1482.482060][T16189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1482.482070][T16189] RIP: 0033:0x7f3d67f9aeb9 [ 1482.482080][T16189] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1482.482088][T16189] RSP: 002b:00007f3d68df0028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1482.482100][T16189] RAX: ffffffffffffffda RBX: 00007f3d68215fa0 RCX: 00007f3d67f9aeb9 [ 1482.482107][T16189] RDX: 03db66e6159adff3 RSI: 0000200000000180 RDI: 0000000000000009 [ 1482.482114][T16189] RBP: 00007f3d68df0090 R08: 0000000000000000 R09: 0000000000000000 [ 1482.482120][T16189] R10: 0000000000010100 R11: 0000000000000246 R12: 0000000000000002 [ 1482.482126][T16189] R13: 00007f3d68216038 R14: 00007f3d68215fa0 R15: 00007ffec8435918 [ 1482.482142][T16189] [ 1482.870430][T16116] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1482.901154][T16186] netlink: 'syz.1.11111': attribute type 1 has an invalid length. [ 1482.909455][T16186] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11111'. [ 1483.061100][T16197] syzkaller0: entered promiscuous mode [ 1483.079637][T16197] syzkaller0: entered allmulticast mode [ 1483.361177][T16214] bond5: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 1483.482964][T16214] bond5 (unregistering): Released all slaves [ 1483.711099][T16228] syzkaller1: entered promiscuous mode [ 1483.731007][T16228] syzkaller1: entered allmulticast mode [ 1483.752529][T16228] netlink: 40 bytes leftover after parsing attributes in process `syz.1.11120'. [ 1483.832401][T16233] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1483.951587][T16233] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1483.963862][T16236] netlink: 'syz.4.11123': attribute type 1 has an invalid length. [ 1483.974793][T16236] netlink: 224 bytes leftover after parsing attributes in process `syz.4.11123'. [ 1483.999659][T16241] syzkaller0: entered promiscuous mode [ 1484.017779][T16241] syzkaller0: entered allmulticast mode [ 1484.019409][T16244] netlink: 52 bytes leftover after parsing attributes in process `syz.0.11126'. [ 1484.044358][T16233] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1484.223793][T16233] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1484.327747][T16253] netlink: 'syz.1.11130': attribute type 1 has an invalid length. [ 1484.335675][T16253] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11130'. [ 1484.438533][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1484.450135][ T36] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1484.486462][ T36] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1484.494724][ T36] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1484.528175][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1484.667593][T16274] netlink: 744 bytes leftover after parsing attributes in process `syz.4.11134'. [ 1484.741108][T16274] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11134'. [ 1484.945727][T16284] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11138'. [ 1484.955288][T16284] netlink: 261 bytes leftover after parsing attributes in process `syz.4.11138'. [ 1485.034535][T16290] FAULT_INJECTION: forcing a failure. [ 1485.034535][T16290] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1485.055989][T16287] netlink: 'syz.0.11139': attribute type 10 has an invalid length. [ 1485.070334][T16287] team0: Device vxcan1 is of different type [ 1485.087848][T16290] CPU: 1 UID: 0 PID: 16290 Comm: syz.2.11140 Not tainted syzkaller #0 PREEMPT(full) [ 1485.087873][T16290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1485.087884][T16290] Call Trace: [ 1485.087891][T16290] [ 1485.087898][T16290] dump_stack_lvl+0xe8/0x150 [ 1485.087929][T16290] should_fail_ex+0x412/0x560 [ 1485.087955][T16290] prepare_alloc_pages+0x22a/0x650 [ 1485.087979][T16290] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1485.088002][T16290] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1485.088025][T16290] ? __pfx_policy_nodemask+0x10/0x10 [ 1485.088049][T16290] ? pfn_valid+0xba/0x480 [ 1485.088076][T16290] alloc_pages_mpol+0x232/0x4a0 [ 1485.088100][T16290] vma_alloc_folio_noprof+0xea/0x210 [ 1485.088122][T16290] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1485.088149][T16290] do_wp_page+0x127b/0x5990 [ 1485.088180][T16290] ? ___pte_offset_map+0x29/0x240 [ 1485.088203][T16290] ? ___pte_offset_map+0x29/0x240 [ 1485.088231][T16290] ? __pfx_do_wp_page+0x10/0x10 [ 1485.088250][T16290] ? do_raw_spin_lock+0x12b/0x2f0 [ 1485.088272][T16290] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1485.088301][T16290] handle_mm_fault+0x1520/0x32a0 [ 1485.088338][T16290] ? handle_mm_fault+0xee/0x32a0 [ 1485.088368][T16290] ? __pfx_handle_mm_fault+0x10/0x10 [ 1485.088391][T16290] ? follow_page_pte+0xd6a/0x1460 [ 1485.088422][T16290] ? __pfx_follow_page_pte+0x10/0x10 [ 1485.088456][T16290] __get_user_pages+0x165b/0x29d0 [ 1485.088506][T16290] __gup_longterm_locked+0xdcf/0x1630 [ 1485.088542][T16290] ? sanity_check_pinned_pages+0x1219/0x12d0 [ 1485.088572][T16290] gup_fast_fallback+0x1d82/0x22e0 [ 1485.088626][T16290] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1485.088645][T16290] ? ____sys_recvmsg+0x1e6/0x4a0 [ 1485.088673][T16290] ? __x64_sys_recvmsg+0x1ba/0x2a0 [ 1485.088693][T16290] ? do_syscall_64+0xe2/0xf80 [ 1485.088714][T16290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.088736][T16290] ? pin_user_pages_fast+0x4d/0xb0 [ 1485.088761][T16290] iov_iter_extract_pages+0x37b/0x5f0 [ 1485.088794][T16290] extract_iter_to_sg+0xe62/0x2520 [ 1485.088830][T16290] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 1485.088855][T16290] ? rcu_is_watching+0x15/0xb0 [ 1485.088873][T16290] ? trace_kmalloc+0x1f/0xb0 [ 1485.088889][T16290] ? sock_kmalloc+0xd6/0x160 [ 1485.088914][T16290] ? __asan_memset+0x22/0x50 [ 1485.088939][T16290] af_alg_get_rsgl+0x436/0x810 [ 1485.088980][T16290] skcipher_recvmsg+0x3a3/0x1140 [ 1485.089023][T16290] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1485.089044][T16290] ? __lock_acquire+0x6b5/0x2cf0 [ 1485.089068][T16290] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1485.089086][T16290] ? security_socket_recvmsg+0x7e/0x2c0 [ 1485.089108][T16290] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1485.089131][T16290] sock_recvmsg+0x22c/0x270 [ 1485.089154][T16290] ____sys_recvmsg+0x1e6/0x4a0 [ 1485.089186][T16290] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1485.089224][T16290] ? import_iovec+0x73/0xa0 [ 1485.089250][T16290] ___sys_recvmsg+0x215/0x590 [ 1485.089270][T16290] ? get_pid_task+0x20/0x1f0 [ 1485.089295][T16290] ? __pfx____sys_recvmsg+0x10/0x10 [ 1485.089322][T16290] ? __fget_files+0x2a/0x420 [ 1485.089359][T16290] ? __fget_files+0x3a0/0x420 [ 1485.089388][T16290] __x64_sys_recvmsg+0x1ba/0x2a0 [ 1485.089413][T16290] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1485.089446][T16290] ? __pfx_ksys_write+0x10/0x10 [ 1485.089480][T16290] do_syscall_64+0xe2/0xf80 [ 1485.089500][T16290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.089517][T16290] ? clear_bhb_loop+0x60/0xb0 [ 1485.089538][T16290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.089554][T16290] RIP: 0033:0x7f910159aeb9 [ 1485.089569][T16290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1485.089582][T16290] RSP: 002b:00007f90ff7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1485.089600][T16290] RAX: ffffffffffffffda RBX: 00007f9101815fa0 RCX: 00007f910159aeb9 [ 1485.089613][T16290] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 1485.089622][T16290] RBP: 00007f90ff7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1485.089633][T16290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1485.089642][T16290] R13: 00007f9101816038 R14: 00007f9101815fa0 R15: 00007ffd1aeb3128 [ 1485.089675][T16290] [ 1485.630440][T16292] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11141'. [ 1485.770053][ T8057] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1485.785936][T16304] FAULT_INJECTION: forcing a failure. [ 1485.785936][T16304] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1485.801628][T16300] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1485.825681][ T8057] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1485.843264][T16304] CPU: 1 UID: 0 PID: 16304 Comm: syz.1.11144 Not tainted syzkaller #0 PREEMPT(full) [ 1485.843289][T16304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1485.843299][T16304] Call Trace: [ 1485.843307][T16304] [ 1485.843315][T16304] dump_stack_lvl+0xe8/0x150 [ 1485.843340][T16304] should_fail_ex+0x412/0x560 [ 1485.843364][T16304] _copy_from_user+0x2d/0xb0 [ 1485.843388][T16304] ___sys_sendmsg+0x1c6/0x360 [ 1485.843410][T16304] ? __lock_acquire+0x6b5/0x2cf0 [ 1485.843436][T16304] ? __pfx____sys_sendmsg+0x10/0x10 [ 1485.843486][T16304] ? __fget_files+0x2a/0x420 [ 1485.843502][T16304] ? __fget_files+0x3a0/0x420 [ 1485.843528][T16304] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1485.843551][T16304] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1485.843582][T16304] ? __pfx_ksys_write+0x10/0x10 [ 1485.843624][T16304] do_syscall_64+0xe2/0xf80 [ 1485.843645][T16304] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.843660][T16304] ? trace_irq_disable+0x37/0x100 [ 1485.843675][T16304] ? clear_bhb_loop+0x60/0xb0 [ 1485.843696][T16304] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.843713][T16304] RIP: 0033:0x7fd133b9aeb9 [ 1485.843729][T16304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1485.843744][T16304] RSP: 002b:00007fd131df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1485.843763][T16304] RAX: ffffffffffffffda RBX: 00007fd133e15fa0 RCX: 00007fd133b9aeb9 [ 1485.843777][T16304] RDX: 0000000000004000 RSI: 0000200000000080 RDI: 0000000000000005 [ 1485.843787][T16304] RBP: 00007fd131df6090 R08: 0000000000000000 R09: 0000000000000000 [ 1485.843798][T16304] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1485.843809][T16304] R13: 00007fd133e16038 R14: 00007fd133e15fa0 R15: 00007ffc5a1dcbb8 [ 1485.843838][T16304] [ 1485.886291][ T8057] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1486.155048][T16306] ip6_vti0 speed is unknown, defaulting to 1000 [ 1486.166638][ T8057] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1486.697177][T16324] ip6_vti0 speed is unknown, defaulting to 1000 [ 1487.211707][T16329] ip6_vti0 speed is unknown, defaulting to 1000 [ 1488.087241][T16306] lo speed is unknown, defaulting to 1000 [ 1488.158770][T16374] __nla_validate_parse: 2 callbacks suppressed [ 1488.158792][T16374] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11158'. [ 1488.258128][T16377] syzkaller0: entered promiscuous mode [ 1488.276497][T16377] syzkaller0: entered allmulticast mode [ 1488.497899][T16384] netlink: 'syz.2.11161': attribute type 4 has an invalid length. [ 1488.963916][T16402] netlink: 'syz.3.11166': attribute type 1 has an invalid length. [ 1488.974902][T16402] netlink: 224 bytes leftover after parsing attributes in process `syz.3.11166'. [ 1489.410440][T16324] lo speed is unknown, defaulting to 1000 [ 1489.676629][T16416] IPVS: set_ctl: invalid protocol: 50 224.0.0.1:20001 [ 1489.715869][T16418] netlink: 64 bytes leftover after parsing attributes in process `syz.1.11167'. [ 1489.786264][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5350 ms [ 1489.794328][ C0] lec:lec_tx_timeout: lec0 [ 1490.294360][T16436] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 1490.707931][T16329] lo speed is unknown, defaulting to 1000 [ 1490.729169][T16460] ip6_vti0 speed is unknown, defaulting to 1000 [ 1491.096083][T16466] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11176'. [ 1491.799870][T16581] page_pool_release_retry() stalled pool shutdown: id 530, 1 inflight 60 sec [ 1491.890239][T16495] netlink: 'syz.1.11181': attribute type 1 has an invalid length. [ 1491.898806][T16495] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11181'. [ 1492.094584][T16502] netlink: 'syz.1.11182': attribute type 2 has an invalid length. [ 1492.402133][T16500] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap0 [ 1492.932050][T16522] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1493.018668][T16522] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1493.056733][T16460] lo speed is unknown, defaulting to 1000 [ 1493.099794][T16522] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1493.168440][T16531] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11189'. [ 1493.194728][T16522] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1493.264516][T16531] ip6gretap0: entered promiscuous mode [ 1493.282122][T16531] gretap0: entered promiscuous mode [ 1493.317916][T16531] debugfs: 'hsr1' already exists in 'hsr' [ 1493.329475][T16531] Cannot create hsr debugfs directory [ 1493.376377][ T1162] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1493.434255][ T1162] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1493.458909][ T1162] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1493.542846][ T1156] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1493.620311][T16544] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11191'. [ 1493.650061][T16544] smc: ib device syz2 ibport 1 applied user defined pnetid S [ 1493.759401][T16542] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11190'. [ 1493.944974][T16559] netlink: 'syz.0.11194': attribute type 4 has an invalid length. [ 1493.997243][T16558] netlink: 'syz.0.11194': attribute type 4 has an invalid length. [ 1494.697782][T16574] ip6_vti0 speed is unknown, defaulting to 1000 [ 1494.974859][T16593] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1494.998189][T16593] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1495.140797][T16593] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1495.171979][T16593] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1495.320156][T16593] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1495.330463][T16593] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1495.429085][T16593] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1495.439485][T16593] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1495.656842][ T1162] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1495.695339][ T1162] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1495.882935][ T1162] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1495.926392][ T1162] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1496.001122][T16617] mac80211_hwsim hwsim120 syzkaller0: entered promiscuous mode [ 1496.009054][T16617] mac80211_hwsim hwsim120 syzkaller0: entered allmulticast mode [ 1496.121222][ T1162] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1496.141949][ T1162] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1496.177763][ T1162] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1496.206509][ T1162] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1496.350565][T16625] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11210'. [ 1496.410188][T16629] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11211'. [ 1496.586971][ T11] block nbd3: Possible stuck request ffff8880259a8000: control (read@0,1024B). Runtime 330 seconds [ 1496.598702][ T11] block nbd3: Possible stuck request ffff8880259a8200: control (read@1024,1024B). Runtime 330 seconds [ 1496.610528][ T11] block nbd3: Possible stuck request ffff8880259a8400: control (read@2048,1024B). Runtime 330 seconds [ 1496.622290][ T11] block nbd3: Possible stuck request ffff8880259b0000: control (read@3072,1024B). Runtime 330 seconds [ 1496.748387][T16638] syzkaller0: entered promiscuous mode [ 1496.753896][T16638] syzkaller0: entered allmulticast mode [ 1497.048809][T16652] netlink: 'syz.0.11220': attribute type 1 has an invalid length. [ 1497.096495][T16652] netlink: 224 bytes leftover after parsing attributes in process `syz.0.11220'. [ 1497.207856][T16663] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11222'. [ 1497.482658][T16679] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11227'. [ 1497.635939][T16574] lo speed is unknown, defaulting to 1000 [ 1498.411796][T16700] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11231'. [ 1498.422623][T16700] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11231'. [ 1498.474188][T16709] netlink: 'syz.2.11231': attribute type 10 has an invalid length. [ 1498.547446][T16700] netlink: 'syz.2.11231': attribute type 10 has an invalid length. [ 1498.562604][T16704] netlink: 'syz.0.11233': attribute type 1 has an invalid length. [ 1498.578997][T16704] netlink: 224 bytes leftover after parsing attributes in process `syz.0.11233'. [ 1498.587628][T16700] team0: Device vxcan1 is of different type [ 1498.603535][T16709] team0: Device vxcan1 is of different type [ 1498.650331][ T1162] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1498.750194][ T1162] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1498.768648][ T1162] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1498.782781][T16722] rdma_rxe: rxe_newlink: failed to add lo [ 1498.892103][ T1162] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1499.074429][T16734] netlink: 200 bytes leftover after parsing attributes in process `syz.0.11241'. [ 1499.794010][ T31] INFO: task udevd:5939 blocked for more than 143 seconds. [ 1499.831496][ T31] Not tainted syzkaller #0 [ 1499.856650][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1499.865366][ T31] task:udevd state:D stack:21320 pid:5939 tgid:5939 ppid:5189 task_flags:0x400140 flags:0x00080802 [ 1499.911448][ T31] Call Trace: [ 1499.914778][ T31] [ 1499.926343][ T31] __schedule+0x14ea/0x5050 [ 1499.930689][T16760] netlink: 'syz.1.11248': attribute type 1 has an invalid length. [ 1499.936444][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 1499.939262][T16760] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11248'. [ 1499.948098][ T31] ? __pfx___schedule+0x10/0x10 [ 1499.958143][ T31] ? schedule+0x90/0x360 [ 1499.962623][T16761] batadv_slave_0: entered promiscuous mode [ 1499.986312][ T31] schedule+0x164/0x360 [ 1499.996462][ T31] io_schedule+0x7f/0xd0 [ 1500.000756][ T31] folio_wait_bit_common+0x6d8/0xbc0 [ 1500.021442][T16761] batadv_slave_0: left promiscuous mode [ 1500.029946][ T31] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 1500.035802][ T31] ? __pfx_wake_page_function+0x10/0x10 [ 1500.046482][ T31] ? __filemap_get_folio_mpol+0x7a9/0xb00 [ 1500.052254][ T31] do_read_cache_folio+0x1ad/0x590 [ 1500.058241][ T31] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1500.063740][ T31] read_part_sector+0xb6/0x2b0 [ 1500.069045][ T31] adfspart_check_POWERTEC+0x92/0xef0 [ 1500.086312][ T31] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 1500.092125][ T31] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 1500.112330][ T31] bdev_disk_changed+0x765/0x14c0 [ 1500.126082][ T31] ? bdev_open+0xe0/0xd30 [ 1500.130903][ T31] ? __pfx_bdev_disk_changed+0x10/0x10 [ 1500.140811][ T31] blkdev_get_whole+0x380/0x510 [ 1500.145712][ T31] bdev_open+0x31e/0xd30 [ 1500.160232][ T31] blkdev_open+0x470/0x610 [ 1500.164694][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 1500.170257][ T31] do_dentry_open+0x7ce/0x1420 [ 1500.175066][ T31] vfs_open+0x3b/0x340 [ 1500.179697][ T31] ? path_openat+0x346e/0x3e20 [ 1500.184604][ T31] path_openat+0x3486/0x3e20 [ 1500.195060][ T31] ? kmem_cache_alloc_noprof+0x370/0x6e0 [ 1500.201565][ T31] ? getname_flags+0xb7/0x540 [ 1500.206603][ T31] ? __pfx_path_openat+0x10/0x10 [ 1500.211577][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 1500.218084][ T31] do_filp_open+0x22d/0x490 [ 1500.222895][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 1500.228978][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1500.233923][ T31] ? alloc_fd+0x64b/0x6c0 [ 1500.239741][ T31] do_sys_openat2+0x12f/0x220 [ 1500.244507][ T31] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1500.250420][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1500.255669][ T31] ? rcu_is_watching+0x15/0xb0 [ 1500.260672][ T31] __x64_sys_openat+0x138/0x170 [ 1500.265543][ T31] do_syscall_64+0xe2/0xf80 [ 1500.272939][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.279239][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1500.283945][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.289920][ T31] RIP: 0033:0x7fb3a28a7407 [ 1500.294342][ T31] RSP: 002b:00007ffec7011820 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1500.303194][ T31] RAX: ffffffffffffffda RBX: 00007fb3a3075880 RCX: 00007fb3a28a7407 [ 1500.311287][ T31] RDX: 00000000000a0800 RSI: 000055f0843bb0f0 RDI: ffffffffffffff9c [ 1500.319570][ T31] RBP: 000055f0843a3910 R08: 0000000000000000 R09: 0000000000000000 [ 1500.327604][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 000055f0843b6ad0 [ 1500.335586][ T31] R13: 000055f0843b1190 R14: 0000000000000000 R15: 000055f0843b6ad0 [ 1500.343844][ T31] [ 1500.348880][ T31] [ 1500.348880][ T31] Showing all locks held in the system: [ 1500.358103][ T31] 1 lock held by khungtaskd/31: [ 1500.366296][ T31] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1500.376202][ T31] 1 lock held by dhcpcd/5484: [ 1500.385783][ T31] #0: ffff8880b873a918 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 1500.396705][ T31] 2 locks held by getty/5576: [ 1500.401544][ T31] #0: ffff888030f5c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1500.411426][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 1500.421725][ T31] 3 locks held by kworker/1:1/16581: [ 1500.428494][ T31] #0: ffff88813fe55948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1500.439684][ T31] #1: ffffc90002f47bc0 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1500.452529][ T31] #2: ffff88806ce59240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x202/0x3d0 [ 1500.463294][ T31] 1 lock held by udevd/5939: [ 1500.467950][ T31] #0: ffff8880258d5358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 1500.477347][ T31] 2 locks held by syz.3.11198/16574: [ 1500.482643][ T31] #0: ffffffff8f99ddf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 1500.486649][ T7847] lec:lec_start_xmit: lec0:No lecd attached [ 1500.492399][ T31] #1: ffffffff8e560b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 1500.509276][ T31] [ 1500.511620][ T31] ============================================= [ 1500.511620][ T31] [ 1500.520216][ T31] NMI backtrace for cpu 1 [ 1500.520236][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1500.520279][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1500.520302][ T31] Call Trace: [ 1500.520319][ T31] [ 1500.520336][ T31] dump_stack_lvl+0xe8/0x150 [ 1500.520387][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1500.520429][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1500.520491][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1500.520540][ T31] sys_info+0x135/0x170 [ 1500.520595][ T31] watchdog+0xf90/0xfe0 [ 1500.520652][ T31] ? watchdog+0x209/0xfe0 [ 1500.520677][ T31] kthread+0x726/0x8b0 [ 1500.520699][ T31] ? __pfx_watchdog+0x10/0x10 [ 1500.520716][ T31] ? __pfx_kthread+0x10/0x10 [ 1500.520737][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1500.520756][ T31] ? __pfx_kthread+0x10/0x10 [ 1500.520776][ T31] ret_from_fork+0x51b/0xa40 [ 1500.520801][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1500.520823][ T31] ? __switch_to+0xc82/0x1410 [ 1500.520846][ T31] ? __pfx_kthread+0x10/0x10 [ 1500.520864][ T31] ret_from_fork_asm+0x1a/0x30 [ 1500.520898][ T31] [ 1500.520905][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1500.640796][ C0] NMI backtrace for cpu 0 [ 1500.640813][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 1500.640830][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1500.640840][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1500.640862][ C0] Code: 18 5f 02 e9 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 77 10 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 1500.640875][ C0] RSP: 0018:ffffffff8e207dc0 EFLAGS: 00000242 [ 1500.640893][ C0] RAX: 00000000004cc0a1 RBX: ffffffff8199370d RCX: 0000000080000001 [ 1500.640904][ C0] RDX: 0000000000000001 RSI: ffffffff8dccd28e RDI: ffffffff8c073980 [ 1500.640915][ C0] RBP: ffffffff8e207eb0 R08: ffff8880b86336db R09: 1ffff110170c66db [ 1500.640926][ C0] R10: dffffc0000000000 R11: ffffed10170c66dc R12: ffffffff8fef4270 [ 1500.640937][ C0] R13: 1ffffffff1c52a78 R14: 0000000000000000 R15: 0000000000000000 [ 1500.640948][ C0] FS: 0000000000000000(0000) GS:ffff8881256eb000(0000) knlGS:0000000000000000 [ 1500.640961][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1500.640971][ C0] CR2: 000055f7be8af000 CR3: 000000007add8000 CR4: 00000000003526f0 [ 1500.640985][ C0] Call Trace: [ 1500.640992][ C0] [ 1500.640998][ C0] default_idle+0x9/0x20 [ 1500.641017][ C0] default_idle_call+0x72/0xb0 [ 1500.641031][ C0] do_idle+0x1bd/0x500 [ 1500.641045][ C0] ? asm_sysvec_call_function_single+0x1a/0x20 [ 1500.641064][ C0] ? __pfx_do_idle+0x10/0x10 [ 1500.641087][ C0] cpu_startup_entry+0x43/0x60 [ 1500.641101][ C0] rest_init+0x2de/0x300 [ 1500.641116][ C0] start_kernel+0x380/0x3d0 [ 1500.641136][ C0] x86_64_start_reservations+0x24/0x30 [ 1500.641154][ C0] x86_64_start_kernel+0x143/0x1c0 [ 1500.641170][ C0] common_startup_64+0x13e/0x147 [ 1500.641199][ C0] [ 1500.841192][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1500.848083][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1500.857207][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1500.867275][ T31] Call Trace: [ 1500.870567][ T31] [ 1500.873505][ T31] vpanic+0x1e0/0x670 [ 1500.877505][ T31] panic+0xc5/0xd0 [ 1500.881259][ T31] ? __pfx_panic+0x10/0x10 [ 1500.885683][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1500.891078][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1500.897250][ T31] watchdog+0xfda/0xfe0 [ 1500.901407][ T31] ? watchdog+0x209/0xfe0 [ 1500.905731][ T31] kthread+0x726/0x8b0 [ 1500.909792][ T31] ? __pfx_watchdog+0x10/0x10 [ 1500.914454][ T31] ? __pfx_kthread+0x10/0x10 [ 1500.919119][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1500.924304][ T31] ? __pfx_kthread+0x10/0x10 [ 1500.928880][ T31] ret_from_fork+0x51b/0xa40 [ 1500.933464][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1500.938563][ T31] ? __switch_to+0xc82/0x1410 [ 1500.943231][ T31] ? __pfx_kthread+0x10/0x10 [ 1500.947810][ T31] ret_from_fork_asm+0x1a/0x30 [ 1500.952577][ T31] [ 1500.955944][ T31] Kernel Offset: disabled [ 1500.960256][ T31] Rebooting in 86400 seconds..