last executing test programs: 5.075774095s ago: executing program 4 (id=454): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @remote}}, 0x0, 0x0, 0x4d, 0x0, "8ddbb51a3cfd954e41e8ccb2650fa60067fb9bbcf0feeee4dc036d0675af58b39fa8d54ee8323507a61a95cf134ce8f605671338c7f8838a00bdfba71b43b828c7de258b6b9ca1fc52bcc83e2a016a00"}, 0xd8) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) listen(r0, 0x81) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x0], &(0x7f0000000700), 0xfffffff6, 0x1}}, 0x40) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000140)) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)="a2", 0x1}], 0x1}, 0x4006041) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0xf, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000040)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0f000000040000000400000048f4b81d81ac2ac316000000000000004cf1304bc17183b160a69da62b882455d66d847c4fe79972645d46a5e162a4bbb8090c44376acb4ec7501467c185b72a91a403736b7ef4fb115f790abb557082b8e6c286dfbc46dce8157c1aa11c106104648584db09f0aa575d303fe979ffb241ec31ba6b50860a", @ANYRES32, @ANYBLOB="fdffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="05"], 0x10) sendmsg$inet(r2, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) r6 = accept$ax25(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) getpeername$ax25(r6, &(0x7f0000000440)={{0x3, @netrom}, [@default, @bcast, @remote, @bcast, @default, @netrom, @default, @null]}, &(0x7f0000000300)=0x48) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000007440), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000007580)={0x0, 0xfffffffffffffc85, &(0x7f0000007540)={&(0x7f0000000000)={0x50, r8, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}]}, 0x50}}, 0x48040) syz_emit_ethernet(0x4a, &(0x7f00000000c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000200", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) 4.301594704s ago: executing program 3 (id=458): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x801) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) 3.153647441s ago: executing program 1 (id=461): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x5450, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0xcdf) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="5800000040001901feffffff00000000017c0000340041802d000a000229a2517945a71f852b20c694feb2c60d660ade200fff9c5408fbd224968e91f66612039a7624b7b50000000c0001800600060065310000040002"], 0x58}, 0x1, 0x0, 0x0, 0x48814}, 0xc000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x38, r6, 0xacf5e67dd0b583a1, 0x0, 0x0, {{0x5}, {@val={0x8}, @val={0xc, 0x99, {0xf86, 0x6f}}}}, [@NL80211_ATTR_HE_OBSS_PD={0x10, 0x117, 0x0, 0x1, [@NL80211_HE_OBSS_PD_ATTR_SR_CTRL={0x5}]}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_REGISTER_FRAME(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x118, r6, 0x200, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0xa2}, @NL80211_ATTR_FRAME_TYPE={0x6}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x1}, @NL80211_ATTR_FRAME_MATCH={0xe1, 0x5b, "f63cbb055ca790aa5dcf8f76b5fb15ca85efb52d0b20e0ea2edad875a165627a4a65c843647b9ccb3769e203a4f861cd1dab614ba2b6b8360e35a2e6d8eff498b996ca7bc632f95c358efaa337222a076d8486ff279dedf339dabf0abf461c97aef2ff68f72a0844bc14abde00bc422e72cc26abe77dcfbcef5a40f806b315ee4c060d58cde60f4f768d7ab3a0b38e3bdbad2272e6f220a7787bf8d683a4925451fb83b5149b244e0df3cc7f65276a37bb34b144d0b5dc4b2a240a05cd1a677aa2c94def8f71acdde4612796b5f0bbfdf48482d7be276371b86df40ecc"}]}, 0x118}, 0x1, 0x0, 0x0, 0x22000010}, 0x880) sendmsg$TIPC_CMD_GET_NETID(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r4, 0x1, 0x70bd2a, 0x25dfdbff}, 0x1c}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x1c, r4, 0x130a, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20004040) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@setneightbl={0x28, 0x43, 0xf00, 0x70bd28, 0x25dfdbff, {0x1c}, [@NDTA_GC_INTERVAL={0xc, 0x8, 0x7}, @NDTA_THRESH1={0x8, 0x2, 0x6f47}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x800) syz_emit_ethernet(0x52, &(0x7f0000000080)={@local, @local, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x11, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x4}]}}}}}}}}, 0x0) 2.831546766s ago: executing program 3 (id=463): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x28, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x30004042}, 0x90) 2.830575524s ago: executing program 4 (id=464): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000780)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, 0x2, 0x0, 0x0, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r0, 0x40047459, 0x0) bind$xdp(0xffffffffffffffff, &(0x7f00000001c0)={0x2c, 0x20}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000140)=[@in={0x2, 0x4e23, @private=0xa010102}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x808004}, 0x8) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) getsockopt$bt_hci(r4, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xca) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x100}, 0x8044) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newlink={0x5c, 0x10, 0x400, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5003}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @mcast1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x5c}}, 0x2000000) close(0x4) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000007, 0x42032, 0xffffffffffffffff, 0x100000000) setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000020000210d0000aaa8fa017242ba9380d412000000000000002900000003", 0x2d) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x54, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x4c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_HOOK_HOOKNUM={0x2, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xe8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000340)=@framed={{}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}, @call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.830024818s ago: executing program 1 (id=465): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) r0 = socket(0x28, 0x5, 0x0) r1 = socket(0x28, 0x5, 0x0) listen(r1, 0x4) sendmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20040000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4], 0x90}}, 0x0) (fail_nth: 7) 2.607119797s ago: executing program 3 (id=466): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001ec0)=ANY=[@ANYBLOB="340000003e0007012bbd700000000000010100080400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="080002800400338008000900", @ANYRES32=r0], 0x34}, 0x1, 0x0, 0x40000, 0xc000}, 0x4040) 2.058186227s ago: executing program 4 (id=469): r0 = socket(0x1d, 0x2, 0x6) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502"], 0x40}}, 0x0) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000000000000000300060000000e0002000000e0001009000000000000000002000100000000000000000200000000030005000000000002000000e0000001"], 0x50}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000a80)={0x3c, r5, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c191b}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}]}, 0x3c}}, 0x20000040) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000c80), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000000dc0)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000cc0)={0x80, r7, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x2c}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0xfffffffffffffffc}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010102}, @NLBL_MGMT_A_DOMAIN={0xa, 0x1, '[&$-+\x00'}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}]}, 0x80}, 0x1, 0x0, 0x0, 0x200008c0}, 0x54) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000300)=@ethtool_pauseparam={0x13, 0xa, 0x0, 0x6}}) r8 = socket$inet(0x2, 0x2, 0x1) r9 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000d40)='rdma.max\x00', 0x2, 0x0) write$cgroup_int(r9, &(0x7f0000000e00)=0x7, 0x12) sendmsg$inet(r8, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)}, {&(0x7f0000000180)="2d0000008058", 0x6}], 0x2, &(0x7f0000000100)=ANY=[], 0xd}, 0x20000810) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574"], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040007}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r8, 0x89f5, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000480)={@initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 0xa0, 0x0, [{@empty}, {}, {@multicast2}, {}, {@private}, {@broadcast}, {@empty}, {@dev}, {@dev}, {@dev}]}}) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x3, 0x1, 0x101, 0x0, 0x0, {0x7, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4048000) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720a00fef8ffffff71a400fe0000000071101000000000001d300200000000004704000001ed030407030000030000001d440000000000006b0a20fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 1.996054304s ago: executing program 2 (id=470): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c000000020605ea190000000000000000000001050004000100000005000100070000000c0505007a300000000015000300686173683a69702c706f72742c6e65"], 0x5c}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000680)={0xd0, 0x0, 0x400, 0x70bd26, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x1}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40e0}, 0x8001) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000280)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)}, {&(0x7f0000000100)}, {0x0}, {0x0}], 0x4}, 0x40000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'pimreg\x00', 0x2}) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)={r0}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 1.910764713s ago: executing program 3 (id=471): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0xd, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x48}, 0x94) r1 = socket(0x2, 0x80805, 0x0) socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000400)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x74, &(0x7f0000000200)={r2, 0x5, 0x20, 0x800}, &(0x7f00000001c0)=0x18) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETLINK(r4, 0x400454cd, 0x305) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32=0x0], 0x48) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x30, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0xba}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xf9}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x30}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYRES64=r0, @ANYRES16=r3, @ANYBLOB="000500004aa1010038001a80200002800c"], 0x58}, 0x1, 0x0, 0x0, 0x20000001}, 0x8004) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(echainiv(aegis128))\x00'}, 0x58) close(0x3) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYRES8=0x0, @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c000000020601080000000000000000000000001400078008001140000000ba05001500090000000500010006000000050005000a00000005000400000000000900020073797a300000000010000300686173683a69702c6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x20}, 0x0) 1.860862602s ago: executing program 1 (id=472): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd3ff}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x35}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) 1.705810275s ago: executing program 2 (id=473): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r1, &(0x7f00000019c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000001880)={0x14, 0xa, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@remote, @in=@broadcast, 0x4e23, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x4000000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {0x0, 0x0, 0x8000}, 0x0, 0x0, 0x1}, {{@in6=@remote, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x3, 0xb7, 0xc4, 0xfffffffe}}, 0xe8) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2f00}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_LACP_RATE={0x5}, @IFLA_BOND_MODE={0x5, 0x1, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 1.643257218s ago: executing program 1 (id=474): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x11, &(0x7f0000000100)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}}, 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7040000080000008500000095000000950000000000bb80bd094f119da95ea0f42182a02fce72a927d3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x80, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x11}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x3c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc8}}, 0x20050800) 1.46579068s ago: executing program 1 (id=475): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000cc0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x16, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0x9c}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="200000000307010200000000000000000a0000030c00024000004800000033b1f78df48f47a73c0449"], 0x20}}, 0x44) 1.446559017s ago: executing program 3 (id=476): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x28, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x30004042}, 0x90) 1.242648969s ago: executing program 1 (id=477): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x15}, {}, {0x3, 0xfd}, {0x0, 0x0, 0x0, 0x10000000}, {0x64}, {0x0, 0x0, 0xf8}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) setsockopt$MRT_DEL_VIF(r1, 0x0, 0x15, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000180)={0x0, 0x0}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r4, 0x0, 0x0) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r6) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f00000000c0)=0x0) syz_80211_inject_frame(0x0, &(0x7f0000000040)=@mgmt_frame=@action_no_ack={{{0x0, 0x0, 0xe, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x1}, @device_b, @device_b, @from_mac=@device_b, {0x9, 0xc5}}, @tdls_disc_req={0xc, 0xa, {0xff, {0x65, 0x12, {@random="c1ce23a07a61", @device_a, @device_b}}}}}, 0x2f) sendmsg$NFC_CMD_DEV_UP(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r7, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r8], 0x1c}}, 0x4008054) write$nci(r5, &(0x7f0000000240)=@NCI_OP_CORE_RESET_NTF={0x0, 0x1, 0x3, 0x0, 0x9, {0x45, 0x2, 0x20, 0x2, 0xf, 0x4}}, 0xc) write$nci(r5, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) pselect6(0x40, &(0x7f0000000040)={0x6, 0x8, 0xc97, 0xdd43, 0x10000000004, 0x3467, 0x1, 0x2}, 0x0, 0x0, 0x0, 0x0) 1.049217361s ago: executing program 2 (id=478): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$cgroup_subtree(r1, 0x0, 0x32600) socket$inet6(0xa, 0x4, 0xb) ioctl$SIOCSIFHWADDR(r0, 0x891a, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) 771.673424ms ago: executing program 3 (id=480): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x8e40, 0x0) close(r1) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000400)='illinois', 0x8) getsockopt$inet_tcp_buf(r2, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f00000014c0), 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x4020800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="540000000008010100000000000000000a000000050003002f6000000600024000000000240004800800024000000000080001400000fcff07000140800000010800014080000001090001"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x20000000) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff5644d, 0x70b923, 0x7fffe, {0x0, 0x0, 0x0, r11, {}, {0xb, 0xb}, {0x2, 0xb}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x808, 0x205, 0x1, 0xc}, 0xb, 0x6, 0x32, 0x5, 0xa, 0x2, 0x9, 0xd, 0x1, 0x1, {0xffff1c72, 0x23, 0x7, 0xc, 0xfffffffe, 0x7583}}}}]}, 0x78}}, 0x8000) sendto$packet(r7, &(0x7f0000000240)="bad33075218151db00316f3a277f953286ddd1dc9119f992e83de525e4a40e81692d09dc6b6b0ef17b", 0x29, 0x2000041, &(0x7f0000000080)={0x11, 0x88a8, r5, 0x1, 0xda, 0x6, @remote}, 0x14) 745.669174ms ago: executing program 4 (id=481): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000480)={0x2, 0x3, 0x0, 0x3, 0x13, 0x0, 0x4070bd2c, 0x25dfdbfc, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x7, @mcast1, 0x80000001}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc, 0xffffff7f}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0xff, @local, 0x1ff}}, @sadb_x_sa2={0x2, 0x13, 0x2, 0x0, 0x0, 0x70bd29, 0x3506}]}, 0x98}, 0x1, 0x7, 0xfe80}, 0x0) 687.114882ms ago: executing program 0 (id=482): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f00000000c0)={@remote, r2}, 0x14) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000400)={0x89}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x1, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=[@pktinfo={{0x24, 0x29, 0x32, {@remote, r2}}}], 0x28}, 0x1000000}], 0x1, 0x0) 654.358828ms ago: executing program 0 (id=483): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c000000020605ea190000000000000000000001050004000100000005000100070000000c0505007a300000000015000300686173683a69702c706f72742c6e65"], 0x5c}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000500)={&(0x7f0000000680)={0xd0, 0x0, 0x400, 0x70bd26, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x6, 0x4, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x6}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x6, 0x4, 0x1}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40e0}, 0x8001) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000280)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)}, {&(0x7f0000000100)}, {0x0}, {0x0}], 0x4}, 0x40000) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'pimreg\x00', 0x2}) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x89e1, &(0x7f0000000300)={r0}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r1, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 641.493366ms ago: executing program 2 (id=484): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000200)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x8, 0x1, 0x1d, 0x3, 0x9, 0x800, 0x4, 0x854}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4000) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xfff3, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044060}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0xe}, @NFTA_CT_DIRECTION={0x5}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x80}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 567.033407ms ago: executing program 4 (id=485): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x6000000, 0x0, 0x90}, 0x4000c00) 504.97304ms ago: executing program 0 (id=486): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x9, 0x2, 0xffffffff, 0x0, 0xfea}, 0x43e, 0x0, 0x8, 0x7, 0x200, 0x4, 0x2, 0x0, 0x8, 0x51, {0x8, 0x6, 0x3, 0x6, 0x4, 0xe}}}}]}, 0x78}}, 0x20008001) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r2 = socket$kcm(0xa, 0x2, 0x73) setsockopt$sock_attach_bpf(r2, 0x29, 0x21, &(0x7f0000000200), 0x4) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@un=@abs={0x0, 0x0, 0x4e22}, 0x80, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r1, {0xe}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x10, 0x4}}]}}]}, 0x3c}}, 0x4000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 308.596558ms ago: executing program 0 (id=487): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x1}, 0x8) sendmmsg$inet6(r1, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c, 0x0, 0xf5ff}}], 0x1, 0x4000800) 266.149864ms ago: executing program 4 (id=488): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x28, 0x5, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x4) sendmmsg(r1, 0x0, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) accept4$unix(r2, 0x0, 0x0, 0x800) socket$netlink(0x10, 0x3, 0x8000000004) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r4], 0x90}}, 0x0) 179.567426ms ago: executing program 2 (id=489): bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x80}, [@call={0x85, 0x0, 0x0, 0x7b}], {0x95, 0x0, 0x0, 0x4802}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x11}, 0x94) 143.829145ms ago: executing program 0 (id=490): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x28, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x30004042}, 0x90) 134.215944ms ago: executing program 2 (id=491): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0xfb, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0xd2}}}}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000011c0)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr=0x64010102, @multicast1=0xe0000300}, @redirect={0x5, 0x0, 0x0, @loopback, {0x5, 0x4, 0x1, 0x0, 0x1, 0x66, 0x6, 0x3, 0x6c, 0x0, @broadcast, @local}}}}}}, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe000031f, 0x0, "ff00000058b274e6d845167fefe428970548fc3c7b00000000000000fcffffa4", 0xb2, 0xb, 0x6, 0x6}, 0x3c) 0s ago: executing program 0 (id=492): socket$inet6(0xa, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6(0xa, 0x80003, 0xff) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) r1 = socket(0x2a, 0x2, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010426bd7000f8dbdf25020000b108000100", @ANYRES32=r5], 0x1c}}, 0x4008054) write$nci(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r2, &(0x7f0000000140)=ANY=[@ANYBLOB="500238", @ANYRES64=r1], 0x3b) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.18' (ED25519) to the list of known hosts. [ 80.191621][ T5806] cgroup: Unknown subsys name 'net' [ 80.339469][ T5806] cgroup: Unknown subsys name 'cpuset' [ 80.348178][ T5806] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 81.901846][ T5806] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.573798][ T5828] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.582039][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.603451][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.612951][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.624545][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.628039][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 85.635798][ T5840] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.647183][ T5841] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.647692][ T5840] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.658974][ T5841] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 85.662845][ T5840] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.670802][ T5841] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 85.676587][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.689723][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.692959][ T5841] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.701744][ T5842] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.707294][ T5841] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.715671][ T5842] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.720500][ T5841] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.731828][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.731911][ T5842] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.746334][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.754120][ T5842] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.798495][ T5836] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.806377][ T5836] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.309651][ T5825] chnl_net:caif_netlink_parms(): no params data found [ 86.343957][ T5829] chnl_net:caif_netlink_parms(): no params data found [ 86.465330][ T5822] chnl_net:caif_netlink_parms(): no params data found [ 86.526051][ T5821] chnl_net:caif_netlink_parms(): no params data found [ 86.651087][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.666179][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.673362][ T5829] bridge_slave_0: entered allmulticast mode [ 86.681252][ T5829] bridge_slave_0: entered promiscuous mode [ 86.738390][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.745544][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.753284][ T5829] bridge_slave_1: entered allmulticast mode [ 86.761421][ T5829] bridge_slave_1: entered promiscuous mode [ 86.799331][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.806748][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.814540][ T5825] bridge_slave_0: entered allmulticast mode [ 86.822391][ T5825] bridge_slave_0: entered promiscuous mode [ 86.844082][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.851458][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.858805][ T5825] bridge_slave_1: entered allmulticast mode [ 86.867460][ T5825] bridge_slave_1: entered promiscuous mode [ 86.887041][ T5827] chnl_net:caif_netlink_parms(): no params data found [ 86.931012][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.951052][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.958281][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.965383][ T5822] bridge_slave_0: entered allmulticast mode [ 86.972752][ T5822] bridge_slave_0: entered promiscuous mode [ 86.991899][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.015542][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.022918][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.030571][ T5822] bridge_slave_1: entered allmulticast mode [ 87.038166][ T5822] bridge_slave_1: entered promiscuous mode [ 87.046942][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.105904][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.139508][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.146741][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.153848][ T5821] bridge_slave_0: entered allmulticast mode [ 87.161028][ T5821] bridge_slave_0: entered promiscuous mode [ 87.190736][ T5829] team0: Port device team_slave_0 added [ 87.201496][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.209090][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.216437][ T5821] bridge_slave_1: entered allmulticast mode [ 87.223658][ T5821] bridge_slave_1: entered promiscuous mode [ 87.232924][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.243927][ T5825] team0: Port device team_slave_0 added [ 87.251812][ T5825] team0: Port device team_slave_1 added [ 87.258959][ T5829] team0: Port device team_slave_1 added [ 87.282828][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.358840][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.365803][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.391946][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.423457][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.430521][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.456706][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.470548][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.481581][ T5822] team0: Port device team_slave_0 added [ 87.488159][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.495127][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.525446][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.536817][ T5827] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.543987][ T5827] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.551303][ T5827] bridge_slave_0: entered allmulticast mode [ 87.558572][ T5827] bridge_slave_0: entered promiscuous mode [ 87.566207][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.573184][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.599235][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.612494][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.623610][ T5822] team0: Port device team_slave_1 added [ 87.636859][ T5827] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.643969][ T5827] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.651232][ T5827] bridge_slave_1: entered allmulticast mode [ 87.658440][ T5827] bridge_slave_1: entered promiscuous mode [ 87.722909][ T5821] team0: Port device team_slave_0 added [ 87.740408][ T5827] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.761284][ T5821] team0: Port device team_slave_1 added [ 87.777993][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.784949][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.811195][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.826596][ T5828] Bluetooth: hci3: command tx timeout [ 87.836434][ T5836] Bluetooth: hci2: command tx timeout [ 87.840786][ T5827] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.842224][ T5836] Bluetooth: hci0: command tx timeout [ 87.856643][ T5141] Bluetooth: hci1: command tx timeout [ 87.862306][ T5828] Bluetooth: hci4: command tx timeout [ 87.891288][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.898349][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.924576][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.958836][ T5829] hsr_slave_0: entered promiscuous mode [ 87.965394][ T5829] hsr_slave_1: entered promiscuous mode [ 87.972838][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.979945][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.006195][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.028019][ T5825] hsr_slave_0: entered promiscuous mode [ 88.034272][ T5825] hsr_slave_1: entered promiscuous mode [ 88.040534][ T5825] debugfs: 'hsr0' already exists in 'hsr' [ 88.046355][ T5825] Cannot create hsr debugfs directory [ 88.054357][ T5827] team0: Port device team_slave_0 added [ 88.062262][ T5827] team0: Port device team_slave_1 added [ 88.069841][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.076949][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.103266][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.202671][ T5821] hsr_slave_0: entered promiscuous mode [ 88.210005][ T5821] hsr_slave_1: entered promiscuous mode [ 88.216365][ T5821] debugfs: 'hsr0' already exists in 'hsr' [ 88.222096][ T5821] Cannot create hsr debugfs directory [ 88.237908][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.244850][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.271014][ T5827] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.315693][ T5827] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.322870][ T5827] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.348898][ T5827] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.370681][ T5822] hsr_slave_0: entered promiscuous mode [ 88.377173][ T5822] hsr_slave_1: entered promiscuous mode [ 88.383372][ T5822] debugfs: 'hsr0' already exists in 'hsr' [ 88.389184][ T5822] Cannot create hsr debugfs directory [ 88.538703][ T5827] hsr_slave_0: entered promiscuous mode [ 88.545092][ T5827] hsr_slave_1: entered promiscuous mode [ 88.555472][ T5827] debugfs: 'hsr0' already exists in 'hsr' [ 88.561330][ T5827] Cannot create hsr debugfs directory [ 88.908564][ T5829] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.921037][ T5829] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.932299][ T5829] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.951488][ T5829] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.006727][ T5821] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.017266][ T5821] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.033431][ T5821] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.054555][ T5821] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 89.138699][ T5825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.151078][ T5825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.161374][ T5825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.172558][ T5825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.277113][ T5827] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.288254][ T5827] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.309759][ T5827] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.320822][ T5827] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.357803][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.428664][ T5822] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.442637][ T5822] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.453705][ T5822] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.474009][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.482646][ T5822] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.516718][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.532053][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.539386][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.562489][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.569635][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.607576][ T5821] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.622263][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.648680][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.655767][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.687600][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.718288][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.725388][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.734736][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.741887][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.811912][ T2928] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.819099][ T2928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.833408][ T5827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.894231][ T5821] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.907151][ T5836] Bluetooth: hci0: command tx timeout [ 89.912595][ T5836] Bluetooth: hci4: command tx timeout [ 89.919494][ T5828] Bluetooth: hci1: command tx timeout [ 89.924895][ T5828] Bluetooth: hci2: command tx timeout [ 89.926731][ T5842] Bluetooth: hci3: command tx timeout [ 89.974155][ T5827] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.000778][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.049500][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.056873][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.079470][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.086683][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.128094][ T5822] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.184680][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.191877][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.202339][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.209545][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.331405][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.442713][ T5822] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 90.520491][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.561247][ T5829] veth0_vlan: entered promiscuous mode [ 90.594283][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.605543][ T5829] veth1_vlan: entered promiscuous mode [ 90.672271][ T5821] veth0_vlan: entered promiscuous mode [ 90.759611][ T5821] veth1_vlan: entered promiscuous mode [ 90.770267][ T5825] veth0_vlan: entered promiscuous mode [ 90.794532][ T5827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.835725][ T5829] veth0_macvtap: entered promiscuous mode [ 90.861253][ T5829] veth1_macvtap: entered promiscuous mode [ 90.874516][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.898172][ T5825] veth1_vlan: entered promiscuous mode [ 90.922519][ T5821] veth0_macvtap: entered promiscuous mode [ 90.958913][ T5821] veth1_macvtap: entered promiscuous mode [ 90.993761][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.041342][ T5822] veth0_vlan: entered promiscuous mode [ 91.055785][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.068582][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.085669][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.094903][ T5822] veth1_vlan: entered promiscuous mode [ 91.117700][ T3552] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.138447][ T3552] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.155686][ T5825] veth0_macvtap: entered promiscuous mode [ 91.201698][ T3552] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.222831][ T5825] veth1_macvtap: entered promiscuous mode [ 91.231013][ T3552] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.250426][ T3552] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.274653][ T5822] veth0_macvtap: entered promiscuous mode [ 91.288322][ T3552] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.297177][ T3552] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.314414][ T3552] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.331826][ T5822] veth1_macvtap: entered promiscuous mode [ 91.363905][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.393918][ T3552] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.412022][ T3552] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.425201][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.453696][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.464525][ T2939] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.474529][ T2939] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.505290][ T2939] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.514142][ T2939] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.538815][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.546824][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.554713][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.566622][ T5827] veth0_vlan: entered promiscuous mode [ 91.590873][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.607219][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.618086][ T50] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.672069][ T797] cfg80211: failed to load regulatory.db [ 91.692139][ T50] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.701939][ T50] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.717051][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.719609][ T60] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.745750][ T60] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.755431][ T50] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.782958][ T5827] veth1_vlan: entered promiscuous mode [ 91.945386][ T5940] netlink: 'syz.3.4': attribute type 1 has an invalid length. [ 91.986819][ T5842] Bluetooth: hci3: command tx timeout [ 91.992290][ T5842] Bluetooth: hci4: command tx timeout [ 91.999003][ T5836] Bluetooth: hci2: command tx timeout [ 91.999024][ T5828] Bluetooth: hci1: command tx timeout [ 92.004427][ T5836] Bluetooth: hci0: command tx timeout [ 92.034331][ T3552] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.042877][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.063179][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.070818][ T3552] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.147011][ T5827] veth0_macvtap: entered promiscuous mode [ 92.159695][ T5827] veth1_macvtap: entered promiscuous mode [ 92.194132][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.209253][ T3552] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.213984][ T5827] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.246147][ T3552] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.299921][ T3552] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.397553][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.399655][ T3552] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.405495][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.496651][ T3552] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.607865][ T3552] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.751431][ T5956] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8'. [ 93.256711][ T5962] netlink: 'syz.3.9': attribute type 2 has an invalid length. [ 93.304019][ T5963] x_tables: duplicate underflow at hook 3 [ 93.310481][ T5962] hmac(sha224): entered promiscuous mode [ 93.337377][ T2928] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.386828][ T2928] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.556910][ T5963] bond1: peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 93.588927][ T5963] bond1 (unregistering): Released all slaves [ 93.624441][ T5972] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10'. [ 93.655465][ T5972] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10'. [ 93.718513][ T2928] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.766795][ T2928] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.974726][ T5985] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 94.011981][ T5987] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14'. [ 94.020912][ T5987] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14'. [ 94.071190][ T5842] Bluetooth: hci1: command tx timeout [ 94.078761][ T5836] Bluetooth: hci2: command tx timeout [ 94.079483][ T5141] Bluetooth: hci4: command tx timeout [ 94.084588][ T5836] Bluetooth: hci0: command tx timeout [ 94.099280][ T5828] Bluetooth: hci3: command tx timeout [ 94.325128][ T6001] xt_TCPMSS: Only works on TCP SYN packets [ 94.451563][ T6009] syz_tun: entered allmulticast mode [ 94.460941][ T6008] syz_tun: left allmulticast mode [ 94.799091][ T6017] syz.0.25 uses obsolete (PF_INET,SOCK_PACKET) [ 94.810463][ T6017] xt_hashlimit: size too large, truncated to 1048576 [ 95.335781][ T6033] syzkaller0: entered promiscuous mode [ 95.341948][ T6033] syzkaller0: entered allmulticast mode [ 95.692069][ T6047] gre1: entered allmulticast mode [ 95.790830][ T6053] syz_tun: entered allmulticast mode [ 95.808087][ T6052] syz_tun: left allmulticast mode [ 96.563202][ T5970] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 97.022220][ T6078] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 97.048144][ T6078] team0 (unregistering): Port device team_slave_0 removed [ 97.088053][ T6078] team0 (unregistering): Failed to send options change via netlink (err -105) [ 97.099756][ T6088] netlink: 'syz.1.47': attribute type 2 has an invalid length. [ 97.122612][ T6078] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 97.144202][ T6078] team0 (unregistering): Port device team_slave_1 removed [ 97.238250][ T6085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.46'. [ 97.247511][ T6085] netlink: 16 bytes leftover after parsing attributes in process `syz.3.46'. [ 97.277620][ T6085] netlink: 'syz.3.46': attribute type 12 has an invalid length. [ 97.599034][ T6109] netlink: 'syz.3.52': attribute type 13 has an invalid length. [ 97.625461][ T6108] syzkaller0: entered promiscuous mode [ 97.633340][ T6108] syzkaller0: entered allmulticast mode [ 97.806459][ T6112] netlink: 'syz.1.53': attribute type 4 has an invalid length. [ 98.047219][ T6126] netlink: 'syz.2.59': attribute type 83 has an invalid length. [ 98.318135][ T6139] netlink: 4 bytes leftover after parsing attributes in process `syz.4.61'. [ 98.333651][ T6139] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 98.415145][ T6139] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 98.591920][ T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 98.601317][ T39] IPVS: starting estimator thread 0... [ 98.675108][ T12] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 98.684687][ T12] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 98.696458][ T6158] IPVS: using max 29 ests per chain, 69600 per kthread [ 98.712176][ T6159] team_slave_0: entered promiscuous mode [ 98.718001][ T6159] team_slave_1: entered promiscuous mode [ 98.729613][ T6159] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 98.755275][ T12] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 98.771287][ T6162] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 98.784694][ T6162] Zero length message leads to an empty skb [ 98.913105][ T6168] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.66'. [ 99.158416][ T6176] syzkaller0: entered promiscuous mode [ 99.163962][ T6176] syzkaller0: entered allmulticast mode [ 99.201335][ T6159] infiniband !yz!: set active [ 99.207930][ T6159] infiniband !yz!: added team_slave_0 [ 99.269527][ T6159] RDS/IB: !yz!: added [ 99.273916][ T6159] smc: adding ib device !yz! with port count 1 [ 99.286189][ T6159] smc: ib device !yz! port 1 has no pnetid [ 100.299267][ T6180] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 100.315515][ T6180] netlink: 'syz.3.71': attribute type 12 has an invalid length. [ 100.325812][ T6180] netlink: 'syz.3.71': attribute type 29 has an invalid length. [ 100.334058][ T6180] netlink: 148 bytes leftover after parsing attributes in process `syz.3.71'. [ 100.347214][ T6180] netlink: 59 bytes leftover after parsing attributes in process `syz.3.71'. [ 100.523715][ T6184] openvswitch: netlink: Key type 195 is out of range max 32 [ 100.895611][ T6190] FAULT_INJECTION: forcing a failure. [ 100.895611][ T6190] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 100.909425][ T6190] CPU: 1 UID: 0 PID: 6190 Comm: syz.3.76 Not tainted syzkaller #0 PREEMPT(full) [ 100.909466][ T6190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 100.909484][ T6190] Call Trace: [ 100.909492][ T6190] [ 100.909500][ T6190] dump_stack_lvl+0xe8/0x150 [ 100.909536][ T6190] should_fail_ex+0x412/0x560 [ 100.909564][ T6190] _copy_from_iter+0x1d3/0x1670 [ 100.909589][ T6190] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 100.909616][ T6190] ? __pfx_policy_nodemask+0x10/0x10 [ 100.909639][ T6190] ? __pfx__copy_from_iter+0x10/0x10 [ 100.909670][ T6190] ? set_page_refcounted+0xa0/0x1e0 [ 100.909692][ T6190] ? page_copy_sane+0x4e/0x270 [ 100.909718][ T6190] copy_page_from_iter+0xdd/0x170 [ 100.909747][ T6190] tun_get_user+0x1d4b/0x3dd0 [ 100.909767][ T6190] ? tun_get_user+0x6ff/0x3dd0 [ 100.909804][ T6190] ? aa_file_perm+0x440/0x1630 [ 100.909828][ T6190] ? __pfx_tun_get_user+0x10/0x10 [ 100.909850][ T6190] ? __lock_acquire+0x6b5/0x2cf0 [ 100.909889][ T6190] ? ref_tracker_alloc+0x363/0x4d0 [ 100.909915][ T6190] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 100.909939][ T6190] ? tun_get+0x1c/0x2f0 [ 100.909959][ T6190] ? tun_get+0x1c/0x2f0 [ 100.909983][ T6190] ? tun_get+0x1c/0x2f0 [ 100.909996][ T6190] ? tun_get+0x1c/0x2f0 [ 100.910013][ T6190] tun_chr_write_iter+0x113/0x200 [ 100.910045][ T6190] vfs_write+0x61d/0xb90 [ 100.910070][ T6190] ? __pfx_vfs_write+0x10/0x10 [ 100.910095][ T6190] ? __fget_files+0x2a/0x420 [ 100.910116][ T6190] ksys_write+0x150/0x270 [ 100.910136][ T6190] ? __pfx_ksys_write+0x10/0x10 [ 100.910166][ T6190] do_syscall_64+0xe2/0xf80 [ 100.910185][ T6190] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.910198][ T6190] ? trace_irq_disable+0x37/0x100 [ 100.910211][ T6190] ? clear_bhb_loop+0x60/0xb0 [ 100.910227][ T6190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.910240][ T6190] RIP: 0033:0x7f468295c84e [ 100.910256][ T6190] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 100.910267][ T6190] RSP: 002b:00007f468387ffb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 100.910282][ T6190] RAX: ffffffffffffffda RBX: 00007f46838806c0 RCX: 00007f468295c84e [ 100.910292][ T6190] RDX: 000000000000004e RSI: 0000200000000600 RDI: 00000000000000c8 [ 100.910300][ T6190] RBP: 00007f4683880090 R08: 0000000000000000 R09: 0000000000000000 [ 100.910307][ T6190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.910315][ T6190] R13: 00007f4682c16038 R14: 00007f4682c15fa0 R15: 00007ffd8dbd02a8 [ 100.910336][ T6190] [ 101.384606][ T6142] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 101.398603][ T6145] netlink: 16 bytes leftover after parsing attributes in process `syz.0.62'. [ 101.599883][ T6200] netlink: 'syz.2.82': attribute type 6 has an invalid length. [ 101.616061][ T6202] netlink: 'syz.4.80': attribute type 12 has an invalid length. [ 101.623744][ T6202] netlink: 'syz.4.80': attribute type 29 has an invalid length. [ 101.631483][ T6202] netlink: 148 bytes leftover after parsing attributes in process `syz.4.80'. [ 101.646086][ T6202] netlink: 43 bytes leftover after parsing attributes in process `syz.4.80'. [ 102.007128][ T6219] gretap1: entered promiscuous mode [ 102.045068][ T6225] FAULT_INJECTION: forcing a failure. [ 102.045068][ T6225] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 102.086114][ T6225] CPU: 0 UID: 0 PID: 6225 Comm: syz.4.90 Not tainted syzkaller #0 PREEMPT(full) [ 102.086137][ T6225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 102.086147][ T6225] Call Trace: [ 102.086154][ T6225] [ 102.086162][ T6225] dump_stack_lvl+0xe8/0x150 [ 102.086189][ T6225] should_fail_ex+0x412/0x560 [ 102.086214][ T6225] _copy_from_user+0x2d/0xb0 [ 102.086242][ T6225] generic_map_update_batch+0x572/0x810 [ 102.086276][ T6225] ? __pfx_generic_map_update_batch+0x10/0x10 [ 102.086299][ T6225] ? __fget_files+0x2a/0x420 [ 102.086324][ T6225] ? __pfx_generic_map_update_batch+0x10/0x10 [ 102.086347][ T6225] bpf_map_do_batch+0x39b/0x630 [ 102.086370][ T6225] __sys_bpf+0x709/0x920 [ 102.086390][ T6225] ? __pfx___sys_bpf+0x10/0x10 [ 102.086419][ T6225] ? ksys_write+0x242/0x270 [ 102.086447][ T6225] ? __pfx_ksys_write+0x10/0x10 [ 102.086479][ T6225] __x64_sys_bpf+0x7c/0x90 [ 102.086505][ T6225] do_syscall_64+0xe2/0xf80 [ 102.086529][ T6225] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.086545][ T6225] ? trace_irq_disable+0x37/0x100 [ 102.086562][ T6225] ? clear_bhb_loop+0x60/0xb0 [ 102.086582][ T6225] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.086599][ T6225] RIP: 0033:0x7ff4a459bf79 [ 102.086615][ T6225] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.086629][ T6225] RSP: 002b:00007ff4a5453028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 102.086647][ T6225] RAX: ffffffffffffffda RBX: 00007ff4a4815fa0 RCX: 00007ff4a459bf79 [ 102.086659][ T6225] RDX: 0000000000000038 RSI: 0000200000000000 RDI: 000000000000001a [ 102.086669][ T6225] RBP: 00007ff4a5453090 R08: 0000000000000000 R09: 0000000000000000 [ 102.086679][ T6225] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 102.086689][ T6225] R13: 00007ff4a4816038 R14: 00007ff4a4815fa0 R15: 00007ffff9119088 [ 102.086716][ T6225] [ 102.453050][ T6236] netlink: 16 bytes leftover after parsing attributes in process `syz.3.91'. [ 102.476408][ T6239] netlink: 8 bytes leftover after parsing attributes in process `syz.2.97'. [ 102.558874][ T6224] netlink: 'syz.3.91': attribute type 12 has an invalid length. [ 102.699435][ T6247] syzkaller0: entered promiscuous mode [ 102.704976][ T6247] syzkaller0: entered allmulticast mode [ 102.917965][ T6255] netlink: 'syz.1.102': attribute type 4 has an invalid length. [ 102.937003][ T6255] af_packet: tpacket_rcv: packet too big, clamped from 32 to 4294967272. macoff=96 [ 103.015423][ T6258] netlink: 44 bytes leftover after parsing attributes in process `syz.2.103'. [ 103.313758][ T6264] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 103.327872][ T6264] team0 (unregistering): Port device team_slave_0 removed [ 103.342643][ T6264] team0 (unregistering): Failed to send options change via netlink (err -105) [ 103.361577][ T6264] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 103.385561][ T6264] team0 (unregistering): Port device team_slave_1 removed [ 103.449433][ T6272] __nla_validate_parse: 1 callbacks suppressed [ 103.449450][ T6272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.110'. [ 103.511091][ T6272] vlan2: entered allmulticast mode [ 103.520967][ T6272] macvlan1: entered allmulticast mode [ 103.531293][ T6272] veth1_vlan: entered allmulticast mode [ 103.611422][ T6277] syz_tun: entered allmulticast mode [ 103.624364][ T6275] syz_tun: left allmulticast mode [ 103.739548][ T6280] netlink: 'syz.2.112': attribute type 1 has an invalid length. [ 103.816799][ T6284] syz_tun: entered allmulticast mode [ 103.844684][ T6282] syz_tun: left allmulticast mode [ 104.099502][ T6291] netlink: 14 bytes leftover after parsing attributes in process `syz.0.117'. [ 104.167411][ T6290] vlan2: entered allmulticast mode [ 104.172584][ T6290] bond0: entered allmulticast mode [ 104.180491][ T6290] bond_slave_0: entered allmulticast mode [ 104.186443][ T6290] bond_slave_1: entered allmulticast mode [ 104.282231][ T6291] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 104.299687][ T6291] bond_slave_0: left allmulticast mode [ 104.310978][ T6291] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 104.322777][ T6291] bond_slave_1: left allmulticast mode [ 104.347320][ T6291] bond0 (unregistering): Released all slaves [ 104.486551][ T6296] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 104.517322][ T6306] netlink: 4 bytes leftover after parsing attributes in process `syz.4.121'. [ 104.696674][ T6316] FAULT_INJECTION: forcing a failure. [ 104.696674][ T6316] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 104.723883][ T6303] netlink: 4 bytes leftover after parsing attributes in process `syz.4.121'. [ 104.753815][ T6316] CPU: 1 UID: 0 PID: 6316 Comm: syz.2.123 Not tainted syzkaller #0 PREEMPT(full) [ 104.753838][ T6316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 104.753849][ T6316] Call Trace: [ 104.753855][ T6316] [ 104.753862][ T6316] dump_stack_lvl+0xe8/0x150 [ 104.753889][ T6316] should_fail_ex+0x412/0x560 [ 104.753913][ T6316] _copy_from_user+0x2d/0xb0 [ 104.753938][ T6316] generic_map_update_batch+0x51b/0x810 [ 104.753969][ T6316] ? __pfx_generic_map_update_batch+0x10/0x10 [ 104.753993][ T6316] ? __fget_files+0x2a/0x420 [ 104.754018][ T6316] ? __pfx_generic_map_update_batch+0x10/0x10 [ 104.754040][ T6316] bpf_map_do_batch+0x39b/0x630 [ 104.754064][ T6316] __sys_bpf+0x709/0x920 [ 104.754083][ T6316] ? __pfx___sys_bpf+0x10/0x10 [ 104.754111][ T6316] ? ksys_write+0x242/0x270 [ 104.754136][ T6316] ? __pfx_ksys_write+0x10/0x10 [ 104.754166][ T6316] __x64_sys_bpf+0x7c/0x90 [ 104.754192][ T6316] do_syscall_64+0xe2/0xf80 [ 104.754217][ T6316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.754233][ T6316] ? trace_irq_disable+0x37/0x100 [ 104.754250][ T6316] ? clear_bhb_loop+0x60/0xb0 [ 104.754270][ T6316] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.754286][ T6316] RIP: 0033:0x7fe558f9bf79 [ 104.754303][ T6316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.754316][ T6316] RSP: 002b:00007fe559e82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 104.754334][ T6316] RAX: ffffffffffffffda RBX: 00007fe559215fa0 RCX: 00007fe558f9bf79 [ 104.754345][ T6316] RDX: 0000000000000038 RSI: 0000200000000000 RDI: 000000000000001a [ 104.754355][ T6316] RBP: 00007fe559e82090 R08: 0000000000000000 R09: 0000000000000000 [ 104.754366][ T6316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 104.754375][ T6316] R13: 00007fe559216038 R14: 00007fe559215fa0 R15: 00007fff39548c68 [ 104.754399][ T6316] [ 105.327445][ T6338] Cannot find del_set index 2 as target [ 105.395375][ T6317] syz.0.122 (6317) used greatest stack depth: 17656 bytes left [ 105.582139][ T6346] pim6reg: entered allmulticast mode [ 105.587490][ T6351] netlink: 8 bytes leftover after parsing attributes in process `syz.3.133'. [ 105.587595][ T6351] netlink: 8 bytes leftover after parsing attributes in process `syz.3.133'. [ 105.613887][ T6352] Illegal XDP return value 98 on prog (id 34) dev N/A, expect packet loss! [ 105.646928][ T6353] 8021q: VLANs not supported on gre0 [ 105.779843][ T6356] netlink: 16 bytes leftover after parsing attributes in process `syz.1.137'. [ 105.794873][ T6356] netlink: 'syz.1.137': attribute type 12 has an invalid length. [ 105.895467][ T6366] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 105.999970][ T6364] netlink: 24 bytes leftover after parsing attributes in process `syz.2.140'. [ 106.068459][ T6364] netlink: 4 bytes leftover after parsing attributes in process `syz.2.140'. [ 106.112390][ T6370] xt_TPROXY: Can be used only with -p tcp or -p udp [ 106.722343][ T6393] netlink: 12 bytes leftover after parsing attributes in process `syz.2.143'. [ 107.512714][ T6414] syz_tun: entered allmulticast mode [ 107.542453][ T6409] syz_tun: left allmulticast mode [ 108.378944][ T6450] FAULT_INJECTION: forcing a failure. [ 108.378944][ T6450] name failslab, interval 1, probability 0, space 0, times 1 [ 108.393562][ T6450] CPU: 1 UID: 0 PID: 6450 Comm: syz.2.166 Not tainted syzkaller #0 PREEMPT(full) [ 108.393586][ T6450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 108.393596][ T6450] Call Trace: [ 108.393604][ T6450] [ 108.393611][ T6450] dump_stack_lvl+0xe8/0x150 [ 108.393639][ T6450] should_fail_ex+0x412/0x560 [ 108.393666][ T6450] should_failslab+0xa8/0x100 [ 108.393687][ T6450] __kmalloc_cache_node_noprof+0x87/0x6d0 [ 108.393707][ T6450] ? __get_vm_area_node+0x13f/0x300 [ 108.393738][ T6450] __get_vm_area_node+0x13f/0x300 [ 108.393762][ T6450] ? xskq_create+0x56/0x170 [ 108.393788][ T6450] __vmalloc_node_range_noprof+0x372/0x1730 [ 108.393807][ T6450] ? xskq_create+0xbf/0x170 [ 108.393856][ T6450] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 108.393879][ T6450] ? __kasan_kmalloc+0x93/0xb0 [ 108.393921][ T6450] vmalloc_user_noprof+0xad/0xe0 [ 108.393939][ T6450] ? xskq_create+0xbf/0x170 [ 108.393962][ T6450] xskq_create+0xbf/0x170 [ 108.393986][ T6450] xsk_init_queue+0xad/0x110 [ 108.394009][ T6450] xsk_setsockopt+0x54c/0x990 [ 108.394033][ T6450] ? __pfx_xsk_setsockopt+0x10/0x10 [ 108.394053][ T6450] ? __pfx_aa_sk_perm+0x10/0x10 [ 108.394078][ T6450] ? aa_sock_opt_perm+0xff/0x1a0 [ 108.394103][ T6450] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 108.394122][ T6450] ? __pfx_xsk_setsockopt+0x10/0x10 [ 108.394145][ T6450] do_sock_setsockopt+0x17c/0x1b0 [ 108.394176][ T6450] __x64_sys_setsockopt+0x13d/0x1b0 [ 108.394205][ T6450] do_syscall_64+0xe2/0xf80 [ 108.394231][ T6450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.394249][ T6450] ? trace_irq_disable+0x37/0x100 [ 108.394267][ T6450] ? clear_bhb_loop+0x60/0xb0 [ 108.394288][ T6450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.394305][ T6450] RIP: 0033:0x7fe558f9bf79 [ 108.394321][ T6450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.394337][ T6450] RSP: 002b:00007fe559e82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 108.394359][ T6450] RAX: ffffffffffffffda RBX: 00007fe559215fa0 RCX: 00007fe558f9bf79 [ 108.394372][ T6450] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 108.394382][ T6450] RBP: 00007fe559e82090 R08: 0000000000000004 R09: 0000000000000000 [ 108.394399][ T6450] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 108.394410][ T6450] R13: 00007fe559216038 R14: 00007fe559215fa0 R15: 00007fff39548c68 [ 108.394440][ T6450] [ 108.395002][ T6450] syz.2.166: vmalloc error: size 4096, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 108.684708][ T6450] CPU: 0 UID: 0 PID: 6450 Comm: syz.2.166 Not tainted syzkaller #0 PREEMPT(full) [ 108.684730][ T6450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 108.684740][ T6450] Call Trace: [ 108.684747][ T6450] [ 108.684754][ T6450] dump_stack_lvl+0xe8/0x150 [ 108.684782][ T6450] warn_alloc+0x249/0x340 [ 108.684806][ T6450] ? __pfx_warn_alloc+0x10/0x10 [ 108.684826][ T6450] ? __get_vm_area_node+0x13f/0x300 [ 108.684857][ T6450] ? __get_vm_area_node+0x2b5/0x300 [ 108.684880][ T6450] ? xskq_create+0x56/0x170 [ 108.684908][ T6450] __vmalloc_node_range_noprof+0x397/0x1730 [ 108.684955][ T6450] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 108.684978][ T6450] ? __kasan_kmalloc+0x93/0xb0 [ 108.685002][ T6450] vmalloc_user_noprof+0xad/0xe0 [ 108.685019][ T6450] ? xskq_create+0xbf/0x170 [ 108.685041][ T6450] xskq_create+0xbf/0x170 [ 108.685064][ T6450] xsk_init_queue+0xad/0x110 [ 108.685087][ T6450] xsk_setsockopt+0x54c/0x990 [ 108.685110][ T6450] ? __pfx_xsk_setsockopt+0x10/0x10 [ 108.685129][ T6450] ? __pfx_aa_sk_perm+0x10/0x10 [ 108.685153][ T6450] ? aa_sock_opt_perm+0xff/0x1a0 [ 108.685177][ T6450] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 108.685196][ T6450] ? __pfx_xsk_setsockopt+0x10/0x10 [ 108.685217][ T6450] do_sock_setsockopt+0x17c/0x1b0 [ 108.685245][ T6450] __x64_sys_setsockopt+0x13d/0x1b0 [ 108.685274][ T6450] do_syscall_64+0xe2/0xf80 [ 108.685298][ T6450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.685320][ T6450] ? trace_irq_disable+0x37/0x100 [ 108.685337][ T6450] ? clear_bhb_loop+0x60/0xb0 [ 108.685358][ T6450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.685374][ T6450] RIP: 0033:0x7fe558f9bf79 [ 108.685390][ T6450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.685407][ T6450] RSP: 002b:00007fe559e82028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 108.685425][ T6450] RAX: ffffffffffffffda RBX: 00007fe559215fa0 RCX: 00007fe558f9bf79 [ 108.685437][ T6450] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 108.685446][ T6450] RBP: 00007fe559e82090 R08: 0000000000000004 R09: 0000000000000000 [ 108.685456][ T6450] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 108.685466][ T6450] R13: 00007fe559216038 R14: 00007fe559215fa0 R15: 00007fff39548c68 [ 108.685494][ T6450] [ 108.685588][ T6450] Mem-Info: [ 108.956286][ T6450] active_anon:6424 inactive_anon:0 isolated_anon:0 [ 108.956286][ T6450] active_file:3084 inactive_file:39940 isolated_file:0 [ 108.956286][ T6450] unevictable:768 dirty:530 writeback:0 [ 108.956286][ T6450] slab_reclaimable:10388 slab_unreclaimable:97697 [ 108.956286][ T6450] mapped:29261 shmem:1356 pagetables:1138 [ 108.956286][ T6450] sec_pagetables:0 bounce:0 [ 108.956286][ T6450] kernel_misc_reclaimable:0 [ 108.956286][ T6450] free:1320618 free_pcp:21029 free_cma:0 [ 109.012495][ T6450] Node 0 active_anon:25696kB inactive_anon:0kB active_file:12336kB inactive_file:159556kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117044kB dirty:2116kB writeback:0kB shmem:3888kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11988kB pagetables:4388kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 109.048225][ T6450] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 109.175441][ T6450] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 109.205698][ T6450] lowmem_reserve[]: 0 2494 2495 2495 2495 [ 109.211582][ T6450] Node 0 DMA32 free:1386240kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25696kB inactive_anon:0kB active_file:12336kB inactive_file:159556kB unevictable:1536kB writepending:2116kB zspages:0kB present:3129332kB managed:2554036kB mlocked:0kB bounce:0kB free_pcp:62792kB local_pcp:17848kB free_cma:0kB [ 109.245589][ T6450] lowmem_reserve[]: 0 0 1 1 1 [ 109.251255][ T6450] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 109.313140][ T6470] __nla_validate_parse: 6 callbacks suppressed [ 109.313159][ T6470] netlink: 112 bytes leftover after parsing attributes in process `syz.3.172'. [ 109.320991][ T6450] lowmem_reserve[]: [ 109.338267][ T6472] netlink: 56 bytes leftover after parsing attributes in process `syz.1.173'. [ 109.356007][ T6450] 0 0 0 0 0 [ 109.359289][ T6450] Node 1 Normal free:3881652kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:21408kB local_pcp:8320kB free_cma:0kB [ 109.406294][ T6473] netlink: 240 bytes leftover after parsing attributes in process `syz.0.169'. [ 109.420200][ T6450] lowmem_reserve[]: 0 0 0 0 0 [ 109.435674][ T6450] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 109.474164][ T6477] netlink: 'syz.4.174': attribute type 1 has an invalid length. [ 109.484697][ T6450] Node 0 DMA32: 563*4kB (U) 136*8kB (UME) 236*16kB (UE) 75*32kB (UME) 27*64kB (U) 18*128kB (UME) 11*256kB (U) 12*512kB (UM) 9*1024kB (UME) 5*2048kB (UM) 328*4096kB (M) = 1385452kB [ 109.505465][ T6450] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 109.545208][ T6477] 8021q: adding VLAN 0 to HW filter on device bond1 [ 109.559842][ T6450] Node 1 Normal: 167*4kB (UE) 37*8kB (UME) 39*16kB (UME) 68*32kB (UME) 20*64kB (UME) 8*128kB (UME) 3*256kB (UM) 4*512kB (UME) 2*1024kB (ME) 2*2048kB (UE) 944*4096kB (M) = 3881652kB [ 109.626830][ T6479] bond1: (slave syz_tun): making interface the new active one [ 109.635664][ T6479] bond1: (slave syz_tun): Enslaving as an active interface with an up link [ 109.661107][ T6450] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 109.703323][ T6450] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 109.734696][ T6450] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 109.766261][ T6450] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 109.797821][ T6450] 44376 total pagecache pages [ 109.803581][ T6450] 0 pages in swap cache [ 109.823664][ T6450] Free swap = 124996kB [ 109.836063][ T6450] Total swap = 124996kB [ 109.840259][ T6450] 2097051 pages RAM [ 109.860668][ T6488] veth0: Caught tx_queue_len zero misconfig [ 109.867298][ T6450] 0 pages HighMem/MovableOnly [ 109.867313][ T6450] 426644 pages reserved [ 109.867322][ T6450] 0 pages cma reserved [ 109.907748][ T6491] netlink: 16 bytes leftover after parsing attributes in process `syz.4.181'. [ 109.926228][ T6491] Cannot find add_set index 2 as target [ 110.115577][ T6506] netlink: 112 bytes leftover after parsing attributes in process `syz.3.185'. [ 110.642589][ T6539] netlink: 'syz.4.193': attribute type 5 has an invalid length. [ 110.751865][ T6550] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 110.918239][ T6555] netlink: 112 bytes leftover after parsing attributes in process `syz.2.199'. [ 111.029898][ T6560] netlink: 8 bytes leftover after parsing attributes in process `syz.2.201'. [ 111.065106][ T6562] xt_connbytes: Forcing CT accounting to be enabled [ 111.141388][ T6564] syz_tun: entered allmulticast mode [ 111.151420][ T6563] syz_tun: left allmulticast mode [ 111.471420][ T6582] netlink: 28 bytes leftover after parsing attributes in process `syz.2.209'. [ 111.514628][ T6582] netlink: 'syz.2.209': attribute type 7 has an invalid length. [ 111.539256][ T6582] netlink: 'syz.2.209': attribute type 8 has an invalid length. [ 111.548505][ T6584] netlink: 112 bytes leftover after parsing attributes in process `syz.3.211'. [ 111.559072][ T6582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.209'. [ 111.919533][ T6601] IPv6: Can't replace route, no match found [ 112.213246][ T6595] bond1: (slave bond_slave_1): Device is not our slave [ 112.226284][ T6595] bond1: option active_slave: invalid value (bond_slave_1) [ 112.237376][ T6595] bond1 (unregistering): Released all slaves [ 112.506233][ T6607] IPv6: Can't replace route, no match found [ 113.652467][ T6541] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 114.086267][ T6638] IPv6: Can't replace route, no match found [ 114.128383][ T6643] netlink: 'syz.2.229': attribute type 7 has an invalid length. [ 114.150104][ T6643] netlink: 'syz.2.229': attribute type 8 has an invalid length. [ 114.237819][ T6647] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 114.622690][ T6660] __nla_validate_parse: 8 callbacks suppressed [ 114.622709][ T6660] netlink: 28 bytes leftover after parsing attributes in process `syz.0.232'. [ 114.647584][ T6660] netlink: 28 bytes leftover after parsing attributes in process `syz.0.232'. [ 114.648663][ T6662] x_tables: unsorted entry at hook 3 [ 114.702661][ T6660] batadv0: entered promiscuous mode [ 114.717699][ T6660] bridge0: entered promiscuous mode [ 114.786911][ T6664] FAULT_INJECTION: forcing a failure. [ 114.786911][ T6664] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 114.808078][ T6655] netlink: 16 bytes leftover after parsing attributes in process `syz.2.233'. [ 114.812179][ T6664] CPU: 0 UID: 0 PID: 6664 Comm: syz.4.238 Not tainted syzkaller #0 PREEMPT(full) [ 114.812246][ T6664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 114.812274][ T6664] Call Trace: [ 114.812311][ T6664] [ 114.812339][ T6664] dump_stack_lvl+0xe8/0x150 [ 114.812412][ T6664] should_fail_ex+0x412/0x560 [ 114.812509][ T6664] _copy_from_user+0x2d/0xb0 [ 114.812609][ T6664] generic_map_update_batch+0x51b/0x810 [ 114.812710][ T6664] ? __pfx_generic_map_update_batch+0x10/0x10 [ 114.812780][ T6664] ? __fget_files+0x2a/0x420 [ 114.812851][ T6664] ? __pfx_generic_map_update_batch+0x10/0x10 [ 114.812916][ T6664] bpf_map_do_batch+0x39b/0x630 [ 114.812996][ T6664] __sys_bpf+0x709/0x920 [ 114.813056][ T6664] ? __pfx___sys_bpf+0x10/0x10 [ 114.813147][ T6664] ? ksys_write+0x242/0x270 [ 114.813225][ T6664] ? __pfx_ksys_write+0x10/0x10 [ 114.813323][ T6664] __x64_sys_bpf+0x7c/0x90 [ 114.813396][ T6664] do_syscall_64+0xe2/0xf80 [ 114.813466][ T6664] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.813528][ T6664] ? trace_irq_disable+0x37/0x100 [ 114.813575][ T6664] ? clear_bhb_loop+0x60/0xb0 [ 114.813626][ T6664] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 114.813672][ T6664] RIP: 0033:0x7ff4a459bf79 [ 114.813718][ T6664] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 114.813756][ T6664] RSP: 002b:00007ff4a5453028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 114.813810][ T6664] RAX: ffffffffffffffda RBX: 00007ff4a4815fa0 RCX: 00007ff4a459bf79 [ 114.813840][ T6664] RDX: 0000000000000038 RSI: 0000200000000000 RDI: 000000000000001a [ 114.813882][ T6664] RBP: 00007ff4a5453090 R08: 0000000000000000 R09: 0000000000000000 [ 114.813898][ T6664] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 114.813934][ T6664] R13: 00007ff4a4816038 R14: 00007ff4a4815fa0 R15: 00007ffff9119088 [ 114.814028][ T6664] [ 115.036313][ T6655] netlink: 64 bytes leftover after parsing attributes in process `syz.2.233'. [ 115.045209][ T6655] tipc: Invalid UDP bearer configuration [ 115.045265][ T6655] tipc: Enabling of bearer rejected, failed to enable media [ 115.340078][ T6677] netlink: 'syz.3.242': attribute type 1 has an invalid length. [ 115.361669][ T6672] netlink: 'syz.1.241': attribute type 4 has an invalid length. [ 115.383525][ T6677] 8021q: adding VLAN 0 to HW filter on device bond1 [ 115.561925][ T6691] netlink: 8 bytes leftover after parsing attributes in process `syz.4.245'. [ 115.581715][ T6691] netlink: 20 bytes leftover after parsing attributes in process `syz.4.245'. [ 115.674917][ T6677] bond1: (slave syz_tun): making interface the new active one [ 115.690260][ T6677] bond1: (slave syz_tun): Enslaving as an active interface with an up link [ 115.699890][ T6687] netlink: 11562 bytes leftover after parsing attributes in process `syz.4.245'. [ 115.749876][ T6691] geneve2: entered promiscuous mode [ 115.767185][ T6691] geneve2: entered allmulticast mode [ 116.042821][ T6703] netlink: 72 bytes leftover after parsing attributes in process `syz.4.249'. [ 116.129148][ T6712] netlink: 20 bytes leftover after parsing attributes in process `syz.3.252'. [ 116.167003][ T6712] netlink: 4 bytes leftover after parsing attributes in process `syz.3.252'. [ 116.620640][ T6736] syz_tun: entered allmulticast mode [ 116.649510][ T6735] syz_tun: left allmulticast mode [ 116.738344][ T6738] netlink: 'syz.4.259': attribute type 4 has an invalid length. [ 117.028289][ T6752] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 117.358111][ T6764] syz_tun: entered allmulticast mode [ 117.365453][ T6763] syz_tun: left allmulticast mode [ 117.510723][ T6766] netlink: 'syz.3.267': attribute type 4 has an invalid length. [ 117.604246][ T6775] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 117.977105][ T6789] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 118.006691][ T6789] team0 (unregistering): Port device team_slave_0 removed [ 118.061702][ T6789] team0 (unregistering): Failed to send options change via netlink (err -105) [ 118.073320][ T6789] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 118.085344][ T6789] team0 (unregistering): Port device team_slave_1 removed [ 118.392027][ T6809] netlink: 'syz.2.276': attribute type 4 has an invalid length. [ 118.458984][ T6805] ip6gretap0: entered promiscuous mode [ 118.480144][ T6805] syz_tun: entered promiscuous mode [ 118.486904][ T6805] syz_tun: left promiscuous mode [ 118.492741][ T6805] ip6gretap0: left promiscuous mode [ 118.624368][ T6817] netlink: 'syz.0.285': attribute type 1 has an invalid length. [ 118.790800][ T6822] bond0: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 118.891045][ T6825] veth3: entered promiscuous mode [ 118.899448][ T6825] bond0: (slave veth3): Enslaving as a backup interface with a down link [ 118.909544][ T6827] netlink: 'syz.3.288': attribute type 12 has an invalid length. [ 118.919276][ T13] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 118.921735][ T6817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 119.050575][ T6833] netlink: 'syz.1.291': attribute type 1 has an invalid length. [ 119.087311][ T12] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 119.163618][ T6833] 8021q: adding VLAN 0 to HW filter on device bond1 [ 119.185736][ T6843] netlink: 'syz.0.295': attribute type 13 has an invalid length. [ 119.262916][ T6841] bond1: (slave veth3): Enslaving as an active interface with a down link [ 119.310242][ T6833] bond1: (slave dummy0): making interface the new active one [ 119.327010][ T6833] dummy0: entered promiscuous mode [ 119.332978][ T6833] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 119.421229][ T6851] !yz!: rxe_newlink: already configured on team_slave_0 [ 119.514681][ T6847] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 119.577866][ T12] bond0: (slave ip6gretap1): link status up again after 0 ms [ 119.601589][ T6849] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 119.634441][ T6852] syz_tun: entered allmulticast mode [ 119.643152][ T12] bond0: (slave ip6gretap1): link status up again after 0 ms [ 119.656145][ T6848] syz_tun: left allmulticast mode [ 119.673426][ T12] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 119.801144][ T6846] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 119.876150][ T3552] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 119.987475][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 120.106748][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 120.319162][ T6887] __nla_validate_parse: 10 callbacks suppressed [ 120.319210][ T6887] netlink: 165240 bytes leftover after parsing attributes in process `syz.3.310'. [ 120.549641][ T6889] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.590496][ T6892] tunl0: Caught tx_queue_len zero misconfig [ 120.675844][ T6889] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.799722][ T6889] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 120.895499][ T6889] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.118226][ T6900] netlink: 8 bytes leftover after parsing attributes in process `syz.0.314'. [ 121.148757][ T6900] netlink: 48 bytes leftover after parsing attributes in process `syz.0.314'. [ 121.235703][ T3552] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.264737][ T3552] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.347995][ T36] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.429402][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.532570][ T6905] batman_adv: batadv0: Adding interface: dummy0 [ 121.546474][ T6905] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 121.590177][ T6905] batman_adv: batadv0: Interface activated: dummy0 [ 121.613458][ T6911] netlink: 'syz.3.319': attribute type 1 has an invalid length. [ 121.704952][ T6911] 8021q: adding VLAN 0 to HW filter on device bond2 [ 121.760372][ T6918] netlink: 'syz.4.320': attribute type 3 has an invalid length. [ 121.799385][ T6914] bond1: (slave syz_tun): Releasing active interface [ 121.822637][ T6920] netlink: 12 bytes leftover after parsing attributes in process `syz.1.323'. [ 121.832658][ T6920] IPv6: Can't replace route, no match found [ 121.843568][ T6914] bond2: (slave syz_tun): making interface the new active one [ 121.853822][ T6914] bond2: (slave syz_tun): Enslaving as an active interface with an up link [ 121.878107][ T6918] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 121.944293][ T6915] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 122.061792][ T6928] syz_tun: entered allmulticast mode [ 122.079541][ T6932] FAULT_INJECTION: forcing a failure. [ 122.079541][ T6932] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 122.095133][ T6926] syz_tun: left allmulticast mode [ 122.106964][ T6932] CPU: 1 UID: 0 PID: 6932 Comm: syz.4.326 Not tainted syzkaller #0 PREEMPT(full) [ 122.106988][ T6932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 122.107009][ T6932] Call Trace: [ 122.107015][ T6932] [ 122.107021][ T6932] dump_stack_lvl+0xe8/0x150 [ 122.107050][ T6932] should_fail_ex+0x412/0x560 [ 122.107070][ T6932] _copy_from_user+0x2d/0xb0 [ 122.107093][ T6932] generic_map_update_batch+0x572/0x810 [ 122.107121][ T6932] ? __pfx_generic_map_update_batch+0x10/0x10 [ 122.107141][ T6932] ? __fget_files+0x2a/0x420 [ 122.107161][ T6932] ? __pfx_generic_map_update_batch+0x10/0x10 [ 122.107180][ T6932] bpf_map_do_batch+0x39b/0x630 [ 122.107199][ T6932] __sys_bpf+0x709/0x920 [ 122.107214][ T6932] ? __pfx___sys_bpf+0x10/0x10 [ 122.107238][ T6932] ? ksys_write+0x242/0x270 [ 122.107261][ T6932] ? __pfx_ksys_write+0x10/0x10 [ 122.107286][ T6932] __x64_sys_bpf+0x7c/0x90 [ 122.107307][ T6932] do_syscall_64+0xe2/0xf80 [ 122.107327][ T6932] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.107340][ T6932] ? trace_irq_disable+0x37/0x100 [ 122.107372][ T6932] ? clear_bhb_loop+0x60/0xb0 [ 122.107390][ T6932] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 122.107404][ T6932] RIP: 0033:0x7ff4a459bf79 [ 122.107421][ T6932] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.107433][ T6932] RSP: 002b:00007ff4a5453028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 122.107455][ T6932] RAX: ffffffffffffffda RBX: 00007ff4a4815fa0 RCX: 00007ff4a459bf79 [ 122.107493][ T6932] RDX: 0000000000000038 RSI: 0000200000000000 RDI: 000000000000001a [ 122.107502][ T6932] RBP: 00007ff4a5453090 R08: 0000000000000000 R09: 0000000000000000 [ 122.107510][ T6932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 122.107537][ T6932] R13: 00007ff4a4816038 R14: 00007ff4a4815fa0 R15: 00007ffff9119088 [ 122.107560][ T6932] [ 122.409620][ T6938] xt_TPROXY: Can be used only with -p tcp or -p udp [ 122.531472][ T6941] netlink: 8 bytes leftover after parsing attributes in process `syz.2.331'. [ 122.600292][ T6941] netlink: 'syz.2.331': attribute type 3 has an invalid length. [ 122.617559][ T6947] Cannot find del_set index 2 as target [ 122.636435][ T6941] netlink: 8 bytes leftover after parsing attributes in process `syz.2.331'. [ 122.667534][ T6949] ip6gre1: entered promiscuous mode [ 122.679522][ T6949] ip6gre1: entered allmulticast mode [ 122.784616][ T6952] veth3: entered promiscuous mode [ 122.847008][ T6965] netlink: 12 bytes leftover after parsing attributes in process `syz.0.335'. [ 122.859035][ T6965] IPv6: Can't replace route, no match found [ 122.876594][ T6955] veth5: entered promiscuous mode [ 122.891398][ T6960] syzkaller0: entered promiscuous mode [ 122.898511][ T6960] syzkaller0: entered allmulticast mode [ 122.916955][ T36] net_ratelimit: 17 callbacks suppressed [ 122.916972][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 122.949170][ T6969] netlink: 4 bytes leftover after parsing attributes in process `syz.4.337'. [ 122.959934][ T6941] netlink: 8 bytes leftover after parsing attributes in process `syz.2.331'. [ 123.009487][ T6969] netlink: 12 bytes leftover after parsing attributes in process `syz.4.337'. [ 123.118018][ T3552] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 123.184980][ T6976] syz_tun: entered allmulticast mode [ 123.211755][ T6978] mÿ5nè‹Ò: entered promiscuous mode [ 123.228192][ T6971] syz_tun: left allmulticast mode [ 123.252080][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 123.386143][ T3552] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 123.496900][ T12] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 123.588470][ T7005] netlink: 'syz.1.348': attribute type 13 has an invalid length. [ 123.599614][ T7006] IPv6: Can't replace route, no match found [ 123.680175][ T12] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 123.711652][ T7008] netlink: 'syz.3.350': attribute type 21 has an invalid length. [ 123.719779][ T7008] netlink: 'syz.3.350': attribute type 22 has an invalid length. [ 123.727614][ T7008] netlink: 'syz.3.350': attribute type 23 has an invalid length. [ 123.735484][ T7008] netlink: 'syz.3.350': attribute type 25 has an invalid length. [ 123.816931][ T3552] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 123.936671][ T3552] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 124.057745][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 124.188040][ T2939] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 124.408672][ T7043] syz_tun: entered allmulticast mode [ 124.415958][ T7042] syz_tun: left allmulticast mode [ 124.496622][ T7047] xt_TPROXY: Can be used only with -p tcp or -p udp [ 124.523328][ T7049] IPv6: Can't replace route, no match found [ 124.615898][ T7051] Cannot find del_set index 2 as target [ 124.735116][ T7056] netlink: 'syz.1.366': attribute type 21 has an invalid length. [ 124.775407][ T7056] netlink: 'syz.1.366': attribute type 1 has an invalid length. [ 124.785546][ T7061] ieee802154 phy0 wpan0: encryption failed: -22 [ 124.952284][ T7071] IPv6: Can't replace route, no match found [ 125.258885][ T7087] No such timeout policy "syz0" [ 125.360385][ T7096] __nla_validate_parse: 11 callbacks suppressed [ 125.360401][ T7096] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.378'. [ 125.485632][ T7100] erspan1: entered allmulticast mode [ 125.529397][ T7108] netlink: 12 bytes leftover after parsing attributes in process `syz.1.384'. [ 125.570707][ T7108] IPv6: Can't replace route, no match found [ 125.743511][ T7112] netlink: 4 bytes leftover after parsing attributes in process `syz.4.386'. [ 125.985226][ T7124] netlink: 32 bytes leftover after parsing attributes in process `syz.4.391'. [ 126.002322][ T7119] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 126.101451][ T7119] netlink: 28 bytes leftover after parsing attributes in process `syz.2.389'. [ 126.152561][ T7127] veth3: entered promiscuous mode [ 126.167645][ T7127] bond2: (slave veth3): Enslaving as a backup interface with a down link [ 126.182462][ T7119] 8021q: adding VLAN 0 to HW filter on device bond2 [ 126.240976][ T7124] syzkaller0: entered promiscuous mode [ 126.292197][ T7124] syzkaller0: entered allmulticast mode [ 126.756563][ T7150] syz_tun: entered allmulticast mode [ 126.778142][ T7149] syz_tun: left allmulticast mode [ 127.438106][ T7173] validate_nla: 3 callbacks suppressed [ 127.438124][ T7173] netlink: 'syz.3.405': attribute type 1 has an invalid length. [ 127.524514][ T7178] netlink: 8 bytes leftover after parsing attributes in process `syz.0.404'. [ 127.547247][ T7178] netlink: 48 bytes leftover after parsing attributes in process `syz.0.404'. [ 128.176625][ T7171] netlink: 'syz.2.406': attribute type 6 has an invalid length. [ 128.208284][ T7173] 8021q: adding VLAN 0 to HW filter on device bond3 [ 128.218532][ T3552] net_ratelimit: 21 callbacks suppressed [ 128.218561][ T3552] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 128.409507][ T7192] netlink: 'syz.4.410': attribute type 1 has an invalid length. [ 128.416317][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 128.446201][ T7190] netlink: 24 bytes leftover after parsing attributes in process `syz.3.408'. [ 128.463764][ T7192] 8021q: adding VLAN 0 to HW filter on device bond2 [ 128.624102][ T7195] bond2: (slave veth3): Enslaving as an active interface with a down link [ 128.690491][ T7192] batman_adv: batadv0: Interface deactivated: dummy0 [ 128.700806][ T7192] batman_adv: batadv0: Removing interface: dummy0 [ 128.724176][ T7192] bond2: (slave dummy0): making interface the new active one [ 128.733815][ T7192] dummy0: entered promiscuous mode [ 128.740133][ T7192] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 128.792222][ T7207] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 128.807750][ T7207] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.850987][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 128.900352][ T7207] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 128.937788][ T7207] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.941767][ T7220] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 129.007919][ T7222] syz_tun: entered allmulticast mode [ 129.100715][ T7207] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.117684][ T7207] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.136987][ T7221] syz_tun: left allmulticast mode [ 129.144793][ T7228] netlink: 'syz.2.419': attribute type 4 has an invalid length. [ 129.160235][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 129.240583][ T7207] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 129.252321][ T7207] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 129.276088][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 129.373482][ T7236] netlink: 28 bytes leftover after parsing attributes in process `syz.0.422'. [ 129.396551][ T60] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 129.440125][ T13] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.449033][ T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.503336][ T36] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.526877][ T36] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.551852][ T36] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.561527][ T36] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.576190][ T7246] netlink: 240 bytes leftover after parsing attributes in process `syz.0.425'. [ 129.609593][ T13] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 129.626184][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 129.659525][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 129.695198][ T7254] netlink: 'syz.4.427': attribute type 10 has an invalid length. [ 129.704939][ T7254] hsr0: entered promiscuous mode [ 129.727135][ T7254] bridge0: port 3(hsr0) entered blocking state [ 129.740055][ T7254] bridge0: port 3(hsr0) entered disabled state [ 129.751671][ T7254] hsr0: entered allmulticast mode [ 129.757379][ T7254] hsr_slave_0: entered allmulticast mode [ 129.763231][ T7254] hsr_slave_1: entered allmulticast mode [ 129.772925][ T7254] bridge0: port 3(hsr0) entered blocking state [ 129.779490][ T7254] bridge0: port 3(hsr0) entered forwarding state [ 129.806155][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 129.840583][ T7258] 8021q: VLANs not supported on gre0 [ 129.891057][ T7260] Cannot find del_set index 2 as target [ 129.919201][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 130.232449][ T7274] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 130.596653][ T60] dummy0: left promiscuous mode [ 130.664133][ T7284] __nla_validate_parse: 7 callbacks suppressed [ 130.664151][ T7284] netlink: 28 bytes leftover after parsing attributes in process `syz.1.437'. [ 130.681850][ T7284] netlink: 28 bytes leftover after parsing attributes in process `syz.1.437'. [ 130.705571][ T7284] bridge0: entered promiscuous mode [ 130.721296][ T7284] ip6gretap0: entered promiscuous mode [ 130.731562][ T7284] debugfs: 'hsr1' already exists in 'hsr' [ 130.740760][ T7284] Cannot create hsr debugfs directory [ 131.575221][ T7202] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 131.815357][ T7305] netlink: 28 bytes leftover after parsing attributes in process `syz.4.442'. [ 131.830526][ T7305] netlink: 28 bytes leftover after parsing attributes in process `syz.4.442'. [ 131.843310][ T7308] netlink: 28 bytes leftover after parsing attributes in process `syz.3.443'. [ 131.852503][ T7308] netlink: 28 bytes leftover after parsing attributes in process `syz.3.443'. [ 131.901499][ T7308] batadv0: entered promiscuous mode [ 131.913420][ T7308] bridge0: entered promiscuous mode [ 131.927909][ T7308] debugfs: 'hsr1' already exists in 'hsr' [ 131.952010][ T7308] Cannot create hsr debugfs directory [ 132.632079][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.641786][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.656818][ T7338] xt_CT: No such helper "snmp" [ 132.784421][ T7347] 8021q: adding VLAN 0 to HW filter on device macvlan7 [ 132.793833][ T7346] netlink: 'syz.4.453': attribute type 4 has an invalid length. [ 132.808690][ T7347] 8021q: adding VLAN 0 to HW filter on device macvlan8 [ 132.817897][ T7347] !yz!: rxe_newlink: already configured on team_slave_0 [ 132.911764][ T7317] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.021826][ T7352] netlink: 12 bytes leftover after parsing attributes in process `syz.0.455'. [ 133.045762][ T7352] bond1: entered promiscuous mode [ 133.051065][ T7352] bond1: entered allmulticast mode [ 133.060048][ T7352] 8021q: adding VLAN 0 to HW filter on device bond1 [ 133.236071][ T50] net_ratelimit: 32 callbacks suppressed [ 133.236097][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 133.356091][ T60] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 133.466076][ T60] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 133.576121][ T60] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 133.686109][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 133.796101][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 133.907086][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 134.016648][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 134.126063][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 134.236228][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 134.888079][ T7369] netlink: 'syz.1.461': attribute type 10 has an invalid length. [ 135.080528][ T7318] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 135.255536][ T7379] netlink: 28 bytes leftover after parsing attributes in process `syz.1.465'. [ 135.274916][ T7379] netlink: 28 bytes leftover after parsing attributes in process `syz.1.465'. [ 135.284390][ T7379] FAULT_INJECTION: forcing a failure. [ 135.284390][ T7379] name failslab, interval 1, probability 0, space 0, times 0 [ 135.325702][ T7379] CPU: 0 UID: 0 PID: 7379 Comm: syz.1.465 Not tainted syzkaller #0 PREEMPT(full) [ 135.325727][ T7379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 135.325738][ T7379] Call Trace: [ 135.325745][ T7379] [ 135.325754][ T7379] dump_stack_lvl+0xe8/0x150 [ 135.325782][ T7379] should_fail_ex+0x412/0x560 [ 135.325821][ T7379] should_failslab+0xa8/0x100 [ 135.325842][ T7379] kmem_cache_alloc_lru_noprof+0x8c/0x6c0 [ 135.325869][ T7379] ? __d_alloc+0x37/0x6f0 [ 135.325895][ T7379] __d_alloc+0x37/0x6f0 [ 135.325922][ T7379] d_alloc+0x4b/0x190 [ 135.325957][ T7379] ? lookup_one_qstr_excl+0xc8/0x360 [ 135.325981][ T7379] lookup_one_qstr_excl+0xdc/0x360 [ 135.326007][ T7379] ? lookup_noperm_common+0x245/0x430 [ 135.326032][ T7379] start_dirop+0x5c/0x90 [ 135.326054][ T7379] simple_start_creating+0xcc/0x110 [ 135.326077][ T7379] ? __pfx_simple_start_creating+0x10/0x10 [ 135.326100][ T7379] ? do_raw_spin_unlock+0xf5/0x210 [ 135.326121][ T7379] ? mntput+0x65/0xc0 [ 135.326172][ T7379] debugfs_start_creating+0xdb/0x1a0 [ 135.326199][ T7379] __debugfs_create_file+0x6f/0x400 [ 135.326227][ T7379] debugfs_create_file_full+0x3f/0x60 [ 135.326256][ T7379] ref_tracker_dir_debugfs+0x197/0x360 [ 135.326282][ T7379] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 135.326338][ T7379] ? trace_kmalloc+0x1f/0xb0 [ 135.326354][ T7379] ? __kvmalloc_node_noprof+0x5ba/0x8d0 [ 135.326380][ T7379] ? __raw_spin_lock_init+0x45/0x100 [ 135.326406][ T7379] alloc_netdev_mqs+0x272/0x11b0 [ 135.326425][ T7379] ? __pfx_hsr_dev_setup+0x10/0x10 [ 135.326452][ T7379] rtnl_create_link+0x31f/0xd70 [ 135.326480][ T7379] rtnl_newlink_create+0x277/0xb70 [ 135.326515][ T7379] ? __pfx___nla_validate_parse+0x10/0x10 [ 135.326552][ T7379] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 135.326582][ T7379] ? __pfx___mutex_lock+0x10/0x10 [ 135.326622][ T7379] ? ns_capable+0x89/0xe0 [ 135.326642][ T7379] rtnl_newlink+0x1666/0x1be0 [ 135.326682][ T7379] ? __pfx_rtnl_newlink+0x10/0x10 [ 135.326703][ T7379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.326762][ T7379] ? kasan_quarantine_put+0xbb/0x1f0 [ 135.326791][ T7379] ? lockdep_hardirqs_on+0x7a/0x110 [ 135.326823][ T7379] ? kmem_cache_free+0x195/0x610 [ 135.326842][ T7379] ? nlmon_xmit+0xb0/0x100 [ 135.326874][ T7379] ? __lock_acquire+0x6b5/0x2cf0 [ 135.326911][ T7379] ? __local_bh_enable_ip+0xd0/0x130 [ 135.326929][ T7379] ? lockdep_hardirqs_on+0x7a/0x110 [ 135.326954][ T7379] ? __dev_queue_xmit+0x274/0x3850 [ 135.326981][ T7379] ? __local_bh_enable_ip+0xd0/0x130 [ 135.326997][ T7379] ? __dev_queue_xmit+0x274/0x3850 [ 135.327033][ T7379] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 135.327072][ T7379] ? __pfx_rtnl_newlink+0x10/0x10 [ 135.327095][ T7379] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 135.327122][ T7379] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 135.327144][ T7379] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 135.327165][ T7379] ? ref_tracker_free+0x693/0x840 [ 135.327187][ T7379] ? __copy_skb_header+0xa3/0x4a0 [ 135.327216][ T7379] ? __pfx_ref_tracker_free+0x10/0x10 [ 135.327238][ T7379] ? __skb_clone+0x63/0x7a0 [ 135.327275][ T7379] netlink_rcv_skb+0x232/0x4b0 [ 135.327299][ T7379] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 135.327324][ T7379] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 135.327358][ T7379] ? netlink_deliver_tap+0x2e/0x1b0 [ 135.327399][ T7379] netlink_unicast+0x80f/0x9b0 [ 135.327425][ T7379] ? __pfx_netlink_unicast+0x10/0x10 [ 135.327445][ T7379] ? netlink_sendmsg+0x650/0xb40 [ 135.327464][ T7379] ? skb_put+0x11b/0x210 [ 135.327490][ T7379] netlink_sendmsg+0x813/0xb40 [ 135.327525][ T7379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 135.327550][ T7379] ? aa_sock_msg_perm+0xf1/0x1b0 [ 135.327573][ T7379] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 135.327594][ T7379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 135.327614][ T7379] ____sys_sendmsg+0xa68/0xad0 [ 135.327640][ T7379] ? __might_fault+0xaf/0x130 [ 135.327682][ T7379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 135.327714][ T7379] ? import_iovec+0x73/0xa0 [ 135.327743][ T7379] ___sys_sendmsg+0x2a5/0x360 [ 135.327767][ T7379] ? __lock_acquire+0x6b5/0x2cf0 [ 135.327794][ T7379] ? __pfx____sys_sendmsg+0x10/0x10 [ 135.327851][ T7379] ? __fget_files+0x2a/0x420 [ 135.327869][ T7379] ? __fget_files+0x3a0/0x420 [ 135.327897][ T7379] __x64_sys_sendmsg+0x1bd/0x2a0 [ 135.327924][ T7379] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 135.327957][ T7379] ? __pfx_ksys_write+0x10/0x10 [ 135.327993][ T7379] do_syscall_64+0xe2/0xf80 [ 135.328016][ T7379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.328032][ T7379] ? trace_irq_disable+0x37/0x100 [ 135.328047][ T7379] ? clear_bhb_loop+0x60/0xb0 [ 135.328068][ T7379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.328084][ T7379] RIP: 0033:0x7fdc39d9bf79 [ 135.328100][ T7379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 135.328113][ T7379] RSP: 002b:00007fdc3abb9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 135.328131][ T7379] RAX: ffffffffffffffda RBX: 00007fdc3a015fa0 RCX: 00007fdc39d9bf79 [ 135.328142][ T7379] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000b [ 135.328152][ T7379] RBP: 00007fdc3abb9090 R08: 0000000000000000 R09: 0000000000000000 [ 135.328162][ T7379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 135.328171][ T7379] R13: 00007fdc3a016038 R14: 00007fdc3a015fa0 R15: 00007fff3f263768 [ 135.328199][ T7379] [ 136.258822][ T7389] netlink: 12 bytes leftover after parsing attributes in process `syz.4.469'. [ 136.685823][ T7401] bond3: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 136.712308][ T7401] bond3 (unregistering): Released all slaves [ 137.154239][ T5828] block nbd0: Receive control failed (result -32) [ 137.223237][ T7421] netlink: 16 bytes leftover after parsing attributes in process `syz.0.479'. [ 137.379117][ T7427] syzkaller0: entered promiscuous mode [ 137.384640][ T7427] syzkaller0: entered allmulticast mode [ 137.461202][ T7430] syzkaller0: entered promiscuous mode [ 137.476238][ T7430] syzkaller0: entered allmulticast mode [ 137.486751][ T7433] netlink: 'syz.4.485': attribute type 13 has an invalid length. [ 137.610816][ T7437] lo: Caught tx_queue_len zero misconfig [ 137.684542][ T7407] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.925094][ T7427] netlink: 'syz.3.480': attribute type 1 has an invalid length. [ 137.941656][ T7449] netlink: 28 bytes leftover after parsing attributes in process `syz.4.488'. [ 137.951155][ T7449] netlink: 28 bytes leftover after parsing attributes in process `syz.4.488'. [ 137.955299][ T7448] syz_tun: entered allmulticast mode [ 137.983776][ T7449] bridge0: entered promiscuous mode [ 137.998219][ T7449] ip6gretap0: entered promiscuous mode [ 138.005102][ T7449] debugfs: 'hsr1' already exists in 'hsr' [ 138.014767][ T7449] Cannot create hsr debugfs directory [ 138.028099][ T7446] syz_tun: left allmulticast mode [ 138.046587][ T5869] [ 138.048956][ T5869] ============================================ [ 138.055121][ T5869] WARNING: possible recursive locking detected [ 138.061304][ T5869] syzkaller #0 Not tainted [ 138.065747][ T5869] -------------------------------------------- [ 138.071907][ T5869] kworker/0:4/5869 is trying to acquire lock: [ 138.077988][ T5869] ffff8880346baf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 138.087070][ T5869] [ 138.087070][ T5869] but task is already holding lock: [ 138.094452][ T5869] ffff888033850f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 138.103545][ T5869] [ 138.103545][ T5869] other info that might help us debug this: [ 138.111637][ T5869] Possible unsafe locking scenario: [ 138.111637][ T5869] [ 138.119105][ T5869] CPU0 [ 138.122410][ T5869] ---- [ 138.125714][ T5869] lock(&hsr->seqnr_lock); [ 138.130246][ T5869] lock(&hsr->seqnr_lock); [ 138.134778][ T5869] [ 138.134778][ T5869] *** DEADLOCK *** [ 138.134778][ T5869] [ 138.142942][ T5869] May be due to missing lock nesting notation [ 138.142942][ T5869] [ 138.151285][ T5869] 13 locks held by kworker/0:4/5869: [ 138.156627][ T5869] #0: ffff88802f72fd48 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 138.167402][ T5869] #1: ffffc900043cfbc0 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 138.180582][ T5869] #2: ffff8880542e2538 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xe70 [ 138.189833][ T5869] #3: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x213/0xe40 [ 138.199098][ T5869] #4: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x126/0x550 [ 138.208164][ T5869] #5: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 138.218107][ T5869] #6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 138.227248][ T5869] #7: ffff888033850f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 138.236784][ T5869] #8: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x2860 [ 138.246304][ T5869] #9: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 138.256257][ T5869] #10: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1920 [ 138.265715][ T5869] #11: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 138.275737][ T5869] #12: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 138.284986][ T5869] [ 138.284986][ T5869] stack backtrace: [ 138.290891][ T5869] CPU: 0 UID: 0 PID: 5869 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) [ 138.290911][ T5869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 138.290923][ T5869] Workqueue: mld mld_ifc_work [ 138.290946][ T5869] Call Trace: [ 138.290955][ T5869] [ 138.290962][ T5869] dump_stack_lvl+0xe8/0x150 [ 138.290984][ T5869] print_deadlock_bug+0x279/0x290 [ 138.291001][ T5869] __lock_acquire+0x253f/0x2cf0 [ 138.291028][ T5869] ? __lock_acquire+0x6b5/0x2cf0 [ 138.291055][ T5869] ? hsr_dev_xmit+0x237/0x360 [ 138.291070][ T5869] lock_acquire+0x106/0x330 [ 138.291091][ T5869] ? hsr_dev_xmit+0x237/0x360 [ 138.291111][ T5869] ? hsr_dev_xmit+0x237/0x360 [ 138.291126][ T5869] _raw_spin_lock_bh+0x36/0x50 [ 138.291146][ T5869] ? hsr_dev_xmit+0x237/0x360 [ 138.291162][ T5869] hsr_dev_xmit+0x237/0x360 [ 138.291177][ T5869] ? hsr_dev_xmit+0x2d/0x360 [ 138.291193][ T5869] dev_hard_start_xmit+0x2cd/0x7f0 [ 138.291223][ T5869] __dev_queue_xmit+0x168f/0x3850 [ 138.291251][ T5869] ? __local_bh_enable_ip+0xd0/0x130 [ 138.291266][ T5869] ? __dev_queue_xmit+0x274/0x3850 [ 138.291297][ T5869] ? ebt_do_table+0x2665/0x2830 [ 138.291323][ T5869] ? __local_bh_enable_ip+0xd0/0x130 [ 138.291337][ T5869] ? ebt_do_table+0x2665/0x2830 [ 138.291358][ T5869] ? __pfx___dev_queue_xmit+0x10/0x10 [ 138.291392][ T5869] ? br_nf_post_routing+0x219/0xfe0 [ 138.291408][ T5869] ? lock_acquire+0x106/0x330 [ 138.291434][ T5869] br_dev_queue_push_xmit+0x370/0x4a0 [ 138.291451][ T5869] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 138.291466][ T5869] NF_HOOK+0x360/0x3f0 [ 138.291482][ T5869] ? NF_HOOK+0xa2/0x3f0 [ 138.291496][ T5869] ? __pfx_NF_HOOK+0x10/0x10 [ 138.291510][ T5869] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 138.291525][ T5869] ? lock_acquire+0x106/0x330 [ 138.291551][ T5869] br_forward_finish+0xd3/0x130 [ 138.291566][ T5869] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 138.291581][ T5869] ? __pfx_br_forward_finish+0x10/0x10 [ 138.291596][ T5869] NF_HOOK+0x360/0x3f0 [ 138.291611][ T5869] ? NF_HOOK+0xa2/0x3f0 [ 138.291624][ T5869] ? __pfx_NF_HOOK+0x10/0x10 [ 138.291639][ T5869] ? __pfx_br_forward_finish+0x10/0x10 [ 138.291655][ T5869] ? __skb_clone+0x483/0x7a0 [ 138.291677][ T5869] ? br_handle_vlan+0x61/0x530 [ 138.291700][ T5869] __br_forward+0x397/0x540 [ 138.291714][ T5869] ? __pfx_br_forward_finish+0x10/0x10 [ 138.291730][ T5869] br_flood+0x6ee/0xb80 [ 138.291754][ T5869] ? br_dev_xmit+0x193/0x1920 [ 138.291774][ T5869] br_dev_xmit+0x127a/0x1920 [ 138.291793][ T5869] ? br_dev_xmit+0x193/0x1920 [ 138.291815][ T5869] ? __pfx_br_dev_xmit+0x10/0x10 [ 138.291833][ T5869] ? __skb_get_hash_net+0x13f/0x2e0 [ 138.291856][ T5869] ? __pfx___skb_get_hash_net+0x10/0x10 [ 138.291878][ T5869] ? kasan_save_track+0x4f/0x80 [ 138.291894][ T5869] ? skb_network_protocol+0x23d/0x3f0 [ 138.291918][ T5869] ? __pfx_passthru_features_check+0x10/0x10 [ 138.291949][ T5869] dev_hard_start_xmit+0x2cd/0x7f0 [ 138.291979][ T5869] __dev_queue_xmit+0x168f/0x3850 [ 138.292008][ T5869] ? __dev_queue_xmit+0x274/0x3850 [ 138.292031][ T5869] ? rcu_is_watching+0x15/0xb0 [ 138.292047][ T5869] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 138.292070][ T5869] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 138.292096][ T5869] ? __pfx___dev_queue_xmit+0x10/0x10 [ 138.292120][ T5869] ? __asan_memcpy+0x40/0x70 [ 138.292142][ T5869] ? __pskb_copy_fclone+0x9c8/0xff0 [ 138.292166][ T5869] ? __asan_memcpy+0x40/0x70 [ 138.292190][ T5869] ? __pskb_copy_fclone+0x9c8/0xff0 [ 138.292216][ T5869] ? hsr_create_tagged_frame+0x500/0xe10 [ 138.292241][ T5869] ? __asan_memmove+0x40/0x70 [ 138.292264][ T5869] ? hsr_create_tagged_frame+0x8cd/0xe10 [ 138.292290][ T5869] ? hsr_addr_subst_dest+0x30d/0xa90 [ 138.292310][ T5869] hsr_forward_skb+0x157b/0x2860 [ 138.292329][ T5869] ? ret_from_fork_asm+0x1a/0x30 [ 138.292354][ T5869] ? hsr_forward_skb+0xb3/0x2860 [ 138.292374][ T5869] ? __pfx_hsr_forward_skb+0x10/0x10 [ 138.292393][ T5869] ? do_raw_spin_lock+0x12b/0x2f0 [ 138.292411][ T5869] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 138.292431][ T5869] ? hsr_dev_xmit+0x237/0x360 [ 138.292447][ T5869] hsr_dev_xmit+0x242/0x360 [ 138.292467][ T5869] ? hsr_dev_xmit+0x2d/0x360 [ 138.292484][ T5869] dev_hard_start_xmit+0x2cd/0x7f0 [ 138.292513][ T5869] __dev_queue_xmit+0x168f/0x3850 [ 138.292543][ T5869] ? __dev_queue_xmit+0x274/0x3850 [ 138.292571][ T5869] ? __pfx___dev_queue_xmit+0x10/0x10 [ 138.292596][ T5869] ? neigh_connected_output+0x1ea/0x460 [ 138.292616][ T5869] ? eth_header+0x11b/0x200 [ 138.292637][ T5869] ? __asan_memcpy+0x40/0x70 [ 138.292660][ T5869] ? eth_header+0x11b/0x200 [ 138.292685][ T5869] ? __pfx_eth_header+0x10/0x10 [ 138.292706][ T5869] ? neigh_connected_output+0x3b6/0x460 [ 138.292729][ T5869] ? ip6_output+0x126/0x550 [ 138.292748][ T5869] ip6_output+0x340/0x550 [ 138.292770][ T5869] NF_HOOK+0xa2/0x3a0 [ 138.292790][ T5869] ? NF_HOOK+0xf9/0x3a0 [ 138.292810][ T5869] ? __pfx_NF_HOOK+0x10/0x10 [ 138.292831][ T5869] ? __pfx_dst_output+0x10/0x10 [ 138.292851][ T5869] ? lockdep_hardirqs_on+0x7a/0x110 [ 138.292873][ T5869] ? __local_bh_enable_ip+0xd0/0x130 [ 138.292887][ T5869] ? icmp6_dst_alloc+0x3a6/0x440 [ 138.292909][ T5869] mld_sendpack+0x8b4/0xe40 [ 138.292936][ T5869] ? mld_sendpack+0x213/0xe40 [ 138.292956][ T5869] ? __pfx_mld_sendpack+0x10/0x10 [ 138.292984][ T5869] mld_ifc_work+0x835/0xe70 [ 138.293006][ T5869] ? process_scheduled_works+0xa0f/0x17a0 [ 138.293030][ T5869] process_scheduled_works+0xaec/0x17a0 [ 138.293070][ T5869] ? __pfx_process_scheduled_works+0x10/0x10 [ 138.293092][ T5869] ? do_raw_spin_lock+0x12b/0x2f0 [ 138.293111][ T5869] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 138.293128][ T5869] ? schedule+0x90/0x360 [ 138.293151][ T5869] worker_thread+0xda6/0x1360 [ 138.293182][ T5869] ? __kthread_parkme+0x19c/0x1f0 [ 138.293199][ T5869] kthread+0x726/0x8b0 [ 138.293218][ T5869] ? __pfx_worker_thread+0x10/0x10 [ 138.293241][ T5869] ? __pfx_kthread+0x10/0x10 [ 138.293260][ T5869] ? _raw_spin_unlock_irq+0x23/0x50 [ 138.293286][ T5869] ? __pfx_kthread+0x10/0x10 [ 138.293303][ T5869] ret_from_fork+0x51b/0xa40 [ 138.293319][ T5869] ? __pfx_ret_from_fork+0x10/0x10 [ 138.293343][ T5869] ? __switch_to+0xc82/0x1410 [ 138.293367][ T5869] ? __pfx_kthread+0x10/0x10 [ 138.293384][ T5869] ret_from_fork_asm+0x1a/0x30 [ 138.293425][ T5869] [ 138.898778][ T60] net_ratelimit: 24 callbacks suppressed [ 138.898797][ T60] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.016074][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.126064][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.236036][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.347283][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.456579][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.566110][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.676104][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.786091][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 139.896398][ T12] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 141.067834][ T7451] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 141.097218][ T36] dummy0: left promiscuous mode [ 143.976057][ T13] net_ratelimit: 36 callbacks suppressed [ 143.976072][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.096366][ T13] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.206054][ T12] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.316084][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.426098][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.536100][ T60] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.646086][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.756130][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.866065][ T36] bond0: (slave ip6gretap1): failed to get link speed/duplex [ 144.976096][ T50] bond0: (slave ip6gretap1): failed to get link speed/duplex