last executing test programs: 6.102334049s ago: executing program 2 (id=13995): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a6ddf0000000000000000070000000900010073797a33000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a0500000000080005400000000d08000640ffffff400800034000000038"], 0xdc}}, 0x0) socket$kcm(0xa, 0x2, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000005e00010200"/19, @ANYRES32=0x0, @ANYBLOB="0200f7"], 0x1c}}, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, 0x0, 0x0) bind$bt_hci(r3, &(0x7f0000000140)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f00000000c0)="510003000000", 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x1, 0x0, 0x4, 0x2, 0x1, 0x78}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x94) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f00000a2000)={0x1, &(0x7f0000f07000)=[{0x6}]}, 0x10) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newlink={0x48, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x8}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IFLAGS={0x6}, @IFLA_GRE_IKEY={0x8}]}}}]}, 0x48}}, 0x0) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r5) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100ffffffff00000000010000000800010003000000340004800500030001000000050003000000000005000300000000000500030080000000050003000000000005001300010000000800020002"], 0x58}}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000002000000000000000000000202000000000000000000000a03000000000000000000000a"], 0x0, 0x3e}, 0x20) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006c617374000000000400028008000340000001", @ANYRES16=r10], 0xe4}}, 0x50800) 5.823316836s ago: executing program 2 (id=14000): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r0 = socket$packet(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000500766555a70cd209000cc0028008000a00", @ANYRES32=r3, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r3}, @IFLA_ADDRESS={0xa}]}, 0x48}}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, 0x0, 0x0) unshare(0x6a040000) r5 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r5, 0x40106183, &(0x7f0000000000)) 4.419535883s ago: executing program 0 (id=14013): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x24, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x401}]}, 0x24}, 0x1, 0x0, 0x0, 0x404c041}, 0x40000) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r7 = socket(0x1, 0x803, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r3) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f00000006c0)={0x17c, r8, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xf7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_MEDIA={0x110, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x83}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf77}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fe4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xefb2}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5199}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x22}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x404c840}, 0x20000080) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x403, 0x78bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d40)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="2c00000010008100000000000080000000000000", @ANYRES32=0x0, @ANYBLOB="0a043cbf", @ANYRES32, @ANYBLOB="0a001b"], 0x2c}], 0x1}, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000200), r1) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x24, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_SEND_SEQ={0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x401}]}, 0x24}, 0x1, 0x0, 0x0, 0x404c041}, 0x40000) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x2) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) (async) socket(0x1, 0x803, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000480), r3) (async) sendmsg$TIPC_NL_MEDIA_SET(r7, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f00000006c0)={0x17c, r8, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xf7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_MEDIA={0x110, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x83}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf77}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fe4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xefb2}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5199}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x22}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffff}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x404c840}, 0x20000080) (async) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x403, 0x78bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r9}]}, 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) (async) 4.178467419s ago: executing program 3 (id=14016): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) unshare(0x6a040000) r1 = socket(0x8, 0x3, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, &(0x7f0000000040)) ioctl$IMGETCOUNT(r1, 0x618e, 0x0) unshare(0x600) unshare(0x24000480) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x528, 0x0, 0x3b8, 0x0, 0x230, 0x230, 0x490, 0x490, 0x490, 0x490, 0x490, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x1, 'unconfined\x00'}}}, {{@ip={@private=0xa010100, @broadcast, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x20, 0x2}}}, {{@uncond, 0x0, 0x90, 0xb8, 0x0, {}, [@common=@socket0={{0x20}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local, 0x4, 0x8, [0x3b, 0x21, 0x20, 0x15, 0xf, 0x31, 0x39, 0x25, 0x17, 0x16, 0x14, 0x29, 0x15, 0x7, 0x1b, 0x2f], 0x0, 0x1, 0x6}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'dummy0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x0, 0x4c}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x2, 0x0, 0x2, 0x3, 0x3, 0x3]}}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x0, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x588) sendmsg$NL80211_CMD_REGISTER_FRAME(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd25, 0x25dfdbf7, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6}, @NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000850}, 0x20008040) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socketpair(0x28, 0xa, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r8, &(0x7f0000000000), &(0x7f0000000080)=@tcp6=r10, 0x2}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r9, r6, 0x25, 0x0, @val=@tcx={@void, @value=r9}}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r8, &(0x7f00000001c0), &(0x7f0000000040)=@tcp=r5}, 0x20) syz_emit_ethernet(0x2dc2d, &(0x7f0000000300)=ANY=[], 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x20, r4, 0x1, 0x70bd2d, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_TX_RATES={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4000040) 3.855495784s ago: executing program 0 (id=14019): r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10, 0x0) close(r0) socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000305000000000000000000cf0000", @ANYRES32=0x0, @ANYBLOB="03000000000000002000128008000100677265"], 0x48}, 0x1, 0x0, 0x0, 0x24040000}, 0x2000800) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) 3.201132573s ago: executing program 0 (id=14024): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket(0x8, 0x0, 0x8000) ioctl$sock_netrom_SIOCADDRT(r0, 0x61d1, 0x0) r1 = socket(0x1e, 0x4, 0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000040), r0) sendmsg$SEG6_CMD_SET_TUNSRC(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r2, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x1ff]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x3}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, 0x0, 0x0) r3 = socket(0x22, 0xa, 0x2) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) close(0x4) 3.063844917s ago: executing program 3 (id=14025): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) close(0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000340)={'syztnl1\x00', 0x0, 0x7800, 0x40, 0x9, 0x6, {{0x9, 0x4, 0x0, 0xa, 0x24, 0x65, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010100, @loopback, {[@lsrr={0x83, 0x7, 0xce, [@dev={0xac, 0x14, 0x14, 0x11}]}, @generic={0x6ba77cfb30895758, 0x2}, @ra={0x94, 0x4, 0x1}]}}}}}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000680)=@o_path={0x0}, 0x18) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, 0x0, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)=ANY=[], 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000b40)={0xffffffffffffffff, 0x20, &(0x7f0000000b00)={&(0x7f0000000a80)=""/51, 0x33, 0x0, &(0x7f0000000ac0)=""/50, 0x32}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_lsm={0x1d, 0xf, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, [@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2d}}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0xa, 0x1, 0x0, r2}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000a40)={0x3, 0xf, 0x7, 0x7}, 0x10, r3, 0x0, 0x1, 0x0, &(0x7f0000000b80)=[{0x1, 0x2, 0xa, 0xc}], 0x10, 0x4}, 0x94) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x11) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x0, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000a410000000100000038000180060001000200000008000500000000000c000700000000000000000008000900000000000800080000000000080006"], 0x4c}}, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000000c0)=""/24, &(0x7f0000000100)=0x18) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1802000002000000000000000a0000808500000041000000850000005000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0xd, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d28", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000a00)="f7b3196fb4b382d9983491ae6686", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) syz_emit_ethernet(0x46, &(0x7f00000000c0)=ANY=[@ANYBLOB="0380c20000000180c20000000800450000380066000000f4019078ac1e0001ac1414aa0500907831c802282500000000000000002f00007f004001ac1e0001380022ebe46a25"], 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0xd}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) 2.618892868s ago: executing program 3 (id=14028): r0 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x28, r2, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x28}}, 0x4000000) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r0, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) 2.37903192s ago: executing program 1 (id=14032): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x4) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfb, 0x8}, 0xc) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES16=r1, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r1], 0x68}}, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x1ff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000380)={r0, &(0x7f0000000200)='syzkaller\x00', 0x80, &(0x7f00000002c0)={@align=0x52, {0xbfb, 0x3, 0x1, 0x631e}}, 0x2c97538f, &(0x7f0000000300), &(0x7f0000000340)=0x101}) openat$cgroup_freezer_state(r3, &(0x7f00000003c0), 0x2, 0x0) socket(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x12, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, @jmp={0x5, 0x1, 0x4, 0x0, 0x9, 0xfffffffffffffff8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c80)=ANY=[@ANYBLOB="240000002e00090027bd7000fedbdf250400000010001a8004000480080001"], 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x84) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r7) sendmsg$IEEE802154_LLSEC_SETPARAMS(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000003c0)={0x14, r8, 0x5, 0x0, 0x0, {0x22}}, 0x14}}, 0x4000000) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r5) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$unix(0x1, 0x2, 0x0) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x54, r12, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r13}, @val={0xc, 0x99, {0x10000, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'dvmrp1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x54}, 0x1, 0x0, 0x0, 0x91}, 0x24044804) sendmsg$NL80211_CMD_SET_MAC_ACL(r5, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000580)={0x160, r9, 0x10, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r13}, @val={0xc, 0x99, {0x6742d3b0, 0x7c}}}}, [@NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_MAC_ADDRS={0x28, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}]}, @NL80211_ATTR_ACL_POLICY={0x8}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_ACL_POLICY={0x8, 0xa5, 0x1}, @NL80211_ATTR_MAC_ADDRS={0x70, 0xa6, 0x0, 0x1, [{0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @broadcast}, {0xa}, {0xa}, {0xa}, {0xa}, {0xa}]}, @NL80211_ATTR_MAC_ADDRS={0x70, 0xa6, 0x0, 0x1, [{0xa}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa, 0x6, @broadcast}, {0xa, 0x6, @device_b}, {0xa, 0x6, @device_b}, {0xa}, {0xa, 0x6, @broadcast}]}]}, 0x160}, 0x1, 0x0, 0x0, 0x4000}, 0x20048014) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r7) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="40000000100001040500"/20, @ANYRES32=0x0, @ANYBLOB="000300000000000014003500766574683100000000000000000000000c002b8008000300b24083bb"], 0x40}}, 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r14, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000004500090000000000000100f102000000080002"], 0x1c}}, 0x0) 2.36827127s ago: executing program 3 (id=14033): unshare(0x62000000) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0x17}, 0x1e, r1}) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000000)={{r2, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000280)='%+9llu \x00'}, 0x7f) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x67) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x368, 0x10, 0x581, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x4d014}, [@IFLA_NET_NS_PID={0x8}, @IFLA_PROTO_DOWN={0x5, 0x27, 0x2}, @IFLA_NET_NS_FD={0x8}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bridge_slave_1\x00'}, @IFLA_VFINFO_LIST={0x1ac, 0x16, 0x0, 0x1, [{0x4}, {0x58, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0x33bc, 0x2}}, @IFLA_VF_IB_NODE_GUID={0x14, 0xa, {0x0, 0x8000}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x4, 0x46}}, @IFLA_VF_RATE={0x10, 0x6, {0xffffffff, 0x6, 0x51}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x7, 0x100}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x400, 0x100}}]}, {0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x3, {0x80, 0x3}}]}, {0x68, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x0, @remote}}, @IFLA_VF_RATE={0x10, 0x6, {0x9, 0x3, 0x4}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x8, 0xa}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0xe8, 0x2ab0}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0xf, 0x7fffffff}}]}, {0xd4, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x0, 0x81}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xc, 0x1}}, @IFLA_VF_VLAN_LIST={0x68, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x0, 0xb15, 0x7, 0x8100}}, {0x14, 0x1, {0xdd2, 0x338, 0x8, 0x88a8}}, {0x14, 0x1, {0x0, 0xf6d, 0x6, 0x8100}}, {0x14, 0x1, {0x4, 0x36b, 0x7, 0x8100}}, {0x14, 0x1, {0x6, 0xe04, 0x32, 0x8100}}]}, @IFLA_VF_TX_RATE={0xc, 0x3, {0xdd2, 0x5}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x1}}, @IFLA_VF_VLAN_LIST={0x18, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x6, 0x93b, 0x3, 0x8100}}]}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x8}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x9, 0x1}}]}]}, @IFLA_TXQLEN={0x8, 0xd, 0x3}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x6e36}, @IFLA_GSO_MAX_SIZE={0xffffffffffffff2c, 0x29, 0x3645d}, @IFLA_VFINFO_LIST={0x158, 0x16, 0x0, 0x1, [{0x90, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0xc5, 0x7}}, @IFLA_VF_TRUST={0xc, 0x9, {0x200, 0xffffff01}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x8, 0x8}}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x100, 0x8}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x2, 0x3}}, @IFLA_VF_VLAN={0x10, 0x2, {0x1, 0xc5a, 0x2}}, @IFLA_VF_TRUST={0xc, 0x9, {0x8e9, 0x6}}, @IFLA_VF_RATE={0x10, 0x6, {0x7, 0x2, 0x9}}, @IFLA_VF_RATE={0x10, 0x6, {0x9, 0x3ea000, 0xb}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x8, 0x1}}]}, {0xc4, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x6, 0x521, 0x1000}}, @IFLA_VF_RATE={0x10, 0x6, {0x6, 0x905c, 0x7}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0x4c7, 0x6d22}}, @IFLA_VF_SPOOFCHK={0xc, 0x4, {0x6, 0x3ff}}, @IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x0, 0x2}}, @IFLA_VF_VLAN_LIST={0x54, 0xc, 0x0, 0x1, [{0x14, 0x1, {0x7, 0xac2, 0x4fe, 0x8100}}, {0x14, 0x1, {0x5e067207, 0xed, 0x401, 0x88a8}}, {0x14, 0x1, {0x5, 0xbae, 0x1, 0x8100}}, {0x14, 0x1, {0xfffffffe, 0xd7a, 0x56, 0x8100}}]}, @IFLA_VF_TRUST={0xc, 0x9, {0x4, 0xb33}}, @IFLA_VF_TX_RATE={0xc, 0x3, {0x8, 0x7}}, @IFLA_VF_RATE={0x10, 0x6, {0x0, 0x0, 0x100}}]}]}]}, 0x368}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000040)={0x36, &(0x7f00000000c0)=[{0x7}, {0x3, 0x5, 0x2c, 0x4}, {0xfac3, 0x2, 0x4, 0x2}, {0x77cf, 0x7f, 0x1, 0x80000001}, {0x7, 0x11, 0xcf, 0x7}]}) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r6, &(0x7f0000000040)=ANY=[], 0x6) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r3, r2}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x16, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000341218007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r7, 0x0, 0xe, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e839e8971", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000580)) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000500)={{r0, &(0x7f0000000040)='{\x00', 0x2881, &(0x7f0000000080)={@_ha_fsid={[0x2, 0x7]}, {0x4, 0xfff, 0x800, 0x2}}, 0x35, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x6}, 0x3, &(0x7f0000000480)=[{0x2, 0x3, &(0x7f0000000180)='\x00', &(0x7f00000001c0)="1791c9d2249faa6bfa78cb7816433ceb83ff39bb2cf6b3f04b46b88f7fbe3c0f0359e39e183a71c3a73bc8c0bd00d1a3f937dfea6e919e67f244e2dd9f2f8a10cf974348a772302a160c11f14a8a353c14906afbc63ba1bcacb1f7b49229b5e2ca073a55a7fb88513eb910b1a3c5de84e6778eb3715825a77f83ed7de094c4c73f58ac3f2ceb269fad670b69f9b6b24d397f0eb6767e9f94e02f7d934a21010879c43c8a6f60fa2c7c4ed9", 0xab, 0x10}, {0x3, 0xba, &(0x7f0000000280)='/]\x00', &(0x7f00000002c0)="f4eb890ae5625aecc7b62803df45486ae0946e1d6f84814b265507cb365979f725ad46561a6278e9d90ff48c11300ded8fe9cbe59c9d53a6db4c17b94b2ea5f68a0bdd49f107f38089766c1a9da6ddf87859028ca93df233263c2fad6e7088c5bf9726108fc5e8924dcd6fa60b527f142d52446e8b7c9cf73d60a34d14cee3deb2cc02356f70698660400c2e270fa374e8c78f05a75f73dec4815fc4fa06e9c50b960780ec874ff9b41420114109887d54704a00cc1f6eb78ee46ecfed7130235d8bf25478142b623708ff95ef7d21f9f218fe607a62d6427f1a415c1f97c11761690eab2c41d4c702103e2bb97854e467ffb7", 0xf3, 0x8}, {0x3, 0xffffffff, &(0x7f00000005c0)='sit0\x00', &(0x7f0000000400)="1a1e32d80764ef55590ed78f1923b986427b39be8c26d8979d9cf6deda0af0303ec7d5c8bb380f6b4851a1d42dc8ef6fe49b142cc2ec800b5c64e22b2aa87220748bf3d0", 0x44, 0x12}]}) 1.870555375s ago: executing program 1 (id=14035): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'caif0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c}}]}, 0x4c}}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=0x0, @ANYRESHEX=r0, @ANYRES16=r3, @ANYRES32=r0, @ANYRESHEX=r0, @ANYRES64=0x0], 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a000000080000000200000fffffffff0e000000000000000300001007000000030000ca75ffffff00000000000000002e"], &(0x7f0000000040)=""/249, 0x46, 0xf9, 0x9}, 0x20) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001000000400000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="8b04040049229da42448268009000169626f6e000300000005000100030000007ff727be9ab344117211dc52ade879299e195ea4f2849829d68535194ca7d6bed5095e60c27a4ba5559ae620912b6c98131fe57004943d3a7ffdaaa6f9d508c9898f1e5883e15f5bc50469ba345b9771b9c971d750c97153f39196ce65e9713db079c37d017c52a11367363d56b5b40cd53604b384dbf63b29dbffc666ba9b60be1e3ada15b94c2935ae73f89e"], 0x44}}, 0x0) 1.671665646s ago: executing program 4 (id=14036): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x8000010}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0x53}, @printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000000)='syzkaller\x00', 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r1, &(0x7f0000003880)={&(0x7f0000000e00)={0x2, 0x4e24, @broadcast}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8080}, 0x4000040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="662700000000000024001280090001007866726d0000000014000280040003"], 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$XFS_IOC_SCRUB_METADATA(r1, 0xc040583c, &(0x7f00000001c0)={0x17, 0x18a, 0x0, 0x8, 0x3}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.604047833s ago: executing program 1 (id=14037): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r2, {0xfffd, 0x10}, {0x8, 0x4}, {0x6, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x8804) r3 = socket(0x1, 0x1, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$xdp(r3, &(0x7f0000000000)={0x2c, 0x2, r2, 0xe}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x2c638}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x40a}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008086}, 0x0) 1.561866738s ago: executing program 2 (id=14038): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000380)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000880)={0x24, r1, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x2c, 0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4010084) 1.395272779s ago: executing program 3 (id=14039): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) close(0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000340)={'syztnl1\x00', 0x0, 0x7800, 0x40, 0x9, 0x6, {{0x9, 0x4, 0x0, 0xa, 0x24, 0x65, 0x0, 0x8, 0x2f, 0x0, @rand_addr=0x64010100, @loopback, {[@lsrr={0x83, 0x7, 0xce, [@dev={0xac, 0x14, 0x14, 0x11}]}, @generic={0x6ba77cfb30895758, 0x2}, @ra={0x94, 0x4, 0x1}]}}}}}) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000680)=@o_path={0x0}, 0x18) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, 0x0, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)=ANY=[], 0x50) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000b40)={0xffffffffffffffff, 0x20, &(0x7f0000000b00)={&(0x7f0000000a80)=""/51, 0x33, 0x0, &(0x7f0000000ac0)=""/50, 0x32}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000bc0)=@bpf_lsm={0x1d, 0xf, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, [@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2d}}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffa}, @map_fd={0x18, 0xa, 0x1, 0x0, r2}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x7, 0x1}, 0x8, 0x10, &(0x7f0000000a40)={0x3, 0xf, 0x7, 0x7}, 0x10, r3, 0x0, 0x1, 0x0, &(0x7f0000000b80)=[{0x1, 0x2, 0xa, 0xc}], 0x10, 0x4}, 0x94) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x11) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x0, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000a410000000100000038000180060001000200000008000500000000000c000700000000000000000008000900000000000800080000000000080006"], 0x4c}}, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000000c0)=""/24, &(0x7f0000000100)=0x18) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1802000002000000000000000a0000808500000041000000850000005000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0xd, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d28", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r7, 0x0, 0xe, 0x0, &(0x7f0000000a00)="f7b3196fb4b382d9983491ae6686", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) syz_emit_ethernet(0x46, &(0x7f00000000c0)=ANY=[@ANYBLOB="0380c20000000180c20000000800450000380066000000f4019078ac1e0001ac1414aa0500907831c802282500000000000000002f00007f004001ac1e0001380022ebe46a25"], 0x0) sendmsg$nl_route(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0xd}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) 1.303602716s ago: executing program 4 (id=14040): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="b8000000190001000000000000000000e0000002000000005e7d88db000000000000000000000000000000000000000180000000000000000a000000870000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000300000000000000000080000000000000000000000000000100000000000040fbffffffffffffff00000000000000000100000000000000020000000000000000000000000000000008"], 0xb8}}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x4004) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x2000000, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) 1.234161036s ago: executing program 4 (id=14041): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c0000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0005000082180000140012800b00010062726964676500000400028008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x2, 0x803, 0xb) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0118000000000000aaffc637809ac22ddb00000f0000000f00ed12bb34c6"], 0x0, 0x2a, 0x0, 0x0, 0x7ff}, 0x28) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001e00010027bd7000fcdbdf250a000000", @ANYRES32=r9, @ANYBLOB="000008001400"], 0x30}}, 0x20000000) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r8], 0x5c}}, 0x40) 1.192759271s ago: executing program 1 (id=14042): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000040850000002f000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000c53d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328562b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaeaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509afd15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4df92cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2571f67a7c7819b0889d7614ab5e25b468ab3102cab53f312f2e29075891bd21c2301f338b8a961a01fb282fd4e53d8c0a2ebb71ceaf7e3b34e4502b5fad975855ce0e4d4c163519fabd209c3d4302f46c90a19d8a0a03396e8949a91184e8d680f724d65700b9a18d28e22810be9fb37ce6cac86c45a03165c1af3152a3c21dc927f0697343abf80e3aae6149b14d08f188e61f900bbb0eae54b0566ad8489918ddc866871e06a5f50cf35b551f7b4c7ae0300838056a65d2e0058c9d8bf1c99d40fb3e2ecdbd68b5f79003c04266a43b8794a5d90b2348f4e81ed1d00000000000000000000e321e9aa37fc5cbee1f627e86e2f58a24ccd9c0376772b2bd5e99ab9d86b753de57a5f40714d11282d809bf6bf5f7009ff38db199273d029f5b65b573722b8131f473775031a7889a2e6b6e804b26429c839373dffd00347a65a2e8ca7d387857dddcea793ce7a08e92648dd663d25d5374ddf20e98e824b269a199210b7064fb6cda054ccef091d11"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) 1.139039462s ago: executing program 2 (id=14043): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)={0x4c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x0) (async, rerun: 32) socket$kcm(0x2c, 0x3, 0x0) (rerun: 32) socket$xdp(0x2c, 0x3, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r1, &(0x7f0000019440)=[{&(0x7f0000000340)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed090f0000600000f3a1bc5603ca00000f7f89e3ff296aa1f6475322f000200000004a2471083ec6991778581acb6c0101ff00", 0x48}], 0x1) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000003580)={0x2, 0x0, @dev}, 0x10) (async) r3 = socket$kcm(0xa, 0x1, 0x106) socket(0xf, 0x5, 0x3) (async) sendmsg$kcm(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) (async) sendmsg$kcm(r3, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0xfffe, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x80, 0x0}, 0xe07e872420dfefca) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000001e0001000000000000000000020000000100000000000000080001000000000008000f"], 0x2c}, 0x1, 0x0, 0x0, 0x2}, 0x0) (async) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x20, 0x24, 0x107, 0x70bd2e, 0x25dfdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) (async) r6 = socket$kcm(0xa, 0x3, 0x73) sendmsg$kcm(r6, &(0x7f0000000100)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xe0000000, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xffffffff, 0x1000000}, 0x80, 0x0, 0x0, &(0x7f0000000540)=ANY=[], 0xa}, 0x0) 981.663003ms ago: executing program 1 (id=14044): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x7, 0x7}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2, 0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x66, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0xffff, 0xe}, {0x3, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004850) r11 = epoll_create1(0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000010003b15326a00"/20, @ANYRES32=0x0, @ANYBLOB="00000000008000002c0012800b00010062726964676500001c0002800c002100ffffffffffffffff0c0022000104080000000000"], 0x4c}}, 0x80) r13 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r13, 0x0, 0x48f, &(0x7f0000000b40)={0x84, @empty, 0x4e22, 0x0, 'wrr\x00', 0x12, 0x6, 0x51}, 0x2c) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r1, &(0x7f0000000000)={0x2}) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a74000000060a0b0400000000000000000200000048000480440001800a0001006d6174636800000034000280180003000f140000a7906e8f58c2052fade1bc2c62cdeb7508000240000000000d00010064657667726f7570000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x18}, 0xc) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x6, 0xff, 0x42}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000080), 0x619, r14}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300), 0x4) 931.971079ms ago: executing program 2 (id=14045): r0 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000000c0)={0x2, [0x0, 0x0]}, &(0x7f0000000100)=0xc) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x66960000) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r2, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r1], 0x68}}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCGIDLE32(r3, 0x8008743f, &(0x7f0000000000)) 800.619585ms ago: executing program 3 (id=14046): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket(0x2b, 0x1, 0x0) listen(r1, 0x0) accept4$nfc_llcp(r1, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x86c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x5, 0x4, 0x9, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000002d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x30, 0x9, 0x6, 0xfffff02c}]}) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xfffffffffffffde3) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000000206030000000000000000000000000014000780080012400020000005001500ff0000000500010006000000050005000200000005000400000000000900020073797a310000000011000300686173683a69702c706f7274"], 0x60}}, 0x0) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socketpair(0x6, 0x1, 0x6, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003a80)=ANY=[@ANYBLOB="883800003f000701fe57ffff02000000027c00000400f6000c0001"], 0x3888}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r9) r11 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r11, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 755.75289ms ago: executing program 0 (id=14047): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000540), 0xffffffffffffffff) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff0300000000000000000000850000001100000085000000a000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000300)="e02742e8680d85ff978276fcf294", 0x0, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x20004010}, 0x8000000) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0xfffc, @local}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r5, &(0x7f00000004c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x2c, 0x4, 0x8, 0x301, 0x0, 0x0, {0x8, 0x0, 0xa}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88ca}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x22f0}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005000100040000000600180000100000060019"], 0x4c}}, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0xffff, @multicast2}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="430325bd7000fcffffff0c00000008000300", @ANYRES32=r9, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000044}, 0x0) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) syz_emit_ethernet(0x80, &(0x7f0000000200)={@multicast, @remote, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00', 0x4a, 0x2f, 0x0, @remote, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x22eb}, {0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x800, [0x5cc6, 0x4, 0x9]}, {}, {0x8, 0x88be, 0x1, {{0x0, 0x1, 0x7}, 0x1, {0x3}}}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0xfffffffe, 0x3}}}}}}}}}, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x100000011, @multicast2, 0x0, 0x0, 'nq\x00', 0x3f, 0x84, 0x43}, 0x2c) syz_emit_ethernet(0x11, &(0x7f0000000200)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@llc={0x4, {@llc={0x42, 0xfe, "87"}}}}}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r11, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r10}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r12}, &(0x7f0000000240), &(0x7f0000000280)=r10}, 0x20) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$IPVS_CMD_FLUSH(r13, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x7c, r14, 0x1, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x32, 0x12}}, @IPVS_SVC_ATTR_FWMARK={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfc}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0xc006}, 0x0) 389.978362ms ago: executing program 4 (id=14048): r0 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r0, 0x40106183, &(0x7f0000000000)) 364.922112ms ago: executing program 0 (id=14049): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x403, 0x70bc25, 0x0, {0x0, 0x0, 0x0, 0x0, 0xe068, 0x20}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x9}, @IFLA_GRE_IFLAGS={0x6, 0x2, 0x1ff}]}}}]}, 0x44}, 0x1, 0x2000000000000000}, 0x4080) 183.893766ms ago: executing program 2 (id=14050): socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x1, 0x1, 0x0, 0x9, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb6b, 0x800c1, 0x4, 0x1, 0x1, 0x9, 0x4, 0x1000, 0xc, 0x3, 0x3, 0x80000001, 0xfffffffa, 0x0, 0x1, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0x63c, 0xe, 0x6, 0x100, 0x6, 0x1bfe, 0xb, 0x40, 0x40, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x5, 0x1, 0x7f, 0x1, 0xa, 0x7, 0xf, 0x101, 0xa, 0x1fa0860a, 0x1, 0xa9, 0x81, 0x2, 0x180000, 0x4003, 0x28b, 0x5, 0x2af, 0x3, 0x5, 0x3, 0x1, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10000, 0x0, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0xfffffffe, 0x84, 0x100, 0x5, 0x252, 0x3, 0xb, 0x2, 0x20006, 0xc50, 0xc8, 0xb, 0x2, 0xd9a, 0xc8, 0x2a2, 0x1, 0x3, 0x2, 0x1, 0x8, 0x0, 0x4, 0x6, 0x0, 0x0, 0x1, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x5, 0x1fc, 0x1ff, 0xffffffff]}}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r1, @ANYBLOB="21042abd7000fedbdf251a00000007002100626200000500920001000000f80022"], 0x11c}, 0x1, 0x0, 0x0, 0x4088}, 0x44840) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b400000000000000691058000000000004000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000001c0)=r2}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r2}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, [@func={0x85, 0x0, 0x1, 0x0, 0x3}, @map_fd={0x18, 0x1, 0x1, 0x0, r3}, @exit={0x95, 0x0, 0x7b00}, @call={0x85, 0x0, 0x0, 0x13}]}, &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x41000}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="3000000040000701fefeffff00000000017c0000040042801400018006000600800a000008000100b231032c6ebd5d92dde843a2d1193e612ef2b7950b3bbe66b465952b7eb11d4fcacf78d3d8fd3b34d888c7dfe582be2d78", @ANYRES32=0x0, @ANYBLOB="04000280"], 0x30}}, 0x8010) 123.258363ms ago: executing program 0 (id=14051): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYRESHEX], &(0x7f0000000400)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$SIOCNRDECOBS(r0, 0x89e2) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)="0000000000000002", 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRESOCT=0x0, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000002000000000000000000009f1000000000000000"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001300)={{r2, 0xffffffffffffffff}, &(0x7f0000000400), &(0x7f00000003c0)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000900)={r3}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, &(0x7f00000000c0)={0xf, 0x7, 0x9, 0x7}, 0x10) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x50) close(r5) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r6}, &(0x7f0000000500), 0x0}, 0x20) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r7, 0xffffffffffffffff}, 0x4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x17, 0x18, &(0x7f0000000c80)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207021000000000020000000bf8a00000000000007010000f8ffffffb702000008000000b703000000000000850000002d0000002194a6a23eb6e5bd2ba751a1cdb7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000ce087b2cc65c913df0d6ea3f737b292a7aff5d761def0f6c6b579f69330c993aa1cbd497feae0e15acdd0f02360385f68af29b4ee997851a40be652b20d8066addb607000000ac77421e9d4580f784c96936df892c73139b8f009393101a0579f5a376af78225392e49ff9ad7983fc5ecdd023e8390d854877ba5146dad81f91d6edfb5e8424c9c8071655460dd10f9e0ea8c44ddedd", @ANYRES32=r8, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r9}, 0xc) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000004bc0)={&(0x7f0000004a80)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000004b80)={0x0}, 0x1, 0x0, 0x0, 0x8001}, 0x4008001) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$sock_linger(r10, 0x1, 0xd, &(0x7f00000000c0)={0xfffffffb}, 0x9) shutdown(r10, 0x1) socket$inet_sctp(0x2, 0x1, 0x84) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00'}) 122.848125ms ago: executing program 4 (id=14052): socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000d80)=ANY=[@ANYRES8=r0], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000020000000c000000001466bfdac3c37dd5273545b9193c412d42832b1bc897a82f6f0b95c99bcf82e5ef1a49736b94ceead334e440a96111d5713c3408ca3de393208cc5dfb2d637ec39407436c4494f0d2075a5625827d853a8b3f9d5fd4c6324518c9f9d93b9ced5500aeb511a2247"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0), 0xc) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000008240)=[{{&(0x7f0000001200)={0xa, 0x4e21, 0x4, @private2, 0x6}, 0x1c, &(0x7f0000002600)=[{&(0x7f0000001240)="bdb8", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000003c00)=[{0x0}, {0xfffffffffffffffc}], 0x2}}], 0x2, 0xc0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x2, 0x3, 0x0, 0xad7}, 0x14) syz_emit_ethernet(0x4a, &(0x7f0000000980)=ANY=[@ANYBLOB="aaaaaaaaaaaa0380c200000108004a00003c00000000d798c2c400069078ac141410ac1e0001440f0ae0000002ac1414bbe000000189030000008ad5da8a5eb44b954cac340570594ce522ba7f3b944bb8dd4aa78aa2afeccb49ebd89c0f66e6b5b6ccba6ef0b7c53fdc050b2923af2c8e27d2790f5dbaeea051c6828d1342d68ce900639c05dbac874a7ee1d76efdd7aa2effd0dc33930ff2edcd2881d57b1b83549e7a0a64e05263af5737e2cbab32014d2abaef37f24d0fb5c40fb5cb7bacaa707172a8c53129d15be439628472547826674cf0e691d33dfb062eef2e56fa06645ce4569b47922c87230bb47a70220a2c59b85071247662", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000008090780000"], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="2000000040000701feffffff00000000017c000004004280040001800400028016a31fdf7ce10161d410ff422b8e2fbb5087050c7166e190fcfe13dbf82a57a82fefc92afd799452a689e3a5505df1e8cf0c701ad72839279467c82e3fe76ffc80600202809d4dcd4cc067db037194463cde68290cc1221d89661e517136f46f8a5ac4d4f3c149b0088309c4099b3eff05da02de13577133898fe1184f05568ab34992"], 0x20}}, 0xc000) sendmsg(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000640)="3013f93f6a23826aeaa571d88a1fc628ec108a5ce411744d4e3ae79c53", 0x1d}, {&(0x7f00000006c0)="ac5bf07dfbe37df362733fa6e33fcfe007a76905029bf5f167a7418ebe47895ee8a38f7c4ae25d6ae91633bc0b", 0x2d}], 0x2, &(0x7f0000003240)=ANY=[], 0xe10}, 0x40000) r2 = socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000048000000060a010400000000000000000100000008000b4000000000200004801c0001800b00010065789368647200000c00028008000640000000000900010073797a3000000000140000001100010000000000000000000700000a"], 0xbc}}, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000080)={@in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x19}}}, 0x0, 0x0, 0x1d, 0x0, "15858ce35aa69efed67e06703676e3ce5a269a8951e86ca918b4e3b27ceaf9b3907c9cb29ca442f7c3a6061331e7b69c4d16e3b8b8294997832c8bae8cf9b1ca0c9d11b9d8ff5d2c17716aef3a2dd561"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f00000002c0)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x1c, 0x0, "246575a4000000004fb62fe6bce0eef5607264c7f28557a8046964d292934c2a2bb1dcc5a80c0107040000000000001e0000009000000000000800"}, 0xf0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) socket$l2tp6(0xa, 0x2, 0x73) 35.10427ms ago: executing program 1 (id=14053): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, &(0x7f00000000c0)={0x2, 0x4e23, @private=0xa010100}, 0x10) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x10042) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r1, 0x58, &(0x7f0000000340)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r11}, 0xc) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x3f8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x228, 0x250, 0x0, {}, [@common=@ipv6header={{0x28}, {0x1a, 0x1, 0x1}}, @common=@inet=@policy={{0x158}, {[{@ipv4=@local, [0xff], @ipv6=@remote, [0x0, 0xff000000, 0xff000000, 0xffffff00], 0x4d3, 0x34ff, 0x1, 0x1, 0x15, 0x10}, {@ipv4=@multicast1, [0x0, 0xffffffff, 0xffffffff, 0xff], @ipv4=@rand_addr=0x64010100, [0xff000000, 0xffffffff], 0x4d6, 0x3503, 0x87, 0x0, 0x2, 0x10}, {@ipv4=@empty, [0x0, 0xffffffff, 0xff000000, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x11}, [0xff000000, 0x0, 0xff, 0xff000000], 0x4d6, 0x3500, 0x3a, 0x0, 0x0, 0x4}, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, [0xff, 0xffffff00, 0x0, 0xffffff00], @ipv6=@mcast1, [0xff000000, 0xffffffff, 0xff000000, 0xffffffff], 0x4d3, 0x0, 0x2f, 0x0, 0x4, 0x1a}], 0x1, 0x3}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}, [], [], 'wg1\x00', 'caif0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x458) socket$inet6(0xa, 0x3, 0x8000000003c) (async) bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x48) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) (async) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) (async) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) (async) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) socket$rds(0x15, 0x5, 0x0) (async) setsockopt$RDS_CANCEL_SENT_TO(r6, 0x114, 0x1, &(0x7f00000000c0)={0x2, 0x4e23, @private=0xa010100}, 0x10) (async) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) (async) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) (async) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) (async) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x10042) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r1, 0x58, &(0x7f0000000340)}, 0x10) (async) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r11}, 0xc) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x3f8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x228, 0x250, 0x0, {}, [@common=@ipv6header={{0x28}, {0x1a, 0x1, 0x1}}, @common=@inet=@policy={{0x158}, {[{@ipv4=@local, [0xff], @ipv6=@remote, [0x0, 0xff000000, 0xff000000, 0xffffff00], 0x4d3, 0x34ff, 0x1, 0x1, 0x15, 0x10}, {@ipv4=@multicast1, [0x0, 0xffffffff, 0xffffffff, 0xff], @ipv4=@rand_addr=0x64010100, [0xff000000, 0xffffffff], 0x4d6, 0x3503, 0x87, 0x0, 0x2, 0x10}, {@ipv4=@empty, [0x0, 0xffffffff, 0xff000000, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x11}, [0xff000000, 0x0, 0xff, 0xff000000], 0x4d6, 0x3500, 0x3a, 0x0, 0x0, 0x4}, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, [0xff, 0xffffff00, 0x0, 0xffffff00], @ipv6=@mcast1, [0xff000000, 0xffffffff, 0xff000000, 0xffffffff], 0x4d3, 0x0, 0x2f, 0x0, 0x4, 0x1a}], 0x1, 0x3}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}, [], [], 'wg1\x00', 'caif0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x458) (async) 0s ago: executing program 4 (id=14054): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 64) r1 = epoll_create1(0x0) (rerun: 64) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000000040)={0xb0000010}) (async) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="940000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c0001800c00028005000100000000002c00018014000300ff02000000040000000000000000000114000400000000f7000000000000ffffac1e00010800074000000001"], 0x94}}, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0xac, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_DST={0x18, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x0) kernel console output (not intermixed with test programs): TASK> [ 1111.686564][T19599] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1111.738947][T19599] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1111.837214][T13737] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12663'. [ 1111.847125][T13737] openvswitch: netlink: Flow key attr not present in new flow. [ 1111.905685][T13739] netlink: 104 bytes leftover after parsing attributes in process `syz.2.12664'. [ 1111.934642][T19599] team_slave_1 (unregistering): left promiscuous mode [ 1111.943879][T19599] team0 (unregistering): Port device team_slave_1 removed [ 1111.961550][T19599] team_slave_0 (unregistering): left promiscuous mode [ 1111.969638][T19599] team0 (unregistering): Port device team_slave_0 removed [ 1112.133081][T13724] syzkaller1: entered promiscuous mode [ 1112.145687][T13724] syzkaller1: entered allmulticast mode [ 1112.155923][T13743] netlink: 'syz.2.12665': attribute type 2 has an invalid length. [ 1112.557706][T19599] IPVS: stop unused estimator thread 0... [ 1112.784120][T13754] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1112.835630][T13769] netlink: 'syz.2.12674': attribute type 9 has an invalid length. [ 1113.072927][T13777] IPVS: length: 35 != 24 [ 1113.169474][T13775] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1113.268262][ T5760] Bluetooth: hci4: command tx timeout [ 1113.341291][T13788] syzkaller1: entered promiscuous mode [ 1113.348020][T13788] syzkaller1: entered allmulticast mode [ 1113.601810][T13811] netlink: 'syz.1.12681': attribute type 1 has an invalid length. [ 1113.626933][T13811] __nla_validate_parse: 1 callbacks suppressed [ 1113.626953][T13811] netlink: 352 bytes leftover after parsing attributes in process `syz.1.12681'. [ 1113.687351][T13569] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1114.570152][T13850] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 1114.677604][T13857] netlink: 'syz.4.12686': attribute type 58 has an invalid length. [ 1114.706695][T13857] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12686'. [ 1114.942125][T13569] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1115.003562][T13811] netlink: 'syz.1.12681': attribute type 1 has an invalid length. [ 1115.012820][T13811] netlink: 352 bytes leftover after parsing attributes in process `syz.1.12681'. [ 1115.046785][T13820] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12684'. [ 1115.088058][T13820] netlink: 39 bytes leftover after parsing attributes in process `syz.2.12684'. [ 1115.195863][T13569] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1115.245061][T13569] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1115.336758][ T5760] Bluetooth: hci4: command tx timeout [ 1115.399433][T13884] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12690'. [ 1115.418272][T13884] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12690'. [ 1115.492031][T13890] xt_hashlimit: size too large, truncated to 1048576 [ 1115.665761][T13900] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12693'. [ 1115.753514][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1115.952195][T13900] team0 (unregistering): Port device team_slave_0 removed [ 1115.990443][T13900] team0 (unregistering): Port device team_slave_1 removed [ 1115.992818][T13909] netlink: 68 bytes leftover after parsing attributes in process `syz.0.12697'. [ 1116.059416][T13569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1116.112380][T13569] 8021q: adding VLAN 0 to HW filter on device team0 [ 1116.165510][ T1653] bridge0: port 1(bridge_slave_0) entered blocking state [ 1116.172725][ T1653] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1116.214375][ T1654] bridge0: port 2(bridge_slave_1) entered blocking state [ 1116.221566][ T1654] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1116.330218][T13929] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1116.458897][T13569] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1116.762798][T13569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1116.802242][T13569] veth0_vlan: entered promiscuous mode [ 1116.816396][T13569] veth1_vlan: entered promiscuous mode [ 1116.850219][T13569] veth0_macvtap: entered promiscuous mode [ 1116.859051][T13569] veth1_macvtap: entered promiscuous mode [ 1116.875889][T13569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1116.893625][T13569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1116.908146][ T1653] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.917827][ T1653] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.937664][ T1653] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.946441][ T1653] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1117.050741][T19599] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1117.061140][T19599] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1117.088939][T19599] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1117.097815][T19599] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1117.145431][T13941] IPv6: addrconf: prefix option has invalid lifetime [ 1120.766609][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1120.774615][ C1] lec:lec_tx_timeout: lec0 [ 1135.897415][ T47] page_pool_release_retry() stalled pool shutdown: id 319, 1 inflight 60 sec [ 1142.712672][T25016] lec:lec_start_xmit: lec0:No lecd attached [ 1147.736977][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 1147.745009][ C1] lec:lec_tx_timeout: lec0 [ 1163.900825][ T5838] Bluetooth: hci2: command 0x0406 tx timeout [ 1177.189215][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1179.256964][ T5838] Bluetooth: hci1: command 0x0406 tx timeout [ 1182.696696][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5510 ms [ 1182.704816][ C1] lec:lec_tx_timeout: lec0 [ 1207.294021][T25016] lec:lec_start_xmit: lec0:No lecd attached [ 1212.696806][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5400 ms [ 1212.704845][ C1] lec:lec_tx_timeout: lec0 [ 1230.461596][T13958] Bluetooth: hci4: command 0x0406 tx timeout [ 1230.466628][T13957] Bluetooth: hci3: command 0x0406 tx timeout [ 1237.292212][T13968] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12704'. [ 1237.307380][T13970] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12707'. [ 1237.320518][T13966] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.336717][T13970] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12707'. [ 1237.368479][T13974] netlink: 176 bytes leftover after parsing attributes in process `syz.0.12704'. [ 1237.484293][T13966] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.546197][T13966] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.552272][T13984] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12710'. [ 1237.569087][T13970] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12707'. [ 1237.588819][T13970] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12707'. [ 1237.623410][T13984] bond1: option all_slaves_active: invalid value (13) [ 1237.632270][T13984] bond1 (unregistering): Released all slaves [ 1237.659525][T13966] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.777119][ T1655] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.820668][ T1655] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.860042][ T1655] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1237.897022][ T1655] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1238.264382][T14003] netlink: 68 bytes leftover after parsing attributes in process `syz.0.12714'. [ 1238.308613][T14006] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12715'. [ 1238.439977][T14006] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12715'. [ 1238.634091][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1239.448700][T14042] geneve1: entered promiscuous mode [ 1239.454490][T14042] macsec1: entered promiscuous mode [ 1239.496644][T14042] macsec1: entered allmulticast mode [ 1239.501991][T14042] geneve1: entered allmulticast mode [ 1239.587488][T14049] bond1: option all_slaves_active: invalid value (13) [ 1239.632738][T14049] bond1 (unregistering): Released all slaves [ 1242.733036][T14066] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1242.927597][T14101] netlink: 'syz.0.12735': attribute type 15 has an invalid length. [ 1242.929558][T14102] netlink: 'syz.1.12732': attribute type 10 has an invalid length. [ 1242.938815][T14101] __nla_validate_parse: 1 callbacks suppressed [ 1242.938835][T14101] netlink: 666 bytes leftover after parsing attributes in process `syz.0.12735'. [ 1242.960434][T14102] team0: Device veth1_macvtap failed to register rx_handler [ 1243.008101][T14109] netlink: 104 bytes leftover after parsing attributes in process `syz.3.12737'. [ 1243.078372][T14112] Bluetooth: MGMT ver 1.23 [ 1243.103571][T14112] bond0: (slave batadv0): Releasing backup interface [ 1243.118853][T14112] bridge_slave_0: left allmulticast mode [ 1243.129585][T14112] bridge_slave_0: left promiscuous mode [ 1243.145967][T14112] bridge0: port 1(bridge_slave_0) entered disabled state [ 1243.169351][T14112] bridge_slave_1: left allmulticast mode [ 1243.175047][T14112] bridge_slave_1: left promiscuous mode [ 1243.187114][T14112] bridge0: port 2(bridge_slave_1) entered disabled state [ 1243.201620][T14112] bond0: (slave bond_slave_0): Releasing backup interface [ 1243.218856][T14112] bond0: (slave bond_slave_1): Releasing backup interface [ 1243.242224][T14112] team0: Port device team_slave_0 removed [ 1243.251451][T14112] team0: Port device team_slave_1 removed [ 1243.258880][T14112] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1243.267726][T14112] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1243.277353][T14112] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1243.316051][T14117] bond1: entered promiscuous mode [ 1243.323564][T14117] bond1: entered allmulticast mode [ 1243.329436][T14117] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1243.428876][T14133] netlink: 'syz.4.12745': attribute type 1 has an invalid length. [ 1243.507217][T14133] bond1: (slave geneve2): making interface the new active one [ 1243.532588][T14133] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 1243.542039][ T1658] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 1243.554327][ T1658] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 1243.564240][ T1658] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 1243.573249][T14133] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12745'. [ 1243.645576][ T1658] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 1243.657741][T14133] bond1 (unregistering): (slave geneve2): Releasing active interface [ 1243.668445][T14133] bond1 (unregistering): Released all slaves [ 1243.690504][T12377] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1243.703665][T12377] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1243.738114][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5100 ms [ 1243.746200][ C1] lec:lec_tx_timeout: lec0 [ 1243.752836][T12377] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1243.784777][T14144] netlink: 272 bytes leftover after parsing attributes in process `syz.0.12749'. [ 1243.829534][T12377] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1244.013961][ T4064] IPVS: starting estimator thread 0... [ 1244.039361][T14163] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.063160][T14163] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12756'. [ 1244.104402][T14165] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.106939][T14164] IPVS: using max 29 ests per chain, 69600 per kthread [ 1244.117536][T14165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12756'. [ 1244.129903][T14165] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.143301][T14165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12756'. [ 1244.154841][T14165] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.163659][T14165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12756'. [ 1244.206768][T14165] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.221238][T14173] FAULT_INJECTION: forcing a failure. [ 1244.221238][T14173] name failslab, interval 1, probability 0, space 0, times 0 [ 1244.223782][T14165] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12756'. [ 1244.237352][T14173] CPU: 1 UID: 0 PID: 14173 Comm: syz.3.12760 Not tainted syzkaller #0 PREEMPT(full) [ 1244.237380][T14173] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1244.237392][T14173] Call Trace: [ 1244.237400][T14173] [ 1244.237409][T14173] dump_stack_lvl+0xe8/0x150 [ 1244.237442][T14173] should_fail_ex+0x412/0x560 [ 1244.237472][T14173] should_failslab+0xa8/0x100 [ 1244.237499][T14173] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1244.237520][T14173] ? __alloc_skb+0x1d0/0x7d0 [ 1244.237552][T14173] __alloc_skb+0x1d0/0x7d0 [ 1244.237581][T14173] tcp_stream_alloc_skb+0x3f/0x580 [ 1244.237690][T14173] tcp_sendmsg_locked+0x1375/0x5490 [ 1244.237722][T14173] ? __lock_acquire+0x6b5/0x2cf0 [ 1244.237780][T14173] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1244.237805][T14173] ? tcp_sendmsg+0x21/0x50 [ 1244.237826][T14173] ? __local_bh_enable_ip+0xd0/0x130 [ 1244.237857][T14173] ? __pfx_inet_sendmsg+0x10/0x10 [ 1244.237884][T14173] tcp_sendmsg+0x2f/0x50 [ 1244.237902][T14173] __sys_sendto+0x5de/0x710 [ 1244.237931][T14173] ? __pfx___sys_sendto+0x10/0x10 [ 1244.237952][T14173] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1244.237992][T14173] ? __fget_files+0x3a0/0x420 [ 1244.238027][T14173] ? ksys_write+0x242/0x270 [ 1244.238048][T14173] ? __pfx_ksys_write+0x10/0x10 [ 1244.238072][T14173] __x64_sys_sendto+0xde/0x100 [ 1244.238101][T14173] do_syscall_64+0x14d/0xf80 [ 1244.238124][T14173] ? trace_irq_disable+0x3b/0x150 [ 1244.238148][T14173] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1244.238168][T14173] ? clear_bhb_loop+0x40/0x90 [ 1244.238189][T14173] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1244.238208][T14173] RIP: 0033:0x7ff43a79c799 [ 1244.238227][T14173] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1244.238242][T14173] RSP: 002b:00007ff43b5b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1244.238262][T14173] RAX: ffffffffffffffda RBX: 00007ff43aa15fa0 RCX: 00007ff43a79c799 [ 1244.238286][T14173] RDX: 00000000fffffdef RSI: 0000200000002240 RDI: 0000000000000003 [ 1244.238301][T14173] RBP: 00007ff43b5b0090 R08: 0000000000000000 R09: 0000000000000049 [ 1244.238313][T14173] R10: 0000000004004085 R11: 0000000000000246 R12: 0000000000000001 [ 1244.238324][T14173] R13: 00007ff43aa16038 R14: 00007ff43aa15fa0 R15: 00007ffd54d6cd08 [ 1244.238353][T14173] [ 1244.421982][T14177] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1244.424461][T14165] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.509386][T14177] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12761'. [ 1244.529648][T14165] netlink: 'syz.4.12756': attribute type 29 has an invalid length. [ 1244.673351][T14183] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1244.699256][T14183] bond1: (slave lo): Enslaving as an active interface with an up link [ 1244.710319][T14183] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1244.730045][T14187] bond0: entered promiscuous mode [ 1244.735099][T14187] bond_slave_0: entered promiscuous mode [ 1244.741504][T14187] bond_slave_1: entered promiscuous mode [ 1244.749549][T14187] gretap0: entered promiscuous mode [ 1244.755585][T14187] batadv0: entered promiscuous mode [ 1244.761759][T14187] debugfs: 'hsr0' already exists in 'hsr' [ 1244.767647][T14187] Cannot create hsr debugfs directory [ 1244.773073][T14187] hsr0: entered promiscuous mode [ 1245.123273][T14197] macsec1: entered promiscuous mode [ 1245.130082][T14197] geneve1: entered promiscuous mode [ 1245.136142][T14197] macsec1: entered allmulticast mode [ 1245.144610][T14197] geneve1: entered allmulticast mode [ 1245.819603][T14235] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1246.290162][T14269] lo speed is unknown, defaulting to 1000 [ 1246.308480][T14269] lo speed is unknown, defaulting to 1000 [ 1246.315425][T14269] lo speed is unknown, defaulting to 1000 [ 1246.479749][T14281] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1246.604317][T14289] netem: change failed [ 1246.752529][T14269] infiniband syz0: set active [ 1246.761226][ T4053] lo speed is unknown, defaulting to 1000 [ 1246.769076][T14297] lo speed is unknown, defaulting to 1000 [ 1246.776715][T14269] infiniband syz0: added lo [ 1246.813733][T14269] RDS/IB: syz0: added [ 1246.818332][T14269] smc: adding ib device syz0 with port count 1 [ 1246.824614][T14269] smc: ib device syz0 port 1 has no pnetid [ 1246.833572][ T4053] lo speed is unknown, defaulting to 1000 [ 1247.050550][T14315] dummy0: entered promiscuous mode [ 1247.057065][T14315] bridge0: port 3(dummy0) entered blocking state [ 1247.064774][T14315] bridge0: port 3(dummy0) entered disabled state [ 1247.082532][T14315] dummy0: entered allmulticast mode [ 1247.100756][T14315] bridge0: port 3(dummy0) entered blocking state [ 1247.107336][T14315] bridge0: port 3(dummy0) entered forwarding state [ 1247.265763][T14269] lo speed is unknown, defaulting to 1000 [ 1247.467433][T14336] IPVS: set_ctl: invalid protocol: 94 10.1.1.2:3 [ 1247.769692][T14269] lo speed is unknown, defaulting to 1000 [ 1248.017091][T14355] __nla_validate_parse: 45 callbacks suppressed [ 1248.017114][T14355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12820'. [ 1248.027400][T14361] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1248.045804][T14355] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12820'. [ 1248.070688][T14355] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12820'. [ 1248.125170][ T1658] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1248.136810][T14355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12820'. [ 1248.157991][ T1653] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1248.168152][ T1653] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1248.187393][T14355] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12820'. [ 1248.205092][ T1653] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1248.227527][T14355] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12820'. [ 1248.320785][T14269] lo speed is unknown, defaulting to 1000 [ 1248.819699][T14359] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1249.425201][T14390] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12832'. [ 1250.425287][T14365] lo speed is unknown, defaulting to 1000 [ 1250.450861][T14375] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1250.679788][T14375] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1250.757730][T14401] vlan2: entered promiscuous mode [ 1250.766265][T14401] macvlan0: entered promiscuous mode [ 1250.786144][T14269] lo speed is unknown, defaulting to 1000 [ 1251.258506][T14375] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1251.380845][T14269] lo speed is unknown, defaulting to 1000 [ 1251.467595][T14375] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1251.681950][ T1658] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.696353][T14417] validate_nla: 17 callbacks suppressed [ 1251.696374][T14417] netlink: 'syz.1.12840': attribute type 8 has an invalid length. [ 1251.739053][ T1658] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.754557][ T1658] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.764635][T14417] bridge0: port 2(bridge_slave_1) entered disabled state [ 1251.772043][T14417] bridge0: port 1(bridge_slave_0) entered disabled state [ 1251.838547][T12373] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1252.069791][T14430] netlink: 'syz.1.12843': attribute type 1 has an invalid length. [ 1252.279866][T14438] bond2: (slave geneve2): making interface the new active one [ 1252.316914][T14438] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 1252.361301][T12373] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 1252.370982][T12373] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 1252.434280][T12373] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 1252.453369][T12373] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 1252.467169][T14453] netlink: 14 bytes leftover after parsing attributes in process `syz.2.12852'. [ 1252.515358][T14453] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1252.526050][T14453] bond_slave_0: left promiscuous mode [ 1252.534452][T14453] bond_slave_0: left allmulticast mode [ 1252.555457][T14453] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1252.566309][T14453] bond_slave_1: left promiscuous mode [ 1252.572902][T14453] bond_slave_1: left allmulticast mode [ 1252.582332][T14453] bond0 (unregistering): Released all slaves [ 1252.612270][T14452] lo speed is unknown, defaulting to 1000 [ 1252.632704][T14461] netlink: 48 bytes leftover after parsing attributes in process `syz.3.12853'. [ 1252.643643][T14461] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12853'. [ 1252.837269][T14467] FAULT_INJECTION: forcing a failure. [ 1252.837269][T14467] name failslab, interval 1, probability 0, space 0, times 0 [ 1252.853760][T14467] CPU: 1 UID: 0 PID: 14467 Comm: syz.3.12856 Not tainted syzkaller #0 PREEMPT(full) [ 1252.853786][T14467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1252.853798][T14467] Call Trace: [ 1252.853805][T14467] [ 1252.853813][T14467] dump_stack_lvl+0xe8/0x150 [ 1252.853853][T14467] should_fail_ex+0x412/0x560 [ 1252.853883][T14467] should_failslab+0xa8/0x100 [ 1252.853906][T14467] ? skb_clone+0x212/0x3a0 [ 1252.853925][T14467] kmem_cache_alloc_noprof+0x87/0x650 [ 1252.853952][T14467] skb_clone+0x212/0x3a0 [ 1252.853968][T14467] ? netlink_broadcast_filtered+0x6a0/0x1020 [ 1252.853993][T14467] netlink_broadcast_filtered+0x6ae/0x1020 [ 1252.854023][T14467] ? trace_kmem_cache_alloc+0x29/0xf0 [ 1252.854050][T14467] ? __pfx_netlink_broadcast_filtered+0x10/0x10 [ 1252.854073][T14467] ? alloc_uevent_skb+0xeb/0x230 [ 1252.854096][T14467] ? __asan_memcpy+0x40/0x70 [ 1252.854117][T14467] netlink_broadcast+0x37/0x50 [ 1252.854141][T14467] kobject_uevent_net_broadcast+0x378/0x560 [ 1252.854167][T14467] kobject_uevent_env+0x55c/0x9e0 [ 1252.854196][T14467] tty_register_device_attr+0x573/0x950 [ 1252.854230][T14467] ? __pfx_tty_register_device_attr+0x10/0x10 [ 1252.854268][T14467] ? tty_port_register_device+0x5a/0x100 [ 1252.854296][T14467] rfcomm_dev_ioctl+0x1b73/0x21d0 [ 1252.854328][T14467] ? kasan_quarantine_put+0xbb/0x1f0 [ 1252.854346][T14467] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 1252.854374][T14467] ? tomoyo_path_number_perm+0x219/0x630 [ 1252.854397][T14467] ? tomoyo_path_number_perm+0x219/0x630 [ 1252.854426][T14467] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1252.854455][T14467] sock_do_ioctl+0x101/0x320 [ 1252.854481][T14467] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1252.854500][T14467] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1252.854534][T14467] sock_ioctl+0x5c6/0x7f0 [ 1252.854552][T14467] ? __pfx_sock_ioctl+0x10/0x10 [ 1252.854571][T14467] ? __fget_files+0x2a/0x420 [ 1252.854596][T14467] ? __fget_files+0x3a0/0x420 [ 1252.854618][T14467] ? __fget_files+0x2a/0x420 [ 1252.854650][T14467] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1252.854673][T14467] ? __pfx_sock_ioctl+0x10/0x10 [ 1252.854694][T14467] __se_sys_ioctl+0xfc/0x170 [ 1252.854717][T14467] do_syscall_64+0x14d/0xf80 [ 1252.854741][T14467] ? trace_irq_disable+0x3b/0x150 [ 1252.854766][T14467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1252.854782][T14467] ? clear_bhb_loop+0x40/0x90 [ 1252.854804][T14467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1252.854822][T14467] RIP: 0033:0x7ff43a79c799 [ 1252.854840][T14467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1252.854863][T14467] RSP: 002b:00007ff43b5b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1252.854883][T14467] RAX: ffffffffffffffda RBX: 00007ff43aa15fa0 RCX: 00007ff43a79c799 [ 1252.854895][T14467] RDX: 0000200000000100 RSI: 00000000400452c8 RDI: 0000000000000004 [ 1252.854907][T14467] RBP: 00007ff43b5b0090 R08: 0000000000000000 R09: 0000000000000000 [ 1252.854918][T14467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1252.854928][T14467] R13: 00007ff43aa16038 R14: 00007ff43aa15fa0 R15: 00007ffd54d6cd08 [ 1252.854956][T14467] [ 1253.526115][T14477] netlink: 104 bytes leftover after parsing attributes in process `syz.0.12861'. [ 1253.580560][T14475] syzkaller1: entered promiscuous mode [ 1253.626204][T14475] syzkaller1: entered allmulticast mode [ 1253.776915][T14481] netlink: 'syz.4.12862': attribute type 11 has an invalid length. [ 1253.966755][T14486] lo speed is unknown, defaulting to 1000 [ 1254.572761][T14524] netlink: 104 bytes leftover after parsing attributes in process `syz.0.12874'. [ 1254.636891][T14485] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1254.929054][T14542] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12879'. [ 1255.026763][T14510] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1255.051672][T14534] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12879'. [ 1255.153779][T14542] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12879'. [ 1255.206653][T14552] netlink: 40 bytes leftover after parsing attributes in process `syz.4.12882'. [ 1255.352323][T14554] netlink: 'syz.4.12885': attribute type 1 has an invalid length. [ 1255.558675][T14562] bond1: (slave geneve3): making interface the new active one [ 1255.603883][T14562] bond1: (slave geneve3): Enslaving as an active interface with an up link [ 1255.636720][ T1653] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1255.676619][ T1653] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1255.685463][ T1653] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1255.766635][ T1653] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1255.830258][T14573] netlink: 'syz.0.12889': attribute type 21 has an invalid length. [ 1255.936051][T14579] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12890'. [ 1256.017037][T14579] bond2: entered promiscuous mode [ 1256.022476][T14579] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1256.084495][T14581] pimreg: entered allmulticast mode [ 1256.163730][T14576] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1256.172770][T14591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12894'. [ 1256.174860][T14576] bond3: entered promiscuous mode [ 1256.191050][T14576] bond2: (slave bond3): Enslaving as an active interface with an up link [ 1256.227320][T14591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12894'. [ 1256.233848][T14587] lo speed is unknown, defaulting to 1000 [ 1256.260330][T14591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12894'. [ 1256.719393][T14597] syzkaller1: entered promiscuous mode [ 1256.729641][T14597] syzkaller1: entered allmulticast mode [ 1256.942094][T14586] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1257.098699][T14618] netlink: zone id is out of range [ 1257.106622][T14618] netlink: zone id is out of range [ 1257.116317][T14618] netlink: zone id is out of range [ 1257.127325][T14618] netlink: zone id is out of range [ 1257.133855][T14618] netlink: zone id is out of range [ 1257.139672][T14618] netlink: zone id is out of range [ 1257.145052][T14618] netlink: zone id is out of range [ 1257.152560][T14618] netlink: zone id is out of range [ 1257.158844][T14618] netlink: zone id is out of range [ 1257.164194][T14618] netlink: zone id is out of range [ 1257.395935][T14628] vlan2: entered promiscuous mode [ 1257.413472][T14628] vlan2: entered allmulticast mode [ 1258.119747][T14649] FAULT_INJECTION: forcing a failure. [ 1258.119747][T14649] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1258.206594][T14649] CPU: 0 UID: 0 PID: 14649 Comm: syz.3.12913 Not tainted syzkaller #0 PREEMPT(full) [ 1258.206620][T14649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1258.206629][T14649] Call Trace: [ 1258.206638][T14649] [ 1258.206646][T14649] dump_stack_lvl+0xe8/0x150 [ 1258.206675][T14649] should_fail_ex+0x412/0x560 [ 1258.206702][T14649] _copy_to_user+0x31/0xb0 [ 1258.206729][T14649] simple_read_from_buffer+0xe1/0x170 [ 1258.206756][T14649] proc_fail_nth_read+0x1bb/0x230 [ 1258.206783][T14649] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1258.206808][T14649] ? rw_verify_area+0x2a6/0x4d0 [ 1258.206824][T14649] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1258.206845][T14649] vfs_read+0x20c/0xa70 [ 1258.206862][T14649] ? fdget_pos+0x246/0x320 [ 1258.206888][T14649] ? __pfx___mutex_lock+0x10/0x10 [ 1258.206912][T14649] ? __pfx_vfs_read+0x10/0x10 [ 1258.206931][T14649] ? __fget_files+0x2a/0x420 [ 1258.206958][T14649] ? __fget_files+0x3a0/0x420 [ 1258.206980][T14649] ? __fget_files+0x2a/0x420 [ 1258.207010][T14649] ksys_read+0x150/0x270 [ 1258.207029][T14649] ? __pfx_ksys_read+0x10/0x10 [ 1258.207054][T14649] do_syscall_64+0x14d/0xf80 [ 1258.207076][T14649] ? trace_irq_disable+0x3b/0x150 [ 1258.207099][T14649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.207117][T14649] ? clear_bhb_loop+0x40/0x90 [ 1258.207139][T14649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.207156][T14649] RIP: 0033:0x7ff43a75cfce [ 1258.207173][T14649] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1258.207189][T14649] RSP: 002b:00007ff43b5affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1258.207207][T14649] RAX: ffffffffffffffda RBX: 00007ff43b5b06c0 RCX: 00007ff43a75cfce [ 1258.207220][T14649] RDX: 000000000000000f RSI: 00007ff43b5b00a0 RDI: 0000000000000003 [ 1258.207230][T14649] RBP: 00007ff43b5b0090 R08: 0000000000000000 R09: 0000000000000000 [ 1258.207251][T14649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1258.207261][T14649] R13: 00007ff43aa16038 R14: 00007ff43aa15fa0 R15: 00007ffd54d6cd08 [ 1258.207292][T14649] [ 1258.471215][T14650] IPVS: Scheduler module ip_vs_ not found [ 1258.647264][T14658] bond5: option all_slaves_active: invalid value (13) [ 1258.688527][T14658] bond5 (unregistering): Released all slaves [ 1258.744683][T14667] __nla_validate_parse: 68 callbacks suppressed [ 1258.744704][T14667] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12919'. [ 1258.871481][T14667] netlink: 'syz.2.12919': attribute type 1 has an invalid length. [ 1258.885999][T14667] netlink: 'syz.2.12919': attribute type 2 has an invalid length. [ 1259.328766][T14674] netlink: 'syz.1.12924': attribute type 5 has an invalid length. [ 1259.384266][T14675] xt_hashlimit: size too large, truncated to 1048576 [ 1259.727963][T14691] "syz.0.12928" (14691) uses obsolete ecb(arc4) skcipher [ 1259.753007][T14696] "syz.0.12928" (14696) uses obsolete ecb(arc4) skcipher [ 1259.947867][T14702] pim6reg1: entered allmulticast mode [ 1260.319825][T14728] sctp: [Deprecated]: syz.3.12939 (pid 14728) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1260.319825][T14728] Use struct sctp_sack_info instead [ 1260.652296][T14755] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12945'. [ 1260.791012][T14760] af_packet: tpacket_rcv: packet too big, clamped from 20 to 4294967272. macoff=96 [ 1260.794132][T14763] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 1260.809962][T14760] netlink: 'syz.2.12948': attribute type 2 has an invalid length. [ 1260.837002][T14760] netlink: 60 bytes leftover after parsing attributes in process `syz.2.12948'. [ 1260.908687][T14770] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12948'. [ 1261.575071][T14803] FAULT_INJECTION: forcing a failure. [ 1261.575071][T14803] name failslab, interval 1, probability 0, space 0, times 0 [ 1261.636683][T14803] CPU: 0 UID: 0 PID: 14803 Comm: syz.4.12963 Not tainted syzkaller #0 PREEMPT(full) [ 1261.636711][T14803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1261.636723][T14803] Call Trace: [ 1261.636731][T14803] [ 1261.636740][T14803] dump_stack_lvl+0xe8/0x150 [ 1261.636771][T14803] should_fail_ex+0x412/0x560 [ 1261.636801][T14803] should_failslab+0xa8/0x100 [ 1261.636825][T14803] ? dst_alloc+0x105/0x170 [ 1261.636847][T14803] kmem_cache_alloc_noprof+0x87/0x650 [ 1261.636866][T14803] ? __pfx_find_exception+0x10/0x10 [ 1261.636899][T14803] dst_alloc+0x105/0x170 [ 1261.636921][T14803] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 1261.636956][T14803] ? ip_route_output_key_hash+0xd8/0x2a0 [ 1261.636984][T14803] ip_route_output_key_hash+0x18d/0x2a0 [ 1261.637013][T14803] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 1261.637044][T14803] ? call_rcu+0x644/0x890 [ 1261.637079][T14803] ip_route_output_flow+0x2a/0x150 [ 1261.637101][T14803] ? security_sk_classify_flow+0x6d/0x150 [ 1261.637122][T14803] __ip4_datagram_connect+0x9a5/0x1270 [ 1261.637254][T14803] __ip6_datagram_connect+0x9f0/0x1150 [ 1261.637332][T14803] ? __pfx___ip6_datagram_connect+0x10/0x10 [ 1261.637355][T14803] ? ip6_datagram_connect_v6_only+0x56/0xa0 [ 1261.637379][T14803] ? __local_bh_enable_ip+0xd0/0x130 [ 1261.637408][T14803] ip6_datagram_connect_v6_only+0x63/0xa0 [ 1261.637432][T14803] __sys_connect+0x312/0x450 [ 1261.637458][T14803] ? __pfx___sys_connect+0x10/0x10 [ 1261.637497][T14803] ? __pfx_ksys_write+0x10/0x10 [ 1261.637523][T14803] __x64_sys_connect+0x7a/0x90 [ 1261.637548][T14803] do_syscall_64+0x14d/0xf80 [ 1261.637575][T14803] ? trace_irq_disable+0x3b/0x150 [ 1261.637599][T14803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1261.637618][T14803] ? clear_bhb_loop+0x40/0x90 [ 1261.637640][T14803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1261.637657][T14803] RIP: 0033:0x7fd19af9c799 [ 1261.637675][T14803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1261.637691][T14803] RSP: 002b:00007fd19be18028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1261.637714][T14803] RAX: ffffffffffffffda RBX: 00007fd19b215fa0 RCX: 00007fd19af9c799 [ 1261.637727][T14803] RDX: 000000000000001c RSI: 0000200000000000 RDI: 0000000000000003 [ 1261.637739][T14803] RBP: 00007fd19be18090 R08: 0000000000000000 R09: 0000000000000000 [ 1261.637751][T14803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1261.637762][T14803] R13: 00007fd19b216038 R14: 00007fd19b215fa0 R15: 00007ffcd7f72448 [ 1261.637792][T14803] [ 1262.348012][T14826] net_ratelimit: 48 callbacks suppressed [ 1262.348030][T14826] IPVS: rr: FWM 3 0x00000003 - no destination available [ 1262.361312][T14829] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 1262.675440][T14847] netlink: 96 bytes leftover after parsing attributes in process `syz.2.12977'. [ 1262.709933][T14847] 8021q: VLANs not supported on sit0 [ 1262.794251][T14844] lo speed is unknown, defaulting to 1000 [ 1263.007156][T14863] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12984'. [ 1263.899424][T14890] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12993'. [ 1263.964564][T14885] bond4: option miimon: invalid value (18446744073709551607) [ 1263.972576][T14885] bond4: option miimon: allowed values 0 - 2147483647 [ 1263.996091][T14891] netlink: 44 bytes leftover after parsing attributes in process `syz.0.12991'. [ 1264.001359][T14885] bond4 (unregistering): Released all slaves [ 1264.011042][T14893] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12993'. [ 1264.037223][T14889] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12993'. [ 1264.063039][T14889] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12993'. [ 1264.116595][T14893] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12993'. [ 1264.504128][T14916] FAULT_INJECTION: forcing a failure. [ 1264.504128][T14916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1264.518406][T14916] CPU: 1 UID: 0 PID: 14916 Comm: syz.1.13001 Not tainted syzkaller #0 PREEMPT(full) [ 1264.518432][T14916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1264.518444][T14916] Call Trace: [ 1264.518452][T14916] [ 1264.518460][T14916] dump_stack_lvl+0xe8/0x150 [ 1264.518492][T14916] should_fail_ex+0x412/0x560 [ 1264.518521][T14916] _copy_to_user+0x31/0xb0 [ 1264.518550][T14916] simple_read_from_buffer+0xe1/0x170 [ 1264.518582][T14916] proc_fail_nth_read+0x1bb/0x230 [ 1264.518610][T14916] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1264.518639][T14916] ? rw_verify_area+0x2a6/0x4d0 [ 1264.518658][T14916] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1264.518693][T14916] vfs_read+0x20c/0xa70 [ 1264.518711][T14916] ? fdget_pos+0x246/0x320 [ 1264.518733][T14916] ? __pfx___mutex_lock+0x10/0x10 [ 1264.518762][T14916] ? __pfx___mutex_lock+0x10/0x10 [ 1264.518786][T14916] ? __pfx_vfs_read+0x10/0x10 [ 1264.518805][T14916] ? __fget_files+0x2a/0x420 [ 1264.518833][T14916] ? __fget_files+0x3a0/0x420 [ 1264.518855][T14916] ? __fget_files+0x2a/0x420 [ 1264.518888][T14916] ksys_read+0x150/0x270 [ 1264.518909][T14916] ? __pfx_ksys_read+0x10/0x10 [ 1264.518939][T14916] do_syscall_64+0x14d/0xf80 [ 1264.518963][T14916] ? trace_irq_disable+0x3b/0x150 [ 1264.518987][T14916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1264.519006][T14916] ? clear_bhb_loop+0x40/0x90 [ 1264.519027][T14916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1264.519044][T14916] RIP: 0033:0x7fe4e875cfce [ 1264.519061][T14916] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1264.519075][T14916] RSP: 002b:00007fe4e95e5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1264.519094][T14916] RAX: ffffffffffffffda RBX: 00007fe4e95e66c0 RCX: 00007fe4e875cfce [ 1264.519107][T14916] RDX: 000000000000000f RSI: 00007fe4e95e60a0 RDI: 0000000000000005 [ 1264.519119][T14916] RBP: 00007fe4e95e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1264.519130][T14916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1264.519141][T14916] R13: 00007fe4e8a16038 R14: 00007fe4e8a15fa0 R15: 00007fff201c0d48 [ 1264.519172][T14916] [ 1264.874348][T14920] lo speed is unknown, defaulting to 1000 [ 1265.309425][T14919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1265.323931][T14933] netlink: 'syz.4.13007': attribute type 1 has an invalid length. [ 1265.340574][T14936] FAULT_INJECTION: forcing a failure. [ 1265.340574][T14936] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1265.357585][T14936] CPU: 0 UID: 0 PID: 14936 Comm: syz.2.13008 Not tainted syzkaller #0 PREEMPT(full) [ 1265.357609][T14936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1265.357619][T14936] Call Trace: [ 1265.357626][T14936] [ 1265.357633][T14936] dump_stack_lvl+0xe8/0x150 [ 1265.357662][T14936] should_fail_ex+0x412/0x560 [ 1265.357688][T14936] _copy_to_user+0x31/0xb0 [ 1265.357716][T14936] simple_read_from_buffer+0xe1/0x170 [ 1265.357745][T14936] proc_fail_nth_read+0x1bb/0x230 [ 1265.357773][T14936] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1265.357803][T14936] ? rw_verify_area+0x2a6/0x4d0 [ 1265.357823][T14936] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1265.357849][T14936] vfs_read+0x20c/0xa70 [ 1265.357866][T14936] ? fdget_pos+0x246/0x320 [ 1265.357894][T14936] ? __pfx___mutex_lock+0x10/0x10 [ 1265.357921][T14936] ? __pfx_vfs_read+0x10/0x10 [ 1265.357941][T14936] ? __fget_files+0x2a/0x420 [ 1265.357969][T14936] ? __fget_files+0x3a0/0x420 [ 1265.357993][T14936] ? __fget_files+0x2a/0x420 [ 1265.358024][T14936] ksys_read+0x150/0x270 [ 1265.358045][T14936] ? __pfx_ksys_read+0x10/0x10 [ 1265.358074][T14936] do_syscall_64+0x14d/0xf80 [ 1265.358098][T14936] ? trace_irq_disable+0x3b/0x150 [ 1265.358123][T14936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1265.358158][T14936] ? clear_bhb_loop+0x40/0x90 [ 1265.358177][T14936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1265.358193][T14936] RIP: 0033:0x7ff5e575cfce [ 1265.358209][T14936] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1265.358225][T14936] RSP: 002b:00007ff5e65d7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1265.358251][T14936] RAX: ffffffffffffffda RBX: 00007ff5e65d86c0 RCX: 00007ff5e575cfce [ 1265.358264][T14936] RDX: 000000000000000f RSI: 00007ff5e65d80a0 RDI: 0000000000000004 [ 1265.358275][T14936] RBP: 00007ff5e65d8090 R08: 0000000000000000 R09: 0000000000000000 [ 1265.358286][T14936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1265.358297][T14936] R13: 00007ff5e5a16038 R14: 00007ff5e5a15fa0 R15: 00007ffc36a376f8 [ 1265.358326][T14936] [ 1265.405857][T14933] bond4: entered promiscuous mode [ 1265.586883][T14933] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1266.282942][T14972] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13019'. [ 1266.390397][T14977] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13019'. [ 1266.467359][T14977] netlink: 40 bytes leftover after parsing attributes in process `syz.1.13019'. [ 1266.770710][T14987] syzkaller1: entered promiscuous mode [ 1266.776749][T14987] syzkaller1: entered allmulticast mode [ 1266.911158][T14999] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13027'. [ 1266.936026][ T1654] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1266.945893][ T1654] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1266.960711][ T1654] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1266.993053][ T1654] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1267.641909][T15034] syzkaller1: entered promiscuous mode [ 1267.647760][T15034] syzkaller1: entered allmulticast mode [ 1268.049629][T15055] x_tables: duplicate underflow at hook 2 [ 1268.188300][T15064] IPv6: addrconf: prefix option has invalid lifetime [ 1268.257647][T15055] bridge0: port 3(dummy0) entered disabled state [ 1268.264270][T15055] bridge0: port 2(bridge_slave_1) entered disabled state [ 1268.271924][T15055] bridge0: port 1(bridge_slave_0) entered disabled state [ 1268.540073][T15055] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1268.564201][T15055] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1268.654985][T15055] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 1268.698447][T15055] geneve1: left allmulticast mode [ 1268.703794][T15055] macsec1: left promiscuous mode [ 1268.709026][T15055] macsec1: left allmulticast mode [ 1268.716171][T15055] bond1: left promiscuous mode [ 1268.723891][T15055] bond1: left allmulticast mode [ 1268.794675][ T1661] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.829003][ T1661] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.884900][ T1661] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1268.925014][ T1661] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1269.030782][T15085] __nla_validate_parse: 4 callbacks suppressed [ 1269.030803][T15085] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13057'. [ 1269.058809][T15085] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13057'. [ 1269.077284][T15085] netlink: 11 bytes leftover after parsing attributes in process `syz.3.13057'. [ 1269.161365][T15097] syzkaller1: entered promiscuous mode [ 1269.188755][T15097] syzkaller1: entered allmulticast mode [ 1269.305561][T15104] pim6reg: entered allmulticast mode [ 1269.331109][T15105] pim6reg: left allmulticast mode [ 1269.840446][T15136] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 1270.244462][T15152] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.13079'. [ 1270.335666][T15154] lo speed is unknown, defaulting to 1000 [ 1270.593029][T25016] lec:lec_start_xmit: lec0:No lecd attached [ 1270.901245][T15168] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13084'. [ 1271.179460][T15175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1271.898208][T15212] netlink: 20 bytes leftover after parsing attributes in process `syz.4.13098'. [ 1272.082296][T15218] veth0_to_team: entered promiscuous mode [ 1272.111893][T15218] veth0_to_team: entered allmulticast mode [ 1272.176671][T15221] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13102'. [ 1272.458887][T15227] tipc: Enabled bearer , priority 0 [ 1272.592532][T15227] syzkaller0: entered promiscuous mode [ 1272.602150][T15227] syzkaller0: entered allmulticast mode [ 1272.623926][T15227] tipc: Resetting bearer [ 1272.649753][T15226] tipc: Resetting bearer [ 1272.680282][T15242] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13109'. [ 1273.006646][T15253] netlink: 104 bytes leftover after parsing attributes in process `syz.0.13113'. [ 1273.140116][T15258] xt_TCPMSS: Only works on TCP SYN packets [ 1273.214106][T15261] netlink: 'syz.2.13116': attribute type 1 has an invalid length. [ 1275.404489][T15226] tipc: Disabling bearer [ 1275.479267][ T5899] tipc: Node number set to 4227858433 [ 1275.493814][T15259] lo speed is unknown, defaulting to 1000 [ 1275.746565][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5150 ms [ 1275.748203][T15278] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13121'. [ 1275.754727][ C1] lec:lec_tx_timeout: lec0 [ 1275.788022][T15277] netlink: 48 bytes leftover after parsing attributes in process `syz.2.13120'. [ 1275.995998][T15255] lo speed is unknown, defaulting to 1000 [ 1276.139051][T15292] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13125'. [ 1276.148410][T15295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13126'. [ 1276.531783][T15301] syzkaller0: entered promiscuous mode [ 1276.539197][T15301] syzkaller0: entered allmulticast mode [ 1276.994246][T15318] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13131'. [ 1277.077107][T15319] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13131'. [ 1277.268097][T15326] netlink: 104 bytes leftover after parsing attributes in process `syz.2.13134'. [ 1277.669593][T15343] team0: Device macvlan4 failed to change mtu [ 1277.685795][T15343] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13140'. [ 1277.712240][T15343] netlink: 11 bytes leftover after parsing attributes in process `syz.0.13140'. [ 1277.862581][T15347] lo speed is unknown, defaulting to 1000 [ 1278.461661][T15368] FAULT_INJECTION: forcing a failure. [ 1278.461661][T15368] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1278.540326][T15368] CPU: 0 UID: 0 PID: 15368 Comm: syz.0.13145 Not tainted syzkaller #0 PREEMPT(full) [ 1278.540354][T15368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1278.540366][T15368] Call Trace: [ 1278.540374][T15368] [ 1278.540384][T15368] dump_stack_lvl+0xe8/0x150 [ 1278.540415][T15368] should_fail_ex+0x412/0x560 [ 1278.540451][T15368] _copy_to_user+0x31/0xb0 [ 1278.540482][T15368] simple_read_from_buffer+0xe1/0x170 [ 1278.540514][T15368] proc_fail_nth_read+0x1bb/0x230 [ 1278.540543][T15368] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1278.540572][T15368] ? rw_verify_area+0x2a6/0x4d0 [ 1278.540592][T15368] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1278.540619][T15368] vfs_read+0x20c/0xa70 [ 1278.540637][T15368] ? fdget_pos+0x246/0x320 [ 1278.540667][T15368] ? __pfx___mutex_lock+0x10/0x10 [ 1278.540694][T15368] ? __pfx_vfs_read+0x10/0x10 [ 1278.540715][T15368] ? __fget_files+0x2a/0x420 [ 1278.540744][T15368] ? __fget_files+0x3a0/0x420 [ 1278.540768][T15368] ? __fget_files+0x2a/0x420 [ 1278.540802][T15368] ksys_read+0x150/0x270 [ 1278.540824][T15368] ? __pfx_ksys_read+0x10/0x10 [ 1278.540855][T15368] do_syscall_64+0x14d/0xf80 [ 1278.540879][T15368] ? trace_irq_disable+0x3b/0x150 [ 1278.540905][T15368] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1278.540923][T15368] ? clear_bhb_loop+0x40/0x90 [ 1278.540946][T15368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1278.540964][T15368] RIP: 0033:0x7f2cea15cfce [ 1278.540982][T15368] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1278.540997][T15368] RSP: 002b:00007f2ce83f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1278.541017][T15368] RAX: ffffffffffffffda RBX: 00007f2ce83f66c0 RCX: 00007f2cea15cfce [ 1278.541031][T15368] RDX: 000000000000000f RSI: 00007f2ce83f60a0 RDI: 0000000000000003 [ 1278.541043][T15368] RBP: 00007f2ce83f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1278.541055][T15368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1278.541066][T15368] R13: 00007f2cea416128 R14: 00007f2cea416090 R15: 00007ffc37445488 [ 1278.541096][T15368] [ 1278.855370][T15373] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13146'. [ 1279.089479][T15379] lo: entered allmulticast mode [ 1279.206627][T15383] lo: left allmulticast mode [ 1280.009560][T15405] nbd: couldn't find device at index 0 [ 1280.428432][T15417] IPVS: Scheduler module ip_vs_ not found [ 1280.436409][T15422] netlink: 'syz.2.13162': attribute type 1 has an invalid length. [ 1280.540186][T15417] bond3: option all_slaves_active: invalid value (13) [ 1280.590790][T15417] bond3 (unregistering): Released all slaves [ 1280.759551][T15433] __nla_validate_parse: 8 callbacks suppressed [ 1280.759571][T15433] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13163'. [ 1281.121998][T15450] bond0: (slave veth3): Enslaving as an active interface with a down link [ 1281.160075][T15456] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13167'. [ 1281.264631][T15446] bond0: (slave veth5): Enslaving as an active interface with a down link [ 1281.470044][T15469] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13173'. [ 1281.707013][T15489] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13178'. [ 1281.727836][T15476] IPVS: Scheduler module ip_vs_ not found [ 1281.744198][T15489] netlink: 39 bytes leftover after parsing attributes in process `syz.3.13178'. [ 1281.775387][T15492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13176'. [ 1281.796387][T15492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13176'. [ 1281.800911][T15491] bond3: option all_slaves_active: invalid value (13) [ 1281.859178][T15494] netlink: 'syz.4.13179': attribute type 1 has an invalid length. [ 1282.234617][T15491] bond3 (unregistering): Released all slaves [ 1282.309288][T15489] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13178'. [ 1282.361522][T15489] netlink: 39 bytes leftover after parsing attributes in process `syz.3.13178'. [ 1282.410704][T15489] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13178'. [ 1282.863218][T15516] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1282.972756][T15516] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1283.050076][T15516] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1283.152474][T15516] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1283.290951][T15531] IPVS: Scheduler module ip_vs_ not found [ 1283.415748][T15531] bond3: option all_slaves_active: invalid value (13) [ 1283.441042][T15531] bond3 (unregistering): Released all slaves [ 1283.550120][ T1658] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.699070][ T1655] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.717250][ T1655] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.768458][ T1654] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1283.780605][T15552] netdevsim netdevsim1 : renamed from netdevsim0 (while UP) [ 1283.979827][T15564] syzkaller1: entered promiscuous mode [ 1283.992634][T15564] syzkaller1: entered allmulticast mode [ 1286.683377][T15547] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1286.843750][T15592] netlink: 'syz.3.13206': attribute type 1 has an invalid length. [ 1286.879535][T15596] __nla_validate_parse: 29 callbacks suppressed [ 1286.879554][T15596] netlink: 44 bytes leftover after parsing attributes in process `syz.1.13205'. [ 1287.259065][T15621] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13214'. [ 1288.230256][T15645] lo speed is unknown, defaulting to 1000 [ 1288.534926][T15677] netlink: 'syz.0.13231': attribute type 2 has an invalid length. [ 1291.104605][T15649] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1291.156813][T15680] netlink: 120 bytes leftover after parsing attributes in process `syz.2.13233'. [ 1291.166070][T15680] netlink: 'syz.2.13233': attribute type 1 has an invalid length. [ 1291.194254][T15680] netlink: 'syz.2.13233': attribute type 1 has an invalid length. [ 1291.406014][T15694] geneve2: entered promiscuous mode [ 1291.432885][ T1655] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 53205 - 0 [ 1291.444875][ T1655] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 53205 - 0 [ 1291.485137][T15689] lo speed is unknown, defaulting to 1000 [ 1291.493738][ T1655] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 53205 - 0 [ 1291.520341][ T1655] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 53205 - 0 [ 1291.850516][T15708] syzkaller1: entered promiscuous mode [ 1291.876730][T15708] syzkaller1: entered allmulticast mode [ 1291.901727][T15708] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13241'. [ 1291.918787][T15717] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13244'. [ 1291.928756][T15708] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 1292.401417][T15731] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13248'. [ 1293.105052][T15750] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13250'. [ 1293.222540][T15752] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13251'. [ 1293.403991][T15766] syzkaller1: entered promiscuous mode [ 1293.409674][T15766] syzkaller1: entered allmulticast mode [ 1293.448956][T15770] dummy0: left allmulticast mode [ 1293.458850][T15770] dummy0: left promiscuous mode [ 1293.490206][T15770] bridge0: port 3(dummy0) entered disabled state [ 1293.527032][T15770] bridge_slave_0: left allmulticast mode [ 1293.534227][T15770] bridge_slave_0: left promiscuous mode [ 1293.540347][T15770] bridge0: port 1(bridge_slave_0) entered disabled state [ 1293.551621][T15770] bridge_slave_1: left allmulticast mode [ 1293.559522][T15770] bridge_slave_1: left promiscuous mode [ 1293.565453][T15770] bridge0: port 2(bridge_slave_1) entered disabled state [ 1293.577083][T15770] bond0: (slave bond_slave_0): Releasing backup interface [ 1293.588626][T15770] bond0: (slave bond_slave_1): Releasing backup interface [ 1293.608679][T15770] team0: Port device team_slave_0 removed [ 1293.628434][T15770] team0: Port device team_slave_1 removed [ 1293.635235][T15770] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1293.653958][T15770] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1293.677794][T15770] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1294.086578][T15784] nbd4: detected capacity change from 0 to 63 [ 1294.110829][T15794] netlink: 36 bytes leftover after parsing attributes in process `syz.2.13264'. [ 1294.122534][T15790] block nbd4: NBD_DISCONNECT [ 1294.151981][T15790] block nbd4: Disconnected due to user request. [ 1294.178437][T15794] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13264'. [ 1294.189247][T15790] block nbd4: shutting down sockets [ 1294.222950][T15794] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13264'. [ 1294.223836][T15800] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13264'. [ 1294.750810][T15826] netlink: 'syz.4.13271': attribute type 1 has an invalid length. [ 1294.767655][T15826] netlink: 224 bytes leftover after parsing attributes in process `syz.4.13271'. [ 1295.337680][T15840] lo speed is unknown, defaulting to 1000 [ 1295.361028][T15852] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1296.266044][T15896] netlink: 'syz.0.13291': attribute type 33 has an invalid length. [ 1296.285518][T15897] netlink: 'syz.0.13291': attribute type 33 has an invalid length. [ 1296.462118][T15901] netlink: 'syz.0.13293': attribute type 8 has an invalid length. [ 1297.329647][T15931] netlink: 'syz.1.13303': attribute type 1 has an invalid length. [ 1297.366565][T15931] __nla_validate_parse: 6 callbacks suppressed [ 1297.366583][T15931] netlink: 96 bytes leftover after parsing attributes in process `syz.1.13303'. [ 1297.399580][T15931] netlink: 658 bytes leftover after parsing attributes in process `syz.1.13303'. [ 1297.460067][T15931] netlink: 1 bytes leftover after parsing attributes in process `syz.1.13303'. [ 1297.641482][T15945] netlink: 'syz.3.13308': attribute type 1 has an invalid length. [ 1297.680440][T15945] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1297.749211][T15951] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13311'. [ 1297.778502][T15952] netlink: 'syz.0.13311': attribute type 27 has an invalid length. [ 1297.927662][T15953] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1297.942642][T15953] 8021q: adding VLAN 0 to HW filter on device team0 [ 1298.008451][T15953] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1298.090043][T15952] geneve2: left promiscuous mode [ 1298.372243][T15979] IPv6: addrconf: prefix option has invalid lifetime [ 1298.726847][ T1654] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1298.735362][ T1654] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 53205 - 0 [ 1298.759393][ T1654] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1298.796909][ T1654] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 53205 - 0 [ 1298.805745][T15989] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13322'. [ 1298.896742][T15992] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13322'. [ 1298.898592][T15994] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13324'. [ 1298.975934][ T1654] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1298.989338][ T1654] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 53205 - 0 [ 1299.013266][ T1654] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1299.032085][ T1654] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 53205 - 0 [ 1299.117173][T15999] netlink: 'syz.2.13325': attribute type 11 has an invalid length. [ 1299.241317][T15994] tipc: Enabled bearer , priority 0 [ 1299.370568][T16020] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13328'. [ 1299.386650][T16020] netdevsim0: renamed from gretap0 (while UP) [ 1299.429315][T16020] netdevsim0: entered allmulticast mode [ 1299.481398][T16020] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1299.518219][T15998] syzkaller0: entered promiscuous mode [ 1299.523834][T15998] syzkaller0: entered allmulticast mode [ 1299.541259][T15993] tipc: Resetting bearer [ 1299.564901][T16025] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13331'. [ 1299.575240][T15993] tipc: Disabling bearer [ 1299.764885][T16031] syzkaller0: entered promiscuous mode [ 1299.809130][T16031] syzkaller0: entered allmulticast mode [ 1299.832253][T16036] netlink: 'syz.4.13334': attribute type 1 has an invalid length. [ 1299.868419][T16036] netlink: 56 bytes leftover after parsing attributes in process `syz.4.13334'. [ 1300.010720][T16050] netlink: 'syz.2.13338': attribute type 1 has an invalid length. [ 1300.076511][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1302.504391][T16070] tipc: Enabling of bearer rejected, failed to enable media [ 1302.711190][T16082] bond3 (unregistering): Released all slaves [ 1302.744758][T16088] __nla_validate_parse: 2 callbacks suppressed [ 1302.744778][T16088] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13349'. [ 1303.052536][T16107] netlink: 104 bytes leftover after parsing attributes in process `syz.0.13356'. [ 1303.391520][T16123] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.427166][T16123] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.436244][T16123] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.506760][T16126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.518154][T16126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.538912][T16126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.568564][T16126] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13361'. [ 1303.725887][T16128] lo speed is unknown, defaulting to 1000 [ 1303.805961][T16137] syzkaller1: entered promiscuous mode [ 1303.811539][T16137] syzkaller1: entered allmulticast mode [ 1303.892947][T16143] netlink: 32 bytes leftover after parsing attributes in process `syz.4.13366'. [ 1303.988122][T16146] netlink: 'syz.2.13367': attribute type 62 has an invalid length. [ 1304.031569][T16146] netlink: 'syz.2.13367': attribute type 2 has an invalid length. [ 1305.497948][T16213] bond6: option ad_actor_sys_prio: invalid value (0) [ 1305.504770][T16213] bond6: option ad_actor_sys_prio: allowed values 1 - 65535 [ 1305.563930][T16213] bond6 (unregistering): Released all slaves [ 1305.721034][T16220] vlan2: entered promiscuous mode [ 1305.737058][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5660 ms [ 1305.745140][ C1] lec:lec_tx_timeout: lec0 [ 1305.766641][T16220] syz_tun: entered promiscuous mode [ 1306.203418][T16251] netlink: 'syz.1.13402': attribute type 2 has an invalid length. [ 1306.212184][T16248] macsec0: entered promiscuous mode [ 1306.252994][T16248] macsec0: entered allmulticast mode [ 1306.283926][T16253] openvswitch: netlink: Duplicate key (type 21). [ 1306.527562][T16259] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1307.643517][T16318] lo speed is unknown, defaulting to 1000 [ 1307.677287][T16310] netlink: 'syz.1.13415': attribute type 1 has an invalid length. [ 1307.915159][T16330] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 1308.085364][T16342] syz.3.13425: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1308.086287][T16341] vlan2: entered promiscuous mode [ 1308.105814][T16341] macvlan0: entered promiscuous mode [ 1308.114264][T16344] __nla_validate_parse: 9 callbacks suppressed [ 1308.114283][T16344] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13426'. [ 1308.133055][T16342] CPU: 1 UID: 0 PID: 16342 Comm: syz.3.13425 Not tainted syzkaller #0 PREEMPT(full) [ 1308.133082][T16342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1308.133094][T16342] Call Trace: [ 1308.133102][T16342] [ 1308.133110][T16342] dump_stack_lvl+0xe8/0x150 [ 1308.133141][T16342] warn_alloc+0x249/0x340 [ 1308.133164][T16342] ? stack_trace_save+0xa9/0x100 [ 1308.133188][T16342] ? __pfx_warn_alloc+0x10/0x10 [ 1308.133215][T16342] ? kasan_save_track+0x4f/0x80 [ 1308.133233][T16342] ? kasan_save_track+0x3e/0x80 [ 1308.133250][T16342] ? __kasan_kmalloc+0x93/0xb0 [ 1308.133268][T16342] ? __kmalloc_cache_noprof+0x31c/0x660 [ 1308.133286][T16342] ? xskq_create+0x56/0x170 [ 1308.133309][T16342] ? xsk_setsockopt+0x54c/0x990 [ 1308.133327][T16342] ? do_sock_setsockopt+0x17c/0x1b0 [ 1308.133353][T16342] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 1308.133377][T16342] ? do_syscall_64+0x14d/0xf80 [ 1308.133406][T16342] __vmalloc_node_range_noprof+0x132/0x1730 [ 1308.133458][T16342] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1308.133484][T16342] ? __kasan_kmalloc+0x93/0xb0 [ 1308.133514][T16342] vmalloc_user_noprof+0xad/0xe0 [ 1308.133533][T16342] ? xskq_create+0xbf/0x170 [ 1308.133564][T16342] xskq_create+0xbf/0x170 [ 1308.133588][T16342] xsk_init_queue+0x8a/0xe0 [ 1308.133613][T16342] xsk_setsockopt+0x54c/0x990 [ 1308.133637][T16342] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1308.133658][T16342] ? __pfx_aa_sk_perm+0x10/0x10 [ 1308.133685][T16342] ? aa_sock_opt_perm+0xff/0x1a0 [ 1308.133711][T16342] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1308.133731][T16342] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1308.133754][T16342] do_sock_setsockopt+0x17c/0x1b0 [ 1308.133785][T16342] __x64_sys_setsockopt+0x13d/0x1b0 [ 1308.133817][T16342] do_syscall_64+0x14d/0xf80 [ 1308.133841][T16342] ? trace_irq_disable+0x3b/0x150 [ 1308.133865][T16342] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1308.133884][T16342] ? clear_bhb_loop+0x40/0x90 [ 1308.133907][T16342] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1308.133925][T16342] RIP: 0033:0x7ff43a79c799 [ 1308.133942][T16342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1308.133959][T16342] RSP: 002b:00007ff43b5b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1308.133978][T16342] RAX: ffffffffffffffda RBX: 00007ff43aa15fa0 RCX: 00007ff43a79c799 [ 1308.133992][T16342] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 1308.134004][T16342] RBP: 00007ff43a832c99 R08: 0000000000000004 R09: 0000000000000000 [ 1308.134016][T16342] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1308.134027][T16342] R13: 00007ff43aa16038 R14: 00007ff43aa15fa0 R15: 00007ffd54d6cd08 [ 1308.134057][T16342] [ 1308.134152][T16342] Mem-Info: [ 1308.407673][T16342] active_anon:5818 inactive_anon:0 isolated_anon:0 [ 1308.407673][T16342] active_file:3770 inactive_file:40452 isolated_file:0 [ 1308.407673][T16342] unevictable:768 dirty:172 writeback:0 [ 1308.407673][T16342] slab_reclaimable:20123 slab_unreclaimable:98813 [ 1308.407673][T16342] mapped:32134 shmem:1360 pagetables:1282 [ 1308.407673][T16342] sec_pagetables:0 bounce:0 [ 1308.407673][T16342] kernel_misc_reclaimable:0 [ 1308.407673][T16342] free:1307644 free_pcp:18793 free_cma:0 [ 1308.453107][T16342] Node 0 active_anon:23272kB inactive_anon:0kB active_file:15080kB inactive_file:161600kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:128536kB dirty:688kB writeback:0kB shmem:3904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12284kB pagetables:4972kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1308.489945][T16342] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1308.511588][T16336] lo speed is unknown, defaulting to 1000 [ 1308.545479][T16342] Node 0 DMA free:15212kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:148kB local_pcp:72kB free_cma:0kB [ 1308.551091][T16336] lo speed is unknown, defaulting to 1000 [ 1308.585977][T16336] lo speed is unknown, defaulting to 1000 [ 1308.604400][T16336] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1308.636533][T16342] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 1308.642994][T16342] Node 0 DMA32 free:1300688kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23272kB inactive_anon:0kB active_file:15080kB inactive_file:161600kB unevictable:1536kB writepending:688kB zspages:0kB present:3129332kB managed:2552736kB mlocked:0kB bounce:0kB free_pcp:42140kB local_pcp:21980kB free_cma:0kB [ 1308.736974][T16342] lowmem_reserve[]: 0 0 0 0 0 [ 1308.748191][T16342] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 1308.795382][T16353] netlink: 16 bytes leftover after parsing attributes in process `syz.4.13427'. [ 1308.816683][T16353] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13427'. [ 1308.825666][T16353] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13427'. [ 1308.834738][T16342] lowmem_reserve[]: 0 0 0 0 0 [ 1308.840070][T16336] lo speed is unknown, defaulting to 1000 [ 1308.840115][T16342] Node 1 [ 1308.855037][T16336] lo speed is unknown, defaulting to 1000 [ 1308.858705][T16342] Normal free:3914748kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:32792kB local_pcp:14496kB free_cma:0kB [ 1308.878676][T16336] lo speed is unknown, defaulting to 1000 [ 1308.950159][T16336] lo speed is unknown, defaulting to 1000 [ 1308.976015][T16342] lowmem_reserve[]: 0 0 0 0 0 [ 1308.980054][T16336] lo speed is unknown, defaulting to 1000 [ 1308.994169][T16342] Node 0 DMA: 1*4kB (U) 1*8kB (U) 2*16kB (U) 2*32kB (U) 0*64kB 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 1*4096kB (M) = 15212kB [ 1309.016389][T16336] lo speed is unknown, defaulting to 1000 [ 1309.030461][T16342] Node 0 DMA32: 5782*4kB (UME) 7576*8kB (UME) 5589*16kB (UME) 2752*32kB (UME) 826*64kB (UME) 529*128kB (UME) 540*256kB (UME) 409*512kB (UME) 292*1024kB (UM) 133*2048kB (UM) 0*4096kB = 1300840kB [ 1309.105416][T16342] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1309.178896][T16342] Node 1 Normal: 2*4kB (UM) 9*8kB (UM) 14*16kB (UM) 4*32kB (UM) 8*64kB (UM) 7*128kB (UM) 7*256kB (UM) 3*512kB (UM) 4*1024kB (UM) 1*2048kB (U) 953*4096kB (UM) = 3914800kB [ 1309.210361][T16342] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1309.293246][T16342] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1309.318222][T16370] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 1309.346598][T16342] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1309.367654][T16342] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1309.380202][T16342] 45578 total pagecache pages [ 1309.385928][T16342] 0 pages in swap cache [ 1309.412203][T16342] Free swap = 124996kB [ 1309.443494][T16342] Total swap = 124996kB [ 1309.456573][T16342] 2097051 pages RAM [ 1309.469019][T16342] 0 pages HighMem/MovableOnly [ 1309.496545][T16342] 427031 pages reserved [ 1309.500837][T16342] 0 pages cma reserved [ 1309.515427][T16379] netlink: 104 bytes leftover after parsing attributes in process `syz.2.13435'. [ 1309.730044][T16385] bond6: entered promiscuous mode [ 1309.735707][T16385] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1309.910569][T16399] netlink: 592 bytes leftover after parsing attributes in process `syz.2.13442'. [ 1310.013109][T16399] netlink: 'syz.2.13442': attribute type 11 has an invalid length. [ 1310.203048][T16421] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13449'. [ 1310.469198][T16428] syzkaller1: entered promiscuous mode [ 1310.487287][T16428] syzkaller1: entered allmulticast mode [ 1310.626054][T16420] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13446'. [ 1310.811127][T16440] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1311.262144][T16467] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13461'. [ 1311.494578][T16483] IPv6: addrconf: prefix option has invalid lifetime [ 1311.680057][T16490] xt_hashlimit: size too large, truncated to 1048576 [ 1311.720547][T16492] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13468'. [ 1311.936671][T16500] netlink: 'syz.0.13470': attribute type 10 has an invalid length. [ 1311.959357][T16500] team0: entered promiscuous mode [ 1311.964483][T16500] macvlan4: entered promiscuous mode [ 1312.001797][T16500] team0: entered allmulticast mode [ 1312.024653][T16500] macvlan4: entered allmulticast mode [ 1312.033500][T16500] 8021q: adding VLAN 0 to HW filter on device team0 [ 1312.047561][T16500] bridge0: port 1(team0) entered blocking state [ 1312.067022][T16500] bridge0: port 1(team0) entered disabled state [ 1312.263424][T16517] netlink: 'syz.1.13476': attribute type 4 has an invalid length. [ 1312.347065][T16521] IPv6: addrconf: prefix option has invalid lifetime [ 1312.573374][T16524] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1312.631662][T16524] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 1312.829605][T16532] macvlan0: entered promiscuous mode [ 1312.870527][T16532] macvlan0: entered allmulticast mode [ 1312.916794][T16532] bond5: (slave macvlan0): Error -98 calling set_mac_address [ 1313.183138][T16561] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1313.221996][T16565] IPv6: addrconf: prefix option has invalid lifetime [ 1313.227234][T16561] __nla_validate_parse: 5 callbacks suppressed [ 1313.227251][T16561] netlink: 56 bytes leftover after parsing attributes in process `syz.0.13491'. [ 1313.338896][T16566] IPVS: Scheduler module ip_vs_ not found [ 1313.404360][T16566] bond2: option all_slaves_active: invalid value (13) [ 1313.447303][T16566] bond2 (unregistering): Released all slaves [ 1313.559219][T16584] syzkaller1: entered promiscuous mode [ 1313.564888][T16584] syzkaller1: entered allmulticast mode [ 1313.932938][T16595] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1314.255084][T16613] vlan0: entered promiscuous mode [ 1314.409296][T16620] bridge5: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1314.471671][T16621] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13508'. [ 1314.504390][T16628] netlink: 'syz.3.13511': attribute type 1 has an invalid length. [ 1314.546699][T16628] netlink: 224 bytes leftover after parsing attributes in process `syz.3.13511'. [ 1314.557463][T16627] bridge0: port 1(team0) entered disabled state [ 1314.571949][T16627] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1314.750716][T16641] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13516'. [ 1314.775705][T16647] sctp: [Deprecated]: syz.4.13514 (pid 16647) Use of int in maxseg socket option. [ 1314.775705][T16647] Use struct sctp_assoc_value instead [ 1314.927484][T16656] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1314.980604][T16655] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1315.182263][T16674] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13525'. [ 1315.232641][T16674] bond0: entered promiscuous mode [ 1315.277015][T16674] batadv_slave_0: entered promiscuous mode [ 1317.110477][ T5760] Bluetooth: hci4: command 0x0406 tx timeout [ 1317.784200][T16688] bridge3: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1317.849059][T16678] lo speed is unknown, defaulting to 1000 [ 1318.212940][T16702] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13531'. [ 1318.222417][T16702] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13531'. [ 1318.272116][T16702] netlink: 'syz.3.13531': attribute type 6 has an invalid length. [ 1318.348629][T16706] xt_CT: No such helper "syz1" [ 1318.403927][T16724] nft_compat: unsupported protocol 5 [ 1318.493780][T16705] lo speed is unknown, defaulting to 1000 [ 1318.562501][T16678] lo speed is unknown, defaulting to 1000 [ 1318.801128][T16705] lo speed is unknown, defaulting to 1000 [ 1319.247579][T16737] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13538'. [ 1319.272718][T16737] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13538'. [ 1319.322196][T16739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13539'. [ 1319.337820][T16739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13539'. [ 1321.223870][T16710] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1321.533757][T16761] syzkaller0: entered promiscuous mode [ 1321.564411][T16761] syzkaller0: entered allmulticast mode [ 1321.595922][T16772] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13550'. [ 1321.616642][T16765] netlink: 'syz.3.13547': attribute type 9 has an invalid length. [ 1321.641533][T16772] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13550'. [ 1321.656742][T16774] nbd3: detected capacity change from 0 to 127 [ 1321.679945][T16770] bond7: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1321.690764][ T5838] block nbd3: Receive control failed (result -32) [ 1321.701943][T16770] bond7 (unregistering): Released all slaves [ 1321.766965][T16778] netlink: 20 bytes leftover after parsing attributes in process `syz.4.13552'. [ 1321.837804][T16780] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13553'. [ 1324.679046][T16811] netlink: 44 bytes leftover after parsing attributes in process `syz.1.13560'. [ 1324.744471][T16811] netlink: 'syz.1.13560': attribute type 5 has an invalid length. [ 1324.791617][T16818] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13563'. [ 1324.851268][T16820] netlink: 428 bytes leftover after parsing attributes in process `syz.0.13563'. [ 1324.917298][T16831] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13560'. [ 1324.935952][T16819] lo speed is unknown, defaulting to 1000 [ 1324.958562][T16820] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13563'. [ 1325.163687][T16819] lo speed is unknown, defaulting to 1000 [ 1325.381634][T16817] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1325.724322][T16860] netlink: 'syz.1.13569': attribute type 9 has an invalid length. [ 1326.922811][T16892] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13579'. [ 1327.032695][T16893] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13580'. [ 1327.509797][T16906] lo speed is unknown, defaulting to 1000 [ 1327.513709][T16911] netlink: 'syz.4.13585': attribute type 1 has an invalid length. [ 1327.563824][T16911] netlink: 224 bytes leftover after parsing attributes in process `syz.4.13585'. [ 1327.583769][ T47] IPVS: starting estimator thread 0... [ 1327.611994][T16914] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13586'. [ 1327.621730][T16914] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13586'. [ 1327.696586][T16915] IPVS: using max 37 ests per chain, 88800 per kthread [ 1328.028528][T16932] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 1328.252884][T16904] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1328.342162][T16906] lo speed is unknown, defaulting to 1000 [ 1328.350685][T16949] syzkaller1: entered promiscuous mode [ 1328.359199][T16949] syzkaller1: entered allmulticast mode [ 1329.218278][T16985] netlink: 'syz.0.13601': attribute type 1 has an invalid length. [ 1329.243980][T16982] syzkaller0: entered promiscuous mode [ 1329.249618][T16982] syzkaller0: entered allmulticast mode [ 1329.505405][T16993] netlink: 'syz.0.13603': attribute type 3 has an invalid length. [ 1329.715926][T17000] xt_HMARK: spi-set and port-set can't be combined [ 1329.837582][T17000] __nla_validate_parse: 3 callbacks suppressed [ 1329.837603][T17000] netlink: 40 bytes leftover after parsing attributes in process `syz.0.13603'. [ 1330.096734][T17015] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13608'. [ 1330.134169][T16993] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1330.187492][T16993] team0: left promiscuous mode [ 1330.192411][T16993] macvlan4: left promiscuous mode [ 1330.228538][T16993] team0: left allmulticast mode [ 1330.233445][T16993] macvlan4: left allmulticast mode [ 1330.269206][T16993] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1330.355801][ T47] lo speed is unknown, defaulting to 1000 [ 1330.363657][ T47] syz2: Port: 1 Link ACTIVE [ 1330.426756][T17024] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13606'. [ 1330.571348][T17026] lo speed is unknown, defaulting to 1000 [ 1330.879928][T17037] netlink: 120 bytes leftover after parsing attributes in process `syz.4.13613'. [ 1330.927057][T17037] netlink: 'syz.4.13613': attribute type 1 has an invalid length. [ 1331.050377][T17026] lo speed is unknown, defaulting to 1000 [ 1331.096574][T17037] netlink: 64 bytes leftover after parsing attributes in process `syz.4.13613'. [ 1331.169444][T17025] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1331.948405][T17076] bridge0: entered allmulticast mode [ 1332.243946][T17081] lo speed is unknown, defaulting to 1000 [ 1333.617583][T17081] lo speed is unknown, defaulting to 1000 [ 1333.793883][T17126] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13632'. [ 1333.838618][T25016] lec:lec_start_xmit: lec0:No lecd attached [ 1333.974712][T17133] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.13635'. [ 1334.009961][T17133] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.13635'. [ 1334.090174][T17139] x_tables: duplicate entry at hook 3 [ 1334.615788][T17160] IPVS: Scheduler module ip_vs_ not found [ 1334.809501][T17172] netlink: 'syz.3.13645': attribute type 10 has an invalid length. [ 1337.149280][T17160] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 1337.153826][T17172] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1337.242225][T17197] atomic_op ffff8880537a5998 conn xmit_atomic 0000000000000000 [ 1337.480760][T17207] lo speed is unknown, defaulting to 1000 [ 1337.703307][T17220] syzkaller1: entered promiscuous mode [ 1337.716713][T17220] syzkaller1: entered allmulticast mode [ 1337.789076][T17207] lo speed is unknown, defaulting to 1000 [ 1337.912336][T17228] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13659'. [ 1338.122516][T17228] 8021q: VLANs not supported on ip6tnl0 [ 1338.569509][T17265] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13669'. [ 1338.591117][T17265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13669'. [ 1338.646732][T17268] IPVS: length: 35 != 136824036792 [ 1338.660670][T17265] netlink: 48 bytes leftover after parsing attributes in process `syz.2.13669'. [ 1338.846541][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 1338.854843][ C1] lec:lec_tx_timeout: lec0 [ 1339.148563][T17284] netlink: 120 bytes leftover after parsing attributes in process `syz.2.13675'. [ 1339.177540][T17284] netlink: 'syz.2.13675': attribute type 1 has an invalid length. [ 1339.185515][T17280] IPVS: Scheduler module ip_vs_ not found [ 1339.222043][T17284] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13675'. [ 1339.290241][T17280] bond7: option all_slaves_active: invalid value (13) [ 1339.381966][T17280] bond7 (unregistering): Released all slaves [ 1339.717524][T17310] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13679'. [ 1339.772815][T17310] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13679'. [ 1339.826892][T17310] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13679'. [ 1340.003975][T17327] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13688'. [ 1340.211568][T17333] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1340.476205][T17339] IPVS: Scheduler module ip_vs_ not found [ 1340.557806][T17339] bond7: option all_slaves_active: invalid value (13) [ 1340.598193][T17339] bond7 (unregistering): Released all slaves [ 1340.736160][T17355] syzkaller1: entered promiscuous mode [ 1340.757078][T17355] syzkaller1: entered allmulticast mode [ 1340.775557][T17354] netlink: 'syz.2.13697': attribute type 13 has an invalid length. [ 1340.854528][T17354] bridge0: port 1(bridge_slave_0) entered blocking state [ 1340.861822][T17354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1340.926283][T17371] netlink: 'syz.0.13700': attribute type 1 has an invalid length. [ 1341.069130][ T4053] lo speed is unknown, defaulting to 1000 [ 1341.707727][T17413] netlink: 'syz.2.13711': attribute type 1 has an invalid length. [ 1342.003604][T17424] lo speed is unknown, defaulting to 1000 [ 1342.147929][T17427] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 1342.695112][T17453] netlink: 'syz.4.13725': attribute type 1 has an invalid length. [ 1342.811922][T17457] batadv_slave_1: entered promiscuous mode [ 1342.832321][T17456] batadv_slave_1: left promiscuous mode [ 1343.008223][T17444] lo speed is unknown, defaulting to 1000 [ 1343.031115][T17424] lo speed is unknown, defaulting to 1000 [ 1343.449949][T17442] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1343.620479][T17469] lo speed is unknown, defaulting to 1000 [ 1343.935201][T17467] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1344.095801][T17488] __nla_validate_parse: 16 callbacks suppressed [ 1344.095820][T17488] netlink: 72 bytes leftover after parsing attributes in process `syz.1.13737'. [ 1344.181167][T17495] IPv6: addrconf: prefix option has invalid lifetime [ 1344.278400][T17469] lo speed is unknown, defaulting to 1000 [ 1344.391417][T17444] lo speed is unknown, defaulting to 1000 [ 1345.089668][T17516] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13744'. [ 1345.122048][T17519] lo speed is unknown, defaulting to 1000 [ 1345.569036][T17535] netlink: 'syz.4.13750': attribute type 15 has an invalid length. [ 1345.580713][T17535] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1345.601253][T17535] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13750'. [ 1345.651419][T17536] netlink: 'syz.0.13749': attribute type 6 has an invalid length. [ 1345.674079][T17538] x_tables: duplicate underflow at hook 2 [ 1345.968739][T17519] lo speed is unknown, defaulting to 1000 [ 1346.018261][T17547] veth0: Caught tx_queue_len zero misconfig [ 1346.431345][T17566] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13758'. [ 1346.645325][T17572] syzkaller1: entered promiscuous mode [ 1346.651393][T17572] syzkaller1: entered allmulticast mode [ 1346.662449][T17574] syzkaller0: entered promiscuous mode [ 1346.668280][T17574] syzkaller0: entered allmulticast mode [ 1347.011203][T17587] netlink: 'syz.1.13766': attribute type 10 has an invalid length. [ 1347.023927][T17587] 8021q: adding VLAN 0 to HW filter on device team0 [ 1347.034911][T17587] bond0: (slave team0): Enslaving as an active interface with an up link [ 1347.060102][T17584] bridge5: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1347.072346][T17590] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 1347.193863][T17594] netlink: 'syz.3.13770': attribute type 2 has an invalid length. [ 1347.212105][T17595] netlink: 36 bytes leftover after parsing attributes in process `syz.1.13766'. [ 1347.304923][T17594] 9: entered promiscuous mode [ 1347.730184][T17618] dvmrp0: entered allmulticast mode [ 1348.097696][T17627] lo speed is unknown, defaulting to 1000 [ 1348.469396][T17638] netlink: 104 bytes leftover after parsing attributes in process `syz.4.13781'. [ 1348.580364][T17638] netlink: 32 bytes leftover after parsing attributes in process `syz.4.13781'. [ 1348.593963][T17627] lo speed is unknown, defaulting to 1000 [ 1348.806344][T17648] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13784'. [ 1348.936842][T17653] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13783'. [ 1349.049695][T17649] netlink: 17 bytes leftover after parsing attributes in process `syz.2.13783'. [ 1349.066792][T17649] tunl0: Caught tx_queue_len zero misconfig [ 1349.298246][T17669] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13791'. [ 1349.352585][T17669] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13791'. [ 1349.460985][T17667] lo speed is unknown, defaulting to 1000 [ 1349.549402][T17677] netlink: 84 bytes leftover after parsing attributes in process `syz.3.13792'. [ 1350.031195][T17667] lo speed is unknown, defaulting to 1000 [ 1350.091525][T17672] lo speed is unknown, defaulting to 1000 [ 1350.263604][T17665] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1350.602765][T17689] lo speed is unknown, defaulting to 1000 [ 1350.609692][T17672] lo speed is unknown, defaulting to 1000 [ 1350.996204][T17689] lo speed is unknown, defaulting to 1000 [ 1351.273302][T17732] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13808'. [ 1351.308728][T17732] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13808'. [ 1354.310846][T17773] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13819'. [ 1354.320725][T17773] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13819'. [ 1354.483524][T17777] lo speed is unknown, defaulting to 1000 [ 1354.865882][T17789] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1354.888742][T17777] lo speed is unknown, defaulting to 1000 [ 1355.133684][T17793] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13823'. [ 1355.208016][T17775] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1355.438102][T17802] netlink: 'syz.0.13827': attribute type 2 has an invalid length. [ 1355.508822][T17806] FAULT_INJECTION: forcing a failure. [ 1355.508822][T17806] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1355.536805][T17806] CPU: 0 UID: 0 PID: 17806 Comm: syz.3.13828 Not tainted syzkaller #0 PREEMPT(full) [ 1355.536833][T17806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1355.536844][T17806] Call Trace: [ 1355.536852][T17806] [ 1355.536861][T17806] dump_stack_lvl+0xe8/0x150 [ 1355.536892][T17806] should_fail_ex+0x412/0x560 [ 1355.536926][T17806] _copy_from_user+0x2d/0xb0 [ 1355.536950][T17806] ___sys_sendmsg+0x1c6/0x360 [ 1355.536972][T17806] ? __pfx____sys_sendmsg+0x10/0x10 [ 1355.537012][T17806] ? __fget_files+0x2a/0x420 [ 1355.537032][T17806] ? __fget_files+0x3a0/0x420 [ 1355.537060][T17806] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1355.537078][T17806] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1355.537099][T17806] ? __pfx_ksys_write+0x10/0x10 [ 1355.537124][T17806] do_syscall_64+0x14d/0xf80 [ 1355.537146][T17806] ? trace_irq_disable+0x3b/0x150 [ 1355.537168][T17806] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1355.537184][T17806] ? clear_bhb_loop+0x40/0x90 [ 1355.537201][T17806] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1355.537217][T17806] RIP: 0033:0x7ff43a79c799 [ 1355.537233][T17806] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1355.537247][T17806] RSP: 002b:00007ff43b5b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1355.537264][T17806] RAX: ffffffffffffffda RBX: 00007ff43aa15fa0 RCX: 00007ff43a79c799 [ 1355.537275][T17806] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1355.537286][T17806] RBP: 00007ff43b5b0090 R08: 0000000000000000 R09: 0000000000000000 [ 1355.537295][T17806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1355.537305][T17806] R13: 00007ff43aa16038 R14: 00007ff43aa15fa0 R15: 00007ffd54d6cd08 [ 1355.537328][T17806] [ 1355.596282][T17811] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1355.737779][T17812] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13829'. [ 1355.910979][T17816] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13832'. [ 1355.930375][T17816] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13832'. [ 1356.262064][T17834] 5n: entered promiscuous mode [ 1356.452924][T17848] FAULT_INJECTION: forcing a failure. [ 1356.452924][T17848] name failslab, interval 1, probability 0, space 0, times 0 [ 1356.468363][T17849] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13843'. [ 1356.513914][T17848] CPU: 0 UID: 0 PID: 17848 Comm: syz.0.13842 Not tainted syzkaller #0 PREEMPT(full) [ 1356.513940][T17848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1356.513952][T17848] Call Trace: [ 1356.513960][T17848] [ 1356.513969][T17848] dump_stack_lvl+0xe8/0x150 [ 1356.513999][T17848] should_fail_ex+0x412/0x560 [ 1356.514027][T17848] should_failslab+0xa8/0x100 [ 1356.514052][T17848] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1356.514073][T17848] ? __alloc_skb+0x186/0x7d0 [ 1356.514098][T17848] ? __alloc_skb+0x1d0/0x7d0 [ 1356.514120][T17848] ? __local_bh_enable_ip+0xd0/0x130 [ 1356.514148][T17848] __alloc_skb+0x1d0/0x7d0 [ 1356.514177][T17848] netlink_sendmsg+0x5d4/0xb40 [ 1356.514211][T17848] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1356.514240][T17848] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1356.514265][T17848] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1356.514288][T17848] ____sys_sendmsg+0x972/0x9f0 [ 1356.514315][T17848] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1356.514342][T17848] ? import_iovec+0x73/0xa0 [ 1356.514372][T17848] ___sys_sendmsg+0x2a5/0x360 [ 1356.514404][T17848] ? __pfx____sys_sendmsg+0x10/0x10 [ 1356.514454][T17848] ? __fget_files+0x2a/0x420 [ 1356.514478][T17848] ? __fget_files+0x3a0/0x420 [ 1356.514512][T17848] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1356.514534][T17848] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1356.514561][T17848] ? __pfx_ksys_write+0x10/0x10 [ 1356.514591][T17848] do_syscall_64+0x14d/0xf80 [ 1356.514616][T17848] ? trace_irq_disable+0x3b/0x150 [ 1356.514641][T17848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.514660][T17848] ? clear_bhb_loop+0x40/0x90 [ 1356.514682][T17848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.514701][T17848] RIP: 0033:0x7f2cea19c799 [ 1356.514719][T17848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1356.514735][T17848] RSP: 002b:00007f2ceaf79028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1356.514755][T17848] RAX: ffffffffffffffda RBX: 00007f2cea415fa0 RCX: 00007f2cea19c799 [ 1356.514769][T17848] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1356.514781][T17848] RBP: 00007f2ceaf79090 R08: 0000000000000000 R09: 0000000000000000 [ 1356.514792][T17848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1356.514803][T17848] R13: 00007f2cea416038 R14: 00007f2cea415fa0 R15: 00007ffc37445488 [ 1356.514832][T17848] [ 1356.818991][T17851] lo speed is unknown, defaulting to 1000 [ 1357.167564][T17863] IPv6: addrconf: prefix option has invalid lifetime [ 1357.173138][T17864] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1357.310170][T17851] lo speed is unknown, defaulting to 1000 [ 1357.369176][T17850] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1357.554054][T17874] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 1357.711034][T17883] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13854'. [ 1358.193832][T17895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13858'. [ 1358.219571][T17895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13858'. [ 1359.493695][T17930] lo speed is unknown, defaulting to 1000 [ 1359.804104][T17945] netlink: 'syz.2.13870': attribute type 1 has an invalid length. [ 1359.893228][T17941] __nla_validate_parse: 2 callbacks suppressed [ 1359.893251][T17941] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13870'. [ 1360.023154][T17950] IPv6: addrconf: prefix option has invalid lifetime [ 1360.085297][T17945] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1360.182427][T17949] bond3: (slave batadv2): Opening slave failed [ 1360.188984][T17925] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1360.289139][T17953] netlink: 28 bytes leftover after parsing attributes in process `syz.0.13873'. [ 1360.318498][T17953] netlink: 28 bytes leftover after parsing attributes in process `syz.0.13873'. [ 1360.355870][T17941] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13870'. [ 1360.374561][T17953] gretap0: entered promiscuous mode [ 1360.389289][T17953] gretap0: left promiscuous mode [ 1360.482981][T17941] bond2: entered promiscuous mode [ 1360.590172][T17941] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1360.638716][T17943] lo speed is unknown, defaulting to 1000 [ 1360.644718][T17930] lo speed is unknown, defaulting to 1000 [ 1361.054365][T17967] netlink: 64 bytes leftover after parsing attributes in process `syz.0.13876'. [ 1361.076580][T17967] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13876'. [ 1361.147525][T17951] lo speed is unknown, defaulting to 1000 [ 1361.505380][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 1361.571490][T17951] lo speed is unknown, defaulting to 1000 [ 1361.675415][T17943] lo speed is unknown, defaulting to 1000 [ 1362.052549][T17979] FAULT_INJECTION: forcing a failure. [ 1362.052549][T17979] name failslab, interval 1, probability 0, space 0, times 0 [ 1362.081117][T17979] CPU: 0 UID: 0 PID: 17979 Comm: syz.0.13879 Not tainted syzkaller #0 PREEMPT(full) [ 1362.081144][T17979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1362.081156][T17979] Call Trace: [ 1362.081163][T17979] [ 1362.081172][T17979] dump_stack_lvl+0xe8/0x150 [ 1362.081202][T17979] should_fail_ex+0x412/0x560 [ 1362.081231][T17979] should_failslab+0xa8/0x100 [ 1362.081254][T17979] ? skb_clone+0x212/0x3a0 [ 1362.081274][T17979] kmem_cache_alloc_noprof+0x87/0x650 [ 1362.081292][T17979] ? __netlink_lookup+0xc6/0x8b0 [ 1362.081324][T17979] skb_clone+0x212/0x3a0 [ 1362.081347][T17979] __netlink_deliver_tap+0x404/0x850 [ 1362.081391][T17979] ? netlink_deliver_tap+0x2e/0x1b0 [ 1362.081417][T17979] netlink_deliver_tap+0x19c/0x1b0 [ 1362.081443][T17979] netlink_unicast+0x7e3/0x9b0 [ 1362.081474][T17979] ? __pfx_netlink_unicast+0x10/0x10 [ 1362.081498][T17979] ? netlink_sendmsg+0x650/0xb40 [ 1362.081519][T17979] ? skb_put+0x11b/0x210 [ 1362.081549][T17979] netlink_sendmsg+0x813/0xb40 [ 1362.081582][T17979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1362.081610][T17979] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1362.081635][T17979] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1362.081659][T17979] ____sys_sendmsg+0x972/0x9f0 [ 1362.081687][T17979] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1362.081714][T17979] ? import_iovec+0x73/0xa0 [ 1362.081744][T17979] ___sys_sendmsg+0x2a5/0x360 [ 1362.081768][T17979] ? __pfx____sys_sendmsg+0x10/0x10 [ 1362.081819][T17979] ? __fget_files+0x2a/0x420 [ 1362.081844][T17979] ? __fget_files+0x3a0/0x420 [ 1362.081878][T17979] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1362.081900][T17979] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1362.081928][T17979] ? __pfx_ksys_write+0x10/0x10 [ 1362.081959][T17979] do_syscall_64+0x14d/0xf80 [ 1362.081984][T17979] ? trace_irq_disable+0x3b/0x150 [ 1362.082008][T17979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1362.082027][T17979] ? clear_bhb_loop+0x40/0x90 [ 1362.082048][T17979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1362.082067][T17979] RIP: 0033:0x7f2cea19c799 [ 1362.082085][T17979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1362.082104][T17979] RSP: 002b:00007f2ceaf79028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1362.082125][T17979] RAX: ffffffffffffffda RBX: 00007f2cea415fa0 RCX: 00007f2cea19c799 [ 1362.082139][T17979] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1362.082151][T17979] RBP: 00007f2ceaf79090 R08: 0000000000000000 R09: 0000000000000000 [ 1362.082163][T17979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1362.082174][T17979] R13: 00007f2cea416038 R14: 00007f2cea415fa0 R15: 00007ffc37445488 [ 1362.082204][T17979] [ 1363.203595][T17996] 0: reclassify loop, rule prio 0, protocol 700 [ 1363.366088][T18002] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13889'. [ 1363.496186][T18005] vlan4: entered allmulticast mode [ 1363.511178][T18005] bridge5: entered allmulticast mode [ 1363.586200][T18007] tap0: tun_chr_ioctl cmd 1074025680 [ 1363.609478][T18010] lo speed is unknown, defaulting to 1000 [ 1363.625784][T18007] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13891'. [ 1363.908946][T18010] lo speed is unknown, defaulting to 1000 [ 1363.980611][T18009] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1363.991893][T18026] IPv6: addrconf: prefix option has invalid lifetime [ 1364.018407][T18025] netlink: 'syz.1.13896': attribute type 29 has an invalid length. [ 1364.039529][T18025] netlink: 'syz.1.13896': attribute type 29 has an invalid length. [ 1364.208718][T18031] lo speed is unknown, defaulting to 1000 [ 1364.211828][T18040] netlink: 'syz.0.13901': attribute type 3 has an invalid length. [ 1364.511768][T18050] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13905'. [ 1364.724093][T18059] netlink: 'syz.4.13907': attribute type 1 has an invalid length. [ 1364.741480][T18059] netlink: 224 bytes leftover after parsing attributes in process `syz.4.13907'. [ 1365.010052][T18031] lo speed is unknown, defaulting to 1000 [ 1365.604050][T18082] lo speed is unknown, defaulting to 1000 [ 1365.693172][T18088] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13918'. [ 1365.878243][T18082] lo speed is unknown, defaulting to 1000 [ 1366.236913][T18081] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1366.268399][T18118] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13923'. [ 1366.548429][T18126] FAULT_INJECTION: forcing a failure. [ 1366.548429][T18126] name failslab, interval 1, probability 0, space 0, times 0 [ 1366.574528][T18126] CPU: 1 UID: 0 PID: 18126 Comm: syz.0.13924 Not tainted syzkaller #0 PREEMPT(full) [ 1366.574555][T18126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1366.574567][T18126] Call Trace: [ 1366.574574][T18126] [ 1366.574583][T18126] dump_stack_lvl+0xe8/0x150 [ 1366.574613][T18126] should_fail_ex+0x412/0x560 [ 1366.574636][T18126] ? alloc_inode+0x6a/0x1b0 [ 1366.574659][T18126] should_failslab+0xa8/0x100 [ 1366.574680][T18126] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 1366.574699][T18126] ? simple_start_creating+0xcc/0x110 [ 1366.574729][T18126] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 1366.574808][T18126] alloc_inode+0x6a/0x1b0 [ 1366.574833][T18126] new_inode+0x22/0x170 [ 1366.574860][T18126] __debugfs_create_file+0xb8/0x400 [ 1366.574890][T18126] debugfs_create_file_full+0x3f/0x60 [ 1366.574918][T18126] ref_tracker_dir_debugfs+0x197/0x360 [ 1366.574944][T18126] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 1366.574994][T18126] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 1366.575015][T18126] ? alloc_netdev_mqs+0xa6/0x11b0 [ 1366.575041][T18126] ? __raw_spin_lock_init+0x45/0x100 [ 1366.575063][T18126] alloc_netdev_mqs+0x272/0x11b0 [ 1366.575083][T18126] ? __pfx_macsec_setup+0x10/0x10 [ 1366.575127][T18126] rtnl_create_link+0x31f/0xd70 [ 1366.575155][T18126] rtnl_newlink_create+0x277/0xb70 [ 1366.575188][T18126] ? __pfx___nla_validate_parse+0x10/0x10 [ 1366.575224][T18126] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1366.575254][T18126] ? __pfx___mutex_lock+0x10/0x10 [ 1366.575292][T18126] ? ns_capable+0x89/0xe0 [ 1366.575318][T18126] rtnl_newlink+0x1666/0x1be0 [ 1366.575358][T18126] ? __pfx_rtnl_newlink+0x10/0x10 [ 1366.575381][T18126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.575436][T18126] ? kasan_quarantine_put+0xbb/0x1f0 [ 1366.575456][T18126] ? lockdep_hardirqs_on+0x7a/0x110 [ 1366.575486][T18126] ? kmem_cache_free+0x187/0x630 [ 1366.575505][T18126] ? nlmon_xmit+0xb0/0x100 [ 1366.575545][T18126] ? __lock_acquire+0x6b5/0x2cf0 [ 1366.575574][T18126] ? __local_bh_enable_ip+0xd0/0x130 [ 1366.575597][T18126] ? lockdep_hardirqs_on+0x7a/0x110 [ 1366.575622][T18126] ? __dev_queue_xmit+0x28b/0x3870 [ 1366.575640][T18126] ? __local_bh_enable_ip+0xd0/0x130 [ 1366.575661][T18126] ? __dev_queue_xmit+0x28b/0x3870 [ 1366.575707][T18126] ? __pfx_rtnl_newlink+0x10/0x10 [ 1366.575729][T18126] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1366.575754][T18126] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1366.575774][T18126] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1366.575794][T18126] ? ref_tracker_free+0x693/0x840 [ 1366.575813][T18126] ? __copy_skb_header+0xa3/0x4a0 [ 1366.575831][T18126] ? __pfx_ref_tracker_free+0x10/0x10 [ 1366.575861][T18126] netlink_rcv_skb+0x232/0x4b0 [ 1366.575887][T18126] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1366.575913][T18126] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1366.575949][T18126] ? netlink_deliver_tap+0x2e/0x1b0 [ 1366.575978][T18126] netlink_unicast+0x80f/0x9b0 [ 1366.576010][T18126] ? __pfx_netlink_unicast+0x10/0x10 [ 1366.576034][T18126] ? netlink_sendmsg+0x650/0xb40 [ 1366.576056][T18126] ? skb_put+0x11b/0x210 [ 1366.576086][T18126] netlink_sendmsg+0x813/0xb40 [ 1366.576118][T18126] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1366.576146][T18126] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1366.576179][T18126] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1366.576204][T18126] ____sys_sendmsg+0x972/0x9f0 [ 1366.576232][T18126] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1366.576280][T18126] ? import_iovec+0x73/0xa0 [ 1366.576311][T18126] ___sys_sendmsg+0x2a5/0x360 [ 1366.576335][T18126] ? __pfx____sys_sendmsg+0x10/0x10 [ 1366.576391][T18126] ? __fget_files+0x2a/0x420 [ 1366.576418][T18126] ? __fget_files+0x3a0/0x420 [ 1366.576450][T18126] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1366.576472][T18126] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1366.576498][T18126] ? __pfx_ksys_write+0x10/0x10 [ 1366.576522][T18126] do_syscall_64+0x14d/0xf80 [ 1366.576545][T18126] ? trace_irq_disable+0x3b/0x150 [ 1366.576568][T18126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.576583][T18126] ? clear_bhb_loop+0x40/0x90 [ 1366.576604][T18126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1366.576621][T18126] RIP: 0033:0x7f2cea19c799 [ 1366.576639][T18126] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1366.576655][T18126] RSP: 002b:00007f2ceaf79028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1366.576674][T18126] RAX: ffffffffffffffda RBX: 00007f2cea415fa0 RCX: 00007f2cea19c799 [ 1366.576688][T18126] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1366.576699][T18126] RBP: 00007f2ceaf79090 R08: 0000000000000000 R09: 0000000000000000 [ 1366.576711][T18126] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1366.576722][T18126] R13: 00007f2cea416038 R14: 00007f2cea415fa0 R15: 00007ffc37445488 [ 1366.576753][T18126] [ 1367.040790][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5530 ms [ 1367.048887][ C1] lec:lec_tx_timeout: lec0 [ 1367.114761][T18126] debugfs: out of free dentries, can not create file 'netdev@ffff88804cf52620' [ 1367.208346][T18131] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13925'. [ 1367.310151][T18140] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13930'. [ 1367.534243][T18152] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13934'. [ 1367.604641][T18152] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13934'. [ 1367.679122][T18160] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13934'. [ 1367.692439][T18151] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1367.768221][T18147] syzkaller1: entered promiscuous mode [ 1367.795117][T18147] syzkaller1: entered allmulticast mode [ 1368.091295][T18179] IPVS: Scheduler module ip_vs_ not found [ 1368.098503][T18166] syzkaller1: entered promiscuous mode [ 1368.104205][T18166] syzkaller1: entered allmulticast mode [ 1368.270539][T18179] bond8: option all_slaves_active: invalid value (13) [ 1368.281193][T18179] bond8 (unregistering): Released all slaves [ 1368.468648][T18187] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1368.480833][T18187] netlink: 20 bytes leftover after parsing attributes in process `syz.4.13940'. [ 1368.704217][T18196] bridge9: entered allmulticast mode [ 1368.717227][T18198] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13945'. [ 1368.835882][T18199] lo speed is unknown, defaulting to 1000 [ 1369.274978][T18234] syzkaller0: entered promiscuous mode [ 1369.316676][T18234] syzkaller0: entered allmulticast mode [ 1369.347695][T18234] netlink: 16 bytes leftover after parsing attributes in process `syz.4.13955'. [ 1369.456087][T18199] lo speed is unknown, defaulting to 1000 [ 1369.462846][T18234] syzkaller0: mtu greater than device maximum [ 1369.529262][T18197] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1370.145767][T18245] ip6gre0: Caught tx_queue_len zero misconfig [ 1370.158556][T18245] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1370.660771][T18256] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1370.912260][T18260] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1371.035760][T18264] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1371.264189][T18269] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1371.893516][T18209] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1372.099306][T18275] __nla_validate_parse: 1 callbacks suppressed [ 1372.099326][T18275] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13971'. [ 1372.202360][T18285] netlink: 'syz.4.13972': attribute type 1 has an invalid length. [ 1372.266760][T18289] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13972'. [ 1372.440683][T18285] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1372.471557][T18279] bond7: (slave batadv1): Opening slave failed [ 1372.599936][T18282] bridge10: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1372.646165][T18285] lo speed is unknown, defaulting to 1000 [ 1372.676084][T18302] netlink: 'syz.2.13978': attribute type 10 has an invalid length. [ 1372.796908][T18306] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1372.939610][T18285] lo speed is unknown, defaulting to 1000 [ 1373.077799][T18309] nbd0: detected capacity change from 0 to 63 [ 1373.084612][T18312] nbd: couldn't find device at index 1 [ 1373.106820][ T5838] block nbd0: Receive control failed (result -32) [ 1373.371891][T18320] syzkaller0: entered promiscuous mode [ 1373.377880][T18321] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13984'. [ 1373.409630][T18320] syzkaller0: entered allmulticast mode [ 1373.571982][T18307] netlink: 43 bytes leftover after parsing attributes in process `syz.3.13977'. [ 1373.593968][T18307] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13977'. [ 1373.778463][T18335] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.13986'. [ 1373.826607][T18335] ksmbd: Unknown IPC event: 1, ignore. [ 1373.841862][T18334] netlink: 252 bytes leftover after parsing attributes in process `syz.0.13987'. [ 1373.844164][T18335] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13986'. [ 1373.895116][T18331] netlink: 'syz.2.13986': attribute type 16 has an invalid length. [ 1373.989907][T18342] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1374.122648][T18352] lo speed is unknown, defaulting to 1000 [ 1374.136677][T18344] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1374.260155][T18355] netlink: 'syz.0.13993': attribute type 1 has an invalid length. [ 1374.345192][T18355] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1374.364836][T18355] bond8: (slave bond9): making interface the new active one [ 1374.382138][T18355] bond8: (slave bond9): Enslaving as an active interface with an up link [ 1374.455415][T18360] bond8: (slave gretap2): Enslaving as a backup interface with an up link [ 1374.500639][T18355] netlink: 'syz.0.13993': attribute type 14 has an invalid length. [ 1374.533501][T18355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13993'. [ 1374.647752][T18352] lo speed is unknown, defaulting to 1000 [ 1374.955272][T18374] openvswitch: netlink: VXLAN extension 1 has unexpected len 6 expected 4 [ 1375.008164][T18376] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14001'. [ 1375.129529][T18390] netlink: 'syz.2.14000': attribute type 1 has an invalid length. [ 1375.184762][T18393] nbd: must specify at least one socket [ 1375.297700][T18388] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1375.430093][T18390] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1375.507153][T18402] netlink: 'syz.4.14005': attribute type 13 has an invalid length. [ 1375.515510][T18402] netlink: 'syz.4.14005': attribute type 17 has an invalid length. [ 1375.778959][T18402] bridge0: left allmulticast mode [ 1375.797394][T18420] netlink: 'syz.0.14009': attribute type 1 has an invalid length. [ 1375.799410][T18402] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1375.819631][T18402] 8021q: adding VLAN 0 to HW filter on device team0 [ 1375.832556][T18402] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1375.849849][T18406] 8021q: VLANs not supported on ip6tnl0 [ 1375.878490][T19589] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1375.898701][T19589] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1375.920980][T19589] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1375.943112][T19589] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1375.982363][T18410] syzkaller1: entered promiscuous mode [ 1375.988228][T18410] syzkaller1: entered allmulticast mode [ 1376.067028][T18421] bond10: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1376.079240][T18421] bond10: (slave vxcan3): Error -95 calling set_mac_address [ 1376.127370][T18398] lo speed is unknown, defaulting to 1000 [ 1376.213622][T19589] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1376.266975][T19589] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1376.283934][T19589] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1376.307928][T19589] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 1376.376542][T18433] netlink: 'syz.0.14013': attribute type 1 has an invalid length. [ 1376.471435][T18433] bond11: entered promiscuous mode [ 1376.477204][T18433] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1376.541524][T18438] nbd: must specify at least one socket [ 1376.581001][T18438] nbd: couldn't find device at index 1 [ 1376.675066][T18435] macsec0: left promiscuous mode [ 1376.686567][T18435] macsec0: left allmulticast mode [ 1376.693926][T18435] bond6: left promiscuous mode [ 1376.703070][T18442] ipt_ECN: cannot use operation on non-tcp rule [ 1376.720826][T18435] bridge9: left allmulticast mode [ 1376.759297][T18435] bond11: left promiscuous mode [ 1376.781918][T16509] lo speed is unknown, defaulting to 1000 [ 1376.796649][T18398] lo speed is unknown, defaulting to 1000 [ 1376.796824][T18447] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1376.802778][T16509] syz2: Port: 1 Link DOWN [ 1376.841943][T18450] FAULT_INJECTION: forcing a failure. [ 1376.841943][T18450] name failslab, interval 1, probability 0, space 0, times 0 [ 1376.893604][T18450] CPU: 1 UID: 0 PID: 18450 Comm: syz.1.14018 Not tainted syzkaller #0 PREEMPT(full) [ 1376.893630][T18450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1376.893642][T18450] Call Trace: [ 1376.893650][T18450] [ 1376.893659][T18450] dump_stack_lvl+0xe8/0x150 [ 1376.893692][T18450] should_fail_ex+0x412/0x560 [ 1376.893725][T18450] should_failslab+0xa8/0x100 [ 1376.893752][T18450] __kvmalloc_node_noprof+0x178/0x8a0 [ 1376.893781][T18450] ? __raw_spin_lock_init+0x45/0x100 [ 1376.893800][T18450] ? alloc_netdev_mqs+0xa4b/0x11b0 [ 1376.893831][T18450] alloc_netdev_mqs+0xa4b/0x11b0 [ 1376.893859][T18450] rtnl_create_link+0x31f/0xd70 [ 1376.893886][T18450] rtnl_newlink_create+0x277/0xb70 [ 1376.893915][T18450] ? __mutex_lock+0x5ac/0x1300 [ 1376.893947][T18450] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1376.893977][T18450] ? __pfx___mutex_lock+0x10/0x10 [ 1376.894013][T18450] ? ns_capable+0x89/0xe0 [ 1376.894040][T18450] rtnl_newlink+0x1666/0x1be0 [ 1376.894081][T18450] ? __pfx_rtnl_newlink+0x10/0x10 [ 1376.894103][T18450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1376.894160][T18450] ? kasan_quarantine_put+0xbb/0x1f0 [ 1376.894180][T18450] ? lockdep_hardirqs_on+0x7a/0x110 [ 1376.894209][T18450] ? kmem_cache_free+0x187/0x630 [ 1376.894228][T18450] ? nlmon_xmit+0xb0/0x100 [ 1376.894268][T18450] ? __lock_acquire+0x6b5/0x2cf0 [ 1376.894296][T18450] ? __local_bh_enable_ip+0xd0/0x130 [ 1376.894319][T18450] ? lockdep_hardirqs_on+0x7a/0x110 [ 1376.894343][T18450] ? __dev_queue_xmit+0x28b/0x3870 [ 1376.894361][T18450] ? __local_bh_enable_ip+0xd0/0x130 [ 1376.894382][T18450] ? __dev_queue_xmit+0x28b/0x3870 [ 1376.894427][T18450] ? __pfx_rtnl_newlink+0x10/0x10 [ 1376.894452][T18450] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1376.894480][T18450] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1376.894503][T18450] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1376.894525][T18450] ? ref_tracker_free+0x693/0x840 [ 1376.894548][T18450] ? __copy_skb_header+0xa3/0x4a0 [ 1376.894568][T18450] ? __pfx_ref_tracker_free+0x10/0x10 [ 1376.894606][T18450] netlink_rcv_skb+0x232/0x4b0 [ 1376.894633][T18450] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1376.894659][T18450] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1376.894695][T18450] ? netlink_deliver_tap+0x2e/0x1b0 [ 1376.894727][T18450] netlink_unicast+0x80f/0x9b0 [ 1376.894765][T18450] ? __pfx_netlink_unicast+0x10/0x10 [ 1376.894789][T18450] ? netlink_sendmsg+0x650/0xb40 [ 1376.894812][T18450] ? skb_put+0x11b/0x210 [ 1376.894842][T18450] netlink_sendmsg+0x813/0xb40 [ 1376.894874][T18450] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1376.894902][T18450] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1376.894929][T18450] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1376.894954][T18450] ____sys_sendmsg+0x972/0x9f0 [ 1376.894983][T18450] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1376.895011][T18450] ? import_iovec+0x73/0xa0 [ 1376.895043][T18450] ___sys_sendmsg+0x2a5/0x360 [ 1376.895068][T18450] ? __pfx____sys_sendmsg+0x10/0x10 [ 1376.895124][T18450] ? __fget_files+0x2a/0x420 [ 1376.895149][T18450] ? __fget_files+0x3a0/0x420 [ 1376.895185][T18450] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1376.895208][T18450] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1376.895237][T18450] ? __pfx_ksys_write+0x10/0x10 [ 1376.895266][T18450] do_syscall_64+0x14d/0xf80 [ 1376.895289][T18450] ? trace_irq_disable+0x3b/0x150 [ 1376.895311][T18450] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1376.895328][T18450] ? clear_bhb_loop+0x40/0x90 [ 1376.895348][T18450] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1376.895365][T18450] RIP: 0033:0x7fe4e879c799 [ 1376.895384][T18450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1376.895400][T18450] RSP: 002b:00007fe4e95e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1376.895420][T18450] RAX: ffffffffffffffda RBX: 00007fe4e8a15fa0 RCX: 00007fe4e879c799 [ 1376.895434][T18450] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1376.895446][T18450] RBP: 00007fe4e95e6090 R08: 0000000000000000 R09: 0000000000000000 [ 1376.895458][T18450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1376.895470][T18450] R13: 00007fe4e8a16038 R14: 00007fe4e8a15fa0 R15: 00007fff201c0d48 [ 1376.895501][T18450] [ 1377.606648][T18464] __nla_validate_parse: 4 callbacks suppressed [ 1377.606668][T18464] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14023'. [ 1377.666265][T18464] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14023'. [ 1377.838757][T18471] IPVS: Scheduler module ip_vs_ not found [ 1377.872552][T18469] lo speed is unknown, defaulting to 1000 [ 1377.987141][T18471] bond2: option all_slaves_active: invalid value (13) [ 1377.995932][T18471] bond2 (unregistering): Released all slaves [ 1378.214305][T18483] nbd: must specify at least one socket [ 1378.222442][T18483] block nbd3: NBD_DISCONNECT [ 1378.227469][T18483] block nbd3: Send disconnect failed -32 [ 1378.256815][T18483] block nbd3: shutting down sockets [ 1378.299535][T18469] lo speed is unknown, defaulting to 1000 [ 1378.511087][T18500] netlink: 352 bytes leftover after parsing attributes in process `syz.3.14033'. [ 1378.646543][T18505] netlink: 220 bytes leftover after parsing attributes in process `syz.4.14034'. [ 1378.721448][T18503] veth1: entered promiscuous mode [ 1378.727575][T18503] veth1: entered allmulticast mode [ 1378.785255][T18496] lo speed is unknown, defaulting to 1000 [ 1379.002058][T18496] lo speed is unknown, defaulting to 1000 [ 1379.204633][T18511] netlink: 12 bytes leftover after parsing attributes in process `syz.4.14036'. [ 1379.224249][T18513] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14037'. [ 1379.278118][T18511] xfrm1: entered promiscuous mode [ 1379.283301][T18511] xfrm1: entered allmulticast mode [ 1379.289123][T18511] netlink: 12 bytes leftover after parsing attributes in process `syz.4.14036'. [ 1379.629148][T18520] bond2: option all_slaves_active: invalid value (13) [ 1379.665154][T18520] bond2 (unregistering): Released all slaves [ 1379.674358][T18525] validate_nla: 1 callbacks suppressed [ 1379.674378][T18525] netlink: 'syz.4.14041': attribute type 1 has an invalid length. [ 1379.932990][T18538] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14045'. [ 1379.957228][T18534] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1379.989006][T18534] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 1380.085297][T18525] bond8: (slave bridge7): Enslaving as an active interface with a down link [ 1380.238171][T18551] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1380.437174][T18544] bridge7: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1380.501066][T18552] netlink: 'syz.3.14046': attribute type 1 has an invalid length. [ 1380.537445][T18552] netlink: 14436 bytes leftover after parsing attributes in process `syz.3.14046'. [ 1380.657364][T18564] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14050'. [ 1380.679648][T18564] openvswitch: netlink: Flow actions attr not present in new flow. [ 1380.705234][T18568] [ 1380.707605][T18568] ====================================================== [ 1380.715065][T18568] WARNING: possible circular locking dependency detected [ 1380.722771][T18568] syzkaller #0 Not tainted [ 1380.727198][T18568] ------------------------------------------------------ [ 1380.734835][T18568] syz.0.14051/18568 is trying to acquire lock: [ 1380.741172][T18568] ffffffff8fd42298 (nr_neigh_list_lock){+.-.}-{3:3}, at: nr_rt_ioctl+0x40c/0xf90 [ 1380.750572][T18568] [ 1380.750572][T18568] but task is already holding lock: [ 1380.757969][T18568] ffff88808bfc2470 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x215/0xf90 [ 1380.767237][T18568] [ 1380.767237][T18568] which lock already depends on the new lock. [ 1380.767237][T18568] [ 1380.777735][T18568] [ 1380.777735][T18568] the existing dependency chain (in reverse order) is: [ 1380.786749][T18568] [ 1380.786749][T18568] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 1380.794878][T18568] _raw_spin_lock_bh+0x36/0x50 [ 1380.800172][T18568] nr_rt_device_down+0x153/0x860 [ 1380.805629][T18568] nr_device_event+0x137/0x150 [ 1380.811003][T18568] notifier_call_chain+0x1be/0x400 [ 1380.816727][T18568] __dev_notify_flags+0x16d/0x310 [ 1380.822665][T18568] netif_change_flags+0xe8/0x1a0 [ 1380.828127][T18568] dev_change_flags+0x130/0x260 [ 1380.833498][T18568] dev_ioctl+0x7b4/0x1150 [ 1380.838420][T18568] sock_do_ioctl+0x23e/0x320 [ 1380.843628][T18568] sock_ioctl+0x5c6/0x7f0 [ 1380.848527][T18568] __se_sys_ioctl+0xfc/0x170 [ 1380.853663][T18568] do_syscall_64+0x14d/0xf80 [ 1380.858795][T18568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1380.865219][T18568] [ 1380.865219][T18568] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 1380.873035][T18568] _raw_spin_lock_bh+0x36/0x50 [ 1380.878588][T18568] nr_rt_device_down+0xbe/0x860 [ 1380.883958][T18568] nr_device_event+0x137/0x150 [ 1380.889233][T18568] notifier_call_chain+0x1be/0x400 [ 1380.894869][T18568] __dev_notify_flags+0x16d/0x310 [ 1380.900432][T18568] netif_change_flags+0xe8/0x1a0 [ 1380.906090][T18568] dev_change_flags+0x130/0x260 [ 1380.911480][T18568] dev_ioctl+0x7b4/0x1150 [ 1380.916347][T18568] sock_do_ioctl+0x23e/0x320 [ 1380.921486][T18568] sock_ioctl+0x5c6/0x7f0 [ 1380.926358][T18568] __se_sys_ioctl+0xfc/0x170 [ 1380.931483][T18568] do_syscall_64+0x14d/0xf80 [ 1380.936602][T18568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1380.943013][T18568] [ 1380.943013][T18568] -> #0 (nr_neigh_list_lock){+.-.}-{3:3}: [ 1380.950946][T18568] __lock_acquire+0x15a5/0x2cf0 [ 1380.956314][T18568] lock_acquire+0xf0/0x2e0 [ 1380.961251][T18568] _raw_spin_lock_bh+0x36/0x50 [ 1380.966544][T18568] nr_rt_ioctl+0x40c/0xf90 [ 1380.971490][T18568] sock_do_ioctl+0x101/0x320 [ 1380.976595][T18568] sock_ioctl+0x5c6/0x7f0 [ 1380.981435][T18568] __se_sys_ioctl+0xfc/0x170 [ 1380.986550][T18568] do_syscall_64+0x14d/0xf80 [ 1380.991655][T18568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1380.998061][T18568] [ 1380.998061][T18568] other info that might help us debug this: [ 1380.998061][T18568] [ 1381.008302][T18568] Chain exists of: [ 1381.008302][T18568] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 1381.008302][T18568] [ 1381.022121][T18568] Possible unsafe locking scenario: [ 1381.022121][T18568] [ 1381.029634][T18568] CPU0 CPU1 [ 1381.034986][T18568] ---- ---- [ 1381.040352][T18568] lock(&nr_node->node_lock); [ 1381.045196][T18568] lock(nr_node_list_lock); [ 1381.052293][T18568] lock(&nr_node->node_lock); [ 1381.059571][T18568] lock(nr_neigh_list_lock); [ 1381.064244][T18568] [ 1381.064244][T18568] *** DEADLOCK *** [ 1381.064244][T18568] [ 1381.072370][T18568] 2 locks held by syz.0.14051/18568: [ 1381.077636][T18568] #0: ffffffff8fd422f8 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_ioctl+0x15f/0xf90 [ 1381.087127][T18568] #1: ffff88808bfc2470 (&nr_node->node_lock){+...}-{3:3}, at: nr_rt_ioctl+0x215/0xf90 [ 1381.096874][T18568] [ 1381.096874][T18568] stack backtrace: [ 1381.102780][T18568] CPU: 0 UID: 0 PID: 18568 Comm: syz.0.14051 Not tainted syzkaller #0 PREEMPT(full) [ 1381.102802][T18568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1381.102817][T18568] Call Trace: [ 1381.102824][T18568] [ 1381.102834][T18568] dump_stack_lvl+0xe8/0x150 [ 1381.102860][T18568] print_circular_bug+0x2e1/0x300 [ 1381.102886][T18568] check_noncircular+0x12e/0x150 [ 1381.102912][T18568] __lock_acquire+0x15a5/0x2cf0 [ 1381.102933][T18568] ? kasan_save_track+0x4f/0x80 [ 1381.102957][T18568] lock_acquire+0xf0/0x2e0 [ 1381.102976][T18568] ? nr_rt_ioctl+0x40c/0xf90 [ 1381.103001][T18568] ? nr_rt_ioctl+0x40c/0xf90 [ 1381.103020][T18568] _raw_spin_lock_bh+0x36/0x50 [ 1381.103041][T18568] ? nr_rt_ioctl+0x40c/0xf90 [ 1381.103061][T18568] nr_rt_ioctl+0x40c/0xf90 [ 1381.103086][T18568] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 1381.103110][T18568] ? apparmor_capable+0x126/0x170 [ 1381.103138][T18568] ? capable+0x88/0xe0 [ 1381.103158][T18568] ? nr_ioctl+0x1b1/0x3b0 [ 1381.103176][T18568] sock_do_ioctl+0x101/0x320 [ 1381.103198][T18568] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1381.103216][T18568] ? do_futex+0x333/0x420 [ 1381.103241][T18568] sock_ioctl+0x5c6/0x7f0 [ 1381.103259][T18568] ? __pfx_sock_ioctl+0x10/0x10 [ 1381.103277][T18568] ? __fget_files+0x2a/0x420 [ 1381.103300][T18568] ? __fget_files+0x3a0/0x420 [ 1381.103323][T18568] ? __fget_files+0x2a/0x420 [ 1381.103346][T18568] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1381.103366][T18568] ? __pfx_sock_ioctl+0x10/0x10 [ 1381.103384][T18568] __se_sys_ioctl+0xfc/0x170 [ 1381.103403][T18568] do_syscall_64+0x14d/0xf80 [ 1381.103427][T18568] ? trace_irq_disable+0x3b/0x150 [ 1381.103450][T18568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1381.103466][T18568] ? clear_bhb_loop+0x40/0x90 [ 1381.103484][T18568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1381.103500][T18568] RIP: 0033:0x7f2cea19c799 [ 1381.103522][T18568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1381.103542][T18568] RSP: 002b:00007f2ceaf79028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1381.103564][T18568] RAX: ffffffffffffffda RBX: 00007f2cea415fa0 RCX: 00007f2cea19c799 [ 1381.103576][T18568] RDX: 0000000000000000 RSI: 00000000000089e2 RDI: 0000000000000004 [ 1381.103587][T18568] RBP: 00007f2cea232c99 R08: 0000000000000000 R09: 0000000000000000 [ 1381.103598][T18568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1381.103608][T18568] R13: 00007f2cea416038 R14: 00007f2cea415fa0 R15: 00007ffc37445488 [ 1381.103626][T18568]