last executing test programs: 4.044908991s ago: executing program 2 (id=4324): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000005c0), 0x10) sendmsg$can_bcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="06000000080900003200000000000000b69c6ca8ba0183828721e8ddda39787945357687cac07c61e70062d78d5fc7b080905c4eb53f8c03fbfb258355ccdfba61a72ae40b4dec18ad7666dfb127b9ee53f733f20532510c51d61f6917961b46509ec264c3cafe633f960f540a516c79183678632e9c01effcd47cd2c6385cc79d9a55528cf376575e78937dda8039aba01b745cbb31d40c1115fbee", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRESDEC=0x0, @ANYRES64=0x0, @ANYRESDEC=r0], 0x48}, 0x1, 0x0, 0x0, 0x24040010}, 0x4048840) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x4c, r3, 0x205, 0xfffffffc, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x1}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x5}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x6}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0xfff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x13fea3995e811172}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="1809000000000000000000000001000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000009c0)={0x0, @in={{0x2, 0x4e20, @remote}}, [0x2, 0x9, 0x0, 0x5, 0x8000, 0x7, 0x7, 0xa, 0x7, 0x7f, 0x5, 0x8, 0x536d, 0x8e, 0x7]}, &(0x7f0000000bc0)=0x100) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f0000000c00)={r7, @in={{0x2, 0x4e24, @broadcast}}, 0x7, 0x5}, &(0x7f0000000cc0)=0x90) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r8, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x48, 0x8, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x40) ioctl$SIOCSIFHWADDR(r5, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0200000004000000080000000100000080000071", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000140)=r9, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000dc0)={0x6, 0x6, &(0x7f0000000640)=@framed={{}, [@map_fd={0x18, 0x0, 0x2, 0x0, r9}, @ldst={0x1, 0x3, 0x3}]}, &(0x7f0000000d40)='syzkaller\x00'}, 0x90) bpf$BPF_LINK_UPDATE(0x1d, 0x0, 0x0) r10 = syz_genetlink_get_family_id$gtp(&(0x7f0000000480), r2) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000006c0)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000500)={0x1c, r10, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@GTPA_FLOW={0x6, 0x6, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x28000) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r11, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000280)=""/143, 0x8f}], 0x1}}], 0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)=r4}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r12, &(0x7f00000002c0)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r9, 0xffffffffffffffff}, 0x4) bpf$PROG_BIND_MAP(0x23, &(0x7f00000003c0)={r4, r13}, 0xc) vmsplice(r1, &(0x7f0000002640)=[{&(0x7f0000000040)="214b1ddb399dfc9a3683c4be406e2958100afa4c11f5327e56e910e35e4621c2a6ca480635c75aefe9d8f7241c0e631c8b3cbf5b80ea75970b2c9f04a6cd0c29a2a433907c3ee3b9d5791031c975bd565634fe4ec1462504677865178ea098b654d4fa20478a9fdf0b38020791d0a14a62b3269241cef7aca903f55f0e18f18596e34196c77f7ed2e4da07cfe9d687a0bd8639657f25f3f61a50dd72ad1a289a085bcf56edf83e303e80b8d3814dc6954744595367c21c1ba94067c7bd47232c509836af69ed2d8bdd286364953d78a3eb5a3501cc0f58b88184fc8c6852ba2a2150ff", 0xe3}, {&(0x7f0000001300)="2aeabfb46f139ba301f4a528c091cb0c1c955fd22ca6a8f2586f8198b79c10ff48a25111a1c1ffa30f1e428a002ab21fc2359b43171b0c4ff06f92b38208304f9e4253dceedd69e8c871022fba3d1f6d60486be870a0a171298b34540e06208b78d966467d011c5c9b78d6995cdd4880ee04caf85956cd5fa3d058d3b697faacc15885e32acd8ffeb99615527398f8401a045e5fecab939b1de7ae8ff4d32b9cdd1cb4e55e615ed6d507e8e704041ba05ea7f77a28f267f3c01e0cde95a5d608495f8acb9202e8f8032de234efd5205085332c4e28f93b43a60e286ac01b018bf449662cd8a546062d9af4cad0c8f2028215e6f3edfb8ee23dfe541090e9ab81987907da1eefeeaa7b6128cd41b3e82160bb3d0e4f2b9e181ecd065e154e392e96f59a6fa6c56c564e193655bc109e1236ee1c311f18114611872b3b2528171e0a3d1816003c27b23496736a979b1a354a819754a877024aa0a80d1180829519e28c70ec3b3c29b1ccd40756b0283dd533b719f1ff86e8a83fbcc4f474967a451b25888fb79ac4f6b8b3da5220c78d2c2a184296c68813b1c15f605d59a95f522f04dd568309b9f7b7a8246deb75bda134e94853e9042f6b0077ac1c788143ff59342108abf267254a16520b2c57ebfb0cb1d7f0e220a380ae5801dd553660bf2f906b2f56b9c9dc8d08c14ffd02eaf8379d4c5b8be6bd388bc47e3560974870d566efeec2d7d21583fb858d760f0e9f77b2c9e54dcc0a164584bdf8242fab27519e3cf6e2d07864ad66115fb27d10554a40360237630d90839fb26c0526fecc9e13177f95b55589eafde1613cf23870d68cc115a2698fe2dd56e6722ee306451f09360767441a033f46d0cda34b8fb1ae425e9d93e32e82214d6dbef2c128857784c8bbb2fe29f7c68247c51e27b53d7ab6689faac3eab5664a675c5a50172b6e7ef431732f71dc22c48f1b9b7916bf9a9aec4df6247ae382ebfd33740b01357b9a2fc6550660cae4d71009f9c1013203242d7b5e78510af6a2ea09a22603ad54929401bd721f5d16c3aa75754d767bc48eef57dae954e7c43c98b622299fc715ec83abbceabd923f74ab823a7c37a718cde117e02aca92348fd91a324c1858fe027d5ce736c40d4427b9acce447f305a7eec64ef1d141e73d6d1d27ab308059eb06c0ea77d6a3a2b77698235f72980e18507057a249892883e0d714ae873d0eade67e00591130b4306242826160466005d188532055c39d045a4e51bdc7a25a749b10462003a7d9b57a32acf91d45f7494b6e8d3c4453b7ef2bd6dee3545c07a93cc69dbd2761f4bd9b5fef7748661ad06d29da8757a11852fd60f9d3092f94c0b87288a20d647b78a42ae5bb1e134ec958c2e4c3eaea087a9cb859f74061c578cb3e415236f09bed0f40ad02f532ec697295b8ad124e1bc7721041fd59fa67fa1e4726194e10c90e8aa832ce0cad3b15e3f6db0eb56be0aeb9123037d7b91dc3ad58d0a485015a8869a06721e48250ad6f3607d8bb6726545050ee32e04aec0c5ad421eb9faa1273525ced464ac3fa3eb0cf8f565b5f6fea9adca197e68ffe7d173cadc4c3a1b8e0dcc84815988eb83b3c3b5ac0fa7588f00fe4857d13d55053d53fb56ab6a0aa0e2a556622c31c466dd4be9686f91bd1c4ec4a850ce5e72728b134b9e294e2f386053fa5f26a61c4c3ca86ed36ab45375324ce3e1febaa56be30d3ae2c379b95755fd795b2de2413caaa91b0cb9a2f8952449356f833659b9b4503f2d76367522cf6ee9ac54b180d3c02b5da800d8d554252d4f5be85bc1acbbc89d8bfbae46a64b92bc7d36953a416cefda97db7763f88d1b1e8f2d15466de024957311b63a951af48be405af7fb509b534065b5346b7928f3c2d75cb9db89ed7b1d29de8cd3610bb7b5b5aaac83db01d882c73a0bedec0ec47f7732cc12b2697c8e2b2f8f56baa2ce747512681ccc9e954f5a7df6eab6828fed09ab287ee0110aaeb711cec8048adcd8cd60298d4f2a143186acadee072b420096b31d074d3ebf366d2aabc3586d0faa07a4f40f77a908e7036bcd66e46d29ee3d3f790fab41dadffe775f75a9a5b72fae664ba028369403f3ffc4afffb3b1955d553898bedaf0b1b46363e4f384f19c743e2aaed6f9d240372b1b567e03c5d1ff1142c139f2a072f1e2024af092425c3e14909c87f587013050c33767c5b30ed1030e146c8957afa6e232fee3a3b77d0706202dbfa0f71d422b13de3609f94ffeb22070b68eecb5775651117ac9d606c80a49134e1f96182f77ea5455714da50fb00296a21227e1c0d7f30a788431828c247dd1f6b9347b4397102e1fccd3065c2e202bba256f39c45bc87f5456f9a1d19c0bc5de1618d36a2e38231855691fb9085c35d8235c0fc120cf11305408985b5aad5bc80cbe0591cc9a966e251ea78087936116b446ddbaa524ae33aca54f86bbe7b44bd69cabca73f05f858e2b243383c6af8567ebfebaa499d2ca5519e468799b966d6d7177bac04538c14e19fe725b6553601bb3b4e51a2ea15bbdb9b84c50d6169bc0efd72e4729657fbec06237d87b5edd5b93b338cbf648874f5b75ecf526c8befe4a1339c66b8533770abfa07c91bb72c393ce70a98d40c524a4be8b16bf5c837c696cc304bb93744fbf849c842514cfd7f855d313d24f1d8139210e63641965afcba5a937178bec2a7d2463d08b5be430107596b73061dd687b2361542970c70d75c4fef8b731a85829c10e9b6785b3592342a1f6f1993ed00b1eba659c2737a0a61339dd1eab2004d38fdb176d6fb5349ae935111345393c9983b9e8946fffbbf3914ba19feb20b399beeabf2ad7c5468553bd993c04da6256e8946d0105c99999729b588290fe1c55b0977570e8c52ca3dea266939da5c0e811a3665adcfc78f2b710a281030e759be6e7b56071586690ee4e8dccc30b26de7ec88388a385615f97a30d7bf5fc48d4a8db159dd5a3afbffe769dab6f1a25037eeddb2b68b54513daf99bf00b449af6a3dfddd7f95f23ff6b5ec55fac25c69bfda93d10ad0a56d928a6964b4a04d0900a340c77c0a2bd4f6287dc25fb3fa3a7843a840e4afcdb4d52a0aa85767bd6a879d581d4e00fa3c2fd2b401a320b8e5ef1cb47aeb5a5597152ba9c4b571a8c851adecd0c4e496f9266fb3ce7873f51975fb448f96418f9bfee70454f23021c32f5b1ea144e956ee5c7fd0420e4322a556b4ae674f8edee29ef71f5cc546a33721ff0e092d92915a96aa35a79c2e506a4a10b44d148f5733245ab3cfcf1b2b468689936d771914346bd6c4540b4afa3b51292df79ac47f5026b524edd5251264b11f28f230e0b71501a3c3ce0364b162d3d1276ac0b4315277acebbd67cad342375ca532e8b8468f9f8e5284d4bb90e434304b5e473ba4f0b1da2882acf6af628d3d6148bedf8ae0a11f4acded28960467d0f5ad536ceecc07938e36169723a5347f0cc4f710e80a9ce0c2dfb5aab1095338094ee586c791085f1e6d39e71bb12eb75f06c7e8d9daf44669ceb58d853ad837e32e661ee05053bae12b8c3b1bc85fb304f94dda4397f4695b0b72c9b8d4fa449eb5adb5c0b33d4c0a445d93c6beb63f6b26c38521130dbd6739efb2475523c758d17da89df28d337b20599c7c8967fc878a4867d906c7766be82263e5c4822513d96d72d84d4826efc2071783952afc1cda73ef2dd58bff49e53a7b4b81edf7ef394eca794f3fb72cecdde4290d6c4b2935f7127f6f3c9d162497c3d8545c6dc25202b0487201a9b662b4bc144e53b0865274cda4b2d59ab6f4b25e63974f1576eb8114f5835ad2f6092db1b6e0911829d2078d67eeb4716e4428b9e75a941231c34f4c6125ba369fc294fe5a1b46501688e4d8c5bd46f4b419309551db8bc18869d66d566c655eab1e6f029786dd19ff5f3992f3d678d17d41de8775930b08f3e8a81b8e19c1ff12b3722f333f715261ecb6a8f1ef85f24dad641679b5db6aba5781191c373fb7821caa977a99020f971cb514a1c3624101f3934fb5f184ac8c1dccd803d7eecbca5e1944261420a0c758c3c36035cc1969fe0629bdd94ad8646c6951d1cbccaa5b0f2bdeb36d80fc011dcbdf240ff9745ec81b2d4e741d20983dc54f46a3c9f06de640c30a5fdef0db396b17e4b349c6fdc2adaff7657881a72117f41dca68f9878b1ac4c215b67807a7cc392af7271ea0fa6edf148ab2b983e98638e0de9ba02ed50ffbfc1fb739451a7c96db00b40cba747d24e38e4c91af5dc388c977986f76600fe0f8de18ec0a4649614ef88bb02c98460506fe56d2c652cb285ffb6a070793d8022ca91318cdebf891252bf983dfc85e243886777ba147737d3af94fa45f879580c7a76c3a7082405af3117da88537aa2fd253d0e53dfe3b9664f57d446c8e2eae1815a488a5d9f8106ff84149d73d27d1182158be56750d83769e81d75dc791cde87319b6ff27f18b65df8934e34bc27233d634d9ce7fc669d2b2437494b86597b6b670a5abe1a59e550d1935d8904925888d85f2ca48ab44652dda398905da30452261945c1a1044c9a9cab2dfc2076545b00ca6b15572458869ae530b7ede97ec80d6dcee7afc06a71d7cb1c5c699e850598d798c47cac408dda96b6f6e319173373ed2e4232a683b9e114f6328bf737748f38fd88b5b3fe5a8cb82b95a49fde698177fa5cee03316136cd84c2f4dc05cc0bc44dc1c3759b7df61994673c7b8407fd78e04851f383b80ed04bd901ce65b5269f5a447ef97c6596f28c7f43941b5af6dd04576912e6dddc6fb854b15a342241e98704ef4872930f753fd496c5b118a74baab0d1eff73fc90ce85c2dd0a82c3ded30d80410ec2a4960b518ee23c0b36e5ccf68393682c35f3456828081b893b62fcc378b9a87543d9e493f2d4703aa82e4c4a8d0b0c79324744378f2f970a8ffbc600c56ce210965425c10aa1bad2c6ad0ec37d34965581de0d1c26ab2d0c0aa16f19b4c942a9700de9970589a3472f4968b2f85faf7851a4a72e1c1d29f7ebb8e6f3fc184833a39899da7eed82882ec1fa36a4c485360cc76b7c27395e8898519a682c06c012b2b49bae5b2a49df14fa015f58b2135a6bec1b0ec498ab478c1186ebc80ee8b0d3ef6465cc7115c4743f733ceda93d8f52099bc10efa40400b823422119ef029d7e4ce8e5e4d424d553ceb8368e01ab223b4d71c5b6ea5e2880515011f8a58f8c2a1f0561b42a4b2effe4f554ddb341f3f4d1b43fcbdb490dc1b22cb311af85daa7960d496d720302ec308d6bb8828a0b78db021bbc3ec91926784c2571082aafa0aa40bc85c170b2445faeef250d1c29aca3870837dd490079f7b8e89e6074999f673c582be62e47caf4d51be521f4fc2a6e67ae02b1231cc2114b05e3cc4dc528a2dad084d624b598014000441e1f1fd56775ce2e4333295d4724fa8ea4cefe460d2e95bbf26df5e7440156432aedd8f64796247437ba26c8d8649291dbbf103d75b8a3f550be2865ef5aa16304987c222538d2440e85eb80318fe972c8ee65ad5c3f60b0be0d9588b27020345b50496b031fddc1eaa0309991908bbc297fa13bcfa4ae313ae24b916099b2058c6d8e6c65e8173029ef71be4a29745e5a28e8e6814107d3e7364feac61995c5f87d524a5feacea3a19444fc63457cb42b159980a8afa8d17d476054c1392e056837f3bc99067e8d3dfdbeaf7537b2f00127658a61cc653c0890b76d496ff21f1133c3dde5e9bce9e479d477973c50a67c86228a739d84e5165ba5f196ba1bc6a", 0x1000}, {&(0x7f0000002300)="96c2bddca058f2461f81da6de7517746231782fd9cb6f9e0a397f0843f40cecdf17df9", 0x23}, {&(0x7f0000002340)="3181cd8ef4dfa7db1feb78fc7eeceb8baaecd5407ea8d8950d95ab0578a7684df69a6c52f1c25e64ec205cfdd27ba6c8171fb239bdc31d639aadc651eb2f6993792bf3f45409c35767b8315e8d2825fdbefe0af972bace1c03e62fcbbee28f5b3b354002d1a9090899c84a2c2bf288c713368f2090408275f4972a2a220abe7e7fe633cf72374d895ebaf2345cfa2c886e813a4a9d37e5f5d40d6f27e66832f95d7b1a4d321d384f46212c1fabaa8d86ced9394da157631f52c374e9188308516526999fc7191a4fbeb59e", 0xcb}, {&(0x7f0000002500)="eece766150502e4d33087ff0d9c8f59c3ae2f822e4dbc3b23f15b000c8a18b1af3ab7c38410d732a3fa9ec427e949bffd22dbe995b3221d78c88dac440b700b7f86d48e1ce1f4d47fef69ec5d2f2ddaafe1c58cb00859ebb6cb5e798c2580dc50ab3a677ae6d5733a450614397b8dfb6aed9", 0x72}, {&(0x7f0000002580)="02e2a80f0c47fb80b0acaa5649f2ee6c085987b7a1e6cb3294a5d1a3c86a4c8453229076bf20da42b90a14ed71e19a2bea1802f290cbbc1cd8506bdbe67f174f8eb8bcce69cfca5b20352eeb97d70a0e36d2b7ec511f0eebef107ba53091079b42055fcfe0089108ba0bfa1757b27485b56e8ae311350d7fad92ad4884a2b37cd09286f9f1aebbd7856656f76c4f128832fc", 0x92}], 0x6, 0xc) 3.759299805s ago: executing program 1 (id=4329): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x7, 0x6}, {0xc}, {0xffea, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x80000001}]}}]}, 0x82}, 0x1, 0x0, 0x0, 0x1}, 0x4040050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="780000001000010400"/20, @ANYRES32, @ANYBLOB="60300300001400005800128009000100626f6e6400000000480002802c"], 0x78}}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a118001500060014ea000000120800030043000040a8002b", 0x33}], 0x1}, 0x20000880) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000640)=[@in6={0xa, 0x4e24, 0x8, @mcast1, 0x6}], 0x1c) ioctl$XFS_IOC_ERROR_CLEARALL(r1, 0x40085875) 3.744864777s ago: executing program 2 (id=4331): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010101}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r3, 0x8}, &(0x7f00000000c0)=0x8) close(0x4) syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) socket(0x8, 0x4, 0x3) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) r4 = socket$can_raw(0x1d, 0x3, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0xb, 0x0, 0x0) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000340)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}, {{}, {0x0, 0x0, 0x1, 0x1}}], 0x10) bind$can_raw(r4, &(0x7f00000000c0), 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}}], 0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x41) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7, 0x0, 0x5}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) sendmsg$SEG6_CMD_SETHMAC(r8, &(0x7f0000004140)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000000400)=ANY=[@ANYBLOB="30263bac265dfc9d5c153adc7f8f57b17b58d88ffe3ee47210e085040ca97bee9a4f954a454e177ed423c923ece45bc1b7ec7ed7567ff78bed8b3579878ec2c2a1dae3215f880f1482c6439be0dd984013409b4987801d24b36dace0d5b082ee1a46e10072b7e135ede01709aa4b3a04b52c60dd434a591821990e2ccd42a5eac64d8dc23a2094922710da082cffcd9ebf68e9fa706f21df8c61eb40f87d913d", @ANYRES16=0x0, @ANYBLOB="01002dbd7000fedbdf250100000005000600020000000500050004000000080003000700000004000400"], 0x30}, 0x1, 0x0, 0x0, 0x4845}, 0x20000080) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d0f65acc0d06d1a1434e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab000e271f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab0300817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c690220b87b20581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1ff032aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f757036303767d2e24f29e5dad9796edb697a8ad004eea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc518afc9ffc2cc788bee1b47683db01a2f9398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa407e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db00002e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d50200a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987595ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db08407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4092140faed0c329be610c3082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b4c8787361f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e0800000092e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9be7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa5200002fe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb0972d39e4b5589829b6b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8bc410d9f48bf7eac90529cd6af061c9e501ddddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85e9bb70a3009a5d30f479e293a3302e11350ea857b37e76ca2f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f981179186e4000000000000646174b55d251f7f8ca5ccc22a5efb33b237eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4445eef08401cd1a3e266db41474e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24c5efd5c8495c1ccd580033c55725f2d60354f8ad5914a0155eaa743350ddb388f486b6de0549ef3b1b3c3b7d4d3a830ff39885776119408029be3788dd8422b1ab7b4c9d5b7d8682fd759c713108e1bdfc64b9121bbf07099def5c0ce3c861ae4b5cad8bba5a0b605908000000f96a59320309e25df89484522bb1d6eaa92164f9e4042cb689a45a898354c17b08705205a9189772bcbcb6414e44b33a2470d3bc16f761c332c34812382e57c0e0d83f3f565b9da5e7991ad8482579cc1b16c1fcec815a5482ae8b1779c5e339971a6ec1217b6478c2434a9a18dcc6c7c791e444a79d7ce37f9cf2a434b9048ca6a2fa254aa02cd098026798a6d336348af0fc11fa2809a5ebbe17ca4d0f889d518f64ee50f562b5fdb1f76d4a7fe14701f8ed0c6a55d66a6efea3e449e6b4783d66661a92f174f2b88cd544b2a8e1b05ea7cf51578169fff7765f9978883b4b5983b42a35a05dabfc325ec2a2ec2f9b0882fdcf5d6f72272d2ff0d8eea60f5494ba42b4d40f144f0ab680a6f40f9094d3afb58a1efd6109894b8605c6b3b3f020c222f6446195b2274f634fbb737948a1f36ea729467e132385e9da614e4625175f4443b97a675934db90010e4b884200c3546c4d86d712c3939e11be3343f693846f509ad4c445ade5cd6d126d5694462ac5d3b527c3bd51c0a715a28d65fe94b255d02cdc1fab99b5b9c352f1b284115e4046285a824d22b6f0afbed8d6096a72fef72ebd6aae78b02fa1993e8fe2020ae93aae2bcfffa40b98549f1fb9fcefa74329909a207336d07f6f59da423ac5fa47852055d5ce6d2c56bdbbcdbf3458ba478c669f39d5272e65c90908ea2cb86d38f8ebf80a8cb85d8399b42403c94b8662af5cf1411526f177b4d476169a5d5a8c37d0d8893a77d0bd47b8a0bba60b3e26094209c889585f997ff556bcd2cc223f9c0c44de9d0fe1b5a8a815f652e79747d3e1f413fa0575d51f652d22883e143065c5ad74bdc864754ba3dad5a8fc8fc2c807d1a51dfb29884adee415c13f2ce14d307bd6165ec6ba68a766adfcbe444ea72d586bb47dd98a225467aab538a77667d19bae2e51727ba6d190e6d7"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r9, 0x18000000000002a0, 0xe40, 0x2b0, &(0x7f0000000100)="b9ff0b078059268cb89e14f088a82de0ffff200000000067000aac14140ce000000d49e832f0", 0x0, 0x28e, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.428671533s ago: executing program 1 (id=4335): r0 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x40, 0x2c, 0xf3f, 0x70bd2c, 0x25dddbbd, {0x0, 0x0, 0x0, r1, {0x2, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x10, 0x2, [@TCA_BASIC_EMATCHES={0xc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}]}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x200058c0}, 0x4880) 3.293994041s ago: executing program 0 (id=4337): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000f0cd000000000000044e690085000000a000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x18}, 0x90) 3.105620957s ago: executing program 0 (id=4338): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x14, 0x30, 0x1}, 0x14}}, 0x4010) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x0, 0x2, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff038}, {0x6}]}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@ipv4_newrule={0x2c, 0x1e, 0x1, 0x0, 0x2, {0x2, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0xe}, [@FRA_DST={0x8, 0x1, @rand_addr=0x64010102}, @FRA_GENERIC_POLICY=@FRA_GOTO={0x8, 0x4, 0x7ff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x42}, 0x4002810) sendmmsg(r0, &(0x7f0000000180), 0x4000190, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = gettid() syz_open_procfs$namespace(r5, &(0x7f0000000200)='ns/pid_for_children\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000063110d00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c"], 0xb4}, 0x1, 0x0, 0x0, 0x850}, 0x40) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB="7000000014007b00000000610baf80102d"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg$alg(r6, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100fcff3fffff0000000042000000080001007063690011000200303030303a30303a31302e30000000000d0087006c325f64726f70730000000005008300010000"], 0x48}}, 0x0) 3.103859591s ago: executing program 1 (id=4339): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x11000) socket(0x10, 0x803, 0x0) socket$rds(0x15, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) socket$nl_rdma(0x10, 0x3, 0x14) pselect6(0x40, &(0x7f0000000200)={0x0, 0x0, 0xd6c1, 0x7, 0x4, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x3fb, 0xffffffffffffdffd, 0x0, 0x9, 0xfffffffffffffffc, 0x0, 0x192dbfb5, 0xfffffffffffffffc}, 0x0, 0x0) writev(r2, &(0x7f0000000e00)=[{&(0x7f0000000a40)='^', 0x1}], 0x1) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x44, 0x2f, 0x9, 0x70bd2a, 0x0, {0x4}, [@nested={0x2e, 0x11, 0x0, 0x1, [@generic="e796bd6dd42541affac6ff415af85ab494e09d498fc605baa5fe20e0f8a725f9f47392b70f555def59af"]}]}, 0x44}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 2.908529002s ago: executing program 0 (id=4340): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000140)=[{0x1c, 0x80, 0x0, 0xfffff010}, {0x6, 0x0, 0xff}]}, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r2 = socket(0x2000000015, 0x80005, 0x0) bind$inet6(r2, &(0x7f0000000340)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x84aebfbd6349b7f2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @link_local}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x140) 2.455379222s ago: executing program 4 (id=4342): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r0, 0xc0096616, &(0x7f0000000000)={0x1, [0x0]}) ioctl$OCFS2_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x1, 0x2, 0xfffffffffffffffd, 0xa34, 0x2, 0x105}) r1 = socket$kcm(0x29, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000080)={r0}) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x3, @loopback, 0x9}, 0x1c) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000180)={r1, 0x3, 0x40, 0x100000001}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r2, r3, 0x31, 0x0, @void}, 0x10) sendmsg$OSF_MSG_ADD(r2, &(0x7f00000017c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001780)={&(0x7f0000000240)={0x1508, 0x0, 0x5, 0x401, 0x0, 0x0, {0x3, 0x0, 0x4}, [{{0x254, 0x1, {{0x1, 0xfffffffc}, 0x5, 0x9, 0x55e, 0x9, 0x22, 'syz0\x00', "c602fdbe22bb9cd0b0486f33fee20badd67a78227480b21825add0ff2ae001f5", "17cdc5f4c52181d8bd11361b339b19feaee7a0cad2fe5761d7f01758da59d0ba", [{0x0, 0x1, {0x1, 0x10001}}, {0xf7e1, 0x9, {0x1, 0x40}}, {0x9cb7, 0x8, {0x3}}, {0x8, 0x89df, {0x2, 0x4}}, {0xdb1c, 0x6, {0x1, 0x800}}, {0x9, 0x7, {0x1}}, {0x9, 0x80, {0x2, 0xff}}, {0x6, 0x7, {0x3, 0x7}}, {0x8, 0xfffa, {0x3, 0x2}}, {0x4, 0x10, {0x0, 0xd}}, {0xf33, 0x0, {0x1, 0x3}}, {0x6c, 0x0, {0x3, 0x7}}, {0xdd, 0x1}, {0x5, 0x4, {0x2, 0x6}}, {0x8, 0x8001, {0x1, 0x2}}, {0x7, 0x7, {0x1, 0x6}}, {0x81, 0x1, {0x0, 0xf}}, {0x6, 0x2, {0x0, 0xefa}}, {0xb0, 0x9, {0x2, 0x8dc}}, {0xfffc, 0x27c4, {0x0, 0xac}}, {0x507, 0x6, {0x3, 0x7}}, {0x2, 0x81, {0x0, 0x9}}, {0x5, 0x2, {0x1, 0x101}}, {0x1, 0x9, {0x2, 0x7f}}, {0x9, 0x7fff, {0x1, 0x5a}}, {0x2, 0x4, {0x1, 0x401}}, {0x5, 0x4, {0x2, 0x40}}, {0x6, 0x7, {0x2, 0x4}}, {0x5, 0xa95, {0x3, 0x476f0}}, {0xe844, 0x7fff, {0x3, 0x3}}, {0x0, 0xe00, {0x0, 0x100}}, {0x51, 0x5, {0x0, 0xb1a}}, {0x833a, 0x101, {0x3, 0x8}}, {0x6, 0x8, {0x3, 0x101}}, {0x9, 0x4, {0x2, 0x6}}, {0x9, 0xa, {0x3, 0xb}}, {0x9, 0x9965, {0x3, 0x1}}, {0x3, 0x5, {0x0, 0x8}}, {0x6, 0x0, {0x2, 0x5}}, {0x8, 0x7ff, {0x1, 0xb}}]}}}, {{0x254, 0x1, {{0x2, 0xe}, 0x6, 0x9d, 0x3, 0x4, 0x21, 'syz1\x00', "74a7fe1d7742e3710d4ef1a0f7924a99885d2c6a60185014a695c7eaa80f5046", "1cec8de762c2db8a2735b281d35ed7d59d60e7bde7fa086775fc23ec3f801871", [{0x3c6, 0x7ff, {0x3, 0x40}}, {0x7, 0xfffc, {0x0, 0x7ff0000}}, {0x9, 0x80, {0x1, 0xa}}, {0x5, 0x8990, {0x3, 0x4}}, {0xfffd, 0x7f, {0x2, 0xbaa4}}, {0x81, 0x6, {0x1, 0xff}}, {0x2, 0x9, {0x3, 0xfffffffe}}, {0x6, 0x7, {0x1, 0x9}}, {0xb, 0x2, {0x1}}, {0x9, 0x7, {0x0, 0xd5d5}}, {0x8000, 0x6, {0x3, 0x2}}, {0x8, 0xf, {0x0, 0x4}}, {0xaa1, 0x9, {0x2, 0x8}}, {0x7ff, 0x9, {0x1, 0x4}}, {0x4, 0x2, {0x2, 0x6}}, {0x7, 0x6, {0x2, 0xfffffff8}}, {0x7, 0x3, {0x0, 0x9}}, {0x7, 0x4, {0x1, 0x7ff}}, {0xbb77, 0x6, {0x3, 0x9}}, {0x2, 0xff01, {0x0, 0x7}}, {0xdc, 0x5, {0x2, 0x4}}, {0x7, 0x2, {0x2, 0xfee}}, {0x2, 0x8, {0x2, 0x3ff}}, {0x5, 0x6, {0x1, 0x1}}, {0x1000, 0xd, {0x1, 0x7f}}, {0x5, 0xe15, {0x0, 0x4}}, {0x6, 0xff, {0x2, 0x3}}, {0x4, 0x2, {0x1, 0xc1f2}}, {0x400, 0x9, {0x2, 0x8}}, {0xeae1, 0x1, {0x3, 0x6}}, {0x7f, 0x7, {0x1, 0x2}}, {0x3, 0x1, {0x3, 0x1}}, {0x591, 0x1cd, {0x0, 0x3b6a}}, {0x9, 0x7, {0x0, 0x18}}, {0x6, 0x4, {0x2, 0x2}}, {0x5, 0x9, {0x3, 0x5}}, {0x5, 0x2, {0x2, 0x8001}}, {0x4, 0x2, {0x1, 0x8}}, {0x6, 0x7, {0x1, 0x1}}, {0xfff, 0x5, {0x2, 0x7fffffff}}]}}}, {{0x254, 0x1, {{0x2, 0x316ec36d}, 0x6, 0x81, 0x3e6, 0x9, 0x8, 'syz1\x00', "6d931112dae52f32a4a010fb40e1821dae10994e88582a5a2f2c75409746b0ab", "3c40efe2926199538ebb8cd4f13c598dff3d97308bd24ce9c1e516a5a169eae3", [{0x3, 0x5, {0x1, 0xe}}, {0x3, 0x7fff, {0x2, 0x2}}, {}, {0xfff9, 0x7, {0x2, 0x6}}, {0x9, 0xfff, {0x2}}, {0xf, 0x9, {0x0, 0x80}}, {0xa, 0x1, {0x1, 0xd}}, {0x9, 0x5, {0x2, 0x3a}}, {0x4, 0x7, {0x1, 0x1000}}, {0x8, 0x4d2, {0x1, 0x2}}, {0x1ff, 0x9, {0x0, 0xfffffffc}}, {0x9, 0x4, {0x0, 0x5}}, {0x7f, 0x1000, {0x0, 0x40}}, {0x9, 0x9, {0x0, 0xc61}}, {0x3, 0x5, {0x0, 0xc}}, {0x6, 0xb6, {0x1, 0x52}}, {0x66, 0x400, {0x1, 0xfffffffb}}, {0x5, 0x5, {0x2, 0x401}}, {0x4, 0x6, {0x0, 0x8}}, {0x8, 0x7, {0x3, 0x4}}, {0x81, 0x9, {0x2, 0x71e2}}, {0x9, 0x3, {0x0, 0x80000000}}, {0x8e3, 0x97f7, {0x3, 0x8}}, {0x1, 0x7, {0x3, 0xc6c}}, {0x1, 0xfffd, {0x2, 0x1}}, {0x7, 0xe93f, {0x2}}, {0x3, 0x5, {0x1, 0x10000}}, {0x8, 0x80, {0x3, 0xc0000000}}, {0x7, 0x5, {0x3, 0x84c}}, {0x5, 0x4, {0x3, 0x6}}, {0x1, 0x4000, {0x2, 0x8}}, {0x6, 0x8, {0x2, 0x3}}, {0x4, 0x5, {0x3}}, {0x7, 0x429, {0x1, 0x8}}, {0x6, 0x5, {0x0, 0xc8}}, {0x9, 0x0, {0x2, 0x80000000}}, {0x3ff, 0x19, {0x0, 0x8}}, {0x7, 0x401, {0x2, 0x7b}}, {0x2, 0x7ff, {0x1, 0x2}}, {0xf801, 0xb1, {0x3, 0x4}}]}}}, {{0x254, 0x1, {{0x0, 0x48e4}, 0xff, 0x1, 0x9, 0x4, 0x14, 'syz0\x00', "9590cd5787fcc32643430a4816d64ff2bf259c9a00cfff1810cec799b5ce7aa9", "b94ca18afeeebf2c2f577ac7ba1aae835dfb9316947698bee9b2372970a270c4", [{0x88dc, 0x6, {0x3, 0x200}}, {0x401, 0x0, {0x1, 0x3}}, {0x9, 0x3, {0x2, 0x5}}, {0x5, 0xfc83, {0x1, 0x7ff}}, {0x2, 0x6237, {0x1, 0x6}}, {0xbf9, 0x1ff, {0x1, 0x1}}, {0x7fff, 0x1, {0x0, 0x1}}, {0xf1d1, 0x101, {0x3, 0xffff}}, {0xff, 0x9, {0x2, 0x6}}, {0x6, 0x1, {0x1, 0x5}}, {0x8, 0x7f, {0x2, 0x2}}, {0xfff9, 0xa400, {0x1, 0x7}}, {0x9, 0x3, {0x3, 0xfff}}, {0x2, 0xb35a, {0x2, 0x3}}, {0x1, 0x8, {0x0, 0x4}}, {0xfffc, 0x7, {0x2, 0x8}}, {0xfa, 0x7, {0x1, 0xc}}, {0x0, 0x81, {0x2, 0x7}}, {0x2, 0x8, {0x2, 0x40}}, {0x9, 0x6, {0x3, 0x4}}, {0x800, 0x6, {0x0, 0xb94f}}, {0x0, 0x400, {0x0, 0xffff}}, {0x7f, 0xb, {0x1, 0x2}}, {0x8, 0x5980, {0x1, 0xfffffffd}}, {0xb, 0xc, {0x1, 0xa68e}}, {0x4, 0x5, {0x0, 0x6}}, {0xed9, 0x5, {0x2, 0x3378702b}}, {0x6da9, 0x7, {0x2, 0xffffffff}}, {0x101, 0x7, {0x3, 0x7}}, {0x2, 0xd, {0x0, 0xa649}}, {0x8, 0x7, {0x1, 0x6}}, {0x9, 0x8001, {0x3, 0x3}}, {0x3, 0x5, {0x0, 0x7}}, {0xfffe, 0x9, {0x2, 0x9}}, {0x8, 0x5, {0x0, 0x3ff}}, {0x5, 0x200, {0x0, 0xffff}}, {0x2, 0xeb, {0x2, 0x3}}, {0x4065, 0xf, {0x2, 0x10001}}, {0x2, 0x15, {0x1, 0x144}}, {0x3, 0x429, {0x2, 0x4}}]}}}, {{0x254, 0x1, {{0x2, 0x2}, 0xfe, 0x3, 0xf, 0x83, 0xf, 'syz0\x00', "857be2841a39a1898613f0fd1757dd82f72d0c02a74c23a74ddb7b2e7c847d43", "681cdf0c5d3b034fa4b35c7c5b166e9b6228094c331f76ec08218c59296255bd", [{0xfffd, 0x9963, {0x1}}, {0x36, 0xfffd, {0xfc22175b821d590c, 0xfffffff9}}, {0x4, 0x40, {0x3, 0x9}}, {0xb99, 0x7, {0x3, 0x4}}, {0x8, 0xfffc, {0x3, 0x3}}, {0xffff, 0xfbff, {0x1, 0x5}}, {0x3ff, 0x2, {0x3, 0x4}}, {0x6, 0x9, {0x1, 0x7ba0}}, {0x7, 0x1800, {0x1, 0xc}}, {0xf, 0xfff, {0x0, 0x100}}, {0x5, 0x4, {0x3, 0x8ef6}}, {0xfffe, 0x0, {0x3, 0x6}}, {0x6, 0x1, {0x2, 0x7fffffff}}, {0x100, 0x9, {0x0, 0x2}}, {0x100, 0x0, {0x0, 0x4}}, {0x0, 0x10, {0x3, 0x3}}, {0x7, 0x9, {0x3, 0x42dd}}, {0xb1a, 0x775, {0x0, 0x3}}, {0x8000, 0x5, {0x1, 0x9}}, {0x2cae, 0x3, {0x0, 0x38f}}, {0x8, 0x81, {0x1, 0x92}}, {0x7dbd, 0x100, {0x2, 0x1}}, {0x5, 0x3c, {0x3, 0x400}}, {0x1, 0x53b, {0x4, 0x9}}, {0xff12, 0x200}, {0x0, 0x0, {0x3, 0x7f}}, {0x1, 0x8, {0x2, 0x8}}, {0xc526, 0xffff, {0x3, 0x2}}, {0x8, 0x3, {0x0, 0x2c20d608}}, {0x1, 0x6, {0x0, 0x5}}, {0x5, 0x0, {0x2, 0x4}}, {0x2, 0x9, {0x1, 0xff}}, {0x7, 0x7, {0x1}}, {0x3, 0x1, {0x2}}, {0x1, 0xf, {0x1, 0x4}}, {0xc, 0x7, {0x0, 0x9}}, {0x2, 0xfffe, {0x1, 0x7}}, {0x3, 0x3ff, {0x1, 0x7}}, {0x4, 0x1, {0x3, 0xc12}}, {0x6, 0x7e5, {0x1, 0x8}}]}}}, {{0x254, 0x1, {{0x2, 0x9}, 0x8, 0xa0, 0x101, 0xfff9, 0xd, 'syz0\x00', "da0d569bf586d3cfcc0607ac3b4301e176dceaf571e4f7be19018c23a285499e", "9fc8c6157b13fd8c6c8d7a2f0018c56e50b031f9855b03a03d36043c527e2b4c", [{0x3, 0x0, {0x0, 0x9}}, {0x4e4e, 0x2, {0x0, 0x5}}, {0xc1, 0x2, {0x0, 0x7}}, {0x8000, 0x8, {0x0, 0xacc}}, {0x8, 0x7, {0x0, 0x2}}, {0xd, 0x5, {0x0, 0x2}}, {0x8000, 0x9, {0x0, 0x1}}, {0x3, 0x1, {0x3, 0xb7}}, {0x4, 0x3, {0x1, 0x9}}, {0x6, 0xfff, {0x0, 0x4d}}, {0xff, 0xfff, {0x0, 0x8}}, {0xb, 0x2, {0x0, 0x1}}, {0x4, 0x4, {0x0, 0x9}}, {0x90, 0x668d, {0x3, 0xad1}}, {0x2, 0x4d71, {0x3, 0x9}}, {0x4, 0x2, {0x0, 0x3b3}}, {0x5, 0x9, {0x0, 0x10001}}, {0x6, 0x8000, {0x0, 0x1}}, {0x401, 0x5, {0x1, 0xabca}}, {0x7f, 0xf, {0x1, 0x83}}, {0x4, 0x57c7, {0x3, 0x4}}, {0xe3b, 0x81, {0x1, 0x3}}, {0x3, 0x9}, {0x6, 0x1, {0x3, 0x7}}, {0x1ff, 0x5}, {0x8, 0x4, {0x0, 0x9}}, {0x8000, 0x4, {0x2, 0xc}}, {0xfff, 0x6, {0x2, 0x9}}, {0x8, 0x6, {0x3, 0x80000000}}, {0x3, 0x8, {0x2}}, {0x6, 0x100, {0x2, 0x5}}, {0xb, 0x1, {0x1, 0x9}}, {0x1a1, 0x3, {0x0, 0x6}}, {0x6, 0x8001, {0x2, 0x4}}, {0x8, 0xbc8, {0x1, 0x2}}, {0x4, 0x800, {0x3, 0xfffffffc}}, {0x78e5, 0x5, {0x1, 0xfff}}, {0x8, 0x6, {0x2, 0x7625}}, {0x400, 0x9, {0x3, 0x2fe00}}, {0xdab, 0x6, {0x1, 0x2}}]}}}, {{0x254, 0x1, {{0x1, 0x5}, 0x8, 0x5, 0x2, 0x2, 0x10, 'syz1\x00', "b08a7bea73b3e377c1981c181a5f11d9d98ed1fe42271905ed041181b93b64a0", "67d2bdb76a38954b2eee4a70a166dbf4fd9e3464918c66887aa0e152466f2a32", [{0x1, 0x8, {0x2, 0xef}}, {0x7ff, 0x119, {0x0, 0x2}}, {0x9, 0x9c36, {0x2, 0x6}}, {0x4f38, 0x0, {0x0, 0x5}}, {0x8, 0x46, {0x2, 0xf8}}, {0x970, 0x8, {0x2, 0x2}}, {0xffff, 0x99e, {0x2, 0x6}}, {0x40, 0x3, {0x0, 0x8}}, {0x5, 0xfaa2, {0x2}}, {0x2, 0x800, {0x0, 0x2}}, {0x80, 0x3, {0x1, 0xfffffff9}}, {0x8, 0x0, {0x1, 0x7}}, {0x98, 0x7, {0xb321a07cab99b191, 0xfff}}, {0x4, 0x9, {0x2, 0x1}}, {0xf, 0x6, {0x0, 0xc}}, {0x5, 0x91, {0x0, 0x80000001}}, {0x8, 0x2, {0x1, 0x6}}, {0x4, 0xc22, {0x1, 0x3}}, {0x6, 0x7f, {0x0, 0xba4}}, {0x0, 0xa9d8, {0x2, 0x9}}, {0x36, 0xe, {0x1, 0x1000000}}, {0x9376, 0x10, {0x0, 0x5}}, {0x1ff, 0x40, {0x0, 0x87}}, {0x5, 0xff00, {0x1, 0x80000001}}, {0x5, 0x1, {0x0, 0xffffffff}}, {0xe, 0xea1, {0x2, 0x3}}, {0x3ff, 0x6d2, {0x0, 0xc2}}, {0xbb22, 0x99, {0x3, 0x9}}, {0x7, 0x2, {0x3, 0x4}}, {0x5, 0xb338, {0x3, 0x7}}, {0xffff, 0x5, {0x2, 0xfffffff9}}, {0x100, 0x0, {0x2, 0x662b}}, {0x4, 0x3ff, {0x2, 0x1000}}, {0x2, 0x9, {0x3, 0xfeca}}, {0xf800, 0x10, {0x2, 0xe9d6}}, {0x401, 0xab6, {0x1, 0x6}}, {0x1, 0x8, {0x3, 0x5}}, {0x7, 0x1, {0x2, 0xcecc}}, {0x0, 0x9b7, {0x0, 0x4}}, {0x9, 0xac8, {0x1, 0x7}}]}}}, {{0x254, 0x1, {{0x346c05407303d354, 0x81}, 0x2, 0x7, 0x100, 0x40, 0x19, 'syz0\x00', "cd6933d76aed263b3b069e20818fed790579885921d0892795e71582ad2e3294", "8d8a3fec3db1d9f3caf4f53972f7e1b548d1a47d648ef64747a5731b977f24cb", [{0x7, 0x1000, {0x1, 0x7}}, {0x2, 0x56}, {0x79d, 0x43, {0x2, 0xfc000000}}, {0xcb, 0x7b3, {0x1, 0x947}}, {0x9, 0x1ff, {0x3, 0x3}}, {0x2, 0x3, {0x1, 0x1ff}}, {0x6, 0x2, {0x0, 0x81}}, {0xc, 0x7, {0x0, 0x77e4}}, {0xe, 0x1, {0x0, 0x4}}, {0xc7df, 0x4, {0x2, 0x2}}, {0x0, 0xff, {0x0, 0xdc}}, {0x7fff, 0xfff9, {0x1, 0x47dc0000}}, {0x1, 0xff45, {0x0, 0x8}}, {0x1, 0x0, {0x0, 0x1}}, {0x1, 0x3, {0x2, 0x9}}, {0xa6a9, 0x2, {0x1}}, {0x7, 0x401, {0x0, 0x101}}, {0x5, 0x0, {0x1, 0x80000000}}, {0x5, 0x6, {0x1, 0x5}}, {0x2, 0x7ff, {0x1, 0x53ec}}, {0x8, 0x7ff, {0x1, 0x28a9e3ee}}, {0x7, 0x6, {0x3, 0x9}}, {0x5, 0x5, {0x2, 0xb929}}, {0x90b, 0x2, {0x3, 0x2}}, {0xa05, 0x4, {0x1, 0xd}}, {0x0, 0x914, {0x0, 0x76}}, {0x3ff, 0xfff9, {0x0, 0x8}}, {0x4, 0xcd, {0x3, 0x4}}, {0x8, 0x4, {0x3, 0x4}}, {0xe, 0x0, {0x1, 0x6}}, {0xef7, 0x2, {0x1, 0x101}}, {0x3, 0x3ff, {0x1}}, {0x2ac6, 0x100, {0x1, 0x6}}, {0x5, 0x1ff, {0x2, 0x9}}, {0x8001, 0x1, {0x2, 0xfffffffa}}, {0x400, 0x4, {0x3, 0x8001}}, {0x725, 0x44e, {0x0, 0x9}}, {0x7, 0x6, {0x3, 0x7ff}}, {0x8, 0x400, {0x2, 0x7}}, {0x9, 0x9, {0x2, 0xfffffff8}}]}}}, {{0x254, 0x1, {{0x2, 0x1}, 0x81, 0x6b, 0xd79e, 0xfff, 0x26, 'syz0\x00', "35b2394bf65c966984f1407ec97f6c4248b9732071a61befddcd8a916a15d145", "a8925bcd0fe2c0ecedd96544c23d75a1cb7c16bd668a8ad352cd2ee0f81d6f88", [{0x6, 0x6, {0x0, 0x81}}, {0x3, 0xae62, {0x1, 0x9}}, {0xff, 0x5, {0x1, 0x5}}, {0x8, 0xa33, {0x3, 0x4}}, {0x7, 0xfffe, {0x0, 0x5}}, {0x4, 0x1, {0xe7563e64979de987, 0xfff}}, {0x404, 0x6, {0x1, 0xae}}, {0xf, 0x2, {0x2, 0x10000}}, {0x9, 0x7fff, {0x2}}, {0x8, 0x4, {0x1, 0x661}}, {0x5, 0x5, {0x2, 0xc}}, {0xffc, 0x2d, {0x0, 0x7}}, {0x6, 0x8, {0x0, 0xff}}, {0x9, 0xb, {0x2}}, {0x7, 0xa09c, {0x1, 0x3}}, {0x5, 0x6, {0x3, 0x3}}, {0x6, 0x9, {0x2, 0x2}}, {0x8df, 0x1ff, {0x0, 0x80}}, {0xff2b, 0xca79, {0x0, 0x3}}, {0x0, 0x1fc8, {0x0, 0x6f}}, {0x6, 0x4, {0x3, 0x400}}, {0x96b, 0x9e5a, {0x1, 0x9}}, {0x400, 0x7f, {0x2, 0x7}}, {0x64db, 0x4, {0x1, 0xa00}}, {0x1000, 0xff3d, {0x2, 0x7}}, {0x6a9, 0x5, {0x2, 0x8}}, {0x3, 0x8000, {0x2, 0x10001}}, {0x0, 0xff80, {0x2}}, {0x429, 0x4, {0x1, 0x401}}, {0x5, 0x2, {0x2, 0x10}}, {0x1ff, 0x9, {0xe3be280af084d210, 0x400}}, {0x9, 0x7, {0x1, 0x101}}, {0x8, 0x61, {0x3, 0x3}}, {0x0, 0x6, {0x3, 0xffffffff}}, {0x80, 0x6, {0x0, 0x3}}, {0x0, 0xc, {0x1, 0xd}}, {0x0, 0x8000, {0x0, 0x4}}, {0x3ff, 0x9d8, {0x0, 0x3}}, {0x8, 0x4, {0x1, 0x1}}, {0x4, 0x2, {0x1, 0x5}}]}}}]}, 0x1508}, 0x1, 0x0, 0x0, 0x4004004}, 0x840) r4 = socket$inet6(0xa, 0x80000, 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001900)={@cgroup=r3, 0x31, 0x1, 0x3, &(0x7f0000001800)=[0x0], 0x1, 0x0, &(0x7f0000001840)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001880)=[0x0], &(0x7f00000018c0)=[0x0]}, 0x40) bpf$ENABLE_STATS(0x20, &(0x7f0000001940), 0x4) r5 = socket(0x29, 0x4, 0x5) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) pwritev(r5, &(0x7f0000001980), 0x0, 0x0, 0x4) bpf$ENABLE_STATS(0x20, &(0x7f00000019c0), 0x4) sendmsg$rds(r6, &(0x7f0000002b00)={&(0x7f0000001a00)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f0000002ac0)=[{&(0x7f0000001a40)=""/37, 0x25}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000002a80)=""/44, 0x2c}], 0x3, 0x0, 0x0, 0x800}, 0x40000) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002b40), 0xffffffffffffffff) r8 = accept4$x25(r5, &(0x7f0000002b80)={0x9, @remote}, &(0x7f0000002bc0)=0x12, 0x80800) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000002d00)={r8, &(0x7f0000002c00)='syz0\x00', 0x2200, &(0x7f0000002c40)={@_ha_fsid={[0x1, 0xb247]}, {0xd33, 0x4, 0x884, 0x9}}, 0xd, &(0x7f0000002c80), &(0x7f0000002cc0)=0x6}) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x20, 0x4, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x85) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r10, &(0x7f0000002f00)={&(0x7f0000002e40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000002ec0)={&(0x7f0000002e80)={0x1c, r7, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44004}, 0x10000) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000030c0)={0x6, 0x13, &(0x7f0000002f40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x39, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@cb_func={0x18, 0x1}, @map_val={0x18, 0x8, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0xf}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000003000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000003040)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000003080)={0x5, 0x8, 0x7, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000003480)={r2, 0xe0, &(0x7f0000003380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000003180)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, &(0x7f00000031c0)=[0x0], &(0x7f0000003200)=[0x0, 0x0], 0x0, 0xdd, &(0x7f0000003240)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f00000032c0), &(0x7f0000003300), 0x8, 0x9b, 0x8, 0x8, &(0x7f0000003340)}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000034c0)={r11}, 0x4) getsockopt$IP_VS_SO_GET_DESTS(r4, 0x0, 0x484, &(0x7f0000003500)=""/215, &(0x7f0000003600)=0xd7) recvmsg$unix(0xffffffffffffffff, &(0x7f0000003840)={&(0x7f0000003680)=@abs, 0x6e, &(0x7f00000037c0)=[{&(0x7f0000003700)=""/67, 0x43}, {&(0x7f0000003780)=""/32, 0x20}], 0x2, &(0x7f0000003800)=[@cred={{0x1c}}], 0x20}, 0x40) 2.384619137s ago: executing program 0 (id=4343): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x18, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000f000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005d09010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="ffb0000000000000b708000092a200007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.245327607s ago: executing program 0 (id=4345): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000680)={0x2e4, r2, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0x4c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK={0xc0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x57f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x84ca}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_LINK={0xd8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x881}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3076e57a}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffff001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MEDIA={0x84, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x759}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_BEARER={0x68, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x16, 0x1, @l2={'eth', 0x3a, 'veth1_to_team\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x28}}}, {0x14, 0x2, @in={0x2, 0x4e21, @empty}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8}]}]}, 0x2e4}, 0x1, 0x0, 0x0, 0x4040040}, 0x8800) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB="280000001e00431b000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000000006004000008000a00", @ANYRES32=r1], 0x28}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000640)=ANY=[@ANYBLOB="280000001e00431b000000000000000007000000", @ANYRES32=0x0, @ANYBLOB="000000006004000008000a00", @ANYRES32=r1], 0x28}}, 0x0) 2.125124779s ago: executing program 4 (id=4346): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x6, 0x4, 0x9, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffd}, [@map_fd={0x18, 0xa, 0x1, 0x0, r1}]}, &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x1000007, @ipv4={'\x00', '\xff\xff', @local}, 0x800001}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000400)=@framed={{0xc3, 0xa, 0xa, 0xfe00, 0x50, 0x71, 0x10, 0x1a}}, 0x0, 0x6, 0x0, 0x0, 0x0, 0x48}, 0x94) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x5, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000060)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) write(0xffffffffffffffff, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/88, 0x58) r2 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000140)='syzkaller\x00', 0xd, 0x1000, &(0x7f0000002cc0)=""/4096, 0x40f00, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x19c00, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x0, 0x2, 0x5b, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)={0x1c, 0x37, 0x1, 0x7fffc, 0x25dfdc01, {0x1}, [@nested={0x8, 0x4, 0x0, 0x1, [@nested={0x4, 0x13}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) 2.122059999s ago: executing program 1 (id=4347): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x39}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70000000, '\x00', 0x0, 0x24}, 0x90) 2.078487787s ago: executing program 0 (id=4348): syz_emit_ethernet(0x66, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0xb0, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_WANTED={0x9c, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x29, 0x4, "9ebf89a6efed047a754a2dd316fbd22de257b81aec75ce93c9c989f1a9e3a1eb278565932b"}, @ETHTOOL_A_BITSET_MASK={0x61, 0x5, "a4f827345ff1072c2aaabce6f7c81bd8c0e78f44f55daecbd4f5e21df266dd83949a027838d5c258816744a078a99048bb706383df8efb9a2ca03ae858de7c9be84c86b6d1709f6295c6961c06d3a06f98e6a21887ad7e5c09ed761ac5"}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000540)=""/6, 0x6}, {&(0x7f0000000680)=""/190, 0xbe}], 0x2}, 0x2001) sendmmsg$alg(r1, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) unshare(0x6a040000) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000400)={0x4, 0x6, 0xfe, 0xfd, 0xfe, 0x9, 0x5, 0x1, 0x0, 0xff, 0x28, 0x5, 0x0, 0x2}, 0x25) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x11, 0xffffffffffffffff, 0x4b291000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1400000016000b63d25a8064100094f90224fc05", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) 1.983826896s ago: executing program 3 (id=4349): bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x1}, 0x6) 1.909674116s ago: executing program 1 (id=4350): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newtaction={0x64, 0x30, 0x9, 0x70bd28, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x11, {{0x40, 0x80000000, 0x20000000, 0xdbe, 0x300}, 0x3}}]}, {0x4, 0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r2) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000040000001400050003030000000a0000005dc00006000000080002000500000014000600ff01000a00f2f3"], 0x4c}, 0x1, 0x0, 0x0, 0x8004}, 0x4040000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e23, 0x7, @loopback, 0x6}}, 0x8, 0x1}, &(0x7f00000000c0)=0x90) sendmmsg$inet6(r1, 0x0, 0x0, 0x880) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r5, &(0x7f0000000080), &(0x7f0000000200)=""/155}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x4, &(0x7f0000001800)={{r5}, 0x0, &(0x7f00000017c0)='%pS \x00'}, 0x20) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000240), r2) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r6) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x38, r7, 0x60b, 0x70bd2d, 0x0, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x4}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x38}}, 0x20080000) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x60, 0x30, 0x9, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_bpf={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{}, {0x35, 0x0, 0x5}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x60}}, 0x0) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000002800000028000000020000000100000000000001e5ff0000400000000000000001000084080000000000000001"], 0x0, 0x42}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x6, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, r9, 0x0, 0x2}, 0x50) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000440)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000480)={'wpan0\x00', 0x0}) sendmsg$NLBL_CIPSOV4_C_LIST(r2, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x14, 0x0, 0x300, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) sendmsg$IEEE802154_LIST_IFACE(r6, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x68, r8, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r11}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000080}, 0x800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001f40)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r12, 0x1, 0x4c, &(0x7f0000000000), 0x15) recvmsg$unix(r12, &(0x7f0000000700)={0x0, 0x5f, 0x0, 0x0, &(0x7f0000000180), 0x1400}, 0x2) sendmsg$unix(r12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18, 0x20000084}, 0x4048844) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYRES16=r6, @ANYBLOB="90c7c7152fd9423d57da9429a27cf1f60db3de562385be99265dc6a4945a368f6f4ca79f78c2d4bb35d04d5c9c7658ea3a2db4a0891e1f6abb31", @ANYRES32=r6], 0x9c}, 0x1, 0x0, 0x0, 0x24008001}, 0x24008090) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000037000900fcff1e00fedbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x20004880}, 0x200080c4) 1.893484829s ago: executing program 4 (id=4351): socketpair(0x1a, 0x80a, 0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NL80211_CMD_LEAVE_IBSS(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0x7fff, 0x2b}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), r0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r2, 0x114, 0x70bd28, 0x25dfdbfe, {{}, {}, {0x1c, 0x18, {0x1, @bearer=@l2={'ib', 0x3a, 'veth1_virt_wifi\x00'}}}}, ["", "", "", "", ""]}, 0x38}, 0x1, 0x0, 0x0, 0xc00}, 0x44000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r3) sendmsg$NL802154_CMD_SET_PAN_ID(r3, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r4, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0x2}, @NL802154_ATTR_PAN_ID={0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x8c11}, 0x80) r5 = accept$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000440)=0x14) close(r5) sendmsg$AUDIT_LIST_RULES(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x10, 0x3f5, 0x200, 0x70bd2c, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4040001}, 0x48001) ioctl$INCFS_IOC_PERMIT_FILL(r0, 0x40046721, &(0x7f0000000580)={r5}) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000600)=@generic={&(0x7f00000005c0)='./file0\x00', 0x0, 0x30}, 0x18) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000780)={r6, &(0x7f0000000640)="e128813bfd909b2da73ed5f0cbcbbabbbfcb076bd3377dc45e7b9797a36a94eefdefb93abb0db97b8a6f15f32bf4b0573d5756d261888770fd4719c229df1322b5098a6415c37bc74200c95e7f15497aed7fa6e02b801f09503650f3ecf752a7f10deb3cfb04e4c5063f6c7670d28b8948b9f5", &(0x7f00000006c0)=""/173, 0x4}, 0x20) r7 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000980)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f00000007c0)=""/216, 0xd8, 0x0, &(0x7f00000008c0)=""/144, 0x90}, &(0x7f00000009c0)=0x40) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x74, 0x0, 0x8, 0x0, 0x0, 0x0, {0x1, 0x0, 0x4}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x806}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6005}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x21}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0xf047531c4253d11}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0xb2}]}, 0x74}, 0x1, 0x0, 0x0, 0x4004044}, 0x2000080) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_TX_POWER(r8, &(0x7f0000000c40)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000c00)={&(0x7f0000000b80)={0x60, r4, 0x400, 0x70bd27, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xa21}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x5}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x1000}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4042050}, 0x8000) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r1, &(0x7f0000000e40)={&(0x7f0000000c80), 0xc, &(0x7f0000000e00)={&(0x7f0000000cc0)={0x114, 0x3, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x5}, [@CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x8}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0xea}]}, @CTA_PROTOINFO={0x10, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0xc, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0xff}]}}, @CTA_TUPLE_ORIG={0xc0, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @rand_addr=' \x01\x00'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_LABELS={0xc, 0x16, 0x1, 0x0, [0x4, 0x7]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x4}]}, 0x114}, 0x1, 0x0, 0x0, 0x400c0}, 0x20004080) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000e80)={0x3, [0x0, 0x0, 0x0]}, &(0x7f0000000ec0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000f00)={r9, @in6={{0xa, 0x4e22, 0x6, @local, 0x3e}}, 0x14d1, 0x51}, &(0x7f0000000fc0)=0x90) socket$kcm(0x29, 0x5, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000001000), r8) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000001080), r1) sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000001200)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000011c0)={&(0x7f00000010c0)={0x100, r11, 0x106, 0x70bd2c, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}]}, 0x100}, 0x1, 0x0, 0x0, 0x28000}, 0x8040) ioctl$FIOCLEX(r1, 0x5451) clock_gettime(0x0, &(0x7f0000001300)={0x0, 0x0}) pselect6(0x40, &(0x7f0000001240)={0x1, 0x400, 0x6, 0x3, 0x200, 0x0, 0x1, 0x8000}, &(0x7f0000001280)={0x7, 0x10000, 0xd93, 0x0, 0x5, 0x22d2a799, 0x10000, 0xffffffffffffffff}, &(0x7f00000012c0)={0x1, 0xffffffffffffffff, 0x5, 0x7fffffff, 0xc, 0x0, 0xffffffffffffffff, 0xa5}, &(0x7f0000001340)={r12, r13+60000000}, &(0x7f00000013c0)={&(0x7f0000001380)={[0x40]}, 0x8}) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000001400)={r10, 0xb6, 0x4}, 0x8) 1.840685565s ago: executing program 3 (id=4352): sendmsg$inet(0xffffffffffffffff, &(0x7f0000002080)={0x0, 0x0, 0x0}, 0x805) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x2, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x21) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r1, 0x11e, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x63, 0x10, &(0x7f0000002e00), &(0x7f0000001000), 0x8, 0xa0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0xffffffa9) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, 0x0, &(0x7f0000000080)) ioctl$PPPIOCDISCONN(r0, 0x7439) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000040)={'wg2\x00'}) 1.627397057s ago: executing program 3 (id=4353): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) (async) r2 = socket$kcm(0x29, 0x5, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) r4 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) setsockopt$sock_int(r4, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) (async) sendfile(r2, r3, 0x0, 0xffffffff000) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, 0x0, 0x0, 0x70bd2c, 0x25dfdc00, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40010) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r5, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) (async) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) (async) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) (async) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) (async) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$AUTOFS_IOC_CATATONIC(r0, 0x9362, 0x0) (async) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b00000000000400"], 0x44}}, 0x0) (async) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.394589882s ago: executing program 4 (id=4354): socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x38, 0xffff, 0x0, 0x0, 0x5, 0x0, @dev={0xac, 0x14, 0x14, 0x32}, @private=0xa010100}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x9, 0x0, 0xfffd, 0x0, 0x0, {[@sack={0x5, 0x6, [0x7f]}, @sack={0x5, 0xa, [0x2, 0x80]}]}}}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000005100)=@newtaction={0x74, 0x1e, 0x109, 0x100, 0x0, {}, [{0x60, 0x1, [@m_ife={0x30, 0x10, 0x0, 0x0, {{0x8}, {0x4}, {0x6, 0x6, "8034"}, {0xc, 0x7, {0x92f52d05a60322be, 0xc58826ad51c40e66}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x2c, 0x11, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x74}, 0x1, 0x2b1e}, 0x40810) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x0, 0x0}, 0x8) r2 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000003a40)={0x11, 0xf, &(0x7f0000000300)=ANY=[@ANYRESHEX=r2, @ANYBLOB="0000000000000000b702000014000000b703000000000000850000008300bf0900000000000055090100000000000a432c279500000000000000bf91000000000000b7020000010000008500000084000000b700000000ffff0095000000000000000000c2"], 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x42, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000100000ac0010000050a01020000000000000000000000090a000700726f7574650000007c0008800c00024000000000000000060c0001400000000000000fff0c00014000000000000000060c00014000000000000000010c00024000000000000100010c00014000000000000000080c00024000000000000000010c000140000000007fffffff0c00024000000000000000030c000140fffffffffffffffc0b00070066696c74657200000b00070066696c7465720000ee000c003916eb860f644ca7a7f58bab23724f8a61387016db5a15bf3a0e5224d6188b7797002cecc82f3c1574a036f55eb5b7fb00ef4531209e55b3798ccc91b40964501a2d49afb712eb40035239c0f0fd48f702ed87a901a05f26987e3a9bee99eb42fd6002dafc046c7506507b6d02f74bb9da29527c9f78f1c0e79694b1132755ec44e50f1f8e350d5add6d4899fc0474c77ca74686eb27d9bfb90b4d5afaacbd5923f377034a2f6ce35887dc01baf3090031375456f089da31744075ea9c88ad62150b70ae4ed4a067e61089afa7bc874f23a2c2c4c7a5dcadc398c316fc98e992e42728df3fd634ad9c0c000008000a40000000020900010073797a310000000008000a4000000004600200000e0a03000000000000000000050000024c02038004000080100000800c00044000000000000000083402008024010280170001004abda27873147cd25d46bde50e525f20ad95d0001c00028008000180fffffffb080003400000000308000180ffffffff28000100dae3119acb8a3b1fd3e92060a60525dd0ef2b5650a67b17ad08040ccf2ad510603c96e87500002800900020073797a310000000008000180fffffffe08000340000000030900020073797a30000000000900020073797a31000000000800034000000003080003400000000208000180000000005000828008000180ffffffff08000340000000060900020073797a31000000000900020073797a32000000000900020073797a310000000008000180fffffffd08000340000000020800034000000003200002800900020073797a320000000008000180fffffffd0800034000000001040002800900090073797a320000000000010280240002800900020073797a31000000000900020073797a320000000008000180fffffffb0c00028008000340000000035c0002800900020073797a310000000008000180fffffffc0900020073797a31000000000900020073797a300000000008000180ffffffff080003400000000408000340000000010900020073797a310000000008000340000000026e000100a5344d1dfed0c459328af4a72949f3c85e96cbc7428c757e5a081fae5fd9f32c3db4f24964f58ebb119195d8196a18d6c8d4c1eee9c5fa30dec8c6f93277b6c3c4d2d52581f084963af491926a45a1268c883656f13f35adc2b18396f3d54854769925b57eb6299c2b76000014000000060a0104000000000000000001000000140000001100010000000000000000000000000a"], 0x45c}}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e2c, 0xfffffffe, @private1={0xfc, 0x1, '\x00', 0x2}, 0x9}]}, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000500)={0x81, 0x0, 0x4, 0x3, 0x6, 0x3, 0xec, 0xe69e, r4}, 0x20) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[], 0x44}}, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={0xffffffffffffffff, 0x18000000000002a0, 0x10, 0x0, &(0x7f0000000640)="5aee41dea43e63a3f7fb7f11c72b7493", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.083089005s ago: executing program 3 (id=4355): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x6) sendmsg$kcm(r1, 0x0, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r2}, 0x4) r3 = socket$alg(0x26, 0x5, 0x0) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, 0x0, 0x0, 0x40800) recvmsg$can_bcm(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x12153) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r5, &(0x7f0000000700)={@val={0x8, 0x800}, @val={0x0, 0x3, 0x0, 0x1}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x89, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2=0xe0000001}, {{0x0, 0x4e23, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0xfffe}}}}, 0x36) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, 0x0, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, &(0x7f0000000000)=0x1, 0x4) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x0, @vifc_lcl_ifindex=0x1, @empty}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x7, 0x3e8}]}}}, @IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x48}}, 0x8004042) write(r8, &(0x7f00000001c0)="340000001a000100000000000000000002202000000000a326f3c49dce0002e4ff1414bbd795dd48e9e45469b29dbf3d660800"/65, 0xffffff7a) syz_emit_ethernet(0x3e, &(0x7f0000000100)=ANY=[@ANYBLOB="bbbbbb13f29f2ce3c3bbbbbb00000000003e1804f0100030006500000001907864010101ac1414bb030590780006001f45eb07ff00681ce2d92f0e5c64810102ac37dddeb16e161a4055111c3cf9b15e530ac5a95edec7569055e95610d68c0900000000000000806438f998b1f72673e66e56db80333ea38016721d5fc8e31fe65f782dca28abaf5a49954fb6b3ce22e01a2da79088"], 0x0) 1.033118743s ago: executing program 4 (id=4356): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_delroute={0x24, 0x19, 0x1, 0x70bd27, 0x25dfdbfb, {0xa, 0x14, 0x20, 0x0, 0xfd, 0x1, 0xc8, 0x7, 0x3600}, [@RTA_EXPIRES={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c0}, 0x4010) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00'}) syz_emit_ethernet(0x32, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000080045000024000000914411907864010101ac14142200007aec9e19144e2000109078220500010000000052813a82c587e76a37846af56f118816419141602771e573b420f7de28edc4e42b14a2029c424a41e70a9b1bbad4752637e9f70bc2e85306c4f755fb2c61ef6e26e0fb93442fb3055269a25d7f022a0b3961bcd6260953e7d1efc7343f6c4d293bfcd34c40ca1ea12fa6d9f4acc77d01994fbbf9a6fa64e70c93826da2f1"], 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) (async) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, 0x0, 0x0, 0x20000090, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xe, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2}, 0x94) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0xf, 0x0, 0x0) (async) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0xf, 0x0, 0x0) write$cgroup_subtree(r5, 0x0, 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) openat$cgroup_type(r5, &(0x7f0000000500), 0x2, 0x0) (async) openat$cgroup_type(r5, &(0x7f0000000500), 0x2, 0x0) ioctl(r4, 0x8b1b, &(0x7f0000000040)) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a4c000000060a01f268150400000000000000000200ffff80000480140001800b0001006578746a64720000040002800900010073797a30000000000900020073797a320000000005000740ba000000140000001100010000000000000000000000000a"], 0x74}}, 0x20000000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @rand_addr=0x64010100}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r6, 0x84, 0x78, &(0x7f0000000100)=r9, 0x4) r10 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r10) (async) close(r10) 938.635629ms ago: executing program 1 (id=4357): unshare(0x22020400) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000140)={r4, 0x6}, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'veth0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) socket$inet_smc(0x2b, 0x1, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r8, 0x215eb000) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c0000001400010127bd7000fddbdf25012508104e244e2403000000ffff00000f000000c300000006000000000000000000004007000000757f8c66c9f05789ef987ab931ddc185fb0554d95bccd6e00ee6519af0df213c604756ffa9c6f159d28ae7"], 0x4c}, 0x1, 0x0, 0x0, 0x40480cc}, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r7) sendmsg$ETHTOOL_MSG_COALESCE_SET(r7, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c000000538268b7d26674f819bfcead03a900f5e5555f0f5eb5308d58a4d09bec35cd95b31bb27e", @ANYRES32=r3, @ANYRES16=r0], 0x3c}, 0x1, 0x0, 0x0, 0x2c081}, 0x14040015) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x1, 0x70bd29, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xb}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x40041) socketpair(0x23, 0x800, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="12fd03f392f35f7a000000093d641f326330107941b72f607b6b08a0e2ce9aac6015", @ANYRESDEC=0x0, @ANYRESOCT=r11, @ANYRES32=r10, @ANYBLOB="78e72bf8135edc871292f28eff34606f6acf50d0db42f5fabcc185bc07fb5c3feba01a2c7b1a315cc00c17b186c75faf02668588275374917aec387f0c77dca0fa317475344de6acf846efb6de72b564d6b8e76b7725a8e43a8f33f98ba070db86851f7bbd444505ce53533e1065a069fea9ab2dd46edf225db6608f0b47935d3d567aff33765b0b72ea4f7dcc43858c53fff2e757a81573bb1df0c45410", @ANYBLOB="00005212db9f25548bbec97eb5006300"/36], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r12, 0x0, 0x0, 0x1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000005c0)={&(0x7f0000000640)=ANY=[@ANYBLOB], 0x288}, 0x1, 0x0, 0x0, 0x20000040}, 0xc085) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) r13 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r13, 0x8914, 0x0) 767.255718ms ago: executing program 2 (id=4358): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x10440}}}}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="6000000010000304000300000000000000c30000", @ANYRES32=0x0, @ANYBLOB="00000000010000003000128009000100766c616e00000000200002800c0002001e0000001f00000006000100fc0f00000600050088a8000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6], 0x60}}, 0x8000) 512.467323ms ago: executing program 3 (id=4359): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x700, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x2401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x60, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x50, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TARGET_INFO={0x34, 0x3, "64000000746573745f6c6162656c000000000000050000000000000000000000000100"/48}]}}}]}]}], {0x40, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x104}}, 0x0) 339.800057ms ago: executing program 3 (id=4360): syz_emit_ethernet(0x66, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0xb0, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_WANTED={0x9c, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x29, 0x4, "9ebf89a6efed047a754a2dd316fbd22de257b81aec75ce93c9c989f1a9e3a1eb278565932b"}, @ETHTOOL_A_BITSET_MASK={0x61, 0x5, "a4f827345ff1072c2aaabce6f7c81bd8c0e78f44f55daecbd4f5e21df266dd83949a027838d5c258816744a078a99048bb706383df8efb9a2ca03ae858de7c9be84c86b6d1709f6295c6961c06d3a06f98e6a21887ad7e5c09ed761ac5"}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000540)=""/6, 0x6}, {&(0x7f0000000680)=""/190, 0xbe}], 0x2}, 0x2001) sendmmsg$alg(r1, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) unshare(0x6a040000) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000400)={0x4, 0x6, 0xfe, 0xfd, 0xfe, 0x9, 0x5, 0x1, 0x0, 0xff, 0x28, 0x5, 0x0, 0x2}, 0x25) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x11, 0xffffffffffffffff, 0x4b291000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1400000016000b63d25a8064100094f90224fc05", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) 314.958188ms ago: executing program 2 (id=4361): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x39}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x7b000000, '\x00', 0x0, 0x24}, 0x90) 173.669326ms ago: executing program 2 (id=4362): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xa, 0xb, 0x42, 0x3e, 0x42}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x7, &(0x7f00000014c0)=""/4101, 0x4000000, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) 36.599815ms ago: executing program 4 (id=4363): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bond_slave_1\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x9, &(0x7f0000000280)=ANY=[@ANYBLOB="1808000000000000000000c9e07c000000f3240018100000e0b609677b5140ac781dbaff446f1db4aa3e303230d282ccc57383d012005bf378eefc41a7f6e1a70d4efe0fc513f55c518670a7675abca4196314a369e0ae36ed4faa5f89358fd49e0db5000000", @ANYRES32, @ANYBLOB="0000a2000000000066000000000000001800000000000000000000000000000095000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000004c0)={r3, 0x3, 0x6, @local}, 0x10) r4 = socket(0x10, 0x3, 0x0) sendmsg$inet(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04000081000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000600000004000000000000010400000020040000000000000000000d04000000000000000000001004000000040000000000000f030000000000000061"], 0x0, 0x52}, 0x28) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={r6, 0x1, 0x6}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r8) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r12 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=@newtfilter={0x488, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r13, {0xffff, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x458, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_POLICE={0x444, 0xa, 0x0, 0x1, [@TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x1, 0x40, 0xdc2, 0x1000, {0x7, 0x1, 0xe, 0x6, 0x6, 0x1}, {0x0, 0x1, 0x94, 0x9, 0x401}, 0x9, 0x5, 0x6}}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x6, 0x5, 0x5, 0x0, 0x1, 0x7, 0x4, 0x4, 0x7, 0x3e97, 0x5, 0x18, 0xd, 0xfff, 0x0, 0x5, 0x8, 0x6, 0x0, 0xfce, 0x9, 0x8, 0x5, 0xfff, 0x6, 0xf, 0x6, 0x0, 0x8, 0x5edaf873, 0x1, 0xffff, 0xf1, 0x7, 0x7fffffff, 0x7ff, 0x8, 0x5, 0x4, 0x963e, 0x3, 0x56, 0xfff, 0x875, 0x29c, 0x1000, 0x400, 0x2, 0x1, 0x9, 0x9, 0xfffffffe, 0x7, 0x400, 0xffffff81, 0x0, 0x9, 0x2000, 0x1e2, 0x5, 0xfffffff8, 0x4, 0x0, 0x0, 0x2, 0x7f, 0x0, 0x621, 0x0, 0xff, 0x1ff, 0x3, 0x0, 0x2, 0x9, 0x8, 0x5, 0x3568, 0x4, 0x10001, 0x4, 0x6, 0x5, 0x7fff, 0x4, 0x5, 0x877, 0x6, 0x7, 0x5, 0x7, 0x1, 0x1ff, 0x200, 0x0, 0x9, 0x8, 0x0, 0x7b, 0x3ff, 0x4e, 0xf, 0x3, 0x400, 0x101, 0xfffffff4, 0x1, 0x3, 0x2332, 0x732d4911, 0x9, 0x7, 0xa48, 0x6, 0x7fff, 0x8, 0x6, 0x8, 0xfffffffd, 0x18b, 0x9, 0x7fffffff, 0x5, 0x51e, 0xfffffff8, 0x5, 0x1, 0x7fffffff, 0x6, 0x5, 0x2, 0x0, 0x7ff, 0xa, 0x80000001, 0xde, 0x7a, 0x5, 0x3, 0x1, 0x2, 0x7, 0x6, 0x2792, 0x7, 0x1, 0x8, 0x5, 0x5, 0xa, 0x5, 0x7, 0x400, 0x7, 0x3, 0x2, 0x5, 0x2, 0x252, 0x1, 0x4, 0x40000, 0x3, 0x6, 0x101, 0x1, 0x10, 0x3, 0x4, 0xc, 0xfffff801, 0x8, 0x0, 0x1, 0x6, 0x80000000, 0x1c, 0xd810, 0x1, 0x8001, 0x80, 0x5, 0x1, 0xfffffff8, 0x800, 0x4, 0x9, 0x9, 0x90000000, 0x5, 0x8, 0x6, 0x3ff, 0x53b2, 0x0, 0x9, 0x7, 0x7f, 0x6, 0x1, 0x4, 0xc7, 0x5, 0x6, 0x5, 0x5, 0x7fff, 0x12bc, 0x3, 0xffffffff, 0x1, 0xd, 0xa64, 0x5, 0xfffffff9, 0x2, 0x8, 0x8, 0x200, 0x8, 0xe512, 0xb5, 0x3, 0x0, 0x9f, 0x0, 0x7f, 0x6, 0x1, 0x3b1c, 0xc7, 0x2, 0xfffffffc, 0xa0, 0x100, 0x2, 0x6, 0x101, 0x3ff, 0x2, 0x8, 0x70, 0xd5, 0xffffffff, 0xf, 0xc, 0x1, 0x401, 0xffffffff, 0x1, 0x19d, 0x10001, 0x8fde, 0x8, 0x9]}]}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x884}, 0x40) r14 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r14, 0x107, 0xf, &(0x7f0000000600), 0x56) 0s ago: executing program 2 (id=4364): ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000100)={0x2, 'ipvlan1\x00', {0x7}, 0x3}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18090000000000000000009500070000000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081064e81f782db44b9040a1d08040600000000f309a1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4ee0000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd400d65afd67580ae4edef5d2defd5ccae8d3fb7c27a1059ae31c6", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x4) sendmmsg$inet(r0, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) kernel console output (not intermixed with test programs): he MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 469.264350][T17941] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 469.318714][T17941] hsr_slave_0: entered promiscuous mode [ 469.326030][T17941] hsr_slave_1: entered promiscuous mode [ 469.332710][T17941] debugfs: 'hsr0' already exists in 'hsr' [ 469.339046][T17941] Cannot create hsr debugfs directory [ 469.420239][T17910] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 469.898711][T15897] Bluetooth: hci3: command tx timeout [ 470.054528][T17992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3490'. [ 470.084754][T17992] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3490'. [ 470.382937][T17941] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.418872][T17941] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.458288][T17941] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 470.778657][T17941] bond0: (slave netdevsim1): Releasing backup interface [ 470.832185][T17941] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.864320][T17941] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.896236][T17941] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 471.213533][T17992] lo speed is unknown, defaulting to 1000 [ 471.344603][T17941] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.381924][T17941] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.422399][T17941] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 471.768893][T18044] IPv6: Can't replace route, no match found [ 471.838751][T18044] macsec1: entered promiscuous mode [ 471.857098][T18043] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3497'. [ 471.979918][ T50] Bluetooth: hci3: command tx timeout [ 472.134697][T17941] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 472.165709][T17941] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 472.177244][T17941] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 472.212977][T17941] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 472.234924][T17941] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 472.254707][T17941] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 472.274956][T18058] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3502'. [ 472.290625][T17941] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 472.305297][T17941] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 472.452077][T18068] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3505'. [ 472.716347][ T8476] net_ratelimit: 13 callbacks suppressed [ 472.716370][ T8476] bond13: (slave batadv0): failed to get link speed/duplex [ 472.858577][ T8482] bond13: (slave batadv0): failed to get link speed/duplex [ 472.932369][T17941] 8021q: adding VLAN 0 to HW filter on device bond0 [ 473.047580][T17941] 8021q: adding VLAN 0 to HW filter on device team0 [ 473.090421][ T8482] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.097790][ T8482] bridge0: port 1(bridge_slave_0) entered forwarding state [ 473.135579][T18076] netlink: 'syz.2.3508': attribute type 1 has an invalid length. [ 473.164533][ T149] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.172159][ T149] bridge0: port 2(bridge_slave_1) entered forwarding state [ 473.421965][T18081] bond5: (slave veth13): Enslaving as an active interface with a down link [ 473.473448][T18086] bond5: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 473.537500][T18092] netlink: 'syz.4.3510': attribute type 4 has an invalid length. [ 473.546392][ T8476] nci: nci_rx_work: unknown MT 0x6 [ 473.557624][ T8492] bond13: (slave batadv0): failed to get link speed/duplex [ 473.581463][T18092] netlink: 152 bytes leftover after parsing attributes in process `syz.4.3510'. [ 473.623929][T18093] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3510'. [ 473.662211][T18092] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 473.746543][ T149] bond13: (slave batadv0): failed to get link speed/duplex [ 473.805510][T18098] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 473.827375][T18098] syzkaller1: linktype set to 769 [ 473.893568][T18100] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 473.933315][T18100] bond6 (unregistering): Released all slaves [ 474.005958][ T8476] bond13: (slave batadv0): failed to get link speed/duplex [ 474.073578][T18106] netlink: 'syz.0.3514': attribute type 7 has an invalid length. [ 474.083777][T18106] netlink: 'syz.0.3514': attribute type 8 has an invalid length. [ 474.115919][ T149] bond13: (slave batadv0): failed to get link speed/duplex [ 474.218556][T18112] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3515'. [ 474.234269][T18113] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3516'. [ 474.248160][ T149] bond13: (slave batadv0): failed to get link speed/duplex [ 474.370856][ T36] bond13: (slave batadv0): failed to get link speed/duplex [ 474.498316][ T36] bond13: (slave batadv0): failed to get link speed/duplex [ 474.566943][T17941] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 474.647154][T17941] veth0_vlan: entered promiscuous mode [ 474.662240][T17941] veth1_vlan: entered promiscuous mode [ 474.711790][T17941] veth0_macvtap: entered promiscuous mode [ 474.729256][T17941] veth1_macvtap: entered promiscuous mode [ 474.761031][T17941] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 474.775470][T17941] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 474.807874][ T8476] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.819277][ T8476] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.878793][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.948248][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.383561][T18088] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 476.642418][ T149] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 476.662363][T18140] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3524'. [ 476.679836][ T149] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 476.788030][ T149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 476.791716][T18138] syzkaller0: entered promiscuous mode [ 476.807622][T18138] syzkaller0: entered allmulticast mode [ 476.813524][ T149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.044573][T18157] netlink: 'syz.4.3530': attribute type 7 has an invalid length. [ 477.056635][T18157] netlink: 'syz.4.3530': attribute type 8 has an invalid length. [ 477.195211][T18163] netlink: 'syz.1.3531': attribute type 1 has an invalid length. [ 477.358652][T18170] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3533'. [ 477.377877][T18168] xt_ct_set_helper: 18 callbacks suppressed [ 477.377900][T18168] xt_CT: You must specify a L4 protocol and not use inversions on it [ 477.587196][T18165] bond5: (slave veth7): Enslaving as an active interface with a down link [ 477.614774][T18166] bond5: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 477.763177][T18178] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3535'. [ 478.027126][T18191] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3540'. [ 478.088298][T18194] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3541'. [ 478.264193][T18199] netlink: 'syz.3.3542': attribute type 7 has an invalid length. [ 478.273350][T18199] netlink: 'syz.3.3542': attribute type 8 has an invalid length. [ 481.657169][ T8476] net_ratelimit: 18 callbacks suppressed [ 481.657193][ T8476] bond13: (slave batadv0): failed to get link speed/duplex [ 481.786318][ T8492] bond13: (slave batadv0): failed to get link speed/duplex [ 481.813046][T18205] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 481.905907][ T8492] bond13: (slave batadv0): failed to get link speed/duplex [ 482.031031][ T8492] bond13: (slave batadv0): failed to get link speed/duplex [ 482.102170][T18223] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3551'. [ 482.114425][T18221] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3552'. [ 482.134135][T18221] netlink: 'syz.0.3552': attribute type 3 has an invalid length. [ 482.162113][T18224] netlink: 'syz.1.3553': attribute type 1 has an invalid length. [ 482.274441][T18232] netlink: 'syz.2.3555': attribute type 7 has an invalid length. [ 482.308458][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 482.341272][T18232] netlink: 'syz.2.3555': attribute type 8 has an invalid length. [ 482.573307][T18230] bond6: (slave veth9): Enslaving as an active interface with a down link [ 482.610834][T18233] bond6: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 482.709725][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 482.888867][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 482.953012][T18262] ip6erspan0: entered allmulticast mode [ 483.055528][T18271] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3565'. [ 483.171011][T18274] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3567'. [ 483.256917][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 483.375966][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 483.402038][T18282] netlink: 'syz.1.3570': attribute type 7 has an invalid length. [ 483.438849][T18282] netlink: 'syz.1.3570': attribute type 8 has an invalid length. [ 483.572741][T18290] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3574'. [ 483.600467][T18290] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3574'. [ 483.990351][T18317] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3582'. [ 484.513514][T18339] FAULT_INJECTION: forcing a failure. [ 484.513514][T18339] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 484.532838][T18339] CPU: 0 UID: 0 PID: 18339 Comm: syz.3.3587 Not tainted syzkaller #0 PREEMPT(full) [ 484.532870][T18339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 484.532884][T18339] Call Trace: [ 484.532893][T18339] [ 484.532902][T18339] dump_stack_lvl+0xe8/0x150 [ 484.532942][T18339] should_fail_ex+0x40c/0x560 [ 484.532977][T18339] _copy_from_user+0x2d/0xb0 [ 484.532999][T18339] ___sys_sendmsg+0x1c6/0x360 [ 484.533032][T18339] ? __lock_acquire+0x683/0x2cf0 [ 484.533068][T18339] ? __pfx____sys_sendmsg+0x10/0x10 [ 484.533138][T18339] ? __fget_files+0x2a/0x420 [ 484.533167][T18339] ? __fget_files+0x3a2/0x420 [ 484.533215][T18339] __x64_sys_sendmsg+0x1b1/0x290 [ 484.533247][T18339] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 484.533296][T18339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.533321][T18339] do_syscall_64+0x174/0x580 [ 484.533349][T18339] ? trace_irq_disable+0x3b/0x140 [ 484.533377][T18339] ? clear_bhb_loop+0x40/0x90 [ 484.533404][T18339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.533426][T18339] RIP: 0033:0x7fe13a19e0d9 [ 484.533447][T18339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.533467][T18339] RSP: 002b:00007fe13b026028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 484.533492][T18339] RAX: ffffffffffffffda RBX: 00007fe13a425fa0 RCX: 00007fe13a19e0d9 [ 484.533508][T18339] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 484.533521][T18339] RBP: 00007fe13b026090 R08: 0000000000000000 R09: 0000000000000000 [ 484.533534][T18339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 484.533546][T18339] R13: 00007fe13a426038 R14: 00007fe13a425fa0 R15: 00007fff12f7fb38 [ 484.533582][T18339] [ 485.389957][T18361] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3594'. [ 486.228517][T18374] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3599'. [ 486.326293][T18376] FAULT_INJECTION: forcing a failure. [ 486.326293][T18376] name failslab, interval 1, probability 0, space 0, times 0 [ 486.339852][T18376] CPU: 1 UID: 0 PID: 18376 Comm: syz.3.3600 Not tainted syzkaller #0 PREEMPT(full) [ 486.339881][T18376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 486.339893][T18376] Call Trace: [ 486.339902][T18376] [ 486.339911][T18376] dump_stack_lvl+0xe8/0x150 [ 486.339951][T18376] should_fail_ex+0x40c/0x560 [ 486.339984][T18376] should_failslab+0xa8/0x100 [ 486.340019][T18376] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 486.340046][T18376] ? local_lock_release+0x9c/0x160 [ 486.340073][T18376] ? __alloc_skb+0x1d7/0x7a0 [ 486.340094][T18376] ? __alloc_skb+0x1d7/0x7a0 [ 486.340133][T18376] __alloc_skb+0x1d7/0x7a0 [ 486.340167][T18376] netlink_sendmsg+0x5d4/0xb40 [ 486.340207][T18376] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.340241][T18376] ? aa_sock_msg_perm+0xf1/0x1b0 [ 486.340272][T18376] ? __pfx_netlink_sendmsg+0x10/0x10 [ 486.340300][T18376] sock_sendmsg_nosec+0x13a/0x180 [ 486.340336][T18376] ____sys_sendmsg+0x54e/0x850 [ 486.340378][T18376] ? __pfx_____sys_sendmsg+0x10/0x10 [ 486.340415][T18376] ? import_iovec+0x73/0xa0 [ 486.340441][T18376] ___sys_sendmsg+0x2a5/0x360 [ 486.340466][T18376] ? __lock_acquire+0x683/0x2cf0 [ 486.340501][T18376] ? __pfx____sys_sendmsg+0x10/0x10 [ 486.340567][T18376] ? __fget_files+0x2a/0x420 [ 486.340596][T18376] ? __fget_files+0x3a2/0x420 [ 486.340637][T18376] __x64_sys_sendmsg+0x1b1/0x290 [ 486.340668][T18376] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 486.340715][T18376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.340740][T18376] do_syscall_64+0x174/0x580 [ 486.340768][T18376] ? trace_irq_disable+0x3b/0x140 [ 486.340796][T18376] ? clear_bhb_loop+0x40/0x90 [ 486.340823][T18376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.340845][T18376] RIP: 0033:0x7fe13a19e0d9 [ 486.340870][T18376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 486.340889][T18376] RSP: 002b:00007fe13b026028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 486.340931][T18376] RAX: ffffffffffffffda RBX: 00007fe13a425fa0 RCX: 00007fe13a19e0d9 [ 486.340948][T18376] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 486.340961][T18376] RBP: 00007fe13b026090 R08: 0000000000000000 R09: 0000000000000000 [ 486.340974][T18376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 486.340987][T18376] R13: 00007fe13a426038 R14: 00007fe13a425fa0 R15: 00007fff12f7fb38 [ 486.341022][T18376] [ 486.777108][ T8486] net_ratelimit: 28 callbacks suppressed [ 486.777129][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 486.837982][T18307] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 486.850108][T18322] netlink: 'syz.4.3583': attribute type 2 has an invalid length. [ 486.890569][T18350] netlink: 'syz.1.3591': attribute type 1 has an invalid length. [ 486.900919][T18350] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3591'. [ 486.907060][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 486.919193][T18350] workqueue: Failed to create a rescuer kthread for wq "phy2": -EINTR [ 487.058213][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 487.219564][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 487.361489][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 487.511622][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 487.649428][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 487.791179][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 487.916469][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 487.928881][T18436] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3618'. [ 487.953449][T18438] netlink: 67 bytes leftover after parsing attributes in process `syz.3.3619'. [ 488.052505][T18443] IPv6: NLM_F_CREATE should be specified when creating new route [ 488.073775][T18443] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 488.081299][T18443] IPv6: NLM_F_CREATE should be set when creating new route [ 488.107120][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 488.330058][T18452] bond3: entered promiscuous mode [ 488.347943][T18452] 8021q: adding VLAN 0 to HW filter on device bond3 [ 488.528001][T18469] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3627'. [ 488.565475][T18467] bond4: entered promiscuous mode [ 488.570935][T18467] bond4: entered allmulticast mode [ 488.576896][T18467] 8021q: adding VLAN 0 to HW filter on device bond4 [ 488.852227][ T1181] IPVS: starting estimator thread 0... [ 488.879273][T18475] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:0 [ 488.950216][T18478] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3633'. [ 488.975900][T18476] IPVS: using max 29 ests per chain, 69600 per kthread [ 489.202862][T18489] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3638'. [ 489.245481][T18491] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3636'. [ 489.260146][T18492] netlink: 'syz.4.3640': attribute type 7 has an invalid length. [ 489.285322][T18492] netlink: 'syz.4.3640': attribute type 8 has an invalid length. [ 489.299162][T18489] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3638'. [ 489.313571][T18494] netlink: 'syz.0.3639': attribute type 6 has an invalid length. [ 489.325900][T18494] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3639'. [ 489.559505][T18506] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3643'. [ 489.598530][T18506] netlink: 'syz.1.3643': attribute type 1 has an invalid length. [ 489.732430][T18517] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3645'. [ 489.821595][T18517] netlink: 'syz.0.3645': attribute type 2 has an invalid length. [ 489.900753][T18523] smc: net device lo applied user defined pnetid SYZ0 [ 489.924093][T18523] smc: smcd device lo applied user defined pnetid SYZ0 [ 490.162203][T18536] netlink: 'syz.4.3654': attribute type 1 has an invalid length. [ 490.329963][T18536] 8021q: adding VLAN 0 to HW filter on device bond4 [ 490.427860][T18542] vlan2: entered promiscuous mode [ 490.462327][T18542] bond4: entered promiscuous mode [ 490.487373][T18542] vlan2: entered allmulticast mode [ 490.527116][T18542] bond4: entered allmulticast mode [ 490.643260][T18545] bond4: (slave bridge1): making interface the new active one [ 490.664098][T18545] bridge1: entered promiscuous mode [ 490.681539][T18545] bridge1: entered allmulticast mode [ 490.719535][T18545] bond4: (slave bridge1): Enslaving as an active interface with an up link [ 490.773270][T18554] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 490.812494][T18554] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 491.015841][T18560] syzkaller0: entered promiscuous mode [ 491.036429][T18560] syzkaller0: entered allmulticast mode [ 491.067218][T18571] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 491.627796][T18597] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 491.668313][T18597] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 495.848346][T18591] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 495.904557][ T8493] net_ratelimit: 19 callbacks suppressed [ 495.904581][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 496.059964][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 496.187838][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 496.260992][T18625] __nla_validate_parse: 5 callbacks suppressed [ 496.261016][T18625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3680'. [ 496.308528][T18624] FAULT_INJECTION: forcing a failure. [ 496.308528][T18624] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 496.323236][T18624] CPU: 0 UID: 0 PID: 18624 Comm: syz.3.3681 Not tainted syzkaller #0 PREEMPT(full) [ 496.323267][T18624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.323281][T18624] Call Trace: [ 496.323289][T18624] [ 496.323298][T18624] dump_stack_lvl+0xe8/0x150 [ 496.323337][T18624] should_fail_ex+0x40c/0x560 [ 496.323378][T18624] core_sys_select+0x8be/0xb40 [ 496.323405][T18624] ? get_pid_task+0x20/0x1f0 [ 496.323452][T18624] ? __pfx_core_sys_select+0x10/0x10 [ 496.323505][T18624] ? __pfx_set_user_sigmask+0x10/0x10 [ 496.323531][T18624] ? kmem_cache_free+0x182/0x650 [ 496.323571][T18624] __se_sys_pselect6+0x267/0x320 [ 496.323605][T18624] ? __pfx___se_sys_pselect6+0x10/0x10 [ 496.323632][T18624] ? __pfx_ksys_write+0x10/0x10 [ 496.323659][T18624] ? __x64_sys_pselect6+0x21/0xf0 [ 496.323687][T18624] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.323711][T18624] do_syscall_64+0x174/0x580 [ 496.323740][T18624] ? trace_irq_disable+0x3b/0x140 [ 496.323768][T18624] ? clear_bhb_loop+0x40/0x90 [ 496.323795][T18624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.323818][T18624] RIP: 0033:0x7fe13a19e0d9 [ 496.323838][T18624] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.323857][T18624] RSP: 002b:00007fe13b026028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 496.323880][T18624] RAX: ffffffffffffffda RBX: 00007fe13a425fa0 RCX: 00007fe13a19e0d9 [ 496.323896][T18624] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 496.323909][T18624] RBP: 00007fe13b026090 R08: 0000200000000280 R09: 0000000000000000 [ 496.323923][T18624] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 496.323937][T18624] R13: 00007fe13a426038 R14: 00007fe13a425fa0 R15: 00007fff12f7fb38 [ 496.323972][T18624] [ 496.518260][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 496.631160][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 496.747036][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 496.857043][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 496.966974][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 497.077024][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 497.187957][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 500.937880][ T12] net_ratelimit: 33 callbacks suppressed [ 500.937905][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 501.066111][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 501.177974][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 501.286059][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 501.395950][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 501.506843][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 501.616953][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 501.726764][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 501.836814][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 501.945976][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 504.257375][T18634] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3686'. [ 504.432515][T18643] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 504.447652][T18643] syzkaller1: linktype set to 769 [ 504.508571][T18646] Bluetooth: MGMT ver 1.23 [ 504.593827][T18648] netlink: 'syz.4.3690': attribute type 1 has an invalid length. [ 504.781164][T18651] bond5: (slave veth7): Enslaving as an active interface with a down link [ 504.816346][T18631] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3684'. [ 504.850249][T18653] bond5: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 505.458825][T18682] netlink: 'syz.1.3702': attribute type 3 has an invalid length. [ 505.473104][T18682] netlink: 'syz.1.3702': attribute type 3 has an invalid length. [ 505.483248][T18682] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3702'. [ 505.518567][T18683] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 505.531239][T18683] syzkaller1: linktype set to 769 [ 505.541868][T18682] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3702'. [ 505.552812][T18687] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3704'. [ 505.588756][T18682] xt_hashlimit: overflow, try lower: 0/0 [ 505.794257][T18696] lo speed is unknown, defaulting to 1000 [ 505.942811][T18707] FAULT_INJECTION: forcing a failure. [ 505.942811][T18707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 505.976344][ T12] net_ratelimit: 33 callbacks suppressed [ 505.976368][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 505.993348][T18707] CPU: 0 UID: 0 PID: 18707 Comm: syz.0.3709 Not tainted syzkaller #0 PREEMPT(full) [ 505.993395][T18707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 505.993417][T18707] Call Trace: [ 505.993431][T18707] [ 505.993446][T18707] dump_stack_lvl+0xe8/0x150 [ 505.993505][T18707] should_fail_ex+0x40c/0x560 [ 505.993561][T18707] _copy_to_user+0x31/0xb0 [ 505.993604][T18707] put_timespec64+0xc8/0x130 [ 505.993658][T18707] ? __pfx_put_timespec64+0x10/0x10 [ 505.993711][T18707] poll_select_finish+0x462/0x5d0 [ 505.993744][T18707] ? __pfx_poll_select_finish+0x10/0x10 [ 505.993792][T18707] ? __pfx_set_user_sigmask+0x10/0x10 [ 505.993817][T18707] ? kmem_cache_free+0x182/0x650 [ 505.993858][T18707] __se_sys_pselect6+0x27e/0x320 [ 505.993892][T18707] ? __pfx___se_sys_pselect6+0x10/0x10 [ 505.993920][T18707] ? __pfx_ksys_write+0x10/0x10 [ 505.993947][T18707] ? __x64_sys_pselect6+0x21/0xf0 [ 505.993974][T18707] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.993998][T18707] do_syscall_64+0x174/0x580 [ 505.994027][T18707] ? trace_irq_disable+0x3b/0x140 [ 505.994054][T18707] ? clear_bhb_loop+0x40/0x90 [ 505.994081][T18707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.994102][T18707] RIP: 0033:0x7f49e959e0d9 [ 505.994123][T18707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 505.994141][T18707] RSP: 002b:00007f49ea381028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 505.994164][T18707] RAX: ffffffffffffffda RBX: 00007f49e9825fa0 RCX: 00007f49e959e0d9 [ 505.994180][T18707] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 505.994193][T18707] RBP: 00007f49ea381090 R08: 0000200000000280 R09: 0000000000000000 [ 505.994207][T18707] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 505.994220][T18707] R13: 00007f49e9826038 R14: 00007f49e9825fa0 R15: 00007ffe2b8a0188 [ 505.994255][T18707] [ 506.323791][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 506.374924][T18712] IPVS: set_ctl: invalid protocol: 28791 49.0.0.0:0 [ 506.478143][T18722] syzkaller0: entered promiscuous mode [ 506.502951][T18722] syzkaller0: entered allmulticast mode [ 506.537551][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 506.837168][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 507.070277][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 507.187212][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 507.316520][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 507.427061][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 507.536080][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 507.645966][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 509.016480][ T50] Bluetooth: hci2: command 0x0401 tx timeout [ 511.076338][ T12] net_ratelimit: 30 callbacks suppressed [ 511.076361][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 511.197000][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 511.306041][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 511.419060][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 511.537096][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 511.647722][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 511.758346][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 511.876794][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 511.986602][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 512.096909][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 514.917586][T18777] netlink: 'syz.4.3727': attribute type 1 has an invalid length. [ 514.945006][T18777] netlink: 244 bytes leftover after parsing attributes in process `syz.4.3727'. [ 514.979662][T18777] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3727'. [ 515.059438][T18777] bond6: entered promiscuous mode [ 515.071176][T18777] bond6: entered allmulticast mode [ 515.121825][T18786] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3732'. [ 515.307511][T18796] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 515.320702][T18796] syzkaller1: linktype set to 769 [ 515.484813][T18805] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3738'. [ 515.565180][T18807] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3738'. [ 515.711777][T18805] bridge0: port 2(bridge_slave_1) entered disabled state [ 515.719791][T18805] bridge0: port 1(bridge_slave_0) entered disabled state [ 515.801187][T18805] bridge0: entered allmulticast mode [ 515.858724][T18811] bridge_slave_1: left allmulticast mode [ 515.874956][T18811] bridge_slave_1: left promiscuous mode [ 515.883099][T18817] FAULT_INJECTION: forcing a failure. [ 515.883099][T18817] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 515.907456][T18817] CPU: 0 UID: 0 PID: 18817 Comm: syz.1.3742 Not tainted syzkaller #0 PREEMPT(full) [ 515.907491][T18817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 515.907506][T18817] Call Trace: [ 515.907515][T18817] [ 515.907526][T18817] dump_stack_lvl+0xe8/0x150 [ 515.907566][T18817] should_fail_ex+0x40c/0x560 [ 515.907602][T18817] _copy_from_user+0x2d/0xb0 [ 515.907626][T18817] ___sys_recvmsg+0x173/0x5a0 [ 515.907664][T18817] ? __pfx____sys_recvmsg+0x10/0x10 [ 515.907699][T18817] ? __fget_files+0x2a/0x420 [ 515.907764][T18817] do_recvmmsg+0x31a/0x7f0 [ 515.907803][T18817] ? __pfx_do_recvmmsg+0x10/0x10 [ 515.907846][T18817] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 515.907879][T18817] ? __fget_files+0x3a2/0x420 [ 515.907920][T18817] __x64_sys_recvmmsg+0x198/0x250 [ 515.907954][T18817] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 515.908000][T18817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.908024][T18817] do_syscall_64+0x174/0x580 [ 515.908053][T18817] ? trace_irq_disable+0x3b/0x140 [ 515.908081][T18817] ? clear_bhb_loop+0x40/0x90 [ 515.908108][T18817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.908130][T18817] RIP: 0033:0x7f9c6ff9e0d9 [ 515.908151][T18817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 515.908170][T18817] RSP: 002b:00007f9c70e92028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 515.908194][T18817] RAX: ffffffffffffffda RBX: 00007f9c70225fa0 RCX: 00007f9c6ff9e0d9 [ 515.908210][T18817] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 515.908232][T18817] RBP: 00007f9c70e92090 R08: 0000000000000000 R09: 0000000000000000 [ 515.908246][T18817] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 515.908259][T18817] R13: 00007f9c70226038 R14: 00007f9c70225fa0 R15: 00007ffdcd8cb588 [ 515.908295][T18817] [ 515.913331][T18811] bridge0: port 2(bridge_slave_1) entered disabled state [ 516.139545][T18811] bridge_slave_0: left allmulticast mode [ 516.150666][T18811] bridge_slave_0: left promiscuous mode [ 516.160015][T18811] bridge0: port 1(bridge_slave_0) entered disabled state [ 516.245930][ T78] net_ratelimit: 29 callbacks suppressed [ 516.245955][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 516.369118][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 516.476541][T18833] netlink: 'syz.4.3747': attribute type 1 has an invalid length. [ 516.507126][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 516.531449][T18836] raw_sendmsg: syz.2.3746 forgot to set AF_INET. Fix it! [ 516.639971][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 516.771392][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 516.872069][T18845] netlink: 'syz.4.3753': attribute type 1 has an invalid length. [ 516.975932][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 517.070107][T18848] bond7: (slave veth9): Enslaving as an active interface with a down link [ 517.122946][T18845] bond7: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 517.256717][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 517.365865][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 517.604201][T18870] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3762'. [ 517.704474][T18877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3760'. [ 518.267176][T18884] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3763'. [ 518.277852][T18884] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3763'. [ 518.417691][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 518.454885][T18884] geneve2: entered promiscuous mode [ 518.471254][T18884] geneve2: entered allmulticast mode [ 518.540140][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 518.635095][T18905] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3774'. [ 518.718854][T18912] syzkaller0: entered promiscuous mode [ 518.735153][T18912] syzkaller0: entered allmulticast mode [ 518.793068][T18912] tc action pedit 'at' offset 20 out of bounds [ 519.256070][ T50] Bluetooth: hci1: command 0x041b tx timeout [ 519.960240][T18956] netlink: 'syz.0.3787': attribute type 12 has an invalid length. [ 520.409685][T18979] batman_adv: batadv0: Adding interface: vlan3 [ 520.428316][T18979] batman_adv: batadv0: The MTU of interface vlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 520.488216][T18979] batman_adv: batadv0: Not using interface vlan3 (retrying later): interface not active [ 520.547979][T18985] netlink: 'syz.1.3800': attribute type 1 has an invalid length. [ 520.633134][T18993] __nla_validate_parse: 10 callbacks suppressed [ 520.633158][T18993] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3803'. [ 520.737195][T18989] bond7: (slave veth11): Enslaving as an active interface with a down link [ 520.802631][T18994] bond7: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 521.109876][T19016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 521.235683][T19024] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3815'. [ 521.297526][ T8484] net_ratelimit: 19 callbacks suppressed [ 521.297551][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 521.337539][T15897] Bluetooth: hci1: command 0x041b tx timeout [ 521.368660][T19029] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3816'. [ 521.523302][T19037] netlink: 'syz.3.3818': attribute type 1 has an invalid length. [ 521.627146][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 521.701352][T19043] netlink: 'syz.4.3819': attribute type 1 has an invalid length. [ 521.736815][T19041] bond1: (slave veth3): Enslaving as an active interface with a down link [ 521.756106][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 521.778897][T19037] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 521.893222][T19046] bond8: (slave veth11): Enslaving as an active interface with a down link [ 521.916179][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 522.049582][T19050] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3820'. [ 522.074479][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 522.097581][T19053] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3823'. [ 522.221493][T19053] 8021q: adding VLAN 0 to HW filter on device bond1 [ 522.271393][T19053] 8021q: adding VLAN 0 to HW filter on device bond2 [ 522.314790][T19067] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3826'. [ 522.330681][T19067] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3826'. [ 522.359276][T19053] 8021q: adding VLAN 0 to HW filter on device bond5 [ 522.374770][T19067] ip6t_srh: unknown srh match flags 4000 [ 522.383715][T19068] netlink: 'syz.0.3824': attribute type 1 has an invalid length. [ 522.405159][T19053] 8021q: adding VLAN 0 to HW filter on device bond6 [ 522.425493][T19053] 8021q: adding VLAN 0 to HW filter on device bond7 [ 522.467691][T19053] batman_adv: batadv0: Interface activated: vlan3 [ 522.489762][T19053] 8021q: adding VLAN 0 to HW filter on device bond8 [ 522.542614][ T48] bond5: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 522.562866][ T48] bond5: (slave veth7): making interface the new active one [ 522.603499][ T48] bond5: active interface up! [ 522.721487][T19070] bond5: (slave veth9): Enslaving as an active interface with a down link [ 522.859101][T19080] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3828'. [ 522.896621][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 522.910166][T19076] lo speed is unknown, defaulting to 1000 [ 522.928508][ T48] bond7: (slave veth9): link status definitely up, 10000 Mbps full duplex [ 522.972255][ T48] bond7: (slave veth9): making interface the new active one [ 523.004732][ T48] bond7: active interface up! [ 523.031287][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 523.088108][ T12] bond8: (slave veth11): link status definitely up, 10000 Mbps full duplex [ 523.106877][T19086] netlink: 'syz.0.3833': attribute type 6 has an invalid length. [ 523.172064][ T12] bond8: (slave veth11): making interface the new active one [ 523.214488][ T12] bond8: active interface up! [ 523.278534][T19086] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 523.314556][T11527] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 523.418603][T15897] Bluetooth: hci1: command 0x041b tx timeout [ 523.547017][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 523.626409][T19104] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3836'. [ 523.696788][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 523.820233][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 524.028082][T19117] syzkaller1: entered promiscuous mode [ 524.063324][T19117] syzkaller1: entered allmulticast mode [ 524.349031][T19129] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3842'. [ 524.373904][T19129] netlink: 'syz.4.3842': attribute type 3 has an invalid length. [ 525.499891][T15897] Bluetooth: hci1: command 0x041b tx timeout [ 525.767933][T19164] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3854'. [ 526.376134][ T8493] net_ratelimit: 19 callbacks suppressed [ 526.376160][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 526.505991][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 526.616008][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 526.726910][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 526.836810][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 526.865240][T19110] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 526.946483][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 527.077028][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 527.092619][T19169] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3855'. [ 527.212266][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 527.272628][T19183] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3860'. [ 527.389839][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 527.432397][T19187] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3862'. [ 527.489755][ T30] audit: type=1804 audit(1786037245.807:11): pid=19190 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.3863" name="/newroot/80/cgroup.controllers" dev="tmpfs" ino=430 res=1 errno=0 [ 527.532436][T19190] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3863'. [ 527.564116][ T30] audit: type=1800 audit(1786037245.807:12): pid=19190 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3863" name="cgroup.controllers" dev="tmpfs" ino=430 res=0 errno=0 [ 527.578207][T15897] Bluetooth: hci1: command 0x041b tx timeout [ 527.638356][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 527.826631][T19206] netlink: 'syz.3.3867': attribute type 1 has an invalid length. [ 527.892584][T19211] FAULT_INJECTION: forcing a failure. [ 527.892584][T19211] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 527.906310][T19211] CPU: 0 UID: 0 PID: 19211 Comm: syz.4.3868 Not tainted syzkaller #0 PREEMPT(full) [ 527.906340][T19211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 527.906353][T19211] Call Trace: [ 527.906361][T19211] [ 527.906371][T19211] dump_stack_lvl+0xe8/0x150 [ 527.906409][T19211] should_fail_ex+0x40c/0x560 [ 527.906442][T19211] _copy_from_iter+0x1d3/0x1660 [ 527.906472][T19211] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 527.906502][T19211] ? rcu_is_watching+0x15/0xb0 [ 527.906524][T19211] ? trace_kmem_cache_alloc+0x29/0xe0 [ 527.906553][T19211] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 527.906581][T19211] ? __pfx__copy_from_iter+0x10/0x10 [ 527.906610][T19211] ? __alloc_skb+0x276/0x7a0 [ 527.906632][T19211] ? __alloc_skb+0x276/0x7a0 [ 527.906661][T19211] ? netlink_sendmsg+0x650/0xb40 [ 527.906689][T19211] ? skb_put+0x112/0x210 [ 527.906716][T19211] netlink_sendmsg+0x6c0/0xb40 [ 527.906756][T19211] ? __pfx_netlink_sendmsg+0x10/0x10 [ 527.906789][T19211] ? aa_sock_msg_perm+0xf1/0x1b0 [ 527.906819][T19211] ? __pfx_netlink_sendmsg+0x10/0x10 [ 527.906846][T19211] sock_sendmsg_nosec+0x13a/0x180 [ 527.906883][T19211] ____sys_sendmsg+0x54e/0x850 [ 527.906916][T19211] ? __pfx_____sys_sendmsg+0x10/0x10 [ 527.906954][T19211] ? import_iovec+0x73/0xa0 [ 527.906978][T19211] ___sys_sendmsg+0x2a5/0x360 [ 527.907003][T19211] ? __lock_acquire+0x683/0x2cf0 [ 527.907037][T19211] ? __pfx____sys_sendmsg+0x10/0x10 [ 527.907101][T19211] ? __fget_files+0x2a/0x420 [ 527.907139][T19211] ? __fget_files+0x3a2/0x420 [ 527.907180][T19211] __x64_sys_sendmsg+0x1b1/0x290 [ 527.907216][T19211] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 527.907264][T19211] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.907288][T19211] do_syscall_64+0x174/0x580 [ 527.907318][T19211] ? trace_irq_disable+0x3b/0x140 [ 527.907347][T19211] ? clear_bhb_loop+0x40/0x90 [ 527.907375][T19211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 527.907398][T19211] RIP: 0033:0x7f2e15d9e0d9 [ 527.907418][T19211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 527.907438][T19211] RSP: 002b:00007f2e16cd6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 527.907461][T19211] RAX: ffffffffffffffda RBX: 00007f2e16025fa0 RCX: 00007f2e15d9e0d9 [ 527.907478][T19211] RDX: 00000000200080c4 RSI: 0000200000000100 RDI: 0000000000000004 [ 527.907493][T19211] RBP: 00007f2e16cd6090 R08: 0000000000000000 R09: 0000000000000000 [ 527.907507][T19211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 527.907521][T19211] R13: 00007f2e16026038 R14: 00007f2e16025fa0 R15: 00007ffc3acdb038 [ 527.907556][T19211] [ 528.241011][T19209] bond2: (slave veth5): Enslaving as an active interface with a down link [ 528.251390][T19215] netlink: 'syz.4.3869': attribute type 1 has an invalid length. [ 528.272765][T19206] bond2: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 528.388950][T19214] veth13: entered promiscuous mode [ 528.394163][T19214] veth13: entered allmulticast mode [ 528.403022][T19208] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3866'. [ 528.486832][T19216] bond9: (slave veth13): Enslaving as an active interface with a down link [ 528.508407][T19217] bond9: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 528.759745][T19234] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3873'. [ 528.930887][T19244] netlink: 'syz.0.3878': attribute type 7 has an invalid length. [ 528.970643][T19245] netlink: 164 bytes leftover after parsing attributes in process `syz.1.3877'. [ 528.989730][T19244] netlink: 'syz.0.3878': attribute type 8 has an invalid length. [ 529.028417][T19248] FAULT_INJECTION: forcing a failure. [ 529.028417][T19248] name failslab, interval 1, probability 0, space 0, times 0 [ 529.058719][T19248] CPU: 1 UID: 0 PID: 19248 Comm: syz.4.3879 Not tainted syzkaller #0 PREEMPT(full) [ 529.058755][T19248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 529.058769][T19248] Call Trace: [ 529.058778][T19248] [ 529.058787][T19248] dump_stack_lvl+0xe8/0x150 [ 529.058824][T19248] should_fail_ex+0x40c/0x560 [ 529.058858][T19248] should_failslab+0xa8/0x100 [ 529.058894][T19248] __kmalloc_noprof+0xfe/0x720 [ 529.058923][T19248] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 529.058946][T19248] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 529.058978][T19248] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 529.059010][T19248] genl_family_rcv_msg_doit+0xda/0x340 [ 529.059047][T19248] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 529.059074][T19248] ? __pfx_genl_get_cmd+0x10/0x10 [ 529.059105][T19248] ? __pfx_ila_xlat_nl_cmd_get_mapping+0x10/0x10 [ 529.059135][T19248] ? __pfx_ila_xlat_nl_dump_start+0x10/0x10 [ 529.059164][T19248] ? __pfx_ila_xlat_nl_dump+0x10/0x10 [ 529.059191][T19248] ? __pfx_ila_xlat_nl_dump_done+0x10/0x10 [ 529.059222][T19248] ? __dev_queue_xmit+0x29b/0x3820 [ 529.059263][T19248] genl_rcv_msg+0x614/0x7a0 [ 529.059291][T19248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 529.059312][T19248] ? __pfx_ila_xlat_nl_cmd_get_mapping+0x10/0x10 [ 529.059344][T19248] ? __pfx_ref_tracker_free+0x10/0x10 [ 529.059386][T19248] netlink_rcv_skb+0x226/0x4a0 [ 529.059414][T19248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 529.059438][T19248] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 529.059483][T19248] ? down_read+0x2be/0x330 [ 529.059519][T19248] genl_rcv+0x28/0x40 [ 529.059550][T19248] netlink_unicast+0x7bb/0x940 [ 529.059588][T19248] netlink_sendmsg+0x813/0xb40 [ 529.059628][T19248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 529.059661][T19248] ? aa_sock_msg_perm+0xf1/0x1b0 [ 529.059692][T19248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 529.059720][T19248] sock_sendmsg_nosec+0x13a/0x180 [ 529.059756][T19248] ____sys_sendmsg+0x54e/0x850 [ 529.059791][T19248] ? __pfx_____sys_sendmsg+0x10/0x10 [ 529.059828][T19248] ? import_iovec+0x73/0xa0 [ 529.059854][T19248] ___sys_sendmsg+0x2a5/0x360 [ 529.059880][T19248] ? __lock_acquire+0x683/0x2cf0 [ 529.059915][T19248] ? __pfx____sys_sendmsg+0x10/0x10 [ 529.059983][T19248] ? __fget_files+0x2a/0x420 [ 529.060012][T19248] ? __fget_files+0x3a2/0x420 [ 529.060060][T19248] __x64_sys_sendmsg+0x1b1/0x290 [ 529.060090][T19248] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 529.060138][T19248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.060160][T19248] do_syscall_64+0x174/0x580 [ 529.060189][T19248] ? trace_irq_disable+0x3b/0x140 [ 529.060217][T19248] ? clear_bhb_loop+0x40/0x90 [ 529.060244][T19248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.060266][T19248] RIP: 0033:0x7f2e15d9e0d9 [ 529.060287][T19248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.060306][T19248] RSP: 002b:00007f2e16cd6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 529.060329][T19248] RAX: ffffffffffffffda RBX: 00007f2e16025fa0 RCX: 00007f2e15d9e0d9 [ 529.060345][T19248] RDX: 00000000200080c4 RSI: 0000200000000100 RDI: 0000000000000004 [ 529.060359][T19248] RBP: 00007f2e16cd6090 R08: 0000000000000000 R09: 0000000000000000 [ 529.060372][T19248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.060385][T19248] R13: 00007f2e16026038 R14: 00007f2e16025fa0 R15: 00007ffc3acdb038 [ 529.060420][T19248] [ 529.521978][T19257] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3880'. [ 529.912696][T19280] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3890'. [ 530.037285][T19285] netlink: 'syz.3.3893': attribute type 7 has an invalid length. [ 530.073406][T19285] netlink: 'syz.3.3893': attribute type 8 has an invalid length. [ 530.147241][T19291] x_tables: duplicate underflow at hook 4 [ 531.137030][T19329] netlink: 'syz.0.3906': attribute type 7 has an invalid length. [ 531.156447][T19329] netlink: 'syz.0.3906': attribute type 8 has an invalid length. [ 531.313131][T19335] __nla_validate_parse: 4 callbacks suppressed [ 531.313154][T19335] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3908'. [ 531.362017][T19339] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3910'. [ 531.448134][ T48] net_ratelimit: 25 callbacks suppressed [ 531.448158][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 531.597587][T19346] netlink: 'syz.4.3914': attribute type 1 has an invalid length. [ 531.617387][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 531.851167][T19351] bond10: (slave veth15): Enslaving as an active interface with a down link [ 531.978424][T19346] bond10: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 532.103445][T19359] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 532.123836][T19359] syzkaller1: linktype set to 769 [ 532.187311][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 532.232935][T19363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3917'. [ 532.252947][T19363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3917'. [ 532.271621][T19363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3917'. [ 532.327758][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 532.718985][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 532.869401][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 532.943441][T19388] netlink: 'syz.2.3928': attribute type 1 has an invalid length. [ 533.019346][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 533.073242][T19399] netlink: 'syz.1.3929': attribute type 7 has an invalid length. [ 533.127396][T19399] netlink: 'syz.1.3929': attribute type 8 has an invalid length. [ 533.157084][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 533.267033][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 533.406351][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 533.617721][T19411] lo speed is unknown, defaulting to 1000 [ 533.709841][T19418] FAULT_INJECTION: forcing a failure. [ 533.709841][T19418] name failslab, interval 1, probability 0, space 0, times 0 [ 533.748893][T19418] CPU: 0 UID: 0 PID: 19418 Comm: syz.4.3934 Not tainted syzkaller #0 PREEMPT(full) [ 533.748927][T19418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 533.748940][T19418] Call Trace: [ 533.748948][T19418] [ 533.748957][T19418] dump_stack_lvl+0xe8/0x150 [ 533.748991][T19418] should_fail_ex+0x40c/0x560 [ 533.749025][T19418] should_failslab+0xa8/0x100 [ 533.749061][T19418] __kmalloc_noprof+0xfe/0x720 [ 533.749091][T19418] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 533.749115][T19418] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 533.749146][T19418] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 533.749178][T19418] genl_family_rcv_msg_doit+0xda/0x340 [ 533.749208][T19418] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 533.749235][T19418] ? __pfx_genl_get_cmd+0x10/0x10 [ 533.749266][T19418] ? __pfx_ila_xlat_nl_cmd_get_mapping+0x10/0x10 [ 533.749301][T19418] ? __pfx_ila_xlat_nl_dump_start+0x10/0x10 [ 533.749331][T19418] ? __pfx_ila_xlat_nl_dump+0x10/0x10 [ 533.749360][T19418] ? __pfx_ila_xlat_nl_dump_done+0x10/0x10 [ 533.749392][T19418] ? __dev_queue_xmit+0x29b/0x3820 [ 533.749434][T19418] genl_rcv_msg+0x614/0x7a0 [ 533.749463][T19418] ? __pfx_genl_rcv_msg+0x10/0x10 [ 533.749484][T19418] ? __pfx_ila_xlat_nl_cmd_get_mapping+0x10/0x10 [ 533.749518][T19418] ? __pfx_ref_tracker_free+0x10/0x10 [ 533.749560][T19418] netlink_rcv_skb+0x226/0x4a0 [ 533.749589][T19418] ? __pfx_genl_rcv_msg+0x10/0x10 [ 533.749613][T19418] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 533.749659][T19418] ? down_read+0x2be/0x330 [ 533.749696][T19418] genl_rcv+0x28/0x40 [ 533.749737][T19418] netlink_unicast+0x7bb/0x940 [ 533.749775][T19418] netlink_sendmsg+0x813/0xb40 [ 533.749815][T19418] ? __pfx_netlink_sendmsg+0x10/0x10 [ 533.749849][T19418] ? aa_sock_msg_perm+0xf1/0x1b0 [ 533.749880][T19418] ? __pfx_netlink_sendmsg+0x10/0x10 [ 533.749908][T19418] sock_sendmsg_nosec+0x13a/0x180 [ 533.749945][T19418] ____sys_sendmsg+0x54e/0x850 [ 533.749977][T19418] ? __pfx_____sys_sendmsg+0x10/0x10 [ 533.750015][T19418] ? import_iovec+0x73/0xa0 [ 533.750038][T19418] ___sys_sendmsg+0x2a5/0x360 [ 533.750065][T19418] ? __lock_acquire+0x683/0x2cf0 [ 533.750099][T19418] ? __pfx____sys_sendmsg+0x10/0x10 [ 533.750167][T19418] ? __fget_files+0x2a/0x420 [ 533.750197][T19418] ? __fget_files+0x3a2/0x420 [ 533.750238][T19418] __x64_sys_sendmsg+0x1b1/0x290 [ 533.750270][T19418] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 533.750318][T19418] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.750342][T19418] do_syscall_64+0x174/0x580 [ 533.750372][T19418] ? trace_irq_disable+0x3b/0x140 [ 533.750400][T19418] ? clear_bhb_loop+0x40/0x90 [ 533.750427][T19418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.750448][T19418] RIP: 0033:0x7f2e15d9e0d9 [ 533.750469][T19418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 533.750486][T19418] RSP: 002b:00007f2e16cd6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 533.750509][T19418] RAX: ffffffffffffffda RBX: 00007f2e16025fa0 RCX: 00007f2e15d9e0d9 [ 533.750524][T19418] RDX: 00000000200080c4 RSI: 0000200000000100 RDI: 0000000000000004 [ 533.750537][T19418] RBP: 00007f2e16cd6090 R08: 0000000000000000 R09: 0000000000000000 [ 533.750551][T19418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 533.750563][T19418] R13: 00007f2e16026038 R14: 00007f2e16025fa0 R15: 00007ffc3acdb038 [ 533.750599][T19418] [ 534.506561][T19428] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3936'. [ 534.555021][T19430] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3939'. [ 534.730271][T19435] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 534.767211][T19435] syzkaller1: linktype set to 769 [ 534.863931][T19442] netlink: 'syz.0.3941': attribute type 7 has an invalid length. [ 534.874297][T19442] netlink: 'syz.0.3941': attribute type 8 has an invalid length. [ 535.201012][T19454] FAULT_INJECTION: forcing a failure. [ 535.201012][T19454] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.214474][T19455] netlink: 'syz.3.3945': attribute type 23 has an invalid length. [ 535.230421][T19454] CPU: 1 UID: 0 PID: 19454 Comm: syz.2.3946 Not tainted syzkaller #0 PREEMPT(full) [ 535.230448][T19454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 535.230462][T19454] Call Trace: [ 535.230471][T19454] [ 535.230480][T19454] dump_stack_lvl+0xe8/0x150 [ 535.230517][T19454] should_fail_ex+0x40c/0x560 [ 535.230551][T19454] _copy_from_user+0x2d/0xb0 [ 535.230575][T19454] kstrtouint_from_user+0xd6/0x180 [ 535.230606][T19454] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 535.230654][T19454] proc_fail_nth_write+0x8e/0x210 [ 535.230687][T19454] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 535.230728][T19454] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 535.230758][T19454] vfs_write+0x296/0xba0 [ 535.230789][T19454] ? __pfx_vfs_write+0x10/0x10 [ 535.230812][T19454] ? __fget_files+0x2a/0x420 [ 535.230846][T19454] ? __fget_files+0x3a2/0x420 [ 535.230884][T19454] ? __fget_files+0x2a/0x420 [ 535.230923][T19454] ksys_write+0x150/0x270 [ 535.230948][T19454] ? __pfx_ksys_write+0x10/0x10 [ 535.230980][T19454] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.231003][T19454] do_syscall_64+0x174/0x580 [ 535.231032][T19454] ? trace_irq_disable+0x3b/0x140 [ 535.231060][T19454] ? clear_bhb_loop+0x40/0x90 [ 535.231086][T19454] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.231108][T19454] RIP: 0033:0x7f5ebd15e90e [ 535.231128][T19454] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 535.231149][T19454] RSP: 002b:00007f5ebdf87fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 535.231173][T19454] RAX: ffffffffffffffda RBX: 00007f5ebdf886c0 RCX: 00007f5ebd15e90e [ 535.231188][T19454] RDX: 0000000000000001 RSI: 00007f5ebdf880a0 RDI: 0000000000000005 [ 535.231200][T19454] RBP: 00007f5ebdf88090 R08: 0000000000000000 R09: 0000000000000000 [ 535.231213][T19454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 535.231226][T19454] R13: 00007f5ebd426038 R14: 00007f5ebd425fa0 R15: 00007ffdeb3eb4f8 [ 535.231263][T19454] [ 535.853919][T19472] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3952'. [ 535.962736][T19474] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 535.972623][T19476] netlink: 'syz.0.3954': attribute type 7 has an invalid length. [ 535.986119][T19474] syzkaller1: linktype set to 769 [ 536.024633][T19476] netlink: 'syz.0.3954': attribute type 8 has an invalid length. [ 536.278080][T19488] netlink: 'syz.3.3960': attribute type 1 has an invalid length. [ 536.397101][T19488] bond3: (slave veth7): Enslaving as an active interface with a down link [ 536.497319][T19493] bond3: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 537.435997][ T48] net_ratelimit: 15 callbacks suppressed [ 537.436022][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 537.621139][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 537.745918][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 537.865888][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 537.995913][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 538.126901][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 538.267052][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 538.309343][T19537] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3975'. [ 538.441203][T19541] vlan3: entered allmulticast mode [ 538.471472][T19541] bridge4: entered allmulticast mode [ 538.537169][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 538.620637][T19554] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3982'. [ 538.667459][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 538.786641][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 539.042354][T19570] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3989'. [ 539.244014][T19580] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3992'. [ 539.553891][T19595] FAULT_INJECTION: forcing a failure. [ 539.553891][T19595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 539.567534][T19595] CPU: 0 UID: 0 PID: 19595 Comm: syz.2.3997 Not tainted syzkaller #0 PREEMPT(full) [ 539.567566][T19595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 539.567580][T19595] Call Trace: [ 539.567589][T19595] [ 539.567599][T19595] dump_stack_lvl+0xe8/0x150 [ 539.567639][T19595] should_fail_ex+0x40c/0x560 [ 539.567675][T19595] _copy_from_user+0x2d/0xb0 [ 539.567698][T19595] ___sys_recvmsg+0x173/0x5a0 [ 539.567735][T19595] ? __pfx____sys_recvmsg+0x10/0x10 [ 539.567770][T19595] ? __fget_files+0x2a/0x420 [ 539.567833][T19595] do_recvmmsg+0x31a/0x7f0 [ 539.567871][T19595] ? __pfx_do_recvmmsg+0x10/0x10 [ 539.567911][T19595] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 539.567943][T19595] ? __fget_files+0x3a2/0x420 [ 539.567986][T19595] __x64_sys_recvmmsg+0x198/0x250 [ 539.568018][T19595] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 539.568059][T19595] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.568084][T19595] do_syscall_64+0x174/0x580 [ 539.568111][T19595] ? trace_irq_disable+0x3b/0x140 [ 539.568140][T19595] ? clear_bhb_loop+0x40/0x90 [ 539.568167][T19595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.568188][T19595] RIP: 0033:0x7f5ebd19e0d9 [ 539.568209][T19595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 539.568228][T19595] RSP: 002b:00007f5ebdf88028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 539.568258][T19595] RAX: ffffffffffffffda RBX: 00007f5ebd425fa0 RCX: 00007f5ebd19e0d9 [ 539.568275][T19595] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 539.568289][T19595] RBP: 00007f5ebdf88090 R08: 0000000000000000 R09: 0000000000000000 [ 539.568303][T19595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 539.568316][T19595] R13: 00007f5ebd426038 R14: 00007f5ebd425fa0 R15: 00007ffdeb3eb4f8 [ 539.568351][T19595] [ 539.805653][T19596] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3995'. [ 539.820265][T19596] netlink: 120 bytes leftover after parsing attributes in process `syz.4.3995'. [ 540.361463][T19623] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4007'. [ 540.839645][T19639] netlink: 'syz.1.4013': attribute type 1 has an invalid length. [ 541.072444][T19644] bond8: (slave veth17): Enslaving as an active interface with a down link [ 541.152425][T19639] bond8: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 541.539590][T19655] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4017'. [ 542.260009][T19680] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4020'. [ 542.376837][T19690] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4022'. [ 542.539303][ T1181] net_ratelimit: 23 callbacks suppressed [ 542.539326][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 542.692991][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 542.829126][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 542.920545][T19710] netlink: 'syz.3.4029': attribute type 1 has an invalid length. [ 543.130073][T19717] FAULT_INJECTION: forcing a failure. [ 543.130073][T19717] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 543.144864][T19717] CPU: 1 UID: 0 PID: 19717 Comm: syz.2.4031 Not tainted syzkaller #0 PREEMPT(full) [ 543.144892][T19717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 543.144906][T19717] Call Trace: [ 543.144914][T19717] [ 543.144923][T19717] dump_stack_lvl+0xe8/0x150 [ 543.144959][T19717] should_fail_ex+0x40c/0x560 [ 543.144992][T19717] _copy_from_user+0x2d/0xb0 [ 543.145014][T19717] ___sys_sendmsg+0x1c6/0x360 [ 543.145041][T19717] ? __lock_acquire+0x683/0x2cf0 [ 543.145075][T19717] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.145131][T19717] ? __fget_files+0x2a/0x420 [ 543.145158][T19717] ? __fget_files+0x3a2/0x420 [ 543.145198][T19717] __x64_sys_sendmsg+0x1b1/0x290 [ 543.145229][T19717] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 543.145275][T19717] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.145299][T19717] do_syscall_64+0x174/0x580 [ 543.145335][T19717] ? trace_irq_disable+0x3b/0x140 [ 543.145374][T19717] ? clear_bhb_loop+0x40/0x90 [ 543.145401][T19717] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.145423][T19717] RIP: 0033:0x7f5ebd19e0d9 [ 543.145444][T19717] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.145462][T19717] RSP: 002b:00007f5ebdf88028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 543.145484][T19717] RAX: ffffffffffffffda RBX: 00007f5ebd425fa0 RCX: 00007f5ebd19e0d9 [ 543.145500][T19717] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 543.145513][T19717] RBP: 00007f5ebdf88090 R08: 0000000000000000 R09: 0000000000000000 [ 543.145527][T19717] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 543.145540][T19717] R13: 00007f5ebd426038 R14: 00007f5ebd425fa0 R15: 00007ffdeb3eb4f8 [ 543.145580][T19717] [ 543.361613][T19712] bond4: (slave veth11): Enslaving as an active interface with a down link [ 543.497643][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 543.535192][T19710] bond4: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 543.559023][T19726] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4034'. [ 543.642710][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 543.756514][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 543.867199][ T48] bond13: (slave batadv0): failed to get link speed/duplex [ 543.884647][ T8486] IPVS: starting estimator thread 0... [ 543.947135][T19738] netlink: 'syz.0.4039': attribute type 1 has an invalid length. [ 543.995838][T19736] IPVS: using max 24 ests per chain, 57600 per kthread [ 544.026022][T19744] wlan1: mtu greater than device maximum [ 544.111394][T19738] veth13: entered allmulticast mode [ 544.151220][T19738] bond6: (slave veth13): Enslaving as an active interface with a down link [ 544.176089][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 544.273188][T19746] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 544.319655][T19738] macvlan2: entered promiscuous mode [ 544.325653][T19738] macvlan2: entered allmulticast mode [ 544.334018][T19738] bond6: entered promiscuous mode [ 544.341359][T19738] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 544.378392][T19738] bond6: left promiscuous mode [ 544.419858][T19765] netlink: 'syz.2.4048': attribute type 1 has an invalid length. [ 544.713530][T19769] bond6: (slave veth19): Enslaving as an active interface with a down link [ 544.811771][T19772] bond6: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 544.823376][T19786] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 545.208990][T19809] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4059'. [ 545.478546][T19801] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 545.634530][T19822] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4063'. [ 545.687602][T19823] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4063'. [ 545.949321][T19842] netlink: 'syz.1.4069': attribute type 1 has an invalid length. [ 546.250531][T19848] bond9: (slave veth19): Enslaving as an active interface with a down link [ 546.309201][T19842] bond9: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 546.839510][T19872] netlink: 'syz.0.4080': attribute type 1 has an invalid length. [ 546.853970][T19874] netlink: 'syz.2.4077': attribute type 1 has an invalid length. [ 546.863285][T19872] netlink: 'syz.0.4080': attribute type 7 has an invalid length. [ 546.872766][T19872] netlink: 'syz.0.4080': attribute type 8 has an invalid length. [ 547.092771][T19878] bond7: (slave veth21): Enslaving as an active interface with a down link [ 547.145582][T19879] syzkaller0: entered promiscuous mode [ 547.170089][T19879] syzkaller0: entered allmulticast mode [ 547.208303][T19886] netlink: 'syz.4.4081': attribute type 1 has an invalid length. [ 547.243681][T19874] bond7: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 547.329934][T19889] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4081'. [ 547.581646][T19888] bond12: (slave geneve2): making interface the new active one [ 547.622402][T19888] bond12: (slave geneve2): Enslaving as an active interface with an up link [ 547.658649][T19889] 8021q: adding VLAN 0 to HW filter on device bond12 [ 547.831199][T19902] FAULT_INJECTION: forcing a failure. [ 547.831199][T19902] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.859062][T19902] CPU: 0 UID: 0 PID: 19902 Comm: syz.3.4084 Not tainted syzkaller #0 PREEMPT(full) [ 547.859092][T19902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 547.859104][T19902] Call Trace: [ 547.859112][T19902] [ 547.859121][T19902] dump_stack_lvl+0xe8/0x150 [ 547.859157][T19902] should_fail_ex+0x40c/0x560 [ 547.859191][T19902] _copy_from_iter+0x1d3/0x1660 [ 547.859220][T19902] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 547.859250][T19902] ? rcu_is_watching+0x15/0xb0 [ 547.859272][T19902] ? trace_kmem_cache_alloc+0x29/0xe0 [ 547.859300][T19902] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 547.859327][T19902] ? __pfx__copy_from_iter+0x10/0x10 [ 547.859356][T19902] ? __alloc_skb+0x276/0x7a0 [ 547.859377][T19902] ? __alloc_skb+0x276/0x7a0 [ 547.859404][T19902] ? netlink_sendmsg+0x650/0xb40 [ 547.859431][T19902] ? skb_put+0x112/0x210 [ 547.859457][T19902] netlink_sendmsg+0x6c0/0xb40 [ 547.859497][T19902] ? __pfx_netlink_sendmsg+0x10/0x10 [ 547.859534][T19902] ? aa_sock_msg_perm+0xf1/0x1b0 [ 547.859565][T19902] ? __pfx_netlink_sendmsg+0x10/0x10 [ 547.859591][T19902] sock_sendmsg_nosec+0x13a/0x180 [ 547.859628][T19902] ____sys_sendmsg+0x54e/0x850 [ 547.859661][T19902] ? __pfx_____sys_sendmsg+0x10/0x10 [ 547.859698][T19902] ? import_iovec+0x73/0xa0 [ 547.859722][T19902] ___sys_sendmsg+0x2a5/0x360 [ 547.859748][T19902] ? __lock_acquire+0x683/0x2cf0 [ 547.859781][T19902] ? __pfx____sys_sendmsg+0x10/0x10 [ 547.859854][T19902] ? __fget_files+0x2a/0x420 [ 547.859883][T19902] ? __fget_files+0x3a2/0x420 [ 547.859922][T19902] __x64_sys_sendmsg+0x1b1/0x290 [ 547.859951][T19902] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 547.859994][T19902] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.860018][T19902] do_syscall_64+0x174/0x580 [ 547.860045][T19902] ? trace_irq_disable+0x3b/0x140 [ 547.860071][T19902] ? clear_bhb_loop+0x40/0x90 [ 547.860098][T19902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.860120][T19902] RIP: 0033:0x7fe13a19e0d9 [ 547.860141][T19902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.860160][T19902] RSP: 002b:00007fe13b026028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 547.860183][T19902] RAX: ffffffffffffffda RBX: 00007fe13a425fa0 RCX: 00007fe13a19e0d9 [ 547.860199][T19902] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 547.860212][T19902] RBP: 00007fe13b026090 R08: 0000000000000000 R09: 0000000000000000 [ 547.860225][T19902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.860238][T19902] R13: 00007fe13a426038 R14: 00007fe13a425fa0 R15: 00007fff12f7fb38 [ 547.860273][T19902] [ 548.172898][T19896] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 548.187219][ T48] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 548.197563][ T48] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 548.279419][T19903] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 548.301588][T19903] syzkaller1: linktype set to 769 [ 548.322508][T19910] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4086'. [ 548.336214][T19910] netlink: 'syz.0.4086': attribute type 1 has an invalid length. [ 548.407290][T19910] bridge1: entered promiscuous mode [ 548.412591][T19910] bridge1: entered allmulticast mode [ 548.424826][T19910] team0: Port device bridge1 added [ 548.430656][T19908] bridge0: port 2(team0) entered blocking state [ 548.437675][T19908] bridge0: port 2(team0) entered disabled state [ 548.444371][T19908] team0: entered allmulticast mode [ 548.458068][T19908] team0: entered promiscuous mode [ 548.489994][ T1181] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 548.520740][ T1181] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 548.568859][ T1181] net_ratelimit: 12 callbacks suppressed [ 548.568883][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 548.632465][T19920] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 548.645624][T19919] sctp: [Deprecated]: syz.1.4090 (pid 19919) Use of struct sctp_assoc_value in delayed_ack socket option. [ 548.645624][T19919] Use struct sctp_sack_info instead [ 548.712042][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 548.788915][T19928] netlink: 'syz.3.4093': attribute type 1 has an invalid length. [ 549.030775][T19932] bond5: (slave veth15): Enslaving as an active interface with a down link [ 549.108955][T19928] bond5: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 549.627717][T19925] lo speed is unknown, defaulting to 1000 [ 549.637032][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 549.837061][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 549.866417][ T30] audit: type=1804 audit(1786037268.177:13): pid=19955 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4101" name="/newroot/273/cgroup.controllers" dev="tmpfs" ino=1409 res=1 errno=0 [ 549.902786][T19956] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 549.923166][T19956] syzkaller1: linktype set to 769 [ 549.944031][ T30] audit: type=1800 audit(1786037268.177:14): pid=19955 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4101" name="cgroup.controllers" dev="tmpfs" ino=1409 res=0 errno=0 [ 550.037113][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 550.091424][T19961] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4104'. [ 550.125333][T19961] netlink: 277 bytes leftover after parsing attributes in process `syz.0.4104'. [ 550.176690][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 550.217662][T15897] Bluetooth: hci4: command 0x0405 tx timeout [ 550.316919][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 550.401633][T19963] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4105'. [ 550.451725][T19972] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4106'. [ 550.472031][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 550.689173][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 550.925300][T19988] FAULT_INJECTION: forcing a failure. [ 550.925300][T19988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 550.965838][T19988] CPU: 0 UID: 0 PID: 19988 Comm: syz.4.4112 Not tainted syzkaller #0 PREEMPT(full) [ 550.965870][T19988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 550.965883][T19988] Call Trace: [ 550.965892][T19988] [ 550.965902][T19988] dump_stack_lvl+0xe8/0x150 [ 550.965941][T19988] should_fail_ex+0x40c/0x560 [ 550.965974][T19988] _copy_from_user+0x2d/0xb0 [ 550.965997][T19988] ___sys_recvmsg+0x173/0x5a0 [ 550.966032][T19988] ? __pfx____sys_recvmsg+0x10/0x10 [ 550.966065][T19988] ? __fget_files+0x2a/0x420 [ 550.966129][T19988] do_recvmmsg+0x31a/0x7f0 [ 550.966166][T19988] ? __pfx_do_recvmmsg+0x10/0x10 [ 550.966208][T19988] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 550.966239][T19988] ? __fget_files+0x3a2/0x420 [ 550.966285][T19988] __x64_sys_recvmmsg+0x198/0x250 [ 550.966317][T19988] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 550.966355][T19988] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.966380][T19988] do_syscall_64+0x174/0x580 [ 550.966408][T19988] ? trace_irq_disable+0x3b/0x140 [ 550.966436][T19988] ? clear_bhb_loop+0x40/0x90 [ 550.966463][T19988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.966485][T19988] RIP: 0033:0x7f2e15d9e0d9 [ 550.966513][T19988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 550.966532][T19988] RSP: 002b:00007f2e16cd6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 550.966555][T19988] RAX: ffffffffffffffda RBX: 00007f2e16025fa0 RCX: 00007f2e15d9e0d9 [ 550.966570][T19988] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 550.966584][T19988] RBP: 00007f2e16cd6090 R08: 0000000000000000 R09: 0000000000000000 [ 550.966597][T19988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 550.966609][T19988] R13: 00007f2e16026038 R14: 00007f2e16025fa0 R15: 00007ffc3acdb038 [ 550.966643][T19988] [ 551.569094][T19999] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4114'. [ 551.692281][T20004] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4114'. [ 552.162634][T20005] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 552.176028][T20005] syzkaller1: linktype set to 769 [ 552.203774][T20010] netlink: 'syz.0.4116': attribute type 1 has an invalid length. [ 552.393767][T20019] FAULT_INJECTION: forcing a failure. [ 552.393767][T20019] name failslab, interval 1, probability 0, space 0, times 0 [ 552.409284][T20019] CPU: 1 UID: 0 PID: 20019 Comm: syz.1.4119 Not tainted syzkaller #0 PREEMPT(full) [ 552.409316][T20019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 552.409329][T20019] Call Trace: [ 552.409337][T20019] [ 552.409346][T20019] dump_stack_lvl+0xe8/0x150 [ 552.409395][T20019] should_fail_ex+0x40c/0x560 [ 552.409429][T20019] should_failslab+0xa8/0x100 [ 552.409464][T20019] __kmalloc_noprof+0xfe/0x720 [ 552.409492][T20019] ? __kasan_kmalloc+0x93/0xb0 [ 552.409523][T20019] ? nla_strdup+0x9d/0x140 [ 552.409551][T20019] ? nla_strdup+0x9d/0x140 [ 552.409589][T20019] nla_strdup+0x9d/0x140 [ 552.409624][T20019] nf_tables_newchain+0x1aba/0x28b0 [ 552.409647][T20019] ? __lock_acquire+0x683/0x2cf0 [ 552.409696][T20019] ? __pfx_nf_tables_newchain+0x10/0x10 [ 552.409749][T20019] ? nfnl_pernet+0x23/0x240 [ 552.409775][T20019] ? nfnl_pernet+0x23/0x240 [ 552.409810][T20019] ? __nla_parse+0x40/0x60 [ 552.409847][T20019] nfnetlink_rcv+0x1288/0x28c0 [ 552.409916][T20019] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 552.409961][T20019] ? ref_tracker_free+0x689/0x830 [ 552.410017][T20019] ? skb_clone+0x246/0x3a0 [ 552.410049][T20019] ? __netlink_deliver_tap+0x811/0x860 [ 552.410087][T20019] ? netlink_deliver_tap+0x2e/0x1b0 [ 552.410114][T20019] ? netlink_deliver_tap+0x2e/0x1b0 [ 552.410147][T20019] netlink_unicast+0x7bb/0x940 [ 552.410185][T20019] netlink_sendmsg+0x813/0xb40 [ 552.410223][T20019] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.410256][T20019] ? aa_sock_msg_perm+0xf1/0x1b0 [ 552.410287][T20019] ? __pfx_netlink_sendmsg+0x10/0x10 [ 552.410313][T20019] sock_sendmsg_nosec+0x13a/0x180 [ 552.410350][T20019] ____sys_sendmsg+0x54e/0x850 [ 552.410390][T20019] ? __pfx_____sys_sendmsg+0x10/0x10 [ 552.410429][T20019] ? import_iovec+0x73/0xa0 [ 552.410455][T20019] ___sys_sendmsg+0x2a5/0x360 [ 552.410481][T20019] ? __lock_acquire+0x683/0x2cf0 [ 552.410516][T20019] ? __pfx____sys_sendmsg+0x10/0x10 [ 552.410585][T20019] ? __fget_files+0x2a/0x420 [ 552.410614][T20019] ? __fget_files+0x3a2/0x420 [ 552.410655][T20019] __x64_sys_sendmsg+0x1b1/0x290 [ 552.410686][T20019] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 552.410733][T20019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.410757][T20019] do_syscall_64+0x174/0x580 [ 552.410785][T20019] ? trace_irq_disable+0x3b/0x140 [ 552.410814][T20019] ? clear_bhb_loop+0x40/0x90 [ 552.410842][T20019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.410863][T20019] RIP: 0033:0x7f9c6ff9e0d9 [ 552.410883][T20019] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.410901][T20019] RSP: 002b:00007f9c70e92028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 552.410924][T20019] RAX: ffffffffffffffda RBX: 00007f9c70225fa0 RCX: 00007f9c6ff9e0d9 [ 552.410938][T20019] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 552.410952][T20019] RBP: 00007f9c70e92090 R08: 0000000000000000 R09: 0000000000000000 [ 552.410965][T20019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.410977][T20019] R13: 00007f9c70226038 R14: 00007f9c70225fa0 R15: 00007ffdcd8cb588 [ 552.411011][T20019] [ 552.857827][T20011] bond7: (slave veth15): Enslaving as an active interface with a down link [ 552.965293][T20026] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4118'. [ 552.998286][T20015] bond7: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 553.124395][T20024] pimreg: entered allmulticast mode [ 553.137355][T20024] pimreg: left allmulticast mode [ 553.245243][T20033] FAULT_INJECTION: forcing a failure. [ 553.245243][T20033] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 553.287525][T20033] CPU: 1 UID: 0 PID: 20033 Comm: syz.1.4124 Not tainted syzkaller #0 PREEMPT(full) [ 553.287555][T20033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 553.287568][T20033] Call Trace: [ 553.287576][T20033] [ 553.287585][T20033] dump_stack_lvl+0xe8/0x150 [ 553.287624][T20033] should_fail_ex+0x40c/0x560 [ 553.287658][T20033] prepare_alloc_pages+0x230/0x650 [ 553.287699][T20033] __alloc_frozen_pages_noprof+0x12f/0x380 [ 553.287736][T20033] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 553.287773][T20033] ? __pfx_policy_nodemask+0x10/0x10 [ 553.287804][T20033] ? __folio_batch_add_and_move+0x11a/0xc50 [ 553.287829][T20033] ? lock_acquire+0x106/0x350 [ 553.287869][T20033] alloc_pages_mpol+0x212/0x380 [ 553.287908][T20033] folio_alloc_mpol_noprof+0x39/0x160 [ 553.287945][T20033] vma_alloc_folio_noprof+0xe1/0x1e0 [ 553.287983][T20033] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 553.288029][T20033] do_wp_page+0x1163/0x4c70 [ 553.288075][T20033] ? __pfx_do_wp_page+0x10/0x10 [ 553.288095][T20033] ? do_raw_spin_lock+0x12b/0x2f0 [ 553.288123][T20033] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 553.288161][T20033] handle_mm_fault+0x1490/0x3080 [ 553.288202][T20033] ? handle_mm_fault+0xec/0x3080 [ 553.288237][T20033] ? __pfx_handle_mm_fault+0x10/0x10 [ 553.288285][T20033] ? lock_mm_and_find_vma+0xa7/0x340 [ 553.288318][T20033] do_user_addr_fault+0x744/0x1340 [ 553.288382][T20033] exc_page_fault+0x6a/0xc0 [ 553.288414][T20033] asm_exc_page_fault+0x26/0x30 [ 553.288435][T20033] RIP: 0010:__put_user_nocheck_4+0x3/0x20 [ 553.288463][T20033] Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca e9 51 93 03 00 90 90 90 90 90 90 90 90 90 90 [ 553.288482][T20033] RSP: 0018:ffffc9000348f8d8 EFLAGS: 00050246 [ 553.288502][T20033] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000007030 [ 553.288516][T20033] RDX: ffff88801b138000 RSI: 0000000000000000 RDI: 00000000ffffffff [ 553.288530][T20033] RBP: ffffc9000348fa50 R08: ffffffff9057ac37 R09: 1ffffffff20af586 [ 553.288546][T20033] R10: dffffc0000000000 R11: fffffbfff20af587 R12: 1ffff92000691f28 [ 553.288561][T20033] R13: 0000000000000000 R14: 0000200000007000 R15: dffffc0000000000 [ 553.288596][T20033] ____sys_recvmsg+0x2be/0x4a0 [ 553.288636][T20033] ? __pfx_____sys_recvmsg+0x10/0x10 [ 553.288682][T20033] ? import_iovec+0x73/0xa0 [ 553.288708][T20033] ___sys_recvmsg+0x213/0x5a0 [ 553.288742][T20033] ? __pfx____sys_recvmsg+0x10/0x10 [ 553.288775][T20033] ? __fget_files+0x2a/0x420 [ 553.288840][T20033] do_recvmmsg+0x31a/0x7f0 [ 553.288879][T20033] ? __pfx_do_recvmmsg+0x10/0x10 [ 553.288923][T20033] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 553.288952][T20033] ? __fget_files+0x3a2/0x420 [ 553.288992][T20033] __x64_sys_recvmmsg+0x198/0x250 [ 553.289025][T20033] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 553.289061][T20033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.289084][T20033] do_syscall_64+0x174/0x580 [ 553.289111][T20033] ? trace_irq_disable+0x3b/0x140 [ 553.289140][T20033] ? clear_bhb_loop+0x40/0x90 [ 553.289167][T20033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.289188][T20033] RIP: 0033:0x7f9c6ff9e0d9 [ 553.289206][T20033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.289223][T20033] RSP: 002b:00007f9c70e92028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 553.289243][T20033] RAX: ffffffffffffffda RBX: 00007f9c70225fa0 RCX: 00007f9c6ff9e0d9 [ 553.289258][T20033] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 553.289271][T20033] RBP: 00007f9c70e92090 R08: 0000000000000000 R09: 0000000000000000 [ 553.289283][T20033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 553.289295][T20033] R13: 00007f9c70226038 R14: 00007f9c70225fa0 R15: 00007ffdcd8cb588 [ 553.289336][T20033] [ 554.188663][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 554.316084][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 554.418223][T20054] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 554.434411][T20054] syzkaller1: linktype set to 769 [ 554.488555][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 554.605887][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 554.727467][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 554.845885][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 554.987264][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 555.020071][T20078] FAULT_INJECTION: forcing a failure. [ 555.020071][T20078] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 555.089940][T20078] CPU: 0 UID: 0 PID: 20078 Comm: syz.4.4137 Not tainted syzkaller #0 PREEMPT(full) [ 555.089972][T20078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 555.089985][T20078] Call Trace: [ 555.089994][T20078] [ 555.090003][T20078] dump_stack_lvl+0xe8/0x150 [ 555.090043][T20078] should_fail_ex+0x40c/0x560 [ 555.090076][T20078] _copy_from_user+0x2d/0xb0 [ 555.090099][T20078] ___sys_recvmsg+0x173/0x5a0 [ 555.090135][T20078] ? __pfx____sys_recvmsg+0x10/0x10 [ 555.090169][T20078] ? __fget_files+0x2a/0x420 [ 555.090241][T20078] do_recvmmsg+0x31a/0x7f0 [ 555.090280][T20078] ? __pfx_do_recvmmsg+0x10/0x10 [ 555.090324][T20078] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 555.090356][T20078] ? __fget_files+0x3a2/0x420 [ 555.090398][T20078] __x64_sys_recvmmsg+0x198/0x250 [ 555.090431][T20078] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 555.090470][T20078] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.090494][T20078] do_syscall_64+0x174/0x580 [ 555.090534][T20078] ? trace_irq_disable+0x3b/0x140 [ 555.090563][T20078] ? clear_bhb_loop+0x40/0x90 [ 555.090591][T20078] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.090613][T20078] RIP: 0033:0x7f2e15d9e0d9 [ 555.090634][T20078] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.090653][T20078] RSP: 002b:00007f2e16cd6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 555.090677][T20078] RAX: ffffffffffffffda RBX: 00007f2e16025fa0 RCX: 00007f2e15d9e0d9 [ 555.090693][T20078] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 555.090707][T20078] RBP: 00007f2e16cd6090 R08: 0000000000000000 R09: 0000000000000000 [ 555.090720][T20078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 555.090733][T20078] R13: 00007f2e16026038 R14: 00007f2e16025fa0 R15: 00007ffc3acdb038 [ 555.090768][T20078] [ 555.293201][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 555.417220][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 555.542384][T20089] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4139'. [ 555.560692][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 555.715450][T20095] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4143'. [ 555.751516][T20095] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4143'. [ 555.787410][T20094] veth1_to_bond: entered promiscuous mode [ 555.856201][T20100] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4141'. [ 556.263258][T20115] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4144'. [ 556.421796][T20115] bridge0: port 2(bridge_slave_1) entered disabled state [ 556.430814][T20115] bridge0: port 1(bridge_slave_0) entered disabled state [ 556.643548][T20125] FAULT_INJECTION: forcing a failure. [ 556.643548][T20125] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 556.665097][T20124] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4151'. [ 556.677278][T20125] CPU: 1 UID: 0 PID: 20125 Comm: syz.0.4150 Not tainted syzkaller #0 PREEMPT(full) [ 556.677308][T20125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 556.677322][T20125] Call Trace: [ 556.677331][T20125] [ 556.677340][T20125] dump_stack_lvl+0xe8/0x150 [ 556.677380][T20125] should_fail_ex+0x40c/0x560 [ 556.677413][T20125] _copy_from_user+0x2d/0xb0 [ 556.677436][T20125] ___sys_recvmsg+0x173/0x5a0 [ 556.677471][T20125] ? __pfx____sys_recvmsg+0x10/0x10 [ 556.677503][T20125] ? __fget_files+0x2a/0x420 [ 556.677565][T20125] do_recvmmsg+0x31a/0x7f0 [ 556.677602][T20125] ? __pfx_do_recvmmsg+0x10/0x10 [ 556.677646][T20125] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 556.677715][T20125] ? __fget_files+0x3a2/0x420 [ 556.677757][T20125] __x64_sys_recvmmsg+0x198/0x250 [ 556.677791][T20125] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 556.677830][T20125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.677855][T20125] do_syscall_64+0x174/0x580 [ 556.677883][T20125] ? trace_irq_disable+0x3b/0x140 [ 556.677912][T20125] ? clear_bhb_loop+0x40/0x90 [ 556.677939][T20125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.677961][T20125] RIP: 0033:0x7f49e959e0d9 [ 556.677982][T20125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 556.678001][T20125] RSP: 002b:00007f49ea381028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 556.678025][T20125] RAX: ffffffffffffffda RBX: 00007f49e9825fa0 RCX: 00007f49e959e0d9 [ 556.678041][T20125] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 556.678055][T20125] RBP: 00007f49ea381090 R08: 0000000000000000 R09: 0000000000000000 [ 556.678068][T20125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 556.678080][T20125] R13: 00007f49e9826038 R14: 00007f49e9825fa0 R15: 00007ffe2b8a0188 [ 556.678124][T20125] [ 556.893310][T20124] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4151'. [ 557.715397][T20172] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 557.732023][T20172] syzkaller1: linktype set to 769 [ 557.941957][T20176] FAULT_INJECTION: forcing a failure. [ 557.941957][T20176] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 557.967255][T20176] CPU: 1 UID: 0 PID: 20176 Comm: syz.2.4166 Not tainted syzkaller #0 PREEMPT(full) [ 557.967293][T20176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 557.967307][T20176] Call Trace: [ 557.967315][T20176] [ 557.967326][T20176] dump_stack_lvl+0xe8/0x150 [ 557.967364][T20176] should_fail_ex+0x40c/0x560 [ 557.967398][T20176] _copy_from_user+0x2d/0xb0 [ 557.967421][T20176] ___sys_recvmsg+0x173/0x5a0 [ 557.967457][T20176] ? __pfx____sys_recvmsg+0x10/0x10 [ 557.967491][T20176] ? __fget_files+0x2a/0x420 [ 557.967555][T20176] do_recvmmsg+0x31a/0x7f0 [ 557.967594][T20176] ? __pfx_do_recvmmsg+0x10/0x10 [ 557.967636][T20176] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 557.967669][T20176] ? __fget_files+0x3a2/0x420 [ 557.967711][T20176] __x64_sys_recvmmsg+0x198/0x250 [ 557.967744][T20176] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 557.967784][T20176] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.967809][T20176] do_syscall_64+0x174/0x580 [ 557.967836][T20176] ? trace_irq_disable+0x3b/0x140 [ 557.967866][T20176] ? clear_bhb_loop+0x40/0x90 [ 557.967893][T20176] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.967915][T20176] RIP: 0033:0x7f5ebd19e0d9 [ 557.967935][T20176] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 557.967954][T20176] RSP: 002b:00007f5ebdf88028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 557.967977][T20176] RAX: ffffffffffffffda RBX: 00007f5ebd425fa0 RCX: 00007f5ebd19e0d9 [ 557.967993][T20176] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 557.968007][T20176] RBP: 00007f5ebdf88090 R08: 0000000000000000 R09: 0000000000000000 [ 557.968022][T20176] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 557.968034][T20176] R13: 00007f5ebd426038 R14: 00007f5ebd425fa0 R15: 00007ffdeb3eb4f8 [ 557.968069][T20176] [ 558.372544][T20180] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4169'. [ 558.443816][T20178] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4167'. [ 558.466767][T20183] netlink: 176 bytes leftover after parsing attributes in process `syz.2.4168'. [ 558.622556][T20185] syzkaller1: entered promiscuous mode [ 558.644971][T20185] syzkaller1: entered allmulticast mode [ 558.807664][T20190] netlink: 'syz.1.4172': attribute type 1 has an invalid length. [ 558.880649][T20190] bond10: (slave veth21): Enslaving as an active interface with a down link [ 558.911020][T20190] bond10: (slave vlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 559.215953][ T8484] net_ratelimit: 24 callbacks suppressed [ 559.215975][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 559.247351][T20204] FAULT_INJECTION: forcing a failure. [ 559.247351][T20204] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 559.289690][T20204] CPU: 1 UID: 0 PID: 20204 Comm: syz.3.4178 Not tainted syzkaller #0 PREEMPT(full) [ 559.289724][T20204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 559.289736][T20204] Call Trace: [ 559.289757][T20204] [ 559.289767][T20204] dump_stack_lvl+0xe8/0x150 [ 559.289804][T20204] should_fail_ex+0x40c/0x560 [ 559.289835][T20204] _copy_from_user+0x2d/0xb0 [ 559.289857][T20204] ___sys_recvmsg+0x173/0x5a0 [ 559.289901][T20204] ? __pfx____sys_recvmsg+0x10/0x10 [ 559.289935][T20204] ? __fget_files+0x2a/0x420 [ 559.289999][T20204] do_recvmmsg+0x31a/0x7f0 [ 559.290037][T20204] ? __pfx_do_recvmmsg+0x10/0x10 [ 559.290080][T20204] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 559.290112][T20204] ? __fget_files+0x3a2/0x420 [ 559.290152][T20204] __x64_sys_recvmmsg+0x198/0x250 [ 559.290184][T20204] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 559.290223][T20204] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.290248][T20204] do_syscall_64+0x174/0x580 [ 559.290277][T20204] ? trace_irq_disable+0x3b/0x140 [ 559.290306][T20204] ? clear_bhb_loop+0x40/0x90 [ 559.290333][T20204] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.290354][T20204] RIP: 0033:0x7fe13a19e0d9 [ 559.290375][T20204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.290393][T20204] RSP: 002b:00007fe13b026028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 559.290415][T20204] RAX: ffffffffffffffda RBX: 00007fe13a425fa0 RCX: 00007fe13a19e0d9 [ 559.290431][T20204] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 559.290445][T20204] RBP: 00007fe13b026090 R08: 0000000000000000 R09: 0000000000000000 [ 559.290458][T20204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 559.290471][T20204] R13: 00007fe13a426038 R14: 00007fe13a425fa0 R15: 00007fff12f7fb38 [ 559.290504][T20204] [ 559.357117][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 559.629404][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 559.745908][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 559.856845][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 559.940398][T20226] netlink: 'syz.3.4186': attribute type 1 has an invalid length. [ 560.198792][T20230] bond6: (slave veth17): Enslaving as an active interface with a down link [ 560.279322][T20226] bond6: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 560.585066][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 560.718515][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 560.765662][T20245] netlink: 'syz.3.4193': attribute type 7 has an invalid length. [ 560.779994][T20244] __nla_validate_parse: 4 callbacks suppressed [ 560.780018][T20244] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4192'. [ 560.789767][T20245] netlink: 'syz.3.4193': attribute type 8 has an invalid length. [ 560.849602][T20249] FAULT_INJECTION: forcing a failure. [ 560.849602][T20249] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 560.880932][T20249] CPU: 0 UID: 0 PID: 20249 Comm: syz.1.4194 Not tainted syzkaller #0 PREEMPT(full) [ 560.880964][T20249] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 560.880978][T20249] Call Trace: [ 560.880987][T20249] [ 560.880997][T20249] dump_stack_lvl+0xe8/0x150 [ 560.881036][T20249] should_fail_ex+0x40c/0x560 [ 560.881071][T20249] _copy_from_user+0x2d/0xb0 [ 560.881095][T20249] ___sys_recvmsg+0x173/0x5a0 [ 560.881132][T20249] ? __pfx____sys_recvmsg+0x10/0x10 [ 560.881166][T20249] ? __fget_files+0x2a/0x420 [ 560.881230][T20249] do_recvmmsg+0x31a/0x7f0 [ 560.881273][T20249] ? __pfx_do_recvmmsg+0x10/0x10 [ 560.881316][T20249] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 560.881349][T20249] ? __fget_files+0x3a2/0x420 [ 560.881391][T20249] __x64_sys_recvmmsg+0x198/0x250 [ 560.881424][T20249] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 560.881464][T20249] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.881489][T20249] do_syscall_64+0x174/0x580 [ 560.881518][T20249] ? trace_irq_disable+0x3b/0x140 [ 560.881547][T20249] ? clear_bhb_loop+0x40/0x90 [ 560.881575][T20249] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.881599][T20249] RIP: 0033:0x7f9c6ff9e0d9 [ 560.881620][T20249] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 560.881640][T20249] RSP: 002b:00007f9c70e92028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 560.881664][T20249] RAX: ffffffffffffffda RBX: 00007f9c70225fa0 RCX: 00007f9c6ff9e0d9 [ 560.881681][T20249] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 560.881696][T20249] RBP: 00007f9c70e92090 R08: 0000000000000000 R09: 0000000000000000 [ 560.881711][T20249] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 560.881724][T20249] R13: 00007f9c70226038 R14: 00007f9c70225fa0 R15: 00007ffdcd8cb588 [ 560.881761][T20249] [ 561.254313][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 561.402758][T20260] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 561.466560][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 561.748555][T20283] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4205'. [ 561.777581][T20282] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4203'. [ 562.671181][T20301] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4211'. [ 562.831563][T20303] batman_adv: batadv0: Adding interface: macvtap1 [ 562.846428][T20303] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 562.906837][T20303] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 563.150339][T20317] tc_dump_action: action bad kind [ 563.249710][T20325] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4218'. [ 563.353569][T20332] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4222'. [ 563.485010][T20335] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4223'. [ 563.819607][T20353] FAULT_INJECTION: forcing a failure. [ 563.819607][T20353] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 563.845812][T20353] CPU: 0 UID: 0 PID: 20353 Comm: syz.3.4230 Not tainted syzkaller #0 PREEMPT(full) [ 563.845844][T20353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 563.845858][T20353] Call Trace: [ 563.845867][T20353] [ 563.845876][T20353] dump_stack_lvl+0xe8/0x150 [ 563.845916][T20353] should_fail_ex+0x40c/0x560 [ 563.845949][T20353] _copy_from_user+0x2d/0xb0 [ 563.845973][T20353] ___sys_recvmsg+0x173/0x5a0 [ 563.846008][T20353] ? __pfx____sys_recvmsg+0x10/0x10 [ 563.846046][T20353] ? __fget_files+0x2a/0x420 [ 563.846110][T20353] do_recvmmsg+0x31a/0x7f0 [ 563.846149][T20353] ? __pfx_do_recvmmsg+0x10/0x10 [ 563.846191][T20353] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 563.846223][T20353] ? __fget_files+0x3a2/0x420 [ 563.846265][T20353] __x64_sys_recvmmsg+0x198/0x250 [ 563.846298][T20353] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 563.846336][T20353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.846360][T20353] do_syscall_64+0x174/0x580 [ 563.846387][T20353] ? trace_irq_disable+0x3b/0x140 [ 563.846416][T20353] ? clear_bhb_loop+0x40/0x90 [ 563.846444][T20353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 563.846466][T20353] RIP: 0033:0x7fe13a19e0d9 [ 563.846488][T20353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 563.846507][T20353] RSP: 002b:00007fe13b026028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 563.846531][T20353] RAX: ffffffffffffffda RBX: 00007fe13a425fa0 RCX: 00007fe13a19e0d9 [ 563.846548][T20353] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 563.846562][T20353] RBP: 00007fe13b026090 R08: 0000000000000000 R09: 0000000000000000 [ 563.846584][T20353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 563.846598][T20353] R13: 00007fe13a426038 R14: 00007fe13a425fa0 R15: 00007fff12f7fb38 [ 563.846635][T20353] [ 564.185295][T20355] netlink: 'syz.3.4232': attribute type 1 has an invalid length. [ 564.279083][T20364] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4234'. [ 564.333668][T20355] bond7: entered promiscuous mode [ 564.340433][T20355] bond7: entered allmulticast mode [ 564.348161][T20355] 8021q: adding VLAN 0 to HW filter on device bond7 [ 564.435587][T20366] syz.3.4232 (20366) used obsolete PPPIOCDETACH ioctl [ 564.536094][ T12] net_ratelimit: 22 callbacks suppressed [ 564.536119][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 564.699424][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 564.820372][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 564.946060][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 565.066620][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 565.186283][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 565.208947][T20398] netlink: 'syz.1.4241': attribute type 7 has an invalid length. [ 565.265511][T20402] FAULT_INJECTION: forcing a failure. [ 565.265511][T20402] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 565.292050][T20398] vlan4: entered promiscuous mode [ 565.316672][T20402] CPU: 0 UID: 0 PID: 20402 Comm: syz.0.4242 Not tainted syzkaller #0 PREEMPT(full) [ 565.316703][T20402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 565.316718][T20402] Call Trace: [ 565.316727][T20402] [ 565.316738][T20402] dump_stack_lvl+0xe8/0x150 [ 565.316775][T20402] should_fail_ex+0x40c/0x560 [ 565.316809][T20402] _copy_from_user+0x2d/0xb0 [ 565.316832][T20402] ___sys_recvmsg+0x173/0x5a0 [ 565.316869][T20402] ? __pfx____sys_recvmsg+0x10/0x10 [ 565.316903][T20402] ? __fget_files+0x2a/0x420 [ 565.316968][T20402] do_recvmmsg+0x31a/0x7f0 [ 565.317007][T20402] ? __pfx_do_recvmmsg+0x10/0x10 [ 565.317048][T20402] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 565.317081][T20402] ? __fget_files+0x3a2/0x420 [ 565.317122][T20402] __x64_sys_recvmmsg+0x198/0x250 [ 565.317155][T20402] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 565.317195][T20402] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.317219][T20402] do_syscall_64+0x174/0x580 [ 565.317248][T20402] ? trace_irq_disable+0x3b/0x140 [ 565.317278][T20402] ? clear_bhb_loop+0x40/0x90 [ 565.317305][T20402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.317328][T20402] RIP: 0033:0x7f49e959e0d9 [ 565.317349][T20402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 565.317368][T20402] RSP: 002b:00007f49ea381028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 565.317393][T20402] RAX: ffffffffffffffda RBX: 00007f49e9825fa0 RCX: 00007f49e959e0d9 [ 565.317410][T20402] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 565.317425][T20402] RBP: 00007f49ea381090 R08: 0000000000000000 R09: 0000000000000000 [ 565.317439][T20402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 565.317460][T20402] R13: 00007f49e9826038 R14: 00007f49e9825fa0 R15: 00007ffe2b8a0188 [ 565.317496][T20402] [ 565.546481][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 565.667842][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 565.778213][T20418] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4247'. [ 565.788737][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 565.907268][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 566.112349][T20436] netlink: 1355 bytes leftover after parsing attributes in process `syz.0.4253'. [ 566.160841][T20438] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4254'. [ 566.185157][T20436] IPVS: set_ctl: invalid protocol: 44 172.20.20.170:20004 [ 566.200816][T20442] FAULT_INJECTION: forcing a failure. [ 566.200816][T20442] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 566.256925][T20442] CPU: 0 UID: 0 PID: 20442 Comm: syz.2.4256 Not tainted syzkaller #0 PREEMPT(full) [ 566.256957][T20442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 566.256971][T20442] Call Trace: [ 566.256980][T20442] [ 566.256990][T20442] dump_stack_lvl+0xe8/0x150 [ 566.257028][T20442] should_fail_ex+0x40c/0x560 [ 566.257061][T20442] _copy_from_user+0x2d/0xb0 [ 566.257083][T20442] ___sys_recvmsg+0x173/0x5a0 [ 566.257119][T20442] ? __pfx____sys_recvmsg+0x10/0x10 [ 566.257152][T20442] ? __fget_files+0x2a/0x420 [ 566.257210][T20442] do_recvmmsg+0x31a/0x7f0 [ 566.257249][T20442] ? __pfx_do_recvmmsg+0x10/0x10 [ 566.257291][T20442] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 566.257323][T20442] ? __fget_files+0x3a2/0x420 [ 566.257363][T20442] __x64_sys_recvmmsg+0x198/0x250 [ 566.257395][T20442] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 566.257431][T20442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.257456][T20442] do_syscall_64+0x174/0x580 [ 566.257485][T20442] ? trace_irq_disable+0x3b/0x140 [ 566.257514][T20442] ? clear_bhb_loop+0x40/0x90 [ 566.257542][T20442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.257565][T20442] RIP: 0033:0x7f5ebd19e0d9 [ 566.257586][T20442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.257607][T20442] RSP: 002b:00007f5ebdf88028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 566.257635][T20442] RAX: ffffffffffffffda RBX: 00007f5ebd425fa0 RCX: 00007f5ebd19e0d9 [ 566.257662][T20442] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 566.257677][T20442] RBP: 00007f5ebdf88090 R08: 0000000000000000 R09: 0000000000000000 [ 566.257691][T20442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 566.257704][T20442] R13: 00007f5ebd426038 R14: 00007f5ebd425fa0 R15: 00007ffdeb3eb4f8 [ 566.257741][T20442] [ 566.363034][T20443] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4255'. [ 566.585087][T20454] FAULT_INJECTION: forcing a failure. [ 566.585087][T20454] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 566.638027][T20454] CPU: 0 UID: 0 PID: 20454 Comm: syz.1.4258 Not tainted syzkaller #0 PREEMPT(full) [ 566.638059][T20454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 566.638075][T20454] Call Trace: [ 566.638085][T20454] [ 566.638095][T20454] dump_stack_lvl+0xe8/0x150 [ 566.638136][T20454] should_fail_ex+0x40c/0x560 [ 566.638170][T20454] _copy_from_user+0x2d/0xb0 [ 566.638194][T20454] ___sys_sendmsg+0x1c6/0x360 [ 566.638223][T20454] ? __lock_acquire+0x683/0x2cf0 [ 566.638266][T20454] ? __pfx____sys_sendmsg+0x10/0x10 [ 566.638334][T20454] ? __fget_files+0x2a/0x420 [ 566.638365][T20454] ? __fget_files+0x3a2/0x420 [ 566.638406][T20454] __x64_sys_sendmsg+0x1b1/0x290 [ 566.638438][T20454] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 566.638486][T20454] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.638512][T20454] do_syscall_64+0x174/0x580 [ 566.638540][T20454] ? trace_irq_disable+0x3b/0x140 [ 566.638569][T20454] ? clear_bhb_loop+0x40/0x90 [ 566.638597][T20454] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.638627][T20454] RIP: 0033:0x7f9c6ff9e0d9 [ 566.638649][T20454] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.638668][T20454] RSP: 002b:00007f9c70e92028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 566.638692][T20454] RAX: ffffffffffffffda RBX: 00007f9c70225fa0 RCX: 00007f9c6ff9e0d9 [ 566.638709][T20454] RDX: 0000000000000814 RSI: 0000200000000140 RDI: 0000000000000006 [ 566.638723][T20454] RBP: 00007f9c70e92090 R08: 0000000000000000 R09: 0000000000000000 [ 566.638737][T20454] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 566.638750][T20454] R13: 00007f9c70226038 R14: 00007f9c70225fa0 R15: 00007ffdcd8cb588 [ 566.638786][T20454] [ 566.640570][T20457] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4260'. [ 566.942778][T20458] xt_socket: unknown flags 0x4c [ 567.033794][T20472] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4264'. [ 567.063764][T20472] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4264'. [ 567.317365][T20483] nbd6: detected capacity change from 0 to 63 [ 567.364540][T15897] block nbd6: Receive control failed (result -104) [ 567.365224][ T1645] block nbd6: Send control failed (result -32) [ 567.385134][ T1645] block nbd6: Request send failed, requeueing [ 567.385180][T20490] FAULT_INJECTION: forcing a failure. [ 567.385180][T20490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 567.414897][ T1645] block nbd6: Dead connection, failed to find a fallback [ 567.434723][ T1645] block nbd6: shutting down sockets [ 567.449955][ T1645] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 567.467838][ T1645] Buffer I/O error on dev nbd6, logical block 2, async page read [ 567.478900][ T1645] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 567.497628][ T1645] Buffer I/O error on dev nbd6, logical block 3, async page read [ 567.506236][T20490] CPU: 0 UID: 0 PID: 20490 Comm: syz.1.4270 Not tainted syzkaller #0 PREEMPT(full) [ 567.506263][T20490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 567.506274][T20490] Call Trace: [ 567.506281][T20490] [ 567.506289][T20490] dump_stack_lvl+0xe8/0x150 [ 567.506334][T20490] should_fail_ex+0x40c/0x560 [ 567.506360][T20490] _copy_from_user+0x2d/0xb0 [ 567.506379][T20490] ___sys_recvmsg+0x173/0x5a0 [ 567.506407][T20490] ? __pfx____sys_recvmsg+0x10/0x10 [ 567.506434][T20490] ? __fget_files+0x2a/0x420 [ 567.506483][T20490] do_recvmmsg+0x31a/0x7f0 [ 567.506513][T20490] ? __pfx_do_recvmmsg+0x10/0x10 [ 567.506547][T20490] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 567.506582][T20490] ? __fget_files+0x3a2/0x420 [ 567.506615][T20490] __x64_sys_recvmmsg+0x198/0x250 [ 567.506642][T20490] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 567.506672][T20490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.506692][T20490] do_syscall_64+0x174/0x580 [ 567.506714][T20490] ? trace_irq_disable+0x3b/0x140 [ 567.506737][T20490] ? clear_bhb_loop+0x40/0x90 [ 567.506758][T20490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.506776][T20490] RIP: 0033:0x7f9c6ff9e0d9 [ 567.506793][T20490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.506808][T20490] RSP: 002b:00007f9c70e92028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 567.506828][T20490] RAX: ffffffffffffffda RBX: 00007f9c70225fa0 RCX: 00007f9c6ff9e0d9 [ 567.506841][T20490] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 567.506853][T20490] RBP: 00007f9c70e92090 R08: 0000000000000000 R09: 0000000000000000 [ 567.506864][T20490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 567.506874][T20490] R13: 00007f9c70226038 R14: 00007f9c70225fa0 R15: 00007ffdcd8cb588 [ 567.506901][T20490] [ 567.610558][T20496] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4271'. [ 568.000009][T20520] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 568.006645][T20520] syzkaller1: linktype set to 769 [ 568.128445][T20524] x_tables: duplicate underflow at hook 4 [ 568.449854][T20537] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4284'. [ 569.108664][T20547] FAULT_INJECTION: forcing a failure. [ 569.108664][T20547] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.123085][T20547] CPU: 1 UID: 0 PID: 20547 Comm: syz.0.4287 Not tainted syzkaller #0 PREEMPT(full) [ 569.123115][T20547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 569.123130][T20547] Call Trace: [ 569.123139][T20547] [ 569.123150][T20547] dump_stack_lvl+0xe8/0x150 [ 569.123189][T20547] should_fail_ex+0x40c/0x560 [ 569.123223][T20547] _copy_from_user+0x2d/0xb0 [ 569.123246][T20547] ___sys_recvmsg+0x173/0x5a0 [ 569.123282][T20547] ? __pfx____sys_recvmsg+0x10/0x10 [ 569.123317][T20547] ? __fget_files+0x2a/0x420 [ 569.123382][T20547] do_recvmmsg+0x31a/0x7f0 [ 569.123421][T20547] ? __pfx_do_recvmmsg+0x10/0x10 [ 569.123471][T20547] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 569.123505][T20547] ? __fget_files+0x3a2/0x420 [ 569.123547][T20547] __x64_sys_recvmmsg+0x198/0x250 [ 569.123580][T20547] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 569.123618][T20547] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.123645][T20547] do_syscall_64+0x174/0x580 [ 569.123667][T20547] ? trace_irq_disable+0x3b/0x140 [ 569.123688][T20547] ? clear_bhb_loop+0x40/0x90 [ 569.123708][T20547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.123724][T20547] RIP: 0033:0x7f49e959e0d9 [ 569.123739][T20547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 569.123753][T20547] RSP: 002b:00007f49ea381028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 569.123771][T20547] RAX: ffffffffffffffda RBX: 00007f49e9825fa0 RCX: 00007f49e959e0d9 [ 569.123782][T20547] RDX: 0000000000000a0d RSI: 00002000000066c0 RDI: 0000000000000003 [ 569.123792][T20547] RBP: 00007f49ea381090 R08: 0000000000000000 R09: 0000000000000000 [ 569.123802][T20547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 569.123811][T20547] R13: 00007f49e9826038 R14: 00007f49e9825fa0 R15: 00007ffe2b8a0188 [ 569.123836][T20547] [ 569.648306][ T78] net_ratelimit: 31 callbacks suppressed [ 569.648330][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 569.776990][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 569.887249][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 570.007121][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 570.115994][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 570.225559][T20553] netlink: 'syz.0.4289': attribute type 1 has an invalid length. [ 570.236055][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 570.280787][T20553] bond8: (slave veth17): Enslaving as an active interface with a down link [ 570.300488][T20553] bond8: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 570.346370][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 570.456918][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 570.566953][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 570.676889][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 570.828042][T20501] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 571.062681][T20562] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4293'. [ 571.134395][T20564] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 571.164565][T20564] syzkaller1: linktype set to 769 [ 571.269840][T20575] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4297'. [ 571.591525][T20592] netlink: 'syz.2.4300': attribute type 1 has an invalid length. [ 571.672468][T20592] bond8: (slave veth25): Enslaving as an active interface with a down link [ 571.759465][T20592] bond8: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 572.081533][T20609] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4305'. [ 572.250475][T20616] syzkaller1: entered promiscuous mode [ 572.265760][T20616] syzkaller1: entered allmulticast mode [ 572.370150][T20618] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4309'. [ 572.439352][T20618] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.958411][T20651] netlink: 'syz.3.4317': attribute type 1 has an invalid length. [ 573.134864][T20653] bond8: (slave veth21): Enslaving as an active interface with a down link [ 573.205573][T20651] bond8: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 573.631122][T20665] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4322'. [ 573.762911][T20672] netlink: 'syz.0.4325': attribute type 7 has an invalid length. [ 573.793054][T20672] netlink: 'syz.0.4325': attribute type 8 has an invalid length. [ 574.044130][T20685] C: renamed from veth1_to_team (while UP) [ 574.085667][T20689] sctp: [Deprecated]: syz.2.4331 (pid 20689) Use of struct sctp_assoc_value in delayed_ack socket option. [ 574.085667][T20689] Use struct sctp_sack_info instead [ 574.128779][T20685] netlink: 120 bytes leftover after parsing attributes in process `syz.1.4329'. [ 574.258843][T20689] lo speed is unknown, defaulting to 1000 [ 574.659405][T20695] net_ratelimit: 562 callbacks suppressed [ 574.659425][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.713868][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.724953][ T8488] bond13: (slave batadv0): failed to get link speed/duplex [ 574.744510][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.770611][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.795976][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.812650][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.835007][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.849989][T20695] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 574.862120][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 575.282133][T20723] netlink: 'syz.3.4341': attribute type 7 has an invalid length. [ 575.317808][T20723] netlink: 'syz.3.4341': attribute type 8 has an invalid length. [ 575.932777][T20750] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4350'. [ 575.968351][T20745] lo speed is unknown, defaulting to 1000 [ 576.220111][ T78] wlan0: Trigger new scan to find an IBSS to join [ 576.385056][ T1645] block nbd6: Possible stuck request ffff888027270000: control (read@0,1024B). Runtime 9 seconds [ 576.407871][ T1645] block nbd6: Possible stuck request ffff8880272701c0: control (read@1024,1024B). Runtime 9 seconds [ 576.501026][T20771] netlink: 'syz.4.4354': attribute type 7 has an invalid length. [ 576.547689][T20771] netlink: 'syz.4.4354': attribute type 8 has an invalid length. [ 576.834021][T20774] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4356'. [ 576.881404][T20778] syzkaller1: entered promiscuous mode [ 576.890049][T20778] syzkaller1: entered allmulticast mode [ 576.914801][T20778] lo: entered allmulticast mode [ 577.060975][T20785] netlink: 'syz.2.4358': attribute type 1 has an invalid length. [ 577.142099][T20776] lo: left allmulticast mode [ 577.229221][T20787] bond9: (slave veth27): Enslaving as an active interface with a down link [ 577.254229][T20785] bond9: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 577.580280][T20793] lo speed is unknown, defaulting to 1000 [ 577.780890][T20801] bond_slave_1: entered promiscuous mode [ 577.795464][T20801] bond0: entered promiscuous mode [ 577.806630][T20801] bond_slave_0: entered promiscuous mode [ 577.819308][T20803] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4364'. [ 577.869525][T20803] [ 577.871967][T20803] ====================================================== [ 577.879018][T20803] WARNING: possible circular locking dependency detected [ 577.886076][T20803] syzkaller #0 Not tainted [ 577.890528][T20803] ------------------------------------------------------ [ 577.897592][T20803] syz.2.4364/20803 is trying to acquire lock: [ 577.903711][T20803] ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x61/0x660 [ 577.913082][T20803] [ 577.913082][T20803] but task is already holding lock: [ 577.920561][T20803] ffff8880662ce530 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4e/0xa40 [ 577.929850][T20803] [ 577.929850][T20803] which lock already depends on the new lock. [ 577.929850][T20803] [ 577.940384][T20803] [ 577.940384][T20803] the existing dependency chain (in reverse order) is: [ 577.949462][T20803] [ 577.949462][T20803] -> #7 (&idev->mc_lock){+.+.}-{4:4}: [ 577.957242][T20803] __mutex_lock+0x19d/0x1550 [ 577.962408][T20803] __ipv6_dev_mc_inc+0x4e/0xa40 [ 577.967841][T20803] addrconf_join_solict+0x104/0x190 [ 577.973682][T20803] __ipv6_dev_ac_inc+0x8fd/0xb90 [ 577.979209][T20803] ipv6_sock_ac_join+0x665/0x820 [ 577.984712][T20803] do_ipv6_setsockopt+0x20d1/0x3180 [ 577.990586][T20803] ipv6_setsockopt+0x59/0x170 [ 577.995821][T20803] do_sock_setsockopt+0x17c/0x1b0 [ 578.001540][T20803] __x64_sys_setsockopt+0x13d/0x1b0 [ 578.007292][T20803] do_syscall_64+0x174/0x580 [ 578.012438][T20803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.018884][T20803] [ 578.018884][T20803] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 578.026659][T20803] lock_sock_nested+0x41/0x100 [ 578.031983][T20803] inet_shutdown+0x6a/0x390 [ 578.037036][T20803] nbd_mark_nsock_dead+0x2cb/0x550 [ 578.042697][T20803] recv_work+0x1cee/0x1e10 [ 578.047665][T20803] process_scheduled_works+0xa8e/0x14e0 [ 578.053769][T20803] worker_thread+0xa47/0xfb0 [ 578.058924][T20803] kthread+0x388/0x470 [ 578.063571][T20803] ret_from_fork+0x514/0xb70 [ 578.068720][T20803] ret_from_fork_asm+0x1a/0x30 [ 578.074052][T20803] [ 578.074052][T20803] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 578.081748][T20803] __mutex_lock+0x19d/0x1550 [ 578.086911][T20803] nbd_queue_rq+0x373/0x1150 [ 578.092053][T20803] blk_mq_dispatch_rq_list+0x499/0x1990 [ 578.098147][T20803] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 578.105048][T20803] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 578.111604][T20803] blk_mq_run_work_fn+0x16c/0x300 [ 578.117232][T20803] process_scheduled_works+0xa8e/0x14e0 [ 578.123378][T20803] worker_thread+0xa47/0xfb0 [ 578.128620][T20803] kthread+0x388/0x470 [ 578.133246][T20803] ret_from_fork+0x514/0xb70 [ 578.138395][T20803] ret_from_fork_asm+0x1a/0x30 [ 578.143712][T20803] [ 578.143712][T20803] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 578.150950][T20803] __mutex_lock+0x19d/0x1550 [ 578.156095][T20803] nbd_queue_rq+0xc1/0x1150 [ 578.161178][T20803] blk_mq_dispatch_rq_list+0x499/0x1990 [ 578.167277][T20803] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 578.174165][T20803] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 578.180709][T20803] blk_mq_run_work_fn+0x16c/0x300 [ 578.186285][T20803] process_scheduled_works+0xa8e/0x14e0 [ 578.192383][T20803] worker_thread+0xa47/0xfb0 [ 578.197518][T20803] kthread+0x388/0x470 [ 578.202150][T20803] ret_from_fork+0x514/0xb70 [ 578.207294][T20803] ret_from_fork_asm+0x1a/0x30 [ 578.212602][T20803] [ 578.212602][T20803] -> #3 (set->srcu){.+.+}-{0:0}: [ 578.219778][T20803] __synchronize_srcu+0xc9/0x2f0 [ 578.225276][T20803] elevator_switch+0x1e8/0x7b0 [ 578.230624][T20803] elevator_change+0x2fa/0x480 [ 578.235951][T20803] elevator_set_default+0x375/0x440 [ 578.241709][T20803] blk_register_queue+0x3f3/0x4e0 [ 578.247363][T20803] __add_disk+0x6cb/0xe30 [ 578.252242][T20803] add_disk_fwnode+0x100/0x3a0 [ 578.257640][T20803] nbd_dev_add+0x733/0xb60 [ 578.262601][T20803] nbd_init+0x15f/0x1e0 [ 578.267315][T20803] do_one_initcall+0x250/0x870 [ 578.272721][T20803] do_initcall_level+0x10a/0x1a0 [ 578.278209][T20803] do_initcalls+0x59/0xa0 [ 578.283267][T20803] kernel_init_freeable+0x29d/0x3e0 [ 578.289012][T20803] kernel_init+0x1d/0x1d0 [ 578.293901][T20803] ret_from_fork+0x514/0xb70 [ 578.299206][T20803] ret_from_fork_asm+0x1a/0x30 [ 578.304542][T20803] [ 578.304542][T20803] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 578.312402][T20803] __mutex_lock+0x19d/0x1550 [ 578.317581][T20803] elevator_change+0x1af/0x480 [ 578.322912][T20803] elevator_set_none+0xb5/0x140 [ 578.328326][T20803] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 578.334697][T20803] nbd_start_device+0x189/0xb30 [ 578.340132][T20803] nbd_genl_connect+0x1597/0x1c10 [ 578.345790][T20803] genl_family_rcv_msg_doit+0x233/0x340 [ 578.351930][T20803] genl_rcv_msg+0x614/0x7a0 [ 578.357087][T20803] netlink_rcv_skb+0x226/0x4a0 [ 578.362406][T20803] genl_rcv+0x28/0x40 [ 578.367083][T20803] netlink_unicast+0x7bb/0x940 [ 578.372415][T20803] netlink_sendmsg+0x813/0xb40 [ 578.377751][T20803] sock_sendmsg_nosec+0x13a/0x180 [ 578.383350][T20803] ____sys_sendmsg+0x54e/0x850 [ 578.388665][T20803] ___sys_sendmsg+0x2a5/0x360 [ 578.394006][T20803] __x64_sys_sendmsg+0x1b1/0x290 [ 578.399498][T20803] do_syscall_64+0x174/0x580 [ 578.404647][T20803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.411090][T20803] [ 578.411090][T20803] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 578.419919][T20803] blk_alloc_queue+0x544/0x690 [ 578.425264][T20803] __blk_mq_alloc_disk+0x194/0x390 [ 578.431051][T20803] nbd_dev_add+0x494/0xb60 [ 578.436036][T20803] nbd_init+0x15f/0x1e0 [ 578.440855][T20803] do_one_initcall+0x250/0x870 [ 578.446250][T20803] do_initcall_level+0x10a/0x1a0 [ 578.451830][T20803] do_initcalls+0x59/0xa0 [ 578.456797][T20803] kernel_init_freeable+0x29d/0x3e0 [ 578.462653][T20803] kernel_init+0x1d/0x1d0 [ 578.467634][T20803] ret_from_fork+0x514/0xb70 [ 578.472802][T20803] ret_from_fork_asm+0x1a/0x30 [ 578.478107][T20803] [ 578.478107][T20803] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 578.485349][T20803] __lock_acquire+0x1520/0x2cf0 [ 578.490753][T20803] lock_acquire+0x106/0x350 [ 578.495807][T20803] fs_reclaim_acquire+0x71/0x100 [ 578.501323][T20803] __kmalloc_cache_noprof+0x61/0x660 [ 578.507158][T20803] __ipv6_dev_mc_inc+0x447/0xa40 [ 578.512646][T20803] pndisc_constructor+0xe0/0x150 [ 578.518141][T20803] pneigh_create+0x237/0x4a0 [ 578.523276][T20803] neigh_add+0x6ea/0xf60 [ 578.528070][T20803] rtnetlink_rcv_msg+0x7b9/0xc00 [ 578.533560][T20803] netlink_rcv_skb+0x226/0x4a0 [ 578.538977][T20803] netlink_unicast+0x7bb/0x940 [ 578.544309][T20803] netlink_sendmsg+0x813/0xb40 [ 578.549636][T20803] sock_sendmsg_nosec+0x13a/0x180 [ 578.555243][T20803] ____sys_sendmsg+0x54e/0x850 [ 578.560556][T20803] ___sys_sendmsg+0x2a5/0x360 [ 578.565794][T20803] __x64_sys_sendmsg+0x1b1/0x290 [ 578.571303][T20803] do_syscall_64+0x174/0x580 [ 578.576539][T20803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.583011][T20803] [ 578.583011][T20803] other info that might help us debug this: [ 578.583011][T20803] [ 578.593265][T20803] Chain exists of: [ 578.593265][T20803] fs_reclaim --> sk_lock-AF_INET6 --> &idev->mc_lock [ 578.593265][T20803] [ 578.605915][T20803] Possible unsafe locking scenario: [ 578.605915][T20803] [ 578.613410][T20803] CPU0 CPU1 [ 578.618824][T20803] ---- ---- [ 578.624313][T20803] lock(&idev->mc_lock); [ 578.628774][T20803] lock(sk_lock-AF_INET6); [ 578.635857][T20803] lock(&idev->mc_lock); [ 578.642785][T20803] lock(fs_reclaim); [ 578.646807][T20803] [ 578.646807][T20803] *** DEADLOCK *** [ 578.646807][T20803] [ 578.655004][T20803] 3 locks held by syz.2.4364/20803: [ 578.660260][T20803] #0: ffffffff9002e5c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 [ 578.669803][T20803] #1: ffffffff9015e478 (&tbl->phash_lock){+.+.}-{4:4}, at: pneigh_create+0x4a/0x4a0 [ 578.679453][T20803] #2: ffff8880662ce530 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4e/0xa40 [ 578.689224][T20803] [ 578.689224][T20803] stack backtrace: [ 578.695172][T20803] CPU: 1 UID: 0 PID: 20803 Comm: syz.2.4364 Not tainted syzkaller #0 PREEMPT(full) [ 578.695197][T20803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 578.695210][T20803] Call Trace: [ 578.695220][T20803] [ 578.695229][T20803] dump_stack_lvl+0xe8/0x150 [ 578.695261][T20803] print_circular_bug+0x2e1/0x300 [ 578.695283][T20803] check_noncircular+0x12e/0x150 [ 578.695304][T20803] __lock_acquire+0x1520/0x2cf0 [ 578.695334][T20803] ? preempt_schedule_common+0x82/0xd0 [ 578.695358][T20803] ? preempt_schedule_thunk+0x16/0x40 [ 578.695382][T20803] ? __mutex_lock+0x321/0x1550 [ 578.695408][T20803] ? __kmalloc_cache_noprof+0x61/0x660 [ 578.695432][T20803] lock_acquire+0x106/0x350 [ 578.695455][T20803] ? __kmalloc_cache_noprof+0x61/0x660 [ 578.695480][T20803] ? __ipv6_dev_mc_inc+0x4e/0xa40 [ 578.695506][T20803] ? __pfx___mutex_lock+0x10/0x10 [ 578.695538][T20803] fs_reclaim_acquire+0x71/0x100 [ 578.695561][T20803] ? __kmalloc_cache_noprof+0x61/0x660 [ 578.695585][T20803] __kmalloc_cache_noprof+0x61/0x660 [ 578.695609][T20803] ? __ipv6_dev_mc_inc+0x447/0xa40 [ 578.695633][T20803] ? __ipv6_dev_mc_inc+0x447/0xa40 [ 578.695661][T20803] __ipv6_dev_mc_inc+0x447/0xa40 [ 578.695692][T20803] pndisc_constructor+0xe0/0x150 [ 578.695717][T20803] ? __pfx_pndisc_constructor+0x10/0x10 [ 578.695742][T20803] ? __kmalloc_noprof+0x1ad/0x720 [ 578.695765][T20803] ? pneigh_create+0x11c/0x4a0 [ 578.695781][T20803] ? pneigh_create+0x15b/0x4a0 [ 578.695802][T20803] pneigh_create+0x237/0x4a0 [ 578.695821][T20803] neigh_add+0x6ea/0xf60 [ 578.695848][T20803] ? __pfx_neigh_add+0x10/0x10 [ 578.695882][T20803] ? __pfx_neigh_add+0x10/0x10 [ 578.695903][T20803] rtnetlink_rcv_msg+0x7b9/0xc00 [ 578.695925][T20803] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 578.695944][T20803] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 578.695963][T20803] ? ref_tracker_free+0x689/0x830 [ 578.695989][T20803] ? __pfx_ref_tracker_free+0x10/0x10 [ 578.696017][T20803] netlink_rcv_skb+0x226/0x4a0 [ 578.696041][T20803] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 578.696061][T20803] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 578.696088][T20803] ? netlink_deliver_tap+0x2e/0x1b0 [ 578.696111][T20803] ? netlink_deliver_tap+0x2e/0x1b0 [ 578.696136][T20803] netlink_unicast+0x7bb/0x940 [ 578.696161][T20803] netlink_sendmsg+0x813/0xb40 [ 578.696189][T20803] ? __pfx_netlink_sendmsg+0x10/0x10 [ 578.696214][T20803] ? aa_sock_msg_perm+0xf1/0x1b0 [ 578.696236][T20803] ? __pfx_netlink_sendmsg+0x10/0x10 [ 578.696258][T20803] sock_sendmsg_nosec+0x13a/0x180 [ 578.696287][T20803] ____sys_sendmsg+0x54e/0x850 [ 578.696311][T20803] ? __pfx_____sys_sendmsg+0x10/0x10 [ 578.696337][T20803] ? import_iovec+0x73/0xa0 [ 578.696354][T20803] ___sys_sendmsg+0x2a5/0x360 [ 578.696376][T20803] ? __lock_acquire+0x683/0x2cf0 [ 578.696402][T20803] ? __pfx____sys_sendmsg+0x10/0x10 [ 578.696425][T20803] ? futex_wait+0x2a2/0x390 [ 578.696459][T20803] ? __fget_files+0x2a/0x420 [ 578.696483][T20803] ? __fget_files+0x3a2/0x420 [ 578.696512][T20803] __x64_sys_sendmsg+0x1b1/0x290 [ 578.696542][T20803] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 578.696573][T20803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.696592][T20803] do_syscall_64+0x174/0x580 [ 578.696617][T20803] ? clear_bhb_loop+0x40/0x90 [ 578.696637][T20803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.696655][T20803] RIP: 0033:0x7f5ebd19e0d9 [ 578.696673][T20803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 578.696689][T20803] RSP: 002b:00007f5ebdf88028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 578.696709][T20803] RAX: ffffffffffffffda RBX: 00007f5ebd425fa0 RCX: 00007f5ebd19e0d9 [ 578.696723][T20803] RDX: 0000000000000004 RSI: 0000200000000940 RDI: 0000000000000005 [ 578.696735][T20803] RBP: 00007f5ebd235024 R08: 0000000000000000 R09: 0000000000000000 [ 578.696747][T20803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 578.696757][T20803] R13: 00007f5ebd426038 R14: 00007f5ebd425fa0 R15: 00007ffdeb3eb4f8 [ 578.696778][T20803] [ 579.267694][ T1181] wlan0: Trigger new scan to find an IBSS to join [ 579.652376][T20800] bond0: left promiscuous mode [ 579.657590][T20800] bond_slave_0: left promiscuous mode [ 579.664638][T20800] bond_slave_1: left promiscuous mode [ 579.735813][ T78] net_ratelimit: 138 callbacks suppressed [ 579.735837][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 579.866051][ T78] bond13: (slave batadv0): failed to get link speed/duplex [ 579.897608][ T5713] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.907178][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.976846][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 580.086803][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 580.197025][ T8484] bond13: (slave batadv0): failed to get link speed/duplex [ 580.316028][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 580.426010][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 580.535959][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 582.217557][ T8486] wlan0: Trigger new scan to find an IBSS to join [ 583.127052][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 584.846645][ T1181] net_ratelimit: 41 callbacks suppressed [ 584.846672][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 584.966661][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 585.077468][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 585.188595][ T1181] bond13: (slave batadv0): failed to get link speed/duplex [ 585.305998][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 585.416591][ T12] bond13: (slave batadv0): failed to get link speed/duplex [ 585.424021][ T1645] block nbd6: Possible stuck request ffff888027270000: control (read@0,1024B). Runtime 18 seconds [ 585.436735][ T1645] block nbd6: Possible stuck request ffff8880272701c0: control (read@1024,1024B). Runtime 18 seconds [ 585.526861][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 585.637548][ T8486] bond13: (slave batadv0): failed to get link speed/duplex [ 585.747421][ T8493] bond13: (slave batadv0): failed to get link speed/duplex [ 585.856104][ T12] bond13: (slave batadv0): failed to get link speed/duplex