last executing test programs: 4.272435052s ago: executing program 3 (id=3251): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0xffffffff, [{0x0, 0x2, 0xc1}]}, @restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x3e}, 0x20) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet6_opts(r0, 0x29, 0x39, 0x0, &(0x7f0000000040)) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x7, 0xb, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020437b1af8ff00000000bfa100000000000007010000f8ffffffb7020000000000009f030000feffffff85000000b200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.08264086s ago: executing program 3 (id=3254): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xb, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x1300}, [@printk={@li, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x41}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x2}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x29, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$kcm(0x23, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e00800000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40054) 3.854269849s ago: executing program 1 (id=3259): r0 = socket(0x1e, 0x2, 0xcb15ac4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@can_delroute={0x34, 0x19, 0x1, 0x0, 0x0, {}, [@CGW_CS_XOR={0x8, 0x5, {0x5, 0x0, 0xfffffffffffffffd}}, @CGW_MOD_AND={0x15, 0x1, {{{}, 0x0, 0x0, 0x0, 0x0, "e31db80000d3382f"}, 0xb}}]}, 0x34}}, 0x50) (async) sendmsg$nl_route(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@can_delroute={0x34, 0x19, 0x1, 0x0, 0x0, {}, [@CGW_CS_XOR={0x8, 0x5, {0x5, 0x0, 0xfffffffffffffffd}}, @CGW_MOD_AND={0x15, 0x1, {{{}, 0x0, 0x0, 0x0, 0x0, "e31db80000d3382f"}, 0xb}}]}, 0x34}}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB="24000042e8776fe61f8df09ec5a8493d2299e326c305bd967d0a564f397036abf32cc83e5d8298baac8837860a6212d6077f1e98e6433b33065106a3ba088da50e31a1240cbcb6ce6f5e125685e7bada7aa8da0f88d2c378b9bf718aec12ee1d10f29c8f12792d4e9371b16cb7afa6", @ANYRES16=r3, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r5, @ANYBLOB="0800050009000000"], 0x24}, 0x1, 0x0, 0x0, 0x40800}, 0x24040080) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x8c, r3, 0x5, 0x70bd25, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x57, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @val={0x3, 0x1, 0xd}, @void, @val={0x6, 0x2, 0x4}, @void, @void, @val={0x2a, 0x1, {0x1, 0x1}}, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x1, 0x0, {0x2, 0xce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1}, 0x300, 0x60aa, 0x2}}, @void, @val={0x71, 0x7, {0x0, 0x1, 0x0, 0x0, 0x0, 0x6, 0x61}}, @void}}], @NL80211_ATTR_SMPS_MODE={0x5}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x8c}}, 0x0) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="4c00000011000f14001100020000180002000000200000", 0x17) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000240)={{r1, &(0x7f0000000080)='\x00', 0x200000, &(0x7f00000000c0)={@align=0x83f, {0x7, 0xfff, 0x6, 0x4}}, 0x3, &(0x7f0000000100), &(0x7f0000000140)=0x6}, {[0x5, 0x0, 0x800100, 0x4]}, 0x8, 0x87, &(0x7f0000000180)=""/135}) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f0000000400)={0x5, 0xf6, 0x3, 0xed7, 0x400}) syz_emit_ethernet(0x12b, &(0x7f00000002c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @dccp_packet={0xf, 0x6, "badf01", 0xf5, 0x21, 0xfd, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, {[@hopopts={0x4, 0x14, '\x00', [@calipso={0x7, 0x40, {0x3, 0xe, 0x0, 0x8000, [0x2, 0x4, 0x8000000000000000, 0x20, 0x8, 0x6, 0x9]}}, @calipso={0x7, 0x50, {0x0, 0x12, 0xbe, 0x8, [0x7, 0x8000000000000001, 0x9, 0xfff, 0x5, 0xfffffffffffffffe, 0xa, 0x0, 0x6]}}, @calipso={0x7, 0x10, {0x3, 0x2, 0x7, 0x6, [0x6]}}]}], {{0x4e21, 0x4e22, 0x4, 0x1, 0x5, 0x0, 0x0, 0x4, 0x0, "75f0fa", 0x4, "f141d9"}, "c4afa7c60ffba8dd5ac5c3598b85fc13f5ad25a825711dda125723545cbbb3473fff556719bba7ea00cebe623aee491fb16b80c136"}}}}}}, 0x0) (async) syz_emit_ethernet(0x12b, &(0x7f00000002c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @dccp_packet={0xf, 0x6, "badf01", 0xf5, 0x21, 0xfd, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, {[@hopopts={0x4, 0x14, '\x00', [@calipso={0x7, 0x40, {0x3, 0xe, 0x0, 0x8000, [0x2, 0x4, 0x8000000000000000, 0x20, 0x8, 0x6, 0x9]}}, @calipso={0x7, 0x50, {0x0, 0x12, 0xbe, 0x8, [0x7, 0x8000000000000001, 0x9, 0xfff, 0x5, 0xfffffffffffffffe, 0xa, 0x0, 0x6]}}, @calipso={0x7, 0x10, {0x3, 0x2, 0x7, 0x6, [0x6]}}]}], {{0x4e21, 0x4e22, 0x4, 0x1, 0x5, 0x0, 0x0, 0x4, 0x0, "75f0fa", 0x4, "f141d9"}, "c4afa7c60ffba8dd5ac5c3598b85fc13f5ad25a825711dda125723545cbbb3473fff556719bba7ea00cebe623aee491fb16b80c136"}}}}}}, 0x0) getsockopt$inet_sctp_SCTP_EXPOSE_POTENTIALLY_FAILED_STATE(r7, 0x84, 0x83, &(0x7f00000006c0)={0x0, 0x1}, &(0x7f0000000700)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000740)={0xd, 0x8000, 0x3, 0x7, r8}, 0x10) 3.84970245s ago: executing program 3 (id=3260): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x6) write(r0, &(0x7f0000000000)="3b000200", 0x4) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000100)=0x1, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xffffffff, 0x0, 0x4}, 0x1c) pipe(&(0x7f00000006c0)={0xffffffffffffffff}) shutdown(r3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'xfrm0\x00', 0x0}) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f0000000440)=0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) read$nci(r6, 0x0, 0x0) r9 = syz_genetlink_get_family_id$nfc(&(0x7f00000005c0), r8) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r9, 0x8, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000480), r8) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x1c, r10, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x1c}}, 0x0) sendto$packet(r4, &(0x7f00000001c0)="d6c70fbf61abf9190ffe1470ed9b52ffd02feccaed722697bc26de6edd567f334e569d9fe2d6dc48da91366dfc0be4efa1ec9e77569382f688010ec099fbaf2f0eac14596e205a", 0x47, 0x20008801, &(0x7f0000000240)={0x11, 0x88a8, r5, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1e}}, 0x14) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000280)}, 0x10) syz_emit_ethernet(0x83, &(0x7f0000000700)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d"], 0x0) socket(0x2b, 0x80801, 0x1) r11 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r11, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)={0x14, 0x14, 0x601, 0x0, 0x0, {0x2b, 0xfa}}, 0x14}}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x4, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x2400c0c4) 3.591811555s ago: executing program 2 (id=3263): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x801, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) syz_init_net_socket$llc(0x1a, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d657461000000001400028008000140000000120800024000", @ANYRES16=r0], 0xc4}}, 0x0) 3.498198489s ago: executing program 0 (id=3264): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000010700000000000000000c0000000c0002200000000000000000"], 0x20}}, 0x0) 3.450924282s ago: executing program 1 (id=3265): bpf$BPF_PROG_WITH_BTFID_LOAD(0x85, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="450a00000000000061118400000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) 3.42767788s ago: executing program 2 (id=3266): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000840)={'rose0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r1], 0x20}}, 0x0) 3.307668514s ago: executing program 0 (id=3267): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f0000000040)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x58, 0x2, 0x6, 0x1, 0x6000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0x8}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x80ffffff}}, @IPSET_ATTR_CIDR={0x5}]}]}, 0x58}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x42072, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x2000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x25, 0x4, @void}, 0x10) syz_emit_ethernet(0x7c, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv6={0x86dd, @gre_packet={0xc, 0x6, "9d2218", 0x46, 0x2f, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558, 0x0, 0x2}, {0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, [], "e2f3"}, {0x0, 0x0, 0x1}, {0x8, 0x88be, 0x1, {{0x1, 0x1, 0x6, 0x3, 0x0, 0x2, 0x4, 0x5}, 0x1, {0x3}}}, {0x8, 0x22eb, 0x3, {{0x5, 0x2, 0x3, 0x3, 0x1, 0x3, 0x0, 0x7}, 0x2, {0x0, 0x0, 0x3, 0xa, 0x1, 0x1, 0x3}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000010000100000000000000000000000a0020000000000a01000000000000000000050000000900010073797a300000000064000000120a01000000000000000000050000000900010073797a30000000000900020073797a3100000000080003000000000630000480080001000000123414000280080001007f000001080002007f000002100009"], 0xb0}, 0x1, 0x0, 0x0, 0x20004081}, 0x40800) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, 0x0, &(0x7f00000000c0)) getsockname(r0, &(0x7f0000000100)=@l2={0x1f, 0x0, @none}, &(0x7f0000000180)=0x80) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 3.304375804s ago: executing program 1 (id=3268): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xa0}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x54}}, 0x0) connect$inet6(r1, &(0x7f0000000240)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000002c0)=0xff1a) r3 = socket(0x2, 0x4, 0x0) syz_emit_ethernet(0x7a, &(0x7f00000001c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000400", 0x44, 0x6, 0xfe, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x11, 0xc2, 0x2000, 0x0, 0x7, {[@mptcp=@capable={0x1e, 0xc, 0xf, 0x1, 0x5, 0x1}, @md5sig={0x13, 0x12, "e9803cac6913fbfccc18ce5a512eaf73"}, @md5sig={0x13, 0x12, "f2a3c47d2be4dabe21013d40454c15b5"}]}}}}}}}}, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 3.049479004s ago: executing program 0 (id=3269): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) (fail_nth: 4) 3.048048808s ago: executing program 2 (id=3270): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xb, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x1300}, [@printk={@li, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x41}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x2}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x29, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$kcm(0x23, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e00800000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40054) 2.991711139s ago: executing program 4 (id=3271): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'vlan1\x00', 0x0}) r2 = gettid() r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4400000010000304f9fff2ffbedbdf2500007400", @ANYRES32=r1, @ANYBLOB="089805000750050008001300", @ANYRES32=r2, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x44882}, 0x4000010) 2.867268803s ago: executing program 1 (id=3272): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x2, 0x1}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000480)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x200}, 0x10) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r3, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/44, 0x2c) 2.865498266s ago: executing program 4 (id=3273): syz_emit_ethernet(0x82, &(0x7f00000001c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x74, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x18, 0x4, 0xca, 0x0, 0x1000, {[@timestamp={0x8, 0xa, 0x81000001, 0x56}, @timestamp={0x8, 0x0, 0x10000, 0xffffffff}, @window={0x3, 0x0, 0x5}, @sack={0x5, 0x0, [0x1, 0x5]}]}}}}}}}, 0x0) (fail_nth: 4) 2.213849435s ago: executing program 3 (id=3274): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000180)) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="640000001000030427bd70000300000000000000", @ANYRES32=0x0, @ANYBLOB="46040900000000003c00128009000100766c616e000000002c00028006000100010000000600050088a80000100004800c0001000500000001000000860c05008100000008000500", @ANYRES32], 0x64}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINK={0x8, 0x5, r8}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) 2.104945481s ago: executing program 4 (id=3275): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0xe0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) recvmsg$unix(r0, &(0x7f00000001c0)={&(0x7f0000000200), 0x6e, &(0x7f0000000280)=[{&(0x7f00000002c0)=""/179, 0x22fe0}], 0x3}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000480)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000004c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0xfff5, 0xfff3}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x7e, 0x7, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x9b, 0x59}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) sendmsg$inet(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000400)='>', 0x33fe0}], 0x1}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@ipmr_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x80, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, 0x5}, [@RTA_SRC={0x8, 0x2, @empty}]}, 0x24}}, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2000002, 0x42073, 0xffffffffffffffff, 0xaba00000) 1.986304683s ago: executing program 1 (id=3276): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000000)="2000000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 1.972086778s ago: executing program 0 (id=3277): ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f00000002c0)={{0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x2c0000, &(0x7f0000000080)={@_ha_fsid={[0x1, 0x967d]}, {0x2, 0x5, 0x7fff, 0x80000001}}, 0x1, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x35694be9}, {[0x9, 0x8, 0xe9, 0x2d8ab75d]}, 0xc710, 0xa0, &(0x7f0000000180)=""/160}) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="380000000e140b070f22e28ce289f53f080001000000000008003c0001000000080001000100000008003c00000000000800010000000000"], 0x38}, 0x1, 0x0, 0x0, 0x4048010}, 0x20008000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000d00)={0x108, r2, 0x400, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_KEYS={0x8c, 0x51, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x1}, @NL80211_KEY_TYPE={0x8}, @NL80211_KEY_SEQ={0x9, 0x4, "20576f5fe1"}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT={0x4}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}, @NL80211_KEY_IDX={0x5, 0x2, 0x1}]}, {0x18, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "3a896b0b26"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac01}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT={0x4}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_KEY_CIPHER={0x8, 0x3, 0x7d600}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_MODE={0x5, 0x9, 0x2}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_BSS_SELECT={0x44, 0xe3, 0x0, 0x1, {0x40, 0x0, [@NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x8}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x80}, @NL80211_BSS_SELECT_ATTR_RSSI={0x4}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0xc, 0x9}}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x0, 0x3}}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x4, 0xfa}}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0xd}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x0, 0x3}}]}}]}, 0x108}, 0x1, 0x0, 0x0, 0x20008014}, 0x40c0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r3, @ANYBLOB="040000e8ff000000"], 0x24}}, 0xc080) sendmsg$NL80211_CMD_ASSOCIATE(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)={0x40, r2, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_USE_MFP={0x8}, @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x100, {0x3, 0xdb7f, 0xffff, 0x5}}}]}, 0x40}}, 0xc00) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r0, &(0x7f0000000780)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x58, r2, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x9, 0x11}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xb4}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xf0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xb4}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x4000051) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000b40)={r0, 0x58, &(0x7f0000000ac0)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000b80)={r5, 0xe, 0x8}, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7ff}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}}, 0x8040) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) recvfrom(r1, &(0x7f00000009c0)=""/164, 0xa4, 0x100, &(0x7f0000000bc0)=@rxrpc=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e24, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x800}}, 0x80) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0000001000030500000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0000000090280500140012800b0001006c6f7770616e00000400028008000500", @ANYRES32=r9], 0x44}}, 0x0) 1.963511518s ago: executing program 2 (id=3278): r0 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000000)=0xfffffffe, 0x43) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000000280)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x27}]}, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x90) close(r0) syz_emit_ethernet(0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="e03f995eaaaa429e82211cf886dd6a7abd6a00006701030000000000000100000000000000000000000000000000000801d8e7ebc348667b44b5782651ecdebbb7d3667bb939cd6d94ac2dc084ca7e7aa6252ece5da84ae5fc2e7f5ea955d508d40b079d74af470f9e0b518ae43300cab3100afb2fcb03c60e8e585960a90ee638aa2922ce91bace71dca6f7008f9d9667f34cc602331c91bc2c2c12b035c6b7cf63361e536936bbda9b2b1d0543ed2012e453bb39c1eee744e2c81557dc8082a5226e5887b61486e60c94629f7ddd46fd2b35461b8ad6a91c"], 0x0) 1.709885837s ago: executing program 2 (id=3279): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="450a00000000000061118400000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) (fail_nth: 4) 1.707839172s ago: executing program 0 (id=3280): r0 = socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x15, &(0x7f0000004640)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x2c, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_ORPHAN_MASK={0x8, 0xa, 0x7ff}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0x2}, @TCA_FQ_RATE_ENABLE={0x8, 0x5, 0xfffffffc}]}}]}, 0x58}}, 0x0) 1.357532443s ago: executing program 1 (id=3281): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@delchain={0x17, 0x65, 0x100, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x1, 0x64181b046e585f2f}, {0x48cd5521565b8d04, 0xfff1}, {0xffff, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c0c0}, 0x20000000) getsockname$packet(r0, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010003"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = getpid() r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), r4) sendmsg$NL80211_CMD_SET_QOS_MAP(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000fedbdf256800000008000300", @ANYRES32=r5], 0x30}, 0x1, 0x0, 0x0, 0x40081}, 0x40040) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000380)=r3) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000006c0)) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r8 = socket$igmp(0x2, 0x3, 0x2) r9 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), r9) getsockname$packet(r9, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000680)=0xfffffffffffffd23) sendmsg$IPCTNL_MSG_CT_GET_STATS(r0, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x14, 0x5, 0x1, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x48000}, 0x4000) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x1c, r13, 0x1, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r14}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x240004d0) sendmsg$inet(r8, &(0x7f0000000440)={&(0x7f0000000480)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @dev={0xac, 0x14, 0x14, 0x3c}, @dev={0xac, 0x14, 0x14, 0x12}}}}], 0x20}, 0x0) 1.176953387s ago: executing program 2 (id=3282): r0 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r0, 0x2000000, 0x6, 0x0, &(0x7f0000000280)="63eced8e46dc", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, 0x50) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x43c37000) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000300)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="80000200e180000008001b"], 0x28}}, 0x0) sendto$inet6(r1, &(0x7f00000001c0)="fe4d615809c1e293029ffe31e51897c00ac7e3b42b9b1180cbc7f63e5585582b0ba39408b3638e57e23ea9", 0x2b, 0x50, &(0x7f00000007c0)={0xa, 0x4e20, 0x7, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8}, 0x1c) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f00000005c0)=ANY=[@ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x30, r4, 0x1, 0xffffffff, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xe}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x3b24d1d00c4f8c2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000700000024000180060005004e230000060001000200051b08000300ac1414aa"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x0) 1.006110285s ago: executing program 3 (id=3283): socket$tipc(0x1e, 0x5, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xb, 0x8, 0xc, 0x3, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0), 0x5, r1}, 0x38) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000500)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000540)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x23}, 0x38) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000001600), 0xffffffffffffffff) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x20, 0x1402, 0x1, 0x70bd2a, 0x25dfdc02, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_NET_NS_FD={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000801}, 0x40840) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x0, 0x3e8}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000081}, 0x84) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newtclass={0x44, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x4, 0x1}, {0x0, 0x1}}, [@tclass_kind_options=@c_hfsc={{0x9}, {0x14, 0x2, [@TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x0, 0x3e8}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r8, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24048881}, 0x4000080) sendmsg$TIPC_CMD_SHOW_PORTS(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001640)={0x1c, r3, 0x1}, 0x1c}}, 0x0) 714.279561ms ago: executing program 4 (id=3284): r0 = socket(0x40000000015, 0x5, 0x0) (async) r1 = socket$packet(0x11, 0x3, 0x300) (async) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000001c0)={0x0, 0xb007}, 0x4) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000200)=0xa, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000280)="10031200e0ff020002004788aa96a13bb100001100007fca1a00", 0x1000a, 0x0, &(0x7f00000002c0)={0x11, 0x0, r3}, 0x14) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@mpls_delroute={0x24, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_DST={0x8, 0x1, {0x300}}]}, 0x24}}, 0x0) (async) accept$nfc_llcp(r0, &(0x7f0000000100), &(0x7f0000000180)=0x60) (async) r5 = socket(0x15, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x2716, &(0x7f0000000580)=""/102393, &(0x7f0000000000)=0x18ff9) 637.172789ms ago: executing program 0 (id=3285): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvmsg(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1}, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000140)='X', 0x1}], 0x1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000600)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 541.509099ms ago: executing program 4 (id=3286): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x40, 0x2, 0x1}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000480)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x200}, 0x10) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r3, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff00"/44, 0x2c) 119.756346ms ago: executing program 4 (id=3287): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r2, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x1, &(0x7f0000000480), 0x14}}], 0x400, 0x10) (fail_nth: 4) sendmmsg$inet6(r0, &(0x7f0000004040)=[{{0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f00000001c0)="a78302c2f3", 0x5}], 0x1}}], 0x1, 0x90) 0s ago: executing program 3 (id=3288): socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xb, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x1300}, [@printk={@li, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x41}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x2}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x29, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) socket$kcm(0x23, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x48) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e00800000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40054) kernel console output (not intermixed with test programs): id length. [ 242.881460][T10367] 8021q: adding VLAN 0 to HW filter on device bond3 [ 242.885500][T10370] syzkaller1: entered promiscuous mode [ 242.885525][T10370] syzkaller1: entered allmulticast mode [ 242.990806][T10373] bond3: (slave veth7): Enslaving as a backup interface with a down link [ 243.627825][T10394] veth0: entered promiscuous mode [ 243.903768][T10393] veth0: left promiscuous mode [ 244.508756][T10420] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1753'. [ 245.208673][T10444] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1762'. [ 245.402462][T10452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1765'. [ 245.402491][T10452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1765'. [ 246.936206][T10490] TC_ACT_REPEAT abuse ? [ 247.555695][T10512] netlink: 'syz.2.1788': attribute type 39 has an invalid length. [ 247.899195][T10520] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1790'. [ 248.493630][T10532] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1795'. [ 248.837152][T10544] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1799'. [ 249.294282][T10558] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 249.313152][T10559] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1806'. [ 249.313187][T10559] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1806'. [ 249.465716][T10558] xt_hashlimit: size too large, truncated to 1048576 [ 249.705008][T10571] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1810'. [ 249.766095][T10571] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1810'. [ 250.155194][T10582] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1815'. [ 250.245334][T10582] bond2: (slave bridge5): Enslaving as an active interface with an up link [ 250.498506][T10594] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1819'. [ 250.592640][T10595] netlink: 'syz.1.1818': attribute type 1 has an invalid length. [ 250.800913][T10595] block nbd296: server does not support multiple connections per device. [ 250.843255][T10595] block nbd296: shutting down sockets [ 251.195530][T10610] netlink: 'syz.0.1824': attribute type 1 has an invalid length. [ 251.209321][T10610] netlink: 'syz.0.1824': attribute type 1 has an invalid length. [ 251.228594][T10620] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1828'. [ 251.747491][T10632] netlink: 'syz.0.1832': attribute type 1 has an invalid length. [ 251.898067][T10632] 8021q: adding VLAN 0 to HW filter on device bond4 [ 251.925982][T10634] bond4: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 251.945557][T10634] bond4: entered allmulticast mode [ 251.982515][T10638] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 252.162635][T10642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 252.284859][T10650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 252.387759][T10642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 252.414500][T10653] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1838'. [ 252.497248][T10656] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1839'. [ 252.537690][T10658] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1838'. [ 253.032694][T10675] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1846'. [ 253.237398][T10682] ip_tables: iptables: counters copy to user failed while replacing table [ 253.468861][T10689] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1851'. [ 255.372825][T10741] netlink: 'syz.3.1869': attribute type 9 has an invalid length. [ 255.372850][T10741] __nla_validate_parse: 3 callbacks suppressed [ 255.372863][T10741] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1869'. [ 255.373146][T10741] netlink: 'syz.3.1869': attribute type 9 has an invalid length. [ 255.373162][T10741] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1869'. [ 255.714535][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.715413][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.209040][T10761] TC_ACT_REPEAT abuse ? [ 256.469849][T10770] ip_tables: iptables: counters copy to user failed while replacing table [ 257.097916][T10791] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1886'. [ 257.097978][T10791] netlink: 'syz.3.1886': attribute type 3 has an invalid length. [ 257.098015][T10791] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1886'. [ 257.098626][T10791] netlink: 'syz.3.1886': attribute type 3 has an invalid length. [ 258.453292][T10833] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1903'. [ 259.157313][T10860] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1912'. [ 259.326714][T10870] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1912'. [ 259.649814][T10880] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1918'. [ 259.649844][T10880] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1918'. [ 259.654686][T10880] netlink: 'syz.4.1918': attribute type 2 has an invalid length. [ 259.654821][T10880] netlink: 'syz.4.1918': attribute type 2 has an invalid length. [ 260.811576][T10913] syzkaller1: entered promiscuous mode [ 260.811601][T10913] syzkaller1: entered allmulticast mode [ 260.926616][T10921] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1924'. [ 262.027822][T10954] tipc: Failed to remove unknown binding: 66,0,0/0:1245412106/1245412107 [ 262.029017][T10954] tipc: Failed to remove unknown binding: 66,0,0/0:1245412106/1245412107 [ 262.284116][T10960] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 262.406088][T10963] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.407874][T10966] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1941'. [ 262.501303][T10967] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.585991][T10973] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.764201][T10977] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 262.828684][T10981] TC_ACT_REPEAT abuse ? [ 263.030393][T10984] syzkaller1: entered promiscuous mode [ 263.033822][T10984] syzkaller1: entered allmulticast mode [ 263.277389][T10990] netlink: 'syz.1.1948': attribute type 4 has an invalid length. [ 263.326558][T10992] netlink: 'syz.2.1951': attribute type 4 has an invalid length. [ 263.578476][T10998] netlink: 'syz.1.1955': attribute type 2 has an invalid length. [ 263.926744][T11011] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 264.355123][T11024] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1964'. [ 264.395559][T11024] 8021q: adding VLAN 0 to HW filter on device bond3 [ 264.449207][T11024] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 265.185564][T11058] netlink: 'syz.4.1975': attribute type 1 has an invalid length. [ 265.223410][T11058] bond7: entered promiscuous mode [ 265.223927][T11058] 8021q: adding VLAN 0 to HW filter on device bond7 [ 265.322990][T11058] bond7: (slave bridge3): making interface the new active one [ 265.323017][T11058] bridge3: entered promiscuous mode [ 265.362129][T11058] bond7: (slave bridge3): Enslaving as an active interface with an up link [ 265.381347][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a402000: rx timeout, send abort [ 265.386105][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88802a402000: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 265.386858][ C0] vcan0: j1939_tp_rxtimer: 0xffff88802a401800: rx timeout, send abort [ 265.387243][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff88802a401800: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 265.475365][T11057] syzkaller0: entered promiscuous mode [ 265.475393][T11057] syzkaller0: entered allmulticast mode [ 266.256254][T11085] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1985'. [ 266.256324][T11085] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1985'. [ 266.952653][T11103] syzkaller0: entered promiscuous mode [ 266.952676][T11103] syzkaller0: entered allmulticast mode [ 267.330159][T11123] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1999'. [ 267.507141][T11130] netlink: 'syz.4.2001': attribute type 1 has an invalid length. [ 267.693605][T11130] 8021q: adding VLAN 0 to HW filter on device bond8 [ 267.745077][T11132] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 267.756211][T11135] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 267.756644][T11135] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 268.137011][T11151] netlink: 'syz.4.2006': attribute type 1 has an invalid length. [ 269.709217][T11190] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2021'. [ 269.971626][T11199] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2023'. [ 273.349125][T11248] netlink: 'syz.2.2033': attribute type 1 has an invalid length. [ 273.529310][T11254] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2034'. [ 273.561913][T11255] netlink: 'syz.0.2032': attribute type 10 has an invalid length. [ 273.676867][T11248] 8021q: adding VLAN 0 to HW filter on device bond7 [ 273.698392][T11248] bond6: (slave bond7): making interface the new active one [ 273.708050][T11248] bond6: (slave bond7): Enslaving as an active interface with an up link [ 273.775589][T11251] bond6: (slave gretap2): Enslaving as a backup interface with an up link [ 273.801588][T11253] 8021q: adding VLAN 0 to HW filter on device bond6 [ 273.846714][T11255] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 274.280629][T11273] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2038'. [ 274.383045][T11278] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2041'. [ 274.778647][T11288] syzkaller0: entered promiscuous mode [ 274.778712][T11288] syzkaller0: entered allmulticast mode [ 275.493299][T11312] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2049'. [ 275.495702][T11308] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2048'. [ 275.796284][T11319] syzkaller0: entered promiscuous mode [ 275.796310][T11319] syzkaller0: entered allmulticast mode [ 276.145635][T11338] syzkaller0: entered promiscuous mode [ 276.145662][T11338] syzkaller0: entered allmulticast mode [ 276.180003][T11330] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2056'. [ 276.609455][T11349] netlink: 'syz.1.2062': attribute type 1 has an invalid length. [ 276.848939][T11355] syzkaller0: entered promiscuous mode [ 276.848964][T11355] syzkaller0: entered allmulticast mode [ 276.878463][T11349] bridge8: entered promiscuous mode [ 276.902875][T11349] bond4: (slave bridge8): making interface the new active one [ 276.903963][T11349] bond4: (slave bridge8): Enslaving as an active interface with an up link [ 276.904067][T11350] tipc: Started in network mode [ 276.904096][T11350] tipc: Node identity a2023226b74a, cluster identity 4711 [ 276.904370][T11350] tipc: Enabled bearer , priority 0 [ 276.906753][T11346] tipc: Resetting bearer [ 276.961970][T11358] netlink: 'syz.0.2063': attribute type 19 has an invalid length. [ 276.961997][T11358] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2063'. [ 277.026076][T11346] tipc: Disabling bearer [ 277.061680][T11358] netlink: 'syz.0.2063': attribute type 19 has an invalid length. [ 277.061705][T11358] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2063'. [ 277.319361][T11363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2065'. [ 277.466197][T11368] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2067'. [ 277.468132][T11371] netlink: 'syz.2.2070': attribute type 1 has an invalid length. [ 277.517724][T11374] netlink: 'syz.4.2067': attribute type 4 has an invalid length. [ 277.645113][T11371] bond8: entered promiscuous mode [ 277.646100][T11371] 8021q: adding VLAN 0 to HW filter on device bond8 [ 277.716396][T11374] .`: renamed from bond0 [ 277.789130][T11375] macvtap1: entered allmulticast mode [ 277.870199][T11379] macvtap2: entered allmulticast mode [ 277.899672][T11371] bond8: (slave bridge4): making interface the new active one [ 277.899699][T11371] bridge4: entered promiscuous mode [ 277.919239][T11371] bond8: (slave bridge4): Enslaving as an active interface with an up link [ 278.014168][T11373] syzkaller0: entered promiscuous mode [ 278.014195][T11373] syzkaller0: entered allmulticast mode [ 278.204062][T11393] netlink: 'syz.4.2073': attribute type 1 has an invalid length. [ 281.021893][T11393] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 281.076287][T11403] syzkaller0: left promiscuous mode [ 281.076316][T11403] syzkaller0: left allmulticast mode [ 281.311438][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 281.364857][T11432] syzkaller0: entered promiscuous mode [ 281.364898][T11432] syzkaller0: entered allmulticast mode [ 281.545004][T11437] netlink: 'syz.2.2081': attribute type 1 has an invalid length. [ 281.548974][T11433] syzkaller0: entered promiscuous mode [ 281.549017][T11433] syzkaller0: entered allmulticast mode [ 282.134379][T11457] syzkaller0: entered promiscuous mode [ 282.134404][T11457] syzkaller0: entered allmulticast mode [ 282.167295][T11459] syzkaller0: entered promiscuous mode [ 282.167369][T11459] syzkaller0: entered allmulticast mode [ 282.502758][T11465] __nla_validate_parse: 3 callbacks suppressed [ 282.502814][T11465] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2090'. [ 282.632577][T11468] syzkaller0: entered promiscuous mode [ 282.632603][T11468] syzkaller0: entered allmulticast mode [ 282.746658][T11476] syzkaller0: entered promiscuous mode [ 282.746723][T11476] syzkaller0: entered allmulticast mode [ 283.100251][T11485] ip6gre1: entered promiscuous mode [ 283.100277][T11485] ip6gre1: entered allmulticast mode [ 283.465066][T11497] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 283.478267][T11497] netlink: 'syz.2.2104': attribute type 21 has an invalid length. [ 283.478334][T11497] IPv6: NLM_F_CREATE should be specified when creating new route [ 283.478731][T11497] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 283.478762][T11497] IPv6: NLM_F_CREATE should be set when creating new route [ 283.478889][T11497] IPv6: NLM_F_CREATE should be set when creating new route [ 283.478955][T11497] IPv6: NLM_F_CREATE should be set when creating new route [ 283.659310][T11501] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2105'. [ 283.755427][T11501] IPVS: sed: UDP 224.0.0.2:0 - no destination available [ 284.124130][T11512] syzkaller0: entered promiscuous mode [ 284.124194][T11512] syzkaller0: entered allmulticast mode [ 284.666564][T11523] syz_tun: entered allmulticast mode [ 285.202786][T11532] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 285.256537][T11532] sch_tbf: burst 8 is lower than device syzkaller0 mtu (65589) ! [ 285.259449][T11529] syzkaller0: entered promiscuous mode [ 285.259473][T11529] syzkaller0: entered allmulticast mode [ 285.267444][T11532] syzkaller0: entered promiscuous mode [ 285.267504][T11532] syzkaller0: entered allmulticast mode [ 288.226152][T11585] netlink: 'syz.4.2130': attribute type 6 has an invalid length. [ 288.226175][T11585] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2130'. [ 289.491369][T11595] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2135'. [ 289.521982][T11595] 8021q: adding VLAN 0 to HW filter on device bond9 [ 289.549794][T11595] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2135'. [ 289.664714][T11595] ipvlan2: entered allmulticast mode [ 289.664739][T11595] bond9: entered allmulticast mode [ 289.685617][T11598] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2136'. [ 289.787921][T11601] syzkaller0: entered promiscuous mode [ 289.787949][T11601] syzkaller0: entered allmulticast mode [ 290.422568][T11621] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2143'. [ 290.553386][T11627] tc action pedit 'at' offset -2147483648 out of bounds [ 291.043434][T11632] syzkaller0: entered promiscuous mode [ 291.043504][T11632] syzkaller0: entered allmulticast mode [ 291.574007][T11642] syzkaller0: entered promiscuous mode [ 291.574063][T11642] syzkaller0: entered allmulticast mode [ 291.619638][T11642] tipc: Enabled bearer , priority 0 [ 291.719742][T11640] tipc: Resetting bearer [ 291.821269][T11640] tipc: Disabling bearer [ 291.940602][T11645] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2151'. [ 292.142860][T11657] syzkaller0: left promiscuous mode [ 292.142886][T11657] syzkaller0: left allmulticast mode [ 292.505937][T11665] ip_tables: iptables: counters copy to user failed while replacing table [ 292.507509][T11665] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 293.509267][T11693] syzkaller0: entered promiscuous mode [ 293.509329][T11693] syzkaller0: entered allmulticast mode [ 293.577405][T11698] netlink: 'syz.3.2167': attribute type 1 has an invalid length. [ 293.656387][ T32] audit: type=1804 audit(1792075639.529:3): pid=11700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.2168" name="/newroot/408/cgroup.controllers" dev="tmpfs" ino=2105 res=1 errno=0 [ 293.656700][ T32] audit: type=1800 audit(1792075639.529:4): pid=11700 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2168" name="cgroup.controllers" dev="tmpfs" ino=2105 res=0 errno=0 [ 293.813544][T11698] bond4: entered promiscuous mode [ 293.814687][T11698] 8021q: adding VLAN 0 to HW filter on device bond4 [ 293.876252][T11701] bond4: (slave bridge4): making interface the new active one [ 293.876281][T11701] bridge4: entered promiscuous mode [ 293.877860][T11701] bond4: (slave bridge4): Enslaving as an active interface with an up link [ 293.924633][T11702] ipvlan2: entered allmulticast mode [ 293.924663][T11702] bond4: entered allmulticast mode [ 293.924679][T11702] bridge4: entered allmulticast mode [ 293.926871][T11702] bond4: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 293.926899][T11702] bond4: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 294.053549][T11705] netlink: 'syz.1.2169': attribute type 1 has an invalid length. [ 294.227944][T11711] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2169'. [ 294.314727][T11709] bond6: (slave geneve2): Opening slave failed [ 294.394702][T11711] 8021q: adding VLAN 0 to HW filter on device bond6 [ 294.718448][T11718] vlan2: entered promiscuous mode [ 294.718473][T11718] hsr0: entered promiscuous mode [ 294.718865][T11718] vlan2: entered allmulticast mode [ 294.718883][T11718] hsr0: entered allmulticast mode [ 294.718896][T11718] hsr_slave_0: entered allmulticast mode [ 294.718913][T11718] hsr_slave_1: entered allmulticast mode [ 298.079836][T11741] syzkaller0: entered promiscuous mode [ 298.079863][T11741] syzkaller0: entered allmulticast mode [ 298.101982][T11747] syzkaller0: entered promiscuous mode [ 298.102040][T11747] syzkaller0: entered allmulticast mode [ 298.419547][T11776] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2185'. [ 298.465597][T11776] hsr_slave_0: left promiscuous mode [ 298.472553][T11776] hsr_slave_1: left promiscuous mode [ 298.776072][T11785] syzkaller0: entered promiscuous mode [ 298.776125][T11785] syzkaller0: entered allmulticast mode [ 299.009139][T11794] syzkaller0: entered promiscuous mode [ 299.009166][T11794] syzkaller0: entered allmulticast mode [ 299.064895][T11789] tipc: Enabled bearer , priority 0 [ 299.119125][T11789] tipc: Resetting bearer [ 299.375224][T11793] syzkaller0: entered promiscuous mode [ 299.375253][T11793] syzkaller0: entered allmulticast mode [ 299.410296][T11788] tipc: Resetting bearer [ 299.495713][T11788] tipc: Disabling bearer [ 304.072060][T11847] syzkaller0: entered promiscuous mode [ 304.072123][T11847] syzkaller0: entered allmulticast mode [ 304.568602][T11882] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2203'. [ 308.595491][T11956] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 308.894177][T11967] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2222'. [ 309.631547][T11997] netlink: 'syz.2.2235': attribute type 2 has an invalid length. [ 310.051419][T12014] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2242'. [ 310.360499][T12022] syzkaller0: entered promiscuous mode [ 310.360552][T12022] syzkaller0: entered allmulticast mode [ 310.732181][T12039] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 311.167334][T12057] ip_tables: iptables: counters copy to user failed while replacing table [ 311.475553][T12066] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2265'. [ 311.722528][T12074] syzkaller0: entered promiscuous mode [ 311.722591][T12074] syzkaller0: entered allmulticast mode [ 312.727635][T12114] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 313.067170][T12120] syzkaller1: entered promiscuous mode [ 313.067196][T12120] syzkaller1: entered allmulticast mode [ 313.164020][T12128] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 313.539608][T12148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2300'. [ 313.721700][T12153] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2303'. [ 313.783091][T12158] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2303'. [ 313.820965][T12153] 8021q: adding VLAN 0 to HW filter on device bond7 [ 313.822833][T12147] syzkaller0: entered promiscuous mode [ 313.822856][T12147] syzkaller0: entered allmulticast mode [ 313.858652][T12139] rxe_eth0 speed is unknown, defaulting to 1000 [ 315.628210][T12204] ip_tables: iptables: counters copy to user failed while replacing table [ 315.899311][T12210] syz_tun: entered allmulticast mode [ 316.266382][T12216] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2328'. [ 316.538282][T12223] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2332'. [ 316.741657][T12229] gretap0: entered promiscuous mode [ 316.959293][T12236] syz_tun: entered allmulticast mode [ 317.155167][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.155294][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.226708][T12244] syzkaller1: entered promiscuous mode [ 317.226758][T12244] syzkaller1: entered allmulticast mode [ 317.392315][T12247] syzkaller1: entered promiscuous mode [ 317.392381][T12247] syzkaller1: entered allmulticast mode [ 317.415812][T12247] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 317.577979][T12256] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 317.714606][T12258] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 318.134933][T12271] netlink: 'syz.3.2353': attribute type 1 has an invalid length. [ 318.217611][T12277] netlink: 'syz.4.2354': attribute type 1 has an invalid length. [ 318.253786][T12271] 8021q: adding VLAN 0 to HW filter on device bond5 [ 318.302878][T12276] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 318.757429][T12285] bond9: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 318.776289][T12285] bond9 (unregistering): Released all slaves [ 318.892197][T12289] bridge4: entered promiscuous mode [ 318.917061][T12289] bond0: (slave bridge4): making interface the new active one [ 318.919888][T12289] bond0: (slave bridge4): Enslaving as an active interface with an up link [ 319.126258][T12281] syzkaller0: entered promiscuous mode [ 319.126286][T12281] syzkaller0: entered allmulticast mode [ 319.221722][T12310] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 322.266776][T12322] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 322.552838][T12331] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 322.575510][T12329] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2367'. [ 322.802318][T12336] netlink: 'syz.2.2370': attribute type 1 has an invalid length. [ 322.886629][T12344] TCP: TCP_TX_DELAY enabled [ 322.965283][T12343] bond11: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 322.982574][T12343] bond11 (unregistering): Released all slaves [ 323.072063][T12336] bridge5: entered promiscuous mode [ 323.077349][T12336] bond10: (slave bridge5): making interface the new active one [ 323.078907][T12336] bond10: (slave bridge5): Enslaving as an active interface with an up link [ 323.335139][T12360] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2378'. [ 323.352664][T12360] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2378'. [ 323.584280][T12368] bridge0: port 3(syz_tun) entered blocking state [ 323.584406][T12368] bridge0: port 3(syz_tun) entered disabled state [ 323.610016][T12368] syz_tun: entered promiscuous mode [ 323.616672][T12368] bridge0: port 3(syz_tun) entered blocking state [ 323.617078][T12368] bridge0: port 3(syz_tun) entered forwarding state [ 324.028406][T12379] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2382'. [ 324.600967][T12395] netlink: 'syz.4.2387': attribute type 1 has an invalid length. [ 324.856050][T12407] ip_tables: iptables: counters copy to user failed while replacing table [ 324.863244][T12397] bond10: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 324.884842][T12397] bond10 (unregistering): Released all slaves [ 325.198071][T12395] bridge5: entered promiscuous mode [ 325.248865][T12395] bond9: (slave bridge5): making interface the new active one [ 325.252049][T12395] bond9: (slave bridge5): Enslaving as an active interface with an up link [ 325.788722][T12426] batman_adv: batadv0: Adding interface: syzkaller0 [ 325.788766][T12426] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 325.788800][T12426] batman_adv: batadv0: Interface activated: syzkaller0 [ 325.842921][T12424] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 325.942670][T12424] batman_adv: batadv0: Removing interface: syzkaller0 [ 326.100117][T12432] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2396'. [ 326.765587][T12453] syzkaller1: entered promiscuous mode [ 326.765653][T12453] syzkaller1: entered allmulticast mode [ 326.816484][T12456] syz_tun: entered allmulticast mode [ 327.163058][T12468] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2410'. [ 327.991571][ C0] bridge0: port 3(syz_tun) neighbor 0000.00:00:00:00:00:00 lost [ 327.994193][ C0] bridge0: topology change detected, propagating [ 328.777131][T12499] nbd4: detected capacity change from 0 to 63 [ 328.801340][T12499] block nbd4: NBD_DISCONNECT [ 328.838658][T12499] block nbd4: Disconnected due to user request. [ 328.838722][T12499] block nbd4: shutting down sockets [ 328.855148][ T1704] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.857113][ T1704] Buffer I/O error on dev nbd4, logical block 0, async page read [ 328.857429][ T1704] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.857460][ T1704] Buffer I/O error on dev nbd4, logical block 1, async page read [ 328.857600][ T1704] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.857626][ T1704] Buffer I/O error on dev nbd4, logical block 2, async page read [ 328.857769][ T1704] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.857796][ T1704] Buffer I/O error on dev nbd4, logical block 3, async page read [ 328.858240][ T1704] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.858271][ T1704] Buffer I/O error on dev nbd4, logical block 0, async page read [ 328.859639][ T1704] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.859671][ T1704] Buffer I/O error on dev nbd4, logical block 1, async page read [ 328.859820][ T1704] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.859847][ T1704] Buffer I/O error on dev nbd4, logical block 2, async page read [ 328.859951][ T1704] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.859976][ T1704] Buffer I/O error on dev nbd4, logical block 3, async page read [ 328.860101][ T1704] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.860127][ T1704] Buffer I/O error on dev nbd4, logical block 0, async page read [ 328.860228][ T1704] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 328.860254][ T1704] Buffer I/O error on dev nbd4, logical block 1, async page read [ 329.076686][T12501] ldm_validate_partition_table(): Disk read failed. [ 329.097093][T12501] Dev nbd4: unable to read RDB block 0 [ 329.112808][T12501] nbd4: unable to read partition table [ 329.228492][T12508] syzkaller1: entered promiscuous mode [ 329.228518][T12508] syzkaller1: entered allmulticast mode [ 329.250171][T12501] ldm_validate_partition_table(): Disk read failed. [ 329.272354][T12501] Dev nbd4: unable to read RDB block 0 [ 329.274525][T12501] nbd4: unable to read partition table [ 329.407027][T12512] block nbd4: not configured, cannot reconfigure [ 329.446355][T12513] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2424'. [ 329.686545][T12509] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2423'. [ 329.771003][T12526] netlink: 'syz.4.2429': attribute type 1 has an invalid length. [ 329.774313][T12524] netlink: 'syz.3.2430': attribute type 1 has an invalid length. [ 330.039593][T12524] bond6: entered promiscuous mode [ 330.044059][T12524] 8021q: adding VLAN 0 to HW filter on device bond6 [ 330.123238][T12529] bond11: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 330.126757][T12529] bond11 (unregistering): Released all slaves [ 330.247479][T12531] ipvlan2: entered allmulticast mode [ 330.247505][T12531] bond6: entered allmulticast mode [ 330.248967][T12531] bond6: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 330.248992][T12531] bond6: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 330.249008][T12531] bond6: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 330.320233][T12531] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 330.502430][T12526] bridge6: entered promiscuous mode [ 330.522469][T12526] bond10: (slave bridge6): making interface the new active one [ 330.523833][T12526] bond10: (slave bridge6): Enslaving as an active interface with an up link [ 332.133775][T12571] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2442'. [ 332.290155][T12576] netlink: 'syz.2.2443': attribute type 39 has an invalid length. [ 332.655763][T12582] ip_tables: iptables: counters copy to user failed while replacing table [ 332.717832][T12585] netlink: 'syz.0.2449': attribute type 1 has an invalid length. [ 332.920167][T12598] sctp: [Deprecated]: syz.1.2450 (pid 12598) Use of struct sctp_assoc_value in delayed_ack socket option. [ 332.920167][T12598] Use struct sctp_sack_info instead [ 332.926092][T12598] netlink: 'syz.1.2450': attribute type 10 has an invalid length. [ 333.033845][T12591] bond6: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 333.037888][T12591] bond6 (unregistering): Released all slaves [ 333.079131][T12604] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2450'. [ 333.176143][T12585] bridge3: entered promiscuous mode [ 333.194430][T12585] bond5: (slave bridge3): making interface the new active one [ 333.195696][T12585] bond5: (slave bridge3): Enslaving as an active interface with an up link [ 334.065077][T12622] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2457'. [ 334.627667][T12637] netlink: 'syz.3.2462': attribute type 1 has an invalid length. [ 335.110002][T12626] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 335.375077][T12658] C: entered allmulticast mode [ 335.611887][T12663] batman_adv: batadv0: Adding interface: syzkaller0 [ 335.611908][T12663] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 335.614545][T12663] batman_adv: batadv0: Interface activated: syzkaller0 [ 336.293818][T12661] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 336.333616][T12661] batman_adv: batadv0: Removing interface: syzkaller0 [ 336.683626][T12689] sch_tbf: burst 7 is lower than device syzkaller0 mtu (65589) ! [ 337.253391][T12708] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2483'. [ 338.454455][T12739] 0: reclassify loop, rule prio 0, protocol 03 [ 338.602312][T12716] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2486'. [ 338.602374][T12716] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2486'. [ 338.602407][T12716] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Add Mapping response ret = -22) [ 338.820021][T12744] syzkaller0: Caught tx_queue_len zero misconfig [ 339.604994][T12771] netlink: 'syz.4.2505': attribute type 1 has an invalid length. [ 339.673787][T12774] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2505'. [ 339.879867][T12771] 8021q: adding VLAN 0 to HW filter on device bond11 [ 340.015344][T12776] bond11: (slave bridge7): making interface the new active one [ 340.030275][T12776] bond11: (slave bridge7): Enslaving as an active interface with an up link [ 340.100629][T12785] tipc: Started in network mode [ 340.100665][T12785] tipc: Node identity 1e416908c242, cluster identity 4711 [ 340.100929][T12785] tipc: Enabled bearer , priority 0 [ 340.186909][T12781] sch_tbf: burst 0 is lower than device syzkaller0 mtu (65589) ! [ 340.189606][T12783] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2506'. [ 340.214593][T12781] syzkaller0: mtu less than device minimum [ 340.448799][T12794] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2509'. [ 341.147335][T12816] syzkaller0: entered promiscuous mode [ 341.147361][T12816] syzkaller0: entered allmulticast mode [ 341.315948][ T5815] tipc: Node number set to 3691211016 [ 341.652141][T12824] syzkaller0: entered promiscuous mode [ 341.652168][T12824] syzkaller0: entered allmulticast mode [ 341.711091][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711116][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711130][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711142][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711155][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711167][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711179][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711191][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711203][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711216][T12826] tc action pedit 'at' offset 5 out of bounds [ 341.711244][T12826] 0: reclassify loop, rule prio 0, protocol 800 [ 342.326654][T12840] syzkaller0: entered promiscuous mode [ 342.326678][T12840] syzkaller0: entered allmulticast mode [ 342.393418][T12844] syzkaller0: entered promiscuous mode [ 342.393445][T12844] syzkaller0: entered allmulticast mode [ 342.416037][T12840] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2525'. [ 342.416067][T12840] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2525'. [ 343.158742][T12861] ip6gre2: entered promiscuous mode [ 343.158804][T12861] ip6gre2: entered allmulticast mode [ 343.982798][T12880] syzkaller0: entered promiscuous mode [ 343.982826][T12880] syzkaller0: entered allmulticast mode [ 344.126317][T12893] syzkaller0: entered promiscuous mode [ 344.126346][T12893] syzkaller0: entered allmulticast mode [ 344.399894][T12896] syzkaller0: entered promiscuous mode [ 344.399921][T12896] syzkaller0: entered allmulticast mode [ 344.453052][T12902] netlink: 'syz.0.2546': attribute type 10 has an invalid length. [ 344.719431][T12913] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2549'. [ 344.794760][T12910] netlink: 'syz.4.2548': attribute type 1 has an invalid length. [ 344.794823][T12910] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2548'. [ 344.918405][T12913] 8021q: adding VLAN 0 to HW filter on device bond8 [ 345.027019][T12916] macvlan2: entered promiscuous mode [ 345.027048][T12916] macvlan2: entered allmulticast mode [ 345.033385][T12916] bond8: entered promiscuous mode [ 345.044819][T12916] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 345.064970][T12916] bond8: left promiscuous mode [ 346.205405][T12954] syzkaller0: entered promiscuous mode [ 346.205434][T12954] syzkaller0: entered allmulticast mode [ 346.298159][T12967] batman_adv: batadv0: Adding interface: veth0 [ 346.298178][T12967] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.298212][T12967] batman_adv: batadv0: Interface activated: veth0 [ 350.661072][T12984] erspan0: left promiscuous mode [ 350.873360][T12984] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 351.485420][T13020] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2577'. [ 351.487828][T13020] hsr_slave_0: left promiscuous mode [ 351.488950][T13020] hsr_slave_1: left promiscuous mode [ 351.656514][T13026] syzkaller0: entered promiscuous mode [ 351.656539][T13026] syzkaller0: entered allmulticast mode [ 351.656917][T13018] netlink: 'syz.1.2576': attribute type 20 has an invalid length. [ 351.656975][T13018] IPv6: NLM_F_CREATE should be specified when creating new route [ 352.225798][ C1] vcan0: j1939_tp_rxtimer: 0xffff888055546400: rx timeout, send abort [ 352.226045][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888055546400: 0x10000: (3) A timeout occurred and this is the connection abort to close the session. [ 352.226970][T13048] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1ùà^!00000000000000000000003ÿÿÿ [ 352.252251][ C1] vcan0: j1939_tp_rxtimer: 0xffff8880287a0400: rx timeout, send abort [ 352.253008][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff8880287a0400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 352.384882][T13050] ip_tables: iptables: counters copy to user failed while replacing table [ 352.603165][T13050] syzkaller0: entered promiscuous mode [ 352.603193][T13050] syzkaller0: entered allmulticast mode [ 354.246085][T13107] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2610'. [ 354.246114][T13107] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2610'. [ 354.431600][T13113] ip_tables: iptables: counters copy to user failed while replacing table [ 354.741149][T13100] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 354.800547][ T45] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.800588][ T45] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.803064][ T45] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.803102][ T45] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.803142][ T45] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.803170][ T45] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.803210][ T45] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 354.803237][ T45] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 354.850091][T13119] syzkaller0: left promiscuous mode [ 354.850150][T13119] syzkaller0: left allmulticast mode [ 355.144209][T13127] netlink: 'syz.3.2619': attribute type 4 has an invalid length. [ 355.194367][T13130] netlink: 'syz.3.2619': attribute type 4 has an invalid length. [ 356.446395][T13171] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2638'. [ 357.336661][T13199] tc action pedit offset must be on 32 bit boundaries [ 357.546438][T13206] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2652'. [ 357.617262][T13208] bond3: (slave veth0_to_bond): Releasing backup interface [ 357.635838][T13208] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 357.674429][T13208] team0: Device xfrm0 failed to enter team mode [ 357.674456][T13208] team0: Device xfrm0 failed to enter team mode [ 357.678064][T13208] tipc: Enabled bearer , priority 0 [ 357.946196][T13219] bond0: entered promiscuous mode [ 357.962926][T13219] batadv0: entered promiscuous mode [ 357.965948][T13219] debugfs: 'hsr1' already exists in 'hsr' [ 357.965993][T13219] Cannot create hsr debugfs directory [ 357.966211][T13219] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 357.966234][T13219] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 358.004439][T13219] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 358.253333][T13235] block nbd0: Unsupported socket: should be TCP or UNIX. [ 358.547378][T13245] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2666'. [ 358.635011][T13247] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2666'. [ 359.042037][T13267] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2676'. [ 360.504175][T13311] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 360.526396][T13312] syzkaller1: entered promiscuous mode [ 360.527916][T13312] syzkaller1: entered allmulticast mode [ 360.929698][T13319] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2698'. [ 361.304246][T13333] bond12: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 361.331353][T13333] bond12 (unregistering): Released all slaves [ 361.492222][T13335] bridge8: entered promiscuous mode [ 362.315041][T13364] pimreg: entered allmulticast mode [ 362.336599][T13360] pimreg: left allmulticast mode [ 362.419826][T13367] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2713'. [ 365.165878][T13444] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 365.548150][T13460] netlink: 'syz.0.2750': attribute type 1 has an invalid length. [ 365.606928][T13464] l2tp_ppp: sess 2/0: no socket in recv [ 365.689633][T13468] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2753'. [ 365.759107][T13465] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 365.775496][T13465] bond7 (unregistering): Released all slaves [ 365.932783][T13466] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 365.946910][T13466] bond7 (unregistering): Released all slaves [ 366.135244][T13460] bridge4: entered promiscuous mode [ 366.197113][T13485] batman_adv: batadv0: Adding interface: veth0 [ 366.197134][T13485] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.197166][T13485] batman_adv: batadv0: Interface activated: veth0 [ 366.258259][T13487] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 366.258288][T13487] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 366.306228][T13487] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 366.306293][T13487] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 366.334465][T13487] batman_adv: batadv0: Interface deactivated: veth0 [ 366.334492][T13487] batman_adv: batadv0: Removing interface: veth0 [ 366.476434][T13492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 366.556609][T13494] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2758'. [ 366.717967][T13494] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2758'. [ 366.763581][T11822] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.763677][T11822] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.763776][T11822] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 366.763881][T11822] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 367.122082][T13513] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2765'. [ 367.145987][T13507] tipc: Resetting bearer [ 367.217687][T13516] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2766'. [ 367.306368][T13515] syzkaller1: entered promiscuous mode [ 367.309014][T13515] syzkaller1: entered allmulticast mode [ 367.342382][T13516] bond7: (slave bridge4): Enslaving as an active interface with an up link [ 367.748097][T13531] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 369.283097][T13577] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2783'. [ 369.806742][T13594] syzkaller1: entered promiscuous mode [ 369.807130][T13594] syzkaller1: entered allmulticast mode [ 369.866842][T13597] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 369.867782][T13597] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 371.992834][T13665] netlink: 'syz.3.2812': attribute type 39 has an invalid length. [ 372.891740][T13695] 0: reclassify loop, rule prio 0, protocol 03 [ 373.256429][T13704] syzkaller0: Caught tx_queue_len zero misconfig [ 373.259406][T13704] syzkaller0: entered promiscuous mode [ 373.259449][T13704] syzkaller0: entered allmulticast mode [ 373.578004][T13709] netlink: 'syz.2.2826': attribute type 1 has an invalid length. [ 373.578570][T13709] netlink: 'syz.2.2826': attribute type 1 has an invalid length. [ 373.696597][T13716] syzkaller1: entered promiscuous mode [ 373.696633][T13716] syzkaller1: entered allmulticast mode [ 374.087674][T13725] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2831'. [ 374.178357][T13723] tipc: Enabled bearer , priority 0 [ 374.181448][T13727] syzkaller0: entered promiscuous mode [ 374.181512][T13727] syzkaller0: entered allmulticast mode [ 374.192491][T13723] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 374.207227][T13723] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2830'. [ 374.224502][T13723] tipc: Resetting bearer [ 375.199296][T13765] tc action pedit offset must be on 32 bit boundaries [ 375.315257][T13774] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2844'. [ 375.596147][T13780] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2847'. [ 376.578062][T13818] syzkaller0: entered promiscuous mode [ 376.578090][T13818] syzkaller0: entered allmulticast mode [ 376.612490][T13818] tipc: Enabled bearer , priority 0 [ 376.686950][T13816] tipc: Enabling of bearer rejected, already enabled [ 376.730788][T13818] tipc: Resetting bearer [ 376.781255][T13817] tipc: Resetting bearer [ 376.838139][T13817] tipc: Disabling bearer [ 377.380107][T13827] syzkaller0: entered promiscuous mode [ 377.380136][T13827] syzkaller0: entered allmulticast mode [ 377.503515][T13849] netlink: Unknown conntrack attr (0) [ 378.609408][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 382.057896][T13936] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2887'. [ 383.099450][T13973] erspan0: left promiscuous mode [ 383.240865][T13973] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 383.883874][T13987] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2902'. [ 384.418872][T14003] ip_tables: iptables: counters copy to user failed while replacing table [ 384.518189][T14006] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 384.856031][T14020] openvswitch: netlink: EtherType 500 is less than min 600 [ 384.869694][T14019] ip_tables: iptables: counters copy to user failed while replacing table [ 386.424537][T14079] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 386.428168][T14078] tipc: Enabled bearer , priority 10 [ 386.919116][T14094] openvswitch: netlink: IP tunnel TTL not specified. [ 387.001834][T14096] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2951'. [ 387.489950][T14117] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 387.805668][T14119] syzkaller0: entered promiscuous mode [ 387.805733][T14119] syzkaller0: entered allmulticast mode [ 387.979541][T14133] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 389.800574][T14175] netlink: 'syz.0.2980': attribute type 1 has an invalid length. [ 391.446676][T14177] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 391.487530][T14180] bridge5: entered promiscuous mode [ 391.808092][T14193] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2986'. [ 391.985222][T14196] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2984'. [ 392.106044][T14203] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2988'. [ 392.771242][T14228] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 392.869926][T14220] bond11: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 392.870242][T14232] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3001'. [ 392.896650][T14220] bond11 (unregistering): Released all slaves [ 392.929433][T14233] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3001'. [ 393.158578][T14229] bond11: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 393.188425][T14229] bond11 (unregistering): Released all slaves [ 393.255196][T14249] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3003'. [ 393.367202][T14231] bridge6: entered promiscuous mode [ 393.515439][T14233] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3001'. [ 393.936966][T14247] syzkaller0: entered promiscuous mode [ 393.937003][T14247] syzkaller0: entered allmulticast mode [ 396.720815][T14277] syzkaller0: left promiscuous mode [ 396.720840][T14277] syzkaller0: left allmulticast mode [ 396.901703][T14283] bond8: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 396.905154][T14283] bond8 (unregistering): Released all slaves [ 397.033647][T14289] bond8: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 397.060799][T14289] bond8 (unregistering): Released all slaves [ 397.126661][T14293] bridge5: entered promiscuous mode [ 397.407542][T14304] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3016'. [ 397.423790][T14298] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3017'. [ 397.593540][T14308] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3019'. [ 398.012282][T14319] TC_ACT_REPEAT abuse ? [ 398.636098][T14344] bridge0: port 4(wlan0) entered blocking state [ 398.636322][T14344] bridge0: port 4(wlan0) entered disabled state [ 398.637643][T14344] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 398.647203][T14344] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 398.868740][T14347] syzkaller0: entered promiscuous mode [ 398.868805][T14347] syzkaller0: entered allmulticast mode [ 399.071043][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 401.675365][T14359] syzkaller0: entered promiscuous mode [ 401.675393][T14359] syzkaller0: entered allmulticast mode [ 401.929941][T14382] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 402.038264][T14384] syzkaller0: entered promiscuous mode [ 402.038292][T14384] syzkaller0: entered allmulticast mode [ 402.069399][T14384] simple: /dev/video#_3 [ 402.069422][T14384] simple: /dev/video#_6 [ 402.069434][T14384] simple: /dev/video#_9 [ 402.069445][T14384] simple: /dev/video#_12 [ 402.069457][T14384] simple: /dev/video#_15 [ 402.069468][T14384] simple: /dev/video#_18 [ 402.069479][T14384] simple: /dev/video#_21 [ 402.069490][T14384] simple: /dev/video#_24 [ 402.069502][T14384] simple: /dev/video#_27 [ 402.069513][T14384] simple: /dev/video#_30 [ 402.069523][T14384] simple: /dev/video#_33 [ 402.069534][T14384] simple: /dev/video#_36 [ 402.069544][T14384] simple: /dev/video#_39 [ 402.069555][T14384] simple: /dev/video#_42 [ 402.069566][T14384] simple: /dev/video#_45 [ 402.069576][T14384] simple: /dev/video#_48 [ 402.069586][T14384] simple: /dev/video#_51 [ 402.069598][T14384] simple: /dev/video#_54 [ 402.069608][T14384] simple: /dev/video#_57 [ 402.069618][T14384] simple: /dev/video#_60 [ 402.069629][T14384] simple: /dev/video#_63 [ 402.069639][T14384] simple: /dev/video#_66 [ 402.069650][T14384] simple: /dev/video#_69 [ 402.069662][T14384] simple: /dev/video#_72 [ 402.069672][T14384] simple: /dev/video#_75 [ 402.069682][T14384] simple: /dev/video#_78 [ 402.071319][T14384] simple: /dev/video#_81 [ 402.071336][T14384] simple: /dev/video#_84 [ 402.071384][T14384] simple: /dev/video#_87 [ 402.071418][T14384] simple: /dev/video#_90 [ 402.071448][T14384] simple: /dev/video#_93 [ 402.071485][T14384] simple: /dev/video#_96 [ 402.071530][T14384] TC_ACT_REPEAT abuse ? [ 402.297584][T14392] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3048'. [ 402.373379][T14392] 8021q: adding VLAN 0 to HW filter on device bond12 [ 402.419583][T14387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3046'. [ 402.443102][T14388] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3047'. [ 402.539292][T14388] tipc: Disabling bearer [ 402.558313][T14402] ip_tables: iptables: counters copy to user failed while replacing table [ 402.583382][T14392] ipvlan2: entered allmulticast mode [ 402.583408][T14392] bond12: entered allmulticast mode [ 402.583726][T14392] bond12: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 402.583748][T14392] bond12: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 402.584951][T14392] bond12: (slave ipvlan2): Error -95 calling set_mac_address [ 402.913022][T14407] netlink: 'syz.1.3051': attribute type 1 has an invalid length. [ 403.098377][T14421] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3052'. [ 403.192551][T14407] bond10: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 403.198932][T14407] bond10 (unregistering): Released all slaves [ 403.344289][T14415] bridge0: entered promiscuous mode [ 403.390135][T14415] bond9: (slave bridge0): making interface the new active one [ 403.408716][T14415] bond9: (slave bridge0): Enslaving as an active interface with an up link [ 403.744854][T14441] netlink: 14 bytes leftover after parsing attributes in process `syz.3.3057'. [ 404.185420][T14453] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 404.346071][T14457] syzkaller0: entered promiscuous mode [ 404.346097][T14457] syzkaller0: entered allmulticast mode [ 404.605089][T14466] syzkaller0: entered promiscuous mode [ 404.605115][T14466] syzkaller0: entered allmulticast mode [ 405.353461][T14500] FAULT_INJECTION: forcing a failure. [ 405.353461][T14500] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 405.353539][T14500] CPU: 0 UID: 0 PID: 14500 Comm: syz.2.3076 Not tainted syzkaller #0 PREEMPT(full) [ 405.353566][T14500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 405.353588][T14500] Call Trace: [ 405.353601][T14500] [ 405.353611][T14500] dump_stack_lvl+0xe8/0x150 [ 405.353650][T14500] should_fail_ex+0x410/0x560 [ 405.353686][T14500] _copy_from_user+0x2d/0xb0 [ 405.353723][T14500] __sys_bpf+0x2e7/0xd90 [ 405.353762][T14500] ? __pfx___sys_bpf+0x10/0x10 [ 405.353802][T14500] ? __fget_files+0x2a/0x420 [ 405.353857][T14500] __x64_sys_bpf+0xba/0xd0 [ 405.353886][T14500] do_syscall_64+0x166/0x520 [ 405.353911][T14500] ? trace_irq_disable+0x3b/0x140 [ 405.353935][T14500] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.353957][T14500] ? clear_bhb_loop+0x70/0xc0 [ 405.353986][T14500] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.354008][T14500] RIP: 0033:0x7fc86ed9e559 [ 405.354028][T14500] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.354048][T14500] RSP: 002b:00007fc86fd29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 405.354073][T14500] RAX: ffffffffffffffda RBX: 00007fc86f025fa0 RCX: 00007fc86ed9e559 [ 405.354090][T14500] RDX: 0000000000000090 RSI: 0000200000000300 RDI: 0000000000000005 [ 405.354104][T14500] RBP: 00007fc86fd29090 R08: 0000000000000000 R09: 0000000000000000 [ 405.354118][T14500] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 405.354131][T14500] R13: 00007fc86f026038 R14: 00007fc86f025fa0 R15: 00007ffcdd2f7c78 [ 405.354168][T14500] [ 405.921381][T14511] FAULT_INJECTION: forcing a failure. [ 405.921381][T14511] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 405.921419][T14511] CPU: 1 UID: 0 PID: 14511 Comm: syz.3.3082 Not tainted syzkaller #0 PREEMPT(full) [ 405.921443][T14511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 405.921457][T14511] Call Trace: [ 405.921466][T14511] [ 405.921476][T14511] dump_stack_lvl+0xe8/0x150 [ 405.921532][T14511] should_fail_ex+0x410/0x560 [ 405.921570][T14511] _copy_from_user+0x2d/0xb0 [ 405.921605][T14511] ___sys_sendmsg+0x1c6/0x360 [ 405.921630][T14511] ? __lock_acquire+0x747/0x2de0 [ 405.921662][T14511] ? __pfx____sys_sendmsg+0x10/0x10 [ 405.921729][T14511] ? __fget_files+0x2a/0x420 [ 405.921750][T14511] ? __fget_files+0x3a2/0x420 [ 405.921789][T14511] __x64_sys_sendmsg+0x1b1/0x290 [ 405.921817][T14511] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 405.921875][T14511] do_syscall_64+0x166/0x520 [ 405.921901][T14511] ? trace_irq_disable+0x3b/0x140 [ 405.921926][T14511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.921950][T14511] ? clear_bhb_loop+0x70/0xc0 [ 405.921975][T14511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.921996][T14511] RIP: 0033:0x7ff1e299e559 [ 405.922017][T14511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.922036][T14511] RSP: 002b:00007ff1e3871028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 405.922062][T14511] RAX: ffffffffffffffda RBX: 00007ff1e2c25fa0 RCX: 00007ff1e299e559 [ 405.922079][T14511] RDX: 0000000000000000 RSI: 0000200000003280 RDI: 0000000000000003 [ 405.922093][T14511] RBP: 00007ff1e3871090 R08: 0000000000000000 R09: 0000000000000000 [ 405.922107][T14511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 405.922121][T14511] R13: 00007ff1e2c26038 R14: 00007ff1e2c25fa0 R15: 00007ffe14a87428 [ 405.922156][T14511] [ 405.924820][T14507] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3080'. [ 406.203390][T14512] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3081'. [ 406.567779][T14531] FAULT_INJECTION: forcing a failure. [ 406.567779][T14531] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 406.567826][T14531] CPU: 1 UID: 0 PID: 14531 Comm: syz.2.3088 Not tainted syzkaller #0 PREEMPT(full) [ 406.567851][T14531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 406.567865][T14531] Call Trace: [ 406.567874][T14531] [ 406.567884][T14531] dump_stack_lvl+0xe8/0x150 [ 406.567934][T14531] should_fail_ex+0x410/0x560 [ 406.567981][T14531] _copy_from_user+0x2d/0xb0 [ 406.568035][T14531] sk_setsockopt+0x2b5/0x2f20 [ 406.568077][T14531] ? __pfx_sk_setsockopt+0x10/0x10 [ 406.568136][T14531] ? aa_sock_opt_perm+0xe8/0x1e0 [ 406.568175][T14531] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 406.568215][T14531] do_sock_setsockopt+0x11b/0x1b0 [ 406.568244][T14531] __x64_sys_setsockopt+0x13d/0x1b0 [ 406.568273][T14531] do_syscall_64+0x166/0x520 [ 406.568300][T14531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.568324][T14531] ? clear_bhb_loop+0x70/0xc0 [ 406.568353][T14531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.568376][T14531] RIP: 0033:0x7fc86ed9e559 [ 406.568398][T14531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.568418][T14531] RSP: 002b:00007fc86fd29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 406.568442][T14531] RAX: ffffffffffffffda RBX: 00007fc86f025fa0 RCX: 00007fc86ed9e559 [ 406.568459][T14531] RDX: 0000000000000048 RSI: 0000000000000001 RDI: 0000000000000003 [ 406.568473][T14531] RBP: 00007fc86fd29090 R08: 0000000000000010 R09: 0000000000000000 [ 406.568487][T14531] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 406.568502][T14531] R13: 00007fc86f026038 R14: 00007fc86f025fa0 R15: 00007ffcdd2f7c78 [ 406.568539][T14531] [ 407.176863][T14547] ip_vti0: entered promiscuous mode [ 407.195419][T14551] netlink: 'syz.0.3094': attribute type 58 has an invalid length. [ 407.195443][T14551] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3094'. [ 407.265090][T14550] syzkaller0: entered promiscuous mode [ 407.265117][T14550] syzkaller0: entered allmulticast mode [ 407.387354][T14552] syzkaller0: entered promiscuous mode [ 407.387419][T14552] syzkaller0: entered allmulticast mode [ 407.488289][T14552] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 407.559358][T14563] FAULT_INJECTION: forcing a failure. [ 407.559358][T14563] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 407.559431][T14563] CPU: 0 UID: 0 PID: 14563 Comm: syz.2.3099 Not tainted syzkaller #0 PREEMPT(full) [ 407.559458][T14563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 407.559472][T14563] Call Trace: [ 407.559481][T14563] [ 407.559490][T14563] dump_stack_lvl+0xe8/0x150 [ 407.559528][T14563] should_fail_ex+0x410/0x560 [ 407.559565][T14563] _copy_from_user+0x2d/0xb0 [ 407.559601][T14563] ___sys_sendmsg+0x1c6/0x360 [ 407.559643][T14563] ? __lock_acquire+0x747/0x2de0 [ 407.559674][T14563] ? __pfx____sys_sendmsg+0x10/0x10 [ 407.559737][T14563] ? __fget_files+0x2a/0x420 [ 407.559760][T14563] ? __fget_files+0x3a2/0x420 [ 407.559793][T14563] __x64_sys_sendmsg+0x1b1/0x290 [ 407.559822][T14563] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 407.559871][T14563] do_syscall_64+0x166/0x520 [ 407.559897][T14563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.559921][T14563] ? clear_bhb_loop+0x70/0xc0 [ 407.559949][T14563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.559973][T14563] RIP: 0033:0x7fc86ed9e559 [ 407.559994][T14563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.560013][T14563] RSP: 002b:00007fc86fd29028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 407.560038][T14563] RAX: ffffffffffffffda RBX: 00007fc86f025fa0 RCX: 00007fc86ed9e559 [ 407.560055][T14563] RDX: 0000000020000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 407.560070][T14563] RBP: 00007fc86fd29090 R08: 0000000000000000 R09: 0000000000000000 [ 407.560084][T14563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 407.560098][T14563] R13: 00007fc86f026038 R14: 00007fc86f025fa0 R15: 00007ffcdd2f7c78 [ 407.560141][T14563] [ 408.384546][T14575] unsupported nlmsg_type 40 [ 408.388209][T14575] syzkaller0: entered promiscuous mode [ 408.388234][T14575] syzkaller0: entered allmulticast mode [ 408.885168][T14587] syzkaller0: entered promiscuous mode [ 408.885195][T14587] syzkaller0: entered allmulticast mode [ 409.017056][T14592] netlink: 'syz.4.3111': attribute type 10 has an invalid length. [ 409.017675][T14592] bridge0: port 3(syz_tun) entered disabled state [ 409.018373][T14592] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.018682][T14592] bridge0: port 1(bridge_slave_0) entered disabled state [ 409.067387][T14592] bridge0: port 3(syz_tun) entered blocking state [ 409.067647][T14592] bridge0: port 3(syz_tun) entered listening state [ 409.068000][T14592] bridge0: port 2(bridge_slave_1) entered blocking state [ 409.068142][T14592] bridge0: port 2(bridge_slave_1) entered listening state [ 409.068428][T14592] bridge0: port 1(bridge_slave_0) entered blocking state [ 409.068572][T14592] bridge0: port 1(bridge_slave_0) entered listening state [ 409.135176][T14595] FAULT_INJECTION: forcing a failure. [ 409.135176][T14595] name failslab, interval 1, probability 0, space 0, times 1 [ 409.135215][T14595] CPU: 1 UID: 0 PID: 14595 Comm: syz.4.3111 Not tainted syzkaller #0 PREEMPT(full) [ 409.135239][T14595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 409.135253][T14595] Call Trace: [ 409.135262][T14595] [ 409.135273][T14595] dump_stack_lvl+0xe8/0x150 [ 409.135319][T14595] should_fail_ex+0x410/0x560 [ 409.135357][T14595] ? __alloc_skb+0x1db/0x7a0 [ 409.135390][T14595] should_failslab+0xa8/0x100 [ 409.135424][T14595] ? __alloc_skb+0x1db/0x7a0 [ 409.135456][T14595] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 409.135483][T14595] ? __alloc_skb+0x18d/0x7a0 [ 409.135516][T14595] ? __alloc_skb+0x1db/0x7a0 [ 409.135557][T14595] __alloc_skb+0x1db/0x7a0 [ 409.135595][T14595] netlink_sendmsg+0x5d4/0xb40 [ 409.135635][T14595] ? __pfx_netlink_sendmsg+0x10/0x10 [ 409.135674][T14595] ? apparmor_socket_sendmsg+0x98/0x360 [ 409.135707][T14595] ? lock_acquire+0x115/0x350 [ 409.135733][T14595] ? __pfx_netlink_sendmsg+0x10/0x10 [ 409.135760][T14595] sock_sendmsg_nosec+0x13a/0x180 [ 409.135794][T14595] sock_write_iter+0x2de/0x3e0 [ 409.135825][T14595] ? __pfx_sock_write_iter+0x10/0x10 [ 409.135861][T14595] ? bpf_lsm_file_permission+0x9/0x20 [ 409.135883][T14595] ? security_file_permission+0x75/0x260 [ 409.135920][T14595] vfs_write+0x612/0xba0 [ 409.135955][T14595] ? __pfx_vfs_write+0x10/0x10 [ 409.136032][T14595] ? __fget_files+0x2a/0x420 [ 409.136063][T14595] ksys_write+0x150/0x270 [ 409.136092][T14595] ? __pfx_ksys_write+0x10/0x10 [ 409.136129][T14595] do_syscall_64+0x166/0x520 [ 409.136156][T14595] ? trace_irq_disable+0x3b/0x140 [ 409.136182][T14595] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.136206][T14595] ? clear_bhb_loop+0x70/0xc0 [ 409.136235][T14595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.136258][T14595] RIP: 0033:0x7f5d7599e559 [ 409.136279][T14595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.136306][T14595] RSP: 002b:00007f5d767c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 409.136331][T14595] RAX: ffffffffffffffda RBX: 00007f5d75c26090 RCX: 00007f5d7599e559 [ 409.136349][T14595] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000004 [ 409.136363][T14595] RBP: 00007f5d767c0090 R08: 0000000000000000 R09: 0000000000000000 [ 409.136378][T14595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 409.136392][T14595] R13: 00007f5d75c26128 R14: 00007f5d75c26090 R15: 00007ffde4695818 [ 409.136429][T14595] [ 409.163077][T14592] bridge0: entered allmulticast mode [ 409.167375][T14592] .`: (slave bridge0): Enslaving as an active interface with a down link [ 409.568530][T14601] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3113'. [ 409.753835][T14611] FAULT_INJECTION: forcing a failure. [ 409.753835][T14611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 409.753924][T14611] CPU: 0 UID: 0 PID: 14611 Comm: syz.1.3117 Not tainted syzkaller #0 PREEMPT(full) [ 409.753952][T14611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 409.753967][T14611] Call Trace: [ 409.753975][T14611] [ 409.753985][T14611] dump_stack_lvl+0xe8/0x150 [ 409.754023][T14611] should_fail_ex+0x410/0x560 [ 409.754061][T14611] _copy_from_user+0x2d/0xb0 [ 409.754097][T14611] __sys_sendto+0x2a9/0x5a0 [ 409.754131][T14611] ? ksys_write+0x1e6/0x270 [ 409.754160][T14611] ? __pfx___sys_sendto+0x10/0x10 [ 409.754191][T14611] ? __mutex_unlock_slowpath+0x731/0x900 [ 409.754250][T14611] ? __pfx_ksys_write+0x10/0x10 [ 409.754280][T14611] __x64_sys_sendto+0xde/0x100 [ 409.754318][T14611] do_syscall_64+0x166/0x520 [ 409.754343][T14611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.754366][T14611] ? clear_bhb_loop+0x70/0xc0 [ 409.754400][T14611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 409.754423][T14611] RIP: 0033:0x7f3cfe59e559 [ 409.754444][T14611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 409.754462][T14611] RSP: 002b:00007f3cfc7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 409.754487][T14611] RAX: ffffffffffffffda RBX: 00007f3cfe825fa0 RCX: 00007f3cfe59e559 [ 409.754504][T14611] RDX: 0000000000000022 RSI: 0000200000000000 RDI: 0000000000000003 [ 409.754519][T14611] RBP: 00007f3cfc7f6090 R08: 00002000000000c0 R09: 0000000000000014 [ 409.754534][T14611] R10: 0000000004008015 R11: 0000000000000246 R12: 0000000000000001 [ 409.754548][T14611] R13: 00007f3cfe826038 R14: 00007f3cfe825fa0 R15: 00007ffdb334ef08 [ 409.754585][T14611] [ 410.356141][T14624] syzkaller0: left promiscuous mode [ 410.356199][T14624] syzkaller0: left allmulticast mode [ 410.476390][T14629] FAULT_INJECTION: forcing a failure. [ 410.476390][T14629] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 410.476462][T14629] CPU: 0 UID: 0 PID: 14629 Comm: syz.4.3126 Not tainted syzkaller #0 PREEMPT(full) [ 410.476496][T14629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 410.476510][T14629] Call Trace: [ 410.476519][T14629] [ 410.476528][T14629] dump_stack_lvl+0xe8/0x150 [ 410.476567][T14629] should_fail_ex+0x410/0x560 [ 410.476604][T14629] _copy_from_user+0x2d/0xb0 [ 410.476638][T14629] ___sys_sendmsg+0x1c6/0x360 [ 410.476660][T14629] ? __lock_acquire+0x747/0x2de0 [ 410.476691][T14629] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.476721][T14629] ? kstrtouint+0x6e/0xe0 [ 410.476776][T14629] ? __fget_files+0x2a/0x420 [ 410.476797][T14629] ? __fget_files+0x3a2/0x420 [ 410.476826][T14629] __sys_sendmmsg+0x273/0x4d0 [ 410.476863][T14629] ? __pfx___sys_sendmmsg+0x10/0x10 [ 410.476894][T14629] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 410.476935][T14629] ? ksys_write+0x242/0x270 [ 410.476960][T14629] ? __pfx_ksys_write+0x10/0x10 [ 410.476991][T14629] __x64_sys_sendmmsg+0xa0/0xc0 [ 410.477018][T14629] do_syscall_64+0x166/0x520 [ 410.477043][T14629] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.477066][T14629] ? clear_bhb_loop+0x70/0xc0 [ 410.477094][T14629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.477115][T14629] RIP: 0033:0x7f5d7599e559 [ 410.477135][T14629] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.477155][T14629] RSP: 002b:00007f5d767e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 410.477179][T14629] RAX: ffffffffffffffda RBX: 00007f5d75c25fa0 RCX: 00007f5d7599e559 [ 410.477196][T14629] RDX: 0000000000000001 RSI: 0000200000004040 RDI: 0000000000000003 [ 410.477210][T14629] RBP: 00007f5d767e1090 R08: 0000000000000000 R09: 0000000000000000 [ 410.477224][T14629] R10: 0000000000000090 R11: 0000000000000246 R12: 0000000000000001 [ 410.477237][T14629] R13: 00007f5d75c26038 R14: 00007f5d75c25fa0 R15: 00007ffde4695818 [ 410.477272][T14629] [ 411.104127][T14653] FAULT_INJECTION: forcing a failure. [ 411.104127][T14653] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 411.104167][T14653] CPU: 1 UID: 0 PID: 14653 Comm: syz.3.3130 Not tainted syzkaller #0 PREEMPT(full) [ 411.104192][T14653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 411.104207][T14653] Call Trace: [ 411.104217][T14653] [ 411.104226][T14653] dump_stack_lvl+0xe8/0x150 [ 411.104266][T14653] should_fail_ex+0x410/0x560 [ 411.104304][T14653] _copy_from_user+0x2d/0xb0 [ 411.104341][T14653] ___sys_recvmsg+0x173/0x5a0 [ 411.104380][T14653] ? __pfx____sys_recvmsg+0x10/0x10 [ 411.104412][T14653] ? lock_acquire+0x115/0x350 [ 411.104471][T14653] ? __fget_files+0x3a2/0x420 [ 411.104505][T14653] do_recvmmsg+0x31a/0x7f0 [ 411.104539][T14653] ? __pfx_do_recvmmsg+0x10/0x10 [ 411.104575][T14653] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 411.104604][T14653] ? __fget_files+0x3a2/0x420 [ 411.104637][T14653] __x64_sys_recvmmsg+0x198/0x250 [ 411.104668][T14653] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 411.104712][T14653] do_syscall_64+0x166/0x520 [ 411.104737][T14653] ? trace_irq_disable+0x3b/0x140 [ 411.104762][T14653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.104785][T14653] ? clear_bhb_loop+0x70/0xc0 [ 411.104814][T14653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.104837][T14653] RIP: 0033:0x7ff1e299e559 [ 411.104858][T14653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 411.104877][T14653] RSP: 002b:00007ff1e382f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 411.104902][T14653] RAX: ffffffffffffffda RBX: 00007ff1e2c26180 RCX: 00007ff1e299e559 [ 411.104919][T14653] RDX: 0000000000000002 RSI: 0000200000002d40 RDI: 0000000000000003 [ 411.104933][T14653] RBP: 00007ff1e382f090 R08: 0000000000000000 R09: 0000000000000000 [ 411.104963][T14653] R10: 0000000000002120 R11: 0000000000000246 R12: 0000000000000001 [ 411.104977][T14653] R13: 00007ff1e2c26218 R14: 00007ff1e2c26180 R15: 00007ffe14a87428 [ 411.105014][T14653] [ 412.105896][T14673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 412.120026][T14673] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.130570][T14673] tipc: Resetting bearer [ 412.148362][T14673] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 412.176775][T14682] FAULT_INJECTION: forcing a failure. [ 412.176775][T14682] name failslab, interval 1, probability 0, space 0, times 0 [ 412.176812][T14682] CPU: 1 UID: 0 PID: 14682 Comm: syz.0.3141 Not tainted syzkaller #0 PREEMPT(full) [ 412.176837][T14682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 412.176852][T14682] Call Trace: [ 412.176860][T14682] [ 412.176871][T14682] dump_stack_lvl+0xe8/0x150 [ 412.176909][T14682] should_fail_ex+0x410/0x560 [ 412.176947][T14682] should_failslab+0xa8/0x100 [ 412.176982][T14682] __kmalloc_cache_node_noprof+0xaa/0x620 [ 412.177017][T14682] ? __get_vm_area_node+0x155/0x2f0 [ 412.177039][T14682] ? __get_vm_area_node+0x155/0x2f0 [ 412.177068][T14682] __get_vm_area_node+0x155/0x2f0 [ 412.177098][T14682] __vmalloc_node_range_noprof+0x343/0x1540 [ 412.177120][T14682] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 412.177150][T14682] ? __lock_acquire+0x747/0x2de0 [ 412.177204][T14682] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 412.177240][T14682] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 412.177268][T14682] __vmalloc_noprof+0xd2/0x120 [ 412.177293][T14682] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 412.177325][T14682] bpf_prog_alloc_no_stats+0x47/0x560 [ 412.177353][T14682] ? bpf_prog_alloc+0x2a/0x1a0 [ 412.177385][T14682] bpf_prog_alloc+0x3c/0x1a0 [ 412.177418][T14682] bpf_prog_load+0x7f8/0x1c20 [ 412.177462][T14682] ? __pfx_bpf_prog_load+0x10/0x10 [ 412.177520][T14682] __sys_bpf+0xd0d/0xd90 [ 412.177559][T14682] ? __pfx___sys_bpf+0x10/0x10 [ 412.177607][T14682] ? __fget_files+0x2a/0x420 [ 412.177648][T14682] ? ksys_write+0x242/0x270 [ 412.177675][T14682] ? __pfx_ksys_write+0x10/0x10 [ 412.177705][T14682] __x64_sys_bpf+0xba/0xd0 [ 412.177733][T14682] do_syscall_64+0x166/0x520 [ 412.177759][T14682] ? trace_irq_disable+0x3b/0x140 [ 412.177785][T14682] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.177808][T14682] ? clear_bhb_loop+0x70/0xc0 [ 412.177836][T14682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.177859][T14682] RIP: 0033:0x7f62a579e559 [ 412.177880][T14682] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.177900][T14682] RSP: 002b:00007f62a6701028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 412.177925][T14682] RAX: ffffffffffffffda RBX: 00007f62a5a25fa0 RCX: 00007f62a579e559 [ 412.177943][T14682] RDX: 0000000000000090 RSI: 0000200000000300 RDI: 0000000000000005 [ 412.177958][T14682] RBP: 00007f62a6701090 R08: 0000000000000000 R09: 0000000000000000 [ 412.177972][T14682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 412.177985][T14682] R13: 00007f62a5a26038 R14: 00007f62a5a25fa0 R15: 00007fff96d2e288 [ 412.178022][T14682] [ 412.178272][T14682] syz.0.3141: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 412.178510][T14682] CPU: 1 UID: 0 PID: 14682 Comm: syz.0.3141 Not tainted syzkaller #0 PREEMPT(full) [ 412.178535][T14682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 412.178549][T14682] Call Trace: [ 412.178558][T14682] [ 412.178567][T14682] dump_stack_lvl+0xe8/0x150 [ 412.178614][T14682] warn_alloc+0x24d/0x270 [ 412.178641][T14682] ? __kasan_kmalloc+0x22/0xb0 [ 412.178676][T14682] ? __pfx_warn_alloc+0x10/0x10 [ 412.178705][T14682] ? __get_vm_area_node+0x155/0x2f0 [ 412.178736][T14682] ? __get_vm_area_node+0x2a9/0x2f0 [ 412.178767][T14682] __vmalloc_node_range_noprof+0x36b/0x1540 [ 412.178793][T14682] ? __lock_acquire+0x747/0x2de0 [ 412.178847][T14682] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 412.178884][T14682] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 412.178912][T14682] __vmalloc_noprof+0xd2/0x120 [ 412.178937][T14682] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 412.178970][T14682] bpf_prog_alloc_no_stats+0x47/0x560 [ 412.178998][T14682] ? bpf_prog_alloc+0x2a/0x1a0 [ 412.179029][T14682] bpf_prog_alloc+0x3c/0x1a0 [ 412.179061][T14682] bpf_prog_load+0x7f8/0x1c20 [ 412.179103][T14682] ? __pfx_bpf_prog_load+0x10/0x10 [ 412.179162][T14682] __sys_bpf+0xd0d/0xd90 [ 412.179200][T14682] ? __pfx___sys_bpf+0x10/0x10 [ 412.179241][T14682] ? __fget_files+0x2a/0x420 [ 412.179282][T14682] ? ksys_write+0x242/0x270 [ 412.179310][T14682] ? __pfx_ksys_write+0x10/0x10 [ 412.179339][T14682] __x64_sys_bpf+0xba/0xd0 [ 412.179369][T14682] do_syscall_64+0x166/0x520 [ 412.179396][T14682] ? trace_irq_disable+0x3b/0x140 [ 412.179421][T14682] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.179445][T14682] ? clear_bhb_loop+0x70/0xc0 [ 412.179473][T14682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.179497][T14682] RIP: 0033:0x7f62a579e559 [ 412.179518][T14682] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.179538][T14682] RSP: 002b:00007f62a6701028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 412.179561][T14682] RAX: ffffffffffffffda RBX: 00007f62a5a25fa0 RCX: 00007f62a579e559 [ 412.179578][T14682] RDX: 0000000000000090 RSI: 0000200000000300 RDI: 0000000000000005 [ 412.179593][T14682] RBP: 00007f62a6701090 R08: 0000000000000000 R09: 0000000000000000 [ 412.179615][T14682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 412.179629][T14682] R13: 00007f62a5a26038 R14: 00007f62a5a25fa0 R15: 00007fff96d2e288 [ 412.179666][T14682] [ 412.179783][T14682] Mem-Info: [ 412.179794][T14682] active_anon:6324 inactive_anon:0 isolated_anon:0 [ 412.179794][T14682] active_file:0 inactive_file:43448 isolated_file:0 [ 412.179794][T14682] unevictable:0 dirty:283 writeback:0 [ 412.179794][T14682] slab_reclaimable:10995 slab_unreclaimable:106965 [ 412.179794][T14682] mapped:29501 shmem:524 pagetables:1217 [ 412.179794][T14682] sec_pagetables:0 bounce:0 [ 412.179794][T14682] kernel_misc_reclaimable:0 [ 412.179794][T14682] free:1314997 free_pcp:9918 free_cma:0 [ 412.179857][T14682] Node 0 active_anon:25296kB inactive_anon:0kB active_file:0kB inactive_file:173588kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118004kB dirty:1132kB writeback:0kB shmem:2096kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13844kB pagetables:4696kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 412.179917][T14682] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 412.179979][T14682] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 412.180043][T14682] lowmem_reserve[]: 0 2468 2468 2468 2468 [ 412.180086][T14682] Node 0 DMA32 free:1309472kB boost:0kB min:33984kB low:42480kB high:50976kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25296kB inactive_anon:0kB active_file:0kB inactive_file:173588kB unevictable:0kB writepending:1132kB zspages:0kB present:3129332kB managed:2527516kB mlocked:0kB bounce:0kB free_pcp:39672kB local_pcp:19944kB free_cma:0kB [ 412.180151][T14682] lowmem_reserve[]: 0 0 0 0 0 [ 412.180190][T14682] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 412.180251][T14682] lowmem_reserve[]: 0 0 0 0 0 [ 412.180291][T14682] Node 1 Normal free:3935156kB boost:0kB min:55916kB low:69892kB high:83868kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 412.184999][T14682] lowmem_reserve[]: 0 0 0 0 0 [ 412.185118][T14682] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 412.185428][T14682] Node 0 DMA32: 804*4kB (UME) 786*8kB (UME) 437*16kB (UME) 329*32kB (UME) 55*64kB (UME) 33*128kB (UME) 27*256kB (UME) 10*512kB (UME) 7*1024kB (UM) 9*2048kB (UME) 302*4096kB (M) = 1309392kB [ 412.191096][T14682] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 412.191384][T14682] Node 1 Normal: 3*4kB (UM) 3*8kB (UM) 11*16kB (UM) 7*32kB (UM) 10*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 2*1024kB (UM) 1*2048kB (U) 959*4096kB (UM) = 3935156kB [ 412.191990][T14682] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 412.192042][T14682] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 412.194979][T14682] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 412.195029][T14682] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 412.197529][T14682] 43968 total pagecache pages [ 412.197571][T14682] 0 pages in swap cache [ 412.197592][T14682] Free swap = 124996kB [ 412.197622][T14682] Total swap = 124996kB [ 412.197645][T14682] 2097051 pages RAM [ 412.197666][T14682] 0 pages HighMem/MovableOnly [ 412.197686][T14682] 433556 pages reserved [ 412.197763][T14682] 0 pages cma reserved [ 413.154287][T14673] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 413.154324][T14673] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 413.229538][T14673] veth1_vlan: left promiscuous mode [ 413.270026][T14673] veth0_vlan: left promiscuous mode [ 413.277668][T14673] veth0_vlan: entered promiscuous mode [ 413.295253][T14673] veth1_vlan: entered promiscuous mode [ 413.310790][T14673] veth1_macvtap: left promiscuous mode [ 413.313775][T14673] veth0_macvtap: left promiscuous mode [ 413.317581][T14673] veth0_macvtap: entered promiscuous mode [ 413.331296][T14673] veth1_macvtap: entered promiscuous mode [ 413.375994][T14673] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 413.379982][T14673] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 413.402077][T14673] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 413.407159][T14673] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 413.408861][T14673] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 413.431429][ T153] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.431569][ T153] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.431673][ T153] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 413.431832][ T153] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 414.220183][T14705] FAULT_INJECTION: forcing a failure. [ 414.220183][T14705] name failslab, interval 1, probability 0, space 0, times 0 [ 414.220221][T14705] CPU: 1 UID: 0 PID: 14705 Comm: syz.1.3149 Not tainted syzkaller #0 PREEMPT(full) [ 414.220246][T14705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 414.220260][T14705] Call Trace: [ 414.220269][T14705] [ 414.220280][T14705] dump_stack_lvl+0xe8/0x150 [ 414.220323][T14705] should_fail_ex+0x410/0x560 [ 414.220358][T14705] should_failslab+0xa8/0x100 [ 414.220392][T14705] __kmalloc_noprof+0xfe/0x720 [ 414.220418][T14705] ? iovec_from_user+0x87/0x250 [ 414.220449][T14705] ? iovec_from_user+0x87/0x250 [ 414.220488][T14705] iovec_from_user+0x87/0x250 [ 414.220527][T14705] __import_iovec+0x15e/0x7e0 [ 414.220574][T14705] import_iovec+0x73/0xa0 [ 414.220612][T14705] ___sys_sendmsg+0x255/0x360 [ 414.220666][T14705] ? __lock_acquire+0x747/0x2de0 [ 414.220698][T14705] ? __pfx____sys_sendmsg+0x10/0x10 [ 414.220762][T14705] ? __fget_files+0x2a/0x420 [ 414.220783][T14705] ? __fget_files+0x3a2/0x420 [ 414.220817][T14705] __x64_sys_sendmsg+0x1b1/0x290 [ 414.220846][T14705] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 414.220902][T14705] do_syscall_64+0x166/0x520 [ 414.220929][T14705] ? trace_irq_disable+0x3b/0x140 [ 414.220954][T14705] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.220979][T14705] ? clear_bhb_loop+0x70/0xc0 [ 414.221008][T14705] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.221031][T14705] RIP: 0033:0x7f3cfe59e559 [ 414.221053][T14705] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.221073][T14705] RSP: 002b:00007f3cfc7f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 414.221099][T14705] RAX: ffffffffffffffda RBX: 00007f3cfe825fa0 RCX: 00007f3cfe59e559 [ 414.221116][T14705] RDX: 0000000000000000 RSI: 0000200000003680 RDI: 0000000000000003 [ 414.221130][T14705] RBP: 00007f3cfc7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 414.221145][T14705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 414.221159][T14705] R13: 00007f3cfe826038 R14: 00007f3cfe825fa0 R15: 00007ffdb334ef08 [ 414.221195][T14705] [ 414.247518][T14704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3148'. [ 414.321324][T14704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3148'. [ 414.813349][T14712] openvswitch: netlink: ct_state flags ffffffff unsupported [ 414.885013][T14712] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3152'. [ 415.554304][T14736] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3161'. [ 415.558198][T14737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 415.581191][T14737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3162'. [ 416.149850][T14748] bond11: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 416.174758][T14748] bond11 (unregistering): Released all slaves [ 416.416638][T14754] bond11: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 416.429924][T14754] bond11 (unregistering): Released all slaves [ 416.559604][T14756] bridge7: entered promiscuous mode [ 416.903095][T14773] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3175'. [ 416.939360][T14769] bond8: option packets_per_slave: invalid value (18446744073709551615) [ 416.939415][T14769] bond8: option packets_per_slave: allowed values 0 - 65535 [ 416.962815][T14769] bond8 (unregistering): Released all slaves [ 416.969649][T14779] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3175'. [ 417.452417][T14796] netlink: 312 bytes leftover after parsing attributes in process `syz.4.3178'. [ 417.492304][T14796] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3178'. [ 417.586375][T14799] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3181'. [ 418.008604][T14813] netlink: 'syz.3.3186': attribute type 10 has an invalid length. [ 418.025685][T14813] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3186'. [ 418.075529][T14811] xt_hashlimit: size too large, truncated to 1048576 [ 419.307076][T14856] FAULT_INJECTION: forcing a failure. [ 419.307076][T14856] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 419.307149][T14856] CPU: 0 UID: 0 PID: 14856 Comm: syz.4.3199 Not tainted syzkaller #0 PREEMPT(full) [ 419.307178][T14856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 419.307193][T14856] Call Trace: [ 419.307201][T14856] [ 419.307211][T14856] dump_stack_lvl+0xe8/0x150 [ 419.307249][T14856] should_fail_ex+0x410/0x560 [ 419.307287][T14856] _copy_to_user+0x31/0xb0 [ 419.307324][T14856] simple_read_from_buffer+0xe1/0x170 [ 419.307367][T14856] proc_fail_nth_read+0x1bb/0x230 [ 419.307391][T14856] ? common_file_perm+0x20e/0x2b0 [ 419.307427][T14856] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 419.307457][T14856] ? rw_verify_area+0x24a/0x4c0 [ 419.307478][T14856] ? kfree+0x1c5/0x650 [ 419.307501][T14856] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 419.307526][T14856] vfs_read+0x213/0xa80 [ 419.307556][T14856] ? __pfx___mutex_lock+0x10/0x10 [ 419.307582][T14856] ? __pfx_vfs_read+0x10/0x10 [ 419.307607][T14856] ? __fget_files+0x2a/0x420 [ 419.307633][T14856] ? __fget_files+0x3a2/0x420 [ 419.307653][T14856] ? __fget_files+0x2a/0x420 [ 419.307684][T14856] ksys_read+0x150/0x270 [ 419.307712][T14856] ? __pfx_ksys_read+0x10/0x10 [ 419.307748][T14856] do_syscall_64+0x166/0x520 [ 419.307773][T14856] ? trace_irq_disable+0x3b/0x140 [ 419.307798][T14856] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.307821][T14856] ? clear_bhb_loop+0x70/0xc0 [ 419.307849][T14856] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.307872][T14856] RIP: 0033:0x7f5d7595ed8e [ 419.307893][T14856] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 419.307920][T14856] RSP: 002b:00007f5d767e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 419.307944][T14856] RAX: ffffffffffffffda RBX: 00007f5d767e16c0 RCX: 00007f5d7595ed8e [ 419.307961][T14856] RDX: 000000000000000f RSI: 00007f5d767e10a0 RDI: 0000000000000004 [ 419.307976][T14856] RBP: 00007f5d767e1090 R08: 0000000000000000 R09: 0000000000000000 [ 419.307990][T14856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 419.308003][T14856] R13: 00007f5d75c26038 R14: 00007f5d75c25fa0 R15: 00007ffde4695818 [ 419.308040][T14856] [ 419.625455][T14862] syzkaller0: entered promiscuous mode [ 419.625481][T14862] syzkaller0: entered allmulticast mode [ 419.633452][T14859] netlink: 'syz.2.3200': attribute type 32 has an invalid length. [ 419.866211][T14859] bond11: option coupled_control: invalid value (192) [ 419.889529][T14859] bond11 (unregistering): Released all slaves [ 420.654148][T14898] netlink: 'syz.3.3209': attribute type 10 has an invalid length. [ 420.682584][T14898] __nla_validate_parse: 5 callbacks suppressed [ 420.682610][T14898] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3209'. [ 421.122550][T14915] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3214'. [ 421.178978][T14915] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3214'. [ 421.457808][T14923] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3219'. [ 421.457873][T14923] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3219'. [ 421.595959][T14920] bridge0: port 3(syz_tun) entered disabled state [ 421.629596][T14920] bridge0: port 2(bridge_slave_1) entered disabled state [ 421.629836][T14920] bridge0: port 1(bridge_slave_0) entered disabled state [ 421.676256][T14920] batman_adv: batadv0: Interface deactivated: veth0 [ 421.725985][T14945] FAULT_INJECTION: forcing a failure. [ 421.725985][T14945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 421.726023][T14945] CPU: 1 UID: 0 PID: 14945 Comm: syz.1.3225 Not tainted syzkaller #0 PREEMPT(full) [ 421.726049][T14945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 421.726063][T14945] Call Trace: [ 421.726072][T14945] [ 421.726082][T14945] dump_stack_lvl+0xe8/0x150 [ 421.726123][T14945] should_fail_ex+0x410/0x560 [ 421.726172][T14945] _copy_from_user+0x2d/0xb0 [ 421.726209][T14945] bpf_test_init+0xd8/0x150 [ 421.726241][T14945] bpf_prog_test_run_skb+0x31e/0x2230 [ 421.726270][T14945] ? lock_acquire+0x115/0x350 [ 421.726313][T14945] ? __fget_files+0x3a2/0x420 [ 421.726335][T14945] ? __fget_files+0x2a/0x420 [ 421.726360][T14945] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 421.726389][T14945] bpf_prog_test_run+0x2c5/0x340 [ 421.726424][T14945] __sys_bpf+0xa22/0xd90 [ 421.726462][T14945] ? __pfx___sys_bpf+0x10/0x10 [ 421.726501][T14945] ? __fget_files+0x2a/0x420 [ 421.726542][T14945] ? ksys_write+0x242/0x270 [ 421.726569][T14945] ? __pfx_ksys_write+0x10/0x10 [ 421.726600][T14945] __x64_sys_bpf+0xba/0xd0 [ 421.726630][T14945] do_syscall_64+0x166/0x520 [ 421.726655][T14945] ? trace_irq_disable+0x3b/0x140 [ 421.726680][T14945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.726703][T14945] ? clear_bhb_loop+0x70/0xc0 [ 421.726733][T14945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.726756][T14945] RIP: 0033:0x7f3cfe59e559 [ 421.726776][T14945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.726797][T14945] RSP: 002b:00007f3cfc7f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 421.726821][T14945] RAX: ffffffffffffffda RBX: 00007f3cfe825fa0 RCX: 00007f3cfe59e559 [ 421.726839][T14945] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 421.726854][T14945] RBP: 00007f3cfc7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 421.726869][T14945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 421.726884][T14945] R13: 00007f3cfe826038 R14: 00007f3cfe825fa0 R15: 00007ffdb334ef08 [ 421.726920][T14945] [ 421.873864][T14943] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3224'. [ 422.034482][T14920] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 422.038973][T14920] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 422.206122][T14920] v: left promiscuous mode [ 422.551090][ T8142] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.551130][ T8142] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.551171][ T8142] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.551197][ T8142] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.551234][ T8142] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.551261][ T8142] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.551297][ T8142] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.551322][ T8142] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.841450][T14970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3233'. [ 422.894354][T14974] FAULT_INJECTION: forcing a failure. [ 422.894354][T14974] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 422.894391][T14974] CPU: 1 UID: 0 PID: 14974 Comm: syz.4.3230 Not tainted syzkaller #0 PREEMPT(full) [ 422.894416][T14974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 422.894429][T14974] Call Trace: [ 422.894438][T14974] [ 422.894448][T14974] dump_stack_lvl+0xe8/0x150 [ 422.894491][T14974] should_fail_ex+0x410/0x560 [ 422.894528][T14974] _copy_from_iter+0x1d3/0x1660 [ 422.894563][T14974] ? alloc_pages_mpol+0x256/0x390 [ 422.894598][T14974] ? __pfx_tcp_leave_memory_pressure+0x10/0x10 [ 422.894633][T14974] ? alloc_pages_noprof+0x140/0x2b0 [ 422.894673][T14974] ? __pfx__copy_from_iter+0x10/0x10 [ 422.894707][T14974] ? __sk_mem_schedule+0x7b/0xf0 [ 422.894739][T14974] ? sk_msg_alloc+0xa53/0xb00 [ 422.894767][T14974] sk_msg_memcopy_from_iter+0x35e/0x700 [ 422.894807][T14974] tcp_bpf_sendmsg+0x622/0x1c70 [ 422.894841][T14974] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 422.894901][T14974] ? __pfx_tcp_bpf_sendmsg+0x10/0x10 [ 422.895014][T14974] ? __lock_acquire+0x747/0x2de0 [ 422.895045][T14974] ? sock_rps_record_flow+0x19/0x350 [ 422.895080][T14974] ? inet_send_prepare+0x5b/0x260 [ 422.895115][T14974] ? inet6_sendmsg+0x101/0x120 [ 422.895148][T14974] ? __pfx_inet6_sendmsg+0x10/0x10 [ 422.895178][T14974] sock_sendmsg_nosec+0x90/0x180 [ 422.895210][T14974] ____sys_sendmsg+0x54e/0x850 [ 422.895241][T14974] ? __pfx_____sys_sendmsg+0x10/0x10 [ 422.895276][T14974] ? import_iovec+0x73/0xa0 [ 422.895314][T14974] ___sys_sendmsg+0x2a5/0x360 [ 422.895337][T14974] ? __lock_acquire+0x747/0x2de0 [ 422.895367][T14974] ? __pfx____sys_sendmsg+0x10/0x10 [ 422.895397][T14974] ? kstrtouint+0x6e/0xe0 [ 422.895455][T14974] ? __fget_files+0x2a/0x420 [ 422.895476][T14974] ? __fget_files+0x3a2/0x420 [ 422.895509][T14974] __sys_sendmmsg+0x273/0x4d0 [ 422.895538][T14974] ? __pfx___sys_sendmmsg+0x10/0x10 [ 422.895575][T14974] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 422.895619][T14974] ? ksys_write+0x242/0x270 [ 422.895645][T14974] ? __pfx_ksys_write+0x10/0x10 [ 422.895683][T14974] __x64_sys_sendmmsg+0xa0/0xc0 [ 422.895711][T14974] do_syscall_64+0x166/0x520 [ 422.895734][T14974] ? trace_irq_disable+0x3b/0x140 [ 422.895759][T14974] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.895782][T14974] ? clear_bhb_loop+0x70/0xc0 [ 422.895810][T14974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.895831][T14974] RIP: 0033:0x7f5d7599e559 [ 422.895852][T14974] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 422.895870][T14974] RSP: 002b:00007f5d767e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 422.895895][T14974] RAX: ffffffffffffffda RBX: 00007f5d75c25fa0 RCX: 00007f5d7599e559 [ 422.895912][T14974] RDX: 0000000000000400 RSI: 0000200000002440 RDI: 0000000000000003 [ 422.895927][T14974] RBP: 00007f5d767e1090 R08: 0000000000000000 R09: 0000000000000000 [ 422.895941][T14974] R10: 0000000000000010 R11: 0000000000000246 R12: 0000000000000001 [ 422.895955][T14974] R13: 00007f5d75c26038 R14: 00007f5d75c25fa0 R15: 00007ffde4695818 [ 422.895993][T14974] [ 423.003963][T14977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3233'. [ 423.289270][T14970] 8021q: adding VLAN 0 to HW filter on device bond8 [ 423.474789][T14980] ipvlan2: entered allmulticast mode [ 423.474814][T14980] bond8: entered allmulticast mode [ 423.475035][T14980] bond8: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 423.475056][T14980] bond8: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 423.523293][T14980] bond8: (slave ipvlan2): Error -95 calling set_mac_address [ 423.703497][T14999] FAULT_INJECTION: forcing a failure. [ 423.703497][T14999] name failslab, interval 1, probability 0, space 0, times 0 [ 423.703530][T14999] CPU: 0 UID: 0 PID: 14999 Comm: syz.0.3237 Not tainted syzkaller #0 PREEMPT(full) [ 423.703552][T14999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 423.703564][T14999] Call Trace: [ 423.703572][T14999] [ 423.703580][T14999] dump_stack_lvl+0xe8/0x150 [ 423.703614][T14999] should_fail_ex+0x410/0x560 [ 423.703646][T14999] should_failslab+0xa8/0x100 [ 423.703674][T14999] ? dst_alloc+0x105/0x170 [ 423.703697][T14999] kmem_cache_alloc_noprof+0xa1/0x600 [ 423.703722][T14999] ? dst_alloc+0x105/0x170 [ 423.703751][T14999] dst_alloc+0x105/0x170 [ 423.703779][T14999] ip_route_input_rcu+0x20ca/0x3190 [ 423.703816][T14999] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 423.703874][T14999] ? ip_route_input_noref+0xad/0x270 [ 423.703903][T14999] ip_route_input_noref+0x17c/0x270 [ 423.703932][T14999] ? __pfx_ip_route_input_noref+0x10/0x10 [ 423.703966][T14999] ? ipt_do_table+0x2b9/0x15d0 [ 423.703987][T14999] ? __pfx_ipt_do_table+0x10/0x10 [ 423.704009][T14999] ip_rcv_finish_core+0x593/0x1c00 [ 423.704044][T14999] ip_rcv_finish+0x14c/0x2a0 [ 423.704068][T14999] NF_HOOK+0x336/0x3c0 [ 423.704091][T14999] ? __pfx_ip_rcv_finish+0x10/0x10 [ 423.704111][T14999] ? NF_HOOK+0x9e/0x3c0 [ 423.704130][T14999] ? __pfx_NF_HOOK+0x10/0x10 [ 423.704153][T14999] ? __pfx_ip_rcv_finish+0x10/0x10 [ 423.704181][T14999] ? netif_receive_skb+0x102/0xbf0 [ 423.704206][T14999] ? __pfx_ip_rcv+0x10/0x10 [ 423.704225][T14999] netif_receive_skb+0x45b/0xbf0 [ 423.704257][T14999] ? __pfx_netif_receive_skb+0x10/0x10 [ 423.704286][T14999] ? rcu_is_watching+0x16/0xb0 [ 423.704311][T14999] ? tun_rx_batched+0x185/0x790 [ 423.704339][T14999] tun_rx_batched+0x1de/0x790 [ 423.704371][T14999] ? __pfx_tun_rx_batched+0x10/0x10 [ 423.704398][T14999] ? lock_acquire+0x115/0x350 [ 423.704427][T14999] ? tun_get_user+0x1d3f/0x4450 [ 423.704462][T14999] ? __local_bh_enable_ip+0xd6/0x140 [ 423.704494][T14999] tun_get_user+0x2bb1/0x4450 [ 423.704526][T14999] ? tun_get_user+0x27a6/0x4450 [ 423.704564][T14999] ? aa_file_perm+0x4ed/0x15f0 [ 423.704583][T14999] ? __pfx_tun_get_user+0x10/0x10 [ 423.704611][T14999] ? __lock_acquire+0x747/0x2de0 [ 423.704647][T14999] ? ref_tracker_alloc+0x341/0x4b0 [ 423.704675][T14999] ? lock_acquire+0x115/0x350 [ 423.704697][T14999] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 423.704727][T14999] ? lock_acquire+0x115/0x350 [ 423.704748][T14999] ? tun_get+0x1c/0x2f0 [ 423.704780][T14999] ? tun_get+0x1c/0x2f0 [ 423.704804][T14999] ? tun_get+0x1c/0x2f0 [ 423.704834][T14999] tun_chr_write_iter+0x113/0x200 [ 423.704863][T14999] vfs_write+0x612/0xba0 [ 423.704894][T14999] ? __pfx_vfs_write+0x10/0x10 [ 423.704925][T14999] ? __fget_files+0x2a/0x420 [ 423.704954][T14999] ksys_write+0x150/0x270 [ 423.704978][T14999] ? __pfx_ksys_write+0x10/0x10 [ 423.705011][T14999] do_syscall_64+0x166/0x520 [ 423.705036][T14999] ? trace_irq_disable+0x3b/0x140 [ 423.705057][T14999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.705077][T14999] ? clear_bhb_loop+0x70/0xc0 [ 423.705101][T14999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.705120][T14999] RIP: 0033:0x7f62a575ed8e [ 423.705138][T14999] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 423.705154][T14999] RSP: 002b:00007f62a6700fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 423.705175][T14999] RAX: ffffffffffffffda RBX: 00007f62a67016c0 RCX: 00007f62a575ed8e [ 423.705190][T14999] RDX: 0000000000000086 RSI: 00002000000010c0 RDI: 00000000000000c8 [ 423.705202][T14999] RBP: 00007f62a6701090 R08: 0000000000000000 R09: 0000000000000000 [ 423.705214][T14999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 423.705226][T14999] R13: 00007f62a5a26038 R14: 00007f62a5a25fa0 R15: 00007fff96d2e288 [ 423.705259][T14999] [ 424.284689][T15010] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3238'. [ 424.415422][T15020] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3243'. [ 425.393720][T15070] Bluetooth: hci0: unsupported parameter 5135 [ 425.393746][T15070] Bluetooth: hci0: unsupported parameter 8192 [ 425.393765][T15070] Bluetooth: hci0: unsupported parameter 5135 [ 425.393778][T15070] Bluetooth: hci0: unsupported parameter 8192 [ 425.914244][T15108] netlink: 'syz.1.3268': attribute type 1 has an invalid length. [ 426.124510][T15114] __nla_validate_parse: 1 callbacks suppressed [ 426.124533][T15114] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3271'. [ 426.185329][T15120] netlink: 'syz.0.3269': attribute type 10 has an invalid length. [ 426.185586][T15120] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.186285][T15120] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.274097][T15121] FAULT_INJECTION: forcing a failure. [ 426.274097][T15121] name failslab, interval 1, probability 0, space 0, times 0 [ 426.274135][T15121] CPU: 0 UID: 0 PID: 15121 Comm: syz.0.3269 Not tainted syzkaller #0 PREEMPT(full) [ 426.274159][T15121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 426.274173][T15121] Call Trace: [ 426.274182][T15121] [ 426.274192][T15121] dump_stack_lvl+0xe8/0x150 [ 426.274231][T15121] should_fail_ex+0x410/0x560 [ 426.274269][T15121] should_failslab+0xa8/0x100 [ 426.274301][T15121] ? skb_clone+0x212/0x3a0 [ 426.274326][T15121] kmem_cache_alloc_noprof+0xa1/0x600 [ 426.274354][T15121] ? skb_clone+0x212/0x3a0 [ 426.274387][T15121] skb_clone+0x212/0x3a0 [ 426.274416][T15121] __netlink_deliver_tap+0x413/0x860 [ 426.274457][T15121] ? netlink_deliver_tap+0x2e/0x1b0 [ 426.274487][T15121] netlink_deliver_tap+0x19c/0x1b0 [ 426.274516][T15121] netlink_unicast+0x8c1/0xa80 [ 426.274561][T15121] netlink_sendmsg+0x813/0xb40 [ 426.274600][T15121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 426.274638][T15121] ? apparmor_socket_sendmsg+0x98/0x360 [ 426.274667][T15121] ? lock_acquire+0x115/0x350 [ 426.274693][T15121] ? __pfx_netlink_sendmsg+0x10/0x10 [ 426.274720][T15121] sock_sendmsg_nosec+0x13a/0x180 [ 426.274754][T15121] sock_write_iter+0x2de/0x3e0 [ 426.274784][T15121] ? __pfx_sock_write_iter+0x10/0x10 [ 426.274822][T15121] ? bpf_lsm_file_permission+0x9/0x20 [ 426.274842][T15121] ? security_file_permission+0x75/0x260 [ 426.274889][T15121] vfs_write+0x612/0xba0 [ 426.274926][T15121] ? __pfx_vfs_write+0x10/0x10 [ 426.274962][T15121] ? __fget_files+0x2a/0x420 [ 426.274994][T15121] ksys_write+0x150/0x270 [ 426.275021][T15121] ? __pfx_ksys_write+0x10/0x10 [ 426.275059][T15121] do_syscall_64+0x166/0x520 [ 426.275084][T15121] ? trace_irq_disable+0x3b/0x140 [ 426.275109][T15121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.275132][T15121] ? clear_bhb_loop+0x70/0xc0 [ 426.275160][T15121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.275183][T15121] RIP: 0033:0x7f62a579e559 [ 426.275203][T15121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.275223][T15121] RSP: 002b:00007f62a66e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 426.275248][T15121] RAX: ffffffffffffffda RBX: 00007f62a5a26090 RCX: 00007f62a579e559 [ 426.275264][T15121] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000004 [ 426.275278][T15121] RBP: 00007f62a66e0090 R08: 0000000000000000 R09: 0000000000000000 [ 426.275292][T15121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.275306][T15121] R13: 00007f62a5a26128 R14: 00007f62a5a26090 R15: 00007fff96d2e288 [ 426.275343][T15121] [ 426.321513][T15121] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3269'. [ 426.369980][T15120] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.370515][T15120] bridge0: port 2(bridge_slave_1) entered forwarding state [ 426.371346][T15120] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.371678][T15120] bridge0: port 1(bridge_slave_0) entered forwarding state [ 426.598075][T15120] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 426.599123][T15121] bridge_slave_1: left promiscuous mode [ 426.599530][T15121] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.633884][T15125] FAULT_INJECTION: forcing a failure. [ 426.633884][T15125] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 426.633919][T15125] CPU: 1 UID: 0 PID: 15125 Comm: syz.4.3273 Not tainted syzkaller #0 PREEMPT(full) [ 426.633944][T15125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 426.633958][T15125] Call Trace: [ 426.633967][T15125] [ 426.633977][T15125] dump_stack_lvl+0xe8/0x150 [ 426.634020][T15125] should_fail_ex+0x410/0x560 [ 426.634058][T15125] _copy_to_user+0x31/0xb0 [ 426.634095][T15125] simple_read_from_buffer+0xe1/0x170 [ 426.634134][T15125] proc_fail_nth_read+0x1bb/0x230 [ 426.634156][T15125] ? common_file_perm+0x20e/0x2b0 [ 426.634189][T15125] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 426.634216][T15125] ? rw_verify_area+0x24a/0x4c0 [ 426.634236][T15125] ? tun_chr_write_iter+0x18a/0x200 [ 426.634264][T15125] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 426.634288][T15125] vfs_read+0x213/0xa80 [ 426.634314][T15125] ? __pfx___mutex_lock+0x10/0x10 [ 426.634339][T15125] ? __pfx_vfs_read+0x10/0x10 [ 426.634362][T15125] ? __fget_files+0x2a/0x420 [ 426.634386][T15125] ? __fget_files+0x3a2/0x420 [ 426.634403][T15125] ? __fget_files+0x2a/0x420 [ 426.634431][T15125] ksys_read+0x150/0x270 [ 426.634455][T15125] ? __pfx_ksys_read+0x10/0x10 [ 426.634489][T15125] do_syscall_64+0x166/0x520 [ 426.634512][T15125] ? trace_irq_disable+0x3b/0x140 [ 426.634536][T15125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.634559][T15125] ? clear_bhb_loop+0x70/0xc0 [ 426.634586][T15125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.634610][T15125] RIP: 0033:0x7f5d7595ed8e [ 426.634630][T15125] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 426.634649][T15125] RSP: 002b:00007f5d767e0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 426.634673][T15125] RAX: ffffffffffffffda RBX: 00007f5d767e16c0 RCX: 00007f5d7595ed8e [ 426.634690][T15125] RDX: 000000000000000f RSI: 00007f5d767e10a0 RDI: 0000000000000003 [ 426.634705][T15125] RBP: 00007f5d767e1090 R08: 0000000000000000 R09: 0000000000000000 [ 426.634719][T15125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.634733][T15125] R13: 00007f5d75c26038 R14: 00007f5d75c25fa0 R15: 00007ffde4695818 [ 426.634769][T15125] [ 426.636761][T15121] bridge_slave_0: left allmulticast mode [ 426.636787][T15121] bridge_slave_0: left promiscuous mode [ 426.647871][T15121] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.923733][T15121] bond0: (slave bridge0): Releasing backup interface [ 427.109143][T15131] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3274'. [ 427.162851][T15131] 8021q: adding VLAN 0 to HW filter on device bond7 [ 427.192022][T15131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3274'. [ 427.194858][T15138] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3277'. [ 427.236010][T15142] netlink: 'syz.1.3276': attribute type 10 has an invalid length. [ 427.250314][T15131] ipvlan2: entered allmulticast mode [ 427.250731][T15131] bond7: entered allmulticast mode [ 427.251051][T15131] bond7: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 427.251072][T15131] bond7: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 427.252111][T15131] bond7: (slave ipvlan2): Error -95 calling set_mac_address [ 427.337912][T15146] FAULT_INJECTION: forcing a failure. [ 427.337912][T15146] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 427.337951][T15146] CPU: 1 UID: 0 PID: 15146 Comm: syz.2.3279 Not tainted syzkaller #0 PREEMPT(full) [ 427.337975][T15146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 427.337989][T15146] Call Trace: [ 427.337999][T15146] [ 427.338008][T15146] dump_stack_lvl+0xe8/0x150 [ 427.338060][T15146] should_fail_ex+0x410/0x560 [ 427.338096][T15146] prepare_alloc_pages+0x223/0x600 [ 427.338133][T15146] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 427.338167][T15146] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 427.338194][T15146] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 427.338227][T15146] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 427.338260][T15146] ? __pfx_policy_nodemask+0x10/0x10 [ 427.338290][T15146] ? __get_vm_area_node+0x155/0x2f0 [ 427.338309][T15146] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 427.338332][T15146] ? __vmalloc_noprof+0xd2/0x120 [ 427.338357][T15146] __alloc_pages_noprof+0x10/0x100 [ 427.338386][T15146] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 427.338423][T15146] ? alloc_pages_noprof+0x140/0x2b0 [ 427.338460][T15146] __kasan_populate_vmalloc+0xb7/0x1c0 [ 427.338494][T15146] alloc_vmap_area+0xd1a/0x1420 [ 427.338545][T15146] ? __pfx_alloc_vmap_area+0x10/0x10 [ 427.338577][T15146] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 427.338606][T15146] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 427.338632][T15146] ? __get_vm_area_node+0x155/0x2f0 [ 427.338658][T15146] __get_vm_area_node+0x200/0x2f0 [ 427.338688][T15146] __vmalloc_node_range_noprof+0x343/0x1540 [ 427.338714][T15146] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 427.338744][T15146] ? __lock_acquire+0x747/0x2de0 [ 427.338797][T15146] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 427.338833][T15146] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 427.338859][T15146] __vmalloc_noprof+0xd2/0x120 [ 427.338883][T15146] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 427.338914][T15146] bpf_prog_alloc_no_stats+0x47/0x560 [ 427.338941][T15146] ? bpf_prog_alloc+0x2a/0x1a0 [ 427.338973][T15146] bpf_prog_alloc+0x3c/0x1a0 [ 427.339003][T15146] bpf_prog_load+0x7f8/0x1c20 [ 427.339055][T15146] ? __pfx_bpf_prog_load+0x10/0x10 [ 427.339112][T15146] __sys_bpf+0xd0d/0xd90 [ 427.339150][T15146] ? __pfx___sys_bpf+0x10/0x10 [ 427.339190][T15146] ? __fget_files+0x2a/0x420 [ 427.339231][T15146] ? ksys_write+0x242/0x270 [ 427.339275][T15146] ? __pfx_ksys_write+0x10/0x10 [ 427.339306][T15146] __x64_sys_bpf+0xba/0xd0 [ 427.339335][T15146] do_syscall_64+0x166/0x520 [ 427.339360][T15146] ? trace_irq_disable+0x3b/0x140 [ 427.339384][T15146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.339408][T15146] ? clear_bhb_loop+0x70/0xc0 [ 427.339435][T15146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.339458][T15146] RIP: 0033:0x7fc86ed9e559 [ 427.339479][T15146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 427.339498][T15146] RSP: 002b:00007fc86fd29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 427.339523][T15146] RAX: ffffffffffffffda RBX: 00007fc86f025fa0 RCX: 00007fc86ed9e559 [ 427.339540][T15146] RDX: 0000000000000090 RSI: 0000200000000300 RDI: 0000000000000005 [ 427.339555][T15146] RBP: 00007fc86fd29090 R08: 0000000000000000 R09: 0000000000000000 [ 427.339569][T15146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 427.339582][T15146] R13: 00007fc86f026038 R14: 00007fc86f025fa0 R15: 00007ffcdd2f7c78 [ 427.339619][T15146] [ 427.339702][T15146] syz.2.3279: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 427.339769][T15146] CPU: 1 UID: 0 PID: 15146 Comm: syz.2.3279 Not tainted syzkaller #0 PREEMPT(full) [ 427.339793][T15146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 427.339806][T15146] Call Trace: [ 427.339815][T15146] [ 427.339824][T15146] dump_stack_lvl+0xe8/0x150 [ 427.339858][T15146] warn_alloc+0x24d/0x270 [ 427.339886][T15146] ? lockdep_hardirqs_on+0x7b/0x110 [ 427.339914][T15146] ? __pfx_warn_alloc+0x10/0x10 [ 427.339938][T15146] ? kfree+0x1c5/0x650 [ 427.339966][T15146] ? __get_vm_area_node+0x219/0x2f0 [ 427.339996][T15146] __vmalloc_node_range_noprof+0x36b/0x1540 [ 427.340022][T15146] ? __lock_acquire+0x747/0x2de0 [ 427.340083][T15146] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 427.340116][T15146] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 427.340143][T15146] __vmalloc_noprof+0xd2/0x120 [ 427.340167][T15146] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 427.340197][T15146] bpf_prog_alloc_no_stats+0x47/0x560 [ 427.340223][T15146] ? bpf_prog_alloc+0x2a/0x1a0 [ 427.340254][T15146] bpf_prog_alloc+0x3c/0x1a0 [ 427.340283][T15146] bpf_prog_load+0x7f8/0x1c20 [ 427.340328][T15146] ? __pfx_bpf_prog_load+0x10/0x10 [ 427.340382][T15146] __sys_bpf+0xd0d/0xd90 [ 427.340417][T15146] ? __pfx___sys_bpf+0x10/0x10 [ 427.340457][T15146] ? __fget_files+0x2a/0x420 [ 427.340496][T15146] ? ksys_write+0x242/0x270 [ 427.340522][T15146] ? __pfx_ksys_write+0x10/0x10 [ 427.340552][T15146] __x64_sys_bpf+0xba/0xd0 [ 427.340581][T15146] do_syscall_64+0x166/0x520 [ 427.340605][T15146] ? trace_irq_disable+0x3b/0x140 [ 427.340629][T15146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.340653][T15146] ? clear_bhb_loop+0x70/0xc0 [ 427.340681][T15146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 427.340703][T15146] RIP: 0033:0x7fc86ed9e559 [ 427.340723][T15146] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 427.340741][T15146] RSP: 002b:00007fc86fd29028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 427.340764][T15146] RAX: ffffffffffffffda RBX: 00007fc86f025fa0 RCX: 00007fc86ed9e559 [ 427.340781][T15146] RDX: 0000000000000090 RSI: 0000200000000300 RDI: 0000000000000005 [ 427.340796][T15146] RBP: 00007fc86fd29090 R08: 0000000000000000 R09: 0000000000000000 [ 427.340810][T15146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 427.340823][T15146] R13: 00007fc86f026038 R14: 00007fc86f025fa0 R15: 00007ffcdd2f7c78 [ 427.340859][T15146] [ 427.453790][T15146] Mem-Info: [ 427.453826][T15146] active_anon:6263 inactive_anon:0 isolated_anon:0 [ 427.453826][T15146] active_file:0 inactive_file:43523 isolated_file:0 [ 427.453826][T15146] unevictable:0 dirty:331 writeback:0 [ 427.453826][T15146] slab_reclaimable:11280 slab_unreclaimable:105804 [ 427.453826][T15146] mapped:29492 shmem:525 pagetables:1216 [ 427.453826][T15146] sec_pagetables:0 bounce:0 [ 427.453826][T15146] kernel_misc_reclaimable:0 [ 427.453826][T15146] free:1313332 free_pcp:10508 free_cma:0 [ 427.454049][T15146] Node 0 active_anon:25052kB inactive_anon:0kB active_file:0kB inactive_file:173888kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:117968kB dirty:1324kB writeback:0kB shmem:2100kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14180kB pagetables:4692kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 427.454207][T15146] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 427.454368][T15146] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 427.454565][T15146] lowmem_reserve[]: 0 2468 2468 2468 2468 [ 427.454683][T15146] Node 0 DMA32 free:1302812kB boost:0kB min:33984kB low:42480kB high:50976kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25052kB inactive_anon:0kB active_file:0kB inactive_file:173888kB unevictable:0kB writepending:1324kB zspages:0kB present:3129332kB managed:2527516kB mlocked:0kB bounce:0kB free_pcp:42032kB local_pcp:21188kB free_cma:0kB [ 427.454871][T15146] lowmem_reserve[]: 0 0 0 0 0 [ 427.454996][T15146] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 427.455160][T15146] lowmem_reserve[]: 0 0 0 0 0 [ 427.455286][T15146] Node 1 Normal free:3935156kB boost:0kB min:55916kB low:69892kB high:83868kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 427.467939][T15146] lowmem_reserve[]: 0 0 0 0 0 [ 427.468079][T15146] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 427.468409][T15146] Node 0 DMA32: 239*4kB (ME) 324*8kB (M) 340*16kB (M) 498*32kB (UM) 105*64kB (UME) 35*128kB (UME) 26*256kB (UME) 11*512kB (UME) 7*1024kB (UM) 5*2048kB (UME) 302*4096kB (UM) = 1302812kB [ 427.468848][T15146] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 427.469111][T15146] Node 1 Normal: 3*4kB (UM) 3*8kB (UM) 11*16kB (UM) 7*32kB (UM) 10*64kB (UM) 3*128kB (UM) 2*256kB (M) 2*512kB (M) 2*1024kB (UM) 1*2048kB (U) 959*4096kB (UM) = 3935156kB [ 427.469625][T15146] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 427.487286][T15146] Node 0 hugepages_total=4 hugepages_free=0 hugepages_surp=2 hugepages_size=2048kB [ 427.487350][T15146] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 427.487394][T15146] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 427.487444][T15146] 44044 total pagecache pages [ 427.487466][T15146] 0 pages in swap cache [ 427.487486][T15146] Free swap = 124996kB [ 427.487494][T15146] Total swap = 124996kB [ 427.487522][T15146] 2097051 pages RAM [ 427.487543][T15146] 0 pages HighMem/MovableOnly [ 427.487564][T15146] 433556 pages reserved [ 427.487585][T15146] 0 pages cma reserved [ 428.248500][T15148] sch_fq: defrate 0 ignored. [ 428.390888][T15151] netlink: 'syz.1.3281': attribute type 1 has an invalid length. [ 428.477352][T15151] 8021q: adding VLAN 0 to HW filter on device bond10 [ 428.526208][T15151] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3281'. [ 428.557882][T15163] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3282'. [ 428.557909][T15163] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3282'. [ 428.743476][T15155] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.897085][T15155] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 428.911384][T15155] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 429.101996][ C0] ------------[ cut here ]------------ [ 429.102016][ C0] sk->sk_forward_alloc [ 429.102032][ C0] WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x640/0x750, CPU#0: syz.0.3285/15173 [ 429.123423][ C0] Modules linked in: [ 429.127366][ C0] CPU: 0 UID: 0 PID: 15173 Comm: syz.0.3285 Not tainted syzkaller #0 PREEMPT(full) [ 429.136844][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 429.147000][ C0] RIP: 0010:inet_sock_destruct+0x640/0x750 [ 429.152937][ C0] Code: 0f 0b 90 e9 43 fe ff ff e8 ad dc 66 f7 90 0f 0b 90 e9 76 fe ff ff e8 9f dc 66 f7 90 0f 0b 90 e9 9c fe ff ff e8 91 dc 66 f7 90 <0f> 0b 90 e9 c2 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 80 fc [ 429.172667][ C0] RSP: 0018:ffffc90000007d08 EFLAGS: 00010246 [ 429.178793][ C0] RAX: ffffffff8a6132af RBX: dffffc0000000000 RCX: ffff88802a948000 [ 429.186875][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 429.194949][ C0] RBP: 0000000000000ffb R08: 0000000000000100 R09: 1ffff11006697564 [ 429.203020][ C0] R10: dffffc0000000000 R11: ffffed1006697565 R12: ffff8880334ba880 [ 429.211077][ C0] R13: dffffc0000000000 R14: ffff8880334bab0c R15: 1ffff11006697512 [ 429.219129][ C0] FS: 00007f62a66e06c0(0000) GS:ffff888123abf000(0000) knlGS:0000000000000000 [ 429.228161][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 429.234831][ C0] CR2: 0000200000001a80 CR3: 000000007b47e000 CR4: 00000000003526f0 [ 429.242926][ C0] Call Trace: [ 429.246245][ C0] [ 429.249138][ C0] ? inet6_cleanup_sock+0x18b/0x220 [ 429.254460][ C0] ? __pfx_tcp6_destruct_sock+0x10/0x10 [ 429.260088][ C0] __sk_destruct+0x89/0x9d0 [ 429.264680][ C0] ? __pfx___sk_destruct+0x10/0x10 [ 429.269850][ C0] ? rcu_core+0x8a8/0x1260 [ 429.274394][ C0] rcu_core+0x926/0x1260 [ 429.278714][ C0] ? __pfx_rcu_core+0x10/0x10 [ 429.283515][ C0] ? lapic_next_event+0x11/0x20 [ 429.288435][ C0] handle_softirqs+0x226/0x860 [ 429.294719][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 429.299563][ C0] __irq_exit_rcu+0xcb/0x220 [ 429.304292][ C0] irq_exit_rcu+0x9/0x30 [ 429.308587][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 429.314328][ C0] [ 429.317384][ C0] [ 429.320409][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 429.326433][ C0] RIP: 0010:unwind_next_frame+0xcb7/0x2550 [ 429.332352][ C0] Code: 4c 39 f8 0f 96 c0 20 c8 3c 01 0f 85 76 0e 00 00 48 89 d7 e8 eb 23 00 00 48 89 c3 49 bc 00 00 00 00 00 fc ff df 48 8b 44 24 20 <42> 80 3c 20 00 4d 8d 7e 48 74 08 4c 89 ff e8 56 d2 c0 00 49 89 1f [ 429.352051][ C0] RSP: 0018:ffffc90006abece8 EFLAGS: 00000202 [ 429.358176][ C0] RAX: 1ffff92000d57dc6 RBX: ffffffff816e9403 RCX: 1ffff92000d57d01 [ 429.366446][ C0] RDX: ffffc90006abede0 RSI: 0000000000000002 RDI: ffffc90006abede0 [ 429.374512][ C0] RBP: 1ffffffff2424b14 R08: ffffc90006abede8 R09: 0000000000000000 [ 429.382587][ C0] R10: ffffc90006abede8 R11: fffff52000d57dc9 R12: dffffc0000000000 [ 429.390647][ C0] R13: ffffc90006ac0000 R14: ffffc90006abede8 R15: ffffc90006ab8000 [ 429.398669][ C0] ? arch_stack_walk+0xe3/0x150 [ 429.403644][ C0] ? unwind_next_frame+0xca5/0x2550 [ 429.408907][ C0] ? __unwind_start+0xed/0x660 [ 429.413774][ C0] ? unwind_next_frame+0x8f/0x2550 [ 429.418944][ C0] __unwind_start+0x514/0x660 [ 429.423772][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 429.430013][ C0] arch_stack_walk+0xe3/0x150 [ 429.434902][ C0] ? __unwind_start+0xed/0x660 [ 429.439729][ C0] stack_trace_save+0xa9/0x100 [ 429.444625][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 429.450169][ C0] save_stack+0x122/0x230 [ 429.454635][ C0] ? __pfx_save_stack+0x10/0x10 [ 429.459537][ C0] ? __lock_acquire+0x747/0x2de0 [ 429.464615][ C0] __set_page_owner+0x8d/0x4c0 [ 429.469433][ C0] ? __pfx___set_page_owner+0x10/0x10 [ 429.474927][ C0] ? seqcount_lockdep_reader_access+0x89/0xc0 [ 429.481108][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 429.486371][ C0] post_alloc_hook+0x1f9/0x250 [ 429.491250][ C0] get_page_from_freelist+0x2209/0x2280 [ 429.496924][ C0] ? lock_acquire+0x115/0x350 [ 429.501743][ C0] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 429.507698][ C0] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 429.514150][ C0] ? __pfx_policy_nodemask+0x10/0x10 [ 429.519508][ C0] alloc_pages_mpol+0x21e/0x390 [ 429.524499][ C0] folio_alloc_mpol_noprof+0x39/0x160 [ 429.529927][ C0] shmem_alloc_and_add_folio+0x43e/0xf60 [ 429.535680][ C0] ? filemap_get_entry+0xcd/0x3f0 [ 429.540807][ C0] ? filemap_map_pages+0x1d1/0x2170 [ 429.546046][ C0] ? __pfx_filemap_get_entry+0x10/0x10 [ 429.551618][ C0] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 429.557843][ C0] ? shmem_allowable_huge_orders+0x61e/0x6c0 [ 429.563959][ C0] shmem_get_folio_gfp+0x5da/0x16d0 [ 429.569238][ C0] shmem_fault+0x179/0x390 [ 429.574531][ C0] __do_fault+0x138/0x2a0 [ 429.578932][ C0] ? do_pte_missing+0x140c/0x34b0 [ 429.584066][ C0] do_pte_missing+0x2215/0x34b0 [ 429.588984][ C0] ? handle_mm_fault+0xf1/0x3750 [ 429.594072][ C0] handle_mm_fault+0x1a53/0x3750 [ 429.599110][ C0] ? handle_mm_fault+0xf1/0x3750 [ 429.604193][ C0] ? __pfx_handle_mm_fault+0x10/0x10 [ 429.609546][ C0] ? follow_page_pte+0x748/0xf10 [ 429.614636][ C0] ? __pfx_follow_page_pte+0x10/0x10 [ 429.620001][ C0] __get_user_pages+0x1675/0x2750 [ 429.625177][ C0] populate_vma_page_range+0x2be/0x3c0 [ 429.630729][ C0] ? __pfx_populate_vma_page_range+0x10/0x10 [ 429.636764][ C0] ? down_read+0x2be/0x330 [ 429.641335][ C0] __mm_populate+0x25f/0x390 [ 429.645989][ C0] ? __pfx___mm_populate+0x10/0x10 [ 429.651254][ C0] vm_mmap_pgoff+0x353/0x4e0 [ 429.655911][ C0] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 429.661142][ C0] ? rcu_is_watching+0x16/0xb0 [ 429.665960][ C0] ? ksys_mmap_pgoff+0xf3/0x760 [ 429.670939][ C0] ? __x64_sys_mmap+0x7f/0x140 [ 429.675755][ C0] do_syscall_64+0x166/0x520 [ 429.680459][ C0] ? trace_irq_disable+0x3b/0x140 [ 429.685532][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.691712][ C0] ? clear_bhb_loop+0x70/0xc0 [ 429.696444][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.702454][ C0] RIP: 0033:0x7f62a579e559 [ 429.706916][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 429.726633][ C0] RSP: 002b:00007f62a66e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 429.735162][ C0] RAX: ffffffffffffffda RBX: 00007f62a5a26090 RCX: 00007f62a579e559 [ 429.743249][ C0] RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000200000000000 [ 429.751340][ C0] RBP: 00007f62a58358b0 R08: ffffffffffffffff R09: 0000000000000000 [ 429.759371][ C0] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 429.767465][ C0] R13: 00007f62a5a26128 R14: 00007f62a5a26090 R15: 00007fff96d2e288 [ 429.775575][ C0] [ 429.778679][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 429.786006][ C0] CPU: 0 UID: 0 PID: 15173 Comm: syz.0.3285 Not tainted syzkaller #0 PREEMPT(full) [ 429.795429][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 429.805530][ C0] Call Trace: [ 429.808872][ C0] [ 429.811762][ C0] vpanic+0x56d/0xa60 [ 429.815814][ C0] ? __pfx__printk+0x10/0x10 [ 429.820461][ C0] ? __pfx_vpanic+0x10/0x10 [ 429.825015][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 429.830398][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 429.835706][ C0] panic+0xc5/0xd0 [ 429.839499][ C0] ? __pfx_panic+0x10/0x10 [ 429.844098][ C0] __warn+0x315/0x4c0 [ 429.848162][ C0] ? inet_sock_destruct+0x640/0x750 [ 429.853431][ C0] ? inet_sock_destruct+0x640/0x750 [ 429.858695][ C0] __report_bug+0x276/0x570 [ 429.863258][ C0] ? inet_sock_destruct+0x640/0x750 [ 429.868533][ C0] ? __pfx___report_bug+0x10/0x10 [ 429.873617][ C0] ? __lock_acquire+0x747/0x2de0 [ 429.878640][ C0] ? inet_sock_destruct+0x640/0x750 [ 429.883902][ C0] report_bug+0x16b/0x220 [ 429.888297][ C0] ? inet_sock_destruct+0x640/0x750 [ 429.893555][ C0] ? inet_sock_destruct+0x642/0x750 [ 429.898814][ C0] handle_bug+0x9c/0x200 [ 429.903104][ C0] exc_invalid_op+0x1a/0x50 [ 429.907654][ C0] asm_exc_invalid_op+0x1a/0x20 [ 429.912551][ C0] RIP: 0010:inet_sock_destruct+0x640/0x750 [ 429.918421][ C0] Code: 0f 0b 90 e9 43 fe ff ff e8 ad dc 66 f7 90 0f 0b 90 e9 76 fe ff ff e8 9f dc 66 f7 90 0f 0b 90 e9 9c fe ff ff e8 91 dc 66 f7 90 <0f> 0b 90 e9 c2 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 80 fc [ 429.938082][ C0] RSP: 0018:ffffc90000007d08 EFLAGS: 00010246 [ 429.944210][ C0] RAX: ffffffff8a6132af RBX: dffffc0000000000 RCX: ffff88802a948000 [ 429.952242][ C0] RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000 [ 429.960263][ C0] RBP: 0000000000000ffb R08: 0000000000000100 R09: 1ffff11006697564 [ 429.968304][ C0] R10: dffffc0000000000 R11: ffffed1006697565 R12: ffff8880334ba880 [ 429.976394][ C0] R13: dffffc0000000000 R14: ffff8880334bab0c R15: 1ffff11006697512 [ 429.984407][ C0] ? inet_sock_destruct+0x63f/0x750 [ 429.989663][ C0] ? inet_sock_destruct+0x63f/0x750 [ 429.994907][ C0] ? inet6_cleanup_sock+0x18b/0x220 [ 430.000170][ C0] ? __pfx_tcp6_destruct_sock+0x10/0x10 [ 430.005772][ C0] __sk_destruct+0x89/0x9d0 [ 430.010314][ C0] ? __pfx___sk_destruct+0x10/0x10 [ 430.015482][ C0] ? rcu_core+0x8a8/0x1260 [ 430.019936][ C0] rcu_core+0x926/0x1260 [ 430.024240][ C0] ? __pfx_rcu_core+0x10/0x10 [ 430.028958][ C0] ? lapic_next_event+0x11/0x20 [ 430.033847][ C0] handle_softirqs+0x226/0x860 [ 430.038657][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 430.043456][ C0] __irq_exit_rcu+0xcb/0x220 [ 430.048078][ C0] irq_exit_rcu+0x9/0x30 [ 430.052362][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 430.058022][ C0] [ 430.060971][ C0] [ 430.063919][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 430.069922][ C0] RIP: 0010:unwind_next_frame+0xcb7/0x2550 [ 430.075759][ C0] Code: 4c 39 f8 0f 96 c0 20 c8 3c 01 0f 85 76 0e 00 00 48 89 d7 e8 eb 23 00 00 48 89 c3 49 bc 00 00 00 00 00 fc ff df 48 8b 44 24 20 <42> 80 3c 20 00 4d 8d 7e 48 74 08 4c 89 ff e8 56 d2 c0 00 49 89 1f [ 430.095483][ C0] RSP: 0018:ffffc90006abece8 EFLAGS: 00000202 [ 430.101587][ C0] RAX: 1ffff92000d57dc6 RBX: ffffffff816e9403 RCX: 1ffff92000d57d01 [ 430.109579][ C0] RDX: ffffc90006abede0 RSI: 0000000000000002 RDI: ffffc90006abede0 [ 430.117580][ C0] RBP: 1ffffffff2424b14 R08: ffffc90006abede8 R09: 0000000000000000 [ 430.125582][ C0] R10: ffffc90006abede8 R11: fffff52000d57dc9 R12: dffffc0000000000 [ 430.133584][ C0] R13: ffffc90006ac0000 R14: ffffc90006abede8 R15: ffffc90006ab8000 [ 430.141606][ C0] ? arch_stack_walk+0xe3/0x150 [ 430.146515][ C0] ? unwind_next_frame+0xca5/0x2550 [ 430.151755][ C0] ? __unwind_start+0xed/0x660 [ 430.156557][ C0] ? unwind_next_frame+0x8f/0x2550 [ 430.161703][ C0] __unwind_start+0x514/0x660 [ 430.166437][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 430.172630][ C0] arch_stack_walk+0xe3/0x150 [ 430.177346][ C0] ? __unwind_start+0xed/0x660 [ 430.182151][ C0] stack_trace_save+0xa9/0x100 [ 430.186950][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 430.192435][ C0] save_stack+0x122/0x230 [ 430.196805][ C0] ? __pfx_save_stack+0x10/0x10 [ 430.201704][ C0] ? __lock_acquire+0x747/0x2de0 [ 430.206687][ C0] __set_page_owner+0x8d/0x4c0 [ 430.211485][ C0] ? __pfx___set_page_owner+0x10/0x10 [ 430.216889][ C0] ? seqcount_lockdep_reader_access+0x89/0xc0 [ 430.223008][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 430.228272][ C0] post_alloc_hook+0x1f9/0x250 [ 430.233071][ C0] get_page_from_freelist+0x2209/0x2280 [ 430.238677][ C0] ? lock_acquire+0x115/0x350 [ 430.243442][ C0] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 430.249414][ C0] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 430.255826][ C0] ? __pfx_policy_nodemask+0x10/0x10 [ 430.261173][ C0] alloc_pages_mpol+0x21e/0x390 [ 430.266115][ C0] folio_alloc_mpol_noprof+0x39/0x160 [ 430.271595][ C0] shmem_alloc_and_add_folio+0x43e/0xf60 [ 430.277382][ C0] ? filemap_get_entry+0xcd/0x3f0 [ 430.282552][ C0] ? filemap_map_pages+0x1d1/0x2170 [ 430.287797][ C0] ? __pfx_filemap_get_entry+0x10/0x10 [ 430.293294][ C0] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 430.299497][ C0] ? shmem_allowable_huge_orders+0x61e/0x6c0 [ 430.305514][ C0] shmem_get_folio_gfp+0x5da/0x16d0 [ 430.310769][ C0] shmem_fault+0x179/0x390 [ 430.315219][ C0] __do_fault+0x138/0x2a0 [ 430.319578][ C0] ? do_pte_missing+0x140c/0x34b0 [ 430.324655][ C0] do_pte_missing+0x2215/0x34b0 [ 430.329569][ C0] ? handle_mm_fault+0xf1/0x3750 [ 430.334664][ C0] handle_mm_fault+0x1a53/0x3750 [ 430.339720][ C0] ? handle_mm_fault+0xf1/0x3750 [ 430.344773][ C0] ? __pfx_handle_mm_fault+0x10/0x10 [ 430.350111][ C0] ? follow_page_pte+0x748/0xf10 [ 430.355093][ C0] ? __pfx_follow_page_pte+0x10/0x10 [ 430.360434][ C0] __get_user_pages+0x1675/0x2750 [ 430.365526][ C0] populate_vma_page_range+0x2be/0x3c0 [ 430.371021][ C0] ? __pfx_populate_vma_page_range+0x10/0x10 [ 430.377034][ C0] ? down_read+0x2be/0x330 [ 430.381493][ C0] __mm_populate+0x25f/0x390 [ 430.386159][ C0] ? __pfx___mm_populate+0x10/0x10 [ 430.391338][ C0] vm_mmap_pgoff+0x353/0x4e0 [ 430.395970][ C0] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 430.401150][ C0] ? rcu_is_watching+0x16/0xb0 [ 430.405963][ C0] ? ksys_mmap_pgoff+0xf3/0x760 [ 430.410860][ C0] ? __x64_sys_mmap+0x7f/0x140 [ 430.415656][ C0] do_syscall_64+0x166/0x520 [ 430.420275][ C0] ? trace_irq_disable+0x3b/0x140 [ 430.425336][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.431443][ C0] ? clear_bhb_loop+0x70/0xc0 [ 430.436173][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.442110][ C0] RIP: 0033:0x7f62a579e559 [ 430.446559][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 430.466453][ C0] RSP: 002b:00007f62a66e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 430.474941][ C0] RAX: ffffffffffffffda RBX: 00007f62a5a26090 RCX: 00007f62a579e559 [ 430.482960][ C0] RDX: 0000000000000003 RSI: 0000000000b36000 RDI: 0000200000000000 [ 430.490970][ C0] RBP: 00007f62a58358b0 R08: ffffffffffffffff R09: 0000000000000000 [ 430.498985][ C0] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000 [ 430.506997][ C0] R13: 00007f62a5a26128 R14: 00007f62a5a26090 R15: 00007fff96d2e288 [ 430.515028][ C0] [ 430.518714][ C0] Kernel Offset: disabled [ 430.523066][ C0] Rebooting in 86400 seconds..