last executing test programs: 7m19.100897055s ago: executing program 3 (id=3426): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000500)=0xd79d, 0x4) write(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x7fff}, &(0x7f0000000200)=0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x14, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf26}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x6, 0x9, 0x0, 0x1, 0xf9ffffff}, {0x66, 0x0, 0x0, 0x256c7520}}, [@printk={@s, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xcb}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='GPL\x00', 0xffff, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r6) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r6, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r9, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x8004) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000780)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r12, &(0x7f0000000a00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000880)={0x124, 0x0, 0x8, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x28008816}, 0x4040000) sendmsg$NL80211_CMD_REGISTER_FRAME(r12, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r2, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 7m18.321858141s ago: executing program 3 (id=3429): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x24040040) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000280)="d5", 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 7m18.279190035s ago: executing program 4 (id=3430): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @none, 0xff}, 0xa) connect$bt_rfcomm(r0, 0x0, 0x0) 7m18.22639261s ago: executing program 2 (id=3431): r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0xb, 0x3}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r1, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd"], 0xfce) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000072000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r6, 0x0, 0xac, 0x0, &(0x7f0000000480)="00000000000000da5709ea6255714dd362cd43741a7163f736ab745264f2653ef8d97745eafb60b05a97f66fd018c628e3e12a8e921ed0f3c35db03a4aeb911b5f4ca7db22d6e444f4e242136016dda5247f7958e7ecba84117916fa94e9db7c43260c324f8a4a893dfd2424199b12afad411ee465556a4e323269c014a9d9a74d69d4bc9a093eeb56ffbe89dba865d1a6ae87c86b6e7dc53115f6f512d096df57be85dac7d0deee5329946c", 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x50) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000bc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000b80)={&(0x7f0000001a40)={0x418, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@ETHTOOL_A_FEATURES_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x9a}]}, @ETHTOOL_A_FEATURES_WANTED={0xc4, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x0, 0x3, 0x0, 0x1, [{0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0xf813}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\'\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '*\'\\(\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_VALUE]}]}]}, @ETHTOOL_A_FEATURES_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @ETHTOOL_A_FEATURES_WANTED={0x104, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x3c, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}]}]}, @ETHTOOL_A_BITSET_BITS={0xbc, 0x3, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xb, 0x2, '&-(]{+\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, 'GPL\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '!\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x994}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '/,#\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9806}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x2}]}, @ETHTOOL_A_FEATURES_HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'tunl0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_FEATURES_WANTED={0x0, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x0, 0x4, "26529b526d3c6768b842f9bd8fbda5bd5abab3a7d3131b3886785004d560430463d8e6ca105d7581e178e2e24ba58516332b638a9f"}, @ETHTOOL_A_BITSET_SIZE={0x0, 0x2, 0x7}, @ETHTOOL_A_BITSET_VALUE={0x0, 0x4, "65c04cce391245d9831c8ba832f4f63970e124c4694a300555d64bb68436d342f0e346291340dccb0ab320c774040db9528f6f24dbd9a8611cdc3ea069cebca43275c5455ce5a767d740e9333f9120dff12bbb3e207484fe53318c896039a38217b6aae3a0bea9bc00478df5a057f4f72ebfbd11d18452f40c5e29aac017b977a5b553ff18c0f8a08b9ed2a294018e59b387348fc775a11c1407376d8db7d19fef2080556159456b8974c3c5f60c20a7115f67fe6b441aa76928b4510a86f31ea84b170cfcd1205bc08abdc206cc38e62e0d082744a02db4b17e6e338e46aa2f25954d71821fdad699a71c107bacffd5c56c65a287d7b0fa92"}, @ETHTOOL_A_BITSET_SIZE, @ETHTOOL_A_BITSET_MASK={0x0, 0x5, "fe14b2377c92f0a4a0a5a5c6e32b9c77cdca1267481c8b3b19f075d9672bfd8ada1e9d512306242d1c6d5cc2c4e81ca16149389a16cfc12f29b703087f7791f4fcdeb05f3b152aaa1bf32a4663cd2af0497cd7d75ccdbab8765317946006249b800d746cd28985c28701c0aec2991a22e30028ce79e0330b264ecc25d6222a67318f28fa"}, @ETHTOOL_A_BITSET_SIZE={0x0, 0x2, 0xfffffffc}, @ETHTOOL_A_BITSET_VALUE={0x0, 0x4, "ecc873695531670fb6eea2895e4a1d51b868f230d63d4fd97ddb4a4f69d3c22366cf6b13ecc661d7c1c1421ab01bf39446d5633fd62b69951ba8b53049f2bb3ddfb6007d76d6a1f6bc42d1a755a43d551095"}, @ETHTOOL_A_BITSET_BITS={0x0, 0x3, 0x0, 0x1, [{0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '/\'!\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '}-!%{\x00'}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\'\x00'}]}, {}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x5}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0xfffffffe}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '.-$-))*\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '):\x00'}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x6}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '/,#\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '/,#\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0xc35}, @ETHTOOL_A_BITSET_BIT_INDEX, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x8}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '/dev/net/tun\x00'}]}]}, @ETHTOOL_A_BITSET_MASK={0x0, 0x5, "ab74c29e4da1b01b4c90a1bc1a2a9c29c515c9ffe10a1a61d37e1935e140ddb76b9650177c8509f2c7b3b43b296a31628f62d77839dccbba03160850cfc92247b3cbbb466b4c0564783a751331c87ae737cc8f5c0287b4d164926d581a565b916f6c8efae5bc2ae87054"}]}, @ETHTOOL_A_FEATURES_WANTED={0x1c4, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x3}, @ETHTOOL_A_BITSET_MASK={0xc2, 0x5, "498cb19d01a568012edb3b9549f0d21c6700c77f1a282650a679db9eec1822279e5d188675c0970839fda483ce7d63ce3b08e3bb78def81f6c3e8f6cf19c4f099d88ade3f2ba713c6a898b4cae081ee0f84afaf94362b4cef0b9365bae4a4eda4e19034b6e2a0e45a05ddd7fa1f5a643567d0712482f4f6c13cc72243e0850e20ae97ac7183bf7b85f8faec9fb91351d099f9e2f9de6d2bc08fd475a955246ae6eea25a80e0d97f8f395cde3e851ff6e9242a92974052658270816c14597"}, @ETHTOOL_A_BITSET_MASK={0xee, 0x5, "dd387572b8c0df75e989507472ee795d67e6545e48a246b037a89cfcdea155451256cf82b00974f9b51d3f03602beb15dd0a2b687dc058a227b5afcaab3f05965d636487f08e4abc73584723b604f742679340aa19477bd850a0f6492a6bde7ebf0960857d2ee6f6084c2a1cfdb0780f53b61b547d9482fc75c0db5e4ef8d09e87cd0ba2140097739a7b2655732668a4c80327fb0f203b45002589e37fa9f818b67a643a442887eceb92b432579d65191059e2de9a1c9b5159d5f76ce189e406af476a015ac64df5d0d553a30d5b2eba13c1e9a8013db13184a21f6bafea5c5bf5ed0f8d569af10ca61c"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x418}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004003) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) r8 = socket(0x28, 0x5, 0x0) read(r3, &(0x7f0000000c00)=""/96, 0x60) r9 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r9, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001ac0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000400000000000e1ff95000000000000002ba76bb3019c1341056bd8174b79603123751c4e345c652fbc1626cca2a2ad75806150ae0209e62751ee00aa19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac05c04683712a0b09ec39e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e468eea3fcfcf498278a315f5b87e1c26433a8acd715f5888b2007f00000000000000000100000000000000010015d60605000053350000000034a70c2ab40c7cf5691db43a5c00000000000000f030007ce2c6f800000000000000e75a89faff01218087560cce39bf405f1e846c1242000000000040cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bef5d7d617da7a6520655a805608df4d431623c850af895abba14f6fbd7fb5e22431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf050000008600a62e96b7cb8e52cbdc2ba9d580609e31c30879d6fce424c2208af6c3784a1975fa657de38a3a32e4fd67ce446adb431d07db79241aca1dd9ba02453bbb5ee8babe1745e645f091231b986e952afdac972f342c6f184777d05d988d6edc71df0100000013a38300cabf2b554380ad215c789bef4cc574109b8df8d9a9db669557b3809d8c396d2c0361629d1822f722ec23812770d72cd00100000078a75dea785be550dbb420287e0789b8c7044f563a1f68d4efe895fdbc463f747c08f5010586903500000000000000e800000000000000000000000000000000000000003ddf4aa4b1c8b8a0ae6fb5425f1d581961471cdb51f8940290e99ccff4123fad5267fe4a75c11448741f064fc7ce7e62ee4df874e086287547d409baeec9f1538ee25a2a5ccf4a9b604e88e12ff25184d4e3c6f7f623559435b2c505fb711300000000040000000000000000000000000000e67ccc02148a4fc43021cce9f24f4b2f9492c32e7a92a557ac2b44b84e88bbf7a49789906d923e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd029406000000433f5c899119ec0c0acef5385c5a2720caeb68f1e9c05b0591d89467ded84da092dea262e51811e2d7fa515722516bd5ef6c8c4966e5937562a5648a696ad3a042a7097ddefe0671a5767014b09ddbf69b78f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb32879d326497e21e041254f06bd7f3a067e147e82e841dba3867da8bfbc101d3960e07d282f483e7b49991be06b950ccd48f4e49833f3c4a02bbd06c84680549f9eb16682ecb722e8ffaca907a3eaaebfc8e0a47c0076d7cc9d32b3cc96aa751d890881c3c33bd91f6ecf45ab3f12f816318346f9b883427b9190024edc1eddd68f34ce3bfedb5fe5d7beae4d3ca561e37570587783f9673e7ab17f5a09efc1114777d2707d2996961203aedff1c52108d9c0d50000000000000001af42eb29d54a37be0fdfdcd74c2d859a566ee5c30677173a2592a4617ae08bec07422d52d2ba7271550a5c20e3a8d1c8c8fd3025ff00607b2249ae9a18391e01b21b36169790b8e96f7955754b6b01a75165d3573d1dec5cf1b08b6115b43203a5654cce2277eb4c02ef4817b4cb989ac178895810eff7b697f2dc9b308aa2460e3cb85cdc4833571a62bf310700000000000000cc7f923284230ada8c756096a66119d4b6b2f159585c3cf8e7bfdd619e294b1d21cd491b8cfd4a253856e485fe29c6ad177a9fb078ca905782b9ed3c30675b89a784bb8031cac0de95178a5acff029a0f0fe972df22b20afe95fba722056f94ab15f1cf605c33df627311f1b614684d5d40b88d2a810c489fc40e26af417fbd7754961841974230b98fe4c02cbc41eb1a61a4e9c19ab2362b2f0098b60cc1e4b25d5b3fe540a08e6153dd229c935846240ab79451fb359792b4c7103cd3307744477fa78dbb78512cf497dfef5d97245f4c3b34c6b89f072e381a35d1d7d3e0db5629985889ad49c5c9268d269d1e3c14c0ed4f390cd88353fd387fa"], &(0x7f0000000140)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r10, 0x0, 0x13, 0x0, &(0x7f00000005c0)="07ec0c191cd2749bf8ffc2c4257f078b3909d0", 0xfffffffffffffffd, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) listen(r9, 0x4) connect$vsock_stream(r8, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) sendmmsg(r8, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="6ff567452d54cc0c26783778eec9dc8ded24919bcd401b7cb7d66dc849685a31eccd51a5676180af5bb6ac61d689d1b0fb4da01beca89044cb52ac9cd4f5bba708238b199d08f9a306bd223383b8c13e6ee7a9bc027fc18dfb3d0dd481e590c3abe71645691a84ff01000000000000000000000000afe377c4213127d3cac6f15c745bebe8eb78503f6b63116fe4d9437baa2ef970117e1d74e70508ec92b84c5d52b74f44b4748daa", 0xa9}, {&(0x7f00000021c0)="775a816ccf3c1f75e6b195a101e9937d930f37f2ad572cfca859ee210732f575db9e94afd44a2ef9552905733b858270f83d8ad050ef48bfc63e5d22beb8af06870a4a430aced9b75a1e17ecfb30e955eb348ff1c5c354ca0caa75c7ddb755f6db61f99f90ec293539fae7895a61bbffc476b1d215b782682f71d090ade6c3f7ab349282b1a25eef77d45f1345bbb486c74566c4cb6b2bde868e632a81d70ef956fe8498fb16443c86ab52164795f0ea6b7cd6e91b3e7be8b5775b772da27d9ded602ec0312d97a0649898af46811f21f4445727faf840163940fac977b7a9e482d864cb117a71351132c3e2c556c64fa300289870a14db02ea7f076c4dd0938e9fc841590cbabc71eab8e00f9789b800372b22d62fd1d015ab5c5bfe89a1c22574bdc1b048eee853884626ce61c8ab2e28955da7822ce99647b82424c687e084b87db814d09535e3e971005f7b1c81090514408408f25d6f43f9d68609b4c1738dd8e6495c65c73ec16b11467a85d77cbcb340a0ce3ba4b4dbbabe850011848d35c5341aca12fcbdfd7567d1c6b6a7be5ea19a1178d30d306c1b3a73c59161e3dd61da4e60e3c93e464440c1f9bfe0ead26bc5c50981cb95f79e9656caf6dcc1e48582e0edf5250c86569d3b6e34ec8e871f963bc8649609fd7e2c3a4fb33456994b735900f0206f892cd1a838a18eb46be6ad8cd489b7c607386c5f997847bad6105c9b9149b08e90e5b5ce2e2bf33342266965b2b0f08c3e8ee238984d881a5f58465fd2f26d40b9cf2bd706f535eb4e2f6030fb90755ef6f23b035df0188d3f2cc90e1ef45bf256ad01647ede75429f25fe8889f167442990d1021b62c406a12bd13455f050c888ae09f51f418df266fd03cbcc2c304ccdb38b9475d1d3915607b08553add1075532ee66dd37111855d2da430f461f6093dfa1435cb71f2862f2e246ff0458af21dadafd725ae0252ccc8e3683ad9493d5a2c21c47492d96fa7c64d487acd55b4460244c727ae3242cf1a6ee6914782c199f516ba79dafafc7af4aa061a76c034ffea277f5881fb8bcf5983a1bbee88955bbc4ff192846eeaca5765ee11852127b389ce5bea82f0f8834a200835fd5080458689fe6080ad9463e398c4f2cb73a25c9734a4a9a6ccc6fd1d7f5d3e46601506656a741a54d63618ad087d80ee1887b352e907fc2fa588fb8a3d322f9f736615e094f45126d050c6b340c03467341fd19a0689bc3730b21d3f1f11626160c14d49c8396e17702b038bd5caaa48fc882e481ed6d10fffc36b3af32b23d4418cf7967a4fecdcbc9861df7bae84539f8e1942f1c6fedc0243ca386eb495c639ca90850e4a233ce7dfe1315eaac4aec560ef6f94ca21eb5da4a4b2d23102c61b115f2f5345df70818f9511c710155c26591816118124f4c0e4161b0b3836ed7c82e8a627819577bed2a8743f92de4ed2edda68dbebf0a13294a726a7fe0acae59b1118f57dc9b6a03850b259005a86c6b5e9193c6c4c28681f8ec69f1f0e536a4a841f3c2fd7ee0f617e33ad8f5f443ef2e321e9f58d069a94a1f17a5119fd4f8b0e794c808b77dc068ec54451cd378982c272c377b4845af2b75d0f6bcf3d2a1d0ef4248b613edd2536823d4f38376dfcb40ab9388dcccc5222069a8ed100386cacdf7dfed859e3f28ffb1ce270e2f9ab5c0edd6836401e5a4856681ac4f995399b2a64a8f33e471400de7dceb9a14ec4ab2fd70263036357b01dee206ec97aa198a9b6f1e85b00be20ad070d0e123b6e3f469c26b7f1f5dfbd3a42bc710c6663542d4cddf3167aef133a8bfb7dc1e09a30977e4d2f97ca8b9a8cdd7a6b278c2c19fc2c4f7dc911d95af46e22cb607f2c9d55df1d2cfbf97053bf98eb47dc485faa00d3b5474725e21338cdb995cf876935ac9f95b1d379dfba02d4687de7da9aae32137b7afbf064eb07e08cd73b240214ddd437027b6f6051afcd7a4e1db7ce084b7023f76119bdd64f21023643df87b54398cd312e04da42b6df7b95984c73611f7fd38d6303e5ff2b841b7cea88ebbe96e6792d7de2de7dcc2e4b82e3490f8cf0032e8e0691e50e88179c81f91966d4a2b321df23f0645420f0e02f19629c0d73694519d42f66e385e898696a51a9e9b77f8701e81e6bf813d92ae2509e3304ba958903748957be38e8c60f119a80a645f44ab9f65a452781ee20c2b78b701f3ee2a28a1777acbdf937a12931887b9badc64e3bdb6eb58b2d2671e8e771de5bf19bbf8dad8b8f821acfae476e366076bb81f8aa072b3bfe1f7004a712516f105d2d340c70a52254fa95b3b74fd4b4028a1d031cad8f978b9305eb57bcd6361b0a5b9deea3b4c012abaf270015d2a1e745b7bd4c5f81a784756e3055a18e64a7f17370bc4090830def453ebfd38a2f954a140cda27f8a4d77a7c9d18cc7697640a1671f10a8471a4c11efb820b660b814f67b7b3e9f948421df3e7daac16275af82d155fbc4927e6916f28179c1517a6c7acf611e626526c7e13ba99a1d6fe8866b657e1e4daae6714f6480ddcfbfa42e123cbc921cfd1ae2653adc0a44a36aa0aede889000b5a24a550a7c2117b36a0f64146a5ed6e28c9ab1aa56aa3d22024529faea93b998e62933b34832455b124f71853b1838d48c9c4d640baaed28a8ec298750f25f63f75891beec588ac81078eaa5dccd7fb40af317500db437ceeb02fd99acc2d87ea8cfab5d14cd6e8748bfb278799e713077fab96f60449747da1bafbff04714194df512f04ffdd0ac4104686244336204a85e258c2269a6d3861a8c68f07ca8ce4abb70653d83dce8b74384119ed606ad520713c6d193ad96e56f2735e19cca6cf98641f2a2aba34cc6af3c65f4464968bddc60c04c063107736269b395a14cb267df19990a4218c94946fdfe3d4c4c3577b955f782c56eb88eb4510b1d15b06dd5ac5c3d4a6d90b1fd95e2ccd0b7a655f7a148580c124ad88aa0a3c5b1ad55352aeb244830fbc4dbbd7a4d9a196c8a792a13bbd1d8422585a6bba811bc73ada4b81b28be551552e78cf820d526b696a1ec164aadda551f9ccc0e93035744483b939e6d39e3263bf189b767d15753be31217b26b9db8bdb4436527bbb535247695214f5ade653aaaea3923b3a50630ac40b45056d717504d1b213d7b9394e95874441a950f12fb4e70c27fabe23c97621777b0a35d10af73ea95cfd62fbca1217d80cf993d82ecdbc0b40eb0bfbd9a732b44079474cbb91edbbddd63829fd4e7a47b2305ccd74a93a5c14b33756153b9a2a1f98eb25c1bb8f19faae1d0ee583568199a91e28392616dd852fdc39bcaa449fa4eac9d81bd01661707748b8955a14bf1e93c9c1cd73b544f57004e414027c0d0c16cdd24e6bad6218efbbb3e628d083f8ba97e34b23117128671770fa69883caf9801d9a3c8e854b3c970c8972d4604b8a9c8cd983bd6a965276c48ec3110c6cee208899c2012fd623e36c4d64538b3d420483e46a3b2527510fc946a653e7efc20d6ed93b7d7a6c38c26d3f5af890158c37c538add299c3cbfd6f21c9cf3f1b5fc3d254a9cc9b486a902908a5ba1b71538fe9ff9f9c197810c381ef122d82ef33f923ffe6bd576f17d0a9a12817c69e86f7697d7baf0eb431ff2f537d740b9451d67d2e224402a7b8c01f6c87d3e62b674583f44e87da3a3fed37645aa70d67f02ba62c2ae1c4cf31582e55d95607aa1c5d01b8604bb1168f429a3cae1a78d758b5896b5947e8a9c1daa33f195cd7de66b8ef20e07f12feedfd002d4e727aea905b630d67a5b16a5211feb17b4e460171d07f4ac9f2a50610b021e50808e04c4057a64375664e35a9062496bb6537af8b7610b7d63ea34991cd919ba832a3ff5c49ab77351affa9d69bfa8fc05b8844dcbceff8a16b8163706c121a68da93bd9842a7130eeff2e5dee16abab095bbba24042c361c308674ace46d588f933dd9020f8ced4963ee78584dd412a885761db28fb3f3d699a27ecb3aac2cd830e1a2a12f5515e5dd3fe3a4d34b22e49ef29f6c9dd79690113464871ce3f827b5b64673f96a17d2a205af15fd055e1663163bfc0011817052d5af2573938a96f81db5c7100b6eb1036ddf43428e449076914749bd61068dd7c55ba317cbc54893d310bdad60f2ae1caf089f401caf2cb6a21bf927d26029b4b2e38c36e994428352e05bdd10db224a8c70b4fad32bc426fcd36cab3b14cbb203c728dfe5aea4cdf0f889a44d9e8ad33706dc6b86fb81b466e2e98300632d67084703052e6aed2fb4a4691908d5d9b39c81c35231697e9b04f5f252946db025f3f83aaeb77ab69a5258f713c09b44039e7c397cec896d8d481bc27906a00faa4f01c5c1c3809781639e688e743af2201254ff09b3e3efaae6b7f39b6c07e54127ba19da1ea28e368811b556e38d727ada539118dc98ec39583963fcf8536f28511af4fec6ec111981ff769965d5c53c6ee056eb534fd6e01b0ea5b38b4c6419c6ac444c2f8943320bcb88219797e89fe0e5810ab0eda80ddad2e3cdfcbdf6dab8580a8b3994e006f1443cb32c0cf4a01dbc863a8a2dd22be04e9256b1d2642b35ac3215c616dce6dcf23f6be31affb0abf279e9702e7d85acfd03ace35b547fadf659ad4e14b54f4ff63895f0a970ae184f1aeab76d5956ff395ccbe4dd9d612e512f6829d45f7237ad289551f1b75b9c29133a578e15b02a13b47f579d5834fb3fe8bbe05cf680a7b0f656369fe3b6bd5ef0bfa6a262023c14332449983e1f562f85857d5fc85c03764a31756e17722f701e085376f0624930962b73951c256eb1ec3396a8d2992295c2899f6be004b6b8e5e480bc18ea4963a217c8baeaaa19adc4fbbe9e71bb7f0dae115162e3f52bfb10cb6912826ae8c212fb1b02afba42e5959707b54bbf70f00ee0ce0e3e67568e072fffcc1edf724877fe0ff903c3377ba5a38b9bca7d187262a27295dc1312d8f102fb08d52c91dc2479af03fc19430daecc5bfb182a8ddea93c4f18fcd4b5bc7d335fdae6e337a8f8d3a2d79372018592f8a5bfcfe58b981e7cfc0cc8761ff26914321958470f82043f27a6b23a9f9000"/3608, 0xe18}], 0x2}}], 0x1, 0x4854) r11 = accept4$unix(r9, 0x0, 0x0, 0x800) recvfrom$unix(r11, &(0x7f0000000140)=""/248, 0x1ffd4, 0x0, 0x0, 0x0) 7m17.938798364s ago: executing program 4 (id=3433): socket$pppl2tp(0x18, 0x1, 0x1) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x12, r2, 0x0) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f00000042c0)={0x0, 0x0, &(0x7f0000004280)={&(0x7f0000000380)=ANY=[@ANYBLOB="84000000120035062dbd7000fedbdf25090504494e204e2004000000ab0d0000060000000e0000005f00000007000b000100000010000000", @ANYRES32=0x0, @ANYBLOB="034000007689c0240800000009000000380001000030"], 0x84}, 0x1, 0x0, 0x0, 0x40040}, 0x20000014) 7m17.938642068s ago: executing program 1 (id=3434): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x19, 0x4, 0x4, 0x2}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 7m17.863889828s ago: executing program 3 (id=3436): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x3, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = socket$inet(0x2, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) sendmsg$inet_sctp(r2, &(0x7f0000000200)={&(0x7f0000000080)=@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000100)="418206ec3ba245be4b7e23c0ef5af8873831133af803269154eda11e1fe696e99c8f850720fd811498f0d8dc501bfc7a47c8021bc3fa19ed25939dd8f42fc184eb5bb8fd0661fbca105e2b2e2154909a3ddbc3e763b08977dcb7219d0690f212915b321ce3a35d3dce4dff", 0x6b}], 0x1, &(0x7f00000001c0)=[@authinfo={0x18, 0x84, 0x6, {0x5}}], 0x18, 0x4800}, 0x40000) 7m17.718665513s ago: executing program 0 (id=3437): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0xc05, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0x18, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}]}], {0x14, 0x11, 0x1, 0x2000000, 0x0, {0x5}}}, 0x94}}, 0x0) 7m17.666443912s ago: executing program 4 (id=3438): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x3, 0x4, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000000000000000000000000000730133000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) (async) socketpair(0x22, 0x3, 0x6, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r1 = socket$packet(0x11, 0x3, 0x300) (async) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x56) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="48000000100039042bbd7000fbdbdf2500000000", @ANYRES32=r3, @ANYBLOB="01980400419a04002800128008000100736974001c00028008000300ac1414bb06000a002f0000000500050001"], 0x48}}, 0x0) (async) sendto$packet(r1, &(0x7f0000000400)="05d936277c6f5422007f83477ca1b278e3e4018a34e7bfd3de1a00ad6762646c95c716727eb53bcc", 0x28, 0x40880, &(0x7f0000000440)={0x11, 0x86dd, r3, 0x1, 0x4, 0x6, @local}, 0x14) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) (async) r6 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r6) (async) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x18, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000200000000000000fc2b000018120000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703004497b84b9cab0000000c000000b7000000000000009500000000400000"], &(0x7f0000000600)='GPL\x00', 0x6, 0x66, &(0x7f00000006c0)=""/102, 0x41100, 0x21, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe}, 0x94) (async) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@delchain={0x48, 0x64, 0xf31, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x14, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x6, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}]}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40054}, 0x4804) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'erspan0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x40, 0x20, 0x452, 0x5, {{0x19, 0x4, 0x0, 0x8, 0x64, 0x68, 0x0, 0x5, 0x2f, 0x0, @loopback, @loopback, {[@cipso={0x86, 0x4f, 0x0, [{0x5, 0x5, "d96153"}, {0x1, 0xb, "6d68e539a04d292719"}, {0x1, 0x12, "4ecfa91ed1f34369f2c5a35d23a8a368"}, {0x6, 0x12, "4d7157432a3e8e340ced691ea49014cc"}, {0x2, 0x7, "c431746787"}, {0x1, 0xe, "85baf2f05816ece0a4677da4"}]}]}}}}}) r10 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r12, r11, 0x25, 0x12, @void}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x7, 0x8, 0x1, 0x3, {{0x11, 0x4, 0x1, 0x2, 0x44, 0x66, 0x0, 0xb, 0x2f, 0x0, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0xf, 0xa7, [@multicast1, @broadcast, @remote]}, @ra={0x94, 0x4, 0x1}, @end, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0xb, 0xd3, [@rand_addr=0x64010101, @remote]}, @generic={0x86, 0xb, "2e627497062a884e89"}]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'gre0\x00', &(0x7f0000000280)={'gre0\x00', 0x0, 0x8000, 0x80, 0x2, 0x8, {{0x59, 0x4, 0x0, 0x7, 0x164, 0x65, 0x0, 0xe1, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x35}, @loopback, {[@ra={0x94, 0x4}, @timestamp={0x44, 0x18, 0xae, 0x0, 0x4, [0xd, 0x7f, 0xc6, 0x0, 0x3]}, @cipso={0x86, 0x17, 0x21a9daf576aada82, [{0x0, 0x11, "ff0df43f4d5127f336c5624a405ae6"}]}, @timestamp_addr={0x44, 0x44, 0x5b, 0x1, 0x1, [{@empty, 0x1}, {@dev={0xac, 0x14, 0x14, 0xe}, 0x3}, {@local, 0xfffffff8}, {@empty, 0x7fff}, {@empty, 0xfffffff7}, {@remote, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@dev={0xac, 0x14, 0x14, 0x14}}]}, @cipso={0x86, 0x53, 0x3, [{0x0, 0x4, "c242"}, {0x5, 0x11, "f8e15a05a20369681c6c01a5dfa46d"}, {0x0, 0x12, "6c2e4da9fafdb1fe957ad8ac9d4d2c92"}, {0x0, 0xd, "8d128939cd4e7490af2cd6"}, {0x6, 0x7, "a6798fe788"}, {0x2, 0x4, "0d1e"}, {0x0, 0x2}, {0x6, 0x6, "8e068fed"}, {0x2, 0x6, "26811464"}]}, @timestamp_addr={0x44, 0x3c, 0xfd, 0x1, 0x5, [{@multicast1, 0x3}, {@empty, 0x30}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@loopback, 0xf5}, {@dev={0xac, 0x14, 0x14, 0xe}, 0xf}, {@dev={0xac, 0x14, 0x14, 0x18}, 0x2}, {@empty, 0x2}]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x45, 0xffffffffffffffff, [{0x6, 0x12, "adf5be24950965f06aa196097c8a326f"}, {0x0, 0xd, "a57724f928d09f6622cc04"}, {0x0, 0x8, "a73d67f987ec"}, {0x1, 0x2}, {0x2, 0x12, "ccceee298c3153a6c97c5ae16a463a5b"}, {0x2, 0x4, "c4dc"}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000580)={'erspan0\x00', &(0x7f0000000540)={'tunl0\x00', 0x0, 0x8000, 0x7800, 0xfffffff7, 0x3, {{0x8, 0x4, 0x1, 0x6, 0x20, 0x64, 0x0, 0x9, 0x29, 0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x37}, {[@generic={0x86, 0x9, "dfaacba229f270"}]}}}}}) (async) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000005c0)={@loopback, @multicast1, 0x0}, &(0x7f0000000600)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000640)={'vcan0\x00', 0x0}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000740)={'tunl0\x00', &(0x7f0000000680)={'erspan0\x00', 0x0, 0x20, 0x8, 0xd, 0xd098, {{0x19, 0x4, 0x1, 0x6, 0x64, 0x66, 0x0, 0x5, 0x0, 0x0, @private=0xa010102, @private=0xa010102, {[@timestamp_addr={0x44, 0x4c, 0x57, 0x1, 0xa, [{@loopback, 0x6}, {@private=0xa010102, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@loopback, 0x2}, {@empty, 0x1}, {@broadcast, 0x80000000}, {@broadcast, 0x9}, {@empty, 0x7}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x10}]}, @end]}}}}}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000cc0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000940)={0x2e8, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0x130, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x47f}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r11}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r13}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r14}}}]}}, {{0x8, 0x1, r15}, {0x14c, 0x2, 0x0, 0x1, [{0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0xfffd, 0xd, 0x1, 0x1}, {0xa, 0x3e, 0x2, 0x7}, {0x4, 0x2, 0x8, 0x7}, {0x8, 0x8, 0x6, 0x5}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x844}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5a00}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r18}}}]}}]}, 0x2e8}, 0x1, 0x0, 0x0, 0x8025}, 0x8001) 7m17.666077146s ago: executing program 1 (id=3439): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, &(0x7f0000000500)=0xd79d, 0x4) write(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0x7fff}, &(0x7f0000000200)=0x8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x14, 0x17, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf26}, {{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x6, 0x9, 0x0, 0x1, 0xf9ffffff}, {0x66, 0x0, 0x0, 0x256c7520}}, [@printk={@s, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0x5, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xcb}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='GPL\x00', 0xffff, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r6) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r6, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x30, r9, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x8004) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000780)={'vcan0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r12, &(0x7f0000000a00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000880)={0x124, 0x0, 0x8, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg1\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x28008816}, 0x4040000) sendmsg$NL80211_CMD_REGISTER_FRAME(r12, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x48000) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r2, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r1}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 7m17.56807843s ago: executing program 0 (id=3440): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r0, &(0x7f0000002700)={0x0, 0x0, &(0x7f00000026c0)={&(0x7f0000000000)={0x20, 0x140d, 0xd15, 0x70bd2a, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x20004008) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@flushpolicy={0x38, 0x12, 0x105, 0x6, 0x25dfdbff, "", [@address_filter={0x28, 0x1a, {@in=@private=0xa010102, @in6=@mcast1, 0x2, 0xd}}]}, 0x38}, 0x1, 0xff80}, 0x20040840) 7m17.292984054s ago: executing program 0 (id=3441): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000002200000009"], 0x33) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001100)={r1, 0x0, &(0x7f00000003c0)=""/61}, 0x20) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000001a40)={&(0x7f0000001980)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001a00)={&(0x7f00000019c0)={0x40, 0x1405, 0x200, 0x70bd28, 0x25dfdbff, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x2}, {0x8}}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000c0}, 0x4008800) recvmmsg(r0, &(0x7f0000001900)=[{{&(0x7f0000000000)=@isdn, 0x80, 0x0, 0x0, &(0x7f0000001440)=""/242, 0xf2}, 0x1}, {{&(0x7f0000001540)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000001840)=[{&(0x7f00000015c0)=""/206, 0xce}, {&(0x7f00000016c0)=""/100, 0x64}, {&(0x7f0000001740)=""/199, 0xc7}], 0x3, &(0x7f0000001880)=""/118, 0x76}, 0x51}], 0x2, 0x40010002, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r0, &(0x7f0000003340)={0x0, 0x0, &(0x7f0000003300)={&(0x7f00000032c0)={0x20, 0x140e, 0x529, 0x70bd28, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x4044801}, 0x20000000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000001ac0), 0xffffffffffffffff) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r4, &(0x7f0000002980)=[{&(0x7f0000000300)=""/44, 0x2c}, {&(0x7f00000001c0)=""/95, 0x5f}, {&(0x7f0000000600)=""/4096, 0x6a9}], 0x3) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000100)=0x730) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001c80)={{0x1, 0xffffffffffffffff}, &(0x7f0000001c00), &(0x7f0000001c40)='%pK \x00'}, 0x20) write(r6, &(0x7f0000001d00)="c043b32a1b9864e0b2f58426f736a43e66ea7061684759a6675f7df2d8914eeb9ce5487ead5a1c78bff20a986f799e3e16bb74c549613bb5a47e2b46679857450aac6a046388227c0a3c75b11b3e3b8e861d6a7c308f35c34bd5af3d695420a07a0d6d189c87c455b367dfbc263bea4dc3633bbb97d76a831f14", 0x7a) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001cc0)={r6}, 0x4) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000001bc0)={&(0x7f0000001a80)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001b80)={&(0x7f0000001b00)={0x44, r3, 0x100, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x8}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x40}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x3ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x840}, 0x20000000) 7m17.202589355s ago: executing program 3 (id=3442): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=@newlink={0x44, 0x10, 0x401, 0xfffffffa, 0x25dfdbfe, {0x0, 0x0, 0x4100, 0x0, 0x1705, 0x204ee9f}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 7m17.202389833s ago: executing program 4 (id=3443): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @none, 0xff}, 0xa) connect$bt_rfcomm(r0, 0x0, 0x0) 7m16.986563664s ago: executing program 2 (id=3444): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000940)=@newqdisc={0x34, 0x24, 0xf0b, 0x70bd2e, 0x2, {0x0, 0x0, 0x12, r2, {}, {0xffff, 0xffff}, {0x2}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x7}}, @qdisc_kind_options=@q_mq={0x7}]}, 0x34}, 0x1, 0xf1ffffffffffffff, 0x0, 0x8004001}, 0x0) 7m16.706865784s ago: executing program 4 (id=3445): r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r1, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="280320000a001400000000f506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67b1678895e16f37fe839017be0e6dd0b388dd93fbeb0e7f84dba33ff97d1", 0x55, 0x400c010, &(0x7f0000000080)={0x11, 0x3, r3, 0x1, 0x6, 0x6, @multicast}, 0x14) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000880)={'syztnl1\x00', 0x0}) socket(0x10, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r1, 0x29, 0x0, 0x6, 0x7f, 0x42, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x40, 0x6, 0x41}}) (async) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00'}) (async) sendto$packet(r2, &(0x7f0000000180)="280320000a001400000000f506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67b1678895e16f37fe839017be0e6dd0b388dd93fbeb0e7f84dba33ff97d1", 0x55, 0x400c010, &(0x7f0000000080)={0x11, 0x3, r3, 0x1, 0x6, 0x6, @multicast}, 0x14) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000880)={'syztnl1\x00', 0x0}) (async) 7m16.705555119s ago: executing program 1 (id=3446): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x24040040) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000280)="d5", 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 7m16.705421842s ago: executing program 2 (id=3447): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x2c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2df31ab3}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 7m16.46308576s ago: executing program 3 (id=3448): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}}, 0x0) 7m16.368372369s ago: executing program 2 (id=3449): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendfile(r0, r1, &(0x7f0000000000)=0x7fff, 0x80000000) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r3, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=@delrng={0x10, 0x14, 0x4, 0x70bd29, 0x25dfdbfd, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000090}, 0x81) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b000000400000000000000000000400000008"], 0x50) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b000000400000000000000000000400000008"], 0x50) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) (async) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="1809000000000000000000000001000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r4, &(0x7f0000000780)}, 0x20) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2002, 0x40000002, 0x4, 0xa17433da3c5d6980, 0x2, 0x81}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e22, @empty}}, 0xfffffff8, 0x40, 0xc, 0xffffffbb, 0x40, 0x1, 0x1}, &(0x7f00000003c0)=0x9c) socket(0x10, 0x3, 0x0) (async) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000024c0)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x401, 0x70bd2a, 0xfffffffe, {0x0, 0x0, 0x0, r2, 0x4982, 0x701ca}, [@IFLA_PROTO_DOWN={0x5, 0x27, 0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0xc10}, 0x4008000) 7m16.315938941s ago: executing program 1 (id=3450): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @local}, 0xc) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000000)={0x4, {{0x2, 0x4e23, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000000000002004e23e0000002"], 0x20000) 7m16.183328693s ago: executing program 3 (id=3451): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x800000e}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r1}, 0x8) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000600)={r2, r2, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f00000001c0)={@any, 0xff, 0x5, 0x3, 0x800, 0x5, "8f1dc444b2a813bcfd8e57d84dc7115eec5fbeda733e52756349fd8d2c4fda878f0e54599180e4543cba2ef65d539ad3cd097ab0f432e66f1466ba52b445f33927335186bbab00507d36e8b17e8b3af68ca2e0d945c90c64f86ad7be6544128410589a95916675cc8006a544210f380098271a4f83f018722836306112e8b25b"}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100)={0x0, 0xffffffff}, 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x702, 0x29, 0x0, &(0x7f0000000380)="e460334470b8d480eb20c15286dda4fba8285e2e31ca72823a29dad4781041a996430bbe5ecac76a35", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)}, 0x811) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r6}, &(0x7f0000000080), &(0x7f00000001c0), 0x2000000}, 0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz0\x00', 0x1ff) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000540)={0x7, 0x7, 0x4, 0x4, 0xfff}) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4c014}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)={0x20, r8, 0x5eae78d9c54e9d3f, 0x0, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_SEC_KEY={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r10 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(r7, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, r10, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x5}, 0x840) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) recvmmsg(0xffffffffffffffff, &(0x7f0000004740)=[{{0x0, 0x0, 0x0}, 0x60}], 0x1, 0x22, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 7m16.122553587s ago: executing program 0 (id=3452): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x48}}, 0x1000000) 7m16.066031314s ago: executing program 2 (id=3453): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001080)={0x11, 0x10, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xcf, 0x0, 0x0, 0xffff, 0x4}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x20}}, [@jmp={0x5, 0x1, 0x3, 0x0, 0x0, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41000, 0x2c}, 0x94) 7m16.040545406s ago: executing program 1 (id=3454): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWCHAIN={0x6c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x4a, 0x3, "fd02b21edf8b721e23f25f47a7af48fbb07c400f2ffd8d27130601205b56f46dc2de1fa3d7afb2f185d0371736af66032ae4eed98dbb95537f4f247aa2bc4978345407669db4"}]}], {0x14}}, 0x94}}, 0x0) 7m15.926647567s ago: executing program 4 (id=3455): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)="2e00000010008188e6b62aa73f72cc9f0ba1f8481a0000005e140602000000000b000a00100000000a8000061294", 0x2e}], 0x1}, 0x0) 7m15.926366947s ago: executing program 0 (id=3456): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, @none, 0xff}, 0xa) connect$bt_rfcomm(r0, 0x0, 0x0) 7m13.287509362s ago: executing program 2 (id=3457): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f00000000c0)=0x80) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @broadcast}, 0x1, 0x0, 0x3, 0x1}}, 0x2e) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x21, 0x3, 0x280, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1b0, 0xffffffff, 0xffffffff, 0x1b0, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x4, 0x8fff, 0x3}}}, {{@ipv6={@remote, @loopback, [0x0, 0x0, 0x0, 0xffffffff], [0xff0000ff], 'batadv0\x00', 'veth1\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x2, 0x4, 0x1}, {0x1, 0x1, 0x5}, {0x1, 0x3, 0x6}, 0xfffffffa, 0xfffffff7}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e0) 7m11.114902637s ago: executing program 1 (id=3458): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05002bbd7000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="2e000e0080000000ffffffffffff08021100040008021100000000000000000002000000640001003c04000aae06000008000c006400000008000d00080000000500a3000000"], 0x64}, 0x1, 0x0, 0x0, 0x20008054}, 0x0) 7m8.522544294s ago: executing program 0 (id=3459): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x2c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2df31ab3}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 6m55.616409008s ago: executing program 32 (id=3451): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @local}, 0x800000e}, 0x1c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r1}, 0x8) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000600)={r2, r2, 0x8, 0x0, 0x0, 0x6, 0xfe, 0x10cf, 0x5, 0x5, 0x2, 0x1, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f00000001c0)={@any, 0xff, 0x5, 0x3, 0x800, 0x5, "8f1dc444b2a813bcfd8e57d84dc7115eec5fbeda733e52756349fd8d2c4fda878f0e54599180e4543cba2ef65d539ad3cd097ab0f432e66f1466ba52b445f33927335186bbab00507d36e8b17e8b3af68ca2e0d945c90c64f86ad7be6544128410589a95916675cc8006a544210f380098271a4f83f018722836306112e8b25b"}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100)={0x0, 0xffffffff}, 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x702, 0x29, 0x0, &(0x7f0000000380)="e460334470b8d480eb20c15286dda4fba8285e2e31ca72823a29dad4781041a996430bbe5ecac76a35", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)}, 0x811) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="11000000040000000400000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r6}, &(0x7f0000000080), &(0x7f00000001c0), 0x2000000}, 0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000500)='./cgroup/syz0\x00', 0x1ff) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000540)={0x7, 0x7, 0x4, 0x4, 0xfff}) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4c014}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)={0x20, r8, 0x5eae78d9c54e9d3f, 0x0, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_SEC_KEY={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r10 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(r7, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, r10, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x5}, 0x840) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) recvmmsg(0xffffffffffffffff, &(0x7f0000004740)=[{{0x0, 0x0, 0x0}, 0x60}], 0x1, 0x22, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 6m47.954615952s ago: executing program 33 (id=3458): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05002bbd7000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="2e000e0080000000ffffffffffff08021100040008021100000000000000000002000000640001003c04000aae06000008000c006400000008000d00080000000500a3000000"], 0x64}, 0x1, 0x0, 0x0, 0x20008054}, 0x0) 6m41.855499816s ago: executing program 34 (id=3457): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f00000000c0)=0x80) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @broadcast}, 0x1, 0x0, 0x3, 0x1}}, 0x2e) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000800)=@raw={'raw\x00', 0x21, 0x3, 0x280, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1b0, 0xffffffff, 0xffffffff, 0x1b0, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x4, 0x8fff, 0x3}}}, {{@ipv6={@remote, @loopback, [0x0, 0x0, 0x0, 0xffffffff], [0xff0000ff], 'batadv0\x00', 'veth1\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x2, 0x4, 0x1}, {0x1, 0x1, 0x5}, {0x1, 0x3, 0x6}, 0xfffffffa, 0xfffffff7}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e0) 6m35.684114545s ago: executing program 35 (id=3455): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)="2e00000010008188e6b62aa73f72cc9f0ba1f8481a0000005e140602000000000b000a00100000000a8000061294", 0x2e}], 0x1}, 0x0) 6m31.680524271s ago: executing program 36 (id=3459): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x4c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x2c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2df31ab3}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 4m57.711103596s ago: executing program 6 (id=3461): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}}, 0x0) 3m46.033188926s ago: executing program 9 (id=3464): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000000)={0xa, 0x4a20, 0x2, @remote, 0x29}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f0000000080)=[@hoplimit={{0x14, 0x29, 0x34, 0x10001}}], 0x18, 0x2900}, 0x4004000) 0s ago: executing program 7 (id=3462): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000000900020073797a310000000008000440000000000900010073797a300000000008000340000000011400000011"], 0x64}}, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2}, @TCA_FQ_FLOW_PLIMIT={0x0, 0x2, 0x3ff}]}}]}, 0x48}}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @dev={0xfe, 0x80, '\x00', 0x22}, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000100100000d100000aa00000016afd121000000001800"/43], 0x30}, 0x0) kernel console output (not intermixed with test programs): 54db RDI: 0000000000000003 [ 363.689722][T15096] RBP: 00007fbfad50a090 R08: 0000000000000000 R09: 0000000000000000 [ 363.689734][T15096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 363.689744][T15096] R13: 00007fbfac826128 R14: 00007fbfac826090 R15: 00007ffcc02c28f8 [ 363.689775][T15096] [ 363.717777][T15096] ERROR: Out of memory at tomoyo_realpath_from_path. [ 364.322571][T15110] netlink: 87 bytes leftover after parsing attributes in process `syz.4.2735'. [ 364.764401][T15129] wlan0 speed is unknown, defaulting to 1000 [ 364.794293][T15129] lo speed is unknown, defaulting to 1000 [ 365.228612][T15156] FAULT_INJECTION: forcing a failure. [ 365.228612][T15156] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.228644][T15156] CPU: 1 UID: 0 PID: 15156 Comm: syz.0.2747 Not tainted syzkaller #0 PREEMPT(full) [ 365.228665][T15156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 365.228677][T15156] Call Trace: [ 365.228685][T15156] [ 365.228694][T15156] dump_stack_lvl+0xe8/0x150 [ 365.228726][T15156] should_fail_ex+0x410/0x560 [ 365.228760][T15156] _copy_from_user+0x2d/0xb0 [ 365.228786][T15156] ipv6_flowlabel_opt+0x153/0x2b10 [ 365.228913][T15156] ? register_lock_class+0x31/0x2e0 [ 365.228935][T15156] ? __lock_acquire+0x747/0x2de0 [ 365.228955][T15156] ? __pfx_ipv6_flowlabel_opt+0x10/0x10 [ 365.229003][T15156] ? do_raw_spin_lock+0x12b/0x2f0 [ 365.229032][T15156] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 365.229062][T15156] ? do_ipv6_setsockopt+0x956/0x2960 [ 365.229143][T15156] ? __local_bh_enable_ip+0xd6/0x140 [ 365.229185][T15156] do_ipv6_setsockopt+0x9cb/0x2960 [ 365.229217][T15156] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 365.229240][T15156] ? aa_inet_opt_perm+0xae4/0xcf0 [ 365.229265][T15156] ? get_pid_task+0x20/0x1f0 [ 365.229291][T15156] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 365.229333][T15156] ? ksys_write+0x1e6/0x270 [ 365.229371][T15156] ? lock_acquire+0x115/0x350 [ 365.229400][T15156] ? aa_sock_opt_perm+0xe1/0x1e0 [ 365.229428][T15156] ipv6_setsockopt+0x59/0x170 [ 365.229452][T15156] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 365.229476][T15156] do_sock_setsockopt+0x17c/0x1b0 [ 365.229505][T15156] __x64_sys_setsockopt+0x13d/0x1b0 [ 365.229535][T15156] do_syscall_64+0x166/0x520 [ 365.229561][T15156] ? trace_irq_disable+0x3b/0x140 [ 365.229580][T15156] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.229599][T15156] ? clear_bhb_loop+0x70/0xc0 [ 365.229623][T15156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.229642][T15156] RIP: 0033:0x7fbfac59e159 [ 365.229661][T15156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.229676][T15156] RSP: 002b:00007fbfad52b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 365.229697][T15156] RAX: ffffffffffffffda RBX: 00007fbfac825fa0 RCX: 00007fbfac59e159 [ 365.229711][T15156] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000004 [ 365.229723][T15156] RBP: 00007fbfad52b090 R08: 0000000000000020 R09: 0000000000000000 [ 365.229735][T15156] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 365.229748][T15156] R13: 00007fbfac826038 R14: 00007fbfac825fa0 R15: 00007ffcc02c28f8 [ 365.229780][T15156] [ 365.867827][T15173] bond11: entered promiscuous mode [ 365.867892][T15173] bond11: entered allmulticast mode [ 365.870009][T15173] 8021q: adding VLAN 0 to HW filter on device bond11 [ 365.966136][T15181] netlink: 'syz.0.2750': attribute type 39 has an invalid length. [ 366.188981][T15186] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2753'. [ 366.670844][T15207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2758'. [ 367.626670][ T12] syzkaller0: tun_net_xmit 76 [ 367.628603][ T12] syzkaller0: tun_net_xmit 48 [ 370.683514][T15254] 0ªî{X¹¦: entered promiscuous mode [ 370.723788][T15239] wlan0 speed is unknown, defaulting to 1000 [ 370.744154][T15239] lo speed is unknown, defaulting to 1000 [ 370.819670][T15280] net_ratelimit: 1 callbacks suppressed [ 370.819793][T15280] ip_tables: iptables: counters copy to user failed while replacing table [ 370.837796][T15280] FAULT_INJECTION: forcing a failure. [ 370.837796][T15280] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 370.837827][T15280] CPU: 1 UID: 0 PID: 15280 Comm: syz.3.2775 Not tainted syzkaller #0 PREEMPT(full) [ 370.837846][T15280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 370.837856][T15280] Call Trace: [ 370.837863][T15280] [ 370.837872][T15280] dump_stack_lvl+0xe8/0x150 [ 370.837903][T15280] should_fail_ex+0x410/0x560 [ 370.837928][T15280] _copy_from_user+0x2d/0xb0 [ 370.837950][T15280] ___sys_sendmsg+0x1c6/0x360 [ 370.837971][T15280] ? __lock_acquire+0x747/0x2de0 [ 370.837992][T15280] ? __pfx____sys_sendmsg+0x10/0x10 [ 370.838020][T15280] ? kstrtouint+0x6e/0xe0 [ 370.838058][T15280] ? __fget_files+0x2a/0x420 [ 370.838082][T15280] ? __fget_files+0x3a2/0x420 [ 370.838114][T15280] __sys_sendmmsg+0x273/0x4d0 [ 370.838143][T15280] ? __pfx___sys_sendmmsg+0x10/0x10 [ 370.838176][T15280] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 370.838215][T15280] ? ksys_write+0x242/0x270 [ 370.838245][T15280] ? __pfx_ksys_write+0x10/0x10 [ 370.838281][T15280] __x64_sys_sendmmsg+0xa0/0xc0 [ 370.838309][T15280] do_syscall_64+0x166/0x520 [ 370.838340][T15280] ? trace_irq_disable+0x3b/0x140 [ 370.838360][T15280] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.838379][T15280] ? clear_bhb_loop+0x70/0xc0 [ 370.838403][T15280] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 370.838422][T15280] RIP: 0033:0x7fabec59e159 [ 370.838440][T15280] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 370.838456][T15280] RSP: 002b:00007fabed4d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 370.838477][T15280] RAX: ffffffffffffffda RBX: 00007fabec825fa0 RCX: 00007fabec59e159 [ 370.838491][T15280] RDX: 0000000000000001 RSI: 0000200000001ec0 RDI: 0000000000000003 [ 370.838503][T15280] RBP: 00007fabed4d5090 R08: 0000000000000000 R09: 0000000000000000 [ 370.838515][T15280] R10: 0000000000004040 R11: 0000000000000246 R12: 0000000000000001 [ 370.838527][T15280] R13: 00007fabec826038 R14: 00007fabec825fa0 R15: 00007ffc0282bd98 [ 370.838559][T15280] [ 371.156274][T15290] ip_tables: iptables: counters copy to user failed while replacing table [ 371.931856][T15319] netlink: 'syz.1.2789': attribute type 12 has an invalid length. [ 371.931880][T15319] netlink: 'syz.1.2789': attribute type 29 has an invalid length. [ 371.931893][T15319] netlink: 148 bytes leftover after parsing attributes in process `syz.1.2789'. [ 372.092354][T15327] FAULT_INJECTION: forcing a failure. [ 372.092354][T15327] name failslab, interval 1, probability 0, space 0, times 0 [ 372.092387][T15327] CPU: 1 UID: 0 PID: 15327 Comm: syz.4.2791 Not tainted syzkaller #0 PREEMPT(full) [ 372.092408][T15327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 372.092419][T15327] Call Trace: [ 372.092427][T15327] [ 372.092436][T15327] dump_stack_lvl+0xe8/0x150 [ 372.092467][T15327] should_fail_ex+0x410/0x560 [ 372.092494][T15327] should_failslab+0xa8/0x100 [ 372.092520][T15327] __kvmalloc_node_noprof+0x176/0x820 [ 372.092543][T15327] ? __kvmalloc_node_noprof+0x345/0x820 [ 372.092563][T15327] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 372.092585][T15327] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 372.092613][T15327] bpf_compute_subprog_arg_access+0x187/0x14d0 [ 372.092648][T15327] ? bpf_tracing_func_proto+0x72/0x180 [ 372.092726][T15327] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 372.092755][T15327] ? __kvmalloc_node_noprof+0x345/0x820 [ 372.092773][T15327] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 372.092794][T15327] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 372.092822][T15327] bpf_compute_live_registers+0x8d3/0x1ff0 [ 372.092863][T15327] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 372.092900][T15327] bpf_check+0x2746/0x2ef0 [ 372.092939][T15327] ? __pfx_bpf_check+0x10/0x10 [ 372.092963][T15327] ? bpf_obj_name_cpy+0x194/0x1e0 [ 372.092992][T15327] bpf_prog_load+0x14d6/0x1c20 [ 372.093027][T15327] ? __pfx_bpf_prog_load+0x10/0x10 [ 372.093079][T15327] __sys_bpf+0xd0d/0xd90 [ 372.093109][T15327] ? __pfx___sys_bpf+0x10/0x10 [ 372.093141][T15327] ? __fget_files+0x2a/0x420 [ 372.093183][T15327] ? ksys_write+0x242/0x270 [ 372.093217][T15327] ? __pfx_ksys_write+0x10/0x10 [ 372.093253][T15327] __x64_sys_bpf+0xba/0xd0 [ 372.093282][T15327] do_syscall_64+0x166/0x520 [ 372.093306][T15327] ? trace_irq_disable+0x3b/0x140 [ 372.093325][T15327] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.093344][T15327] ? clear_bhb_loop+0x70/0xc0 [ 372.093371][T15327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.093389][T15327] RIP: 0033:0x7f69dbf9e159 [ 372.093407][T15327] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 372.093423][T15327] RSP: 002b:00007f69dce77028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 372.093443][T15327] RAX: ffffffffffffffda RBX: 00007f69dc225fa0 RCX: 00007f69dbf9e159 [ 372.093457][T15327] RDX: 0000000000000094 RSI: 0000200000000000 RDI: 0000000000000005 [ 372.093470][T15327] RBP: 00007f69dce77090 R08: 0000000000000000 R09: 0000000000000000 [ 372.093480][T15327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 372.093491][T15327] R13: 00007f69dc226038 R14: 00007f69dc225fa0 R15: 00007ffd684f7b68 [ 372.093521][T15327] [ 372.965419][ T4934] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 372.983997][ T4934] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 372.985589][ T4934] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 372.990226][ T4934] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 373.005012][ T4934] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 373.189536][T15355] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2801'. [ 373.189558][T15355] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2801'. [ 373.192039][T15356] netlink: 'syz.2.2801': attribute type 4 has an invalid length. [ 373.192057][T15356] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2801'. [ 373.194183][T15356] .`: renamed from bond0 [ 373.667423][T15371] FAULT_INJECTION: forcing a failure. [ 373.667423][T15371] name failslab, interval 1, probability 0, space 0, times 0 [ 373.667453][T15371] CPU: 0 UID: 0 PID: 15371 Comm: syz.1.2805 Not tainted syzkaller #0 PREEMPT(full) [ 373.667470][T15371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 373.667478][T15371] Call Trace: [ 373.667485][T15371] [ 373.667492][T15371] dump_stack_lvl+0xe8/0x150 [ 373.667520][T15371] should_fail_ex+0x410/0x560 [ 373.667545][T15371] should_failslab+0xa8/0x100 [ 373.667567][T15371] __kmalloc_cache_noprof+0xa3/0x600 [ 373.667583][T15371] ? __kmalloc_cache_noprof+0x14d/0x600 [ 373.667601][T15371] ? sctp_add_bind_addr+0x8c/0x370 [ 373.667791][T15371] ? sctp_add_bind_addr+0x8c/0x370 [ 373.667819][T15371] sctp_add_bind_addr+0x8c/0x370 [ 373.667842][T15371] sctp_copy_local_addr_list+0x31a/0x4e0 [ 373.667911][T15371] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 373.667933][T15371] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 373.667956][T15371] ? sctp_v6_is_any+0x64/0x80 [ 373.668004][T15371] ? sctp_copy_one_addr+0x93/0x360 [ 373.668029][T15371] sctp_bind_addr_copy+0xb3/0x3c0 [ 373.668051][T15371] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 373.668073][T15371] sctp_connect_new_asoc+0x2ff/0x6b0 [ 373.668093][T15371] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 373.668115][T15371] ? __local_bh_enable_ip+0xd6/0x140 [ 373.668133][T15371] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 373.668154][T15371] ? security_sctp_bind_connect+0x7e/0x2c0 [ 373.668173][T15371] sctp_sendmsg+0x159b/0x2d00 [ 373.668200][T15371] ? kstrtouint+0x6e/0xe0 [ 373.668215][T15371] ? __pfx_sctp_sendmsg+0x10/0x10 [ 373.668231][T15371] ? lock_acquire+0x115/0x350 [ 373.668248][T15371] ? get_pid_task+0x20/0x1f0 [ 373.668276][T15371] ? aa_sock_msg_perm+0xf5/0x210 [ 373.668295][T15371] ? sock_rps_record_flow+0x19/0x350 [ 373.668380][T15371] ? inet_sendmsg+0x298/0x320 [ 373.668397][T15371] ? __pfx_inet_sendmsg+0x10/0x10 [ 373.668411][T15371] sock_sendmsg_nosec+0x10f/0x190 [ 373.668429][T15371] __sys_sendto+0x408/0x5a0 [ 373.668449][T15371] ? ksys_write+0x1e6/0x270 [ 373.668476][T15371] ? __pfx___sys_sendto+0x10/0x10 [ 373.668493][T15371] ? __mutex_unlock_slowpath+0x731/0x900 [ 373.668542][T15371] ? __pfx_ksys_write+0x10/0x10 [ 373.668576][T15371] __x64_sys_sendto+0xde/0x100 [ 373.668602][T15371] do_syscall_64+0x166/0x520 [ 373.668635][T15371] ? trace_irq_disable+0x3b/0x140 [ 373.668653][T15371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.668672][T15371] ? clear_bhb_loop+0x70/0xc0 [ 373.668691][T15371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.668708][T15371] RIP: 0033:0x7f9f0059e159 [ 373.668726][T15371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.668738][T15371] RSP: 002b:00007f9f014ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 373.668760][T15371] RAX: ffffffffffffffda RBX: 00007f9f00825fa0 RCX: 00007f9f0059e159 [ 373.668774][T15371] RDX: 0000000000000001 RSI: 00002000000009c0 RDI: 0000000000000003 [ 373.668786][T15371] RBP: 00007f9f014ab090 R08: 000020000005ffe4 R09: 000000000000001c [ 373.668798][T15371] R10: 00000000200080c1 R11: 0000000000000246 R12: 0000000000000002 [ 373.668810][T15371] R13: 00007f9f00826038 R14: 00007f9f00825fa0 R15: 00007ffc8c4fbdc8 [ 373.668842][T15371] [ 374.015411][T15377] FAULT_INJECTION: forcing a failure. [ 374.015411][T15377] name failslab, interval 1, probability 0, space 0, times 0 [ 374.015448][T15377] CPU: 1 UID: 0 PID: 15377 Comm: syz.1.2807 Not tainted syzkaller #0 PREEMPT(full) [ 374.015470][T15377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 374.015482][T15377] Call Trace: [ 374.015489][T15377] [ 374.015498][T15377] dump_stack_lvl+0xe8/0x150 [ 374.015531][T15377] should_fail_ex+0x410/0x560 [ 374.015558][T15377] should_failslab+0xa8/0x100 [ 374.015585][T15377] __kvmalloc_node_noprof+0x176/0x820 [ 374.015607][T15377] ? rcu_is_watching+0x16/0xb0 [ 374.015664][T15377] ? analyze_subprog+0x846/0x9e00 [ 374.015685][T15377] ? analyze_subprog+0x846/0x9e00 [ 374.015713][T15377] analyze_subprog+0x846/0x9e00 [ 374.015734][T15377] ? is_bpf_text_address+0x292/0x2b0 [ 374.015761][T15377] ? kernel_text_address+0xa5/0xe0 [ 374.015788][T15377] ? arch_stack_walk+0xfb/0x150 [ 374.015830][T15377] ? __pfx_stack_trace_save+0x10/0x10 [ 374.015861][T15377] ? call_instance+0x263/0x560 [ 374.015879][T15377] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 374.015900][T15377] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 374.015922][T15377] ? __pfx_analyze_subprog+0x10/0x10 [ 374.015942][T15377] ? __x64_sys_bpf+0xba/0xd0 [ 374.015966][T15377] ? do_syscall_64+0x166/0x520 [ 374.015990][T15377] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.016045][T15377] ? call_instance+0x263/0x560 [ 374.016065][T15377] ? rcu_is_watching+0x16/0xb0 [ 374.016086][T15377] ? call_instance+0x263/0x560 [ 374.016106][T15377] ? trace_kmalloc+0x2a/0xf0 [ 374.016126][T15377] ? call_instance+0x263/0x560 [ 374.016145][T15377] ? __kvmalloc_node_noprof+0x52f/0x820 [ 374.016168][T15377] ? __kvmalloc_node_noprof+0x345/0x820 [ 374.016187][T15377] ? call_instance+0x263/0x560 [ 374.016206][T15377] ? call_instance+0x263/0x560 [ 374.016233][T15377] ? call_instance+0x42e/0x560 [ 374.016261][T15377] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 374.016283][T15377] ? lwt_out_func_proto+0xed/0x2a0 [ 374.016421][T15377] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 374.016448][T15377] ? __kvmalloc_node_noprof+0x345/0x820 [ 374.016468][T15377] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 374.016490][T15377] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 374.016519][T15377] bpf_compute_live_registers+0x8d3/0x1ff0 [ 374.016560][T15377] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 374.016594][T15377] bpf_check+0x2746/0x2ef0 [ 374.016634][T15377] ? __pfx_bpf_check+0x10/0x10 [ 374.016657][T15377] ? bpf_obj_name_cpy+0x194/0x1e0 [ 374.016688][T15377] bpf_prog_load+0x14d6/0x1c20 [ 374.016723][T15377] ? __pfx_bpf_prog_load+0x10/0x10 [ 374.016770][T15377] __sys_bpf+0xd0d/0xd90 [ 374.016800][T15377] ? __pfx___sys_bpf+0x10/0x10 [ 374.016833][T15377] ? __fget_files+0x2a/0x420 [ 374.016875][T15377] ? ksys_write+0x242/0x270 [ 374.016906][T15377] ? __pfx_ksys_write+0x10/0x10 [ 374.016938][T15377] __x64_sys_bpf+0xba/0xd0 [ 374.016968][T15377] do_syscall_64+0x166/0x520 [ 374.016991][T15377] ? trace_irq_disable+0x3b/0x140 [ 374.017010][T15377] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.017029][T15377] ? clear_bhb_loop+0x70/0xc0 [ 374.017053][T15377] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.017073][T15377] RIP: 0033:0x7f9f0059e159 [ 374.017092][T15377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.017108][T15377] RSP: 002b:00007f9f014ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 374.017129][T15377] RAX: ffffffffffffffda RBX: 00007f9f00825fa0 RCX: 00007f9f0059e159 [ 374.017143][T15377] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 374.017156][T15377] RBP: 00007f9f014ab090 R08: 0000000000000000 R09: 0000000000000000 [ 374.017168][T15377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 374.017179][T15377] R13: 00007f9f00826038 R14: 00007f9f00825fa0 R15: 00007ffc8c4fbdc8 [ 374.017211][T15377] [ 374.291933][ T5939] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.291967][ T5939] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.429784][T15388] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2810'. [ 374.557881][T15388] vlan2: entered allmulticast mode [ 374.557909][T15388] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 374.559145][T15388] batman_adv: batadv0: Adding interface: vlan2 [ 374.559160][T15388] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 374.559186][T15388] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 374.707770][ T5939] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.707793][ T5939] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.861752][ T5939] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.861787][ T5939] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 374.881706][T15347] wlan0 speed is unknown, defaulting to 1000 [ 374.901612][T15347] lo speed is unknown, defaulting to 1000 [ 375.025605][ T5939] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 375.025641][ T5939] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.073389][ T4934] Bluetooth: hci5: command tx timeout [ 375.086364][T15411] syzkaller1: entered promiscuous mode [ 375.086387][T15411] syzkaller1: entered allmulticast mode [ 375.218194][T15412] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2818'. [ 375.451263][T15426] ip_tables: iptables: counters copy to user failed while replacing table [ 375.778846][ T5939] bridge_slave_1: left promiscuous mode [ 375.780862][ T5939] bridge0: port 2(bridge_slave_1) entered disabled state [ 375.824083][ T5939] bridge_slave_0: left promiscuous mode [ 375.824307][ T5939] bridge0: port 1(bridge_slave_0) entered disabled state [ 375.884360][ T5939] dummy0: left allmulticast mode [ 375.915311][T15447] ip_tables: iptables: counters copy to user failed while replacing table [ 376.018507][T15451] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2829'. [ 376.046346][T15456] netlink: 'syz.3.2830': attribute type 6 has an invalid length. [ 376.412490][ T5939] bond2 (unregistering): (slave bridge1): Releasing backup interface [ 376.412543][ T5939] bridge1 (unregistering): left allmulticast mode [ 376.504154][ T5939] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 376.540807][ T5939] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 376.559696][ T5939] bond0 (unregistering): Released all slaves [ 376.577520][ T5939] bond1 (unregistering): Released all slaves [ 376.596980][ T5939] bond2 (unregistering): Released all slaves [ 376.626702][ T5939] bond3 (unregistering): Released all slaves [ 376.641833][ T5939] bond4 (unregistering): (slave veth3): Releasing active interface [ 376.642959][ T5939] bond4 (unregistering): Released all slaves [ 376.670076][ T5939] bond5 (unregistering): Released all slaves [ 376.681001][ T5939] bond6 (unregistering): Released all slaves [ 376.687667][ T5939] bond7 (unregistering): Released all slaves [ 376.703333][ T5939] bond8 (unregistering): (slave veth7): Releasing active interface [ 376.703360][ T5939] batadv1: entered promiscuous mode [ 376.705668][ T5939] bond8 (unregistering): (slave batadv1): Releasing active interface [ 376.705702][ T5939] batadv1: left promiscuous mode [ 376.707049][ T5939] bond8 (unregistering): Released all slaves [ 376.739107][ T5939] bond9 (unregistering): (slave lo): Releasing backup interface [ 376.757473][ T5939] bond9 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 376.759774][ T5939] bond9 (unregistering): Released all slaves [ 376.780212][ T5939] bond10 (unregistering): Released all slaves [ 376.791278][ T5939] bond11 (unregistering): Released all slaves [ 376.831771][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1 [ 376.925681][ T5939] : left promiscuous mode [ 377.047397][T15476] sctp: [Deprecated]: syz.0.2831 (pid 15476) Use of int in max_burst socket option. [ 377.047397][T15476] Use struct sctp_assoc_value instead [ 377.170647][ T4934] Bluetooth: hci5: command tx timeout [ 377.218475][T15475] 8021q: adding VLAN 0 to HW filter on device .` [ 377.219940][T15475] 8021q: adding VLAN 0 to HW filter on device team0 [ 377.224055][T15475] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.283819][T15485] openvswitch: netlink: Multiple metadata blocks provided [ 377.290311][T15485] netlink: 220 bytes leftover after parsing attributes in process `syz.2.2832'. [ 377.349281][T15475] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 377.349299][T15475] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 377.366540][T15475] veth1_macvtap: left promiscuous mode [ 377.367677][T15475] veth0_macvtap: entered promiscuous mode [ 377.368719][T15475] veth1_macvtap: entered promiscuous mode [ 377.378334][T15475] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 377.379351][T15475] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 377.382096][T15475] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 377.383254][T15475] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 377.389985][T15475] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 377.393203][T15475] 8021q: adding VLAN 0 to HW filter on device bond1 [ 377.452466][T15475] 8021q: adding VLAN 0 to HW filter on device bond2 [ 377.454513][T15475] 8021q: adding VLAN 0 to HW filter on device bond3 [ 377.455907][T15475] 8021q: adding VLAN 0 to HW filter on device bond4 [ 377.458221][T15475] 8021q: adding VLAN 0 to HW filter on device bond5 [ 377.488316][ T5925] bond2: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 377.488945][ T5939] tipc: Left network mode [ 377.530288][T15482] netlink: 'syz.2.2832': attribute type 3 has an invalid length. [ 377.532101][T15482] netlink: 'syz.2.2832': attribute type 3 has an invalid length. [ 377.664117][T15488] vlan3: entered allmulticast mode [ 377.802707][T15347] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.802813][T15347] bridge0: port 1(bridge_slave_0) entered disabled state [ 377.802962][T15347] bridge_slave_0: entered allmulticast mode [ 377.833338][T15347] bridge_slave_0: entered promiscuous mode [ 377.857556][T15347] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.858474][T15347] bridge0: port 2(bridge_slave_1) entered disabled state [ 377.858629][T15347] bridge_slave_1: entered allmulticast mode [ 377.871971][T15347] bridge_slave_1: entered promiscuous mode [ 377.993942][T15504] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2839'. [ 378.418728][T15347] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 378.434278][T15347] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 378.673240][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.711699][ T5930] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.711729][ T5930] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.711852][ T5930] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.711872][ T5930] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.711902][ T5930] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.711921][ T5930] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.732814][ T5935] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.732846][ T5935] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.874545][T15535] netlink: 'syz.2.2843': attribute type 4 has an invalid length. [ 378.874567][T15535] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2843'. [ 378.876896][T15347] team0: Port device team_slave_0 added [ 378.892910][ T5925] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 378.906737][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2 [ 378.941631][T15535] A link change request failed with some changes committed already. Interface .` may have been left with an inconsistent configuration, please check. [ 379.004500][T15347] team0: Port device team_slave_1 added [ 379.053196][T15559] FAULT_INJECTION: forcing a failure. [ 379.053196][T15559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.053229][T15559] CPU: 0 UID: 0 PID: 15559 Comm: syz.1.2849 Not tainted syzkaller #0 PREEMPT(full) [ 379.053250][T15559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 379.053262][T15559] Call Trace: [ 379.053269][T15559] [ 379.053278][T15559] dump_stack_lvl+0xe8/0x150 [ 379.053309][T15559] should_fail_ex+0x410/0x560 [ 379.053335][T15559] _copy_from_user+0x2d/0xb0 [ 379.053359][T15559] ___sys_recvmsg+0x173/0x5a0 [ 379.053389][T15559] ? __pfx____sys_recvmsg+0x10/0x10 [ 379.053420][T15559] ? lock_acquire+0x115/0x350 [ 379.053474][T15559] do_recvmmsg+0x31a/0x7f0 [ 379.053503][T15559] ? __pfx_do_recvmmsg+0x10/0x10 [ 379.053566][T15559] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 379.053593][T15559] ? __fget_files+0x3a2/0x420 [ 379.053627][T15559] __x64_sys_recvmmsg+0x198/0x250 [ 379.053652][T15559] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 379.053689][T15559] do_syscall_64+0x166/0x520 [ 379.053712][T15559] ? trace_irq_disable+0x3b/0x140 [ 379.053731][T15559] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.053750][T15559] ? clear_bhb_loop+0x70/0xc0 [ 379.053774][T15559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.053793][T15559] RIP: 0033:0x7f9f0059e159 [ 379.053811][T15559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.053827][T15559] RSP: 002b:00007f9f0148a028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 379.053846][T15559] RAX: ffffffffffffffda RBX: 00007f9f00826090 RCX: 00007f9f0059e159 [ 379.053860][T15559] RDX: 0400000000000341 RSI: 00002000000000c0 RDI: 0000000000000003 [ 379.053873][T15559] RBP: 00007f9f0148a090 R08: 0000000000000000 R09: 0000000000000000 [ 379.053885][T15559] R10: 0000000000010100 R11: 0000000000000246 R12: 0000000000000002 [ 379.053896][T15559] R13: 00007f9f00826128 R14: 00007f9f00826090 R15: 00007ffc8c4fbdc8 [ 379.053926][T15559] [ 379.235458][ T4934] Bluetooth: hci5: command tx timeout [ 379.348897][T15347] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 379.348915][T15347] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 379.348938][T15347] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 379.437239][T15570] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2852'. [ 379.438269][ T5939] hsr_slave_0: left promiscuous mode [ 379.463831][ T5939] hsr_slave_1: left promiscuous mode [ 379.467285][ T5939] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 379.467331][ T5939] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 379.494368][ T5939] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 379.494391][ T5939] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 379.540292][ T5939] veth1_macvtap: left promiscuous mode [ 379.550878][ T5939] veth0_macvtap: left promiscuous mode [ 379.551353][ T5939] veth1_vlan: left promiscuous mode [ 379.551497][ T5939] veth0_vlan: left promiscuous mode [ 379.868345][T15587] openvswitch: netlink: IP tunnel dst address not specified [ 380.222011][ T5939] team0 (unregistering): Port device team_slave_1 removed [ 380.247919][ T5939] team0 (unregistering): Port device team_slave_0 removed [ 380.391573][T15347] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 380.391591][T15347] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 380.391616][T15347] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 380.395832][T15580] wlan0 speed is unknown, defaulting to 1000 [ 380.399036][T15580] wlan0 speed is unknown, defaulting to 1000 [ 380.399081][T15592] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2858'. [ 380.399979][T15580] wlan0 speed is unknown, defaulting to 1000 [ 380.475162][T15580] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 380.475198][T15580] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 380.475234][T15580] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 380.537211][T15580] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 380.657216][T15580] wlan0 speed is unknown, defaulting to 1000 [ 380.695911][T15347] hsr_slave_0: entered promiscuous mode [ 380.701566][T15347] hsr_slave_1: entered promiscuous mode [ 380.707586][T15347] debugfs: 'hsr0' already exists in 'hsr' [ 380.707610][T15347] Cannot create hsr debugfs directory [ 380.712289][T15580] wlan0 speed is unknown, defaulting to 1000 [ 380.796096][T15580] wlan0 speed is unknown, defaulting to 1000 [ 380.805161][T15604] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2860'. [ 380.905342][T15580] wlan0 speed is unknown, defaulting to 1000 [ 381.062931][T15580] wlan0 speed is unknown, defaulting to 1000 [ 381.236176][T15621] openvswitch: netlink: Unknown key attributes 1 [ 381.313462][ T4934] Bluetooth: hci5: command tx timeout [ 381.508840][T15606] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 381.508878][T15606] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.740872][ T5939] IPVS: stop unused estimator thread 0... [ 381.855659][T15606] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 381.855726][T15606] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 381.892010][ T5279] 8021q: adding VLAN 0 to HW filter on device eth3 [ 382.141333][T15647] syzkaller1: entered promiscuous mode [ 382.141359][T15647] syzkaller1: entered allmulticast mode [ 382.205002][T15606] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.205039][T15606] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.245842][T15662] netlink: 'syz.0.2873': attribute type 1 has an invalid length. [ 382.343746][T15662] 8021q: adding VLAN 0 to HW filter on device bond6 [ 382.438797][T15606] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.438832][T15606] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.493562][T15662] bond6: (slave geneve3): making interface the new active one [ 382.500200][T15662] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 382.840843][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 383.131323][ T38] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 383.131357][ T38] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.131403][ T38] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 383.131426][ T38] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.310857][ T5930] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 383.310891][ T5930] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.310942][ T5930] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 383.310964][ T5930] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 383.520913][T15699] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input24 [ 383.786070][T15708] batman_adv: batadv0: Adding interface: syzkaller0 [ 383.786089][T15708] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 383.820998][T15708] batman_adv: batadv0: Interface activated: syzkaller0 [ 383.852185][T15707] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 383.920035][T15707] batman_adv: batadv0: Removing interface: syzkaller0 [ 383.933672][T15347] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 383.942426][T15347] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 383.945119][T15347] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 383.990247][T15347] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 384.002889][T15347] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 384.025107][T15347] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 384.026227][T15347] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 384.057186][T15347] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 384.166413][T15347] 8021q: adding VLAN 0 to HW filter on device bond0 [ 384.199222][T15347] 8021q: adding VLAN 0 to HW filter on device team0 [ 384.225536][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.225633][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 384.258744][T15729] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2887'. [ 384.283440][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.283549][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 384.454255][T15732] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2889'. [ 385.372174][T15770] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2895'. [ 385.372218][T15770] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2895'. [ 385.454284][T15765] xt_CT: No such helper "netbios-ns" [ 386.066976][T15347] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 386.240961][T15813] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2899'. [ 386.785044][T15840] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2906'. [ 386.812718][T15347] veth0_vlan: entered promiscuous mode [ 386.838922][T15347] veth1_vlan: entered promiscuous mode [ 386.992141][T15347] veth0_macvtap: entered promiscuous mode [ 387.011412][T15347] veth1_macvtap: entered promiscuous mode [ 387.056643][T15347] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 387.070146][T15347] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 387.162969][ T5939] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.197005][T15857] netlink: 'syz.1.2911': attribute type 12 has an invalid length. [ 387.197028][T15857] netlink: 'syz.1.2911': attribute type 29 has an invalid length. [ 387.197041][T15857] netlink: 148 bytes leftover after parsing attributes in process `syz.1.2911'. [ 387.205387][ T5939] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.274233][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.274276][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 387.352321][ T5925] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.352343][ T5925] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.397079][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 387.397095][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 387.908705][T15882] syzkaller0: entered promiscuous mode [ 387.908727][T15882] syzkaller0: entered allmulticast mode [ 388.021590][T15888] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 388.279778][T15901] sock: sock_set_timeout: `syz.4.2921' (pid 15901) tries to set negative timeout [ 388.319399][ T5625] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 388.329803][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 388.339270][ T5625] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 388.353542][ T5625] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 388.356634][ T5625] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 388.598061][T15915] gretap0: entered promiscuous mode [ 388.606248][T15915] vlan2: entered promiscuous mode [ 389.107956][T15934] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2929'. [ 389.399848][ T5930] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.501145][T15952] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2933'. [ 389.501181][T15952] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2933'. [ 389.801963][ T5930] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.098150][ T5930] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.360718][ T5930] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 390.410117][T15904] wlan0 speed is unknown, defaulting to 1000 [ 390.419875][T15904] lo speed is unknown, defaulting to 1000 [ 390.425577][T15993] FAULT_INJECTION: forcing a failure. [ 390.425577][T15993] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 390.425609][T15993] CPU: 0 UID: 0 PID: 15993 Comm: syz.3.2943 Not tainted syzkaller #0 PREEMPT(full) [ 390.425630][T15993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 390.425641][T15993] Call Trace: [ 390.425649][T15993] [ 390.425658][T15993] dump_stack_lvl+0xe8/0x150 [ 390.425689][T15993] should_fail_ex+0x410/0x560 [ 390.425716][T15993] _copy_from_user+0x2d/0xb0 [ 390.425740][T15993] generic_map_update_batch+0x662/0xae0 [ 390.425779][T15993] ? __pfx_generic_map_update_batch+0x10/0x10 [ 390.425812][T15993] ? __fget_files+0x2a/0x420 [ 390.425844][T15993] ? __pfx_generic_map_update_batch+0x10/0x10 [ 390.425869][T15993] bpf_map_do_batch+0x391/0x630 [ 390.425896][T15993] __sys_bpf+0xbe5/0xd90 [ 390.425924][T15993] ? __pfx___sys_bpf+0x10/0x10 [ 390.425958][T15993] ? __fget_files+0x2a/0x420 [ 390.425997][T15993] ? ksys_write+0x242/0x270 [ 390.426026][T15993] ? __pfx_ksys_write+0x10/0x10 [ 390.426057][T15993] __x64_sys_bpf+0xba/0xd0 [ 390.426077][T15993] do_syscall_64+0x166/0x520 [ 390.426101][T15993] ? trace_irq_disable+0x3b/0x140 [ 390.426118][T15993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.426137][T15993] ? clear_bhb_loop+0x70/0xc0 [ 390.426159][T15993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.426177][T15993] RIP: 0033:0x7fabec59e159 [ 390.426194][T15993] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.426209][T15993] RSP: 002b:00007fabed4d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 390.426229][T15993] RAX: ffffffffffffffda RBX: 00007fabec825fa0 RCX: 00007fabec59e159 [ 390.426243][T15993] RDX: 0000000000000038 RSI: 00002000000000c0 RDI: 000000000000001a [ 390.426255][T15993] RBP: 00007fabed4d5090 R08: 0000000000000000 R09: 0000000000000000 [ 390.426266][T15993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 390.426278][T15993] R13: 00007fabec826038 R14: 00007fabec825fa0 R15: 00007ffc0282bd98 [ 390.426306][T15993] [ 390.442544][ T4934] Bluetooth: hci4: command tx timeout [ 390.467366][T15904] wlan0 speed is unknown, defaulting to 1000 [ 390.990335][T16018] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2952'. [ 390.993602][T16018] FAULT_INJECTION: forcing a failure. [ 390.993602][T16018] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 390.993633][T16018] CPU: 0 UID: 0 PID: 16018 Comm: syz.1.2952 Not tainted syzkaller #0 PREEMPT(full) [ 390.993655][T16018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 390.993667][T16018] Call Trace: [ 390.993675][T16018] [ 390.993684][T16018] dump_stack_lvl+0xe8/0x150 [ 390.993716][T16018] should_fail_ex+0x410/0x560 [ 390.993745][T16018] _copy_to_user+0x31/0xb0 [ 390.993772][T16018] simple_read_from_buffer+0xe1/0x170 [ 390.993803][T16018] proc_fail_nth_read+0x1bb/0x230 [ 390.993863][T16018] ? common_file_perm+0x20e/0x2b0 [ 390.993890][T16018] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 390.993912][T16018] ? rw_verify_area+0x24a/0x4c0 [ 390.993941][T16018] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 390.993959][T16018] vfs_read+0x213/0xa80 [ 390.993990][T16018] ? __pfx___mutex_lock+0x10/0x10 [ 390.994014][T16018] ? __pfx_vfs_read+0x10/0x10 [ 390.994041][T16018] ? __fget_files+0x2a/0x420 [ 390.994065][T16018] ? __fget_files+0x3a2/0x420 [ 390.994089][T16018] ? __fget_files+0x2a/0x420 [ 390.994121][T16018] ksys_read+0x150/0x270 [ 390.994149][T16018] ? __pfx_ksys_read+0x10/0x10 [ 390.994187][T16018] do_syscall_64+0x166/0x520 [ 390.994210][T16018] ? trace_irq_disable+0x3b/0x140 [ 390.994230][T16018] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.994250][T16018] ? clear_bhb_loop+0x70/0xc0 [ 390.994273][T16018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.994337][T16018] RIP: 0033:0x7f9f0055e98e [ 390.994356][T16018] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 390.994371][T16018] RSP: 002b:00007f9f014aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 390.994391][T16018] RAX: ffffffffffffffda RBX: 00007f9f014ab6c0 RCX: 00007f9f0055e98e [ 390.994411][T16018] RDX: 000000000000000f RSI: 00007f9f014ab0a0 RDI: 0000000000000004 [ 390.994423][T16018] RBP: 00007f9f014ab090 R08: 0000000000000000 R09: 0000000000000000 [ 390.994434][T16018] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.994443][T16018] R13: 00007f9f00826038 R14: 00007f9f00825fa0 R15: 00007ffc8c4fbdc8 [ 390.994472][T16018] [ 391.234579][T16008] syzkaller1: entered promiscuous mode [ 391.234603][T16008] syzkaller1: entered allmulticast mode [ 391.483256][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 391.502588][T16038] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2955'. [ 391.644015][T16042] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2959'. [ 391.685114][ T5930] bond4: left allmulticast mode [ 391.690220][ T5930] bond4: left promiscuous mode [ 391.705451][ T5930] bridge0: port 1(bond4) entered disabled state [ 392.323743][T16070] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2967'. [ 392.510736][ T4934] Bluetooth: hci4: command tx timeout [ 392.600092][T16094] netlink: 'syz.1.2971': attribute type 2 has an invalid length. [ 392.600107][T16094] netlink: 'syz.1.2971': attribute type 8 has an invalid length. [ 392.600114][T16094] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2971'. [ 392.723412][ T5930] bond6 (unregistering): (slave geneve3): Releasing active interface [ 392.798023][ T5930] bond0 (unregistering): Released all slaves [ 392.816444][ T5930] bond1 (unregistering): Released all slaves [ 392.849576][ T5930] bond2 (unregistering): Released all slaves [ 392.882192][ T5930] bond3 (unregistering): (slave veth7): Releasing backup interface [ 392.884709][ T5930] bond3 (unregistering): Released all slaves [ 392.917823][ T5930] bond4 (unregistering): Released all slaves [ 392.942895][ T5930] bond5 (unregistering): Released all slaves [ 392.982678][ T5930] bond6 (unregistering): Released all slaves [ 393.037826][T16070] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2967'. [ 393.206125][ T5279] 8021q: adding VLAN 0 to HW filter on device eth1 [ 393.339756][ T5930] tipc: Left network mode [ 393.371819][T16121] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input25 [ 393.621114][T15904] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.621221][T15904] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.621379][T15904] bridge_slave_0: entered allmulticast mode [ 393.623311][T15904] bridge_slave_0: entered promiscuous mode [ 393.637686][T16134] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2980'. [ 393.754594][T15904] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.756337][T15904] bridge0: port 2(bridge_slave_1) entered disabled state [ 393.756513][T15904] bridge_slave_1: entered allmulticast mode [ 393.758440][T15904] bridge_slave_1: entered promiscuous mode [ 394.088814][ T7927] infiniband syz0: ib_query_port failed (-19) [ 394.133107][T15904] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 394.155975][T15904] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 394.195044][ T12] smbdirect: ib_dev[syz0] removed [ 394.348285][T15904] team0: Port device team_slave_0 added [ 394.366606][T15904] team0: Port device team_slave_1 added [ 394.588900][T15904] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 394.588918][T15904] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 394.588942][T15904] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 394.598853][ T4934] Bluetooth: hci4: command tx timeout [ 394.598978][T15904] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 394.598990][T15904] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 394.599013][T15904] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 394.785905][ T5930] hsr_slave_0: left promiscuous mode [ 394.791298][ T5930] hsr_slave_1: left promiscuous mode [ 395.624014][ T5939] smbdirect: ib_dev[syz2] removed [ 395.633606][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2 [ 395.746357][T16192] netlink: 'syz.2.2992': attribute type 2 has an invalid length. [ 395.750865][ T7927] infiniband syz2: ib_query_port failed (-19) [ 395.843522][T15904] hsr_slave_0: entered promiscuous mode [ 395.844947][T15904] hsr_slave_1: entered promiscuous mode [ 395.845674][T15904] debugfs: 'hsr0' already exists in 'hsr' [ 395.845693][T15904] Cannot create hsr debugfs directory [ 396.484176][T16215] bond2: entered allmulticast mode [ 396.484592][T16215] 8021q: adding VLAN 0 to HW filter on device bond2 [ 396.489217][ T5930] IPVS: stop unused estimator thread 0... [ 396.670967][ T4934] Bluetooth: hci4: command tx timeout [ 396.729001][T16229] syzkaller0: tun_chr_ioctl cmd 1074025677 [ 396.729146][T16229] syzkaller0: linktype set to 768 [ 397.025114][ T31] audit: type=1800 audit(1790718285.402:5): pid=16218 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2999" name="memory.events" dev="tmpfs" ino=2906 res=0 errno=0 [ 397.446310][T16267] netlink: 'syz.2.3010': attribute type 1 has an invalid length. [ 397.516281][T16276] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3010'. [ 397.612403][T16267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 397.871186][T16267] bond0: (slave bridge2): making interface the new active one [ 397.903221][T16267] bond0: (slave bridge2): Enslaving as an active interface with an up link [ 398.202582][T15904] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 398.222490][T15904] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 398.223354][T15904] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 398.250039][T15904] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 398.259798][T15904] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 398.285100][T15904] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 398.287556][T15904] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 398.307999][T15904] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 398.517262][T16324] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3022'. [ 398.850026][T15904] 8021q: adding VLAN 0 to HW filter on device bond0 [ 398.936589][T15904] 8021q: adding VLAN 0 to HW filter on device team0 [ 398.968449][ T5925] bridge0: port 1(bridge_slave_0) entered blocking state [ 398.968557][ T5925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 398.996416][T16345] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3024'. [ 399.004881][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.005013][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 399.438085][T16358] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 399.462267][T16358] bond5 (unregistering): Released all slaves [ 399.934359][T16399] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3040'. [ 399.934804][T16399] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3040'. [ 400.222470][T16413] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3043'. [ 400.580293][T15904] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 400.807676][T16398] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3039'. [ 400.808905][T15904] veth0_vlan: entered promiscuous mode [ 400.839981][T15904] veth1_vlan: entered promiscuous mode [ 400.892604][T16445] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3049'. [ 400.921959][T15904] veth0_macvtap: entered promiscuous mode [ 400.938196][T15904] veth1_macvtap: entered promiscuous mode [ 400.992944][T15904] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.002236][T16445] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3049'. [ 401.047071][T16445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3049'. [ 401.050365][T15904] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.101088][ T5925] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.101158][ T5925] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.101189][ T5925] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.101219][ T5925] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.467809][ T5941] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.467833][ T5941] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.550391][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 401.551929][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 401.650359][T16470] bond8: entered promiscuous mode [ 401.651063][T16470] bond8: entered allmulticast mode [ 401.651452][T16470] 8021q: adding VLAN 0 to HW filter on device bond8 [ 402.396081][ T5625] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 402.411188][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 402.412718][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 402.414638][ T5625] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 402.419120][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 403.150668][T16544] x_tables: duplicate underflow at hook 2 [ 403.477252][T16564] 8021q: adding VLAN 0 to HW filter on device bond5 [ 403.566571][T16515] wlan0 speed is unknown, defaulting to 1000 [ 403.630035][T16571] __nla_validate_parse: 6 callbacks suppressed [ 403.630055][T16571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3077'. [ 404.279144][T16515] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.280165][T16515] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.280964][T16515] bridge_slave_0: entered allmulticast mode [ 404.284514][T16515] bridge_slave_0: entered promiscuous mode [ 404.289036][T16515] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.289136][T16515] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.289304][T16515] bridge_slave_1: entered allmulticast mode [ 404.291477][T16515] bridge_slave_1: entered promiscuous mode [ 404.339541][T16515] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 404.358744][T16515] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 404.401111][T16515] team0: Port device team_slave_0 added [ 404.405302][T16515] team0: Port device team_slave_1 added [ 404.477489][T16515] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 404.477507][T16515] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 404.477526][T16515] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 404.478770][T16515] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 404.478784][T16515] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 404.478805][T16515] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 404.521479][ T4934] Bluetooth: hci3: command tx timeout [ 404.635661][T16515] hsr_slave_0: entered promiscuous mode [ 404.639803][T16515] hsr_slave_1: entered promiscuous mode [ 404.640633][T16515] debugfs: 'hsr0' already exists in 'hsr' [ 404.640652][T16515] Cannot create hsr debugfs directory [ 404.849961][T16624] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3089'. [ 405.187024][T16632] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3092'. [ 405.639323][T16651] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3096'. [ 406.041566][T16657] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 406.050056][T16665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3100'. [ 406.194489][T16670] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3100'. [ 406.592090][ T4934] Bluetooth: hci3: command tx timeout [ 406.691325][T16515] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 406.697575][T16515] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 406.699026][T16515] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 406.723848][T16515] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 406.724757][T16515] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 406.729709][T16515] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 406.757860][T16515] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 406.778286][T16515] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 406.948579][T16515] 8021q: adding VLAN 0 to HW filter on device bond0 [ 406.998235][T16515] 8021q: adding VLAN 0 to HW filter on device team0 [ 407.045959][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.046067][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 407.083700][ T5925] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.083811][ T5925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 407.175424][T16705] netlink: 'syz.0.3107': attribute type 12 has an invalid length. [ 407.175449][T16705] netlink: 'syz.0.3107': attribute type 29 has an invalid length. [ 407.175464][T16705] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3107'. [ 407.418062][T16714] wlan0 speed is unknown, defaulting to 1000 [ 407.470964][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 407.543409][T16717] syzkaller0: entered promiscuous mode [ 407.543432][T16717] syzkaller0: entered allmulticast mode [ 408.291872][T16756] tipc: Started in network mode [ 408.291902][T16756] tipc: Node identity 46571ab72c0e, cluster identity 4711 [ 408.292068][T16756] tipc: Enabled bearer , priority 0 [ 408.294452][T16756] syzkaller0: entered promiscuous mode [ 408.294474][T16756] syzkaller0: entered allmulticast mode [ 408.420258][T16764] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3123'. [ 408.437407][T16764] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3123'. [ 408.438634][T16764] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 408.469684][T16515] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.482476][T16755] tipc: Resetting bearer [ 408.548642][T16755] tipc: Disabling bearer [ 408.671461][ T4934] Bluetooth: hci3: command tx timeout [ 408.793662][T16515] veth0_vlan: entered promiscuous mode [ 408.827770][T16515] veth1_vlan: entered promiscuous mode [ 408.841928][T16783] netlink: 'syz.4.3130': attribute type 1 has an invalid length. [ 409.010121][T16792] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 409.046130][T16789] wlan0 speed is unknown, defaulting to 1000 [ 409.086283][T16515] veth0_macvtap: entered promiscuous mode [ 409.108888][T16793] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3131'. [ 409.126136][T16515] veth1_macvtap: entered promiscuous mode [ 409.263013][T16802] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3137'. [ 409.283592][T16802] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 409.283616][T16802] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 409.284823][T16802] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 409.284843][T16802] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 409.415021][T16815] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3137'. [ 409.473851][T16806] bond3 (unregistering): Released all slaves [ 409.565595][T16515] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.635398][T16820] bond3 (unregistering): Released all slaves [ 409.755851][T16515] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 409.941579][ T5925] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.941629][ T5925] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.941665][ T5925] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.941700][ T5925] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.965571][T16833] wlan0 speed is unknown, defaulting to 1000 [ 410.149359][T16843] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3142'. [ 410.174564][ T5939] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.174585][ T5939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.346406][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.346427][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.490322][T16855] x_tables: duplicate entry at hook 1 [ 410.493392][T16851] bond0: (slave gretap0): Opening slave failed [ 410.499134][T16851] bond0: (slave gretap0): Opening slave failed [ 410.509473][T16851] bond0: (slave gretap0): Opening slave failed [ 410.524239][T16851] bond0: (slave gretap0): Opening slave failed [ 410.538667][T16851] bond0: (slave gretap0): Opening slave failed [ 410.544447][T16851] bond0: (slave gretap0): Opening slave failed [ 410.549126][T16851] bond0: (slave gretap0): Opening slave failed [ 410.553857][T16851] bond0: (slave gretap0): Opening slave failed [ 410.558797][T16851] bond0: (slave gretap0): Opening slave failed [ 410.563272][T16851] bond0: (slave gretap0): Opening slave failed [ 410.567752][T16851] bond0: (slave gretap0): Opening slave failed [ 410.579061][T16851] bond0: (slave gretap0): Opening slave failed [ 410.593342][T16851] bond0: (slave gretap0): Opening slave failed [ 410.597316][T16851] bond0: (slave gretap0): Opening slave failed [ 410.613639][T16851] bond0: (slave gretap0): Opening slave failed [ 410.621216][T16851] bond0: (slave gretap0): Opening slave failed [ 410.636197][T16851] bond0: (slave gretap0): Opening slave failed [ 410.643021][T16851] bond0: (slave gretap0): Opening slave failed [ 410.684913][T16851] bond0: (slave gretap0): Opening slave failed [ 410.747221][T16855] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3146'. [ 410.755244][T16855] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3146'. [ 410.769334][ T4934] Bluetooth: hci3: command tx timeout [ 410.802223][T16869] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3147'. [ 410.845346][T16872] netlink: 'syz.4.3146': attribute type 1 has an invalid length. [ 410.958328][T16851] bond0: (slave gretap0): Opening slave failed [ 411.031315][T16851] bond0: (slave gretap0): Opening slave failed [ 411.032783][T16851] bond0: (slave gretap0): Opening slave failed [ 411.035720][T16851] bond0: (slave gretap0): Opening slave failed [ 411.037516][T16851] bond0: (slave gretap0): Opening slave failed [ 411.066167][T16851] bond0: (slave gretap0): Opening slave failed [ 411.069572][T16851] bond0: (slave gretap0): Opening slave failed [ 411.077610][T16851] bond0: (slave gretap0): Opening slave failed [ 411.089650][T16851] bond0: (slave gretap0): Opening slave failed [ 411.099653][T16851] bond0: (slave gretap0): Opening slave failed [ 411.108047][T16851] bond0: (slave gretap0): Opening slave failed [ 411.117784][T16851] bond0: (slave gretap0): Opening slave failed [ 411.129894][T16851] bond0: (slave gretap0): Opening slave failed [ 411.148615][T16851] bond0: (slave gretap0): Opening slave failed [ 411.307323][T16883] sit0: entered promiscuous mode [ 411.322961][T16883] netlink: 'syz.4.3150': attribute type 1 has an invalid length. [ 411.322986][T16883] netlink: 1 bytes leftover after parsing attributes in process `syz.4.3150'. [ 411.444924][ T5625] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 411.457848][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 411.459158][ T5625] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 411.460104][ T5625] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 411.463033][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 412.158364][T16884] wlan0 speed is unknown, defaulting to 1000 [ 412.329025][T16923] wlan0 speed is unknown, defaulting to 1000 [ 413.099887][T16884] bridge0: port 1(bridge_slave_0) entered blocking state [ 413.100058][T16884] bridge0: port 1(bridge_slave_0) entered disabled state [ 413.100194][T16884] bridge_slave_0: entered allmulticast mode [ 413.102618][T16884] bridge_slave_0: entered promiscuous mode [ 413.105672][T16884] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.105833][T16884] bridge0: port 2(bridge_slave_1) entered disabled state [ 413.105967][T16884] bridge_slave_1: entered allmulticast mode [ 413.107899][T16884] bridge_slave_1: entered promiscuous mode [ 413.143486][T16884] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 413.146903][T16884] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 413.184461][T16884] team0: Port device team_slave_0 added [ 413.188682][T16884] team0: Port device team_slave_1 added [ 413.302014][T16884] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 413.302032][T16884] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 413.302055][T16884] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 413.307660][T16884] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 413.307700][T16884] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 413.307723][T16884] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 413.442514][T16884] hsr_slave_0: entered promiscuous mode [ 413.444319][T16884] hsr_slave_1: entered promiscuous mode [ 413.447853][T16884] debugfs: 'hsr0' already exists in 'hsr' [ 413.447873][T16884] Cannot create hsr debugfs directory [ 413.490272][T16967] vlan2: entered promiscuous mode [ 413.490296][T16967] bridge0: entered promiscuous mode [ 413.550639][ T5625] Bluetooth: hci2: command tx timeout [ 413.804259][T16987] netlink: 'syz.0.3174': attribute type 2 has an invalid length. [ 413.804282][T16987] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3174'. [ 413.804298][T16987] netlink: 'syz.0.3174': attribute type 2 has an invalid length. [ 413.804309][T16987] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3174'. [ 413.947182][T16884] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 413.947215][T16884] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.000385][T16994] x_tables: duplicate entry at hook 2 [ 414.058254][T16884] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 414.058289][T16884] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.144802][T17000] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3181'. [ 414.187469][T16884] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 414.187503][T16884] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.222183][T17003] FAULT_INJECTION: forcing a failure. [ 414.222183][T17003] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 414.222215][T17003] CPU: 0 UID: 0 PID: 17003 Comm: syz.4.3182 Not tainted syzkaller #0 PREEMPT(full) [ 414.222235][T17003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 414.222248][T17003] Call Trace: [ 414.222256][T17003] [ 414.222265][T17003] dump_stack_lvl+0xe8/0x150 [ 414.222297][T17003] should_fail_ex+0x410/0x560 [ 414.222333][T17003] _copy_from_user+0x2d/0xb0 [ 414.222359][T17003] ___sys_recvmsg+0x173/0x5a0 [ 414.222392][T17003] ? __pfx____sys_recvmsg+0x10/0x10 [ 414.222423][T17003] ? lock_acquire+0x115/0x350 [ 414.222472][T17003] do_recvmmsg+0x31a/0x7f0 [ 414.222507][T17003] ? __pfx_do_recvmmsg+0x10/0x10 [ 414.222543][T17003] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 414.222568][T17003] ? __fget_files+0x3a2/0x420 [ 414.222605][T17003] __x64_sys_recvmmsg+0x198/0x250 [ 414.222634][T17003] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 414.222672][T17003] do_syscall_64+0x166/0x520 [ 414.222697][T17003] ? trace_irq_disable+0x3b/0x140 [ 414.222716][T17003] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.222736][T17003] ? clear_bhb_loop+0x70/0xc0 [ 414.222759][T17003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.222779][T17003] RIP: 0033:0x7f9693d9e159 [ 414.222796][T17003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.222810][T17003] RSP: 002b:00007f9694cf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 414.222831][T17003] RAX: ffffffffffffffda RBX: 00007f9694025fa0 RCX: 00007f9693d9e159 [ 414.222846][T17003] RDX: 000000000400023c RSI: 00002000000055c0 RDI: 0000000000000004 [ 414.222858][T17003] RBP: 00007f9694cf6090 R08: 0000000000000000 R09: 0000000000000000 [ 414.222870][T17003] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000002 [ 414.222882][T17003] R13: 00007f9694026038 R14: 00007f9694025fa0 R15: 00007ffeb8798758 [ 414.222913][T17003] [ 414.359474][T16884] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 414.359508][T16884] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.644521][T17016] netlink: 'syz.0.3186': attribute type 2 has an invalid length. [ 414.682958][T17010] x_tables: duplicate underflow at hook 4 [ 414.792619][T17018] bridge_slave_0: left allmulticast mode [ 414.792653][T17018] bridge_slave_0: left promiscuous mode [ 414.792904][T17018] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.817260][T17018] bridge_slave_1: left allmulticast mode [ 414.817289][T17018] bridge_slave_1: left promiscuous mode [ 414.817495][T17018] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.846474][T17018] bond0: (slave bond_slave_0): Releasing backup interface [ 414.875155][T17018] bond0: (slave bond_slave_1): Releasing backup interface [ 414.925087][T17018] team0: Port device team_slave_0 removed [ 414.934349][T17018] team0: Port device team_slave_1 removed [ 414.935274][T17018] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 414.935294][T17018] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 414.939565][T17018] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 414.939585][T17018] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 414.946024][T17018] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 415.019316][T17021] team0: Port device xfrm0 added [ 415.102903][T16884] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 415.108444][T16884] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 415.125535][T16884] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 415.138601][T16884] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 415.139825][T16884] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 415.153870][T16884] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 415.154707][T16884] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 415.178524][T16884] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 415.314629][T16884] 8021q: adding VLAN 0 to HW filter on device bond0 [ 415.341477][T16884] 8021q: adding VLAN 0 to HW filter on device team0 [ 415.359601][ T5939] bridge0: port 1(bridge_slave_0) entered blocking state [ 415.359686][ T5939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 415.407813][ T5939] bridge0: port 2(bridge_slave_1) entered blocking state [ 415.407924][ T5939] bridge0: port 2(bridge_slave_1) entered forwarding state [ 415.632200][ T5625] Bluetooth: hci2: command tx timeout [ 415.923107][T17066] x_tables: duplicate entry at hook 3 [ 415.965937][T17067] ip6erspan0: entered allmulticast mode [ 416.333455][T16884] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 416.433349][T16884] veth0_vlan: entered promiscuous mode [ 416.453991][T16884] veth1_vlan: entered promiscuous mode [ 416.506612][T16884] veth0_macvtap: entered promiscuous mode [ 416.524417][T16884] veth1_macvtap: entered promiscuous mode [ 416.556134][T16884] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 416.571574][T16884] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 416.667851][ T5930] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.668379][ T5930] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.668757][ T5930] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.669245][ T5930] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.862834][T17097] veth0_to_bridge: entered promiscuous mode [ 416.862976][T17097] macsec1: entered allmulticast mode [ 416.862991][T17097] veth0_to_bridge: entered allmulticast mode [ 416.869298][T17097] veth0_to_bridge: left allmulticast mode [ 416.869326][T17097] veth0_to_bridge: left promiscuous mode [ 416.949144][ T5930] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 416.949166][ T5930] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.039121][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 417.039142][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.433378][T17121] FAULT_INJECTION: forcing a failure. [ 417.433378][T17121] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 417.433420][T17121] CPU: 0 UID: 0 PID: 17121 Comm: syz.0.3220 Not tainted syzkaller #0 PREEMPT(full) [ 417.433439][T17121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 417.433449][T17121] Call Trace: [ 417.433456][T17121] [ 417.433464][T17121] dump_stack_lvl+0xe8/0x150 [ 417.433497][T17121] should_fail_ex+0x410/0x560 [ 417.433522][T17121] _copy_from_user+0x2d/0xb0 [ 417.433545][T17121] ___sys_recvmsg+0x173/0x5a0 [ 417.433576][T17121] ? __pfx____sys_recvmsg+0x10/0x10 [ 417.433606][T17121] ? lock_acquire+0x115/0x350 [ 417.433652][T17121] do_recvmmsg+0x31a/0x7f0 [ 417.433684][T17121] ? __pfx_do_recvmmsg+0x10/0x10 [ 417.433720][T17121] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 417.433746][T17121] ? __fget_files+0x3a2/0x420 [ 417.433781][T17121] __x64_sys_recvmmsg+0x198/0x250 [ 417.433809][T17121] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 417.433844][T17121] do_syscall_64+0x166/0x520 [ 417.433865][T17121] ? trace_irq_disable+0x3b/0x140 [ 417.433884][T17121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.433902][T17121] ? clear_bhb_loop+0x70/0xc0 [ 417.433926][T17121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 417.433945][T17121] RIP: 0033:0x7f657f99e159 [ 417.433962][T17121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 417.433979][T17121] RSP: 002b:00007f6580950028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 417.433998][T17121] RAX: ffffffffffffffda RBX: 00007f657fc25fa0 RCX: 00007f657f99e159 [ 417.434012][T17121] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 417.434022][T17121] RBP: 00007f6580950090 R08: 0000000000000000 R09: 0000000000000000 [ 417.434033][T17121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 417.434044][T17121] R13: 00007f657fc26038 R14: 00007f657fc25fa0 R15: 00007ffc9a26fb58 [ 417.434074][T17121] [ 417.714947][ T5625] Bluetooth: hci2: command tx timeout [ 417.803248][T17138] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3225'. [ 417.886288][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 417.902361][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 417.903138][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 417.905697][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 417.906319][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 417.969814][T17143] wlan0 speed is unknown, defaulting to 1000 [ 417.969900][T17143] wlan0 speed is unknown, defaulting to 1000 [ 417.988524][T17143] wlan0 speed is unknown, defaulting to 1000 [ 417.998088][T17143] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 417.998124][T17143] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 417.998248][T17143] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 418.056341][T17143] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 418.097375][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.100178][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.120171][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.128699][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.139843][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.150892][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.154809][T17143] wlan0 speed is unknown, defaulting to 1000 [ 418.174352][T17147] openvswitch: netlink: IP tunnel dst address not specified [ 418.717536][T17169] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input26 [ 419.053939][T17141] wlan0 speed is unknown, defaulting to 1000 [ 419.072459][T17141] wlan0 speed is unknown, defaulting to 1000 [ 419.189085][T17187] bridge1: entered promiscuous mode [ 419.189103][T17187] bridge1: entered allmulticast mode [ 419.190302][T17187] team0: Device bridge1 is of different type [ 419.504009][T17141] bridge0: port 1(bridge_slave_0) entered blocking state [ 419.504200][T17141] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.504613][T17141] bridge_slave_0: entered allmulticast mode [ 419.506434][T17141] bridge_slave_0: entered promiscuous mode [ 419.536606][T17141] bridge0: port 2(bridge_slave_1) entered blocking state [ 419.536777][T17141] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.536926][T17141] bridge_slave_1: entered allmulticast mode [ 419.538674][T17141] bridge_slave_1: entered promiscuous mode [ 419.601481][T17141] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 419.604300][T17141] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 419.655947][T17141] team0: Port device team_slave_0 added [ 419.659117][T17141] team0: Port device team_slave_1 added [ 419.704273][T17141] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 419.704289][T17141] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.704313][T17141] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 419.706286][T17141] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 419.706300][T17141] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.706323][T17141] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 419.791647][ T5625] Bluetooth: hci2: command tx timeout [ 419.858019][T17201] netlink: 136 bytes leftover after parsing attributes in process `syz.4.3239'. [ 419.937001][T17141] hsr_slave_0: entered promiscuous mode [ 419.939853][T17141] hsr_slave_1: entered promiscuous mode [ 419.945035][T17141] debugfs: 'hsr0' already exists in 'hsr' [ 419.945060][T17141] Cannot create hsr debugfs directory [ 419.963311][T17198] wlan0 speed is unknown, defaulting to 1000 [ 420.031126][ T5625] Bluetooth: hci1: command tx timeout [ 420.101897][T17198] wlan0 speed is unknown, defaulting to 1000 [ 421.031354][T17141] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.031400][T17141] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.032302][T17228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3246'. [ 421.250308][T17141] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.250330][T17141] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.507685][T17141] bond0: (slave netdevsim1): Releasing backup interface [ 421.585818][T17141] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.585851][T17141] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 421.735515][T17141] batman_adv: batadv0: Removing interface: vlan2 [ 421.763577][T17141] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.763613][T17141] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.154486][ T5625] Bluetooth: hci1: command tx timeout [ 422.330034][T17141] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 422.368053][T17258] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3257'. [ 422.771353][T17141] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 422.812469][T17141] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 422.831405][T17141] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 422.842064][T17141] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 422.871545][T17141] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 422.872731][T17141] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 422.894716][T17141] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 423.024978][T17141] 8021q: adding VLAN 0 to HW filter on device bond0 [ 423.062396][T17141] 8021q: adding VLAN 0 to HW filter on device team0 [ 423.077750][ T5930] bridge0: port 1(bridge_slave_0) entered blocking state [ 423.077840][ T5930] bridge0: port 1(bridge_slave_0) entered forwarding state [ 423.116254][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 423.116364][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 424.190108][T17141] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 424.190599][ T5625] Bluetooth: hci1: command tx timeout [ 424.329989][T17141] veth0_vlan: entered promiscuous mode [ 424.358933][T17141] veth1_vlan: entered promiscuous mode [ 424.451809][T17141] veth0_macvtap: entered promiscuous mode [ 424.467459][T17141] veth1_macvtap: entered promiscuous mode [ 424.607425][T17141] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 424.618480][T17141] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 424.853675][ T1105] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.853719][ T1105] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.853751][ T1105] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.853781][ T1105] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.110847][ T5930] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.110868][ T5930] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.181714][ T5930] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.181735][ T5930] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.309311][T17371] FAULT_INJECTION: forcing a failure. [ 425.309311][T17371] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 425.309359][T17371] CPU: 1 UID: 0 PID: 17371 Comm: syz.1.3223 Not tainted syzkaller #0 PREEMPT(full) [ 425.309379][T17371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 425.309396][T17371] Call Trace: [ 425.309408][T17371] [ 425.309416][T17371] dump_stack_lvl+0xe8/0x150 [ 425.309449][T17371] should_fail_ex+0x410/0x560 [ 425.309475][T17371] _copy_from_user+0x2d/0xb0 [ 425.309501][T17371] ___sys_sendmsg+0x1c6/0x360 [ 425.309525][T17371] ? __lock_acquire+0x747/0x2de0 [ 425.309547][T17371] ? __pfx____sys_sendmsg+0x10/0x10 [ 425.309575][T17371] ? kstrtouint+0x6e/0xe0 [ 425.309620][T17371] ? __fget_files+0x2a/0x420 [ 425.309644][T17371] ? __fget_files+0x3a2/0x420 [ 425.309678][T17371] __sys_sendmmsg+0x273/0x4d0 [ 425.309706][T17371] ? __pfx___sys_sendmmsg+0x10/0x10 [ 425.309738][T17371] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 425.309773][T17371] ? ksys_write+0x242/0x270 [ 425.309801][T17371] ? __pfx_ksys_write+0x10/0x10 [ 425.309832][T17371] __x64_sys_sendmmsg+0xa0/0xc0 [ 425.309859][T17371] do_syscall_64+0x166/0x520 [ 425.309882][T17371] ? trace_irq_disable+0x3b/0x140 [ 425.309901][T17371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.309920][T17371] ? clear_bhb_loop+0x70/0xc0 [ 425.309944][T17371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.309963][T17371] RIP: 0033:0x7fe14f59e159 [ 425.309981][T17371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.309997][T17371] RSP: 002b:00007fe1503f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 425.310016][T17371] RAX: ffffffffffffffda RBX: 00007fe14f825fa0 RCX: 00007fe14f59e159 [ 425.310029][T17371] RDX: 0000000000000002 RSI: 0000200000004f80 RDI: 0000000000000003 [ 425.310041][T17371] RBP: 00007fe1503f2090 R08: 0000000000000000 R09: 0000000000000000 [ 425.310053][T17371] R10: 0000000004044880 R11: 0000000000000246 R12: 0000000000000001 [ 425.310064][T17371] R13: 00007fe14f826038 R14: 00007fe14f825fa0 R15: 00007ffedb018398 [ 425.310104][T17371] [ 425.555366][T17381] FAULT_INJECTION: forcing a failure. [ 425.555366][T17381] name failslab, interval 1, probability 0, space 0, times 0 [ 425.555397][T17381] CPU: 1 UID: 0 PID: 17381 Comm: syz.4.3291 Not tainted syzkaller #0 PREEMPT(full) [ 425.555418][T17381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 425.555430][T17381] Call Trace: [ 425.555438][T17381] [ 425.555446][T17381] dump_stack_lvl+0xe8/0x150 [ 425.555479][T17381] should_fail_ex+0x410/0x560 [ 425.555507][T17381] should_failslab+0xa8/0x100 [ 425.555531][T17381] ? skb_clone+0x212/0x3a0 [ 425.555556][T17381] kmem_cache_alloc_noprof+0xa1/0x600 [ 425.555586][T17381] ? skb_clone+0x212/0x3a0 [ 425.555618][T17381] skb_clone+0x212/0x3a0 [ 425.555647][T17381] bpf_clone_redirect+0x170/0x4b0 [ 425.555709][T17381] ? bpf_test_run+0x1d1/0x830 [ 425.555799][T17381] bpf_prog_cfa4bf6e1e03aea2+0x5f/0x68 [ 425.555818][T17381] ? __kernel_text_address+0xd/0x30 [ 425.555842][T17381] ? arch_stack_walk+0xfb/0x150 [ 425.555868][T17381] ? __pfx___schedule+0x10/0x10 [ 425.555905][T17381] ? preempt_schedule_thunk+0x16/0x40 [ 425.555929][T17381] ? preempt_schedule_common+0x7f/0xd0 [ 425.555950][T17381] ? bpf_test_run+0x1d1/0x830 [ 425.555982][T17381] ? bpf_test_timer_continue+0x10c/0x320 [ 425.556006][T17381] bpf_test_run+0x354/0x830 [ 425.556065][T17381] ? __pfx_bpf_test_run+0x10/0x10 [ 425.556110][T17381] ? __kasan_krealloc+0xec/0x110 [ 425.556142][T17381] ? skb_dst_set+0x72/0x140 [ 425.556173][T17381] bpf_prog_test_run_skb+0xe35/0x2230 [ 425.556223][T17381] ? __fget_files+0x3a2/0x420 [ 425.556249][T17381] ? __fget_files+0x2a/0x420 [ 425.556280][T17381] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 425.556309][T17381] bpf_prog_test_run+0x2c5/0x340 [ 425.556337][T17381] __sys_bpf+0xa22/0xd90 [ 425.556368][T17381] ? __pfx___sys_bpf+0x10/0x10 [ 425.556402][T17381] ? __fget_files+0x2a/0x420 [ 425.556446][T17381] ? ksys_write+0x242/0x270 [ 425.556477][T17381] ? __pfx_ksys_write+0x10/0x10 [ 425.556511][T17381] __x64_sys_bpf+0xba/0xd0 [ 425.556534][T17381] do_syscall_64+0x166/0x520 [ 425.556556][T17381] ? trace_irq_disable+0x3b/0x140 [ 425.556575][T17381] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.556595][T17381] ? clear_bhb_loop+0x70/0xc0 [ 425.556619][T17381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.556639][T17381] RIP: 0033:0x7f9693d9e159 [ 425.556657][T17381] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 425.556673][T17381] RSP: 002b:00007f9694cd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 425.556694][T17381] RAX: ffffffffffffffda RBX: 00007f9694026090 RCX: 00007f9693d9e159 [ 425.556708][T17381] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 425.556721][T17381] RBP: 00007f9694cd5090 R08: 0000000000000000 R09: 0000000000000000 [ 425.556733][T17381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 425.556745][T17381] R13: 00007f9694026128 R14: 00007f9694026090 R15: 00007ffeb8798758 [ 425.556778][T17381] [ 426.132554][T17401] x_tables: duplicate underflow at hook 4 [ 426.270744][ T5625] Bluetooth: hci1: command tx timeout [ 426.311807][T17406] netlink: 'syz.2.3299': attribute type 10 has an invalid length. [ 426.457377][T17402] wlan0 speed is unknown, defaulting to 1000 [ 426.459157][T17402] wlan0 speed is unknown, defaulting to 1000 [ 426.694623][T17418] FAULT_INJECTION: forcing a failure. [ 426.694623][T17418] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 426.694655][T17418] CPU: 1 UID: 0 PID: 17418 Comm: syz.0.3304 Not tainted syzkaller #0 PREEMPT(full) [ 426.694677][T17418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 426.694688][T17418] Call Trace: [ 426.694695][T17418] [ 426.694703][T17418] dump_stack_lvl+0xe8/0x150 [ 426.694735][T17418] should_fail_ex+0x410/0x560 [ 426.694761][T17418] _copy_from_user+0x2d/0xb0 [ 426.694786][T17418] ___sys_sendmsg+0x1c6/0x360 [ 426.694811][T17418] ? __lock_acquire+0x747/0x2de0 [ 426.694836][T17418] ? __pfx____sys_sendmsg+0x10/0x10 [ 426.694895][T17418] ? __fget_files+0x2a/0x420 [ 426.694921][T17418] ? __fget_files+0x3a2/0x420 [ 426.694955][T17418] __x64_sys_sendmsg+0x1b1/0x290 [ 426.694983][T17418] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 426.695029][T17418] do_syscall_64+0x166/0x520 [ 426.695053][T17418] ? trace_irq_disable+0x3b/0x140 [ 426.695072][T17418] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.695092][T17418] ? clear_bhb_loop+0x70/0xc0 [ 426.695115][T17418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.695134][T17418] RIP: 0033:0x7f657f99e159 [ 426.695153][T17418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.695168][T17418] RSP: 002b:00007f6580950028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 426.695189][T17418] RAX: ffffffffffffffda RBX: 00007f657fc25fa0 RCX: 00007f657f99e159 [ 426.695203][T17418] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 426.695216][T17418] RBP: 00007f6580950090 R08: 0000000000000000 R09: 0000000000000000 [ 426.695227][T17418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.695238][T17418] R13: 00007f657fc26038 R14: 00007f657fc25fa0 R15: 00007ffc9a26fb58 [ 426.695269][T17418] [ 427.252127][T17447] Cannot find set identified by id 65534 to match [ 427.492079][T17455] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 427.492079][T17455] Please contact the netfilter-devel mailing list or update your nftables rules. [ 428.404313][T17480] netlink: 'syz.2.3324': attribute type 14 has an invalid length. [ 429.020854][T17520] FAULT_INJECTION: forcing a failure. [ 429.020854][T17520] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 429.020886][T17520] CPU: 1 UID: 0 PID: 17520 Comm: syz.4.3339 Not tainted syzkaller #0 PREEMPT(full) [ 429.020907][T17520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 429.020919][T17520] Call Trace: [ 429.020927][T17520] [ 429.020935][T17520] dump_stack_lvl+0xe8/0x150 [ 429.020966][T17520] should_fail_ex+0x410/0x560 [ 429.020994][T17520] _copy_from_user+0x2d/0xb0 [ 429.021020][T17520] __sys_connect+0x155/0x450 [ 429.021046][T17520] ? __pfx___sys_connect+0x10/0x10 [ 429.021080][T17520] ? __pfx_ksys_write+0x10/0x10 [ 429.021127][T17520] __x64_sys_connect+0x7a/0x90 [ 429.021151][T17520] do_syscall_64+0x166/0x520 [ 429.021171][T17520] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.021189][T17520] ? clear_bhb_loop+0x70/0xc0 [ 429.021212][T17520] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.021237][T17520] RIP: 0033:0x7f9693d9e159 [ 429.021255][T17520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 429.021270][T17520] RSP: 002b:00007f9694cf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 429.021289][T17520] RAX: ffffffffffffffda RBX: 00007f9694025fa0 RCX: 00007f9693d9e159 [ 429.021303][T17520] RDX: 000000000000000e RSI: 0000200000000240 RDI: 0000000000000004 [ 429.021316][T17520] RBP: 00007f9694cf6090 R08: 0000000000000000 R09: 0000000000000000 [ 429.021328][T17520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 429.021339][T17520] R13: 00007f9694026038 R14: 00007f9694025fa0 R15: 00007ffeb8798758 [ 429.021370][T17520] [ 429.049197][T17515] syzkaller0: entered promiscuous mode [ 429.049217][T17515] syzkaller0: entered allmulticast mode [ 429.109270][T17516] 0: reclassify loop, rule prio 0, protocol 800 [ 429.109435][T17515] 0: reclassify loop, rule prio 0, protocol 800 [ 429.273537][T17528] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3344'. [ 429.586088][T17550] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3353'. [ 429.766926][T17558] netlink: zone id is out of range [ 429.766941][T17558] netlink: zone id is out of range [ 429.766950][T17558] netlink: zone id is out of range [ 429.766958][T17558] netlink: zone id is out of range [ 429.766967][T17558] netlink: zone id is out of range [ 429.766975][T17558] netlink: zone id is out of range [ 429.766983][T17558] netlink: zone id is out of range [ 429.766991][T17558] netlink: zone id is out of range [ 429.784302][T17558] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3356'. [ 429.784325][T17558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3356'. [ 430.502048][ T38] bond5 (unregistering): (slave bridge1): Releasing backup interface [ 430.502076][ T38] bridge1 (unregistering): left promiscuous mode [ 430.536813][ T38] bond0 (unregistering): (slave bridge2): Releasing active interface [ 431.171102][ T38] .` (unregistering): Released all slaves [ 431.181838][ T38] bond1 (unregistering): Released all slaves [ 431.200046][ T38] bond2 (unregistering): (slave veth7): Releasing active interface [ 431.227401][ T38] bond2 (unregistering): (slave veth0_to_bond): Releasing active interface [ 431.245091][ T38] bond2 (unregistering): Released all slaves [ 431.279624][ T38] bond3 (unregistering): Released all slaves [ 431.318863][ T38] bond4 (unregistering): Released all slaves [ 431.347029][ T38] bond5 (unregistering): Released all slaves [ 431.369073][T17604] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3374'. [ 431.369102][T17604] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3374'. [ 431.388941][ T38] bond0 (unregistering): Released all slaves [ 431.411761][ T38] bond6 (unregistering): Released all slaves [ 431.421072][T17606] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3374'. [ 431.638317][ T38] tipc: Left network mode [ 431.938265][T17633] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input27 [ 433.419882][ T5925] smbdirect: ib_dev[s] removed [ 433.467576][T17686] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3398'. [ 434.108240][T17690] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 434.544529][T17717] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3402'. [ 434.604673][ T38] hsr_slave_0: left promiscuous mode [ 434.610322][ T38] hsr_slave_1: left promiscuous mode [ 434.656411][ T38] veth1_macvtap: left promiscuous mode [ 434.656445][ T38] veth0_macvtap: left promiscuous mode [ 434.659718][ T38] veth1_vlan: left promiscuous mode [ 434.794538][T17729] block nbd0: not configured, cannot reconfigure [ 435.028305][T17744] FAULT_INJECTION: forcing a failure. [ 435.028305][T17744] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 435.028337][T17744] CPU: 1 UID: 0 PID: 17744 Comm: syz.2.3409 Not tainted syzkaller #0 PREEMPT(full) [ 435.028357][T17744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 435.028368][T17744] Call Trace: [ 435.028376][T17744] [ 435.028385][T17744] dump_stack_lvl+0xe8/0x150 [ 435.028416][T17744] should_fail_ex+0x410/0x560 [ 435.028453][T17744] _copy_to_user+0x31/0xb0 [ 435.028480][T17744] simple_read_from_buffer+0xe1/0x170 [ 435.028513][T17744] proc_fail_nth_read+0x1bb/0x230 [ 435.028531][T17744] ? common_file_perm+0x20e/0x2b0 [ 435.028557][T17744] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 435.028577][T17744] ? rw_verify_area+0x24a/0x4c0 [ 435.028605][T17744] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 435.028622][T17744] vfs_read+0x213/0xa80 [ 435.028653][T17744] ? __pfx___mutex_lock+0x10/0x10 [ 435.028677][T17744] ? __pfx_vfs_read+0x10/0x10 [ 435.028704][T17744] ? __fget_files+0x2a/0x420 [ 435.028731][T17744] ? __fget_files+0x3a2/0x420 [ 435.028754][T17744] ? __fget_files+0x2a/0x420 [ 435.028786][T17744] ksys_read+0x150/0x270 [ 435.028815][T17744] ? __pfx_ksys_read+0x10/0x10 [ 435.028852][T17744] do_syscall_64+0x166/0x520 [ 435.028874][T17744] ? trace_irq_disable+0x3b/0x140 [ 435.028892][T17744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.028910][T17744] ? clear_bhb_loop+0x70/0xc0 [ 435.028933][T17744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.028951][T17744] RIP: 0033:0x7f9731b5e98e [ 435.028972][T17744] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 435.028987][T17744] RSP: 002b:00007f97329a4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 435.029007][T17744] RAX: ffffffffffffffda RBX: 00007f97329a56c0 RCX: 00007f9731b5e98e [ 435.029020][T17744] RDX: 000000000000000f RSI: 00007f97329a50a0 RDI: 0000000000000004 [ 435.029032][T17744] RBP: 00007f97329a5090 R08: 0000000000000000 R09: 0000000000000000 [ 435.029043][T17744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.029054][T17744] R13: 00007f9731e26038 R14: 00007f9731e25fa0 R15: 00007ffeda9c8d08 [ 435.029084][T17744] [ 436.107489][T17768] vlan2: entered promiscuous mode [ 436.107511][T17768] bridge0: entered promiscuous mode [ 436.149318][T17769] netlink: 'syz.4.3414': attribute type 16 has an invalid length. [ 436.149343][T17769] netlink: 'syz.4.3414': attribute type 17 has an invalid length. [ 436.391605][T17769] sit0: left promiscuous mode [ 436.438929][T17769] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.439571][T17769] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.660616][T17798] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3422'. [ 436.665136][T17798] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3422'. [ 437.201955][T17769] bond2: left allmulticast mode [ 437.206317][T17769] ip6erspan0: left allmulticast mode [ 437.238491][ T38] IPVS: stop unused estimator thread 0... [ 437.388233][T17829] netlink: 'syz.4.3427': attribute type 11 has an invalid length. [ 437.400827][ T5925] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.400873][ T5925] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.400904][ T5925] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.400932][ T5925] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.647565][T17831] FAULT_INJECTION: forcing a failure. [ 437.647565][T17831] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 437.647604][T17831] CPU: 1 UID: 0 PID: 17831 Comm: syz.1.3428 Not tainted syzkaller #0 PREEMPT(full) [ 437.647626][T17831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 437.647638][T17831] Call Trace: [ 437.647646][T17831] [ 437.647654][T17831] dump_stack_lvl+0xe8/0x150 [ 437.647687][T17831] should_fail_ex+0x410/0x560 [ 437.647715][T17831] _copy_from_user+0x2d/0xb0 [ 437.647741][T17831] ___sys_sendmsg+0x1c6/0x360 [ 437.647773][T17831] ? __pfx____sys_sendmsg+0x10/0x10 [ 437.647821][T17831] ? vfs_write+0x9ce/0xba0 [ 437.647867][T17831] ? do_sys_openat2+0x14e/0x200 [ 437.647898][T17831] __x64_sys_sendmsg+0x1b1/0x290 [ 437.647926][T17831] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 437.647973][T17831] do_syscall_64+0x166/0x520 [ 437.647996][T17831] ? trace_irq_disable+0x3b/0x140 [ 437.648017][T17831] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.648036][T17831] ? clear_bhb_loop+0x70/0xc0 [ 437.648060][T17831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.648079][T17831] RIP: 0033:0x7fe14f59e159 [ 437.648096][T17831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.648122][T17831] RSP: 002b:00007fe1503f2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 437.648143][T17831] RAX: ffffffffffffffda RBX: 00007fe14f825fa0 RCX: 00007fe14f59e159 [ 437.648158][T17831] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b [ 437.648170][T17831] RBP: 00007fe1503f2090 R08: 0000000000000000 R09: 0000000000000000 [ 437.648182][T17831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.648193][T17831] R13: 00007fe14f826038 R14: 00007fe14f825fa0 R15: 00007ffedb018398 [ 437.648225][T17831] [ 438.244967][T17871] netlink: 'syz.4.3438': attribute type 10 has an invalid length. [ 438.269852][T17878] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3438'. [ 438.744359][T17901] veth0_to_bridge: entered promiscuous mode [ 438.746171][T17901] macsec1: entered allmulticast mode [ 438.746193][T17901] veth0_to_bridge: entered allmulticast mode [ 438.779582][T17901] veth0_to_bridge: left allmulticast mode [ 438.779611][T17901] veth0_to_bridge: left promiscuous mode [ 439.655046][T17929] macvlan0: entered promiscuous mode [ 440.157969][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 448.090434][ C1] sched: DL replenish lagged too much [ 502.637543][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.976916][ T52] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 506.979272][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 507.087827][ T5620] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 507.110967][ T5620] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 507.170643][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 507.180800][ T52] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 507.291799][ T52] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 507.316316][ T52] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 507.366088][ T5620] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 507.418152][ T5620] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 507.850875][ T5620] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 507.916524][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 507.949045][ T52] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 508.063599][T17989] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 508.474915][ T5637] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 509.001236][ T4934] Bluetooth: hci5: command 0x0406 tx timeout [ 510.717731][T17989] Bluetooth: hci0: command tx timeout [ 512.069203][ T5637] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 512.917547][ T5637] Bluetooth: hci0: command tx timeout [ 512.921101][ T5637] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 512.956055][ T5637] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 513.159896][ T5625] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 513.227531][ T5625] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 513.391249][ T5629] Bluetooth: hci7: command tx timeout [ 513.471454][ T5629] Bluetooth: hci6: command tx timeout [ 515.110458][ T5625] Bluetooth: hci0: command tx timeout [ 515.482420][ T5625] Bluetooth: hci7: command tx timeout [ 515.571116][ T5625] Bluetooth: hci6: command tx timeout [ 516.201548][ T5625] Bluetooth: hci8: command tx timeout [ 516.258189][ T5625] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 516.298862][ T5625] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 516.313730][ T5625] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 516.337597][ T5625] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 516.381127][ T5625] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 517.300959][ T5625] Bluetooth: hci0: command tx timeout [ 517.801852][ T5625] Bluetooth: hci7: command tx timeout [ 517.801895][ T5625] Bluetooth: hci6: command tx timeout [ 518.275762][ T4934] Bluetooth: hci8: command tx timeout [ 519.121528][ T4934] Bluetooth: hci4: command 0x0406 tx timeout [ 519.980636][ T4934] Bluetooth: hci6: command tx timeout [ 519.980672][ T4934] Bluetooth: hci7: command tx timeout [ 520.355264][T17989] Bluetooth: hci8: command tx timeout [ 522.617070][ T5625] Bluetooth: hci8: command tx timeout [ 529.295841][ T5637] Bluetooth: hci3: command 0x0406 tx timeout [ 530.169143][ T5637] Bluetooth: hci9: command tx timeout [ 532.191390][ T5637] Bluetooth: hci9: command tx timeout [ 534.397835][ T5637] Bluetooth: hci9: command tx timeout [ 537.001263][T17989] Bluetooth: hci9: command tx timeout [ 553.134860][ T5629] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 554.298948][ T5629] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 554.731095][ T5629] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 555.050055][ T5629] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 557.267018][ T5629] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 558.811110][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 563.040512][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.401518][T17989] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 563.610780][T17989] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 563.759021][T17989] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 564.201228][T17989] Bluetooth: hci4: command tx timeout [ 565.791559][ T5629] Bluetooth: hci2: Opcode 0x0c23 failed: -110 [ 566.705121][ T5629] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 566.705201][ T5629] Bluetooth: hci4: command tx timeout [ 566.741111][ T5629] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 568.981796][T17989] Bluetooth: hci4: command tx timeout [ 568.981878][T17989] Bluetooth: hci2: command 0x1001 tx timeout [ 569.171530][T18038] Bluetooth: hci2: Opcode 0x1001 failed: -110 [ 571.100775][ T5629] Bluetooth: hci4: command tx timeout [ 573.759811][ T5637] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 573.899813][ T5637] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 573.960935][ T5637] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 574.119944][ T5637] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 574.701104][ T5637] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 577.561025][ T5629] Bluetooth: hci5: command tx timeout [ 578.164974][ T5629] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 579.470935][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 579.541031][ T5629] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 579.751497][ T5629] Bluetooth: hci5: command tx timeout [ 580.040703][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 580.060928][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 582.327669][ T5637] Bluetooth: hci5: command tx timeout [ 583.707742][ T5637] Bluetooth: hci3: command tx timeout [ 584.391139][ T5637] Bluetooth: hci5: command tx timeout [ 585.921305][ T5637] Bluetooth: hci3: command tx timeout [ 588.501006][ T5637] Bluetooth: hci3: command tx timeout [ 590.862478][ T5637] Bluetooth: hci3: command tx timeout [ 594.767356][ T5629] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 595.018835][ T5629] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 595.109456][ T5629] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 595.171446][ T5629] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 595.307961][ T5629] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 598.199923][ T5637] Bluetooth: hci2: command tx timeout [ 600.501793][ T5637] Bluetooth: hci2: command tx timeout [ 602.763581][ T5637] Bluetooth: hci2: command tx timeout [ 604.831180][ T5637] Bluetooth: hci2: command tx timeout [ 624.617290][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 632.787498][ T5629] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 633.370918][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 633.380732][ T5629] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 633.410780][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 633.450216][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 635.531884][T17989] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 636.849431][ T5637] Bluetooth: hci8: command 0x0406 tx timeout [ 636.900554][ T5637] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 636.926881][ T5637] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 636.960189][ T5637] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 636.979428][ T5637] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 638.751377][ T5629] Bluetooth: hci0: command tx timeout [ 640.341707][ T5629] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 640.501580][ T5629] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 640.511726][ T5637] Bluetooth: hci6: command tx timeout [ 640.538128][ T5629] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 640.570835][ T5629] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 640.591107][ T5629] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 640.903855][ T5625] Bluetooth: hci0: command tx timeout [ 642.870717][ T5629] Bluetooth: hci6: command tx timeout [ 642.913661][ T5629] Bluetooth: hci0: command tx timeout [ 642.913724][ T5629] Bluetooth: hci7: command tx timeout [ 645.234589][ T5629] Bluetooth: hci6: command tx timeout [ 645.234629][ T5629] Bluetooth: hci7: command tx timeout [ 645.234653][ T5629] Bluetooth: hci0: command tx timeout [ 645.730521][ T5625] Bluetooth: hci9: Opcode 0x0c03 failed: -110 [ 646.619209][ T5637] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 647.618861][ T5637] Bluetooth: hci7: command tx timeout [ 647.618904][ T5637] Bluetooth: hci6: command tx timeout [ 648.671916][ T5625] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 649.527603][ T5629] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 649.551031][ T5629] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 649.597643][ T5629] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 649.841049][ T5629] Bluetooth: hci7: command tx timeout [ 650.227983][ T5629] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 651.500898][ T5629] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 654.361577][ T5629] Bluetooth: hci8: command tx timeout [ 656.431350][ T5629] Bluetooth: hci8: command tx timeout [ 658.531179][ T5629] Bluetooth: hci8: command tx timeout [ 660.638821][ T5629] Bluetooth: hci8: command tx timeout [ 668.441414][ T5941] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 687.090534][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 701.839522][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 701.873643][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 701.890554][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 701.930735][ T5637] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 702.200771][ T5637] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 702.221270][ T5637] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 704.071407][ T5637] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 704.089960][ T5637] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 704.760656][ T5637] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 704.787715][ T5637] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 705.631949][ T5637] Bluetooth: hci1: command tx timeout [ 706.025904][ T5941] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 706.207585][ T5625] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 706.229935][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 706.265070][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 707.036969][ T5625] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 707.472214][ T5625] Bluetooth: hci2: command tx timeout [ 707.479928][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 708.011291][ T5625] Bluetooth: hci1: command tx timeout [ 709.711124][ T5637] Bluetooth: hci2: command tx timeout [ 710.111136][ T5625] Bluetooth: hci1: command tx timeout [ 710.191044][ T5625] Bluetooth: hci3: command tx timeout [ 710.671167][ T5637] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 710.720624][ T5637] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 710.800531][ T5637] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 711.221060][ T5637] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 711.251025][ T5637] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 712.002630][ T5625] Bluetooth: hci2: command tx timeout [ 712.208125][ T5625] Bluetooth: hci1: command tx timeout [ 712.270744][ T5625] Bluetooth: hci3: command tx timeout [ 713.472038][ T5625] Bluetooth: hci4: command tx timeout [ 714.259223][ T5625] Bluetooth: hci2: command tx timeout [ 714.411750][ T5629] Bluetooth: hci3: command tx timeout [ 714.461090][ T5629] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 714.491116][ T5629] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 714.525163][ T5629] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 714.566674][ T5629] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 715.551150][ T5629] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 715.552108][ T5629] Bluetooth: hci4: command tx timeout [ 716.500002][ T5625] Bluetooth: hci3: command tx timeout [ 717.630776][ T5637] Bluetooth: hci4: command tx timeout [ 719.421374][ T5637] Bluetooth: hci5: command tx timeout [ 719.711586][ T5637] Bluetooth: hci4: command tx timeout [ 721.657330][ T5637] Bluetooth: hci5: command tx timeout [ 723.711588][ T5637] Bluetooth: hci5: command tx timeout [ 726.147786][ T5637] Bluetooth: hci5: command tx timeout [ 731.717359][ T5941] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 747.367625][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 760.830529][ T5941] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.631784][ T5625] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 767.661043][ T5625] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 767.680619][ T5625] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 767.710451][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 768.570801][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 770.775240][ T5625] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 771.059127][ T5625] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 771.328462][ T5625] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 771.367303][ T5625] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 771.391071][ T5625] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 773.376722][ T5637] Bluetooth: hci0: command tx timeout [ 773.863252][ T5637] Bluetooth: hci6: command tx timeout [ 773.996673][ T5629] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 774.024433][ T5629] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 774.160436][ T5629] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 776.093432][ T5629] Bluetooth: hci0: command tx timeout [ 776.093537][ T5629] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 776.093601][ T5629] Bluetooth: hci6: command tx timeout [ 776.167992][ T5625] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 778.198059][ T5637] Bluetooth: hci6: command tx timeout [ 778.198098][ T5637] Bluetooth: hci0: command tx timeout [ 778.567420][ T5629] Bluetooth: hci7: command tx timeout [ 779.250097][ T5637] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 779.279323][ T5637] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 779.300533][ T5637] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 779.335365][ T5637] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 779.360840][ T5637] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 780.284529][ T5637] Bluetooth: hci0: command tx timeout [ 780.284568][ T5637] Bluetooth: hci6: command tx timeout [ 780.590988][ T5625] Bluetooth: hci7: command tx timeout [ 782.077368][ T5637] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 782.337116][ T5637] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 782.355855][ T5637] Bluetooth: hci8: command tx timeout [ 782.400155][ T5637] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 782.457360][ T5637] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 782.630750][ T5637] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 782.681004][ T5637] Bluetooth: hci7: command tx timeout [ 784.830889][T17989] Bluetooth: hci7: command tx timeout [ 784.830944][ T5629] Bluetooth: hci8: command tx timeout [ 786.914444][ T5625] Bluetooth: hci8: command tx timeout [ 786.926480][ T5941] bridge_slave_1: left allmulticast mode [ 786.937402][ T5941] bridge_slave_1: left promiscuous mode [ 786.957050][ T5941] bridge0: port 2(bridge_slave_1) entered disabled state [ 788.718529][ T5625] Bluetooth: hci9: command tx timeout [ 788.993452][ T5637] Bluetooth: hci8: command tx timeout [ 789.322130][ T5941] bridge_slave_0: left allmulticast mode [ 789.334323][ T5941] bridge_slave_0: left promiscuous mode [ 789.357619][ T5941] bridge0: port 1(bridge_slave_0) entered disabled state [ 790.751077][ T5637] Bluetooth: hci9: command tx timeout [ 792.884505][ T5637] Bluetooth: hci9: command tx timeout [ 794.911436][ T5637] Bluetooth: hci9: command tx timeout [ 808.847093][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 836.662759][ T5625] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 838.797202][ T5625] Bluetooth: hci1: command 0x1003 tx timeout [ 838.797995][ T5625] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 838.798094][ T5637] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 841.040733][ T5637] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 841.050939][ T5637] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 841.330962][ T5637] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 841.700655][ T5637] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 841.720574][ T5637] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 845.471994][ T5625] Bluetooth: hci1: command tx timeout [ 847.631618][ T5625] Bluetooth: hci1: command tx timeout [ 849.714993][ T5625] Bluetooth: hci1: command tx timeout [ 850.506063][ T5637] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 850.520980][ T5637] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 850.530561][ T5637] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 850.687869][ T5637] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 851.540828][ T5637] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 852.150399][ T5625] Bluetooth: hci1: command tx timeout [ 854.076879][ T5637] Bluetooth: hci2: command tx timeout [ 855.722836][ T5625] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 856.446508][ T5629] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 856.456829][ T5629] Bluetooth: hci2: command tx timeout [ 856.810211][ T5625] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 857.687690][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 857.689305][ T5625] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 858.157003][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 858.170592][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 858.430559][ T5625] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 858.450776][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 858.650582][ T5625] Bluetooth: hci2: command tx timeout [ 858.711034][ T5629] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 860.525501][T18221] Bluetooth: hci3: Opcode 0x0c39 failed: -110 [ 860.681499][ T5629] Bluetooth: hci2: command tx timeout [ 860.740892][ T5629] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 860.770764][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 864.756268][ T5629] Bluetooth: hci4: command tx timeout [ 866.758349][ T5625] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 867.123068][ T5625] Bluetooth: hci4: command tx timeout [ 868.001621][ T5625] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 869.006999][ T5625] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 869.287227][ T5625] Bluetooth: hci4: command tx timeout [ 869.969017][ T5625] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 871.000575][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.825844][ T5625] Bluetooth: hci4: command tx timeout [ 871.990820][ T5625] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 876.031798][ T5637] Bluetooth: hci5: command tx timeout [ 878.123688][ T5637] Bluetooth: hci5: command tx timeout [ 880.311276][ T5637] Bluetooth: hci5: command tx timeout [ 882.486918][ T5637] Bluetooth: hci5: command tx timeout [ 897.953994][T18235] Bluetooth: hci0: command 0x0406 tx timeout [ 897.954062][T18235] Bluetooth: hci6: command 0x0406 tx timeout [ 898.801642][T18235] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 899.750543][T18235] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 900.087425][T18235] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 900.639131][T18235] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 900.847110][T18235] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 903.661727][ T5629] Bluetooth: hci7: command 0x0406 tx timeout [ 903.661774][ T5629] Bluetooth: hci8: command 0x0406 tx timeout [ 903.661830][ T5629] Bluetooth: hci3: command tx timeout [ 905.712480][T18239] Bluetooth: hci3: command tx timeout [ 908.028112][T18235] Bluetooth: hci3: command tx timeout [ 910.031496][T18235] Bluetooth: hci3: command tx timeout [ 913.254258][ T5625] Bluetooth: hci9: command 0x0406 tx timeout [ 920.329516][T18239] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 920.613348][T18235] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 922.740853][T18235] Bluetooth: hci10: command 0x1001 tx timeout [ 922.741589][ T5625] Bluetooth: hci10: Opcode 0x1001 failed: -110 [ 922.900670][ T5625] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 922.900718][ T5625] Bluetooth: hci10: unexpected event for opcode 0x1001 [ 922.900805][ T5625] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 923.549199][ T5625] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 923.596594][ T5625] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 924.314682][ T5941] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 924.407608][ T5625] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 924.457677][ T5625] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 928.811063][ T5941] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 929.960552][ T5625] Bluetooth: hci10: command tx timeout [ 931.730272][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.031505][ T5625] Bluetooth: hci10: command tx timeout [ 932.557254][ T5941] bond0 (unregistering): Released all slaves [ 934.155761][ T5625] Bluetooth: hci10: command tx timeout [ 934.260604][ T32] INFO: task dhcpcd:5279 blocked for more than 145 seconds. [ 934.260631][ T32] Not tainted syzkaller #0 [ 934.260642][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 934.260651][ T32] task:dhcpcd state:D stack:21384 pid:5279 tgid:5279 ppid:5278 task_flags:0x400140 flags:0x00080000 [ 934.260700][ T32] Call Trace: [ 934.260709][ T32] [ 934.260724][ T32] __schedule+0x17db/0x58f0 [ 934.260787][ T32] ? __pfx___schedule+0x10/0x10 [ 934.260821][ T32] ? schedule+0x90/0x2b0 [ 934.260847][ T32] schedule+0x164/0x2b0 [ 934.260873][ T32] schedule_preempt_disabled+0x13/0x30 [ 934.260896][ T32] __mutex_lock+0x7c1/0x1550 [ 934.260926][ T32] ? __mutex_lock+0x5d4/0x1550 [ 934.260955][ T32] ? rtnl_newlink+0xc1d/0x1c30 [ 934.261045][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 934.261080][ T32] ? ns_capable+0x89/0xe0 [ 934.261109][ T32] ? rtnl_nets_add+0x16c/0x300 [ 934.261132][ T32] ? rtnl_newlink+0x912/0x1c30 [ 934.261158][ T32] rtnl_newlink+0xc1d/0x1c30 [ 934.261202][ T32] ? __pfx_rtnl_newlink+0x10/0x10 [ 934.261230][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.261258][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.261293][ T32] ? lock_acquire+0x115/0x350 [ 934.261320][ T32] ? lock_acquire+0x115/0x350 [ 934.261349][ T32] ? is_bpf_text_address+0x26/0x2b0 [ 934.261381][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.261406][ T32] ? __kernel_text_address+0xd/0x30 [ 934.261427][ T32] ? unwind_get_return_address+0x4d/0x90 [ 934.261449][ T32] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 934.261470][ T32] ? arch_stack_walk+0xfb/0x150 [ 934.261504][ T32] ? lock_acquire+0x115/0x350 [ 934.261523][ T32] ? __pfx_rtnl_newlink+0x10/0x10 [ 934.261558][ T32] ? __pfx_rtnl_newlink+0x10/0x10 [ 934.261581][ T32] rtnetlink_rcv_msg+0x802/0xc00 [ 934.261603][ T32] ? netlink_sendmsg+0x5d4/0xb40 [ 934.261626][ T32] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 934.261649][ T32] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.261674][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.261706][ T32] netlink_rcv_skb+0x226/0x4a0 [ 934.261738][ T32] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.261764][ T32] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 934.261805][ T32] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.261833][ T32] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.261867][ T32] netlink_unicast+0x7bd/0x940 [ 934.261905][ T32] netlink_sendmsg+0x813/0xb40 [ 934.261934][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.261962][ T32] ? apparmor_socket_sendmsg+0x98/0x360 [ 934.261989][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.262007][ T32] sock_sendmsg_nosec+0x14e/0x190 [ 934.262032][ T32] ____sys_sendmsg+0x54e/0x850 [ 934.262064][ T32] ? __pfx_____sys_sendmsg+0x10/0x10 [ 934.262099][ T32] ? import_iovec+0x73/0xa0 [ 934.262128][ T32] ___sys_sendmsg+0x2a5/0x360 [ 934.262154][ T32] ? __asan_memcpy+0x40/0x70 [ 934.262185][ T32] ? __pfx____sys_sendmsg+0x10/0x10 [ 934.262232][ T32] ? vfs_read+0x804/0xa80 [ 934.262275][ T32] ? __pfx_set_user_sigmask+0x10/0x10 [ 934.262309][ T32] __x64_sys_sendmsg+0x1b1/0x290 [ 934.262338][ T32] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 934.262384][ T32] do_syscall_64+0x166/0x520 [ 934.262409][ T32] ? trace_irq_disable+0x3b/0x140 [ 934.262428][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.262449][ T32] ? clear_bhb_loop+0x70/0xc0 [ 934.262473][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.262493][ T32] RIP: 0033:0x7f57038bb407 [ 934.262511][ T32] RSP: 002b:00007ffdca102db0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 934.262533][ T32] RAX: ffffffffffffffda RBX: 00007f5703831780 RCX: 00007f57038bb407 [ 934.262548][ T32] RDX: 0000000000000000 RSI: 00007ffdca116f90 RDI: 0000000000000004 [ 934.262561][ T32] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 934.262572][ T32] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffdca1271c0 [ 934.262585][ T32] R13: 00007f5703831708 R14: 0000000000000030 R15: 00007ffdca116f90 [ 934.262617][ T32] [ 934.262650][ T32] INFO: task kworker/0:8:7927 blocked for more than 145 seconds. [ 934.262664][ T32] Not tainted syzkaller #0 [ 934.262673][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 934.262682][ T32] task:kworker/0:8 state:D stack:25352 pid:7927 tgid:7927 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 934.262730][ T32] Workqueue: events switchdev_deferred_process_work [ 934.262813][ T32] Call Trace: [ 934.262820][ T32] [ 934.262833][ T32] __schedule+0x17db/0x58f0 [ 934.262875][ T32] ? do_raw_spin_unlock+0xf5/0x200 [ 934.262908][ T32] ? __pfx___schedule+0x10/0x10 [ 934.262939][ T32] ? schedule+0x90/0x2b0 [ 934.262964][ T32] schedule+0x164/0x2b0 [ 934.262988][ T32] schedule_preempt_disabled+0x13/0x30 [ 934.263010][ T32] __mutex_lock+0x7c1/0x1550 [ 934.263040][ T32] ? __mutex_lock+0x5d4/0x1550 [ 934.263067][ T32] ? switchdev_deferred_process_work+0xe/0x20 [ 934.263095][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 934.263120][ T32] ? lock_acquire+0x115/0x350 [ 934.263149][ T32] ? rcu_is_watching+0x16/0xb0 [ 934.263181][ T32] ? process_scheduled_works+0x97a/0x1630 [ 934.263208][ T32] switchdev_deferred_process_work+0xe/0x20 [ 934.263232][ T32] process_scheduled_works+0xc3d/0x1630 [ 934.263289][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 934.263321][ T32] ? assign_work+0x3cf/0x5d0 [ 934.263351][ T32] worker_thread+0xa47/0xfb0 [ 934.263391][ T32] ? __kthread_parkme+0x71/0x1f0 [ 934.263428][ T32] kthread+0x38b/0x480 [ 934.263448][ T32] ? __pfx_worker_thread+0x10/0x10 [ 934.263472][ T32] ? __pfx_kthread+0x10/0x10 [ 934.263493][ T32] ret_from_fork+0x514/0xb70 [ 934.263515][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 934.263534][ T32] ? __switch_to+0xc89/0x1420 [ 934.263575][ T32] ? __pfx_kthread+0x10/0x10 [ 934.263596][ T32] ret_from_fork_asm+0x1a/0x30 [ 934.263643][ T32] [ 934.263690][ T32] INFO: task kworker/u8:8:18056 blocked for more than 145 seconds. [ 934.263705][ T32] Not tainted syzkaller #0 [ 934.263715][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 934.263724][ T32] task:kworker/u8:8 state:D stack:26344 pid:18056 tgid:18056 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 934.263774][ T32] Workqueue: events_unbound linkwatch_event [ 934.263802][ T32] Call Trace: [ 934.263809][ T32] [ 934.263822][ T32] __schedule+0x17db/0x58f0 [ 934.263864][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.263889][ T32] ? __pfx___schedule+0x10/0x10 [ 934.263921][ T32] ? schedule+0x90/0x2b0 [ 934.263946][ T32] schedule+0x164/0x2b0 [ 934.263969][ T32] schedule_preempt_disabled+0x13/0x30 [ 934.263990][ T32] __mutex_lock+0x7c1/0x1550 [ 934.264019][ T32] ? __mutex_lock+0x5d4/0x1550 [ 934.264046][ T32] ? linkwatch_event+0xe/0x60 [ 934.264075][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 934.264100][ T32] ? lock_acquire+0x115/0x350 [ 934.264128][ T32] ? rcu_is_watching+0x16/0xb0 [ 934.264152][ T32] ? process_scheduled_works+0x97a/0x1630 [ 934.264185][ T32] linkwatch_event+0xe/0x60 [ 934.264212][ T32] process_scheduled_works+0xc3d/0x1630 [ 934.264267][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 934.264299][ T32] ? assign_work+0x3cf/0x5d0 [ 934.264329][ T32] worker_thread+0xa47/0xfb0 [ 934.264368][ T32] ? __kthread_parkme+0x71/0x1f0 [ 934.264404][ T32] kthread+0x38b/0x480 [ 934.264423][ T32] ? __pfx_worker_thread+0x10/0x10 [ 934.264446][ T32] ? __pfx_kthread+0x10/0x10 [ 934.264467][ T32] ret_from_fork+0x514/0xb70 [ 934.264489][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 934.264508][ T32] ? __switch_to+0xc89/0x1420 [ 934.264535][ T32] ? __pfx_kthread+0x10/0x10 [ 934.264561][ T32] ret_from_fork_asm+0x1a/0x30 [ 934.264604][ T32] [ 934.264614][ T32] INFO: task syz-executor:18186 blocked for more than 145 seconds. [ 934.264628][ T32] Not tainted syzkaller #0 [ 934.264638][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 934.264646][ T32] task:syz-executor state:D stack:26616 pid:18186 tgid:18186 ppid:1 task_flags:0x400140 flags:0x00080002 [ 934.264698][ T32] Call Trace: [ 934.264705][ T32] [ 934.264717][ T32] __schedule+0x17db/0x58f0 [ 934.264771][ T32] ? __pfx___schedule+0x10/0x10 [ 934.264802][ T32] ? schedule+0x90/0x2b0 [ 934.264827][ T32] schedule+0x164/0x2b0 [ 934.264850][ T32] schedule_preempt_disabled+0x13/0x30 [ 934.264871][ T32] __mutex_lock+0x7c1/0x1550 [ 934.264900][ T32] ? __mutex_lock+0x5d4/0x1550 [ 934.264927][ T32] ? inet_rtm_newaddr+0x470/0x19f0 [ 934.265002][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 934.265039][ T32] ? __nla_parse+0x40/0x60 [ 934.265070][ T32] inet_rtm_newaddr+0x470/0x19f0 [ 934.265100][ T32] ? __kernel_text_address+0xd/0x30 [ 934.265122][ T32] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 934.265150][ T32] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 934.265208][ T32] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 934.265235][ T32] rtnetlink_rcv_msg+0x802/0xc00 [ 934.265258][ T32] ? netlink_sendmsg+0x5d4/0xb40 [ 934.265280][ T32] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 934.265304][ T32] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.265329][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.265362][ T32] netlink_rcv_skb+0x226/0x4a0 [ 934.265392][ T32] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.265418][ T32] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 934.265459][ T32] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.265487][ T32] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.265521][ T32] netlink_unicast+0x7bd/0x940 [ 934.265560][ T32] netlink_sendmsg+0x813/0xb40 [ 934.265588][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.265617][ T32] ? apparmor_socket_sendmsg+0x98/0x360 [ 934.265642][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.265660][ T32] sock_sendmsg_nosec+0x14e/0x190 [ 934.265683][ T32] __sys_sendto+0x408/0x5a0 [ 934.265714][ T32] ? __pfx___sys_sendto+0x10/0x10 [ 934.265767][ T32] ? do_user_addr_fault+0xc4c/0x1340 [ 934.265791][ T32] __x64_sys_sendto+0xde/0x100 [ 934.265818][ T32] do_syscall_64+0x166/0x520 [ 934.265842][ T32] ? trace_irq_disable+0x3b/0x140 [ 934.265861][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.265881][ T32] ? clear_bhb_loop+0x70/0xc0 [ 934.265905][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.265924][ T32] RIP: 0033:0x7f521135e98e [ 934.265942][ T32] RSP: 002b:00007fff92a254f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 934.265961][ T32] RAX: ffffffffffffffda RBX: 000055557ec2c500 RCX: 00007f521135e98e [ 934.265975][ T32] RDX: 0000000000000028 RSI: 00007f5212154670 RDI: 0000000000000003 [ 934.265988][ T32] RBP: 0000000000000001 R08: 00007fff92a25574 R09: 000000000000000c [ 934.266000][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 934.266012][ T32] R13: 0000000000000000 R14: 00007f5212154670 R15: 0000000000000000 [ 934.266043][ T32] [ 934.266051][ T32] INFO: task syz-executor:18192 blocked for more than 145 seconds. [ 934.266065][ T32] Not tainted syzkaller #0 [ 934.266075][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 934.266084][ T32] task:syz-executor state:D stack:26616 pid:18192 tgid:18192 ppid:1 task_flags:0x400140 flags:0x00080002 [ 934.266132][ T32] Call Trace: [ 934.266139][ T32] [ 934.266151][ T32] __schedule+0x17db/0x58f0 [ 934.266272][ T32] ? __pfx___schedule+0x10/0x10 [ 934.266303][ T32] ? schedule+0x90/0x2b0 [ 934.266328][ T32] schedule+0x164/0x2b0 [ 934.266352][ T32] schedule_preempt_disabled+0x13/0x30 [ 934.266373][ T32] __mutex_lock+0x7c1/0x1550 [ 934.266400][ T32] ? __mutex_lock+0x5d4/0x1550 [ 934.266427][ T32] ? inet_rtm_newaddr+0x470/0x19f0 [ 934.266458][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 934.266494][ T32] ? __nla_parse+0x40/0x60 [ 934.266524][ T32] inet_rtm_newaddr+0x470/0x19f0 [ 934.266552][ T32] ? __kernel_text_address+0xd/0x30 [ 934.266575][ T32] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 934.266603][ T32] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 934.266652][ T32] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 934.266679][ T32] rtnetlink_rcv_msg+0x802/0xc00 [ 934.266701][ T32] ? netlink_sendmsg+0x5d4/0xb40 [ 934.266723][ T32] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 934.266746][ T32] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.266771][ T32] ? __lock_acquire+0x747/0x2de0 [ 934.266804][ T32] netlink_rcv_skb+0x226/0x4a0 [ 934.266838][ T32] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 934.266863][ T32] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 934.266905][ T32] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.266933][ T32] ? netlink_deliver_tap+0x2e/0x1b0 [ 934.266967][ T32] netlink_unicast+0x7bd/0x940 [ 934.267005][ T32] netlink_sendmsg+0x813/0xb40 [ 934.267034][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.267062][ T32] ? apparmor_socket_sendmsg+0x98/0x360 [ 934.267087][ T32] ? __pfx_netlink_sendmsg+0x10/0x10 [ 934.267105][ T32] sock_sendmsg_nosec+0x14e/0x190 [ 934.267127][ T32] __sys_sendto+0x408/0x5a0 [ 934.267156][ T32] ? __pfx___sys_sendto+0x10/0x10 [ 934.267216][ T32] ? do_user_addr_fault+0xc4c/0x1340 [ 934.267240][ T32] __x64_sys_sendto+0xde/0x100 [ 934.267267][ T32] do_syscall_64+0x166/0x520 [ 934.267290][ T32] ? trace_irq_disable+0x3b/0x140 [ 934.267310][ T32] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.267330][ T32] ? clear_bhb_loop+0x70/0xc0 [ 934.267354][ T32] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 934.267374][ T32] RIP: 0033:0x7fbea955e98e [ 934.267390][ T32] RSP: 002b:00007ffe17534cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 934.267409][ T32] RAX: ffffffffffffffda RBX: 000055555cef4500 RCX: 00007fbea955e98e [ 934.267424][ T32] RDX: 0000000000000028 RSI: 00007fbeaa354670 RDI: 0000000000000003 [ 934.267437][ T32] RBP: 0000000000000001 R08: 00007ffe17534d54 R09: 000000000000000c [ 934.267449][ T32] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 934.267460][ T32] R13: 0000000000000000 R14: 00007fbeaa354670 R15: 0000000000000000 [ 934.267490][ T32] [ 934.267517][ T32] [ 934.267517][ T32] Showing all locks held in the system: [ 934.267527][ T32] locks held by kworker/u8:0/12: 4, last CPU#1: [ 934.267620][ T32] #0: ffff88805322a940 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.267749][ T32] #1: ffffc90000117c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.267800][ T32] #2: ffff88804e1d1440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 934.267936][ T32] #3: ffff888028b88330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 934.267994][ T32] locks held by khungtaskd/32: 1, last CPU#1: [ 934.268007][ T32] #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 934.268081][ T32] locks held by dhcpcd/5279: 1, on CPU#1: [ 934.268095][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 [ 934.268144][ T32] locks held by getty/5375: 2, on CPU#1: [ 934.268158][ T32] #0: ffff8880233250a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 934.268276][ T32] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 934.268326][ T32] locks held by syz-executor/5605: 1, last CPU#1: [ 934.268340][ T32] #0: ffff8880254d5d60 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_recvmsg+0x1df/0x7f0 [ 934.268442][ T32] locks held by kworker/0:7/5813: 2, last CPU#0: [ 934.268456][ T32] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.268508][ T32] #1: ffffc90004aefc40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.268558][ T32] locks held by kworker/u8:19/5938: 3, last CPU#1: [ 934.268572][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.268623][ T32] #1: ffffc90005267c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.268673][ T32] #2: ffff8880340db258 (&devlink->lock_key#9){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 934.268815][ T32] locks held by kworker/u8:20/5939: 6, last CPU#0: [ 934.268829][ T32] #0: ffff8880326cd140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.268879][ T32] #1: ffffc90005277c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.268929][ T32] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 934.269004][ T32] #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __netif_receive_skb_core+0x2106/0x30c0 [ 934.269051][ T32] #4: ffffffff8ed5c980 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x3820 [ 934.269151][ T32] #5: ffff8880b863d510 (&list->lock#5){..-.}-{3:3}, at: sch_direct_xmit+0x2fe/0x4c0 [ 934.269263][ T32] locks held by kworker/u8:22/5941: 6, last CPU#1: [ 934.269277][ T32] #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.269327][ T32] #1: ffffc90005297c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.269377][ T32] #2: ffffffff90246088 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 934.269425][ T32] #3: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x28e/0x8d0 [ 934.269470][ T32] #4: ffff88801c2d4aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 934.269520][ T32] #5: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 934.269569][ T32] locks held by kworker/0:8/7927: 3, on CPU#0: [ 934.269582][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.269632][ T32] #1: ffffc90005217c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.269680][ T32] #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 934.269732][ T32] locks held by kworker/1:9/7950: 3, on CPU#1: [ 934.269745][ T32] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.269795][ T32] #1: ffffc900037ffc40 (netdev_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.269844][ T32] #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: netdev_work_proc+0x209/0x780 [ 934.269955][ T32] locks held by kworker/u8:1/17948: 3, last CPU#1: [ 934.269969][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.270019][ T32] #1: ffffc900061efc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 934.270070][ T32] #2: ffff8880308fa258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 934.270128][ T32] locks held by kworker/u8:4/17981: 3, on CPU#1: [ 934.270142][ T32] #0: ffff8880321df140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.191298][ T5625] Bluetooth: hci10: command tx timeout [ 936.668233][ T32] #1: ffffc900061a7c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668304][ T32] #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 936.668427][ T32] locks held by kworker/u8:5/18008: 2, on CPU#0: [ 936.668443][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668493][ T32] #1: ffffc900052b7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668543][ T32] locks held by kworker/u8:8/18056: 3, on CPU#1: [ 936.668556][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668606][ T32] #1: ffffc9000485fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668655][ T32] #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 936.668708][ T32] locks held by kworker/u8:10/18174: 2, last CPU#1: [ 936.668722][ T32] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668772][ T32] #1: ffffc90005c37c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 936.668823][ T32] locks held by syz-executor/18182: 1, on CPU#1: [ 936.668837][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 [ 936.668884][ T32] locks held by syz-executor/18186: 1, on CPU#1: [ 936.668897][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.668951][ T32] locks held by syz-executor/18192: 1, on CPU#1: [ 936.668964][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669016][ T32] locks held by syz-executor/18197: 1, on CPU#0: [ 936.669027][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669075][ T32] locks held by syz-executor/18201: 1, on CPU#1: [ 936.669088][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669140][ T32] locks held by syz-executor/18213: 1, on CPU#0: [ 936.669153][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669214][ T32] locks held by syz-executor/18218: 1, on CPU#1: [ 936.669227][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669279][ T32] locks held by syz-executor/18222: 1, on CPU#0: [ 936.669292][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669345][ T32] locks held by syz-executor/18228: 1, on CPU#1: [ 936.669366][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669418][ T32] locks held by syz-executor/18231: 2, last CPU#1: [ 936.669432][ T32] #0: ffff888050f75038 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 936.669484][ T32] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 936.669534][ T32] locks held by syz-executor/18236: 1, on CPU#0: [ 936.669547][ T32] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 936.669601][ T32] locks held by syz-executor/18249: 1, last CPU#1: [ 936.669614][ T32] #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __page_table_check_zero+0x6c/0x430 [ 936.669661][ T32] locks held by syz-executor/18251: 1, on CPU#1: [ 936.669675][ T32] #0: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0x9e/0x650 [ 936.669722][ T32] locks held by udevd/18252: 1, last CPU#1: [ 936.669735][ T32] #0: ffff88807739d038 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 [ 936.670461][ T32] locks held by modprobe/18253: 2, last CPU#1: [ 936.670475][ T32] #0: ffff8880129ddcf8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 936.670526][ T32] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 936.670575][ T32] locks held by syz-executor/18254: 1, last CPU#1: [ 936.670589][ T32] #0: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0x9e/0x650 [ 936.670635][ T32] locks held by udevd/18255: 1, last CPU#1: [ 936.670649][ T32] #0: ffff888053eec740 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 936.670702][ T32] [ 936.670708][ T32] ============================================= [ 936.670708][ T32] [ 936.670726][ T32] NMI backtrace for cpu 1 [ 936.670742][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 936.670784][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 936.670796][ T32] Call Trace: [ 936.670804][ T32] [ 936.670812][ T32] dump_stack_lvl+0xe8/0x150 [ 936.670840][ T32] nmi_cpu_backtrace+0x274/0x2d0 [ 936.670909][ T32] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 936.670941][ T32] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 936.670964][ T32] sys_info+0x135/0x170 [ 936.670998][ T32] watchdog+0xfd7/0x1030 [ 936.671025][ T32] ? watchdog+0x1c7/0x1030 [ 936.671051][ T32] kthread+0x38b/0x480 [ 936.671070][ T32] ? __pfx_watchdog+0x10/0x10 [ 936.671087][ T32] ? __pfx_kthread+0x10/0x10 [ 936.671107][ T32] ret_from_fork+0x514/0xb70 [ 936.671129][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 936.671147][ T32] ? __switch_to+0xc89/0x1420 [ 936.671175][ T32] ? __pfx_kthread+0x10/0x10 [ 936.671195][ T32] ret_from_fork_asm+0x1a/0x30 [ 936.671238][ T32] [ 936.671245][ T32] Sending NMI from CPU 1 to CPUs 0: [ 936.671279][ C0] NMI backtrace for cpu 0 [ 936.671292][ C0] CPU: 0 UID: 0 PID: 4973 Comm: klogd Not tainted syzkaller #0 PREEMPT(full) [ 936.671314][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 936.671326][ C0] RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x0/0xb0 [ 936.671361][ C0] Code: 74 0a 18 48 89 44 0a 20 e9 7d 58 22 0a cc 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d f8 ce cd 11 65 48 8b 15 f8 ce [ 936.671379][ C0] RSP: 0018:ffffc900000070b8 EFLAGS: 00000246 [ 936.671396][ C0] RAX: ffffffff89b276a1 RBX: 1ffff1100ecb7db8 RCX: ffff88807ed01f40 [ 936.671412][ C0] RDX: 8000000000000500 RSI: 0000000000000000 RDI: 000000000000000f [ 936.671426][ C0] RBP: ffff88807999fd90 R08: 0000000000000100 R09: 1ffffffff20f4bcf [ 936.671440][ C0] R10: dffffc0000000000 R11: fffffbfff20f4bd0 R12: 0000000000000000 [ 936.671455][ C0] R13: 0000000000000000 R14: ffff8880765bedc0 R15: dffffc0000000000 [ 936.671469][ C0] FS: 00007fe6fe24dc80(0000) GS:ffff888124cc5000(0000) knlGS:0000000000000000 [ 936.671486][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 936.671499][ C0] CR2: 00007f751b64588d CR3: 000000007f1fe000 CR4: 00000000003526f0 [ 936.671517][ C0] Call Trace: [ 936.671524][ C0] [ 936.671531][ C0] dev_hard_start_xmit+0x424/0x830 [ 936.671569][ C0] sch_direct_xmit+0x257/0x4c0 [ 936.671598][ C0] ? __pfx_sch_direct_xmit+0x10/0x10 [ 936.671621][ C0] ? rcu_read_lock_bh_held+0x10/0x50 [ 936.671651][ C0] __qdisc_run+0xb11/0x1620 [ 936.671685][ C0] __dev_queue_xmit+0x1c05/0x3820 [ 936.671713][ C0] ? __lock_acquire+0x747/0x2de0 [ 936.671738][ C0] ? __dev_queue_xmit+0x29b/0x3820 [ 936.671767][ C0] ? __lock_acquire+0x747/0x2de0 [ 936.671788][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 936.671820][ C0] ? __lock_acquire+0x747/0x2de0 [ 936.671846][ C0] ? __lock_acquire+0x747/0x2de0 [ 936.671873][ C0] ? nf_do_netdev_egress+0x2d9/0x480 [ 936.671977][ C0] ? nf_do_netdev_egress+0x2d9/0x480 [ 936.672004][ C0] nf_do_netdev_egress+0x35f/0x480 [ 936.672033][ C0] nft_fwd_netdev_eval+0x1e0/0x320 [ 936.672095][ C0] nft_do_chain+0x48d/0x1b10 [ 936.672129][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 936.672158][ C0] ? __asan_memset+0x22/0x50 [ 936.672182][ C0] ? __pfx_nft_set_pktinfo_ipv4_validate+0x10/0x10 [ 936.672241][ C0] nft_do_chain_netdev+0x128/0x190 [ 936.672266][ C0] ? __pfx_nft_do_chain_netdev+0x10/0x10 [ 936.672293][ C0] ? lock_acquire+0x115/0x350 [ 936.672314][ C0] ? __pfx_nft_do_chain_netdev+0x10/0x10 [ 936.672340][ C0] nf_hook_slow+0xc5/0x220 [ 936.672388][ C0] __netif_receive_skb_core+0x251a/0x30c0 [ 936.672410][ C0] ? __netif_receive_skb_core+0x2106/0x30c0 [ 936.672439][ C0] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 936.672473][ C0] ? process_backlog+0x3de/0x18b0 [ 936.672495][ C0] ? process_backlog+0x3de/0x18b0 [ 936.672518][ C0] process_backlog+0x727/0x18b0 [ 936.672541][ C0] ? call_timer_fn+0xd5/0x5f0 [ 936.672571][ C0] ? process_backlog+0x3de/0x18b0 [ 936.672600][ C0] __napi_poll+0xaa/0x330 [ 936.672621][ C0] net_rx_action+0x61d/0xf50 [ 936.672649][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 936.672685][ C0] handle_softirqs+0x226/0x860 [ 936.672713][ C0] ? do_softirq+0x77/0xd0 [ 936.672738][ C0] ? __alloc_skb+0x18d/0x7a0 [ 936.672760][ C0] ? __alloc_skb+0x18d/0x7a0 [ 936.672782][ C0] do_softirq+0x77/0xd0 [ 936.672805][ C0] [ 936.672812][ C0] [ 936.672819][ C0] __local_bh_enable_ip+0x100/0x140 [ 936.672844][ C0] __alloc_skb+0x1b1/0x7a0 [ 936.672875][ C0] alloc_skb_with_frags+0xc6/0x760 [ 936.672906][ C0] sock_alloc_send_pskb+0x878/0x990 [ 936.672944][ C0] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 936.672974][ C0] ? sock_def_readable+0xae/0x550 [ 936.672995][ C0] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 936.673026][ C0] unix_dgram_sendmsg+0x4da/0x17b0 [ 936.673057][ C0] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 936.673078][ C0] ? aa_sock_msg_perm+0x129/0x210 [ 936.673107][ C0] ? apparmor_socket_sendmsg+0x98/0x360 [ 936.673129][ C0] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 936.673148][ C0] sock_sendmsg_nosec+0x14e/0x190 [ 936.673169][ C0] __sys_sendto+0x408/0x5a0 [ 936.673191][ C0] ? bpf_lsm_capable+0x9/0x20 [ 936.673212][ C0] ? __pfx___sys_sendto+0x10/0x10 [ 936.673240][ C0] ? ktime_get+0x1f5/0x220 [ 936.673265][ C0] ? rcu_is_watching+0x16/0xb0 [ 936.673291][ C0] __x64_sys_sendto+0xde/0x100 [ 936.673316][ C0] do_syscall_64+0x166/0x520 [ 936.673341][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.673360][ C0] ? clear_bhb_loop+0x70/0xc0 [ 936.673383][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 936.673402][ C0] RIP: 0033:0x7fe6fe39d407 [ 936.673419][ C0] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 936.673436][ C0] RSP: 002b:00007fffd0a4a4f0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 936.673455][ C0] RAX: ffffffffffffffda RBX: 00007fe6fe24dc80 RCX: 00007fe6fe39d407 [ 936.673470][ C0] RDX: 000000000000005b RSI: 00007fffd0a4a630 RDI: 0000000000000003 [ 936.673483][ C0] RBP: 00007fffd0a4aa60 R08: 0000000000000000 R09: 0000000000000000 [ 936.673495][ C0] R10: 0000000000004000 R11: 0000000000000202 R12: 00007fffd0a4aa78 [ 936.673508][ C0] R13: 00007fffd0a4a630 R14: 0000000000000040 R15: 00007fffd0a4a630 [ 936.673531][ C0] [ 936.674283][ T32] Kernel panic - not syncing: hung_task: blocked tasks [ 939.167813][ T32] CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 939.176936][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 939.187005][ T32] Call Trace: [ 939.190300][ T32] [ 939.193259][ T32] vpanic+0x56d/0xa60 [ 939.197380][ T32] ? __pfx_vpanic+0x10/0x10 [ 939.202002][ T32] ? console_srcu_read_unlock+0x3a/0x60 [ 939.207566][ T32] panic+0xc5/0xd0 [ 939.211292][ T32] ? __pfx_panic+0x10/0x10 [ 939.215814][ T32] ? wq_watchdog_touch+0xf9/0x160 [ 939.221058][ T32] ? nmi_trigger_cpumask_backtrace+0x24d/0x390 [ 939.227231][ T32] watchdog+0x1030/0x1030 [ 939.231773][ T32] ? watchdog+0x1c7/0x1030 [ 939.236229][ T32] kthread+0x38b/0x480 [ 939.240326][ T32] ? __pfx_watchdog+0x10/0x10 [ 939.245020][ T32] ? __pfx_kthread+0x10/0x10 [ 939.249629][ T32] ret_from_fork+0x514/0xb70 [ 939.254249][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 939.259375][ T32] ? __switch_to+0xc89/0x1420 [ 939.264081][ T32] ? __pfx_kthread+0x10/0x10 [ 939.268698][ T32] ret_from_fork_asm+0x1a/0x30 [ 939.273643][ T32] [ 939.276985][ T32] Kernel Offset: disabled [ 939.281374][ T32] Rebooting in 86400 seconds..