last executing test programs: 3.936131238s ago: executing program 4 (id=10513): setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="340000001400b59508000000000000000a400000", @ANYRES32=r2, @ANYBLOB="14000200ff020000000000000000000000000001080008000207"], 0x34}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="400000001400a59500000000000000000a6800c8", @ANYRES32=r2, @ANYBLOB="14000200ff02000000000000000000004000000114000100fe"], 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 3.652182644s ago: executing program 4 (id=10514): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11, 0x9c, 0x7b5, 0x0, 0x0, 0x7579e159, 0x0, 0xfffffdfc, 0xef4}}) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="180004000000000029000000b877f9e1c07d105a3c9773070f040000001d0000000000000023e2a90e02e268f43fc5d73471cb0e30031a0800e1a02f29"], 0x18}, 0x922bac8556bdad8e) r1 = socket$l2tp(0x2, 0x2, 0x73) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = socket$l2tp6(0xa, 0x2, 0x73) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newtaction={0x6c, 0x30, 0x1, 0x2, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x6}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x4}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) unshare(0x24020400) getsockopt(r5, 0x8, 0x40, 0x0, 0x0) bind$l2tp6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x400, @mcast1, 0x8, 0x4}, 0x20) r6 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r6, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000000029"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x3, 0x2}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x32600) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r7, &(0x7f0000000f00)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000e00)={0x28, 0x1, 0x8, 0x3, 0x0, 0x0, {0x0, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x9200}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x4000010) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x298, 0x168, 0x0, 0x0, 0x200, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x298}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4, 0x11000000]}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r8, &(0x7f0000000280)="b5", 0x1, 0x45, 0x0, 0x0) recvmmsg(r8, &(0x7f0000001880)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x20103, 0x0) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)={0x58, r9, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0xfffffffffffffffb}, @NBD_ATTR_SOCKETS={0x28, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r10}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r10}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000011}, 0x4008804) 3.262373806s ago: executing program 4 (id=10518): r0 = bpf$MAP_CREATE(0x0, &(0x7f000000a180)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x22d3, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000107000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000001900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.210864699s ago: executing program 3 (id=10522): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x1, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r5) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r10, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, 0x4, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r9, 0x3) sendmsg$inet6(r8, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) r11 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f00000008c0)=[{&(0x7f0000000380)="d6", 0x1}], 0x1) writev(r11, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600004e22590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="660a00000700000061117b000000000085000000cf00000095"], &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="2508007a0000000000030700000008000300", @ANYRES32=r2, @ANYBLOB="1400060064756d6d7930000000000000000000001400040076657468315f746f5f626f016400000005005300010000000800050004"], 0x54}}, 0x0) 3.056070136s ago: executing program 4 (id=10523): r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x4640}, 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0x2, &(0x7f0000000780)=0x2, 0x4) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000000), 0xffffff6a) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendfile(r4, r5, 0x0, 0xffffffff004) 2.847321061s ago: executing program 0 (id=10527): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001b80)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030020800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x8c4}, 0x200020d0) 2.807860777s ago: executing program 1 (id=10528): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@newpolicy={0xfc, 0x13, 0x101, 0x0, 0x0, {{@in=@rand_addr=0x64010102, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0xd, 0x400, 0x9, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3}, {0x0, 0x1, 0x0, 0x100}, 0xfffffffe}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x2b}, 0xa, @in=@local, 0x4000, 0x5, 0x3, 0x0, 0x4, 0x7f}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff0200000000000000002f0000000001"], 0xfdef) 2.64307163s ago: executing program 0 (id=10529): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x80) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000940)=@newqdisc={0x148, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x3}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "0d767b344a4107111e7e642d07ae014c02021bf9ea748c446391894699ec720ff9827531e9b3340038d7a0916c5984381baee6cd3a24fa9327dfcad6fa7c5135531ac295b264596f6d3e857f152d0b7083fb07acdfabd1324a0014a096078ac9c249f66d2af98841b65c33dc69677149a24390411bda91281cd201379858f2fcca40d86f69ed5fc1d5674c90eccc7818ecfcb9e0418db476b3beb17e7a33795eaaf955a98da4290b20627cd3c3edb40de32380fc7781ce8bc43a77a459d826255142030193a40d8f3b2ce6909a57c5bea695b7699c7a393ef756b8ce29f84499994a1138f4be3eea8583115628cedb67fee1eada59655f2b9d67580e94534bc7"}, @TCA_GRED_DPS={0x10, 0x3, {0x0, 0xd, 0x1, 0x8}}]}}]}, 0x148}, 0x1, 0x0, 0x0, 0x480d8}, 0x4000000) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@ipv4_newrule={0x3c, 0x20, 0x1, 0x70bd26, 0x25dfdbfb, {0x2, 0x10, 0x10, 0x0, 0x9, 0x0, 0x0, 0x6, 0x10006}, [@FRA_SRC={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2a}}, @FRA_FLOW={0x8, 0xb, 0x6}, @FRA_GENERIC_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x89}, @FRA_DST={0x8, 0x1, @empty}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4004804) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB='L\x00\x00\x00!'], 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) recvfrom(r4, &(0x7f0000000000)=""/46, 0x2e, 0x2002, &(0x7f00000001c0)=@in={0x2, 0x4e23, @multicast2}, 0x80) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.474970814s ago: executing program 1 (id=10531): r0 = epoll_create1(0x0) epoll_wait(r0, 0x0, 0x0, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={0xffffffffffffffff, 0x2000012, 0xeaa, 0x7ffe, &(0x7f00000003c0)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.397794438s ago: executing program 2 (id=10532): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0801008e2981f82b0003e400000000000000000000000000000020", @ANYRES32=0x0, @ANYBLOB="13000000c4180600e8001280000001006d6163766c616e0000000280000001000100000000000400aaaaaaaaaabb000000000700060000000000020001000000000007000500000000000100060000000000030000000000000002000100000000000700c7d00000"], 0x108}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c044) r1 = socket$netlink(0x10, 0x3, 0x10) unshare(0x4e000800) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket(0x40000000015, 0x805, 0x0) getsockopt(r3, 0x114, 0x5, &(0x7f0000019100)=""/102399, &(0x7f00000000c0)=0x18fff) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300000200000000fbdbdf25fc000000000000000000000000000001fe8000000000000000000000000000aa00000004000000000a004880", @ANYBLOB], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_x25_SIOCADDRT(r5, 0x890b, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000440)={0x0, 0xfffffffffffffc96, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000d00000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) socket$unix(0x1, 0x2, 0x0) 2.282969699s ago: executing program 1 (id=10533): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000440), &(0x7f0000000040)=@udp}, 0x20) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) syz_emit_ethernet(0xffffffffffffffac, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x22}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(0xffffffffffffffff, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1}, 0xb}], 0x12, 0x40000021, 0x0) 2.245262421s ago: executing program 2 (id=10534): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r3, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r3, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x20b7ee}) unshare(0x400) getsockopt(r1, 0x400000000000003a, 0x1, 0x0, &(0x7f00000000c0)=0xffffff7f) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x200, 0x0}, 0x8) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x1f, 0x8, &(0x7f0000001fc0)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x804, 0x0, 0x0, 0x40f00, 0x7c, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5}, 0x94) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000280)=ANY=[@ANYRES32=r6, @ANYRES32=r6, @ANYBLOB='6\x00'/12, @ANYRES32, @ANYBLOB="36811b7adac8e81c1583ee2019ea0478486320eb6aa97d82e0b0c3d39a00db95f3043406888d22617bba512bc6c50d7133e9fd4a6a9793a468e7e1a388d756ffe3eb9ae33f172736c1f6f8b54ac9edab0c7c0a4141a789e7972b90e2489f010d68c284ac6ea81b02165f411c7b9672debdb2fdaada276c0c2d1a52c9f2b80f780d0b7fa09dacf55f9558d9442419bf3148215d91201f3c20d6d9f9b8cbbbfb56825f005a95e942fa4900"/180, @ANYRES64=0x0], 0x20) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020001030900020073797a310000000008000440000000000900010073797a30000000000800034000000003"], 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x0) r7 = socket(0x10, 0x803, 0x0) sendto(r7, &(0x7f0000000740), 0x0, 0x0, 0x0, 0x0) r8 = socket$l2tp6(0xa, 0x2, 0x73) accept4(r8, &(0x7f0000000ac0)=@rc, &(0x7f0000000b40)=0x80, 0x80000) recvmmsg(r7, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/141, 0x8d}, {&(0x7f00000001c0)=""/17, 0x11}, {&(0x7f0000000400)=""/137, 0x89}, {&(0x7f0000000880)=""/254, 0xfe}], 0xa, &(0x7f0000001fc0)=""/206, 0xce}}], 0x1, 0x2000, &(0x7f0000003700)={0x77359400}) r9 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f0000000540)={r9}) r10 = socket$pppl2tp(0x18, 0x1, 0x1) getsockopt$IP_VS_SO_GET_DAEMON(r10, 0x0, 0x487, &(0x7f00000006c0), &(0x7f0000000700)=0x30) sendmsg$AUDIT_TTY_SET(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x18, 0x3f9, 0x20, 0x70bd25, 0x25dfdbfb, {0x0, 0xfffffffd}, [""]}, 0x18}, 0x1, 0x0, 0x0, 0x4040000}, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000b80)={{{@in=@initdev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@remote}}, &(0x7f0000000c80)=0xe8) r12 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e40)=ANY=[@ANYBLOB="64000000190001002abd7000fbdbdf251d01090050001280490030801400ae00ff018000000000000000000000000001c89e34a466291000d25dc3357b42ac55c6e059c9303f2c3754e97afa16b96a2a8f40388cafc3b28b9bf627db2d39f0117d00000064e4f14f95ec8f562b115f4845d2c234bced837a343189bdb276b18f535eb4dccc808fd42469b5fc18efbac24f675cd5a2f7ffffffffffffff7ee4826204649d44374f0653a8212f594979e2c6b75482fd562e7ea4f2f267518a287d52462e34a856092fa0dbc2329afd28df29136c9697b2acb9175fd19dd9c8c90c963a95d98315c0b3707b743d4b7e0fc68916f55cabe487d71ad8d2aff4b1dfe2ddb9876ee22f3f54ebd68278ca196f738d88d43f822aa4"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) r13 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="6c0000001800000227bd7000f9dbdf25022010bdff0400020014000005001b003a000000080002000000000008000200ac14143608000b0004000000a3fe1c004e24000008401900", @ANYRES32=0xee00, @ANYBLOB="060015000300000008001900", @ANYRES32=r11, @ANYBLOB="05001b003a00000008001900", @ANYRES32=r11, @ANYBLOB], 0x6c}, 0x1, 0x0, 0x0, 0x4004854}, 0x10) 2.173149021s ago: executing program 3 (id=10535): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000000209050000000000000000000700000508000640000000010800032900000007"], 0x24}, 0x1, 0x0, 0x0, 0x44000}, 0x20004000) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x90}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x90}}, 0x0) 1.240198512s ago: executing program 4 (id=10536): getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_id=0x0, &(0x7f0000000040)=0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1d, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a4000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095", @ANYRESDEC, @ANYRESOCT], &(0x7f0000000380)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1d, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a4000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095", @ANYRESDEC, @ANYRESOCT], &(0x7f0000000380)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000080)={r0, 0x4, 0x10}, &(0x7f00000000c0)=0xc) 1.235915477s ago: executing program 1 (id=10537): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) unshare(0x64000600) write(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000003c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd698b0f0000180600fe800000000000000000000000000039fe8000000000000100000000000000aa4e224e24", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB='a'], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) 1.234568955s ago: executing program 3 (id=10538): r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket(0x2, 0x80805, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)=""/9, 0x9}, 0x8}], 0x1, 0x20, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x4, 0xa, [0x8, 0xbc, 0x81, 0x5, 0x5, 0x5, 0x1000, 0x8a65, 0x2, 0x59]}, &(0x7f0000000200)=0x1c) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x6}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0xb}]}, 0x34}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000001f0000540000000e0001"], 0x34}}, 0x0) r3 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000a00)={{{@in=@private, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private1}, 0x0, @in6=@mcast1}}, &(0x7f00000001c0)=0xe8) r5 = getgid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000b40)={{{@in6, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@private}, 0x0, @in6=@dev}}, &(0x7f0000000c40)=0xe8) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000440)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000940)=[{&(0x7f00000004c0)="bc07994825d54cfd1c4753cc1eb28667c0a92f2a82122d1f59ebe07df2a54552df5fab91507276db10ce0997d1811401c7314d267bc0778e2a50f685131ec7698ffade08f900207005c7c3bbbb2b6d20597b5c68103c02c7dface2da821857d4370ad3a9d10d64b84638018aeb187bb4a2ce73d84845f984fc", 0x79}, {&(0x7f0000000700)="336b3b545ced95b548553e6f6e70e340437d570b2083941e85cbe3a296b62a86d8546bc7aad23cf934569e7655d17b11ebbf7c72a2484d0ccfdda95568d2ca1137e516474e36e42a61dea66a1beeeda072f6dc355184c65c58956201cfdd7df7b3783f1b874bfb541558ba938ff0954ebad211dae62a98d0bdc1124d53bda80f2e866883339fa52d9288a78691bd2f78c303e6160a1803355b65d42bcd9727eb7d4144064df82fa6499698ae559d4b9e8afeb1675c76fc17aecf8ed7c30a7c59daca9a0c72bad034845f0e28a65181c15e35bfea9f2d318b5e8faa238dec", 0xde}, {&(0x7f0000000800)="0acaeefa2614d2e843922c8ca62fcbc55b34fcbba052a5b05c726a04c893d0317f725a0973c50cf4b52a966d2a4bbfddf94bae76ec66b4b3cf63d3b448543f0e8b15ddee855e2010ccbacb7b316a912f90bb7418d4a62bb96d79d6fea30373b331f50895e1e763bf695baa1f6327078d32e0f867593b7d31d49889e2e93685a2cc073f0aa43c93c3585826f73d251297b7bdbcbe7629f0", 0x97}, {&(0x7f00000008c0)="a9fad243351436bb673603f5e484a558c3eb58a59ebbe59985dd83c0d90897c6ad3b20f563e9348139087ead55465cbc727454ecc959d1fa339c7a5d86d7d61cb324965a19bb27db6467c28823651c24dd50d482c69b", 0x56}], 0x4, &(0x7f0000000c80)=ANY=[@ANYBLOB="34000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r3, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=r4, @ANYRES32=r5, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32, @ANYRES32=r6, @ANYRES32=0x0, @ANYBLOB="a6f4af7a"], 0x78, 0x4001}, 0x20040030) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000002c0)={0x0, @initdev, @broadcast}, &(0x7f0000000300)=0xc) r8 = getuid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000600)={{{@in, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000000700)=0xe8) sendmsg$nl_xfrm(r1, &(0x7f0000000b40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000d40)=ANY=[@ANYBLOB="b003000017000200ffffff34ffdbdf25ff02000000000000000000000000000100000000ac1e0001000000000000000000000000e0000002000000000000000000000000200100000000000000000000000000781db0014e2008000000000002002080080000003e59dbfd5332bbe4fd13", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe880000000000000000000000000101fc0200000000000000000000000000004e2000084e2400010200800008000000", @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="000200000000000007000000000000000100010000000000b2db777a0000000008000000000000003200000000000000544300000000000007000000000000000600000000000000080000000000000002000000000000000f0000000000000001000000000000000200020100000000a0010000060000000700000029000000ac000700fe880000000000000000000000000001640101020000000000000000000000004e2400054e2000060a0090605e000000", @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="01000000000000000900000000000000ff01000000000000070000000000000008000000000000000200000000000000020000000000000004000000000000002d0000000000000008000000000000009c0c000000000000400000000000000009000000b86b6e000100030100000000e4000600ac141427000000000000000000000000ac1e00010000000000000000000000004e2100074e24000902000020020000", @ANYRES32=0x0, @ANYRES32=r9, @ANYBLOB="fe880000000000000000000000000001000004d4ff000000fc000000000000000000000000000000ff0000000000000009000000000000002400000000000000030000000000000000000000004002000000010000000000faffffffffffffff09000000000000000200000000000000070000000000000008000000000000000000010000000000050000000400000006000000060000000000000002000001c40000000000000010000a0028bd700027bd700006000000d9000800d50008000100cd00a55d19e7ee50c1ccd4ab93c10a410d4fd632536a392f7951ea9348b81515ead88bd143f2c4add331464d67e80f9c3eff331cab3ee06fdd0e7636e30f8a54f2fd1bf7f8f18e68253cc96a16e207c567d04bacb9681ff6d7e31e33e376a55fd752a3146ea4158740a26b5ad2d34844948260a19ddcc67dada6529b9d7496e5595b3c3067ea9b29baae6b6bfd4c8fefbd3555f22e9e0b810e86851ae6b42bdcb9a1ed011f580f100a23d4ecd56f0c40efd6e6622639811623fd5fbaa69e46d99d6b4a506a9e27f91e9a3488bff2db0000000a0010000100000000000000"], 0x3b0}, 0x1, 0x0, 0x0, 0x20004000}, 0x40) socket$packet(0x11, 0x2, 0x300) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r11 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r10, &(0x7f0000000400)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x11, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "0200be", 0x4c, 0x2f, 0xff, @local, @mcast2, {[@routing={0x1d, 0x0, 0x1, 0x7}], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x88a8}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0x9, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x82) r12 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r12, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x6f}, 0x2c) sendmsg$sock(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 1.211667445s ago: executing program 2 (id=10539): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf092000000000003509010000000000950000000000fff3b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf9800000000000056080000000000008500000005000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 1.136069731s ago: executing program 0 (id=10540): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001b80)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000600000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x8c4}, 0x200020d0) 1.013559378s ago: executing program 0 (id=10541): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @generic={0x66}, @initr0, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x18000000}, 0x94) 867.045221ms ago: executing program 2 (id=10542): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@base={0x5, 0x5, 0xfff, 0x7, 0x88, 0xffffffffffffffff, 0x81}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000004000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb70300000e41621eb70400000000000085000000c300000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x2000002, 0xe, 0x0, &(0x7f0000000200)="df33c9f7b9a60000000000000000", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 796.78171ms ago: executing program 0 (id=10543): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000080)={0x43, 0x80000009, 0x3}, 0x10) bind$tipc(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r5, 0x0, 0x6, &(0x7f0000000380)='\a', 0x1) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0xffffffffffffffd6) setsockopt$inet6_int(r5, 0x29, 0xb, &(0x7f0000000440)=0xb2, 0x4) sendmmsg$inet6(r5, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r5, &(0x7f0000000c40)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x12141, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x18fb82db60492700, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x338deb2fe304b7cd, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x741}, 0x94) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000300)=@ethtool_dump={0x3e, 0x0, 0x2}}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'dummy0\x00', 0x4000}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b1b, &(0x7f0000000040)) sendmsg$tipc(r4, &(0x7f0000000380)={&(0x7f0000000140)=@id={0x1e, 0x3, 0x3, {0x4e21, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4001c040) r7 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000580)={0x54, r7, 0x417, 0x70bd27, 0x25dfdbfe, {}, [{{0x8, 0x1, r8}, {0x38, 0x2, 0x0, 0x1, [{0x34, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x4}}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000431}, 0x200440c4) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000010000106fcffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="30200200090000401c0060f6492301006d616373656300000c0010000000000000eddb6225e1b528bed778f13883a11a58446e414b20336af06b72d3b582fa95b221d166e59a90798b137a24790251b230f808a00b91c6cbb24e"], 0x3c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=@newlink={0x38, 0x10, 0x439, 0x0, 0x60000, {0x0, 0x0, 0x0, r10, 0x9801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @remote}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001c00070c2ebd7000fedbdf2502000000", @ANYRES16=r10, @ANYRESDEC=r8], 0x3c}}, 0x20024090) 795.668659ms ago: executing program 3 (id=10544): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x0, &(0x7f0000000340)}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) socket$packet(0x11, 0xa, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000e40)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "ae"}]}], {0x14}}, 0xb8}}, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000000)=0x63, 0x2) r4 = accept4(r1, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$AUTOFS_IOC_PROTOVER(r5, 0x80049363, &(0x7f0000000040)) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), r0) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x24000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000125cf84ec43da19bd7000fbdbdf25060000000800050080010000000005000200000008000600060000001c000380060007004e20000008000100010000200600"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x8044) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000100)=0x3, 0x4) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x4) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000200)={0x0, 0x29, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="0700000010000100293d7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b00000000000800040000050000"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r5, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r5, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0xffffffffffffffe9, 0x0}}], 0x1, 0x2000c044) 655.969072ms ago: executing program 4 (id=10545): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x1, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x303}, "1afc7c14d332bcc6", "a9ba0c85d68723369f51322151d9f41aaa2832bb07cc1e49ad714beac6f1ade8", "49960d8f", "bff2a81527ae4190"}, 0x38) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r5) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000100)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000001c0)=0x1c) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r10, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800800}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x20, 0x4, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x80) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r9, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r9, 0x3) sendmsg$inet6(r8, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f00000008c0)=[{&(0x7f0000000380)="d6", 0x1}], 0x1) sendfile(r4, r7, 0x0, 0x20000000002) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="660a00000700000061117b000000000085000000cf00000095"], &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="2508007a0000000000030700000008000300", @ANYRES32=r2, @ANYBLOB="1400060064756d6d7930000000000000000000001400040076657468315f746f5f626f016400000005005300010000000800050004"], 0x54}}, 0x0) 570.847972ms ago: executing program 3 (id=10546): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1e, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x2}, 0x50) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x2, r3}, 0x10) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@restrict={0x3, 0x0, 0x0, 0xb, 0x2}]}, {0x0, [0x30, 0x5f, 0x5f]}}, &(0x7f0000000140)=""/1, 0x29, 0x1, 0x1, 0x7}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xe, 0x4, 0x4, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xd, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r7 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000080)=r9, 0x4) r10 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r9, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r10, r8, 0x0, r7}, 0x10) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000410000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r11, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x4}, 0x50) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f0000000500)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)=r0}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x51a8, 0x0, 0x0, 0x0, 0x7f}, [@map_fd={0x18, 0x3, 0x1, 0x0, r1}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x83c00, 0x8, '\x00', r3, 0x25, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x5, 0xd, 0x101, 0x9}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000380)=[0xffffffffffffffff, r6, r7, r11, r12, r13], 0x0, 0x10, 0x1ff}, 0x94) 569.718175ms ago: executing program 2 (id=10547): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @generic={0x66}, @initr0, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value=0x5000000}, 0x94) 326.619412ms ago: executing program 2 (id=10548): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000440), &(0x7f0000000040)=@udp=r1}, 0x20) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) syz_emit_ethernet(0xffffffffffffffac, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x22}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r1, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1}, 0xb}], 0x12, 0x40000021, 0x0) 236.039056ms ago: executing program 1 (id=10549): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000080)={0xfff, "a4cd16dbabf01b54dc29bb5da3e874f6126df4e1ec51a6463269129523a36a3191c02a91269a73d2766d416949e8ca9870a0dd7feb0b1349112df1ab884a78d5d56ec00e02f3c1a070ecb7cf71b841d05f2431d53beb5de88fc49bc030605ae08332af3b25b1dea718967cc349b7599d4416f794b8df5e3d313e8048d7152b07"}) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "feac8b38d76bd556", "69f080d4ee23164037b7a3e330edf233", "224fb8ec", "ed95318e73730751"}, 0x28) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}, [@mark={0xc, 0x15, {0x35075c, 0x2}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) 143.713479ms ago: executing program 0 (id=10550): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0xe26, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4620, @empty}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f00000003c0)={0xb, 0x9, 0xffffffff}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe98, 0x30, 0x25, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x30, 0x5, 0x0, 0x1, [{0x45, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x4}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) shutdown(r4, 0x1) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x4e20, 0xfffffffe, @empty, 0x3}, 0x1c) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="1c0100002c00010000000000fcdbdf250a01f28004001800140001"], 0x11c}], 0x1, 0x0, 0x0, 0x1}, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x1, @empty, 0x8}, 0x1c) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=@newlink={0x40, 0x10, 0x403, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x74, 0x0, 0x800, 0x1200}, [@IFLA_ADDRESS={0xa, 0x1, @broadcast}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macsec0\x00'}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000801}, 0x40008) sendmmsg$inet6(r4, &(0x7f0000001280)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x8, @empty, 0xfffffffe}, 0x1c, 0x0}}, {{&(0x7f0000000300)={0xa, 0x4e23, 0x10, @loopback, 0x2}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000000940)}}], 0x3, 0x240c089d) sendfile(r5, r4, &(0x7f0000000380)=0xfffffffffffffff9, 0x5) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x6, [@typedef={0x3, 0x0, 0x0, 0x8, 0x4}, @struct={0x4, 0x0, 0x0, 0x4, 0x0, 0x8}, @func={0x4, 0x0, 0x0, 0xc, 0x3}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x2, 0xfffffffd}}]}, {0x0, [0x2e, 0x61, 0x5f, 0x5f]}}, 0x0, 0x5a, 0x0, 0x1}, 0x28) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x3a}, @TCA_CAKE_INGRESS={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="180200000600000000000000000000008500000041000000850000002300000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0x0, 0xe, 0x0, &(0x7f0000000340)="0700000000000000bcf7d1725c60", 0x0, 0x808005, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 44.571588ms ago: executing program 1 (id=10551): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x4, 0x0, 0x0, 0x5}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) close(0xffffffffffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) accept$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb00000800030003", @ANYRES32=r2], 0x68}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x0) 0s ago: executing program 3 (id=10552): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, 0x0) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r2, 0x1) socket(0x22, 0x2, 0x3) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0xff}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3, 0xffffffffffffffff}, 0x0, 0x0}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)={0x1b, 0x0, 0x0, 0x0, 0x0, r4, 0x604, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x4}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket(0x22, 0x2, 0x23) close(r5) socket(0x15, 0x800, 0x200) connect$bt_rfcomm(r2, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) r6 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_PROMISC(r6, 0x6b, 0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x4, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): [ 1239.668406][ T6402] batadv_slave_0: left promiscuous mode [ 1239.709795][ T6404] netlink: 'syz.3.9278': attribute type 1 has an invalid length. [ 1239.811129][ T6404] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9278'. [ 1239.837604][ T6409] netlink: 'syz.1.9280': attribute type 1 has an invalid length. [ 1239.888959][ T6416] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.9281'. [ 1239.982913][ T6426] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9280'. [ 1240.112344][ T6430] netlink: 'syz.3.9285': attribute type 1 has an invalid length. [ 1240.118251][ T6409] bond19: entered promiscuous mode [ 1240.134087][ T6409] bond19: entered allmulticast mode [ 1240.148361][ T6409] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1240.227545][ T6436] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9285'. [ 1240.303798][ T6430] bond7: entered promiscuous mode [ 1240.309519][ T6430] bond7: entered allmulticast mode [ 1240.316412][ T6430] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1240.420748][ T6443] FAULT_INJECTION: forcing a failure. [ 1240.420748][ T6443] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1240.438043][ T6443] CPU: 1 UID: 0 PID: 6443 Comm: syz.4.9287 Not tainted syzkaller #0 PREEMPT(full) [ 1240.438075][ T6443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1240.438089][ T6443] Call Trace: [ 1240.438098][ T6443] [ 1240.438108][ T6443] dump_stack_lvl+0xe8/0x150 [ 1240.438166][ T6443] should_fail_ex+0x412/0x560 [ 1240.438198][ T6443] _copy_from_user+0x2d/0xb0 [ 1240.438229][ T6443] __copy_msghdr+0x3c5/0x5b0 [ 1240.438260][ T6443] ___sys_sendmsg+0x213/0x360 [ 1240.438284][ T6443] ? __lock_acquire+0x6b5/0x2cf0 [ 1240.438310][ T6443] ? __pfx____sys_sendmsg+0x10/0x10 [ 1240.438341][ T6443] ? kstrtouint+0x6e/0xe0 [ 1240.438401][ T6443] ? __fget_files+0x2a/0x420 [ 1240.438427][ T6443] ? __fget_files+0x3a0/0x420 [ 1240.438462][ T6443] __sys_sendmmsg+0x27c/0x4e0 [ 1240.438496][ T6443] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1240.438518][ T6443] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1240.438571][ T6443] ? ksys_write+0x242/0x270 [ 1240.438602][ T6443] ? __pfx_ksys_write+0x10/0x10 [ 1240.438638][ T6443] __x64_sys_sendmmsg+0xa0/0xc0 [ 1240.438664][ T6443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1240.438685][ T6443] do_syscall_64+0x15f/0xf80 [ 1240.438706][ T6443] ? trace_irq_disable+0x3b/0x140 [ 1240.438735][ T6443] ? clear_bhb_loop+0x40/0x90 [ 1240.438759][ T6443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1240.438785][ T6443] RIP: 0033:0x7ff3adb9cdd9 [ 1240.438804][ T6443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1240.438823][ T6443] RSP: 002b:00007ff3ae9db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1240.438846][ T6443] RAX: ffffffffffffffda RBX: 00007ff3ade15fa0 RCX: 00007ff3adb9cdd9 [ 1240.438861][ T6443] RDX: 0000000000000001 RSI: 0000200000003240 RDI: 0000000000000003 [ 1240.438873][ T6443] RBP: 00007ff3ae9db090 R08: 0000000000000000 R09: 0000000000000000 [ 1240.438886][ T6443] R10: 0000000004000800 R11: 0000000000000246 R12: 0000000000000001 [ 1240.438899][ T6443] R13: 00007ff3ade16038 R14: 00007ff3ade15fa0 R15: 00007ffe5b4e80c8 [ 1240.438933][ T6443] [ 1240.982464][ T6454] lo speed is unknown, defaulting to 1000 [ 1240.993453][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.018542][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.038539][ T6454] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1241.075252][ T6454] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1241.129047][ T6454] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1241.185929][ T6454] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1241.264884][ T6463] netlink: 'syz.2.9295': attribute type 1 has an invalid length. [ 1241.311639][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.333872][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.358924][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.359090][ T6472] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9295'. [ 1241.386744][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.412037][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.432813][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.456593][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.478244][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.532074][ T6454] lo speed is unknown, defaulting to 1000 [ 1241.832135][ T6482] FAULT_INJECTION: forcing a failure. [ 1241.832135][ T6482] name failslab, interval 1, probability 0, space 0, times 0 [ 1241.865336][ T6482] CPU: 0 UID: 0 PID: 6482 Comm: syz.2.9300 Not tainted syzkaller #0 PREEMPT(full) [ 1241.865364][ T6482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1241.865378][ T6482] Call Trace: [ 1241.865386][ T6482] [ 1241.865400][ T6482] dump_stack_lvl+0xe8/0x150 [ 1241.865431][ T6482] should_fail_ex+0x412/0x560 [ 1241.865462][ T6482] should_failslab+0xa8/0x100 [ 1241.865494][ T6482] ? dst_alloc+0x105/0x170 [ 1241.865531][ T6482] kmem_cache_alloc_noprof+0x87/0x650 [ 1241.865566][ T6482] dst_alloc+0x105/0x170 [ 1241.865598][ T6482] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 1241.865639][ T6482] ? ip_route_output_key_hash+0xd8/0x2a0 [ 1241.865665][ T6482] ip_route_output_key_hash+0x18d/0x2a0 [ 1241.865697][ T6482] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 1241.865744][ T6482] ip_route_output_flow+0x2a/0x150 [ 1241.865767][ T6482] ? security_sk_classify_flow+0x6d/0x150 [ 1241.865797][ T6482] udp_sendmsg+0x141a/0x21a0 [ 1241.865837][ T6482] ? __pfx_udp_sendmsg+0x10/0x10 [ 1241.865869][ T6482] ? ip4_datagram_release_cb+0x978/0xbe0 [ 1241.865895][ T6482] ? reacquire_held_locks+0x104/0x190 [ 1241.865916][ T6482] ? release_sock+0x2f/0x260 [ 1241.865939][ T6482] ? inet_sendmsg+0x14f/0x370 [ 1241.865961][ T6482] ? inet_sendmsg+0x14f/0x370 [ 1241.865981][ T6482] ? __local_bh_enable_ip+0xd0/0x130 [ 1241.865999][ T6482] ? lockdep_hardirqs_on+0x7a/0x110 [ 1241.866018][ T6482] ? inet_sendmsg+0x14f/0x370 [ 1241.866042][ T6482] ? __local_bh_enable_ip+0xd0/0x130 [ 1241.866059][ T6482] ? inet_sendmsg+0x29c/0x370 [ 1241.866084][ T6482] ____sys_sendmsg+0x80a/0x9f0 [ 1241.866112][ T6482] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1241.866141][ T6482] ? import_iovec+0x73/0xa0 [ 1241.866168][ T6482] ___sys_sendmsg+0x2a5/0x360 [ 1241.866188][ T6482] ? __lock_acquire+0x6b5/0x2cf0 [ 1241.866210][ T6482] ? __pfx____sys_sendmsg+0x10/0x10 [ 1241.866235][ T6482] ? kstrtouint+0x6e/0xe0 [ 1241.866277][ T6482] ? __fget_files+0x2a/0x420 [ 1241.866297][ T6482] ? __fget_files+0x3a0/0x420 [ 1241.866325][ T6482] __sys_sendmmsg+0x27c/0x4e0 [ 1241.866351][ T6482] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1241.866371][ T6482] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1241.866412][ T6482] ? ksys_write+0x242/0x270 [ 1241.866438][ T6482] ? __pfx_ksys_write+0x10/0x10 [ 1241.866467][ T6482] __x64_sys_sendmmsg+0xa0/0xc0 [ 1241.866488][ T6482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1241.866506][ T6482] do_syscall_64+0x15f/0xf80 [ 1241.866531][ T6482] ? trace_irq_disable+0x3b/0x140 [ 1241.866555][ T6482] ? clear_bhb_loop+0x40/0x90 [ 1241.866576][ T6482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1241.866592][ T6482] RIP: 0033:0x7ff8ed59cdd9 [ 1241.866609][ T6482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1241.866625][ T6482] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1241.866644][ T6482] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1241.866656][ T6482] RDX: 0000000000000001 RSI: 0000200000003240 RDI: 0000000000000003 [ 1241.866668][ T6482] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1241.866680][ T6482] R10: 0000000004000800 R11: 0000000000000246 R12: 0000000000000001 [ 1241.866694][ T6482] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1241.866722][ T6482] [ 1242.933308][ T6497] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1243.324198][ T6503] nbd: must specify a device to reconfigure [ 1243.451604][ T6507] netlink: 'syz.4.9308': attribute type 1 has an invalid length. [ 1243.468305][ T6508] netlink: 36 bytes leftover after parsing attributes in process `syz.1.9309'. [ 1243.571938][ T6513] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9308'. [ 1243.707340][ T6515] netlink: 'syz.2.9310': attribute type 5 has an invalid length. [ 1244.642761][ T6537] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9315'. [ 1245.138650][ T6565] netlink: 'syz.3.9324': attribute type 1 has an invalid length. [ 1245.151095][ T6560] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9323'. [ 1245.254275][ T6571] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9324'. [ 1245.266348][ T6559] lo speed is unknown, defaulting to 1000 [ 1245.405016][ T6577] netlink: 316 bytes leftover after parsing attributes in process `syz.4.9327'. [ 1245.417342][ T6577] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1245.508433][ T6580] xfrm0: entered promiscuous mode [ 1245.515310][ T6580] xfrm0: entered allmulticast mode [ 1245.544241][ T6583] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9329'. [ 1245.629774][ T6585] netlink: 'syz.3.9330': attribute type 1 has an invalid length. [ 1245.745712][ T6593] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9330'. [ 1245.804151][ T6595] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9333'. [ 1245.839400][ T6595] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9333'. [ 1245.988085][ T6585] bond8: entered promiscuous mode [ 1246.001292][ T6585] bond8: entered allmulticast mode [ 1246.026378][ T6585] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1247.199734][ T6639] lo speed is unknown, defaulting to 1000 [ 1248.592170][ T6663] __nla_validate_parse: 1 callbacks suppressed [ 1248.592195][ T6663] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9352'. [ 1248.750742][ T6665] veth11: entered allmulticast mode [ 1248.948822][ T6669] bond15 (unregistering): Released all slaves [ 1248.970638][ T6682] netlink: 'syz.2.9353': attribute type 1 has an invalid length. [ 1249.002042][ T6682] netlink: 'syz.2.9353': attribute type 1 has an invalid length. [ 1249.016078][ T6682] netlink: 14593 bytes leftover after parsing attributes in process `syz.2.9353'. [ 1249.158277][ T6689] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9359'. [ 1249.206310][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1249.241999][ T6691] syzkaller1: entered promiscuous mode [ 1249.256456][ T6691] syzkaller1: entered allmulticast mode [ 1249.314818][ T6691] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1249.345261][ T6693] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1249.347094][ T6694] netlink: 256 bytes leftover after parsing attributes in process `syz.3.9361'. [ 1249.369905][ T6691] syzkaller0: entered promiscuous mode [ 1249.381497][ T6691] syzkaller0: entered allmulticast mode [ 1249.442989][ T6694] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 1249.572303][ T6708] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.9364'. [ 1249.957219][ T6721] syzkaller1: entered promiscuous mode [ 1249.968252][ T6721] syzkaller1: entered allmulticast mode [ 1250.040529][ T6714] lo speed is unknown, defaulting to 1000 [ 1250.231861][ T6732] batadv0: left allmulticast mode [ 1250.321169][ T6735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9372'. [ 1250.434157][ T6743] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9374'. [ 1250.491511][ T6743] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1250.621949][ T6750] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9372'. [ 1251.390585][ T6786] lo speed is unknown, defaulting to 1000 [ 1251.514805][ T6795] tipc: Enabled bearer , priority 0 [ 1251.530357][ T6795] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9392'. [ 1251.567362][ T6795] syzkaller0: entered promiscuous mode [ 1251.578710][ T6795] syzkaller0: entered allmulticast mode [ 1251.842500][ T6808] netlink: 'syz.2.9397': attribute type 4 has an invalid length. [ 1251.875858][ T6808] netlink: 152 bytes leftover after parsing attributes in process `syz.2.9397'. [ 1251.916279][ T6795] tipc: Resetting bearer [ 1251.995957][T26782] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1252.006330][ T6808] .`: renamed from bond0 (while UP) [ 1252.024588][T26782] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1252.038875][T26782] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1252.073253][T26782] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1252.085085][T26782] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1252.094373][ T6792] tipc: Resetting bearer [ 1252.333507][ T6792] tipc: Disabling bearer [ 1253.263614][ T6839] lo speed is unknown, defaulting to 1000 [ 1253.463940][ T6811] lo speed is unknown, defaulting to 1000 [ 1253.612094][ T6867] GUP no longer grows the stack in syz.4.9413 (6867): 200000003000-20000000a000 (200000001000) [ 1253.662457][ T6867] CPU: 1 UID: 0 PID: 6867 Comm: syz.4.9413 Not tainted syzkaller #0 PREEMPT(full) [ 1253.662490][ T6867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1253.662505][ T6867] Call Trace: [ 1253.662514][ T6867] [ 1253.662525][ T6867] dump_stack_lvl+0xe8/0x150 [ 1253.662558][ T6867] __get_user_pages+0x2378/0x2720 [ 1253.662590][ T6867] ? __gup_longterm_locked+0xc4e/0x1630 [ 1253.662636][ T6867] ? __gup_longterm_locked+0xc4e/0x1630 [ 1253.662663][ T6867] ? down_read_killable+0x1bb/0x340 [ 1253.662699][ T6867] __gup_longterm_locked+0xdcf/0x1630 [ 1253.662732][ T6867] ? lock_acquire+0x106/0x350 [ 1253.662776][ T6867] gup_fast_fallback+0x1d84/0x20d0 [ 1253.662841][ T6867] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1253.662871][ T6867] ? is_valid_gup_args+0x11f/0x200 [ 1253.662899][ T6867] ? get_user_pages_fast+0x4d/0xb0 [ 1253.662928][ T6867] __iov_iter_get_pages_alloc+0x370/0xa10 [ 1253.662968][ T6867] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 1253.663004][ T6867] iov_iter_get_pages2+0x5e/0xa0 [ 1253.663037][ T6867] __se_sys_vmsplice+0x7c7/0x1620 [ 1253.663088][ T6867] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 1253.663121][ T6867] ? __pfx_futex_wake+0x10/0x10 [ 1253.663161][ T6867] ? lockdep_hardirqs_on+0x7a/0x110 [ 1253.663258][ T6867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1253.663283][ T6867] do_syscall_64+0x15f/0xf80 [ 1253.663306][ T6867] ? trace_irq_disable+0x3b/0x140 [ 1253.663339][ T6867] ? clear_bhb_loop+0x40/0x90 [ 1253.663367][ T6867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1253.663389][ T6867] RIP: 0033:0x7ff3adb9cdd9 [ 1253.663411][ T6867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1253.663429][ T6867] RSP: 002b:00007ff3ae9db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 1253.663450][ T6867] RAX: ffffffffffffffda RBX: 00007ff3ade15fa0 RCX: 00007ff3adb9cdd9 [ 1253.663463][ T6867] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000006 [ 1253.663477][ T6867] RBP: 00007ff3adc32d69 R08: 0000000000000000 R09: 0000000000000000 [ 1253.663491][ T6867] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 1253.663505][ T6867] R13: 00007ff3ade16038 R14: 00007ff3ade15fa0 R15: 00007ffe5b4e80c8 [ 1253.663543][ T6867] [ 1254.168880][T26782] Bluetooth: hci5: command tx timeout [ 1254.542731][T26997] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1254.858150][T27011] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1255.411936][T26997] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1255.430643][T26997] netdevsim netdevsim1 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 1255.456351][ T6811] bridge0: port 1(bridge_slave_0) entered blocking state [ 1255.473661][ T6811] bridge0: port 1(bridge_slave_0) entered disabled state [ 1255.491682][ T6811] bridge_slave_0: entered allmulticast mode [ 1255.518405][ T6811] bridge_slave_0: entered promiscuous mode [ 1255.564922][T26999] bridge_slave_1: left promiscuous mode [ 1255.594977][T26999] bridge0: port 2(bridge_slave_1) entered disabled state [ 1255.667252][T26999] bridge_slave_0: left allmulticast mode [ 1255.690474][T26999] bridge_slave_0: left promiscuous mode [ 1255.705751][T26999] bridge0: port 1(bridge_slave_0) entered disabled state [ 1256.250138][T26782] Bluetooth: hci5: command tx timeout [ 1256.263431][T26999] bond2 (unregistering): (slave erspan1): Releasing active interface [ 1256.279682][T26999] erspan1 (unregistering): left promiscuous mode [ 1256.350833][T26999] bond5 (unregistering): (slave gretap1): Releasing active interface [ 1256.373631][ T6942] ipt_REJECT: TCP_RESET invalid for non-tcp [ 1256.439835][T26999] bond6 (unregistering): (slave bridge1): Releasing active interface [ 1256.603877][T26999] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1256.614975][T26999] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1256.627373][T26999] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1256.639270][T26999] bond0 (unregistering): Released all slaves [ 1256.653236][T26999] bond1 (unregistering): Released all slaves [ 1256.668727][T26999] bond2 (unregistering): Released all slaves [ 1256.684516][T26999] bond3 (unregistering): Released all slaves [ 1256.704605][T26999] bond4 (unregistering): Released all slaves [ 1256.729077][T26999] bond5 (unregistering): Released all slaves [ 1256.744591][T26999] bond6 (unregistering): Released all slaves [ 1256.760364][T26999] bond7 (unregistering): Released all slaves [ 1256.783175][T26999] bond8 (unregistering): Released all slaves [ 1256.799071][T26999] bond9 (unregistering): Released all slaves [ 1256.823607][T26999] bond10 (unregistering): Released all slaves [ 1256.845328][T26999] bond11 (unregistering): Released all slaves [ 1256.861595][T26999] bond12 (unregistering): Released all slaves [ 1256.877088][T26999] bond13 (unregistering): Released all slaves [ 1256.895158][T26999] bond14 (unregistering): Released all slaves [ 1256.913874][T26999] bond15 (unregistering): Released all slaves [ 1256.950803][T26999] bond16 (unregistering): Released all slaves [ 1256.966772][T26999] bond17 (unregistering): Released all slaves [ 1256.982508][T26999] bond18 (unregistering): Released all slaves [ 1256.998427][T26999] bond19 (unregistering): Released all slaves [ 1257.013581][ T6902] lo speed is unknown, defaulting to 1000 [ 1257.013738][ T6811] bridge0: port 2(bridge_slave_1) entered blocking state [ 1257.027309][ T6811] bridge0: port 2(bridge_slave_1) entered disabled state [ 1257.034770][ T6811] bridge_slave_1: entered allmulticast mode [ 1257.042363][ T6811] bridge_slave_1: entered promiscuous mode [ 1257.089970][ T6927] __nla_validate_parse: 4 callbacks suppressed [ 1257.089990][ T6927] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9427'. [ 1257.116994][ T5288] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1257.280355][ T6811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1257.360501][T26999] tipc: Disabling bearer [ 1257.383205][T26999] tipc: Disabling bearer [ 1257.413189][T26999] tipc: Disabling bearer [ 1257.428272][T26999] tipc: Left network mode [ 1257.461287][ T6811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1257.572395][T26999] rxrpc: Call ffff88807f6c2d00 still in use (1,Complete,1489,0)! [ 1257.588059][ T6811] team0: Port device team_slave_0 added [ 1257.697500][ T6811] team0: Port device team_slave_1 added [ 1257.718348][ T6965] netlink: 'syz.2.9436': attribute type 3 has an invalid length. [ 1257.748299][ T6966] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9435'. [ 1257.823236][ T6966] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9435'. [ 1257.959167][ T6811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1257.969848][ T6811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1257.996862][ T6811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1258.074016][ T6811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1258.093284][ T6811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1258.175837][ T6811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1258.195687][ T6982] xt_hashlimit: size too large, truncated to 1048576 [ 1258.328167][T26782] Bluetooth: hci5: command tx timeout [ 1258.569049][ T6990] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9438'. [ 1258.595811][ T6811] hsr_slave_0: entered promiscuous mode [ 1258.611790][ T6811] hsr_slave_1: entered promiscuous mode [ 1258.629048][ T6811] debugfs: 'hsr0' already exists in 'hsr' [ 1258.649028][ T6811] Cannot create hsr debugfs directory [ 1258.659518][ T6992] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9438'. [ 1258.836824][ T6992] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1258.887497][ T5288] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1258.937217][ T6984] lo speed is unknown, defaulting to 1000 [ 1259.141350][ T6996] lo speed is unknown, defaulting to 1000 [ 1259.461472][ T7021] FAULT_INJECTION: forcing a failure. [ 1259.461472][ T7021] name failslab, interval 1, probability 0, space 0, times 0 [ 1259.512547][ T7021] CPU: 1 UID: 0 PID: 7021 Comm: syz.2.9445 Not tainted syzkaller #0 PREEMPT(full) [ 1259.512580][ T7021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1259.512593][ T7021] Call Trace: [ 1259.512602][ T7021] [ 1259.512612][ T7021] dump_stack_lvl+0xe8/0x150 [ 1259.512644][ T7021] should_fail_ex+0x412/0x560 [ 1259.512677][ T7021] should_failslab+0xa8/0x100 [ 1259.512711][ T7021] __kmalloc_noprof+0xe8/0x760 [ 1259.512737][ T7021] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1259.512769][ T7021] ? tls_get_rec+0xbf/0x670 [ 1259.512803][ T7021] tls_get_rec+0xbf/0x670 [ 1259.512830][ T7021] ? __local_bh_enable_ip+0xd0/0x130 [ 1259.512858][ T7021] tls_sw_sendmsg+0x4d7/0x2430 [ 1259.512883][ T7021] ? __lock_acquire+0x6b5/0x2cf0 [ 1259.512907][ T7021] ? __lock_acquire+0x6b5/0x2cf0 [ 1259.512962][ T7021] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 1259.512985][ T7021] ? unwind_next_frame+0xa6/0x2550 [ 1259.513012][ T7021] ? __pfx_aa_sk_perm+0x10/0x10 [ 1259.513032][ T7021] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1259.513060][ T7021] ? sock_rps_record_flow+0x19/0x350 [ 1259.513092][ T7021] ? inet_send_prepare+0x47/0x270 [ 1259.513117][ T7021] ? __pfx_inet6_sendmsg+0x10/0x10 [ 1259.513147][ T7021] ? inet6_sendmsg+0x101/0x120 [ 1259.513173][ T7021] ? __pfx_inet6_sendmsg+0x10/0x10 [ 1259.513201][ T7021] sock_sendmsg+0x267/0x450 [ 1259.513240][ T7021] ? __pfx_sock_sendmsg+0x10/0x10 [ 1259.513284][ T7021] ? __asan_memset+0x22/0x50 [ 1259.513317][ T7021] ? iov_iter_bvec+0xb8/0x180 [ 1259.513349][ T7021] splice_to_socket+0xae2/0x11f0 [ 1259.513384][ T7021] ? ktime_get_coarse_real_ts64_mg+0x59/0x1e0 [ 1259.513435][ T7021] ? __pfx_splice_to_socket+0x10/0x10 [ 1259.513460][ T7021] ? __mark_inode_dirty+0x6ec/0x13b0 [ 1259.513517][ T7021] ? touch_atime+0x379/0x6b0 [ 1259.513545][ T7021] ? shmem_file_splice_read+0xa42/0xbb0 [ 1259.513595][ T7021] ? __pfx_splice_to_socket+0x10/0x10 [ 1259.513623][ T7021] direct_splice_actor+0x101/0x160 [ 1259.513655][ T7021] splice_direct_to_actor+0x53a/0xc70 [ 1259.513695][ T7021] ? __pfx_direct_splice_actor+0x10/0x10 [ 1259.513732][ T7021] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1259.513772][ T7021] do_splice_direct+0x195/0x290 [ 1259.513803][ T7021] ? __pfx_do_splice_direct+0x10/0x10 [ 1259.513831][ T7021] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1259.513863][ T7021] ? bpf_lsm_file_permission+0x9/0x20 [ 1259.513892][ T7021] ? security_file_permission+0x75/0x260 [ 1259.513916][ T7021] ? rw_verify_area+0x255/0x4d0 [ 1259.513949][ T7021] do_sendfile+0x535/0x7d0 [ 1259.513973][ T7021] ? __pfx_vfs_write+0x10/0x10 [ 1259.514009][ T7021] ? __pfx_do_sendfile+0x10/0x10 [ 1259.514033][ T7021] ? __fget_files+0x3a0/0x420 [ 1259.514070][ T7021] __se_sys_sendfile64+0x144/0x1a0 [ 1259.514098][ T7021] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 1259.514130][ T7021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1259.514153][ T7021] do_syscall_64+0x15f/0xf80 [ 1259.514176][ T7021] ? trace_irq_disable+0x3b/0x140 [ 1259.514215][ T7021] ? clear_bhb_loop+0x40/0x90 [ 1259.514240][ T7021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1259.514259][ T7021] RIP: 0033:0x7ff8ed59cdd9 [ 1259.514281][ T7021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1259.514298][ T7021] RSP: 002b:00007ff8ee393028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1259.514321][ T7021] RAX: ffffffffffffffda RBX: 00007ff8ed816090 RCX: 00007ff8ed59cdd9 [ 1259.514336][ T7021] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000008 [ 1259.514347][ T7021] RBP: 00007ff8ee393090 R08: 0000000000000000 R09: 0000000000000000 [ 1259.514359][ T7021] R10: 00000ffffffff004 R11: 0000000000000246 R12: 0000000000000001 [ 1259.514373][ T7021] R13: 00007ff8ed816128 R14: 00007ff8ed816090 R15: 00007ffec26dc118 [ 1259.514415][ T7021] [ 1260.406175][T26782] Bluetooth: hci5: command tx timeout [ 1260.417608][ T7029] netlink: 'syz.0.9448': attribute type 1 has an invalid length. [ 1260.515179][ T7035] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9448'. [ 1260.531827][ T6811] netdevsim netdevsim1 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1260.764535][ T7029] bond15: entered promiscuous mode [ 1260.793903][ T7029] bond15: entered allmulticast mode [ 1260.821519][ T7029] 8021q: adding VLAN 0 to HW filter on device bond15 [ 1260.894595][ T6811] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1261.203740][ T6811] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1261.450829][ T6811] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1261.793671][ T7055] syzkaller1: entered promiscuous mode [ 1261.811117][ T7055] syzkaller1: entered allmulticast mode [ 1261.843464][ T7061] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9454'. [ 1261.880138][ T7061] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9454'. [ 1262.453017][ T6811] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1262.501872][ T6811] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1262.522365][ T6811] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1262.560920][ T6811] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1262.613804][ T6811] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1262.632095][ T6811] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1262.671670][ T6811] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1262.709326][ T6811] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1262.893418][ T7102] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9462'. [ 1263.052205][ T6811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1263.122653][ T6811] 8021q: adding VLAN 0 to HW filter on device team0 [ 1263.184522][T27011] bridge0: port 1(bridge_slave_0) entered blocking state [ 1263.192085][T27011] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1263.281623][T26994] bridge0: port 2(bridge_slave_1) entered blocking state [ 1263.289074][T26994] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1263.318240][ T7107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9464'. [ 1263.690203][ T7118] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9465'. [ 1263.966378][ T7118] netlink: 56 bytes leftover after parsing attributes in process `syz.4.9465'. [ 1264.927693][ T7147] lo speed is unknown, defaulting to 1000 [ 1265.387092][ T6811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1265.698398][ T6811] veth0_vlan: entered promiscuous mode [ 1265.753079][ T6811] veth1_vlan: entered promiscuous mode [ 1265.926831][ T6811] veth0_macvtap: entered promiscuous mode [ 1265.990100][ T6811] veth1_macvtap: entered promiscuous mode [ 1266.137183][ T6811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1266.239585][ T6811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1266.370946][T27004] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1266.395240][ T7193] lo speed is unknown, defaulting to 1000 [ 1266.417907][T27004] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1266.465328][T27004] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1266.517390][T27004] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1266.864946][T26997] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1266.891517][T26997] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1266.980727][T27008] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1267.024827][T27008] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1267.206591][ T7218] sctp: [Deprecated]: syz.0.9479 (pid 7218) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1267.206591][ T7218] Use struct sctp_sack_info instead [ 1267.682712][ T7238] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 1267.757399][ T7239] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9485'. [ 1268.022662][ T4944] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1268.039594][ T4944] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1268.057190][ T4944] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1268.078601][ T4944] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1268.089117][ T4944] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1268.183498][ T7239] team0: Port device team_slave_0 removed [ 1268.210595][ T7254] netlink: 'syz.4.9488': attribute type 21 has an invalid length. [ 1268.698003][ T7254] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9488'. [ 1268.852655][ T7237] lo speed is unknown, defaulting to 1000 [ 1269.025844][ T7261] lo speed is unknown, defaulting to 1000 [ 1269.298718][ T7290] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9495'. [ 1269.442420][ T7249] lo speed is unknown, defaulting to 1000 [ 1269.855833][ T7310] lo speed is unknown, defaulting to 1000 [ 1270.013518][ T7321] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9501'. [ 1270.176109][T26782] Bluetooth: hci4: command tx timeout [ 1270.429334][ T7249] bridge0: port 1(bridge_slave_0) entered blocking state [ 1270.470472][ T7249] bridge0: port 1(bridge_slave_0) entered disabled state [ 1270.490503][ T7249] bridge_slave_0: entered allmulticast mode [ 1270.502825][ T7249] bridge_slave_0: entered promiscuous mode [ 1270.537534][ T7345] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9508'. [ 1270.551473][ T7345] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9508'. [ 1270.553178][ T7249] bridge0: port 2(bridge_slave_1) entered blocking state [ 1270.561278][ T7345] netlink: 'syz.4.9508': attribute type 14 has an invalid length. [ 1270.583175][ T7249] bridge0: port 2(bridge_slave_1) entered disabled state [ 1270.586442][ T7345] netlink: 'syz.4.9508': attribute type 13 has an invalid length. [ 1270.606297][ T7249] bridge_slave_1: entered allmulticast mode [ 1270.621045][ T7249] bridge_slave_1: entered promiscuous mode [ 1270.756535][ T7249] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1270.792992][ T7249] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1270.928661][ T7249] team0: Port device team_slave_0 added [ 1270.951478][ T7249] team0: Port device team_slave_1 added [ 1271.033389][ T7249] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1271.041053][ T7249] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1271.071336][ T7249] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1271.108675][ T7249] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1271.116618][ T7249] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1271.158126][ T7249] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1271.187470][ T7356] lo speed is unknown, defaulting to 1000 [ 1271.276261][ T7365] netlink: 'syz.3.9513': attribute type 10 has an invalid length. [ 1271.374138][ T7249] hsr_slave_0: entered promiscuous mode [ 1271.388713][ T7249] hsr_slave_1: entered promiscuous mode [ 1271.404830][ T7249] debugfs: 'hsr0' already exists in 'hsr' [ 1271.418568][ T7249] Cannot create hsr debugfs directory [ 1271.523649][ T7378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9514'. [ 1271.574392][ T7379] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9516'. [ 1272.246502][T26782] Bluetooth: hci4: command tx timeout [ 1272.274847][ T7249] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1272.289713][ T7249] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.581829][ T7249] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1272.594381][ T7249] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.626034][ T7400] batadv_slave_0: entered promiscuous mode [ 1272.700069][ T7407] nbd: socks must be embedded in a SOCK_ITEM attr [ 1272.737322][ T7407] block nbd8: shutting down sockets [ 1272.769721][ T7406] netlink: 'syz.1.9523': attribute type 8 has an invalid length. [ 1272.861299][ T7249] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1272.872837][ T7249] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1272.906839][ T7403] netlink: 144 bytes leftover after parsing attributes in process `syz.1.9523'. [ 1272.928124][ T7401] batadv_slave_0: left promiscuous mode [ 1273.143857][ T7249] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1273.175223][ T7249] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1273.325256][ T7422] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9527'. [ 1273.350340][ T7413] lo speed is unknown, defaulting to 1000 [ 1273.902621][ T7448] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.9533'. [ 1274.144356][ T7452] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9534'. [ 1274.203257][ T7453] netlink: 'syz.3.9534': attribute type 13 has an invalid length. [ 1274.236833][ T7453] netlink: 'syz.3.9534': attribute type 17 has an invalid length. [ 1274.272375][ T7455] pim6reg: entered allmulticast mode [ 1274.278732][ T7249] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1274.294739][ T7249] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1274.303565][ T7249] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1274.316445][ T7249] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1274.340422][T26782] Bluetooth: hci4: command tx timeout [ 1274.350088][ T7453] lo: left allmulticast mode [ 1274.378002][ T7452] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9534'. [ 1274.398943][ T7453] tunl0: left allmulticast mode [ 1274.431766][ T7453] gre0: left allmulticast mode [ 1274.475969][ T7453] gretap0: left allmulticast mode [ 1274.514024][ T7453] erspan0: left allmulticast mode [ 1274.574625][ T7453] ip_vti0: left allmulticast mode [ 1274.591446][ T7453] ip6_vti0: left allmulticast mode [ 1274.608413][ T7453] sit0: left allmulticast mode [ 1274.639494][ T7453] ip6tnl0: left allmulticast mode [ 1274.661035][ T7453] ip6gre0: left allmulticast mode [ 1274.680526][ T7453] syz_tun: left allmulticast mode [ 1274.749712][ T7453] bridge0: left allmulticast mode [ 1274.772257][ T7453] vcan0: left allmulticast mode [ 1274.785004][ T7453] bond0: left allmulticast mode [ 1274.796231][ T7453] team0: left allmulticast mode [ 1274.801259][ T7453] dummy0: left allmulticast mode [ 1274.835656][ T7453] nlmon0: left allmulticast mode [ 1274.850630][ T7453] veth0: left allmulticast mode [ 1274.863327][ T7453] veth1: left allmulticast mode [ 1274.887518][ T7453] wg0: left allmulticast mode [ 1274.897324][ T7453] wg1: left allmulticast mode [ 1274.911214][ T7453] wg2: left allmulticast mode [ 1274.923376][ T7453] veth0_to_bridge: left allmulticast mode [ 1274.934229][ T7453] bridge_slave_0: left allmulticast mode [ 1274.953262][ T7453] veth1_to_bridge: left allmulticast mode [ 1274.974468][ T7453] bridge_slave_1: left allmulticast mode [ 1274.994273][ T7453] veth0_to_bond: left allmulticast mode [ 1275.015815][ T7453] ªªªªª;: left allmulticast mode [ 1275.024118][ T7453] veth1_to_bond: left allmulticast mode [ 1275.041701][ T7453] bond_slave_1: left allmulticast mode [ 1275.060475][ T7453] veth1_to_team: left allmulticast mode [ 1275.079087][ T7453] team_slave_1: left allmulticast mode [ 1275.093578][ T7453] veth0_to_batadv: left allmulticast mode [ 1275.111121][ T7453] batadv_slave_0: left allmulticast mode [ 1275.127780][ T7453] veth1_to_batadv: left allmulticast mode [ 1275.147105][ T7453] batadv_slave_1: left allmulticast mode [ 1275.166866][ T7453] xfrm0: left allmulticast mode [ 1275.182018][ T7453] veth0_to_hsr: left allmulticast mode [ 1275.208312][ T7453] veth1_to_hsr: left allmulticast mode [ 1275.234451][ T7453] hsr0: left allmulticast mode [ 1275.247109][ T7453] hsr_slave_0: left allmulticast mode [ 1275.254073][ T7453] hsr_slave_1: left allmulticast mode [ 1275.269812][ T7453] veth1_virt_wifi: left allmulticast mode [ 1275.312991][ T7453] veth0_macvtap: left allmulticast mode [ 1275.322668][ T7453] macvtap0: left allmulticast mode [ 1275.346460][ T7453] veth1_macvtap: left allmulticast mode [ 1275.352287][ T7453] macsec0: left allmulticast mode [ 1275.371259][ T7453] geneve0: left allmulticast mode [ 1275.380427][ T7453] geneve1: left allmulticast mode [ 1275.395877][ T7453] mac80211_hwsim hwsim77 wlan0: left allmulticast mode [ 1275.412690][ T7453] mac80211_hwsim hwsim79 wlan1: left allmulticast mode [ 1275.427799][ T7453] bond1: left allmulticast mode [ 1275.437944][ T7453] geneve2: left allmulticast mode [ 1275.450686][ T7453] bridge1: left allmulticast mode [ 1275.462689][ T7453] bond2: left allmulticast mode [ 1275.473311][ T7453] ip6gretap0: left allmulticast mode [ 1275.479371][ T7453] macsec1: left allmulticast mode [ 1275.501948][ T7453] mac80211_hwsim hwsim82 wlan2: left allmulticast mode [ 1275.512782][ T7453] gtp0: left allmulticast mode [ 1275.529088][ T7453] ip6erspan0: left allmulticast mode [ 1275.554410][ T7453] bridge2: left allmulticast mode [ 1275.563836][ T7453] xfrm1: left allmulticast mode [ 1275.574960][ T7453] bridge3: left allmulticast mode [ 1275.583427][ T7453] sit1: left allmulticast mode [ 1275.613615][ T7453] gretap1: left allmulticast mode [ 1275.699578][ T7453] veth2: left allmulticast mode [ 1275.709370][ T7453] veth3: left allmulticast mode [ 1275.721516][ T7453] bridge4: left allmulticast mode [ 1275.730776][ T7453] veth4: left allmulticast mode [ 1275.740657][ T7453] veth5: left allmulticast mode [ 1275.754003][ T7453] bond3: left allmulticast mode [ 1275.769378][ T7453] ip6gretap1: left allmulticast mode [ 1275.783962][ T7453] veth6: left allmulticast mode [ 1275.793008][ T7453] veth7: left allmulticast mode [ 1275.816988][ T7453] bridge5: left promiscuous mode [ 1275.866344][ T7453] bond6: left promiscuous mode [ 1275.872883][ T7453] erspan1: left promiscuous mode [ 1275.878940][ T7453] bond6: left allmulticast mode [ 1275.891768][ T7453] erspan1: left allmulticast mode [ 1275.923278][ T7453] ip6tnl1: left allmulticast mode [ 1275.938356][ T7453] bond7: left promiscuous mode [ 1275.949530][ T7453] bond7: left allmulticast mode [ 1275.958162][ T7453] bond8: left promiscuous mode [ 1275.963081][ T7453] bond8: left allmulticast mode [ 1275.973384][ T7455] pim6reg: left allmulticast mode [ 1276.008588][ T7249] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1276.022189][ T7249] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1276.030871][ T7249] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1276.049693][ T7249] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1276.173342][T27011] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1276.195790][T27011] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1276.208702][ T7475] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.9539'. [ 1276.219987][T27011] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1276.253874][T27011] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1276.354121][ T7478] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9538'. [ 1276.370834][ T7482] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9541'. [ 1276.386259][ T7483] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9540'. [ 1276.394451][ T7470] IPVS: Scheduler module ip_vs_ not found [ 1276.405715][T26782] Bluetooth: hci4: command tx timeout [ 1276.508760][ T7249] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1276.618377][ T7249] 8021q: adding VLAN 0 to HW filter on device team0 [ 1276.683211][T26998] bridge0: port 1(bridge_slave_0) entered blocking state [ 1276.690675][T26998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1276.732345][ T7495] netlink: 48 bytes leftover after parsing attributes in process `syz.4.9543'. [ 1276.748875][T26998] bridge0: port 2(bridge_slave_1) entered blocking state [ 1276.756197][T26998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1276.782158][ T7505] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.9544'. [ 1277.066777][ T7517] netlink: 'syz.2.9548': attribute type 1 has an invalid length. [ 1277.143679][ T7522] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9548'. [ 1278.041912][ T7249] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1278.094694][ T7560] xt_TCPMSS: Only works on TCP SYN packets [ 1278.193291][ T7249] veth0_vlan: entered promiscuous mode [ 1278.231038][ T7249] veth1_vlan: entered promiscuous mode [ 1278.314769][ T7249] veth0_macvtap: entered promiscuous mode [ 1278.348520][ T7249] veth1_macvtap: entered promiscuous mode [ 1278.398450][ T7249] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1278.460520][ T7249] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1278.504279][T27011] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1278.527955][T27011] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1278.582820][T27011] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1278.606563][T27011] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1278.991464][ T7572] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 1279.008061][ T7572] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1279.058712][T27011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1279.083330][T27011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1279.212718][T27008] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1279.237203][T27008] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1279.318076][ T7583] __nla_validate_parse: 2 callbacks suppressed [ 1279.318100][ T7583] netlink: 324 bytes leftover after parsing attributes in process `syz.4.9564'. [ 1279.364953][ T7586] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9562'. [ 1280.107209][ T7604] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.9568'. [ 1280.193171][ T7605] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9569'. [ 1280.222568][ T7588] netlink: 'syz.3.9562': attribute type 29 has an invalid length. [ 1281.274087][ T4944] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1281.292609][ T4944] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1281.311220][ T4944] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1281.326091][ T4944] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1281.346395][ T4944] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1281.586526][ T7648] netlink: 156 bytes leftover after parsing attributes in process `syz.2.9579'. [ 1281.617091][ T7648] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1282.213997][ T7658] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 1282.347101][ T7680] netlink: 64 bytes leftover after parsing attributes in process `syz.2.9585'. [ 1282.850823][ T7701] syzkaller0: entered promiscuous mode [ 1282.874719][ T7701] syzkaller0: entered allmulticast mode [ 1282.924644][ T7640] lo speed is unknown, defaulting to 1000 [ 1283.340263][ T7715] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9596'. [ 1283.445742][T26782] Bluetooth: hci0: command tx timeout [ 1283.893928][ T7735] netlink: 64 bytes leftover after parsing attributes in process `syz.1.9600'. [ 1284.021246][ T7640] bridge0: port 1(bridge_slave_0) entered blocking state [ 1284.046890][ T7640] bridge0: port 1(bridge_slave_0) entered disabled state [ 1284.077123][ T7640] bridge_slave_0: entered allmulticast mode [ 1284.101724][ T7640] bridge_slave_0: entered promiscuous mode [ 1284.129168][ T7640] bridge0: port 2(bridge_slave_1) entered blocking state [ 1284.141058][ T7640] bridge0: port 2(bridge_slave_1) entered disabled state [ 1284.159183][ T7640] bridge_slave_1: entered allmulticast mode [ 1284.179676][ T7640] bridge_slave_1: entered promiscuous mode [ 1284.325030][ T7640] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1284.437879][ T7640] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1284.560940][ T7640] team0: Port device team_slave_0 added [ 1284.595037][ T7640] team0: Port device team_slave_1 added [ 1284.745646][ T7640] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1284.769820][ T7640] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1284.841519][ T7640] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1284.894810][ T7640] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1284.910745][ T7640] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1284.972117][ T7640] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1285.246554][ T7640] hsr_slave_0: entered promiscuous mode [ 1285.258699][ T7640] hsr_slave_1: entered promiscuous mode [ 1285.289860][ T7640] debugfs: 'hsr0' already exists in 'hsr' [ 1285.297455][ T7640] Cannot create hsr debugfs directory [ 1285.366078][ T7780] block nbd8: server does not support multiple connections per device. [ 1285.381235][ T7780] block nbd8: shutting down sockets [ 1285.464259][ T7777] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9615'. [ 1285.526354][T26782] Bluetooth: hci0: command tx timeout [ 1285.835270][ T7795] xt_hashlimit: size too large, truncated to 1048576 [ 1285.907484][ T7796] –: renamed from vxcan1 (while UP) [ 1285.929345][ T7796] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 1286.462264][ T7640] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1286.481239][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1286.503412][ T7640] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1286.536843][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1286.557019][ T7640] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1286.604339][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1286.636679][ T7640] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1286.654238][ T7640] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1286.680861][ T7818] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9629'. [ 1286.961422][ T7834] syzkaller0: entered promiscuous mode [ 1287.029708][ T7640] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1287.098225][ T7640] 8021q: adding VLAN 0 to HW filter on device team0 [ 1287.132016][ T3214] bridge0: port 1(bridge_slave_0) entered blocking state [ 1287.139740][ T3214] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1287.184292][T27008] bridge0: port 2(bridge_slave_1) entered blocking state [ 1287.191560][T27008] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1287.620663][T26782] Bluetooth: hci0: command tx timeout [ 1288.097057][ T7854] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9638'. [ 1288.569896][ T7879] FAULT_INJECTION: forcing a failure. [ 1288.569896][ T7879] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1288.585840][ T7879] CPU: 1 UID: 0 PID: 7879 Comm: syz.2.9644 Not tainted syzkaller #0 PREEMPT(full) [ 1288.585872][ T7879] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1288.585885][ T7879] Call Trace: [ 1288.585893][ T7879] [ 1288.585902][ T7879] dump_stack_lvl+0xe8/0x150 [ 1288.585934][ T7879] should_fail_ex+0x412/0x560 [ 1288.585965][ T7879] _copy_from_user+0x2d/0xb0 [ 1288.585995][ T7879] __sys_bpf+0x229/0x950 [ 1288.586034][ T7879] ? __pfx___sys_bpf+0x10/0x10 [ 1288.586081][ T7879] ? ksys_write+0x242/0x270 [ 1288.586112][ T7879] ? __pfx_ksys_write+0x10/0x10 [ 1288.586146][ T7879] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1288.586170][ T7879] __x64_sys_bpf+0x7c/0x90 [ 1288.586198][ T7879] do_syscall_64+0x15f/0xf80 [ 1288.586220][ T7879] ? trace_irq_disable+0x3b/0x140 [ 1288.586251][ T7879] ? clear_bhb_loop+0x40/0x90 [ 1288.586277][ T7879] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1288.586297][ T7879] RIP: 0033:0x7ff8ed59cdd9 [ 1288.586318][ T7879] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1288.586337][ T7879] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1288.586361][ T7879] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1288.586377][ T7879] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1288.586391][ T7879] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1288.586404][ T7879] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1288.586418][ T7879] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1288.586452][ T7879] [ 1288.873465][ T7884] netlink: 'syz.2.9646': attribute type 1 has an invalid length. [ 1289.016436][ T7887] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9646'. [ 1289.228450][ T7640] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1289.411667][ T7884] bond4: entered promiscuous mode [ 1289.417490][ T7884] bond4: entered allmulticast mode [ 1289.425194][ T7884] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1289.695742][T26782] Bluetooth: hci0: command tx timeout [ 1289.876610][ T7640] veth0_vlan: entered promiscuous mode [ 1290.011662][ T7903] xfrm0: left promiscuous mode [ 1290.047047][ T7903] veth1_vlan: entered allmulticast mode [ 1290.099345][ T7903] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1290.108904][ T7912] netlink: 'syz.2.9653': attribute type 4 has an invalid length. [ 1290.143520][ T7914] FAULT_INJECTION: forcing a failure. [ 1290.143520][ T7914] name failslab, interval 1, probability 0, space 0, times 0 [ 1290.146064][ T7640] veth1_vlan: entered promiscuous mode [ 1290.162962][ T7914] CPU: 1 UID: 0 PID: 7914 Comm: syz.0.9655 Not tainted syzkaller #0 PREEMPT(full) [ 1290.162990][ T7914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1290.163002][ T7914] Call Trace: [ 1290.163011][ T7914] [ 1290.163019][ T7914] dump_stack_lvl+0xe8/0x150 [ 1290.163050][ T7914] should_fail_ex+0x412/0x560 [ 1290.163081][ T7914] should_failslab+0xa8/0x100 [ 1290.163114][ T7914] __kmalloc_noprof+0xe8/0x760 [ 1290.163144][ T7914] ? bpf_test_init+0x9f/0x150 [ 1290.163173][ T7914] bpf_test_init+0x9f/0x150 [ 1290.163201][ T7914] bpf_prog_test_run_xdp+0x529/0x1160 [ 1290.163241][ T7914] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1290.163272][ T7914] ? __fget_files+0x2a/0x420 [ 1290.163303][ T7914] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1290.163328][ T7914] bpf_prog_test_run+0x2c7/0x340 [ 1290.163354][ T7914] __sys_bpf+0x643/0x950 [ 1290.163388][ T7914] ? __pfx___sys_bpf+0x10/0x10 [ 1290.163436][ T7914] ? ksys_write+0x242/0x270 [ 1290.163469][ T7914] ? __pfx_ksys_write+0x10/0x10 [ 1290.163503][ T7914] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1290.163527][ T7914] __x64_sys_bpf+0x7c/0x90 [ 1290.163555][ T7914] do_syscall_64+0x15f/0xf80 [ 1290.163576][ T7914] ? trace_irq_disable+0x3b/0x140 [ 1290.163604][ T7914] ? clear_bhb_loop+0x40/0x90 [ 1290.163629][ T7914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1290.163658][ T7914] RIP: 0033:0x7feb0e19cdd9 [ 1290.163683][ T7914] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1290.163700][ T7914] RSP: 002b:00007feb0f0e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1290.163722][ T7914] RAX: ffffffffffffffda RBX: 00007feb0e415fa0 RCX: 00007feb0e19cdd9 [ 1290.163736][ T7914] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1290.163749][ T7914] RBP: 00007feb0f0e0090 R08: 0000000000000000 R09: 0000000000000000 [ 1290.163762][ T7914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1290.163773][ T7914] R13: 00007feb0e416038 R14: 00007feb0e415fa0 R15: 00007ffce6842cb8 [ 1290.163806][ T7914] [ 1290.383957][ T7640] veth0_macvtap: entered promiscuous mode [ 1290.400119][ T7640] veth1_macvtap: entered promiscuous mode [ 1290.432906][ T7640] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1290.479809][ T7640] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1290.535682][T27011] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1290.546263][ T7920] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9658'. [ 1290.562322][T27011] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1290.580717][ T7921] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9657'. [ 1291.416222][T26994] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1291.423940][ T7943] netlink: 'syz.0.9664': attribute type 1 has an invalid length. [ 1291.440609][T26994] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1291.552156][ T7950] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9664'. [ 1291.572539][ T7943] bond1: entered promiscuous mode [ 1291.581295][ T7943] bond1: entered allmulticast mode [ 1291.600665][ T7943] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1291.631210][T26994] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1291.758505][ T7946] erspan1: entered allmulticast mode [ 1291.816269][ T7946] bond1: (slave erspan1): making interface the new active one [ 1291.834367][ T7946] erspan1: entered promiscuous mode [ 1291.890061][ T7946] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 1291.984332][T26994] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1292.034093][ T7964] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9668'. [ 1292.058336][T26994] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1292.070300][T26994] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1292.075927][ T7963] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9668'. [ 1292.123906][ T7951] lo speed is unknown, defaulting to 1000 [ 1292.260831][ T7970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9670'. [ 1292.599775][ T29] audit: type=1107 audit(1777290680.863:17): pid=7969 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 1292.607917][ T7970] netlink: 'syz.0.9670': attribute type 3 has an invalid length. [ 1293.005017][T27011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1293.016740][T27011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1293.519402][T27008] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1293.571928][T27008] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1293.621145][ T7992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9677'. [ 1294.032202][ T8010] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9682'. [ 1294.061330][ T8015] xt_hashlimit: size too large, truncated to 1048576 [ 1294.426391][ T8010] team0: Port device team_slave_0 removed [ 1294.507085][ T8028] FAULT_INJECTION: forcing a failure. [ 1294.507085][ T8028] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1294.521013][ T8028] CPU: 1 UID: 0 PID: 8028 Comm: syz.2.9687 Not tainted syzkaller #0 PREEMPT(full) [ 1294.521043][ T8028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1294.521055][ T8028] Call Trace: [ 1294.521064][ T8028] [ 1294.521073][ T8028] dump_stack_lvl+0xe8/0x150 [ 1294.521104][ T8028] should_fail_ex+0x412/0x560 [ 1294.521137][ T8028] _copy_from_user+0x2d/0xb0 [ 1294.521168][ T8028] bpf_prog_test_run_xdp+0xde3/0x1160 [ 1294.521212][ T8028] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1294.521243][ T8028] ? __fget_files+0x2a/0x420 [ 1294.521275][ T8028] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1294.521302][ T8028] bpf_prog_test_run+0x2c7/0x340 [ 1294.521328][ T8028] __sys_bpf+0x643/0x950 [ 1294.521361][ T8028] ? __pfx___sys_bpf+0x10/0x10 [ 1294.521409][ T8028] ? ksys_write+0x242/0x270 [ 1294.521440][ T8028] ? __pfx_ksys_write+0x10/0x10 [ 1294.521474][ T8028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1294.521498][ T8028] __x64_sys_bpf+0x7c/0x90 [ 1294.521527][ T8028] do_syscall_64+0x15f/0xf80 [ 1294.521553][ T8028] ? clear_bhb_loop+0x40/0x90 [ 1294.521578][ T8028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1294.521599][ T8028] RIP: 0033:0x7ff8ed59cdd9 [ 1294.521620][ T8028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1294.521639][ T8028] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1294.521663][ T8028] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1294.521679][ T8028] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1294.521693][ T8028] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1294.521706][ T8028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1294.521719][ T8028] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1294.521754][ T8028] [ 1294.844283][ T8032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9688'. [ 1295.008806][ T8033] xt_l2tp: invalid flags combination: 0 [ 1295.067200][ T8033] netlink: 44 bytes leftover after parsing attributes in process `syz.4.9689'. [ 1295.097858][ T8018] lo speed is unknown, defaulting to 1000 [ 1295.758139][ T8063] FAULT_INJECTION: forcing a failure. [ 1295.758139][ T8063] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1295.796766][ T8063] CPU: 1 UID: 0 PID: 8063 Comm: syz.2.9698 Not tainted syzkaller #0 PREEMPT(full) [ 1295.796806][ T8063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1295.796820][ T8063] Call Trace: [ 1295.796829][ T8063] [ 1295.796838][ T8063] dump_stack_lvl+0xe8/0x150 [ 1295.796869][ T8063] should_fail_ex+0x412/0x560 [ 1295.796901][ T8063] prepare_alloc_pages+0x22a/0x650 [ 1295.796937][ T8063] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1295.796973][ T8063] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1295.797008][ T8063] ? __pfx_policy_nodemask+0x10/0x10 [ 1295.797037][ T8063] ? __might_fault+0xaf/0x130 [ 1295.797073][ T8063] alloc_pages_mpol+0x235/0x490 [ 1295.797110][ T8063] alloc_pages_noprof+0xac/0x2a0 [ 1295.797144][ T8063] bpf_prog_test_run_xdp+0xc69/0x1160 [ 1295.797191][ T8063] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1295.797223][ T8063] ? __fget_files+0x2a/0x420 [ 1295.797253][ T8063] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1295.797280][ T8063] bpf_prog_test_run+0x2c7/0x340 [ 1295.797305][ T8063] __sys_bpf+0x643/0x950 [ 1295.797339][ T8063] ? __pfx___sys_bpf+0x10/0x10 [ 1295.797386][ T8063] ? ksys_write+0x242/0x270 [ 1295.797416][ T8063] ? __pfx_ksys_write+0x10/0x10 [ 1295.797480][ T8063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1295.797505][ T8063] __x64_sys_bpf+0x7c/0x90 [ 1295.797534][ T8063] do_syscall_64+0x15f/0xf80 [ 1295.797560][ T8063] ? clear_bhb_loop+0x40/0x90 [ 1295.797597][ T8063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1295.797618][ T8063] RIP: 0033:0x7ff8ed59cdd9 [ 1295.797639][ T8063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1295.797659][ T8063] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1295.797683][ T8063] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1295.797699][ T8063] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1295.797713][ T8063] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1295.797726][ T8063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1295.797739][ T8063] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1295.797771][ T8063] [ 1296.205051][ T8069] __nla_validate_parse: 1 callbacks suppressed [ 1296.212580][ T8069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9700'. [ 1296.237190][ T8069] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9700'. [ 1296.283591][ T8069] ip6gre1: entered promiscuous mode [ 1296.288970][ T8069] ip6gre1: entered allmulticast mode [ 1296.495234][ T8072] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9701'. [ 1296.831062][ T8077] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9704'. [ 1297.057506][ T8077] team0: Port device team_slave_0 removed [ 1297.170880][ T8087] netlink: 'syz.3.9706': attribute type 1 has an invalid length. [ 1297.204977][ T8094] xt_hashlimit: size too large, truncated to 1048576 [ 1297.326284][ T8092] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9706'. [ 1297.721766][ T8103] ip6gretap1: entered promiscuous mode [ 1297.744562][ T8111] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1297.751092][ T8111] syzkaller1: Refused to change device type [ 1297.760201][ T8096] lo speed is unknown, defaulting to 1000 [ 1297.816627][ T8112] syzkaller0: entered promiscuous mode [ 1303.828631][ T8151] netlink: 'syz.3.9724': attribute type 1 has an invalid length. [ 1304.009192][ T9323] IPVS: starting estimator thread 0... [ 1304.052486][ T8147] netlink: 'syz.4.9721': attribute type 2 has an invalid length. [ 1304.072433][ T8147] netlink: 'syz.4.9721': attribute type 2 has an invalid length. [ 1304.101856][ T8157] IPVS: using max 26 ests per chain, 62400 per kthread [ 1304.408987][ T8167] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9728'. [ 1304.462060][ T8167] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9728'. [ 1304.540202][ T8170] vlan0: entered allmulticast mode [ 1304.568192][ T8170] bond0: entered allmulticast mode [ 1304.809773][ T8178] syzkaller0: entered promiscuous mode [ 1304.837626][ T8179] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9732'. [ 1304.999712][ T8179] bond1: option primary_reselect: invalid value (133) [ 1305.120520][ T8179] bond1 (unregistering): Released all slaves [ 1305.313115][ T8192] netlink: 'syz.3.9736': attribute type 1 has an invalid length. [ 1305.347434][ T8192] netlink: 352 bytes leftover after parsing attributes in process `syz.3.9736'. [ 1305.410037][ T8192] netlink: 'syz.3.9736': attribute type 1 has an invalid length. [ 1305.423217][ T991] IPVS: starting estimator thread 0... [ 1305.435980][ T8192] netlink: 352 bytes leftover after parsing attributes in process `syz.3.9736'. [ 1305.516507][ T8200] IPVS: using max 26 ests per chain, 62400 per kthread [ 1305.730806][ T8216] xt_hashlimit: size too large, truncated to 1048576 [ 1305.889235][ T8229] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1305.951103][ T8226] syzkaller0: entered promiscuous mode [ 1305.997899][ T8220] lo speed is unknown, defaulting to 1000 [ 1306.127230][ T8235] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9749'. [ 1306.378846][ T8245] netlink: 'syz.0.9753': attribute type 1 has an invalid length. [ 1306.465074][ T8245] bond2: entered promiscuous mode [ 1306.472316][ T8245] bond2: entered allmulticast mode [ 1306.479224][ T8245] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1306.534837][ T8245] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9753'. [ 1307.157361][ T8272] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.9762'. [ 1307.258941][ T8276] syzkaller0: entered promiscuous mode [ 1307.536176][ T8284] xt_hashlimit: size too large, truncated to 1048576 [ 1307.752400][ T8295] FAULT_INJECTION: forcing a failure. [ 1307.752400][ T8295] name failslab, interval 1, probability 0, space 0, times 0 [ 1307.765189][ T8295] CPU: 0 UID: 0 PID: 8295 Comm: syz.0.9769 Not tainted syzkaller #0 PREEMPT(full) [ 1307.765219][ T8295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1307.765233][ T8295] Call Trace: [ 1307.765242][ T8295] [ 1307.765252][ T8295] dump_stack_lvl+0xe8/0x150 [ 1307.765284][ T8295] should_fail_ex+0x412/0x560 [ 1307.765317][ T8295] should_failslab+0xa8/0x100 [ 1307.765348][ T8295] ? skb_clone+0x212/0x3a0 [ 1307.765380][ T8295] kmem_cache_alloc_noprof+0x87/0x650 [ 1307.765409][ T8295] ? __bpf_redirect+0x9b4/0x12a0 [ 1307.765435][ T8295] skb_clone+0x212/0x3a0 [ 1307.765474][ T8295] bpf_clone_redirect+0x16a/0x4b0 [ 1307.765496][ T8295] ? bpf_test_run+0x1d1/0x830 [ 1307.765526][ T8295] ? bpf_test_run+0x1d1/0x830 [ 1307.765550][ T8295] bpf_prog_4653d16e8163849f+0x22/0x2a [ 1307.765573][ T8295] bpf_test_run+0x354/0x830 [ 1307.765618][ T8295] ? __pfx_bpf_test_run+0x10/0x10 [ 1307.765654][ T8295] ? csum_partial+0x239/0x2c0 [ 1307.765687][ T8295] ? skb_checksum+0x7c0/0x8c0 [ 1307.765721][ T8295] ? skb_dst_set+0x72/0x140 [ 1307.765749][ T8295] bpf_prog_test_run_skb+0xe2c/0x2260 [ 1307.765795][ T8295] ? __fget_files+0x3a0/0x420 [ 1307.765819][ T8295] ? __fget_files+0x2a/0x420 [ 1307.765846][ T8295] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1307.765871][ T8295] bpf_prog_test_run+0x2c7/0x340 [ 1307.765897][ T8295] __sys_bpf+0x643/0x950 [ 1307.765928][ T8295] ? __pfx___sys_bpf+0x10/0x10 [ 1307.765970][ T8295] ? ksys_write+0x242/0x270 [ 1307.765999][ T8295] ? __pfx_ksys_write+0x10/0x10 [ 1307.766029][ T8295] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1307.766054][ T8295] __x64_sys_bpf+0x7c/0x90 [ 1307.766084][ T8295] do_syscall_64+0x15f/0xf80 [ 1307.766107][ T8295] ? trace_irq_disable+0x3b/0x140 [ 1307.766138][ T8295] ? clear_bhb_loop+0x40/0x90 [ 1307.766164][ T8295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1307.766185][ T8295] RIP: 0033:0x7feb0e19cdd9 [ 1307.766206][ T8295] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1307.766225][ T8295] RSP: 002b:00007feb0f0e0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1307.766249][ T8295] RAX: ffffffffffffffda RBX: 00007feb0e415fa0 RCX: 00007feb0e19cdd9 [ 1307.766265][ T8295] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1307.766280][ T8295] RBP: 00007feb0f0e0090 R08: 0000000000000000 R09: 0000000000000000 [ 1307.766292][ T8295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1307.766304][ T8295] R13: 00007feb0e416038 R14: 00007feb0e415fa0 R15: 00007ffce6842cb8 [ 1307.766335][ T8295] [ 1308.033474][ T8290] lo speed is unknown, defaulting to 1000 [ 1308.287577][ T8298] IPVS: persistence engine module ip_vs_pe_… not found [ 1308.554059][ T8314] netlink: 'syz.1.9774': attribute type 12 has an invalid length. [ 1308.570720][ T8314] netlink: 'syz.1.9774': attribute type 29 has an invalid length. [ 1308.588740][ T8314] netlink: 148 bytes leftover after parsing attributes in process `syz.1.9774'. [ 1309.153875][ T8331] syzkaller0: entered promiscuous mode [ 1309.655348][ T8340] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9782'. [ 1309.938669][ T8347] netlink: 'syz.2.9785': attribute type 1 has an invalid length. [ 1310.036261][ T8347] bond5: entered promiscuous mode [ 1310.053987][ T8347] bond5: entered allmulticast mode [ 1310.084997][ T8353] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9785'. [ 1310.119913][ T8347] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1310.467596][ T8359] xt_hashlimit: size too large, truncated to 1048576 [ 1310.672156][ T8360] lo speed is unknown, defaulting to 1000 [ 1310.889671][ T991] IPVS: starting estimator thread 0... [ 1310.896253][ T8374] openvswitch: netlink: Unexpected mask (mask=200240, allowed=10048) [ 1310.995588][ T8375] IPVS: using max 24 ests per chain, 57600 per kthread [ 1311.855322][ T8401] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9800'. [ 1312.107616][ T8424] netlink: 'syz.4.9810': attribute type 6 has an invalid length. [ 1312.144990][ T8415] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9806'. [ 1312.272665][ T8415] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9806'. [ 1312.343933][ T8434] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.9812'. [ 1312.360329][ T8430] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9811'. [ 1312.794159][ T8455] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9822'. [ 1312.893556][ T991] IPVS: starting estimator thread 0... [ 1312.955634][ T8455] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9822'. [ 1313.025982][ T8462] IPVS: using max 26 ests per chain, 62400 per kthread [ 1313.057668][ T8468] hmac(sha224): entered promiscuous mode [ 1313.138028][ T8475] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9829'. [ 1313.416790][ T8489] syzkaller1: entered promiscuous mode [ 1313.430077][ T8489] syzkaller1: entered allmulticast mode [ 1313.546830][ T8494] nbd: nbd64 already in use [ 1313.807712][ T8172] udevd[8172]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1314.523945][ T8520] geneve2: entered promiscuous mode [ 1314.544051][T27004] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 1314.563680][T27004] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 1314.602644][T27004] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 1314.642484][T27004] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 1314.784733][ T8531] geneve3: entered promiscuous mode [ 1314.799028][ T8531] geneve3: entered allmulticast mode [ 1314.917154][ T8536] __nla_validate_parse: 4 callbacks suppressed [ 1314.917179][ T8536] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9850'. [ 1314.964790][ T8538] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9852'. [ 1315.018721][ T8536] vlan2: entered allmulticast mode [ 1315.027462][ T8536] bridge2: entered allmulticast mode [ 1315.171446][ T8541] bridge2: port 1(bond3) entered blocking state [ 1315.193944][ T8547] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9851'. [ 1315.203178][ T8547] netlink: 62 bytes leftover after parsing attributes in process `syz.1.9851'. [ 1315.203233][ T8541] bridge2: port 1(bond3) entered disabled state [ 1315.212485][ T8547] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9851'. [ 1315.243391][ T8541] bond3: entered allmulticast mode [ 1315.257537][ T8541] bond3: entered promiscuous mode [ 1315.328284][ T8551] netlink: 'syz.1.9856': attribute type 1 has an invalid length. [ 1315.348385][ T8551] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9856'. [ 1315.513162][ T8561] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9859'. [ 1315.893264][ T8572] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.9862'. [ 1316.792197][ T8587] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9867'. [ 1316.844931][ T8588] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9868'. [ 1317.381507][ T8607] pim6reg: entered allmulticast mode [ 1317.502033][ T8613] veth0: entered promiscuous mode [ 1317.818810][ T8622] xfrm1: entered allmulticast mode [ 1318.050618][ T8606] veth0: left promiscuous mode [ 1318.084120][ T8628] Unsupported Adiantum instantiation: (ecb(camellia),des) [ 1319.298299][ T8662] veth0_macvtap: mtu less than device minimum [ 1319.661255][ T8676] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1319.675783][ T8676] syzkaller1: linktype set to 260 [ 1319.919768][ T8696] FAULT_INJECTION: forcing a failure. [ 1319.919768][ T8696] name failslab, interval 1, probability 0, space 0, times 0 [ 1319.932684][ T8696] CPU: 1 UID: 0 PID: 8696 Comm: syz.2.9901 Not tainted syzkaller #0 PREEMPT(full) [ 1319.932723][ T8696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1319.932735][ T8696] Call Trace: [ 1319.932746][ T8696] [ 1319.932755][ T8696] dump_stack_lvl+0xe8/0x150 [ 1319.932783][ T8696] should_fail_ex+0x412/0x560 [ 1319.932813][ T8696] should_failslab+0xa8/0x100 [ 1319.932843][ T8696] ? skb_clone+0x212/0x3a0 [ 1319.932868][ T8696] kmem_cache_alloc_noprof+0x87/0x650 [ 1319.932896][ T8696] ? __bpf_redirect+0x9b4/0x12a0 [ 1319.932921][ T8696] skb_clone+0x212/0x3a0 [ 1319.932950][ T8696] bpf_clone_redirect+0x16a/0x4b0 [ 1319.932970][ T8696] ? bpf_test_run+0x1d1/0x830 [ 1319.932999][ T8696] ? bpf_test_run+0x1d1/0x830 [ 1319.933021][ T8696] bpf_prog_4653d16e8163849f+0x22/0x2a [ 1319.933040][ T8696] bpf_test_run+0x354/0x830 [ 1319.933085][ T8696] ? __pfx_bpf_test_run+0x10/0x10 [ 1319.933118][ T8696] ? csum_partial+0x239/0x2c0 [ 1319.933152][ T8696] ? skb_checksum+0x7c0/0x8c0 [ 1319.933185][ T8696] ? skb_dst_set+0x72/0x140 [ 1319.933212][ T8696] bpf_prog_test_run_skb+0xe2c/0x2260 [ 1319.933255][ T8696] ? __fget_files+0x3a0/0x420 [ 1319.933288][ T8696] ? __fget_files+0x2a/0x420 [ 1319.933317][ T8696] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1319.933430][ T8696] bpf_prog_test_run+0x2c7/0x340 [ 1319.933464][ T8696] __sys_bpf+0x643/0x950 [ 1319.933496][ T8696] ? __pfx___sys_bpf+0x10/0x10 [ 1319.933549][ T8696] ? ksys_write+0x242/0x270 [ 1319.933583][ T8696] ? __pfx_ksys_write+0x10/0x10 [ 1319.933618][ T8696] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1319.933642][ T8696] __x64_sys_bpf+0x7c/0x90 [ 1319.933672][ T8696] do_syscall_64+0x15f/0xf80 [ 1319.933698][ T8696] ? clear_bhb_loop+0x40/0x90 [ 1319.933725][ T8696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1319.933746][ T8696] RIP: 0033:0x7ff8ed59cdd9 [ 1319.933769][ T8696] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1319.933788][ T8696] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1319.933814][ T8696] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1319.933829][ T8696] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1319.933844][ T8696] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1319.933857][ T8696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1319.933871][ T8696] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1319.933906][ T8696] [ 1320.269418][ T8693] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 1320.452745][ T8699] lo speed is unknown, defaulting to 1000 [ 1320.471444][ T8705] __nla_validate_parse: 4 callbacks suppressed [ 1320.471468][ T8705] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.9903'. [ 1320.891259][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1321.579800][ T8749] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.9918'. [ 1321.923034][ T8761] syzkaller0: entered promiscuous mode [ 1321.943488][ T8761] syzkaller0: entered allmulticast mode [ 1321.980375][ T8761] 0: reclassify loop, rule prio 0, protocol 800 [ 1322.064670][ T8770] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9926'. [ 1322.090798][ T8770] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9926'. [ 1322.303508][ T8776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9926'. [ 1322.363586][ T8779] netlink: 'syz.0.9928': attribute type 1 has an invalid length. [ 1322.428732][ T8779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1322.670540][ T8793] syzkaller0: entered promiscuous mode [ 1322.687362][ T8792] netlink: 'syz.2.9931': attribute type 4 has an invalid length. [ 1322.697484][ T8795] netlink: 'syz.1.9933': attribute type 1 has an invalid length. [ 1322.760908][ T8799] netlink: 'syz.2.9931': attribute type 4 has an invalid length. [ 1322.816930][ T8800] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9933'. [ 1322.970385][ T8795] bond1: entered promiscuous mode [ 1322.976276][ T8795] bond1: entered allmulticast mode [ 1322.993965][ T8795] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1323.012575][ T8798] erspan1: entered allmulticast mode [ 1323.036886][ T8798] bond1: (slave erspan1): making interface the new active one [ 1323.070863][ T8798] erspan1: entered promiscuous mode [ 1323.099909][ T8811] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.9936'. [ 1323.130028][ T8798] bond1: (slave erspan1): Enslaving as an active interface with an up link [ 1323.510201][ T8821] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9941'. [ 1323.516046][ T8826] netlink: 'syz.2.9940': attribute type 1 has an invalid length. [ 1323.544984][ T8826] gretap1: entered allmulticast mode [ 1323.593875][ T8831] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9944'. [ 1324.105182][ T8852] IPv6: addrconf: prefix option has invalid lifetime [ 1324.512166][ T8835] bridge0: port 2(bridge_slave_1) entered disabled state [ 1324.519943][ T8835] bridge0: port 1(bridge_slave_0) entered disabled state [ 1324.777031][ T8869] xt_bpf: check failed: parse error [ 1325.039074][ T8835] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1325.085876][ T8835] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1325.593416][ T8856] syzkaller1: entered promiscuous mode [ 1325.605986][ T8856] syzkaller1: entered allmulticast mode [ 1325.633252][T27004] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1325.655163][T27004] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1325.693006][T27004] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1325.727998][T27004] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1325.772386][ T8880] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9958'. [ 1325.807254][T27004] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1325.821106][ T8885] netlink: 'syz.4.9959': attribute type 5 has an invalid length. [ 1325.826570][T27004] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1325.852426][ T8885] xt_TCPMSS: Only works on TCP SYN packets [ 1325.865068][T27004] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1325.886016][T27004] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1326.302804][ T8907] netlink: 252 bytes leftover after parsing attributes in process `syz.1.9969'. [ 1326.884574][ T8902] ip6gre2: entered promiscuous mode [ 1326.893109][ T8902] ip6gre2: entered allmulticast mode [ 1327.001083][ T8913] lo speed is unknown, defaulting to 1000 [ 1327.214851][ T8933] netlink: 'syz.3.9974': attribute type 1 has an invalid length. [ 1327.365013][ T8942] netlink: zone id is out of range [ 1327.407338][ T8942] netlink: zone id is out of range [ 1327.445291][ T8945] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9974'. [ 1327.461467][ T8942] netlink: zone id is out of range [ 1327.495495][ T8942] netlink: zone id is out of range [ 1327.525781][ T8942] netlink: zone id is out of range [ 1327.531957][ T8942] netlink: zone id is out of range [ 1327.567802][ T8949] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9979'. [ 1327.577385][ T8949] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9979'. [ 1327.587761][ T8949] netlink: 58 bytes leftover after parsing attributes in process `syz.4.9979'. [ 1327.767600][ T8949] team0 (unregistering): Port device team_slave_1 removed [ 1328.031441][ T8963] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9983'. [ 1328.149796][ T8966] FAULT_INJECTION: forcing a failure. [ 1328.149796][ T8966] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1328.151324][ T8965] sctp: [Deprecated]: syz.4.9983 (pid 8965) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1328.151324][ T8965] Use struct sctp_sack_info instead [ 1328.183530][ T8966] CPU: 0 UID: 0 PID: 8966 Comm: syz.3.9984 Not tainted syzkaller #0 PREEMPT(full) [ 1328.183561][ T8966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1328.183574][ T8966] Call Trace: [ 1328.183585][ T8966] [ 1328.183594][ T8966] dump_stack_lvl+0xe8/0x150 [ 1328.183627][ T8966] should_fail_ex+0x412/0x560 [ 1328.183659][ T8966] _copy_from_user+0x2d/0xb0 [ 1328.183690][ T8966] bpf_test_init+0xd8/0x150 [ 1328.183721][ T8966] bpf_prog_test_run_skb+0x392/0x2260 [ 1328.183745][ T8966] ? bpf_prog_test_run_skb+0x181/0x2260 [ 1328.183791][ T8966] ? __fget_files+0x3a0/0x420 [ 1328.183816][ T8966] ? __fget_files+0x2a/0x420 [ 1328.183847][ T8966] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1328.183872][ T8966] bpf_prog_test_run+0x2c7/0x340 [ 1328.183900][ T8966] __sys_bpf+0x643/0x950 [ 1328.183933][ T8966] ? __pfx___sys_bpf+0x10/0x10 [ 1328.183982][ T8966] ? ksys_write+0x242/0x270 [ 1328.184013][ T8966] ? __pfx_ksys_write+0x10/0x10 [ 1328.184047][ T8966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1328.184071][ T8966] __x64_sys_bpf+0x7c/0x90 [ 1328.184101][ T8966] do_syscall_64+0x15f/0xf80 [ 1328.184124][ T8966] ? trace_irq_disable+0x3b/0x140 [ 1328.184155][ T8966] ? clear_bhb_loop+0x40/0x90 [ 1328.184180][ T8966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1328.184201][ T8966] RIP: 0033:0x7fc81439cdd9 [ 1328.184222][ T8966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1328.184239][ T8966] RSP: 002b:00007fc81524d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1328.184263][ T8966] RAX: ffffffffffffffda RBX: 00007fc814615fa0 RCX: 00007fc81439cdd9 [ 1328.184279][ T8966] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1328.184293][ T8966] RBP: 00007fc81524d090 R08: 0000000000000000 R09: 0000000000000000 [ 1328.184306][ T8966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1328.184319][ T8966] R13: 00007fc814616038 R14: 00007fc814615fa0 R15: 00007ffdfd89b518 [ 1328.184355][ T8966] [ 1328.778315][ T8984] netlink: 'syz.2.9992': attribute type 1 has an invalid length. [ 1328.843878][ T8989] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9992'. [ 1328.860613][ T8990] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9991'. [ 1329.083932][ T9007] FAULT_INJECTION: forcing a failure. [ 1329.083932][ T9007] name failslab, interval 1, probability 0, space 0, times 0 [ 1329.133369][ T9007] CPU: 1 UID: 0 PID: 9007 Comm: syz.1.9997 Not tainted syzkaller #0 PREEMPT(full) [ 1329.133401][ T9007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1329.133423][ T9007] Call Trace: [ 1329.133432][ T9007] [ 1329.133443][ T9007] dump_stack_lvl+0xe8/0x150 [ 1329.133475][ T9007] should_fail_ex+0x412/0x560 [ 1329.133505][ T9007] should_failslab+0xa8/0x100 [ 1329.133538][ T9007] __kmalloc_noprof+0xe8/0x760 [ 1329.133567][ T9007] ? sk_prot_alloc+0xe7/0x210 [ 1329.133599][ T9007] sk_prot_alloc+0xe7/0x210 [ 1329.133621][ T9007] ? sk_alloc+0x27/0x390 [ 1329.133647][ T9007] sk_alloc+0x3a/0x390 [ 1329.133674][ T9007] bpf_prog_test_run_skb+0x415/0x2260 [ 1329.133697][ T9007] ? bpf_prog_test_run_skb+0x181/0x2260 [ 1329.133740][ T9007] ? __fget_files+0x3a0/0x420 [ 1329.133762][ T9007] ? __fget_files+0x2a/0x420 [ 1329.133790][ T9007] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1329.133815][ T9007] bpf_prog_test_run+0x2c7/0x340 [ 1329.133839][ T9007] __sys_bpf+0x643/0x950 [ 1329.133871][ T9007] ? __pfx___sys_bpf+0x10/0x10 [ 1329.133914][ T9007] ? ksys_write+0x242/0x270 [ 1329.133945][ T9007] ? __pfx_ksys_write+0x10/0x10 [ 1329.133979][ T9007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1329.134002][ T9007] __x64_sys_bpf+0x7c/0x90 [ 1329.134031][ T9007] do_syscall_64+0x15f/0xf80 [ 1329.134057][ T9007] ? clear_bhb_loop+0x40/0x90 [ 1329.134083][ T9007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1329.134103][ T9007] RIP: 0033:0x7f9e5859cdd9 [ 1329.134124][ T9007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1329.134142][ T9007] RSP: 002b:00007f9e59443028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1329.134164][ T9007] RAX: ffffffffffffffda RBX: 00007f9e58815fa0 RCX: 00007f9e5859cdd9 [ 1329.134179][ T9007] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1329.134192][ T9007] RBP: 00007f9e59443090 R08: 0000000000000000 R09: 0000000000000000 [ 1329.134206][ T9007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1329.134218][ T9007] R13: 00007f9e58816038 R14: 00007f9e58815fa0 R15: 00007ffe598040c8 [ 1329.134249][ T9007] [ 1329.560051][ T9029] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10003'. [ 1329.751984][ T9035] netlink: 'syz.4.10008': attribute type 1 has an invalid length. [ 1329.915505][ T9040] netlink: 'syz.1.10009': attribute type 3 has an invalid length. [ 1329.933666][ T9040] netlink: 'syz.1.10009': attribute type 3 has an invalid length. [ 1330.812470][ T9063] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input8 [ 1330.914041][ T9063] __nla_validate_parse: 6 callbacks suppressed [ 1330.914065][ T9063] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10015'. [ 1331.116059][ T9063] netlink: 92 bytes leftover after parsing attributes in process `syz.3.10015'. [ 1331.314803][ T9073] netlink: 'syz.2.10018': attribute type 1 has an invalid length. [ 1331.353298][ T9076] netlink: 'syz.4.10020': attribute type 1 has an invalid length. [ 1331.437042][ T9081] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10020'. [ 1331.644770][ T9091] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10024'. [ 1331.801694][ T9097] netlink: 64 bytes leftover after parsing attributes in process `syz.4.10027'. [ 1331.812809][ T9094] tipc: Started in network mode [ 1331.827155][ T9094] tipc: Node identity 3a5e95396fed, cluster identity 4711 [ 1331.844116][ T9094] tipc: Enabled bearer , priority 0 [ 1332.051324][ T9094] syzkaller0: entered promiscuous mode [ 1332.059983][ T9094] syzkaller0: entered allmulticast mode [ 1332.066899][ T9094] tipc: Resetting bearer [ 1332.451945][ T9112] RDS: rds_bind could not find a transport for 2001::1, load rds_tcp or rds_rdma? [ 1332.884070][ T9092] tipc: Resetting bearer [ 1333.049652][ T9118] netlink: 32 bytes leftover after parsing attributes in process `syz.1.10033'. [ 1333.564378][ T9131] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10037'. [ 1337.954897][ T9092] tipc: Disabling bearer [ 1337.964691][ T9116] bridge_slave_1: left promiscuous mode [ 1337.974301][ T9116] bridge0: port 2(bridge_slave_1) entered disabled state [ 1337.993046][ T9116] bridge_slave_0: left allmulticast mode [ 1338.000077][ T9116] bridge_slave_0: left promiscuous mode [ 1338.006769][ T9116] bridge0: port 1(bridge_slave_0) entered disabled state [ 1338.088432][ T9323] tipc: Node number set to 1437832505 [ 1338.130451][ T9114] lo speed is unknown, defaulting to 1000 [ 1338.184994][ T9138] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10038'. [ 1338.313747][ T9145] xt_bpf: check failed: parse error [ 1338.540212][ T9156] xt_hashlimit: size too large, truncated to 1048576 [ 1338.715198][ T9162] netlink: 324 bytes leftover after parsing attributes in process `syz.2.10044'. [ 1339.168494][ T9174] xt_hashlimit: size too large, truncated to 1048576 [ 1339.189132][ T9175] netlink: 'syz.3.10048': attribute type 30 has an invalid length. [ 1339.592223][ T9176] lo speed is unknown, defaulting to 1000 [ 1339.861846][ T9196] bond2: option lacp_rate: invalid value (128) [ 1339.871202][ T9196] bond2 (unregistering): Released all slaves [ 1340.110391][ T9206] netlink: 324 bytes leftover after parsing attributes in process `syz.1.10056'. [ 1340.274098][ T9210] syzkaller0: entered promiscuous mode [ 1340.373918][ T9216] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.10060'. [ 1340.549142][ T9222] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10062'. [ 1341.308421][ T9242] netlink: 204 bytes leftover after parsing attributes in process `syz.2.10073'. [ 1341.319744][ T9242] netlink: 84 bytes leftover after parsing attributes in process `syz.2.10073'. [ 1341.438195][ T9246] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10074'. [ 1341.724536][ T9258] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.10078'. [ 1342.299779][ T9280] xt_hashlimit: size too large, truncated to 1048576 [ 1342.467143][ T9283] lo speed is unknown, defaulting to 1000 [ 1345.085308][ T9344] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10107'. [ 1345.269025][ T9346] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1345.330113][ T9348] FAULT_INJECTION: forcing a failure. [ 1345.330113][ T9348] name failslab, interval 1, probability 0, space 0, times 0 [ 1345.344328][ T9348] CPU: 1 UID: 0 PID: 9348 Comm: syz.3.10109 Not tainted syzkaller #0 PREEMPT(full) [ 1345.344358][ T9348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1345.344371][ T9348] Call Trace: [ 1345.344380][ T9348] [ 1345.344390][ T9348] dump_stack_lvl+0xe8/0x150 [ 1345.344423][ T9348] should_fail_ex+0x412/0x560 [ 1345.344458][ T9348] should_failslab+0xa8/0x100 [ 1345.344489][ T9348] ? skb_clone+0x212/0x3a0 [ 1345.344517][ T9348] kmem_cache_alloc_noprof+0x87/0x650 [ 1345.344546][ T9348] ? __bpf_redirect+0x9b4/0x12a0 [ 1345.344574][ T9348] skb_clone+0x212/0x3a0 [ 1345.344606][ T9348] bpf_clone_redirect+0x16a/0x4b0 [ 1345.344629][ T9348] ? bpf_test_run+0x1d1/0x830 [ 1345.344661][ T9348] ? bpf_test_run+0x1d1/0x830 [ 1345.344685][ T9348] bpf_prog_26e1271c592147e7+0x22/0x2a [ 1345.344708][ T9348] bpf_test_run+0x354/0x830 [ 1345.344756][ T9348] ? __pfx_bpf_test_run+0x10/0x10 [ 1345.344793][ T9348] ? csum_partial+0x239/0x2c0 [ 1345.344829][ T9348] ? skb_checksum+0x7c0/0x8c0 [ 1345.344864][ T9348] ? skb_dst_set+0x72/0x140 [ 1345.344891][ T9348] bpf_prog_test_run_skb+0xe2c/0x2260 [ 1345.344940][ T9348] ? __fget_files+0x3a0/0x420 [ 1345.344964][ T9348] ? __fget_files+0x2a/0x420 [ 1345.344994][ T9348] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1345.345020][ T9348] bpf_prog_test_run+0x2c7/0x340 [ 1345.345047][ T9348] __sys_bpf+0x643/0x950 [ 1345.345081][ T9348] ? __pfx___sys_bpf+0x10/0x10 [ 1345.345131][ T9348] ? ksys_write+0x242/0x270 [ 1345.345164][ T9348] ? __pfx_ksys_write+0x10/0x10 [ 1345.345198][ T9348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1345.345222][ T9348] __x64_sys_bpf+0x7c/0x90 [ 1345.345260][ T9348] do_syscall_64+0x15f/0xf80 [ 1345.345284][ T9348] ? trace_irq_disable+0x3b/0x140 [ 1345.345315][ T9348] ? clear_bhb_loop+0x40/0x90 [ 1345.345342][ T9348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1345.345368][ T9348] RIP: 0033:0x7fc81439cdd9 [ 1345.345388][ T9348] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1345.345405][ T9348] RSP: 002b:00007fc81524d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1345.345427][ T9348] RAX: ffffffffffffffda RBX: 00007fc814615fa0 RCX: 00007fc81439cdd9 [ 1345.345441][ T9348] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1345.345454][ T9348] RBP: 00007fc81524d090 R08: 0000000000000000 R09: 0000000000000000 [ 1345.345467][ T9348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1345.345479][ T9348] R13: 00007fc814616038 R14: 00007fc814615fa0 R15: 00007ffdfd89b518 [ 1345.345514][ T9348] [ 1346.526674][ T9314] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1346.849976][ T9381] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10124'. [ 1346.910467][ T9381] vlan2: entered promiscuous mode [ 1346.920144][ T9381] bridge0: entered promiscuous mode [ 1347.881848][ T9407] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1348.566072][T26782] Bluetooth: hci2: command 0x0406 tx timeout [ 1348.640792][ T9431] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10141'. [ 1348.653554][ T9431] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1348.900820][ T9438] FAULT_INJECTION: forcing a failure. [ 1348.900820][ T9438] name failslab, interval 1, probability 0, space 0, times 0 [ 1348.914097][ T9438] CPU: 0 UID: 0 PID: 9438 Comm: syz.2.10143 Not tainted syzkaller #0 PREEMPT(full) [ 1348.914126][ T9438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1348.914137][ T9438] Call Trace: [ 1348.914145][ T9438] [ 1348.914153][ T9438] dump_stack_lvl+0xe8/0x150 [ 1348.914182][ T9438] should_fail_ex+0x412/0x560 [ 1348.914209][ T9438] should_failslab+0xa8/0x100 [ 1348.914236][ T9438] ? skb_clone+0x212/0x3a0 [ 1348.914259][ T9438] kmem_cache_alloc_noprof+0x87/0x650 [ 1348.914283][ T9438] ? __bpf_redirect+0x9b4/0x12a0 [ 1348.914305][ T9438] skb_clone+0x212/0x3a0 [ 1348.914330][ T9438] bpf_clone_redirect+0x16a/0x4b0 [ 1348.914347][ T9438] ? bpf_test_run+0x1d1/0x830 [ 1348.914373][ T9438] ? bpf_test_run+0x1d1/0x830 [ 1348.914392][ T9438] bpf_prog_26e1271c592147e7+0x22/0x2a [ 1348.914411][ T9438] bpf_test_run+0x354/0x830 [ 1348.914452][ T9438] ? __pfx_bpf_test_run+0x10/0x10 [ 1348.914483][ T9438] ? csum_partial+0x239/0x2c0 [ 1348.914511][ T9438] ? skb_checksum+0x7c0/0x8c0 [ 1348.914540][ T9438] ? skb_dst_set+0x72/0x140 [ 1348.914561][ T9438] bpf_prog_test_run_skb+0xe2c/0x2260 [ 1348.914600][ T9438] ? __fget_files+0x3a0/0x420 [ 1348.914620][ T9438] ? __fget_files+0x2a/0x420 [ 1348.914645][ T9438] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1348.914668][ T9438] bpf_prog_test_run+0x2c7/0x340 [ 1348.914690][ T9438] __sys_bpf+0x643/0x950 [ 1348.914718][ T9438] ? __pfx___sys_bpf+0x10/0x10 [ 1348.914759][ T9438] ? ksys_write+0x242/0x270 [ 1348.914785][ T9438] ? __pfx_ksys_write+0x10/0x10 [ 1348.914814][ T9438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1348.914834][ T9438] __x64_sys_bpf+0x7c/0x90 [ 1348.914858][ T9438] do_syscall_64+0x15f/0xf80 [ 1348.914878][ T9438] ? trace_irq_disable+0x3b/0x140 [ 1348.914917][ T9438] ? clear_bhb_loop+0x40/0x90 [ 1348.914940][ T9438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1348.914959][ T9438] RIP: 0033:0x7ff8ed59cdd9 [ 1348.914981][ T9438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1348.914997][ T9438] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1348.915018][ T9438] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1348.915032][ T9438] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1348.915044][ T9438] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1348.915056][ T9438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1348.915068][ T9438] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1348.915098][ T9438] [ 1349.105284][ T9433] netlink: 'syz.4.10141': attribute type 11 has an invalid length. [ 1349.443884][ T9442] netlink: 'syz.3.10144': attribute type 1 has an invalid length. [ 1349.870187][ T9457] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10148'. [ 1355.303923][ T9442] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1355.418459][ T9470] tipc: Enabling of bearer rejected, failed to enable media [ 1355.693322][ T9487] xt_hashlimit: size too large, truncated to 1048576 [ 1355.963358][ T9490] lo speed is unknown, defaulting to 1000 [ 1356.056339][ T9497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1356.060966][ T9499] netlink: 'syz.3.10161': attribute type 39 has an invalid length. [ 1356.399282][ T9507] netlink: 'syz.3.10164': attribute type 1 has an invalid length. [ 1356.553947][ T9507] bond2: entered promiscuous mode [ 1356.559973][ T9515] netlink: 'syz.4.10166': attribute type 1 has an invalid length. [ 1356.585159][ T9507] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1356.613456][ T9509] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10164'. [ 1356.644149][ T9520] x_tables: duplicate entry at hook 2 [ 1356.677632][ T9517] macvtap1: entered allmulticast mode [ 1356.719350][ T9507] bond2: (slave bridge1): making interface the new active one [ 1356.766321][ T9507] bridge1: entered promiscuous mode [ 1356.785233][ T9507] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 1357.512137][ T9538] FAULT_INJECTION: forcing a failure. [ 1357.512137][ T9538] name failslab, interval 1, probability 0, space 0, times 0 [ 1357.524980][ T9538] CPU: 1 UID: 0 PID: 9538 Comm: syz.2.10170 Not tainted syzkaller #0 PREEMPT(full) [ 1357.525008][ T9538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1357.525021][ T9538] Call Trace: [ 1357.525029][ T9538] [ 1357.525037][ T9538] dump_stack_lvl+0xe8/0x150 [ 1357.525066][ T9538] should_fail_ex+0x412/0x560 [ 1357.525095][ T9538] should_failslab+0xa8/0x100 [ 1357.525123][ T9538] ? skb_clone+0x212/0x3a0 [ 1357.525148][ T9538] kmem_cache_alloc_noprof+0x87/0x650 [ 1357.525174][ T9538] ? __bpf_redirect+0x9b4/0x12a0 [ 1357.525198][ T9538] skb_clone+0x212/0x3a0 [ 1357.525227][ T9538] bpf_clone_redirect+0x16a/0x4b0 [ 1357.525249][ T9538] ? bpf_test_run+0x1d1/0x830 [ 1357.525279][ T9538] ? bpf_test_run+0x1d1/0x830 [ 1357.525303][ T9538] bpf_prog_26e1271c592147e7+0x22/0x2a [ 1357.525323][ T9538] bpf_test_run+0x354/0x830 [ 1357.525376][ T9538] ? __pfx_bpf_test_run+0x10/0x10 [ 1357.525410][ T9538] ? csum_partial+0x239/0x2c0 [ 1357.525444][ T9538] ? skb_checksum+0x7c0/0x8c0 [ 1357.525478][ T9538] ? skb_dst_set+0x72/0x140 [ 1357.525506][ T9538] bpf_prog_test_run_skb+0xe2c/0x2260 [ 1357.525552][ T9538] ? __fget_files+0x3a0/0x420 [ 1357.525576][ T9538] ? __fget_files+0x2a/0x420 [ 1357.525605][ T9538] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1357.525630][ T9538] bpf_prog_test_run+0x2c7/0x340 [ 1357.525656][ T9538] __sys_bpf+0x643/0x950 [ 1357.525687][ T9538] ? __pfx___sys_bpf+0x10/0x10 [ 1357.525733][ T9538] ? ksys_write+0x242/0x270 [ 1357.525765][ T9538] ? __pfx_ksys_write+0x10/0x10 [ 1357.525797][ T9538] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1357.525821][ T9538] __x64_sys_bpf+0x7c/0x90 [ 1357.525850][ T9538] do_syscall_64+0x15f/0xf80 [ 1357.525883][ T9538] ? trace_irq_disable+0x3b/0x140 [ 1357.525912][ T9538] ? clear_bhb_loop+0x40/0x90 [ 1357.525937][ T9538] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1357.525958][ T9538] RIP: 0033:0x7ff8ed59cdd9 [ 1357.525978][ T9538] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1357.525996][ T9538] RSP: 002b:00007ff8ee3b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1357.526020][ T9538] RAX: ffffffffffffffda RBX: 00007ff8ed815fa0 RCX: 00007ff8ed59cdd9 [ 1357.526035][ T9538] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1357.526049][ T9538] RBP: 00007ff8ee3b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1357.526061][ T9538] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1357.526074][ T9538] R13: 00007ff8ed816038 R14: 00007ff8ed815fa0 R15: 00007ffec26dc118 [ 1357.526107][ T9538] [ 1358.120430][ T9546] lo speed is unknown, defaulting to 1000 [ 1358.282416][ T9561] netlink: 'syz.1.10178': attribute type 1 has an invalid length. [ 1358.420187][ T9571] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10178'. [ 1358.580352][ T9574] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10176'. [ 1358.697142][ T9561] bond2: entered promiscuous mode [ 1358.719523][ T9561] bond2: entered allmulticast mode [ 1358.726507][ T9561] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1358.765785][ T9582] netlink: 'syz.3.10180': attribute type 1 has an invalid length. [ 1358.960782][ T9589] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10180'. [ 1359.353380][ T9562] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1359.773131][ T9562] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1360.037914][ T9562] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1360.340259][ T9562] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1360.902488][T26997] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1361.025702][T27008] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1361.057714][ T9624] netlink: 'syz.1.10191': attribute type 1 has an invalid length. [ 1361.141472][T27008] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1361.205105][ T9627] netlink: 'syz.3.10192': attribute type 1 has an invalid length. [ 1361.239187][ T9629] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10191'. [ 1361.258322][ T9624] bond3: entered promiscuous mode [ 1361.263698][ T9624] bond3: entered allmulticast mode [ 1361.328719][ T9624] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1361.443494][ T9627] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10192'. [ 1361.469410][T27008] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1362.411221][ T9669] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1362.514553][ T9652] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10198'. [ 1362.882479][ T9682] bridge0: port 3(vlan3) entered blocking state [ 1362.890287][ T9682] bridge0: port 3(vlan3) entered disabled state [ 1362.899562][ T9682] vlan3: entered allmulticast mode [ 1362.905039][ T9682] bridge0: entered allmulticast mode [ 1362.941463][ T9682] vlan3: left allmulticast mode [ 1362.971288][ T9682] bridge0: left allmulticast mode [ 1362.990879][ T9687] netlink: 'syz.4.10207': attribute type 1 has an invalid length. [ 1363.038369][ T9690] netlink: 'syz.0.10211': attribute type 1 has an invalid length. [ 1363.164740][ T9690] bond4: entered promiscuous mode [ 1363.182687][ T9690] bond4: entered allmulticast mode [ 1363.194189][ T9687] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10207'. [ 1363.211665][ T9699] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10211'. [ 1363.237877][ T9690] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1364.080370][ T9703] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1364.328835][ T9741] netlink: 'syz.1.10225': attribute type 1 has an invalid length. [ 1364.434531][ T9747] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10226'. [ 1364.454849][ T9741] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10225'. [ 1364.486131][ T9747] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10226'. [ 1364.884379][ T9756] bond4: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 1364.903268][ T9756] bond4 (unregistering): Released all slaves [ 1365.027509][ T9767] netlink: 'syz.4.10231': attribute type 1 has an invalid length. [ 1365.170120][ T9774] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10231'. [ 1365.170995][ T9776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10235'. [ 1365.189032][ T9776] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1365.312770][ T9767] bond4: entered promiscuous mode [ 1365.355942][ T9767] bond4: entered allmulticast mode [ 1365.365065][ T9767] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1365.429046][ T9772] erspan1: entered allmulticast mode [ 1365.464175][ T9772] bond4: (slave erspan1): making interface the new active one [ 1365.483999][ T9772] erspan1: entered promiscuous mode [ 1365.498084][ T9772] bond4: (slave erspan1): Enslaving as an active interface with an up link [ 1365.840165][ T9790] netlink: 'syz.4.10239': attribute type 1 has an invalid length. [ 1365.946738][ T9794] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10239'. [ 1366.069709][ T9799] tipc: Started in network mode [ 1366.097186][ T9799] tipc: Node identity aa26fd7d0ed9, cluster identity 4711 [ 1366.142472][ T9799] tipc: Enabled bearer , priority 0 [ 1366.151202][ T9800] syzkaller0: entered promiscuous mode [ 1366.157208][ T9800] syzkaller0: entered allmulticast mode [ 1366.277593][ T9800] tipc: Resetting bearer [ 1366.299567][ T9797] tipc: Resetting bearer [ 1366.389082][ T9797] tipc: Disabling bearer [ 1366.862080][ T9820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10250'. [ 1366.980009][ T9825] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1367.048094][ T9827] netlink: 'syz.2.10255': attribute type 1 has an invalid length. [ 1367.832033][ T9854] xt_hashlimit: size too large, truncated to 1048576 [ 1368.289957][ T9864] tipc: Started in network mode [ 1368.309589][ T9864] tipc: Node identity b2cc99d268b6, cluster identity 4711 [ 1368.339717][ T9864] tipc: Enabled bearer , priority 0 [ 1368.480538][ T9862] syzkaller0: entered promiscuous mode [ 1368.494801][ T9862] syzkaller0: entered allmulticast mode [ 1368.510937][ T9862] tipc: Resetting bearer [ 1368.592165][ T9872] __nla_validate_parse: 2 callbacks suppressed [ 1368.592188][ T9872] netlink: 280 bytes leftover after parsing attributes in process `syz.2.10267'. [ 1368.618497][ T9861] tipc: Resetting bearer [ 1372.094905][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1374.004196][ T9861] tipc: Disabling bearer [ 1374.028842][ T9855] lo speed is unknown, defaulting to 1000 [ 1374.029004][ T9876] netlink: 76 bytes leftover after parsing attributes in process `syz.2.10267'. [ 1374.116594][T25240] tipc: Node number set to 3665467858 [ 1374.192356][ T9894] netlink: 'syz.1.10269': attribute type 1 has an invalid length. [ 1374.212608][ T9895] IPVS: sync thread started: state = MASTER, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1374.331721][ T9894] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10269'. [ 1375.140876][ T9944] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10279'. [ 1375.141411][ T9947] netlink: 'syz.1.10281': attribute type 1 has an invalid length. [ 1375.308048][ T9957] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10281'. [ 1376.153226][ T9947] bond4: entered promiscuous mode [ 1376.188197][ T9947] bond4: entered allmulticast mode [ 1376.226886][ T9947] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1376.382829][ T9970] netlink: 'syz.4.10286': attribute type 1 has an invalid length. [ 1376.473874][ T9976] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10286'. [ 1376.893379][ T9988] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10292'. [ 1376.922897][ T9995] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10292'. [ 1377.683558][T10002] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1377.978329][T10016] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.10296'. [ 1378.730759][T10039] netlink: 'syz.4.10301': attribute type 1 has an invalid length. [ 1378.809134][T10046] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10302'. [ 1378.970830][T10039] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1379.076411][T10045] vlan2: entered allmulticast mode [ 1379.096671][T10045] bond5: entered allmulticast mode [ 1379.153773][T10058] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1379.227721][T10049] bond5: (slave geneve2): making interface the new active one [ 1379.249789][T10049] geneve2: entered allmulticast mode [ 1379.272252][T10049] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 1379.287574][ T4944] Bluetooth: hci5: command 0x0406 tx timeout [ 1379.320329][T10063] vcan0: tx drop: invalid da for name 0x0000000000000001 [ 1379.321020][T10064] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10304'. [ 1379.384050][T10063] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10303'. [ 1379.520458][T10063] nbd: socks must be embedded in a SOCK_ITEM attr [ 1379.557972][T10067] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10303'. [ 1379.595760][T10067] nbd: device at index 64 is going down [ 1380.164148][T10069] udevd[10069]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1380.941436][T10061] bridge0: port 2(bridge_slave_1) entered disabled state [ 1380.949809][T10061] bridge0: port 1(bridge_slave_0) entered disabled state [ 1381.581600][T10061] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1381.608126][T10061] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1382.076145][T10081] kthread_run failed with err -4 [ 1382.104857][T27008] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.145500][T27008] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1382.166064][T27008] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.186078][T27008] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1382.204830][T27008] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.216828][T27008] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1382.227443][T27008] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1382.230114][T10104] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 1382.236880][T27008] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 1382.343312][T10115] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10315'. [ 1382.454628][T10119] syzkaller1: entered promiscuous mode [ 1382.460705][T10119] syzkaller1: entered allmulticast mode [ 1383.626795][T10144] netlink: 80 bytes leftover after parsing attributes in process `syz.4.10322'. [ 1383.894928][T10150] netlink: 324 bytes leftover after parsing attributes in process `syz.0.10324'. [ 1384.486056][T10173] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10334'. [ 1384.535169][T10173] syzkaller1: entered promiscuous mode [ 1384.540843][T10174] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.10332'. [ 1384.583653][T10173] syzkaller1: entered allmulticast mode [ 1385.621811][T10204] netlink: 'syz.3.10342': attribute type 2 has an invalid length. [ 1385.904555][T10220] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10350'. [ 1385.942560][T10220] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1386.121859][T10233] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.10351'. [ 1386.219370][T10240] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10354'. [ 1387.096589][T10253] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 1387.148833][T10261] tipc: Failed to remove unknown binding: 66,0,0/3665467858:2059655600/2059655601 [ 1387.172153][T10261] tipc: Failed to remove unknown binding: 66,0,0/3665467858:2059655600/2059655601 [ 1387.350694][T10270] netlink: 'syz.2.10363': attribute type 1 has an invalid length. [ 1387.463883][T10270] bond6: entered promiscuous mode [ 1387.502999][T10282] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10363'. [ 1387.587589][T10270] bond6: entered allmulticast mode [ 1387.602440][T10270] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1387.833860][T10291] netlink: 324 bytes leftover after parsing attributes in process `syz.4.10368'. [ 1387.859639][T10287] netlink: 'syz.3.10367': attribute type 11 has an invalid length. [ 1388.945889][T10311] hmac(sha224): entered promiscuous mode [ 1389.000591][T10310] lo speed is unknown, defaulting to 1000 [ 1389.229196][T10333] netlink: 324 bytes leftover after parsing attributes in process `syz.4.10381'. [ 1389.284604][T10339] netlink: 'syz.0.10384': attribute type 1 has an invalid length. [ 1389.418517][T10346] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10384'. [ 1389.507027][T10339] bond5: entered promiscuous mode [ 1389.537063][T10339] bond5: entered allmulticast mode [ 1389.565193][T10339] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1389.747044][T10363] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10391'. [ 1389.766080][T10363] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1389.919946][T10369] netlink: 'syz.1.10391': attribute type 11 has an invalid length. [ 1391.144117][T10409] netlink: 'syz.4.10412': attribute type 1 has an invalid length. [ 1391.204940][T10415] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10416'. [ 1391.215673][T10415] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1391.288556][T10420] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10412'. [ 1391.449888][T10417] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1391.496785][T10409] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10412'. [ 1391.523893][T10417] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 1391.624546][T10435] netlink: 'syz.0.10416': attribute type 11 has an invalid length. [ 1391.754794][T10419] macsec1: entered allmulticast mode [ 1391.766955][T10419] macsec0: entered allmulticast mode [ 1391.809738][T10420] bond6: (slave bridge0): Enslaving as an active interface with a down link [ 1391.874597][T10427] macvlan2: entered promiscuous mode [ 1391.885778][T10427] macvlan2: entered allmulticast mode [ 1391.894258][T10427] bond6: entered promiscuous mode [ 1391.911334][T10427] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1391.916425][T10441] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10423'. [ 1391.934384][T10427] bond6: left promiscuous mode [ 1392.008793][T10409] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1392.259974][T10451] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.10426'. [ 1392.359709][T10453] tipc: Started in network mode [ 1392.375651][T10453] tipc: Node identity f64b8c6edf76, cluster identity 4711 [ 1392.396042][T10453] tipc: Enabled bearer , priority 0 [ 1392.534275][T10461] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10432'. [ 1392.548141][T10453] syzkaller0: entered promiscuous mode [ 1392.553995][T10453] syzkaller0: entered allmulticast mode [ 1392.580597][T10453] tipc: Resetting bearer [ 1392.609145][T10461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10432'. [ 1392.629248][T10452] tipc: Resetting bearer [ 1392.687322][T10470] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.10433'. [ 1392.732739][T10472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10434'. [ 1397.931267][T10452] tipc: Disabling bearer [ 1397.948134][T10461] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10432'. [ 1397.957312][T10461] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10432'. [ 1397.969044][T10476] kthread_run failed with err -4 [ 1398.012453][T25240] tipc: Node number set to 691899502 [ 1398.027993][ T3221] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1398.037648][ T3221] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1398.108279][ T3221] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1398.126694][ T3221] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1398.180489][T10491] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.10438'. [ 1398.324043][T10498] netlink: 'syz.0.10442': attribute type 1 has an invalid length. [ 1398.351181][T10499] netlink: 'syz.1.10443': attribute type 1 has an invalid length. [ 1398.393753][T10498] bond6: entered promiscuous mode [ 1398.400625][T10498] bond6: entered allmulticast mode [ 1398.407080][T10498] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1398.453047][T10499] bond6: entered promiscuous mode [ 1398.464446][T10499] bond6: entered allmulticast mode [ 1398.480106][T10499] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1398.498764][T10498] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10442'. [ 1398.509413][T10513] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10443'. [ 1398.640167][T10510] bond7: down delay (5) is not a multiple of miimon (2), value rounded to 4 ms [ 1398.656548][T10510] bond7: entered promiscuous mode [ 1398.707541][T10521] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10448'. [ 1398.838028][T10519] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1398.854201][T10519] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1399.741902][T10519] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1399.766253][ T4944] Bluetooth: hci1: command 0x0406 tx timeout [ 1399.803915][T10519] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1399.908856][T10548] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.10456'. [ 1400.071536][T10538] bond7: entered promiscuous mode [ 1400.091393][T10538] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1400.153468][T10541] bond8: entered promiscuous mode [ 1400.161030][T10541] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1400.297264][T10519] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1400.315607][T10519] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1400.430712][T10561] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10459'. [ 1400.476391][T10561] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1400.715081][T10519] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1400.769619][T10519] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1400.911438][T10572] bond3 (unregistering): Released all slaves [ 1400.989307][T10561] netlink: 'syz.0.10459': attribute type 11 has an invalid length. [ 1401.067036][T10583] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10461'. [ 1401.085756][T10583] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10461'. [ 1401.217707][T10573] bond3 (unregistering): Released all slaves [ 1401.799891][T26994] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1401.812174][T26994] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1401.968640][T26994] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1401.968654][T10606] atomic_op ffff888029491998 conn xmit_atomic 0000000000000000 [ 1401.986203][T26994] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1402.117887][T26994] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1402.135111][T26994] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1402.161935][T26994] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1402.177023][T26994] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1402.309141][T10622] tipc: Enabled bearer , priority 0 [ 1402.359948][T10626] tipc: Enabling of bearer rejected, already enabled [ 1402.402523][T10629] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1402.512841][T10631] bond3: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1402.699429][T10631] bond3: (slave lo): Enslaving as an active interface with an up link [ 1402.756487][T10631] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1402.805051][T10633] netlink: 'syz.0.10479': attribute type 11 has an invalid length. [ 1402.999301][T10655] netlink: 'syz.1.10486': attribute type 1 has an invalid length. [ 1403.039291][T10655] bond7: entered promiscuous mode [ 1403.045092][T10655] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1403.160442][T10655] bond7: (slave bridge4): making interface the new active one [ 1403.177851][T10655] bridge4: entered promiscuous mode [ 1403.193744][T10655] bridge4: left promiscuous mode [ 1403.297905][T10662] __nla_validate_parse: 7 callbacks suppressed [ 1403.297930][T10662] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10488'. [ 1403.491541][T10671] netlink: 'syz.1.10492': attribute type 12 has an invalid length. [ 1403.514871][T10671] netlink: 'syz.1.10492': attribute type 29 has an invalid length. [ 1403.540528][T10671] netlink: 148 bytes leftover after parsing attributes in process `syz.1.10492'. [ 1403.569827][T10671] netlink: 59 bytes leftover after parsing attributes in process `syz.1.10492'. [ 1403.693561][T10687] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1404.054212][T10702] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10500'. [ 1404.060255][T10700] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 1404.074582][T10702] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1404.289657][T10709] netlink: 'syz.1.10500': attribute type 11 has an invalid length. [ 1405.343592][T10737] netlink: 36 bytes leftover after parsing attributes in process `syz.1.10512'. [ 1405.596846][T10744] syz_tun: entered allmulticast mode [ 1405.610989][T10747] sock: sock_set_timeout: `syz.1.10515' (pid 10747) tries to set negative timeout [ 1405.625676][T10744] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10516'. [ 1405.661550][T10744] lo: entered allmulticast mode [ 1405.713965][T10743] syz_tun: left allmulticast mode [ 1405.937641][T10759] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10522'. [ 1405.957142][T10759] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1406.139114][T10769] netlink: 'syz.3.10522': attribute type 11 has an invalid length. [ 1406.564730][T10777] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10529'. [ 1407.017770][T10791] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10534'. [ 1407.912823][T10798] xt_hashlimit: size too large, truncated to 1048576 [ 1408.193184][T10802] lo speed is unknown, defaulting to 1000 [ 1408.399155][T10820] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10545'. [ 1408.412998][T10820] block nbd8: Unsupported socket: should be TCP or UNIX. [ 1408.842734][T10821] netlink: 'syz.4.10545': attribute type 11 has an invalid length. [ 1408.881104][T10834] netlink: 104 bytes leftover after parsing attributes in process `syz.1.10549'. [ 1409.139813][T10844] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10551'. [ 1409.162520][T10844] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10551'. [ 1409.207481][ T30] INFO: task kworker/u8:23:26999 blocked for more than 143 seconds. [ 1409.225661][ T30] Not tainted syzkaller #0 [ 1409.245070][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1409.270827][ T30] task:kworker/u8:23 state:D stack:21728 pid:26999 tgid:26999 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1409.298562][ T30] Workqueue: netns cleanup_net [ 1409.317651][ T30] Call Trace: [ 1409.325199][ T30] [ 1409.333968][ T30] __schedule+0x17b4/0x5680 [ 1409.341093][T26782] Bluetooth: hci4: link tx timeout [ 1409.349559][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 1409.351737][T26782] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1409.354999][ T30] ? __pfx___schedule+0x10/0x10 [ 1409.384868][ T30] ? schedule+0x90/0x360 [ 1409.411460][ T30] schedule+0x164/0x360 [ 1409.432711][ T30] rxrpc_destroy_all_calls+0x448/0x570 [ 1409.452659][ T30] ? __pfx_rxrpc_destroy_all_calls+0x10/0x10 [ 1409.479352][ T30] ? __pfx_var_wake_function+0x10/0x10 [ 1409.504689][ T30] ? lockdep_hardirqs_on+0x7a/0x110 [ 1409.518967][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1409.525929][ T30] ? __timer_delete_sync+0x4a4/0x520 [ 1409.531575][ T30] rxrpc_exit_net+0x6f/0xc0 [ 1409.537049][ T30] ops_undo_list+0x49f/0x940 [ 1409.541836][ T30] ? __pfx_ops_undo_list+0x10/0x10 [ 1409.547844][ T30] ? idr_destroy+0x218/0x290 [ 1409.552716][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 1409.558913][ T30] cleanup_net+0x56b/0x800 [ 1409.563613][ T30] ? __pfx_cleanup_net+0x10/0x10 [ 1409.569968][ T30] ? process_scheduled_works+0xa70/0x1860 [ 1409.582582][ T30] ? process_scheduled_works+0xa70/0x1860 [ 1409.594497][ T30] process_scheduled_works+0xb5d/0x1860 [ 1409.606979][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 1409.620157][ T30] ? assign_work+0x3d5/0x5e0 [ 1409.636310][ T30] worker_thread+0xa53/0xfc0 [ 1409.646901][ T30] kthread+0x388/0x470 [ 1409.657311][ T30] ? __pfx_worker_thread+0x10/0x10 [ 1409.675456][ T30] ? __pfx_kthread+0x10/0x10 [ 1409.680255][ T30] ret_from_fork+0x514/0xb70 [ 1409.685069][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1409.690924][ T30] ? __switch_to+0xc79/0x1410 [ 1409.696659][ T30] ? __pfx_kthread+0x10/0x10 [ 1409.701485][ T30] ret_from_fork_asm+0x1a/0x30 [ 1409.707150][ T30] [ 1409.710700][ T30] [ 1409.710700][ T30] Showing all locks held in the system: [ 1409.773161][ T30] 1 lock held by khungtaskd/30: [ 1409.871752][ T30] #0: ffffffff8e95cd60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1409.883457][ T30] 2 locks held by getty/5381: [ 1409.888620][ T30] #0: ffff8880364de0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1409.899296][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 1409.910275][ T30] 3 locks held by kworker/u9:2/26782: [ 1409.915909][ T30] #0: ffff88806b520140 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 1409.927177][ T30] #1: ffffc90005f3fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 1409.942389][ T30] #2: ffff88805878cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 1409.952716][ T30] 3 locks held by kworker/u8:23/26999: [ 1409.958291][ T30] #0: ffff88801be8e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 1409.969608][ T30] #1: ffffc9000d3f7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 1409.980637][ T30] #2: ffffffff8fdbfc88 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 1409.990469][ T30] [ 1409.992855][ T30] ============================================= [ 1409.992855][ T30] [ 1410.001617][ T30] NMI backtrace for cpu 1 [ 1410.001635][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1410.001656][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1410.001666][ T30] Call Trace: [ 1410.001673][ T30] [ 1410.001682][ T30] dump_stack_lvl+0xe8/0x150 [ 1410.001709][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 1410.001736][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1410.001759][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1410.001787][ T30] sys_info+0x135/0x170 [ 1410.001809][ T30] watchdog+0xfd3/0x1030 [ 1410.001841][ T30] ? watchdog+0x1c9/0x1030 [ 1410.001872][ T30] kthread+0x388/0x470 [ 1410.001896][ T30] ? __pfx_watchdog+0x10/0x10 [ 1410.001921][ T30] ? __pfx_kthread+0x10/0x10 [ 1410.001947][ T30] ret_from_fork+0x514/0xb70 [ 1410.001972][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1410.001993][ T30] ? __switch_to+0xc79/0x1410 [ 1410.002025][ T30] ? __pfx_kthread+0x10/0x10 [ 1410.002051][ T30] ret_from_fork_asm+0x1a/0x30 [ 1410.002091][ T30] [ 1410.002098][ T30] Sending NMI from CPU 1 to CPUs 0: [ 1410.115773][ C0] NMI backtrace for cpu 0 [ 1410.115795][ C0] CPU: 0 UID: 0 PID: 8200 Comm: ipvs-e:303:0 Not tainted syzkaller #0 PREEMPT(full) [ 1410.115816][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1410.115826][ C0] RIP: 0010:sched_clock_cpu+0xa2/0x440 [ 1410.115852][ C0] Code: ad 92 0e 48 c7 44 24 40 0e 36 e0 45 4b c7 04 2f 00 00 00 00 65 48 8b 0d bc e5 9a 11 48 3b 8c 24 80 00 00 00 75 14 48 8d 65 d8 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 69 c9 09 0a 0f [ 1410.115868][ C0] RSP: 0018:ffffc90006307728 EFLAGS: 00000046 [ 1410.115885][ C0] RAX: 000001485172f171 RBX: ffff88802cc01ed4 RCX: 6de12b54f8d03d00 [ 1410.115898][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 1410.115909][ C0] RBP: ffffc90006307750 R08: ffffffff819fb713 R09: ffff8880b8624588 [ 1410.115921][ C0] R10: dffffc0000000000 R11: ffffed10059803d9 R12: 0000000000000001 [ 1410.115933][ C0] R13: dffffc0000000000 R14: ffffc900063076e0 R15: 1ffff92000c60ed8 [ 1410.115946][ C0] FS: 0000000000000000(0000) GS:ffff888125293000(0000) knlGS:0000000000000000 [ 1410.115960][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1410.115972][ C0] CR2: 0000555564e11a28 CR3: 000000000e74a000 CR4: 00000000003526f0 [ 1410.116010][ C0] Call Trace: [ 1410.116021][ C0] [ 1410.116032][ C0] psi_task_switch+0x5b/0x880 [ 1410.116054][ C0] ? psi_account_irqtime+0x137/0x6f0 [ 1410.116078][ C0] __schedule+0x29ae/0x5680 [ 1410.116095][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1410.116125][ C0] ? __pfx___schedule+0x10/0x10 [ 1410.116145][ C0] ? schedule+0x90/0x360 [ 1410.116163][ C0] schedule+0x164/0x360 [ 1410.116180][ C0] schedule_timeout+0x158/0x2c0 [ 1410.116204][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1410.116226][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1410.116255][ C0] ip_vs_estimation_kthread+0x2a87/0x39d0 [ 1410.116275][ C0] ? ip_vs_estimation_kthread+0x28d7/0x39d0 [ 1410.116308][ C0] ? __pfx_ip_vs_estimation_kthread+0x10/0x10 [ 1410.116326][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1410.116355][ C0] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1410.116385][ C0] ? __kthread_parkme+0x7a/0x1f0 [ 1410.116407][ C0] kthread+0x388/0x470 [ 1410.116428][ C0] ? __pfx_ip_vs_estimation_kthread+0x10/0x10 [ 1410.116446][ C0] ? __pfx_kthread+0x10/0x10 [ 1410.116466][ C0] ret_from_fork+0x514/0xb70 [ 1410.116485][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1410.116502][ C0] ? __switch_to+0xc79/0x1410 [ 1410.116525][ C0] ? __pfx_kthread+0x10/0x10 [ 1410.116545][ C0] ret_from_fork_asm+0x1a/0x30 [ 1410.116571][ C0] [ 1410.373774][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 1410.380657][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1410.390043][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1410.400285][ T30] Call Trace: [ 1410.403577][ T30] [ 1410.406536][ T30] vpanic+0x56c/0xa60 [ 1410.410528][ T30] ? __pfx___schedule+0x10/0x10 [ 1410.415389][ T30] ? __pfx_vpanic+0x10/0x10 [ 1410.419979][ T30] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 1410.426240][ T30] panic+0xc5/0xd0 [ 1410.429996][ T30] ? __pfx_panic+0x10/0x10 [ 1410.434427][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 1410.439834][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1410.446012][ T30] watchdog+0x102c/0x1030 [ 1410.450459][ T30] ? watchdog+0x1c9/0x1030 [ 1410.454919][ T30] kthread+0x388/0x470 [ 1410.459132][ T30] ? __pfx_watchdog+0x10/0x10 [ 1410.463891][ T30] ? __pfx_kthread+0x10/0x10 [ 1410.468590][ T30] ret_from_fork+0x514/0xb70 [ 1410.473378][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1410.478541][ T30] ? __switch_to+0xc79/0x1410 [ 1410.483252][ T30] ? __pfx_kthread+0x10/0x10 [ 1410.487859][ T30] ret_from_fork_asm+0x1a/0x30 [ 1410.492747][ T30] [ 1410.496809][ T30] Kernel Offset: disabled [ 1410.501157][ T30] Rebooting in 86400 seconds..