last executing test programs: 6.893454877s ago: executing program 0 (id=8847): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000200)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400"], 0x18}}, 0x0) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/172, 0xac}, {&(0x7f0000002c80)=""/151, 0x97}, {&(0x7f0000002d40)=""/94, 0x5e}], 0x4}, 0x9}, {{0x0, 0x0, 0x0}, 0xb91b}], 0x4, 0x0, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000600f8ff000000000000000085000000b6000000950000"], &(0x7f0000000100)='syzkaller\x00', 0x7, 0xff6, &(0x7f0000000bc0)=""/4086, 0x41100, 0x2e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1f, 0x13, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020200600000000000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000072000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x19}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$int_in(r2, 0x5452, &(0x7f0000000140)=0x1) ppoll(&(0x7f0000000180)=[{r2}], 0x1, &(0x7f00000001c0), 0x0, 0x0) unshare(0x400) getsockopt$inet_sctp6_SCTP_REUSE_PORT(0xffffffffffffffff, 0x84, 0x24, &(0x7f0000000700), &(0x7f0000000740)=0x4) shutdown(0xffffffffffffffff, 0x1) connect$bt_l2cap(r0, &(0x7f0000000a00)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x2a060400) sendmsg$nl_generic(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000046000901feffffff"], 0x20}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 6.589248468s ago: executing program 0 (id=8849): r0 = socket$inet(0x2, 0x2, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000000200), 0xa0d, 0x200001000000, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x7, 0x7}) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000280)={{r1}, 0x10, 0x8001, 0x7b83abc1}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={0x0, 0x38}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)={0x1b, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0xe2, '\x00', 0x0, r1, 0x2, 0x4, 0x5}, 0x50) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f00000026c0)=0x0, &(0x7f0000002700)=0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000002a80)={r1, 0xe0, &(0x7f0000002980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000002840)=[0x0, 0x0], 0x0, 0xbb, &(0x7f0000002880)=[{}, {}], 0x10, 0x10, &(0x7f00000028c0), &(0x7f0000002900), 0x8, 0x58, 0x8, 0x8, &(0x7f0000002940)}}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000002ac0)={r1}, 0x4) socketpair(0x1, 0x1, 0x0, &(0x7f0000002b00)) bpf$MAP_CREATE(0x0, &(0x7f0000002b40)=@base={0x12, 0x5, 0x4, 0x2, 0x0, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002d00)={0x15, 0x17, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4a}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@map_fd={0x18, 0x3, 0x1, 0x0, r2}, @tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @exit], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000400)='syzkaller\x00', 0xfffff00a, 0x1000, &(0x7f00000016c0)=""/4096, 0x40f00, 0x34, '\x00', r4, @sk_reuseport, r2, 0x8, &(0x7f0000002740)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000002780)={0x1, 0x5, 0x2, 0x7}, 0x10, r5, 0xffffffffffffffff, 0x0, &(0x7f0000002c80), 0x0, 0x10, 0x80}, 0x94) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000180)={0x0, @remote, @private}, &(0x7f00000001c0)=0xc) sendmsg$nl_route_sched_retired(r2, 0x0, 0x6040001) 6.276446912s ago: executing program 0 (id=8851): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0), 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000840)={'syzkaller0\x00', 0xca02}) bpf$ENABLE_STATS(0x20, &(0x7f0000000000), 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000880)={'syzkaller0\x00', @multicast}) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x1, 0x3, &(0x7f0000000c80)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f0000001a40)='GPL\x00', 0x4, 0x436, &(0x7f0000001a80)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001b40), 0xfffffffffffffc95}, 0x48) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000001b80)=r2) r3 = socket$kcm(0x11, 0x6, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001bc0)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000001c00), 0x56) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r6, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r7 = socket(0x2, 0x80805, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r8, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000200)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r7, 0x84, 0x77, &(0x7f0000000280)={r9}, 0x8) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f00000000c0)=0x800001, 0x4) bind$inet6(r10, &(0x7f0000000100)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x1c) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r11, 0x29, 0x1a, &(0x7f0000000140)=0x5, 0x4) bind$inet6(r11, &(0x7f0000000180)={0xa, 0x4e22}, 0x1c) sendmsg$kcm(r3, &(0x7f0000001c40)={&(0x7f0000001c80)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000001d00)=[{&(0x7f0000001d40)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 5.342394762s ago: executing program 0 (id=8857): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f0000000700)) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07000000040000000800000003"], 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r2, &(0x7f00000000c0)}, 0x20) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000340)=0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20048810}, 0x900) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_xfrm(0x10, 0x3, 0x6) close(r4) socket$kcm(0x2, 0x2, 0x73) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000000100), 0x400023c, 0x300, 0x0) read(r4, &(0x7f0000000140)=""/31, 0x1f) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000100), &(0x7f0000000180)=0x4) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000380)={r3}, &(0x7f00000003c0)=0x8) sendmsg$802154_dgram(r0, &(0x7f0000000300)={&(0x7f00000001c0)={0x24, @long={0x3, 0x2}}, 0x14, &(0x7f00000002c0)={&(0x7f0000000200)="80b6dbe0c4baaad795162421cc493057219629b42adbb9cdc5692ef40331877e1c8397cba64131d3da84f76bd998f765076e2ca68e9f096ea3d93c4aa811b09a9be418fa93e3d052c4d353c321f437c56f9c3f64da40357430b8355b859a83f4844386c48d843087f006e9aa99c2f5cec330fb6fc5de4dd899dde965a256ad9b05389f301dc54086333f3d1e485cec4e1c8b9c206bf83a98b3588f", 0x9b}, 0x1, 0x0, 0x0, 0xc000000}, 0x4000000) 4.728359131s ago: executing program 3 (id=8862): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000640)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x2100, 0xc, 0xc, 0x6, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x61, 0x2e, 0x5f, 0x2e]}}, 0x0, 0x2a}, 0x28) 4.606628419s ago: executing program 4 (id=8863): socket$netlink(0x10, 0x3, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000300)={0x0, 0x67, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="1480000000a1c9000000", @ANYRES16=r3, @ANYBLOB="ad43000000000000000004000000"], 0x14}}, 0x0) socket$xdp(0x2c, 0x3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0xc, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x1f, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000800)={r5, 0x0, 0x0}, 0x10) socket$xdp(0x2c, 0x3, 0x0) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r6, 0x11b, 0x6, &(0x7f0000000840)=0x1000000, 0x4) r7 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r7, &(0x7f0000000880)=[{&(0x7f00000008c0)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1) (async) writev(r7, &(0x7f0000000880)=[{&(0x7f00000008c0)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000940)={r4}, 0x2) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000940)={r4}, 0x2) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000004140100000000000000000008000300000000000800", @ANYRES64=r8], 0x20}, 0x1, 0x0, 0x0, 0x4008055}, 0x814) (async) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2000000004140100000000000000000008000300000000000800", @ANYRES64=r8], 0x20}, 0x1, 0x0, 0x0, 0x4008055}, 0x814) socket(0x10, 0x803, 0x0) (async) r10 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r10, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x6) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(r1, 0x40106e8c, &(0x7f0000000200)=[0x8000000000000000, 0x2]) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r11, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r11, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) socket$inet_smc(0x2b, 0x1, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r11], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) (async) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r11], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x800}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) socket$nl_route(0x10, 0x3, 0x0) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r11], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 4.5758204s ago: executing program 3 (id=8864): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x13, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000002018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000070000a0970000002d000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000003000000850000000600000095"], &(0x7f00000006c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r1 = socket$kcm(0x10, 0x100000000002, 0x4) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x40010002) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b28, &(0x7f0000000700)={'wlan1\x00'}) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000780), r0) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000840)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x28, r3, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) sendmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="39000000140081ae00002c000500015601618575e285af0180007a1b31d569d9ae527048ffffffffffffffff56fabcb3b2aa9be3da9212d744", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x35, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x80}, {0x3d}, {0x0, 0x0, 0x0, 0x10000}, {}, {0x3}, {0x6, 0x3}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x8000) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$AUDIT_MAKE_EQUIV(r0, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x28, 0x3f7, 0x8, 0x70bd25, 0x25dfdbfc, {0x7, 0x7, './file0', './file0'}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4) socket$inet_icmp(0x2, 0x2, 0x1) sendmsg$netlink(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="140000000000010000000000fcdbdf2504000080"], 0xfffffffffffffead}], 0x1, 0x0, 0x0, 0x20000080}, 0x0) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f00000004c0)={0xffffffffffffffff}) r6 = openat$cgroup(r5, &(0x7f0000000380)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r6, &(0x7f0000000480)='blkio.throttle.io_service_bytes_recursive\x00', 0x0, 0x0) 4.331288906s ago: executing program 3 (id=8865): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10) socket(0x10, 0x3, 0xf1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller0\x00', @link_local}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000780)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x35dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x45557e8d}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000900)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xff, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000940)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000980), 0x56) sendmsg$kcm(r5, &(0x7f00000009c0)={&(0x7f0000000a00)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 4.082962587s ago: executing program 2 (id=8867): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x1001}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0x2, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x17, 0xffff}, {0x1, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20004080) r3 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r3, &(0x7f00000009c0)={&(0x7f0000000d00)=@in={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000d40)=[{&(0x7f0000000d80)=')', 0x1}], 0x1, &(0x7f0000000dc0)=[@init={0x18, 0x84, 0x0, {0x8000, 0xf, 0x5}}], 0x18, 0x4008000}, 0x28008841) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000e00)={0x0, 0x1000}, 0x8) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x44, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0xfff1, 0xffff}, {0x8, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x907, 0x1, 0x1, 0xffff}]}}]}}]}, 0x44}}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'veth0_to_bond\x00', &(0x7f0000000680)=@ethtool_gfeatures}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000700)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x12, r5, 0xba1d0000) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000740)={'wlan0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000940)={r5, &(0x7f00000005c0)='syztnl0\x00', 0x4001, &(0x7f0000000600)={@align=0x5, {0xcb, 0x3, 0x4, 0x3}}, 0xa9e, &(0x7f0000000700), &(0x7f0000000900)=0xffff}) sendmsg$NFT_MSG_GETOBJ(r7, &(0x7f0000000cc0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000a80)={0x200, 0x13, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_USERDATA={0xad, 0x8, "25dbbfec1cdd80fbc46bca615d273ef993e46eda4d689f65f50b0bcca6da74b800a880a0788c8b23e6fa6db1b094e25412fabb95807e9612b45a67f4c1adef785ee154c1537b0e2ee224a846e85068ed74bb79dfb3cdc9560f4f1f9947e31cdcc13afe7faf816a30c1ceff0f3bb3a04ddb85bec0f111cf7eb22c8ebbf0cd303b2d94a22f9fb2fabba6044b71c6d7c495f9289168e6cc1d26fd9e5306cf55832e478f862c252ecb603d"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0x3e, 0x8, "b730aaa4c303a835fd44997463b784422824c9882a8b9dd28ca82ee96bb0a456c43327698cfcdfb530e2a1deec98b6016952587b463a4f72e927"}, @NFTA_OBJ_USERDATA={0xd3, 0x8, "6ad11e297c4ea10d576b6cc5f35fb528182fc2b031e46563d2c402e4f60e2a6023074d34b65af78011bfb68e7c85245d91f968fdfacabeafe9f51f8593b220ad39fb3b37acc7a35ffd69adeb6237d11095475e6c0e566523718b4b7f19b25e977ca5322e1bbfc4f73d84c847fe731acf27b604bbe1778d629b53a0fca51ebb09604be89d1afd5cfbeceb09f706486d95eb571bcc5a168950d62a31f0e59b7ba99561b7d56bab19843262df07e74f13d0fb860c49c1a495b4d0bb2d76c668613dbe0dec9da09e4a8f5569d81d9c006f"}]}, 0x200}, 0x1, 0x0, 0x0, 0x840}, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000440)={0x1, 0xffffffffffffffff, 0x400}, &(0x7f0000000480)=0xc) ioctl$F2FS_IOC_DECOMPRESS_FILE(r8, 0xf517, 0x0) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000800)={'ip6tnl0\x00', &(0x7f0000000780)={'syztnl0\x00', r2, 0x4, 0x4, 0xa, 0x100, 0x0, @private2, @loopback, 0x1, 0x80, 0x2, 0x9}}) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local}) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000100)="2e9b5b00ace03dd65193dfb6c5619a3d86dd60670600001406120000", 0x1c}, {&(0x7f0000000140)="37bcb39800000000f66b8157b45046eb15ff314c846dbc0f31fa4cc9f8296c3c2e80cdd4e4c4d38badf3518aeea2d6f03f", 0x31}, {&(0x7f0000000180)='Ck', 0x2}], 0x3) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000840)=ANY=[@ANYBLOB="14000000100001000000000000000000036edd64a989e95e00000a28000000000a05000000000000000000030000030800024000300000000028000000000a010400000000000000000300000a0900010073797a30000000200800024000000006140000001000010000000000000000000100000a000000009edb624a12bc00000000008e"], 0x78}, 0x1, 0x0, 0x0, 0x24040010}, 0x20000081) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000540)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="300000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r12, @ANYBLOB="80007f1e0a0002"], 0x30}, 0x1, 0x0, 0x0, 0x20007ffd}, 0x4040004) 3.385496429s ago: executing program 1 (id=8870): socket$nl_rdma(0x10, 0x3, 0x14) 3.055203085s ago: executing program 1 (id=8871): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000200)=@bpf_lsm={0x6, 0x4, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1f}, [@ldst={0x3, 0x0, 0x3, 0x0, 0x0, 0x30}]}, &(0x7f0000000300)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x20}, 0x94) 2.94478873s ago: executing program 1 (id=8872): r0 = socket(0x2d, 0x2, 0x0) sendto(r0, &(0x7f0000000600)="01010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101", 0x40, 0x0, &(0x7f0000000700)=@generic={0x2d, "000001000000080108000000000000400300"}, 0x80) 2.837939923s ago: executing program 1 (id=8873): r0 = socket$kcm(0xa, 0x3, 0x73) sendmsg$inet(r0, &(0x7f0000000540)={&(0x7f0000000580)={0xa, 0x0, @empty=0xf5ff}, 0x10, &(0x7f00000005c0)=[{&(0x7f0000000600)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001600)="9d7fcf3efc6316a6a555ba8b4726d7ccaf8a060000009cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71ad21b965f615b31105d60a4b16fa2fa1371850a1be85ffcad45b49422b2121d709014f49cf6bd1d18acc4c19e4356669a2ac3e05d5cdc6f0f485c1eb52ea8faf7e83a1468b6a491e71ae3d03cd9677e72413954feae71b5775a6e3e9fa9db9e1ed56e56bff66a7a86214d8145d878e26fa35bd55db98ecdef374d26a5d9cd0e89f3ae45be2d8e1d98ee0865fb64d6dd1e8c89608733370f12be1495d81b36dd72cc28e9c9b2c45f925b38b21818d93ce604772c21824e45793c4073eb44773f8e42c9ebb297dd5e76e856a22253c0e8a80f33b4d015c3f9c0c26bcdd6b440322a23b10d507eecead59faa166bdac1bd84021", 0x125}], 0x2, &(0x7f0000001740)=[@ip_tos_int={{0x14, 0x29, 0x3e, 0x1000000}}, @ip_tos_u8={{0x11, 0x29, 0x2}}, @ip_tos_u8={{0x11}}], 0x48}, 0xff00) 2.684130615s ago: executing program 1 (id=8874): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT={0x8}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) (fail_nth: 6) 1.914810019s ago: executing program 1 (id=8875): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time\x00') r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000004c0), r0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@newsa={0x150, 0x10, 0x401, 0x70bd27, 0x0, {{@in=@rand_addr=0x64010101, @in6=@mcast1, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {@in6=@loopback, 0x4d2, 0x32}, @in=@rand_addr=0x64010101, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x8}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, '1234567890123456dcba'}}]}, 0x150}}, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000d80)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) syz_open_procfs$namespace(r3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000dc0)={0x1e, 0x4, &(0x7f0000000f40)=ANY=[@ANYBLOB="18000000000000000000000000000000711229000000000095"], &(0x7f0000000f80)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000fc0), 0xffffffffffffffff) r9 = getpid() sendmsg$DEVLINK_CMD_RELOAD(r7, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000001080)={0x3c, r8, 0x1, 0x470bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r9}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0xb0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000010c0)={{{@in=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@dev}}, &(0x7f00000011c0)=0xe8) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001200)={0x0, 0x0, 0x0}, &(0x7f0000001240)=0xc) sendmsg$netlink(r5, &(0x7f0000001280)={&(0x7f00000012c0)=@proc={0x10, 0x0, 0x25dfdbfd, 0x8}, 0xc, &(0x7f0000001300)=[{&(0x7f0000001340)={0x2b0, 0x13, 0x200, 0x70bd25, 0x25dfdbfd, "", [@nested={0x29f, 0x8a, 0x0, 0x1, [@typed={0x8, 0xbe, 0x0, 0x0, @fd=r6}, @nested={0x4, 0x36}, @generic="d5b1793a3fdd7559ac9b080a0812314b4800e46225f0c744eee2b2fcb285423f70412d07eff4533f352f5d14d783e748b0f682ae6e546ed20a2aa7b7e9c85bd2207857478a77d14023c9f03dbd78317e24826ed817742ba1c71480ce5bda1ae1db818ec1d5bc8c985846e463305e030921cce66bece6799a1950cb1f0fd6342db8ec4009750cb1d25bda133d393396f1429cdd64f697d80c21009dc7bae49bb5cda6bc2bbc6231a990e69decc1bc697126790320a6efea8f4057aade1eb92166a53759a3b4a5d6", @generic="196b1f207d3aac436ae7db1102266dc9d6d9a2635888582dc5cf5715f6108a4f2ee0b7a1f3a6fffa3dbf33ab8a2278a478170672fa6bd8fef761507a112efec2", @nested={0x4, 0x1a}, @nested={0x4, 0xb0}, @nested={0x4, 0x15c}, @generic="55e8f699bec9fa7177d0d36032b227b5b4c430ef92e8cc618e3d444f3d01263c040fbbc2708c3560bd610d29f2c86d13dab899e1d69c36f7db4ab2944e8283ebeccbb5baef1d4a893a33277e5836c792bb8ef5bb746efe137395500bb894de23d644d46ced7f6dc33c7d53da48c4eeaf65e8625c4e7fa84af4d9bc10923ea03d5b60d29a03d36572c8bbdd77d8d55da0bbb884e80a1415737cf2ff3ff159213d65b8a6918cb614093ca11645a724b12f9ab799af8294a9ad71d7f6e685ea1fb0c2927d8237d9c958e5cfe2a33e7a541b941c5d333ac7da1e580d3e72c6e9436847aba1bb9fc56e408bfe16e50aa8e2c0", @generic="d737f412ba7778711cb0c0fc965f13e73b1f8aa05f2c381750ea0b3796078393fb2d0004dcca921014a21327b155f0bd7368298a0e11dcf694ccba3eed12b689f5024e018e0c5969183205fab85cdb9dfc06c7637be5bdfcaf47d4c4c25b2df9bca9e3708abf69913b55db1e0f42b210a429c8dcd01d9e3c08f480f0b0444f9b1bf76551aee6066d9197c0f6"]}]}, 0x2b0}, {&(0x7f0000001600)={0x184, 0x38, 0x300, 0x70bd25, 0x25dfdbfe, "", [@generic="c2879eefd5f08daf8dcdbd1f4fc78d4ef651f9b0069968e66516b5537fdabba2713795fea51a6cb6ce7174bea06986d57e684ea83e990b73e8cc6ccf65fbe4c5420e1f7ed92ab2695fb0b71c90800aa90d7f04446f449cd437cc1781052a251d6dddb873b248", @generic="404e4abf131984ee8dd8b6933581b0e97c67f8088cffde9501c0532fd98b27556f0b271b140d93", @generic="1fc4e23ab80dd4c8b37fccfffe8fab90af17bf6671c90275f465e5e5a69764e0d325b14a089bd1e7a842dcc41aaa52c7b786a454e75a93cac3ed7d90d3d373a1a38cf62a6b0e62ed7a091bbdf5c0ff120ca72cc50f0ff42f605904d4d0256cc82dd7aaba8694c49ea80def58454dcd97dfb2ba499931f28df7776ec993f4b842135dd3030144ded875b32deb6493cabde630745ca464b9f0fd186d8a218bd394e47e4e65618f8b8207fc41a6e2365103527ba40cd32ec54345a4c29c9f7ec6f72a93ee9e2e5c5eefa876b2bd7062b41091fb834ed9764d12bfa6b659c0d5078c3b085cf667101d"]}, 0x184}], 0x2, &(0x7f00000017c0)=[@cred={{0x1c, 0x1, 0x2, {r9, r10, r11}}}], 0x20, 0x40}, 0x8080) setsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001800)={r3, 0xee00, r11}, 0xc) sendmsg$nl_xfrm(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r12 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r12, 0x0, 0x0, 0x0, &(0x7f0000000980)={0xa, 0x1234, 0x0, @loopback}, 0x1c) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f00000009c0)={'dummy0\x00', 0x0}) sendmsg$nl_route(r13, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)=@newlinkprop={0x24, 0x6c, 0x1, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r14, 0x1, 0x22}, [@IFLA_PROP_LIST={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x2004d809}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0x6, &(0x7f0000000b80)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x3d}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000bc0)='GPL\x00', 0x5, 0x29e, &(0x7f0000000c00)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000500)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x34, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r15}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x81}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}]}, 0x34}}, 0x0) r16 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000e80)={'macvlan0\x00'}) sendmsg$nl_route(r16, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000f00)={0x0}, 0x1, 0x0, 0x0, 0x28001}, 0x8000002) 1.903439721s ago: executing program 2 (id=8876): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="0815000000051104060000002800000001000005540201"], 0x1508}}, 0x24000880) 1.759193866s ago: executing program 3 (id=8877): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000200)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400"], 0x18}}, 0x0) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/172, 0xac}, {&(0x7f0000002c80)=""/151, 0x97}, {&(0x7f0000002d40)=""/94, 0x5e}], 0x4}, 0x9}, {{0x0, 0x0, 0x0}, 0xb91b}], 0x4, 0x0, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000600f8ff000000000000000085000000b6000000950000"], &(0x7f0000000100)='syzkaller\x00', 0x7, 0xff6, &(0x7f0000000bc0)=""/4086, 0x41100, 0x2e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1f, 0x13, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020200600000000000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000072000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x19}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$int_in(r2, 0x5452, &(0x7f0000000140)=0x1) ppoll(&(0x7f0000000180)=[{r2}], 0x1, &(0x7f00000001c0), 0x0, 0x0) unshare(0x400) getsockopt$inet_sctp6_SCTP_REUSE_PORT(0xffffffffffffffff, 0x84, 0x24, &(0x7f0000000700), &(0x7f0000000740)=0x4) shutdown(0xffffffffffffffff, 0x1) connect$bt_l2cap(r0, &(0x7f0000000a00)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x2a060400) sendmsg$nl_generic(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000046000901feffffff00000000047c"], 0x20}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 1.523352099s ago: executing program 2 (id=8878): bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=@udp}, 0x20) close(0x3) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$OBJ_GET_PROG(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000380)='./file0\x00', 0x0, 0x256aa8b595cb185d}, 0x18) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180), 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1a, 0x0, &(0x7f00000014c0)) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x16, 0x13, 0x0, &(0x7f00000018c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001500)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001880)={{r2, 0xffffffffffffffff}, &(0x7f0000001980), &(0x7f00000019c0)='%+9llu \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001a00)={r3, 0xffffffffffffffff}, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x16, 0x10, &(0x7f0000001b00)=@framed={{0x18, 0x5, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffff7}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}]}, &(0x7f0000001c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f0000001e00)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001d00)={0x1c, 0xb, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4810}, 0x40004) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001c40)={r5, 0xfffff000, 0xe, 0x0, &(0x7f0000001cc0)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x50) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f00000016c0), &(0x7f0000001700)=0x4) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0xfffd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {}, 0x0, 0x6e6bb8, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x9}, 0x4040000) 1.463226523s ago: executing program 4 (id=8879): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000005c0)=""/4078, 0xfee}, {&(0x7f00000015c0)=""/141, 0x8d}, {&(0x7f0000001680)=""/4116, 0x1005}, {&(0x7f00000026c0)=""/6, 0x6}, {&(0x7f0000002700)=""/231, 0xe7}], 0x5}}], 0x3ffffbd, 0x0, 0x0) (fail_nth: 36) 1.234822778s ago: executing program 4 (id=8880): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{&(0x7f0000000080)={0xa, 0x4e20, 0x900, @local, 0x1}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000040)='n', 0x1}], 0x1}}], 0x1, 0x488c4) (fail_nth: 45) 1.206868138s ago: executing program 0 (id=8881): ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x8b0f, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000009e00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.116027333s ago: executing program 2 (id=8882): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000005c0)=""/4078, 0xfee}, {&(0x7f00000015c0)=""/141, 0x8d}, {&(0x7f0000001680)=""/4116, 0x1005}, {&(0x7f00000026c0)=""/6, 0x6}, {&(0x7f0000002700)=""/231, 0xe7}], 0x5}}], 0x3ffffbd, 0x0, 0x0) (fail_nth: 36) 982.442699ms ago: executing program 2 (id=8883): r0 = socket(0xa, 0x1, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000780)={0x2, 0x6}, 0x4) setsockopt$sock_int(r2, 0x1, 0x2c, &(0x7f00000007c0)=0x2, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, 0x0, 0x17) setsockopt$inet_tcp_buf(r0, 0x6, 0x1f, &(0x7f00000001c0)="3995f6e068", 0x5) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd700000000000010000001c0007800c00018008000100", @ANYRES32=r0, @ANYBLOB="0c00018808000100", @ANYRES32=r0, @ANYBLOB="0c0002"], 0x3c}, 0x1, 0x0, 0x0, 0x55ebfcb85e78e904}, 0xc844) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000380), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000005c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000600)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000640)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000680)=0x0) sendmsg$NFC_CMD_LLC_GET_PARAMS(r1, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x3c, r4, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x800) r10 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r10, 0x107, 0x5, 0x0, 0x0) r11 = socket$packet(0x11, 0x2, 0x300) r12 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r12, &(0x7f0000000180)={0x0, 0x4076cbba9945d516, &(0x7f0000000200)={0x0, 0x14}}, 0x0) getsockname$packet(r12, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0x14) r14 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x10900, 0x0) r15 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r15, &(0x7f0000000080)={0xa, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x70bd27, 0x0, [@sadb_address={0x3, 0x6, 0x33, 0x0, 0x0, @in={0x2, 0x1000}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0xfc, 0xe0000001}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0xfffe, @local}}, @sadb_ident={0x2, 0xa}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$TUNSETIFF(r14, 0x400454ca, &(0x7f0000000040)={'bridge0\x00', 0x2000}) sendmsg$nl_route(r12, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=@newlink={0x38, 0x10, 0x439, 0x10000000, 0x0, {0x0, 0x0, 0x0, r13, 0x69801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x2}}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) sendto$packet(r11, &(0x7f0000000540)="003d80", 0x3, 0x20040081, &(0x7f0000000580)={0x11, 0x88a8, r13, 0x1, 0x0, 0x6, @local}, 0x14) 874.306613ms ago: executing program 4 (id=8884): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)={0x80, 0x12f, 0x400, 0x70bd27, 0x0, {}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x68, 0x18, 0x0, 0x0, @binary="da51e73453db455c30ed2f837f6e3ff433ef721e033393e7e46b101edc6b98a4587a1454a3132d0408e6c28850a8ad366f55c660841d7f90b79eee62a77a68a75db7733ca9f5298ac3c4d45766044475f0744107217161c7bdb31f2bad9a85ab34889a1c"}]}, 0x80}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 571.308484ms ago: executing program 4 (id=8885): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r0, 0xe6905000) mmap(&(0x7f00005d4000/0x4000)=nil, 0x4000, 0xf, 0x12, r0, 0xfffff000) (fail_nth: 13) 529.041115ms ago: executing program 3 (id=8886): r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) connect$802154_dgram(r0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB="b702000010000000bfa300000000000007030000f0feffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db76cf059f40fa2640b6bfb74dd35391b8fa18479da9f4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847db97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ccfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000000000000000000003ba34b611569a451564d3a5400f9097ffe7a37e765be352be71ee24250d6828562c7e24cb763062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89a0000bde05c114e7a020fc1a5fd3eeeb822008b2d7d1cc062b51b0aca4956b557e51a1385cc572b0074b0950fb1437de2590bf99ec7ceb69e1fe2465fce099c992d57b804a22e148ae3411523814aee03ee2df877edfabf4aa94f07c6fdd127e57a8bf7975f2e606c25a299980a6e52fcf7849d45bb38573fbba8afef1aa7a24c805f7aee3e39a3000000000000000000000000000000000000878f88c4742ac490951c36c610a0d266588ec6a0bd300cf160b5a5d9e9fafa49ecc8430832d795e727b7fc2b76e7fc4141fdbb82f45d3cdd3fb8d4b443ab4954fdf5c1b9a6ab3e457f098329307ccb0a1989b6c37509692e952e7244f48bc12569ff8eb30d0f887b85b5ef44fb9a7571319190be0c226ed72f346cc4aa071ae0c72fa8bd00d5590c4f4ba65d0c8e1f4870fe3c414681e41b40163eb1aa2a7429a2208cd6e69c7d959e87da3fd0101159a03ab7fe78881ee7a1ee7a2edff75fb18a181e0c54352be2b7a5b5273198291c28d9141deeb3cdba5d414ae4b0000000000000000000000000009eacd83458d8a606be71970497a4fd4ca3b48ca482ab3804e2fac216b3ba613608b1a465456a33fd08491d337d7344c01cfc9e73"], &(0x7f00000013c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000001400), 0xfffffedf, 0x10, &(0x7f0000001440)}, 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="020000000400000006000000450000000010"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000480)=ANY=[@ANYBLOB="180100001700400000000000ff000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x10, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000540)={r4}, 0xc) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xe, 0x6, &(0x7f0000000240)=ANY=[@ANYBLOB="050000000000000071119100000000008510000002000000850000000900000095000000000000009500a50500000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0x29e, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) 420.667403ms ago: executing program 4 (id=8887): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10) socket(0x10, 0x3, 0xf1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller0\x00', @link_local}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000780)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x35dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x45557e8d}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000900)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0xff, 0xb}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000940)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000980), 0x56) sendmsg$kcm(r5, &(0x7f00000009c0)={&(0x7f0000000a00)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000ac0)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 257.811562ms ago: executing program 3 (id=8888): bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=@udp}, 0x20) close(0x3) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000380)='./file0\x00', 0x0, 0x256aa8b595cb185d}, 0x18) bpf$PROG_BIND_MAP(0x23, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180), 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1a, 0x0, &(0x7f00000014c0)) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x16, 0x13, 0x0, &(0x7f00000018c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000100000000000000bd784982a793e27eb472467ad2eac0e2dc66fe3bc03de64806a3e46aad124ac8f6b9f7403e51d9def3aedbb018c40b5ce7897b0e36f83c2a1309e9709b2f28f30c5333ad707f8a218206e78504b547dee95c000000000d6fba478a4c21e6a31588410731da516dcd77cbe6a53c09a17dd612f57b32"], 0x50) r2 = socket$unix(0x1, 0x2, 0x0) bind$unix(r2, &(0x7f0000000400)=@abs={0x1, 0x0, 0x4e24}, 0x6e) r3 = socket$kcm(0x10, 0x100000000002, 0x4) sendmsg$kcm(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000540)="39000000140081ae00002c000500015601618575e285af0180000000171300883795c04a31ba00001b2cc32b38d3740000ffffffefffffffff", 0x39}], 0x1, 0x0, 0x0, 0xc00e}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x4c, 0x2, 0x6, 0x605, 0x0, 0x0, {0x2, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1000000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0086e311cbf2fb28467ceeed00010300000000000000000000000000000000000000ffe3000000"], 0x48) bpf$MAP_GET_NEXT_KEY(0x3, &(0x7f00000007c0)={r5, &(0x7f0000000800), 0x0}, 0x20) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4000000010003b1528bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="41040000011001002000128008000100676570001400028008000200", @ANYRES32, @ANYBLOB="0800030007000000"], 0x40}, 0x1, 0x0, 0x0, 0x6008009}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=ANY=[@ANYBLOB="4800000040000701fcffffff00000100017c0000040042800c00018006000600800a0000240002800c00148008000d"], 0x48}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$IPCTNL_MSG_CT_GET_STATS(r4, &(0x7f00000009c0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a80)={0x14, 0x5, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0xd}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x440f1}, 0x4008000) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="4c00000009060506009aca5b3434ba428e000000000000000200000405000100070000000900020073797a3000000000240007800c00018008000140ac1414bb0c0002800800014064010101"], 0x4c}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000001c0)={{r5}, &(0x7f0000001980), &(0x7f0000000200)='%-5lx \x00'}, 0x2a) socket$xdp(0x2c, 0x3, 0x0) 71.34872ms ago: executing program 0 (id=8889): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x256, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "00cd04", 0x220, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x5a, 0x1, 0x0, 0x0, [{0xe, 0xa, "a78c000005dc8080a2030003004003493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34060600000000000000dac15084dbaf736b41e5af0502"}, {0x0, 0x1, '\x00'/12}, {0x2, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf3915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}]}}}}}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000005c0)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000008c0), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000900)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) syz_emit_ethernet(0x56, &(0x7f0000000280)={@random="38727ab0f6e1", @remote, @void, {@canfd={0xd, {{0x2, 0x0, 0x1, 0x1}, 0x5, 0x3, 0x0, 0x0, "17251461905f28ae9230ab7b84683e4d19c64a781da2e4bfd95e7ea88520e044b314cc600f8497a4c05ceceb5ef4bc33cb7568b2169ced42383303186d96285d"}}}}, &(0x7f0000000300)={0x0, 0x4, [0x5d0, 0x23c, 0x843, 0xba]}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000940)={'syzkaller1\x00', @broadcast}) write$tun(r2, &(0x7f0000000980)={@void, @val={0x1, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x22, 0x16, 0x65, 0x0, 0x60, 0x2, 0x0, @empty, @broadcast}, "14f3"}}, 0x20) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a80)=ANY=[@ANYBLOB="20000000010301000000000000000000020000000c0002000000000400000001"], 0x20}}, 0x0) 0s ago: executing program 2 (id=8890): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000), 0x4) kernel console output (not intermixed with test programs): .479060][ T426] ? __pfx_ksys_write+0x10/0x10 [ 1102.479092][ T426] __x64_sys_bpf+0xba/0xd0 [ 1102.479122][ T426] do_syscall_64+0x166/0x520 [ 1102.479144][ T426] ? trace_irq_disable+0x3b/0x140 [ 1102.479170][ T426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.479188][ T426] ? clear_bhb_loop+0x70/0xc0 [ 1102.479211][ T426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.479228][ T426] RIP: 0033:0x7f05f819fb19 [ 1102.479247][ T426] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1102.479264][ T426] RSP: 002b:00007f05f8ff1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1102.479286][ T426] RAX: ffffffffffffffda RBX: 00007f05f8425fa0 RCX: 00007f05f819fb19 [ 1102.479301][ T426] RDX: 0000000000000094 RSI: 0000200000000740 RDI: 0000000000000005 [ 1102.479314][ T426] RBP: 00007f05f8ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 1102.479326][ T426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1102.479338][ T426] R13: 00007f05f8426038 R14: 00007f05f8425fa0 R15: 00007ffd40b90a28 [ 1102.479371][ T426] [ 1102.584573][ T7221] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1102.740317][ T6091] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1102.759114][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1103.001964][ T438] netlink: 'syz.2.8381': attribute type 11 has an invalid length. [ 1103.050439][ T441] netlink: 'syz.0.8382': attribute type 1 has an invalid length. [ 1103.051357][ T432] netlink: 'syz.1.8377': attribute type 1 has an invalid length. [ 1103.114805][ T443] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 1103.174799][ T445] sctp: [Deprecated]: syz.4.8380 (pid 445) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1103.174799][ T445] Use struct sctp_sack_info instead [ 1103.185777][ T446] netlink: 'syz.0.8382': attribute type 10 has an invalid length. [ 1103.244420][ T449] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1103.271185][T24912] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1103.309722][ T5641] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1103.372656][ T452] netlink: 'syz.4.8386': attribute type 1 has an invalid length. [ 1103.625244][T24910] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1103.625602][T24910] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1103.688255][ T471] netlink: 'syz.1.8393': attribute type 11 has an invalid length. [ 1103.784656][T24912] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1103.962423][ T482] openvswitch: netlink: IP tunnel dst address not specified [ 1104.009346][ T10] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1104.154898][ T494] netlink: 'syz.2.8401': attribute type 1 has an invalid length. [ 1104.214665][ T498] netlink: 'syz.3.8405': attribute type 11 has an invalid length. [ 1104.290300][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1104.391761][ T506] netlink: 'syz.3.8409': attribute type 1 has an invalid length. [ 1104.485811][ T508] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1104.799667][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1105.273738][ T554] 8021q: adding VLAN 0 to HW filter on device team0 [ 1105.316645][T24912] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1105.428045][ T554] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1105.428155][ T554] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1105.475552][ T554] veth0_macvtap: left promiscuous mode [ 1105.481481][ T554] veth0_macvtap: entered promiscuous mode [ 1105.512671][ T554] A link change request failed with some changes committed already. Interface vx0 may have been left with an inconsistent configuration, please check. [ 1105.709083][ T7225] netdevsim netdevsim0 eth3: set [1, 2] type 2 family 0 port 6081 - 0 [ 1105.709137][ T7225] netdevsim netdevsim0 eth2: set [1, 2] type 2 family 0 port 6081 - 0 [ 1105.709173][ T7225] netdevsim netdevsim0 eth1: set [1, 2] type 2 family 0 port 6081 - 0 [ 1105.709209][ T7225] netdevsim netdevsim0 eth0: set [1, 2] type 2 family 0 port 6081 - 0 [ 1105.956198][ T561] bridge2: entered promiscuous mode [ 1106.544705][ T619] Bluetooth: hci0: Invalid link key type 10 for 66:55:44:33:22:11 [ 1106.666987][ T623] bridge2: entered promiscuous mode [ 1106.667048][ T623] bridge2: entered allmulticast mode [ 1106.839006][T23229] net_ratelimit: 2 callbacks suppressed [ 1106.839027][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1106.844536][ T629] lo speed is unknown, defaulting to 1000 [ 1106.982132][ T641] FAULT_INJECTION: forcing a failure. [ 1106.982132][ T641] name failslab, interval 1, probability 0, space 0, times 0 [ 1106.982163][ T641] CPU: 0 UID: 0 PID: 641 Comm: syz.4.8446 Not tainted syzkaller #0 PREEMPT(full) [ 1106.982185][ T641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1106.982197][ T641] Call Trace: [ 1106.982205][ T641] [ 1106.982214][ T641] dump_stack_lvl+0xe8/0x150 [ 1106.982253][ T641] should_fail_ex+0x3eb/0x540 [ 1106.982282][ T641] ? ovs_flow_alloc+0x103/0x1f0 [ 1106.982307][ T641] should_failslab+0xa8/0x100 [ 1106.982337][ T641] ? ovs_flow_alloc+0x103/0x1f0 [ 1106.982360][ T641] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 1106.982383][ T641] ? ovs_flow_alloc+0x24/0x1f0 [ 1106.982411][ T641] ? kmem_cache_alloc_noprof+0x151/0x600 [ 1106.982433][ T641] ? ovs_flow_alloc+0x103/0x1f0 [ 1106.982465][ T641] ovs_flow_alloc+0x103/0x1f0 [ 1106.982494][ T641] ovs_flow_cmd_new+0x28b/0xea0 [ 1106.982520][ T641] ? __kasan_kmalloc+0x93/0xb0 [ 1106.982550][ T641] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 1106.982631][ T641] ? __kmalloc_noprof+0x387/0x710 [ 1106.982658][ T641] ? __nla_parse+0x40/0x60 [ 1106.982688][ T641] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1106.982711][ T641] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1106.982740][ T641] genl_family_rcv_msg_doit+0x233/0x340 [ 1106.982771][ T641] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1106.982807][ T641] ? bpf_lsm_capable+0x9/0x20 [ 1106.982826][ T641] ? security_capable+0x7e/0x2c0 [ 1106.982862][ T641] genl_rcv_msg+0x614/0x7a0 [ 1106.982893][ T641] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1106.982915][ T641] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 1106.982951][ T641] netlink_rcv_skb+0x226/0x4a0 [ 1106.982979][ T641] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1106.983003][ T641] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1106.983047][ T641] ? down_read+0x2b9/0x320 [ 1106.983076][ T641] genl_rcv+0x28/0x40 [ 1106.983096][ T641] netlink_unicast+0x8ef/0xa80 [ 1106.983142][ T641] netlink_sendmsg+0x7f0/0xb20 [ 1106.983176][ T641] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1106.983208][ T641] ? aa_sock_msg_perm+0x144/0x210 [ 1106.983234][ T641] ? apparmor_socket_sendmsg+0x98/0x360 [ 1106.983264][ T641] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1106.983292][ T641] sock_sendmsg_nosec+0x14e/0x190 [ 1106.983322][ T641] ____sys_sendmsg+0x54e/0x850 [ 1106.983351][ T641] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1106.983384][ T641] ? import_iovec+0x73/0xa0 [ 1106.983413][ T641] ___sys_sendmsg+0x2a5/0x360 [ 1106.983432][ T641] ? __lock_acquire+0x747/0x2de0 [ 1106.983464][ T641] ? __pfx____sys_sendmsg+0x10/0x10 [ 1106.983527][ T641] ? __fget_files+0x3a2/0x420 [ 1106.983551][ T641] ? __fget_files+0x2a/0x420 [ 1106.983593][ T641] __x64_sys_sendmsg+0x1b1/0x290 [ 1106.983618][ T641] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1106.983665][ T641] do_syscall_64+0x166/0x520 [ 1106.983689][ T641] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.983710][ T641] ? clear_bhb_loop+0x70/0xc0 [ 1106.983735][ T641] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1106.983756][ T641] RIP: 0033:0x7f4f4379fb19 [ 1106.983775][ T641] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1106.983794][ T641] RSP: 002b:00007f4f44617028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1106.983816][ T641] RAX: ffffffffffffffda RBX: 00007f4f43a25fa0 RCX: 00007f4f4379fb19 [ 1106.983831][ T641] RDX: 0000000004008094 RSI: 0000200000000140 RDI: 0000000000000003 [ 1106.983845][ T641] RBP: 00007f4f44617090 R08: 0000000000000000 R09: 0000000000000000 [ 1106.983858][ T641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1106.983871][ T641] R13: 00007f4f43a26038 R14: 00007f4f43a25fa0 R15: 00007ffc3ae105c8 [ 1106.983906][ T641] [ 1107.299156][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1107.349645][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1107.805663][ T660] __nla_validate_parse: 41 callbacks suppressed [ 1107.805684][ T660] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8451'. [ 1107.861111][T24912] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1108.247237][ T664] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1108.371565][T23389] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1108.436863][ T690] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1108.436903][ T690] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1108.436944][ T690] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1108.537197][ T698] netlink: 164 bytes leftover after parsing attributes in process `syz.0.8459'. [ 1108.538738][ T664] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1108.768361][ T664] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1108.802613][ T703] netlink: 'syz.1.8460': attribute type 1 has an invalid length. [ 1108.879027][T23389] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1108.956408][ T664] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1109.054007][ T716] netlink: 'syz.0.8467': attribute type 39 has an invalid length. [ 1109.055974][T24912] smbdirect: ib_dev[syz2] removed [ 1109.106823][ T720] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8466'. [ 1109.161829][ T724] Cannot find del_set index 1024 as target [ 1109.184200][ T726] netlink: 16 bytes leftover after parsing attributes in process `syz.0.8467'. [ 1109.234381][ T726] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8467'. [ 1109.389664][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1109.419455][ T735] netlink: 72 bytes leftover after parsing attributes in process `syz.3.8471'. [ 1109.427790][ T737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8472'. [ 1109.428161][ T737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8472'. [ 1109.428420][ T737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8472'. [ 1109.428629][ T737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8472'. [ 1109.486965][ T737] A link change request failed with some changes committed already. Interface vx0 may have been left with an inconsistent configuration, please check. [ 1109.580590][T23229] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.589408][T23229] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.589454][T23229] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.589487][T23229] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.738529][ T749] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1109.899334][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1109.938406][ T762] netlink: 'syz.3.8478': attribute type 1 has an invalid length. [ 1110.033200][ T767] netlink: 'syz.3.8478': attribute type 10 has an invalid length. [ 1110.046404][ T767] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1110.288663][ T772] ip_tables: iptables: counters copy to user failed while replacing table [ 1110.299155][ T772] netlink: 'syz.0.8484': attribute type 2 has an invalid length. [ 1110.454189][ T30] audit: type=1804 audit(1793891898.801:51): pid=788 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.8489" name="/newroot/549/cgroup.controllers" dev="tmpfs" ino=2812 res=1 errno=0 [ 1110.454417][ T30] audit: type=1800 audit(1793891898.801:52): pid=788 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8489" name="cgroup.controllers" dev="tmpfs" ino=2812 res=0 errno=-22 [ 1110.507623][ T30] audit: type=1800 audit(1793891898.851:53): pid=788 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8489" name="cgroup.controllers" dev="tmpfs" ino=2812 res=0 errno=-22 [ 1110.643351][ T799] ip6tnl1: entered promiscuous mode [ 1110.643381][ T799] ip6tnl1: entered allmulticast mode [ 1111.512917][ T816] bridge0: port 1(batadv0) entered disabled state [ 1111.658073][ T822] bridge6: entered promiscuous mode [ 1111.669935][ T7225] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1111.669985][ T7225] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1111.670046][ T7225] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1111.671682][ T832] bridge0: port 1(bridge_slave_0) entered disabled state [ 1111.700031][T23389] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1111.940647][ T7221] net_ratelimit: 4 callbacks suppressed [ 1111.940667][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1112.451687][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1112.959455][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1113.173395][ T897] __nla_validate_parse: 58 callbacks suppressed [ 1113.173416][ T897] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8524'. [ 1113.200808][ T899] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.8524'. [ 1113.305906][ T905] netlink: 160 bytes leftover after parsing attributes in process `syz.4.8526'. [ 1113.308669][ T906] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8525'. [ 1113.371025][ T908] tipc: Enabled bearer , priority 10 [ 1113.405931][ T910] netlink: 'syz.1.8528': attribute type 17 has an invalid length. [ 1113.469084][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1113.621998][ T925] netlink: 256 bytes leftover after parsing attributes in process `syz.4.8532'. [ 1113.622027][ T925] netlink: 256 bytes leftover after parsing attributes in process `syz.4.8532'. [ 1113.652304][ T928] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 1113.799083][ T943] netlink: 160 bytes leftover after parsing attributes in process `syz.1.8538'. [ 1113.960182][ T952] bond0: entered promiscuous mode [ 1113.960208][ T952] bond_slave_0: entered promiscuous mode [ 1113.960427][ T952] bond_slave_1: entered promiscuous mode [ 1113.960657][ T952] syz_tun: entered promiscuous mode [ 1113.960927][ T952] bond0: left promiscuous mode [ 1113.960941][ T952] bond_slave_0: left promiscuous mode [ 1113.964122][ T952] bond_slave_1: left promiscuous mode [ 1113.964364][ T952] syz_tun: left promiscuous mode [ 1113.992430][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1114.198170][ T972] FAULT_INJECTION: forcing a failure. [ 1114.198170][ T972] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1114.198198][ T972] CPU: 0 UID: 0 PID: 972 Comm: syz.3.8546 Not tainted syzkaller #0 PREEMPT(full) [ 1114.198220][ T972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1114.198233][ T972] Call Trace: [ 1114.198240][ T972] [ 1114.198250][ T972] dump_stack_lvl+0xe8/0x150 [ 1114.198284][ T972] should_fail_ex+0x3eb/0x540 [ 1114.198311][ T972] _copy_to_user+0x31/0xb0 [ 1114.198337][ T972] bpf_verifier_vlog+0x3a2/0x900 [ 1114.198369][ T972] verbose+0x11d/0x1a0 [ 1114.198398][ T972] ? __pfx_verbose+0x10/0x10 [ 1114.198424][ T972] ? kasan_save_track+0x4f/0x80 [ 1114.198453][ T972] ? lock_acquire+0x115/0x350 [ 1114.198487][ T972] print_bpf_insn+0x197b/0x2a90 [ 1114.198511][ T972] ? __pfx_verbose+0x10/0x10 [ 1114.198540][ T972] ? __pfx_print_bpf_insn+0x10/0x10 [ 1114.198561][ T972] ? _copy_to_user+0x8a/0xb0 [ 1114.198585][ T972] ? bpf_verifier_vlog+0x55a/0x900 [ 1114.198618][ T972] ? bpf_verifier_log_write+0x11d/0x1a0 [ 1114.198642][ T972] bpf_verbose_insn+0xcb/0x130 [ 1114.198677][ T972] ? __pfx_bpf_verbose_insn+0x10/0x10 [ 1114.198702][ T972] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1114.198726][ T972] ? __pfx_verbose+0x10/0x10 [ 1114.198749][ T972] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 1114.198780][ T972] ? arg_track_eq+0xd9/0x7a0 [ 1114.198807][ T972] analyze_subprog+0x3160/0xac60 [ 1114.198884][ T972] ? __pfx_analyze_subprog+0x10/0x10 [ 1114.198909][ T972] ? kasan_save_track+0x4f/0x80 [ 1114.198932][ T972] ? kasan_save_track+0x3e/0x80 [ 1114.198956][ T972] ? __kasan_kmalloc+0x93/0xb0 [ 1114.198980][ T972] ? __kvmalloc_node_noprof+0x50a/0x820 [ 1114.199004][ T972] ? call_instance+0x263/0x560 [ 1114.199027][ T972] ? bpf_compute_subprog_arg_access+0x2cb/0x15c0 [ 1114.199052][ T972] ? bpf_compute_live_registers+0x10b0/0x1df0 [ 1114.199077][ T972] ? bpf_check+0x2d0b/0x34e0 [ 1114.199095][ T972] ? bpf_prog_load+0x14da/0x1c60 [ 1114.199113][ T972] ? __sys_bpf+0xd86/0xe00 [ 1114.199128][ T972] ? __x64_sys_bpf+0xba/0xd0 [ 1114.199151][ T972] ? do_syscall_64+0x166/0x520 [ 1114.199173][ T972] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1114.199230][ T972] ? call_instance+0x263/0x560 [ 1114.199253][ T972] ? rcu_is_watching+0x16/0xb0 [ 1114.199280][ T972] ? call_instance+0x263/0x560 [ 1114.199302][ T972] ? trace_kmalloc+0x2a/0xf0 [ 1114.199325][ T972] ? call_instance+0x263/0x560 [ 1114.199348][ T972] ? __kvmalloc_node_noprof+0x52a/0x820 [ 1114.199375][ T972] ? __kvmalloc_node_noprof+0x340/0x820 [ 1114.199399][ T972] ? call_instance+0x263/0x560 [ 1114.199421][ T972] ? call_instance+0x263/0x560 [ 1114.199463][ T972] bpf_compute_subprog_arg_access+0x2f1/0x15c0 [ 1114.199514][ T972] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1114.199547][ T972] ? __kvmalloc_node_noprof+0x340/0x820 [ 1114.199572][ T972] ? bpf_compute_live_registers+0x142/0x1df0 [ 1114.199596][ T972] ? bpf_compute_live_registers+0x142/0x1df0 [ 1114.199629][ T972] bpf_compute_live_registers+0x10b0/0x1df0 [ 1114.199687][ T972] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1114.199726][ T972] bpf_check+0x2d0b/0x34e0 [ 1114.199758][ T972] ? ktime_get_with_offset+0x93/0x2d0 [ 1114.199786][ T972] ? ktime_get_with_offset+0x93/0x2d0 [ 1114.199814][ T972] ? __pfx_bpf_check+0x10/0x10 [ 1114.199838][ T972] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1114.199868][ T972] bpf_prog_load+0x14da/0x1c60 [ 1114.199900][ T972] ? __pfx_bpf_prog_load+0x10/0x10 [ 1114.199934][ T972] ? __might_fault+0xaf/0x130 [ 1114.199961][ T972] __sys_bpf+0xd86/0xe00 [ 1114.199990][ T972] ? __pfx___sys_bpf+0x10/0x10 [ 1114.200022][ T972] ? __fget_files+0x2a/0x420 [ 1114.200065][ T972] ? ksys_write+0x242/0x270 [ 1114.200092][ T972] ? __pfx_ksys_write+0x10/0x10 [ 1114.200124][ T972] __x64_sys_bpf+0xba/0xd0 [ 1114.200155][ T972] do_syscall_64+0x166/0x520 [ 1114.200177][ T972] ? trace_irq_disable+0x3b/0x140 [ 1114.200204][ T972] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1114.200225][ T972] ? clear_bhb_loop+0x70/0xc0 [ 1114.200250][ T972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1114.200270][ T972] RIP: 0033:0x7f544599fb19 [ 1114.200289][ T972] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1114.200307][ T972] RSP: 002b:00007f54468fa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1114.200328][ T972] RAX: ffffffffffffffda RBX: 00007f5445c25fa0 RCX: 00007f544599fb19 [ 1114.200341][ T972] RDX: 0000000000000078 RSI: 0000200000000700 RDI: 0000000000000005 [ 1114.200353][ T972] RBP: 00007f54468fa090 R08: 0000000000000000 R09: 0000000000000000 [ 1114.200366][ T972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1114.200377][ T972] R13: 00007f5445c26038 R14: 00007f5445c25fa0 R15: 00007ffd682cba98 [ 1114.200410][ T972] [ 1114.243579][ T973] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8545'. [ 1114.282731][ T973] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1114.287063][ T973] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8545'. [ 1114.341299][ T977] x_tables: unsorted underflow at hook 3 [ 1114.344796][ T977] x_tables: duplicate underflow at hook 2 [ 1114.476902][ T983] netlink: 160 bytes leftover after parsing attributes in process `syz.2.8549'. [ 1114.511882][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1114.583239][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1114.676124][ T989] netlink: 'syz.2.8551': attribute type 30 has an invalid length. [ 1114.694267][ T989] vxlan0: entered promiscuous mode [ 1114.694288][ T989] vxlan0: entered allmulticast mode [ 1114.721444][ T7211] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1114.721491][ T7211] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1114.721525][ T7211] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1114.721557][ T7211] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1114.795188][ T991] syzkaller0: entered promiscuous mode [ 1114.795222][ T991] syzkaller0: entered allmulticast mode [ 1114.818497][ T991] FAULT_INJECTION: forcing a failure. [ 1114.818497][ T991] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1114.818526][ T991] CPU: 1 UID: 0 PID: 991 Comm: syz.3.8550 Not tainted syzkaller #0 PREEMPT(full) [ 1114.818548][ T991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1114.818567][ T991] Call Trace: [ 1114.818577][ T991] [ 1114.818585][ T991] dump_stack_lvl+0xe8/0x150 [ 1114.818621][ T991] should_fail_ex+0x3eb/0x540 [ 1114.818650][ T991] _copy_from_user+0x2d/0xb0 [ 1114.818677][ T991] ___sys_sendmsg+0x1c6/0x360 [ 1114.818698][ T991] ? __lock_acquire+0x747/0x2de0 [ 1114.818728][ T991] ? __pfx____sys_sendmsg+0x10/0x10 [ 1114.818787][ T991] ? __fget_files+0x3a2/0x420 [ 1114.818810][ T991] ? __fget_files+0x2a/0x420 [ 1114.818843][ T991] __x64_sys_sendmsg+0x1b1/0x290 [ 1114.818867][ T991] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1114.818911][ T991] do_syscall_64+0x166/0x520 [ 1114.818933][ T991] ? trace_irq_disable+0x3b/0x140 [ 1114.818963][ T991] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1114.818984][ T991] ? clear_bhb_loop+0x70/0xc0 [ 1114.819008][ T991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1114.819028][ T991] RIP: 0033:0x7f544599fb19 [ 1114.819046][ T991] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1114.819064][ T991] RSP: 002b:00007f54468fa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1114.819085][ T991] RAX: ffffffffffffffda RBX: 00007f5445c25fa0 RCX: 00007f544599fb19 [ 1114.819100][ T991] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000006 [ 1114.819114][ T991] RBP: 00007f54468fa090 R08: 0000000000000000 R09: 0000000000000000 [ 1114.819127][ T991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1114.819139][ T991] R13: 00007f5445c26038 R14: 00007f5445c25fa0 R15: 00007ffd682cba98 [ 1114.819172][ T991] [ 1115.013082][ T993] netlink: 'syz.2.8552': attribute type 1 has an invalid length. [ 1115.032367][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1115.186668][ T1003] x_tables: unsorted underflow at hook 3 [ 1115.187455][ T1003] x_tables: duplicate underflow at hook 2 [ 1115.330108][ T1009] bond0: entered promiscuous mode [ 1115.330134][ T1009] bond_slave_0: entered promiscuous mode [ 1115.330343][ T1009] bond_slave_1: entered promiscuous mode [ 1115.332697][ T1009] bond0: left promiscuous mode [ 1115.332719][ T1009] bond_slave_0: left promiscuous mode [ 1115.332916][ T1009] bond_slave_1: left promiscuous mode [ 1115.529120][ T7222] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1115.591391][ T1020] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1115.640366][ T1020] x_tables: unsorted underflow at hook 2 [ 1116.791226][ T1054] x_tables: duplicate underflow at hook 3 [ 1117.060408][T23229] net_ratelimit: 4 callbacks suppressed [ 1117.060432][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1117.569042][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1118.079000][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1118.322719][ T1067] bond0: entered promiscuous mode [ 1118.325713][ T1067] bond0: left promiscuous mode [ 1118.406840][ T1074] netlink: 'syz.2.8576': attribute type 1 has an invalid length. [ 1118.543393][ T1081] FAULT_INJECTION: forcing a failure. [ 1118.543393][ T1081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1118.543423][ T1081] CPU: 0 UID: 0 PID: 1081 Comm: syz.1.8580 Not tainted syzkaller #0 PREEMPT(full) [ 1118.543446][ T1081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1118.543458][ T1081] Call Trace: [ 1118.543467][ T1081] [ 1118.543476][ T1081] dump_stack_lvl+0xe8/0x150 [ 1118.543513][ T1081] should_fail_ex+0x3eb/0x540 [ 1118.543543][ T1081] _copy_from_iter+0x1d3/0x1680 [ 1118.543567][ T1081] ? __alloc_skb+0x27a/0x7a0 [ 1118.543599][ T1081] ? __alloc_skb+0x27a/0x7a0 [ 1118.543630][ T1081] ? __alloc_skb+0x27a/0x7a0 [ 1118.543659][ T1081] ? __pfx__copy_from_iter+0x10/0x10 [ 1118.543680][ T1081] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 1118.543701][ T1081] ? __alloc_skb+0x27a/0x7a0 [ 1118.543728][ T1081] ? __alloc_skb+0x27a/0x7a0 [ 1118.543763][ T1081] ? netlink_sendmsg+0x64f/0xb20 [ 1118.543791][ T1081] ? skb_put+0x112/0x210 [ 1118.543814][ T1081] netlink_sendmsg+0x6bb/0xb20 [ 1118.543849][ T1081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1118.543881][ T1081] ? aa_sock_msg_perm+0x144/0x210 [ 1118.543907][ T1081] ? apparmor_socket_sendmsg+0x98/0x360 [ 1118.543936][ T1081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1118.543964][ T1081] sock_sendmsg_nosec+0x14e/0x190 [ 1118.543994][ T1081] ____sys_sendmsg+0x54e/0x850 [ 1118.544021][ T1081] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1118.544052][ T1081] ? import_iovec+0x73/0xa0 [ 1118.544082][ T1081] ___sys_sendmsg+0x2a5/0x360 [ 1118.544101][ T1081] ? __lock_acquire+0x747/0x2de0 [ 1118.544131][ T1081] ? __pfx____sys_sendmsg+0x10/0x10 [ 1118.544197][ T1081] ? __fget_files+0x3a2/0x420 [ 1118.544219][ T1081] ? __fget_files+0x2a/0x420 [ 1118.544251][ T1081] __x64_sys_sendmsg+0x1b1/0x290 [ 1118.544276][ T1081] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1118.544316][ T1081] do_syscall_64+0x166/0x520 [ 1118.544337][ T1081] ? trace_irq_disable+0x3b/0x140 [ 1118.544362][ T1081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.544383][ T1081] ? clear_bhb_loop+0x70/0xc0 [ 1118.544407][ T1081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.544427][ T1081] RIP: 0033:0x7f05f819fb19 [ 1118.544447][ T1081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1118.544465][ T1081] RSP: 002b:00007f05f8ff1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1118.544487][ T1081] RAX: ffffffffffffffda RBX: 00007f05f8425fa0 RCX: 00007f05f819fb19 [ 1118.544501][ T1081] RDX: 0000000000000040 RSI: 0000200000001480 RDI: 0000000000000003 [ 1118.544513][ T1081] RBP: 00007f05f8ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 1118.544526][ T1081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1118.544538][ T1081] R13: 00007f05f8426038 R14: 00007f05f8425fa0 R15: 00007ffd40b90a28 [ 1118.544571][ T1081] [ 1118.600279][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1118.769387][ T1088] FAULT_INJECTION: forcing a failure. [ 1118.769387][ T1088] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1118.769416][ T1088] CPU: 1 UID: 0 PID: 1088 Comm: syz.1.8582 Not tainted syzkaller #0 PREEMPT(full) [ 1118.769441][ T1088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1118.769453][ T1088] Call Trace: [ 1118.769460][ T1088] [ 1118.769469][ T1088] dump_stack_lvl+0xe8/0x150 [ 1118.769507][ T1088] should_fail_ex+0x3eb/0x540 [ 1118.769536][ T1088] _copy_to_user+0x31/0xb0 [ 1118.769565][ T1088] simple_read_from_buffer+0xe1/0x170 [ 1118.769595][ T1088] proc_fail_nth_read+0x1bb/0x230 [ 1118.769629][ T1088] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1118.769663][ T1088] ? rw_verify_area+0x24a/0x4c0 [ 1118.769696][ T1088] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1118.769725][ T1088] vfs_read+0x213/0xa80 [ 1118.769756][ T1088] ? __pfx___mutex_lock+0x10/0x10 [ 1118.769780][ T1088] ? __pfx_vfs_read+0x10/0x10 [ 1118.769807][ T1088] ? __fget_files+0x2a/0x420 [ 1118.769829][ T1088] ? __fget_files+0x3a2/0x420 [ 1118.769851][ T1088] ? __fget_files+0x2a/0x420 [ 1118.769878][ T1088] ? fdget+0x1ac/0x250 [ 1118.769909][ T1088] ksys_read+0x150/0x270 [ 1118.769936][ T1088] ? __pfx_ksys_read+0x10/0x10 [ 1118.769977][ T1088] do_syscall_64+0x166/0x520 [ 1118.769999][ T1088] ? trace_irq_disable+0x3b/0x140 [ 1118.770025][ T1088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.770045][ T1088] ? clear_bhb_loop+0x70/0xc0 [ 1118.770070][ T1088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.770089][ T1088] RIP: 0033:0x7f05f816034e [ 1118.770108][ T1088] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1118.770126][ T1088] RSP: 002b:00007f05f8ff0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1118.770146][ T1088] RAX: ffffffffffffffda RBX: 00007f05f8ff16c0 RCX: 00007f05f816034e [ 1118.770178][ T1088] RDX: 000000000000000f RSI: 00007f05f8ff10a0 RDI: 0000000000000004 [ 1118.770190][ T1088] RBP: 00007f05f8ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 1118.770203][ T1088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1118.770215][ T1088] R13: 00007f05f8426038 R14: 00007f05f8425fa0 R15: 00007ffd40b90a28 [ 1118.770249][ T1088] [ 1118.931538][ T1091] FAULT_INJECTION: forcing a failure. [ 1118.931538][ T1091] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1118.931570][ T1091] CPU: 1 UID: 0 PID: 1091 Comm: syz.4.8583 Not tainted syzkaller #0 PREEMPT(full) [ 1118.931592][ T1091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1118.931605][ T1091] Call Trace: [ 1118.931613][ T1091] [ 1118.931621][ T1091] dump_stack_lvl+0xe8/0x150 [ 1118.931657][ T1091] should_fail_ex+0x3eb/0x540 [ 1118.931690][ T1091] _copy_from_user+0x2d/0xb0 [ 1118.931716][ T1091] bpf_prog_test_run_skb+0x1842/0x22c0 [ 1118.931773][ T1091] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1118.931801][ T1091] bpf_prog_test_run+0x2c5/0x340 [ 1118.931826][ T1091] __sys_bpf+0xb1e/0xe00 [ 1118.931854][ T1091] ? __pfx___sys_bpf+0x10/0x10 [ 1118.931884][ T1091] ? __fget_files+0x2a/0x420 [ 1118.931927][ T1091] ? ksys_write+0x242/0x270 [ 1118.931954][ T1091] ? __pfx_ksys_write+0x10/0x10 [ 1118.931984][ T1091] __x64_sys_bpf+0xba/0xd0 [ 1118.932015][ T1091] do_syscall_64+0x166/0x520 [ 1118.932038][ T1091] ? trace_irq_disable+0x3b/0x140 [ 1118.932063][ T1091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.932084][ T1091] ? clear_bhb_loop+0x70/0xc0 [ 1118.932107][ T1091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.932127][ T1091] RIP: 0033:0x7f4f4379fb19 [ 1118.932145][ T1091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1118.932161][ T1091] RSP: 002b:00007f4f44617028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1118.932182][ T1091] RAX: ffffffffffffffda RBX: 00007f4f43a25fa0 RCX: 00007f4f4379fb19 [ 1118.932202][ T1091] RDX: 0000000000000050 RSI: 00002000000011c0 RDI: 000000000000000a [ 1118.932214][ T1091] RBP: 00007f4f44617090 R08: 0000000000000000 R09: 0000000000000000 [ 1118.932226][ T1091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1118.932238][ T1091] R13: 00007f4f43a26038 R14: 00007f4f43a25fa0 R15: 00007ffc3ae105c8 [ 1118.932277][ T1091] [ 1119.109549][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1119.612587][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1119.665249][ T1121] __nla_validate_parse: 5 callbacks suppressed [ 1119.665272][ T1121] netlink: 156 bytes leftover after parsing attributes in process `syz.0.8589'. [ 1119.896177][ T1146] netlink: 'syz.4.8595': attribute type 10 has an invalid length. [ 1119.896203][ T1146] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8595'. [ 1120.129053][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1120.639286][ T7222] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1120.887944][ T1182] syzkaller0: entered promiscuous mode [ 1120.887970][ T1182] syzkaller0: entered allmulticast mode [ 1120.906945][ T1182] IPVS: set_ctl: invalid protocol: 41 172.20.20.170:20001 [ 1121.117762][ T1195] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8610'. [ 1121.149035][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1121.659220][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1122.169037][ T7222] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1122.678944][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1123.139659][ T1162] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1123.193890][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1123.515431][ T1221] syzkaller1: entered promiscuous mode [ 1123.515457][ T1221] syzkaller1: entered allmulticast mode [ 1123.555070][ T1222] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1123.620342][ T1224] syzkaller1: entered promiscuous mode [ 1123.620365][ T1224] syzkaller1: entered allmulticast mode [ 1123.699096][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1124.209223][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1124.719324][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1125.229623][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1125.739136][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1126.249717][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1126.423654][ T1237] FAULT_INJECTION: forcing a failure. [ 1126.423654][ T1237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1126.423685][ T1237] CPU: 0 UID: 0 PID: 1237 Comm: syz.1.8625 Not tainted syzkaller #0 PREEMPT(full) [ 1126.423708][ T1237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1126.423721][ T1237] Call Trace: [ 1126.423729][ T1237] [ 1126.423738][ T1237] dump_stack_lvl+0xe8/0x150 [ 1126.423781][ T1237] should_fail_ex+0x3eb/0x540 [ 1126.423812][ T1237] _copy_from_user+0x2d/0xb0 [ 1126.423839][ T1237] ___sys_recvmsg+0x173/0x5a0 [ 1126.423869][ T1237] ? __pfx____sys_recvmsg+0x10/0x10 [ 1126.423897][ T1237] ? lock_acquire+0x115/0x350 [ 1126.423956][ T1237] do_recvmmsg+0x31a/0x800 [ 1126.423989][ T1237] ? __pfx_do_recvmmsg+0x10/0x10 [ 1126.424025][ T1237] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1126.424055][ T1237] ? fdget+0x1ac/0x250 [ 1126.424091][ T1237] __x64_sys_recvmmsg+0x198/0x250 [ 1126.424118][ T1237] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1126.424155][ T1237] do_syscall_64+0x166/0x520 [ 1126.424177][ T1237] ? trace_irq_disable+0x3b/0x140 [ 1126.424206][ T1237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.424227][ T1237] ? clear_bhb_loop+0x70/0xc0 [ 1126.424251][ T1237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1126.424271][ T1237] RIP: 0033:0x7f05f819fb19 [ 1126.424295][ T1237] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1126.424312][ T1237] RSP: 002b:00007f05f8ff1028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1126.424340][ T1237] RAX: ffffffffffffffda RBX: 00007f05f8425fa0 RCX: 00007f05f819fb19 [ 1126.424354][ T1237] RDX: 0000000003ffffbd RSI: 00002000000000c0 RDI: 0000000000000004 [ 1126.424367][ T1237] RBP: 00007f05f8ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 1126.424380][ T1237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1126.424391][ T1237] R13: 00007f05f8426038 R14: 00007f05f8425fa0 R15: 00007ffd40b90a28 [ 1126.424431][ T1237] [ 1126.962024][ T1258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8632'. [ 1127.122787][ T1269] FAULT_INJECTION: forcing a failure. [ 1127.122787][ T1269] name failslab, interval 1, probability 0, space 0, times 0 [ 1127.122817][ T1269] CPU: 1 UID: 0 PID: 1269 Comm: syz.1.8635 Not tainted syzkaller #0 PREEMPT(full) [ 1127.122839][ T1269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1127.122850][ T1269] Call Trace: [ 1127.122859][ T1269] [ 1127.122867][ T1269] dump_stack_lvl+0xe8/0x150 [ 1127.122904][ T1269] should_fail_ex+0x3eb/0x540 [ 1127.122936][ T1269] should_failslab+0xa8/0x100 [ 1127.122967][ T1269] __kmalloc_cache_noprof+0x9e/0x600 [ 1127.122991][ T1269] ? __kmalloc_cache_noprof+0x148/0x600 [ 1127.123013][ T1269] ? sctp_add_bind_addr+0x8c/0x370 [ 1127.123034][ T1269] ? sctp_add_bind_addr+0x8c/0x370 [ 1127.123062][ T1269] sctp_add_bind_addr+0x8c/0x370 [ 1127.123088][ T1269] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1127.123114][ T1269] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1127.123138][ T1269] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1127.123164][ T1269] ? sctp_v6_is_any+0x64/0x80 [ 1127.123189][ T1269] ? sctp_copy_one_addr+0x93/0x360 [ 1127.123213][ T1269] sctp_bind_addr_copy+0xb3/0x3c0 [ 1127.123235][ T1269] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1127.123270][ T1269] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1127.123299][ T1269] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1127.123334][ T1269] ? __local_bh_enable_ip+0xd6/0x140 [ 1127.123360][ T1269] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1127.123386][ T1269] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1127.123417][ T1269] sctp_sendmsg+0x159b/0x2d00 [ 1127.123459][ T1269] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1127.123510][ T1269] ? aa_sock_msg_perm+0xf5/0x210 [ 1127.123528][ T1269] ? sock_rps_record_flow+0x19/0x350 [ 1127.123553][ T1269] ? inet_sendmsg+0x298/0x320 [ 1127.123576][ T1269] ? __pfx_inet_sendmsg+0x10/0x10 [ 1127.123596][ T1269] sock_sendmsg_nosec+0x10f/0x190 [ 1127.123627][ T1269] ____sys_sendmsg+0x54e/0x850 [ 1127.123662][ T1269] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1127.123693][ T1269] ? import_iovec+0x73/0xa0 [ 1127.123721][ T1269] ___sys_sendmsg+0x2a5/0x360 [ 1127.123740][ T1269] ? __lock_acquire+0x747/0x2de0 [ 1127.123769][ T1269] ? __pfx____sys_sendmsg+0x10/0x10 [ 1127.123824][ T1269] ? __fget_files+0x3a2/0x420 [ 1127.123845][ T1269] ? __fget_files+0x2a/0x420 [ 1127.123874][ T1269] __x64_sys_sendmsg+0x1b1/0x290 [ 1127.123897][ T1269] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1127.123937][ T1269] do_syscall_64+0x166/0x520 [ 1127.123960][ T1269] ? trace_irq_disable+0x3b/0x140 [ 1127.123986][ T1269] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1127.124005][ T1269] ? clear_bhb_loop+0x70/0xc0 [ 1127.124030][ T1269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1127.124049][ T1269] RIP: 0033:0x7f05f819fb19 [ 1127.124068][ T1269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1127.124084][ T1269] RSP: 002b:00007f05f8ff1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1127.124105][ T1269] RAX: ffffffffffffffda RBX: 00007f05f8425fa0 RCX: 00007f05f819fb19 [ 1127.124119][ T1269] RDX: 0000000024000052 RSI: 0000200000000040 RDI: 0000000000000003 [ 1127.124131][ T1269] RBP: 00007f05f8ff1090 R08: 0000000000000000 R09: 0000000000000000 [ 1127.124143][ T1269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1127.124154][ T1269] R13: 00007f05f8426038 R14: 00007f05f8425fa0 R15: 00007ffd40b90a28 [ 1127.124187][ T1269] [ 1127.281409][ T7211] net_ratelimit: 1 callbacks suppressed [ 1127.281429][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1127.670649][ T1284] netlink: 'syz.4.8640': attribute type 1 has an invalid length. [ 1127.783710][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1128.043840][ T1304] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8646'. [ 1128.289808][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1128.316499][ T1322] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1128.347407][ T1322] FAULT_INJECTION: forcing a failure. [ 1128.347407][ T1322] name failslab, interval 1, probability 0, space 0, times 0 [ 1128.347439][ T1322] CPU: 1 UID: 0 PID: 1322 Comm: syz.3.8653 Not tainted syzkaller #0 PREEMPT(full) [ 1128.347461][ T1322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1128.347473][ T1322] Call Trace: [ 1128.347481][ T1322] [ 1128.347489][ T1322] dump_stack_lvl+0xe8/0x150 [ 1128.347527][ T1322] should_fail_ex+0x3eb/0x540 [ 1128.347556][ T1322] should_failslab+0xa8/0x100 [ 1128.347587][ T1322] __kmalloc_cache_noprof+0x9e/0x600 [ 1128.347624][ T1322] ? __kmalloc_cache_noprof+0x148/0x600 [ 1128.347647][ T1322] ? sctp_add_bind_addr+0x8c/0x370 [ 1128.347669][ T1322] ? sctp_add_bind_addr+0x8c/0x370 [ 1128.347699][ T1322] sctp_add_bind_addr+0x8c/0x370 [ 1128.347728][ T1322] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1128.347755][ T1322] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1128.347781][ T1322] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1128.347807][ T1322] ? sctp_v6_is_any+0x64/0x80 [ 1128.347836][ T1322] ? sctp_copy_one_addr+0x93/0x360 [ 1128.347863][ T1322] sctp_bind_addr_copy+0x189/0x3c0 [ 1128.347896][ T1322] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1128.347928][ T1322] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1128.347970][ T1322] ? __local_bh_enable_ip+0xd6/0x140 [ 1128.347996][ T1322] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1128.348023][ T1322] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1128.348055][ T1322] sctp_sendmsg+0x159b/0x2d00 [ 1128.348093][ T1322] ? kstrtouint+0x6e/0xe0 [ 1128.348124][ T1322] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1128.348150][ T1322] ? lock_acquire+0x115/0x350 [ 1128.348199][ T1322] ? aa_sock_msg_perm+0xf5/0x210 [ 1128.348218][ T1322] ? sock_rps_record_flow+0x19/0x350 [ 1128.348244][ T1322] ? inet_sendmsg+0x298/0x320 [ 1128.348269][ T1322] ? __pfx_inet_sendmsg+0x10/0x10 [ 1128.348289][ T1322] sock_sendmsg_nosec+0x10f/0x190 [ 1128.348320][ T1322] __sys_sendto+0x408/0x5a0 [ 1128.348350][ T1322] ? ksys_write+0x1e6/0x270 [ 1128.348381][ T1322] ? __pfx___sys_sendto+0x10/0x10 [ 1128.348406][ T1322] ? __mutex_unlock_slowpath+0x731/0x900 [ 1128.348444][ T1322] ? fdget+0x1ac/0x250 [ 1128.348484][ T1322] ? __pfx_ksys_write+0x10/0x10 [ 1128.348517][ T1322] __x64_sys_sendto+0xde/0x100 [ 1128.348552][ T1322] do_syscall_64+0x166/0x520 [ 1128.348575][ T1322] ? trace_irq_disable+0x3b/0x140 [ 1128.348602][ T1322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1128.348630][ T1322] ? clear_bhb_loop+0x70/0xc0 [ 1128.348656][ T1322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1128.348676][ T1322] RIP: 0033:0x7f544599fb19 [ 1128.348696][ T1322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1128.348715][ T1322] RSP: 002b:00007f54468fa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1128.348737][ T1322] RAX: ffffffffffffffda RBX: 00007f5445c25fa0 RCX: 00007f544599fb19 [ 1128.348753][ T1322] RDX: 0000000000034000 RSI: 0000200000002880 RDI: 0000000000000009 [ 1128.348767][ T1322] RBP: 00007f54468fa090 R08: 00002000000028c0 R09: 000000000000001c [ 1128.348781][ T1322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1128.348792][ T1322] R13: 00007f5445c26038 R14: 00007f5445c25fa0 R15: 00007ffd682cba98 [ 1128.348823][ T1322] [ 1128.662593][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1128.772521][ T1341] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8659'. [ 1128.772560][ T1341] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8659'. [ 1128.795659][ T1341] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8659'. [ 1128.809507][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1129.066677][ T1362] ip_tables: iptables: counters copy to user failed while replacing table [ 1129.205990][ T1368] netlink: 'syz.0.8665': attribute type 1 has an invalid length. [ 1129.251161][ T1368] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1129.267676][ T1368] netlink: 'syz.0.8665': attribute type 10 has an invalid length. [ 1129.267701][ T1368] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8665'. [ 1129.319238][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1129.462354][ T1377] FAULT_INJECTION: forcing a failure. [ 1129.462354][ T1377] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1129.462393][ T1377] CPU: 1 UID: 0 PID: 1377 Comm: syz.0.8669 Not tainted syzkaller #0 PREEMPT(full) [ 1129.462414][ T1377] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1129.462427][ T1377] Call Trace: [ 1129.462435][ T1377] [ 1129.462443][ T1377] dump_stack_lvl+0xe8/0x150 [ 1129.462481][ T1377] should_fail_ex+0x3eb/0x540 [ 1129.462511][ T1377] _copy_from_iter+0x1d3/0x1680 [ 1129.462539][ T1377] ? lock_acquire+0x115/0x350 [ 1129.462568][ T1377] ? __lock_acquire+0x747/0x2de0 [ 1129.462593][ T1377] ? __pfx__copy_from_iter+0x10/0x10 [ 1129.462634][ T1377] tun_get_user+0x265/0x4470 [ 1129.462675][ T1377] ? aa_file_perm+0x18b/0x15f0 [ 1129.462702][ T1377] ? aa_file_perm+0x4ed/0x15f0 [ 1129.462720][ T1377] ? __pfx_tun_get_user+0x10/0x10 [ 1129.462747][ T1377] ? __lock_acquire+0x747/0x2de0 [ 1129.462774][ T1377] ? kstrtoull+0x137/0x1d0 [ 1129.462813][ T1377] ? ref_tracker_alloc+0x172/0x530 [ 1129.462839][ T1377] ? lock_acquire+0x115/0x350 [ 1129.462864][ T1377] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1129.462892][ T1377] ? lock_acquire+0x115/0x350 [ 1129.462917][ T1377] ? tun_get+0x1c/0x2f0 [ 1129.462946][ T1377] ? tun_get+0x1c/0x2f0 [ 1129.462968][ T1377] ? tun_get+0x1c/0x2f0 [ 1129.462996][ T1377] tun_chr_write_iter+0x113/0x200 [ 1129.463023][ T1377] vfs_write+0x612/0xba0 [ 1129.463058][ T1377] ? __pfx_vfs_write+0x10/0x10 [ 1129.463087][ T1377] ? __fget_files+0x3a2/0x420 [ 1129.463110][ T1377] ? __fget_files+0x2a/0x420 [ 1129.463138][ T1377] ? fdget+0x1ac/0x250 [ 1129.463169][ T1377] ksys_write+0x150/0x270 [ 1129.463197][ T1377] ? __pfx_ksys_write+0x10/0x10 [ 1129.463235][ T1377] do_syscall_64+0x166/0x520 [ 1129.463258][ T1377] ? trace_irq_disable+0x3b/0x140 [ 1129.463289][ T1377] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1129.463310][ T1377] ? clear_bhb_loop+0x70/0xc0 [ 1129.463335][ T1377] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1129.463356][ T1377] RIP: 0033:0x7f315bd9fb19 [ 1129.463375][ T1377] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1129.463399][ T1377] RSP: 002b:00007f315ccc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1129.463421][ T1377] RAX: ffffffffffffffda RBX: 00007f315c025fa0 RCX: 00007f315bd9fb19 [ 1129.463436][ T1377] RDX: 0000000000000046 RSI: 0000200000000ac0 RDI: 0000000000000003 [ 1129.463449][ T1377] RBP: 00007f315ccc4090 R08: 0000000000000000 R09: 0000000000000000 [ 1129.463463][ T1377] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1129.463475][ T1377] R13: 00007f315c026038 R14: 00007f315c025fa0 R15: 00007ffc356e0f48 [ 1129.463509][ T1377] [ 1129.594782][ T1383] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8672'. [ 1129.784703][ T1391] netlink: 'syz.0.8674': attribute type 9 has an invalid length. [ 1129.831144][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1129.882170][ T1396] ip_tables: iptables: counters copy to user failed while replacing table [ 1129.901759][ T1396] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8678'. [ 1130.133600][ T1410] FAULT_INJECTION: forcing a failure. [ 1130.133600][ T1410] name failslab, interval 1, probability 0, space 0, times 0 [ 1130.133630][ T1410] CPU: 0 UID: 0 PID: 1410 Comm: syz.4.8680 Not tainted syzkaller #0 PREEMPT(full) [ 1130.133653][ T1410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1130.133665][ T1410] Call Trace: [ 1130.133673][ T1410] [ 1130.133682][ T1410] dump_stack_lvl+0xe8/0x150 [ 1130.133719][ T1410] should_fail_ex+0x3eb/0x540 [ 1130.133749][ T1410] should_failslab+0xa8/0x100 [ 1130.133780][ T1410] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 1130.133808][ T1410] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 1130.133833][ T1410] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 1130.133861][ T1410] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 1130.133889][ T1410] krealloc_node_align_noprof+0x19a/0x390 [ 1130.133915][ T1410] ? bpf_lsm_capable+0x9/0x20 [ 1130.133933][ T1410] ? security_capable+0x7e/0x2c0 [ 1130.133965][ T1410] kvrealloc_node_align_noprof+0x7b/0xf0 [ 1130.133994][ T1410] bpf_iarray_realloc+0x34/0xa0 [ 1130.134021][ T1410] bpf_check+0x17a6/0x34e0 [ 1130.134054][ T1410] ? ktime_get_with_offset+0x93/0x2d0 [ 1130.134085][ T1410] ? ktime_get_with_offset+0x93/0x2d0 [ 1130.134114][ T1410] ? __pfx_bpf_check+0x10/0x10 [ 1130.134139][ T1410] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1130.134168][ T1410] bpf_prog_load+0x14da/0x1c60 [ 1130.134202][ T1410] ? __pfx_bpf_prog_load+0x10/0x10 [ 1130.134237][ T1410] ? __might_fault+0xaf/0x130 [ 1130.134266][ T1410] __sys_bpf+0xd86/0xe00 [ 1130.134293][ T1410] ? __pfx___sys_bpf+0x10/0x10 [ 1130.134326][ T1410] ? __fget_files+0x2a/0x420 [ 1130.134375][ T1410] ? ksys_write+0x242/0x270 [ 1130.134402][ T1410] ? __pfx_ksys_write+0x10/0x10 [ 1130.134428][ T1410] __x64_sys_bpf+0xba/0xd0 [ 1130.134459][ T1410] do_syscall_64+0x166/0x520 [ 1130.134482][ T1410] ? trace_irq_disable+0x3b/0x140 [ 1130.134509][ T1410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1130.134529][ T1410] ? clear_bhb_loop+0x70/0xc0 [ 1130.134551][ T1410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1130.134571][ T1410] RIP: 0033:0x7f4f4379fb19 [ 1130.134591][ T1410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1130.134607][ T1410] RSP: 002b:00007f4f44617028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1130.134628][ T1410] RAX: ffffffffffffffda RBX: 00007f4f43a25fa0 RCX: 00007f4f4379fb19 [ 1130.134642][ T1410] RDX: 0000000000000094 RSI: 0000200000000480 RDI: 0000000000000005 [ 1130.134656][ T1410] RBP: 00007f4f44617090 R08: 0000000000000000 R09: 0000000000000000 [ 1130.134668][ T1410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1130.134679][ T1410] R13: 00007f4f43a26038 R14: 00007f4f43a25fa0 R15: 00007ffc3ae105c8 [ 1130.134710][ T1410] [ 1130.223917][ T1411] netlink: 'syz.3.8681': attribute type 11 has an invalid length. [ 1130.350192][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1130.492243][ T1416] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1130.501149][ T1416] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1130.501184][ T1416] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1130.501212][ T1416] netdevsim netdevsim0 eth3 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1130.578337][ T1420] syzkaller1: entered promiscuous mode [ 1130.578360][ T1420] syzkaller1: entered allmulticast mode [ 1130.672496][ T1416] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1130.672536][ T1416] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1130.672564][ T1416] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1130.672590][ T1416] netdevsim netdevsim0 eth2 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1130.841828][ T1416] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1130.842006][ T1416] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1130.842039][ T1416] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1130.842064][ T1416] netdevsim netdevsim0 eth1 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1130.888039][ T1440] netlink: 160 bytes leftover after parsing attributes in process `syz.4.8688'. [ 1131.014691][ T1416] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1131.014731][ T1416] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 1131.014758][ T1416] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1131.014785][ T1416] netdevsim netdevsim0 eth0 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 1131.124478][ T1458] netlink: 172 bytes leftover after parsing attributes in process `syz.1.8691'. [ 1131.330365][T24910] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1131.330402][T24910] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1131.330427][T24910] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 1131.330452][T24910] netdevsim netdevsim0 eth0: set [1, 2] type 2 family 0 port 20000 - 0 [ 1131.523869][ T7222] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1131.523906][ T7222] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1131.523938][ T7222] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 1131.523963][ T7222] netdevsim netdevsim0 eth3: set [1, 2] type 2 family 0 port 20000 - 0 [ 1131.539392][ T7222] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1131.539432][ T7222] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1131.539456][ T7222] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 1131.539480][ T7222] netdevsim netdevsim0 eth2: set [1, 2] type 2 family 0 port 20000 - 0 [ 1131.539516][ T7222] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1131.539539][ T7222] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1131.539563][ T7222] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 1131.539587][ T7222] netdevsim netdevsim0 eth1: set [1, 2] type 2 family 0 port 20000 - 0 [ 1131.739882][ T1481] x_tables: unsorted underflow at hook 3 [ 1131.740564][ T1481] x_tables: duplicate underflow at hook 2 [ 1132.270912][ T1499] __nla_validate_parse: 4 callbacks suppressed [ 1132.270935][ T1499] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8700'. [ 1132.302801][ T1499] vlan3: entered allmulticast mode [ 1132.302829][ T1499] mac80211_hwsim hwsim44 wlan0: entered allmulticast mode [ 1132.305025][ T1499] batman_adv: batadv0: Adding interface: vlan3 [ 1132.305042][ T1499] batman_adv: batadv0: The MTU of interface vlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1132.305072][ T1499] batman_adv: batadv0: Not using interface vlan3 (retrying later): interface not active [ 1132.391538][ T7221] net_ratelimit: 4 callbacks suppressed [ 1132.391559][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1132.753842][T25613] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1132.761472][T25613] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1132.762870][T25613] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1132.785988][T25613] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1132.786659][T25613] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1132.832353][ T1519] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1132.899982][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1133.136564][T24078] bond0: (slave syz_tun): Releasing backup interface [ 1133.265344][ T1530] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1133.265778][ T1536] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1133.297032][ T1539] syzkaller0: entered promiscuous mode [ 1133.297057][ T1539] syzkaller0: entered allmulticast mode [ 1133.409111][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1133.586175][ T1560] x_tables: duplicate underflow at hook 1 [ 1133.634975][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1133.636133][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1133.636813][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1133.781744][T24084] rxe_eth0 speed is unknown, defaulting to 1000 [ 1133.782542][ T1517] infiniband rxe0: set active [ 1133.782555][ T1517] infiniband rxe0: added rxe_eth0 [ 1133.799396][ T1517] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1133.799431][ T1517] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1133.799468][ T1517] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1133.828510][ T1517] RDS/IB: rxe0: added [ 1133.828564][ T1517] smc: adding ib device rxe0 with port count 1 [ 1133.828584][ T1517] smc: ib device rxe0 port 1 has no pnetid [ 1133.828665][T25983] rxe_eth0 speed is unknown, defaulting to 1000 [ 1133.835238][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1133.929095][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1133.995621][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1134.192085][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1134.440354][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1134.611501][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1134.743080][ T1578] FAULT_INJECTION: forcing a failure. [ 1134.743080][ T1578] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1134.743133][ T1578] CPU: 1 UID: 0 PID: 1578 Comm: syz.3.8721 Not tainted syzkaller #0 PREEMPT(full) [ 1134.743157][ T1578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1134.743170][ T1578] Call Trace: [ 1134.743177][ T1578] [ 1134.743186][ T1578] dump_stack_lvl+0xe8/0x150 [ 1134.743222][ T1578] should_fail_ex+0x3eb/0x540 [ 1134.743253][ T1578] prepare_alloc_pages+0x21e/0x5f0 [ 1134.743286][ T1578] __alloc_frozen_pages_noprof+0x17c/0x410 [ 1134.743312][ T1578] ? __lock_acquire+0x747/0x2de0 [ 1134.743340][ T1578] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1134.743372][ T1578] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 1134.743397][ T1578] ? __get_vm_area_node+0x155/0x2f0 [ 1134.743415][ T1578] ? __vmalloc_node_range_noprof+0x36e/0x16f0 [ 1134.743440][ T1578] ? policy_nodemask+0x31b/0x980 [ 1134.743467][ T1578] ? xt_check_match+0x602/0xce0 [ 1134.743491][ T1578] ? translate_table+0x160e/0x2110 [ 1134.743515][ T1578] ? do_ip6t_set_ctl+0xa5c/0xe30 [ 1134.743537][ T1578] ? nf_setsockopt+0x26f/0x290 [ 1134.743566][ T1578] alloc_pages_mpol+0x21e/0x390 [ 1134.743602][ T1578] alloc_pages_noprof+0xb1/0x2b0 [ 1134.743635][ T1578] get_free_pages_noprof+0xf/0x80 [ 1134.743662][ T1578] __kasan_populate_vmalloc+0x38/0x1c0 [ 1134.743688][ T1578] ? do_raw_spin_unlock+0xf5/0x200 [ 1134.743714][ T1578] alloc_vmap_area+0xd10/0x1410 [ 1134.743751][ T1578] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1134.743769][ T1578] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 1134.743795][ T1578] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 1134.743820][ T1578] ? __get_vm_area_node+0x155/0x2f0 [ 1134.743845][ T1578] __get_vm_area_node+0x200/0x2f0 [ 1134.743874][ T1578] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 1134.743898][ T1578] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.743923][ T1578] ? is_bpf_text_address+0x26/0x2b0 [ 1134.743977][ T1578] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1134.744004][ T1578] ? __mutex_trylock_common+0x15f/0x270 [ 1134.744043][ T1578] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.744061][ T1578] __vmalloc_noprof+0xd2/0x120 [ 1134.744082][ T1578] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.744104][ T1578] bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.744122][ T1578] ? bpf_prog_alloc+0x2a/0x1a0 [ 1134.744144][ T1578] bpf_prog_alloc+0x3c/0x1a0 [ 1134.744166][ T1578] bpf_prog_create+0x98/0x1f0 [ 1134.744198][ T1578] bpf_mt_check+0xe5/0x1a0 [ 1134.744306][ T1578] ? __pfx_bpf_mt_check+0x10/0x10 [ 1134.744331][ T1578] ? xt_find_match+0x213/0x260 [ 1134.744360][ T1578] xt_check_match+0x602/0xce0 [ 1134.744392][ T1578] ? __pfx_xt_check_match+0x10/0x10 [ 1134.744420][ T1578] ? pcpu_alloc_noprof+0x1036/0x1900 [ 1134.744461][ T1578] ? xt_find_match+0x213/0x260 [ 1134.744494][ T1578] translate_table+0x160e/0x2110 [ 1134.744519][ T1578] ? __lock_acquire+0x747/0x2de0 [ 1134.744567][ T1578] ? __pfx_translate_table+0x10/0x10 [ 1134.744591][ T1578] ? lock_acquire+0x115/0x350 [ 1134.744632][ T1578] ? __might_fault+0xaf/0x130 [ 1134.744657][ T1578] ? _copy_from_user+0x94/0xb0 [ 1134.744689][ T1578] do_ip6t_set_ctl+0xa5c/0xe30 [ 1134.744723][ T1578] ? rcu_is_watching+0x16/0xb0 [ 1134.744754][ T1578] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 1134.744797][ T1578] ? __mutex_unlock_slowpath+0x731/0x900 [ 1134.744830][ T1578] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1134.744870][ T1578] nf_setsockopt+0x26f/0x290 [ 1134.744896][ T1578] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1134.744927][ T1578] do_sock_setsockopt+0x17c/0x1b0 [ 1134.744953][ T1578] __x64_sys_setsockopt+0x13d/0x1b0 [ 1134.744980][ T1578] do_syscall_64+0x166/0x520 [ 1134.745002][ T1578] ? trace_irq_disable+0x3b/0x140 [ 1134.745036][ T1578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.745057][ T1578] ? clear_bhb_loop+0x70/0xc0 [ 1134.745081][ T1578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.745102][ T1578] RIP: 0033:0x7f544599fb19 [ 1134.745121][ T1578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1134.745139][ T1578] RSP: 002b:00007f54468fa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1134.745161][ T1578] RAX: ffffffffffffffda RBX: 00007f5445c25fa0 RCX: 00007f544599fb19 [ 1134.745176][ T1578] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000004 [ 1134.745189][ T1578] RBP: 00007f54468fa090 R08: 0000000000000590 R09: 0000000000000000 [ 1134.745202][ T1578] R10: 0000200000000640 R11: 0000000000000246 R12: 0000000000000001 [ 1134.745215][ T1578] R13: 00007f5445c26038 R14: 00007f5445c25fa0 R15: 00007ffd682cba98 [ 1134.745250][ T1578] [ 1134.748505][ T1578] syz.3.8721: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1134.748576][ T1578] CPU: 1 UID: 0 PID: 1578 Comm: syz.3.8721 Not tainted syzkaller #0 PREEMPT(full) [ 1134.748599][ T1578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1134.748613][ T1578] Call Trace: [ 1134.748621][ T1578] [ 1134.748630][ T1578] dump_stack_lvl+0xe8/0x150 [ 1134.748668][ T1578] warn_alloc+0x24d/0x270 [ 1134.748695][ T1578] ? lockdep_hardirqs_on+0x7b/0x110 [ 1134.748723][ T1578] ? __pfx_warn_alloc+0x10/0x10 [ 1134.748747][ T1578] ? kfree+0x1c5/0x650 [ 1134.748778][ T1578] ? __get_vm_area_node+0x219/0x2f0 [ 1134.748808][ T1578] __vmalloc_node_range_noprof+0x396/0x16f0 [ 1134.748841][ T1578] ? is_bpf_text_address+0x26/0x2b0 [ 1134.749021][ T1578] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1134.749056][ T1578] ? __mutex_trylock_common+0x15f/0x270 [ 1134.749092][ T1578] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.749112][ T1578] __vmalloc_noprof+0xd2/0x120 [ 1134.749141][ T1578] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.749165][ T1578] bpf_prog_alloc_no_stats+0x47/0x550 [ 1134.749185][ T1578] ? bpf_prog_alloc+0x2a/0x1a0 [ 1134.749207][ T1578] bpf_prog_alloc+0x3c/0x1a0 [ 1134.749230][ T1578] bpf_prog_create+0x98/0x1f0 [ 1134.749264][ T1578] bpf_mt_check+0xe5/0x1a0 [ 1134.749289][ T1578] ? __pfx_bpf_mt_check+0x10/0x10 [ 1134.749318][ T1578] ? xt_find_match+0x213/0x260 [ 1134.749349][ T1578] xt_check_match+0x602/0xce0 [ 1134.749383][ T1578] ? __pfx_xt_check_match+0x10/0x10 [ 1134.749414][ T1578] ? pcpu_alloc_noprof+0x1036/0x1900 [ 1134.749457][ T1578] ? xt_find_match+0x213/0x260 [ 1134.749492][ T1578] translate_table+0x160e/0x2110 [ 1134.749520][ T1578] ? __lock_acquire+0x747/0x2de0 [ 1134.749582][ T1578] ? __pfx_translate_table+0x10/0x10 [ 1134.749609][ T1578] ? lock_acquire+0x115/0x350 [ 1134.749652][ T1578] ? __might_fault+0xaf/0x130 [ 1134.749679][ T1578] ? _copy_from_user+0x94/0xb0 [ 1134.749711][ T1578] do_ip6t_set_ctl+0xa5c/0xe30 [ 1134.749749][ T1578] ? rcu_is_watching+0x16/0xb0 [ 1134.749783][ T1578] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 1134.749830][ T1578] ? __mutex_unlock_slowpath+0x731/0x900 [ 1134.749865][ T1578] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1134.749908][ T1578] nf_setsockopt+0x26f/0x290 [ 1134.749936][ T1578] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1134.749970][ T1578] do_sock_setsockopt+0x17c/0x1b0 [ 1134.749998][ T1578] __x64_sys_setsockopt+0x13d/0x1b0 [ 1134.750027][ T1578] do_syscall_64+0x166/0x520 [ 1134.750051][ T1578] ? trace_irq_disable+0x3b/0x140 [ 1134.750079][ T1578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.750103][ T1578] ? clear_bhb_loop+0x70/0xc0 [ 1134.750131][ T1578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.750152][ T1578] RIP: 0033:0x7f544599fb19 [ 1134.750175][ T1578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1134.750196][ T1578] RSP: 002b:00007f54468fa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1134.750219][ T1578] RAX: ffffffffffffffda RBX: 00007f5445c25fa0 RCX: 00007f544599fb19 [ 1134.750236][ T1578] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000004 [ 1134.750251][ T1578] RBP: 00007f54468fa090 R08: 0000000000000590 R09: 0000000000000000 [ 1134.750264][ T1578] R10: 0000200000000640 R11: 0000000000000246 R12: 0000000000000001 [ 1134.750278][ T1578] R13: 00007f5445c26038 R14: 00007f5445c25fa0 R15: 00007ffd682cba98 [ 1134.750315][ T1578] [ 1134.752062][ T1578] Mem-Info: [ 1134.752078][ T1578] active_anon:7577 inactive_anon:0 isolated_anon:0 [ 1134.752078][ T1578] active_file:79 inactive_file:44391 isolated_file:0 [ 1134.752078][ T1578] unevictable:0 dirty:283 writeback:0 [ 1134.752078][ T1578] slab_reclaimable:13836 slab_unreclaimable:118487 [ 1134.752078][ T1578] mapped:30141 shmem:2268 pagetables:1322 [ 1134.752078][ T1578] sec_pagetables:0 bounce:0 [ 1134.752078][ T1578] kernel_misc_reclaimable:0 [ 1134.752078][ T1578] free:1285385 free_pcp:6286 free_cma:0 [ 1134.752133][ T1578] Node 0 active_anon:30308kB inactive_anon:0kB active_file:316kB inactive_file:177372kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:120564kB dirty:1132kB writeback:0kB shmem:9072kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15348kB pagetables:5108kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1134.752191][ T1578] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1134.752243][ T1578] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1134.752303][ T1578] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 1134.752338][ T1578] Node 0 DMA32 free:1183540kB boost:0kB min:33936kB low:42420kB high:50904kB reserved_highatomic:0kB free_highatomic:0kB active_anon:30308kB inactive_anon:0kB active_file:316kB inactive_file:177372kB unevictable:0kB writepending:1132kB zspages:0kB present:3129332kB managed:2523116kB mlocked:0kB bounce:0kB free_pcp:25140kB local_pcp:19068kB free_cma:0kB [ 1134.752398][ T1578] lowmem_reserve[]: 0 0 1 1 1 [ 1134.752431][ T1578] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1660kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 1134.752488][ T1578] lowmem_reserve[]: 0 0 0 0 0 [ 1134.752521][ T1578] Node 1 Normal free:3942640kB boost:0kB min:55940kB low:69924kB high:83908kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1134.752588][ T1578] lowmem_reserve[]: 0 0 0 0 0 [ 1134.752621][ T1578] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1134.752734][ T1578] Node 0 DMA32: 8287*4kB (UME) 4759*8kB (UM) 1718*16kB (UME) 369*32kB (UME) 120*64kB (UME) 147*128kB (UME) 38*256kB (UM) 25*512kB (UME) 6*1024kB (UME) 7*2048kB (UM) 245*4096kB (UM) = 1183540kB [ 1134.752887][ T1578] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1134.752982][ T1578] Node 1 Normal: 4*4kB (UM) 4*8kB (UM) 8*16kB (UM) 12*32kB (UM) 9*64kB (UM) 5*128kB (UM) 6*256kB (UM) 6*512kB (UM) 4*1024kB (UM) 0*2048kB 960*4096kB (UM) = 3942640kB [ 1134.753124][ T1578] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1134.753142][ T1578] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1134.753159][ T1578] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1134.753175][ T1578] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1134.753191][ T1578] 46734 total pagecache pages [ 1134.753200][ T1578] 0 pages in swap cache [ 1134.753207][ T1578] Free swap = 124996kB [ 1134.753215][ T1578] Total swap = 124996kB [ 1134.753224][ T1578] 2097051 pages RAM [ 1134.753231][ T1578] 0 pages HighMem/MovableOnly [ 1134.753238][ T1578] 434241 pages reserved [ 1134.753246][ T1578] 0 pages cma reserved [ 1134.753258][ T1578] xt_bpf: check failed: parse error [ 1134.901377][ T4959] Bluetooth: hci5: command tx timeout [ 1134.955155][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1135.121996][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1135.463585][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1135.584046][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1135.709990][ T1592] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8725'. [ 1135.974160][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1136.161535][ T1598] syzkaller0: entered promiscuous mode [ 1136.161562][ T1598] syzkaller0: entered allmulticast mode [ 1136.265797][ T1517] lo speed is unknown, defaulting to 1000 [ 1136.514756][ T1517] rxe_eth0 speed is unknown, defaulting to 1000 [ 1136.790191][ T1612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1136.808437][ T1612] batman_adv: batadv0: Adding interface: veth0 [ 1136.808456][ T1612] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1136.808650][ T1612] batman_adv: batadv0: Interface activated: veth0 [ 1136.811682][ T1612] batman_adv: batadv0: Interface deactivated: veth0 [ 1136.811705][ T1612] batman_adv: batadv0: Removing interface: veth0 [ 1136.980775][ T4959] Bluetooth: hci5: command tx timeout [ 1137.216261][ T1624] lo: entered allmulticast mode [ 1137.481996][ T1635] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8741'. [ 1137.498965][T23229] net_ratelimit: 4 callbacks suppressed [ 1137.498984][T23229] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1137.508622][ T1517] bridge0: port 1(bridge_slave_0) entered blocking state [ 1137.540074][ T1517] bridge0: port 1(bridge_slave_0) entered disabled state [ 1137.540516][ T1517] bridge_slave_0: entered allmulticast mode [ 1137.543466][ T1517] bridge_slave_0: entered promiscuous mode [ 1137.546642][ T1636] netlink: 256 bytes leftover after parsing attributes in process `syz.3.8739'. [ 1137.546669][ T1636] netlink: 256 bytes leftover after parsing attributes in process `syz.3.8739'. [ 1137.588404][ T1517] bridge0: port 2(bridge_slave_1) entered blocking state [ 1137.588575][ T1517] bridge0: port 2(bridge_slave_1) entered disabled state [ 1137.588742][ T1517] bridge_slave_1: entered allmulticast mode [ 1137.612325][ T1517] bridge_slave_1: entered promiscuous mode [ 1137.718535][ T1517] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1137.731919][ T1517] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1137.747005][ T1645] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8745'. [ 1137.820185][ T1645] bond0: entered promiscuous mode [ 1137.820212][ T1645] bond_slave_0: entered promiscuous mode [ 1137.821695][ T1645] bond_slave_1: entered promiscuous mode [ 1137.822911][ T1645] bond0: left promiscuous mode [ 1137.822931][ T1645] bond_slave_0: left promiscuous mode [ 1137.823151][ T1645] bond_slave_1: left promiscuous mode [ 1137.868720][ T1517] team0: Port device team_slave_0 added [ 1137.875420][ T1517] team0: Port device team_slave_1 added [ 1137.907646][ T1655] netlink: 256 bytes leftover after parsing attributes in process `syz.0.8748'. [ 1137.907675][ T1655] netlink: 256 bytes leftover after parsing attributes in process `syz.0.8748'. [ 1137.980398][ T1621] lo: left allmulticast mode [ 1137.982025][ T1517] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1137.982044][ T1517] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1137.982097][ T1517] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1137.986958][ T1658] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 1138.002030][ T1517] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1138.002051][ T1517] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1138.002101][ T1517] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1138.030030][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1138.115313][ T1660] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8750'. [ 1138.159510][ T1517] hsr_slave_0: entered promiscuous mode [ 1138.160631][ T1517] hsr_slave_1: entered promiscuous mode [ 1138.161375][ T1517] debugfs: 'hsr0' already exists in 'hsr' [ 1138.161397][ T1517] Cannot create hsr debugfs directory [ 1138.275202][ T1664] netlink: 'syz.2.8752': attribute type 1 has an invalid length. [ 1138.333632][ T1664] netlink: 'syz.2.8752': attribute type 10 has an invalid length. [ 1138.333653][ T1664] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8752'. [ 1138.333677][ T1664] batadv0: entered allmulticast mode [ 1138.334626][ T1664] bridge0: port 4(batadv0) entered blocking state [ 1138.334801][ T1664] bridge0: port 4(batadv0) entered disabled state [ 1138.337373][ T1664] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new VLAN: 1 [ 1138.338010][ T1664] batadv0: failed to initialize vlan filtering on this port [ 1138.402482][ T1664] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1138.469802][ T1664] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1138.539763][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1138.605806][ T1517] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1138.633287][ T1672] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8755'. [ 1138.633313][ T1672] openvswitch: netlink: Flow key attr not present in new flow. [ 1138.716215][ T1517] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1138.846113][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1138.846184][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1138.847055][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1138.848167][ T1678] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1138.848210][ T1678] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1138.848253][ T1678] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1138.916569][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1138.918472][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1138.936247][ T1681] nbd: socks must be embedded in a SOCK_ITEM attr [ 1138.951496][ T1517] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1138.953451][ T1683] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8759'. [ 1138.953478][ T1683] netlink: 'syz.3.8759': attribute type 1 has an invalid length. [ 1139.035577][ T1689] netlink: 'syz.3.8761': attribute type 30 has an invalid length. [ 1139.051622][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1139.058978][ T4959] Bluetooth: hci5: command tx timeout [ 1139.159756][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1139.187509][ T1689] vxlan0: entered promiscuous mode [ 1139.187536][ T1689] vxlan0: entered allmulticast mode [ 1139.194479][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1139.196491][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1139.198372][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1139.199141][ T7225] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1139.199194][ T7225] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1139.199227][ T7225] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1139.201988][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1139.203848][ T1678] wg2 speed is unknown, defaulting to 1000 [ 1139.209268][T24911] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1139.244680][ T1696] netlink: 'syz.4.8764': attribute type 1 has an invalid length. [ 1139.284795][ T1517] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1139.455573][ T1698] netlink: 'syz.4.8764': attribute type 10 has an invalid length. [ 1139.465243][ T1698] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1139.539605][ T1706] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1139.559210][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1139.731695][ T1710] FAULT_INJECTION: forcing a failure. [ 1139.731695][ T1710] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1139.731719][ T1710] CPU: 1 UID: 0 PID: 1710 Comm: syz.0.8766 Not tainted syzkaller #0 PREEMPT(full) [ 1139.731732][ T1710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1139.731739][ T1710] Call Trace: [ 1139.731744][ T1710] [ 1139.731749][ T1710] dump_stack_lvl+0xe8/0x150 [ 1139.731776][ T1710] should_fail_ex+0x3eb/0x540 [ 1139.731793][ T1710] _copy_from_user+0x2d/0xb0 [ 1139.731808][ T1710] __copy_msghdr+0x390/0x590 [ 1139.731824][ T1710] ___sys_sendmsg+0x213/0x360 [ 1139.731834][ T1710] ? __lock_acquire+0x747/0x2de0 [ 1139.731850][ T1710] ? __pfx____sys_sendmsg+0x10/0x10 [ 1139.731882][ T1710] ? __fget_files+0x3a2/0x420 [ 1139.731895][ T1710] ? __fget_files+0x2a/0x420 [ 1139.731912][ T1710] __x64_sys_sendmsg+0x1b1/0x290 [ 1139.731926][ T1710] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1139.731949][ T1710] do_syscall_64+0x166/0x520 [ 1139.731961][ T1710] ? trace_irq_disable+0x3b/0x140 [ 1139.731977][ T1710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1139.731987][ T1710] ? clear_bhb_loop+0x70/0xc0 [ 1139.732001][ T1710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1139.732011][ T1710] RIP: 0033:0x7f315bd9fb19 [ 1139.732023][ T1710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1139.732033][ T1710] RSP: 002b:00007f315cca3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1139.732045][ T1710] RAX: ffffffffffffffda RBX: 00007f315c026090 RCX: 00007f315bd9fb19 [ 1139.732053][ T1710] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000006 [ 1139.732060][ T1710] RBP: 00007f315cca3090 R08: 0000000000000000 R09: 0000000000000000 [ 1139.732067][ T1710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1139.732078][ T1710] R13: 00007f315c026128 R14: 00007f315c026090 R15: 00007ffc356e0f48 [ 1139.732109][ T1710] [ 1139.816763][ T1717] syzkaller0: entered promiscuous mode [ 1139.816786][ T1717] syzkaller0: entered allmulticast mode [ 1139.987753][ T1725] rdma_rxe: rxe_newlink: failed to add lo [ 1140.057056][ T1729] FAULT_INJECTION: forcing a failure. [ 1140.057056][ T1729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1140.057083][ T1729] CPU: 1 UID: 0 PID: 1729 Comm: syz.3.8769 Not tainted syzkaller #0 PREEMPT(full) [ 1140.057099][ T1729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1140.057108][ T1729] Call Trace: [ 1140.057115][ T1729] [ 1140.057122][ T1729] dump_stack_lvl+0xe8/0x150 [ 1140.057150][ T1729] should_fail_ex+0x3eb/0x540 [ 1140.057173][ T1729] _copy_from_user+0x2d/0xb0 [ 1140.057192][ T1729] ___sys_recvmsg+0x173/0x5a0 [ 1140.057215][ T1729] ? __pfx____sys_recvmsg+0x10/0x10 [ 1140.057235][ T1729] ? lock_acquire+0x115/0x350 [ 1140.057281][ T1729] ? __fget_files+0x2a/0x420 [ 1140.057297][ T1729] ? __fget_files+0x3a2/0x420 [ 1140.057313][ T1729] ? __fget_files+0x2a/0x420 [ 1140.057334][ T1729] ? fdget+0x1ac/0x250 [ 1140.057352][ T1729] do_recvmmsg+0x31a/0x800 [ 1140.057375][ T1729] ? __pfx_do_recvmmsg+0x10/0x10 [ 1140.057401][ T1729] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1140.057423][ T1729] ? fdget+0x1ac/0x250 [ 1140.057446][ T1729] __x64_sys_recvmmsg+0x198/0x250 [ 1140.057465][ T1729] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1140.057491][ T1729] do_syscall_64+0x166/0x520 [ 1140.057507][ T1729] ? trace_irq_disable+0x3b/0x140 [ 1140.057526][ T1729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1140.057541][ T1729] ? clear_bhb_loop+0x70/0xc0 [ 1140.057559][ T1729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1140.057574][ T1729] RIP: 0033:0x7f544599fb19 [ 1140.057589][ T1729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1140.057608][ T1729] RSP: 002b:00007f54468fa028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1140.057626][ T1729] RAX: ffffffffffffffda RBX: 00007f5445c25fa0 RCX: 00007f544599fb19 [ 1140.057637][ T1729] RDX: 040000000000012d RSI: 0000200000000000 RDI: 0000000000000003 [ 1140.057647][ T1729] RBP: 00007f54468fa090 R08: 0000000000000000 R09: 0000000000000000 [ 1140.057660][ T1729] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 1140.057670][ T1729] R13: 00007f5445c26038 R14: 00007f5445c25fa0 R15: 00007ffd682cba98 [ 1140.057695][ T1729] [ 1140.069896][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1140.113600][ T1721] syzkaller0: entered promiscuous mode [ 1140.113629][ T1721] syzkaller0: entered allmulticast mode [ 1140.234607][ T1517] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1140.261522][ T1517] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1140.262513][ T1517] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1140.294116][ T1517] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1140.298529][ T1517] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1140.345739][ T1517] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1140.348350][ T1517] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1140.367193][ T1517] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1140.423025][ T1736] bond0: entered promiscuous mode [ 1140.423048][ T1736] bridge2: entered promiscuous mode [ 1140.424745][ T1736] bond0: left promiscuous mode [ 1140.424766][ T1736] bridge2: left promiscuous mode [ 1140.463248][ T1745] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 1140.463909][ T1745] batman_adv: batadv0: Adding interface: gretap2 [ 1140.463921][ T1745] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1140.463950][ T1745] batman_adv: batadv0: Interface activated: gretap2 [ 1140.669740][ T1517] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1140.714401][ T1517] 8021q: adding VLAN 0 to HW filter on device team0 [ 1140.740055][ T7221] bridge0: port 1(bridge_slave_0) entered blocking state [ 1140.740170][ T7221] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1140.761144][T23229] bridge0: port 2(bridge_slave_1) entered blocking state [ 1140.761251][T23229] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1140.835236][ T1751] tap0: tun_chr_ioctl cmd 2148553947 [ 1141.139502][ T4959] Bluetooth: hci5: command tx timeout [ 1141.439321][ T1780] tc_dump_action: action bad kind [ 1141.755577][ T1797] FAULT_INJECTION: forcing a failure. [ 1141.755577][ T1797] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1141.755610][ T1797] CPU: 0 UID: 0 PID: 1797 Comm: syz.2.8787 Not tainted syzkaller #0 PREEMPT(full) [ 1141.755632][ T1797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1141.755645][ T1797] Call Trace: [ 1141.755654][ T1797] [ 1141.755663][ T1797] dump_stack_lvl+0xe8/0x150 [ 1141.755701][ T1797] should_fail_ex+0x3eb/0x540 [ 1141.755731][ T1797] _copy_from_user+0x2d/0xb0 [ 1141.755756][ T1797] ___sys_sendmsg+0x1c6/0x360 [ 1141.755777][ T1797] ? __lock_acquire+0x747/0x2de0 [ 1141.755808][ T1797] ? __pfx____sys_sendmsg+0x10/0x10 [ 1141.755865][ T1797] ? __fget_files+0x3a2/0x420 [ 1141.755886][ T1797] ? __fget_files+0x2a/0x420 [ 1141.755919][ T1797] __x64_sys_sendmsg+0x1b1/0x290 [ 1141.755943][ T1797] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1141.755988][ T1797] do_syscall_64+0x166/0x520 [ 1141.756010][ T1797] ? trace_irq_disable+0x3b/0x140 [ 1141.756035][ T1797] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1141.756055][ T1797] ? clear_bhb_loop+0x70/0xc0 [ 1141.756082][ T1797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1141.756101][ T1797] RIP: 0033:0x7ffa09b9fb19 [ 1141.756120][ T1797] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1141.756136][ T1797] RSP: 002b:00007ffa0a993028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1141.756157][ T1797] RAX: ffffffffffffffda RBX: 00007ffa09e25fa0 RCX: 00007ffa09b9fb19 [ 1141.756172][ T1797] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000006 [ 1141.756184][ T1797] RBP: 00007ffa0a993090 R08: 0000000000000000 R09: 0000000000000000 [ 1141.756197][ T1797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1141.756210][ T1797] R13: 00007ffa09e26038 R14: 00007ffa09e25fa0 R15: 00007fffbb589e68 [ 1141.756244][ T1797] [ 1142.420197][ T1810] tipc: Enabling of bearer rejected, failed to enable media [ 1142.427487][ T1517] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1142.486952][ T1812] netlink: 'syz.0.8791': attribute type 10 has an invalid length. [ 1142.606174][ T1818] FAULT_INJECTION: forcing a failure. [ 1142.606174][ T1818] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1142.606204][ T1818] CPU: 0 UID: 0 PID: 1818 Comm: syz.0.8794 Not tainted syzkaller #0 PREEMPT(full) [ 1142.606226][ T1818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1142.606237][ T1818] Call Trace: [ 1142.606244][ T1818] [ 1142.606253][ T1818] dump_stack_lvl+0xe8/0x150 [ 1142.606289][ T1818] should_fail_ex+0x3eb/0x540 [ 1142.606318][ T1818] _copy_from_user+0x2d/0xb0 [ 1142.606344][ T1818] __sys_bpf+0x2e7/0xe00 [ 1142.606373][ T1818] ? __pfx___sys_bpf+0x10/0x10 [ 1142.606404][ T1818] ? __fget_files+0x2a/0x420 [ 1142.606447][ T1818] ? ksys_write+0x242/0x270 [ 1142.606476][ T1818] ? __pfx_ksys_write+0x10/0x10 [ 1142.606515][ T1818] __x64_sys_bpf+0xba/0xd0 [ 1142.606547][ T1818] do_syscall_64+0x166/0x520 [ 1142.606569][ T1818] ? trace_irq_disable+0x3b/0x140 [ 1142.606597][ T1818] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1142.606617][ T1818] ? clear_bhb_loop+0x70/0xc0 [ 1142.606640][ T1818] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1142.606659][ T1818] RIP: 0033:0x7f315bd9fb19 [ 1142.606678][ T1818] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1142.606695][ T1818] RSP: 002b:00007f315ccc4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1142.606716][ T1818] RAX: ffffffffffffffda RBX: 00007f315c025fa0 RCX: 00007f315bd9fb19 [ 1142.606731][ T1818] RDX: 0000000000000020 RSI: 0000200000000ac0 RDI: 0000000000000002 [ 1142.606744][ T1818] RBP: 00007f315ccc4090 R08: 0000000000000000 R09: 0000000000000000 [ 1142.606757][ T1818] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1142.606770][ T1818] R13: 00007f315c026038 R14: 00007f315c025fa0 R15: 00007ffc356e0f48 [ 1142.606807][ T1818] [ 1142.630305][T24910] net_ratelimit: 29 callbacks suppressed [ 1142.630323][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1142.736810][ T1517] veth0_vlan: entered promiscuous mode [ 1142.790743][ T1517] veth1_vlan: entered promiscuous mode [ 1142.891793][ T1517] veth0_macvtap: entered promiscuous mode [ 1142.896913][ T1517] veth1_macvtap: entered promiscuous mode [ 1142.931988][ T1517] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1142.958200][ T1517] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1142.967068][ T1828] __nla_validate_parse: 9 callbacks suppressed [ 1142.967091][ T1828] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8796'. [ 1143.005923][ T1829] netlink: 'syz.4.8798': attribute type 1 has an invalid length. [ 1143.126798][ T1829] bond4: entered promiscuous mode [ 1143.127194][ T1829] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1143.141286][ T1833] macvtap1: entered allmulticast mode [ 1143.157849][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1143.184436][ T1838] bond4: (slave bridge2): making interface the new active one [ 1143.184465][ T1838] bridge2: entered promiscuous mode [ 1143.186217][ T1838] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 1143.264040][ T7211] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.301755][ T7222] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.301809][ T7222] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.301847][ T7222] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1143.396497][ T7211] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1143.396523][ T7211] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1143.451596][ T7221] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1143.451617][ T7221] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1143.636370][ T1854] dummy0: entered promiscuous mode [ 1143.636435][ T1854] dummy0: entered allmulticast mode [ 1143.659095][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1143.673548][ T1853] ip_tables: iptables: counters copy to user failed while replacing table [ 1144.034838][ T1874] syzkaller1: entered promiscuous mode [ 1144.034864][ T1874] syzkaller1: entered allmulticast mode [ 1144.170170][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1144.345172][ T1883] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8813'. [ 1144.526477][ T1894] netlink: 'syz.1.8817': attribute type 12 has an invalid length. [ 1144.528490][ T1894] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8817'. [ 1144.556832][T24910] IPVS: starting estimator thread 0... [ 1144.560255][ T1894] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 1144.639876][ T1899] IPVS: using max 36 ests per chain, 86400 per kthread [ 1144.682230][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1145.190635][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1145.513428][ T1957] netlink: 'syz.4.8836': attribute type 1 has an invalid length. [ 1145.592805][ T1956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8835'. [ 1145.592832][ T1956] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8835'. [ 1145.656703][ T1957] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1145.692325][ T7211] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1145.692371][ T7211] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1145.692405][ T7211] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1145.726590][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1145.829909][ T7211] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1145.935811][ T1969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1146.215428][ T1954] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1146.215454][ T1954] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1146.230007][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1146.315782][ T1993] netlink: 'syz.1.8842': attribute type 16 has an invalid length. [ 1146.326981][ T1990] SET target dimension over the limit! [ 1146.360373][ T1996] tipc: Started in network mode [ 1146.360403][ T1996] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 1146.360671][ T1996] tipc: Enabled bearer , priority 0 [ 1146.498173][ T2002] netlink: 'syz.3.8843': attribute type 1 has an invalid length. [ 1146.604540][T24910] bridge_slave_1: left allmulticast mode [ 1146.604567][T24910] bridge_slave_1: left promiscuous mode [ 1146.604831][T24910] bridge0: port 2(bridge_slave_1) entered disabled state [ 1146.618630][T24910] bridge_slave_0: left allmulticast mode [ 1146.618656][T24910] bridge_slave_0: left promiscuous mode [ 1146.623673][T24910] bridge0: port 1(bridge_slave_0) entered disabled state [ 1146.763273][ T2013] netlink: 'syz.3.8843': attribute type 10 has an invalid length. [ 1146.763297][ T2013] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8843'. [ 1146.822969][ T2017] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1146.822988][ T2017] IPv6: NLM_F_CREATE should be set when creating new route [ 1146.823028][ T2017] IPv6: NLM_F_CREATE should be set when creating new route [ 1147.121337][T24910] erspan0 (unregistering): left promiscuous mode [ 1147.188526][T24910] gretap0 (unregistering): left promiscuous mode [ 1147.215569][T24910] bond11 (unregistering): (slave gre3): Releasing backup interface [ 1147.215598][T24910] gre3 (unregistering): left promiscuous mode [ 1147.505396][T24910] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1147.507997][T24910] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1147.526574][T24910] bond0 (unregistering): Released all slaves [ 1147.553335][T24910] bond1 (unregistering): Released all slaves [ 1147.574022][T24910] bond2 (unregistering): Released all slaves [ 1147.595662][T24910] bond3 (unregistering): Released all slaves [ 1147.626168][T24910] bond4 (unregistering): Released all slaves [ 1147.646449][T24910] bond5 (unregistering): Released all slaves [ 1147.668042][T24910] bond6 (unregistering): Released all slaves [ 1147.687481][T24910] bond7 (unregistering): Released all slaves [ 1147.722029][T24910] bond8 (unregistering): Released all slaves [ 1147.737491][T24910] bond9 (unregistering): Released all slaves [ 1147.752295][T24910] bond10 (unregistering): Released all slaves [ 1147.767020][T24910] bond11 (unregistering): Released all slaves [ 1147.769903][T24911] net_ratelimit: 2 callbacks suppressed [ 1147.769919][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1147.812998][ T2013] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1147.837922][ T6091] tipc: Node number set to 43690 [ 1147.851956][ T2044] syzkaller0: entered promiscuous mode [ 1147.851972][ T2044] syzkaller0: entered allmulticast mode [ 1148.064792][T24910] tipc: Left network mode [ 1148.065673][ T2054] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8852'. [ 1148.085550][ T2054] bond0: entered promiscuous mode [ 1148.085576][ T2054] bond_slave_0: entered promiscuous mode [ 1148.085786][ T2054] bond_slave_1: entered promiscuous mode [ 1148.087902][ T2054] bond0: left promiscuous mode [ 1148.087919][ T2054] bond_slave_0: left promiscuous mode [ 1148.088146][ T2054] bond_slave_1: left promiscuous mode [ 1148.279005][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1148.458580][ T2063] syzkaller1: entered promiscuous mode [ 1148.458604][ T2063] syzkaller1: entered allmulticast mode [ 1148.620057][ T2073] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 1148.791266][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1149.032271][ T2077] syzkaller0: entered promiscuous mode [ 1149.032295][ T2077] syzkaller0: entered allmulticast mode [ 1149.300448][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1149.321891][ T2088] netlink: 'syz.4.8863': attribute type 1 has an invalid length. [ 1149.325453][ T2089] netlink: 'syz.4.8863': attribute type 1 has an invalid length. [ 1149.598050][ T2092] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1149.656778][ T2092] bond6: (slave bond7): making interface the new active one [ 1149.657558][ T2092] bond6: (slave bond7): Enslaving as an active interface with an up link [ 1149.810878][ T7211] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1149.863615][ T2114] netlink: ct family unspecified [ 1149.867151][ T2114] xt_LOG: level 16 >= 8 [ 1150.013004][ T2094] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1150.017914][ T2094] bond6: (slave bond8): Enslaving as a backup interface with an up link [ 1150.148404][T24910] hsr_slave_0: left promiscuous mode [ 1150.174212][T24910] hsr_slave_1: left promiscuous mode [ 1150.319233][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1150.833545][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1150.938489][ T2129] FAULT_INJECTION: forcing a failure. [ 1150.938489][ T2129] name failslab, interval 1, probability 0, space 0, times 0 [ 1150.938520][ T2129] CPU: 0 UID: 0 PID: 2129 Comm: syz.1.8874 Not tainted syzkaller #0 PREEMPT(full) [ 1150.938543][ T2129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1150.938556][ T2129] Call Trace: [ 1150.938565][ T2129] [ 1150.938573][ T2129] dump_stack_lvl+0xe8/0x150 [ 1150.938610][ T2129] should_fail_ex+0x3eb/0x540 [ 1150.938640][ T2129] should_failslab+0xa8/0x100 [ 1150.938671][ T2129] __kmalloc_cache_noprof+0x9e/0x600 [ 1150.938695][ T2129] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1150.938717][ T2129] ? __request_module+0x2d0/0x630 [ 1150.938735][ T2129] ? __request_module+0x2d0/0x630 [ 1150.938761][ T2129] __request_module+0x2d0/0x630 [ 1150.938784][ T2129] ? rtnl_link_ops_get+0x23/0x250 [ 1150.938806][ T2129] ? __pfx___request_module+0x10/0x10 [ 1150.938836][ T2129] ? rtnl_link_ops_get+0x23/0x250 [ 1150.938855][ T2129] ? rtnl_link_ops_get+0x23/0x250 [ 1150.938878][ T2129] ? rtnl_link_ops_get+0x215/0x250 [ 1150.938913][ T2129] rtnl_newlink+0x66c/0x1c30 [ 1150.938934][ T2129] ? __lock_acquire+0x730/0x2de0 [ 1150.938963][ T2129] ? kasan_save_track+0x4f/0x80 [ 1150.938988][ T2129] ? kasan_save_track+0x3e/0x80 [ 1150.939010][ T2129] ? kasan_save_free_info+0x40/0x50 [ 1150.939030][ T2129] ? __kasan_slab_free+0x5c/0x80 [ 1150.939057][ T2129] ? __pfx_rtnl_newlink+0x10/0x10 [ 1150.939075][ T2129] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 1150.939103][ T2129] ? netlink_deliver_tap+0x19c/0x1b0 [ 1150.939129][ T2129] ? netlink_unicast+0x8c1/0xa80 [ 1150.939151][ T2129] ? netlink_sendmsg+0x7f0/0xb20 [ 1150.939178][ T2129] ? sock_sendmsg_nosec+0x14e/0x190 [ 1150.939202][ T2129] ? ____sys_sendmsg+0x54e/0x850 [ 1150.939220][ T2129] ? ___sys_sendmsg+0x2a5/0x360 [ 1150.939238][ T2129] ? __x64_sys_sendmsg+0x1b1/0x290 [ 1150.939257][ T2129] ? do_syscall_64+0x166/0x520 [ 1150.939278][ T2129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1150.939337][ T2129] ? kasan_quarantine_put+0xbb/0x1f0 [ 1150.939362][ T2129] ? lockdep_hardirqs_on+0x7b/0x110 [ 1150.939389][ T2129] ? nlmon_xmit+0xb0/0x100 [ 1150.939483][ T2129] ? kmem_cache_free+0x182/0x650 [ 1150.939516][ T2129] ? __lock_acquire+0x747/0x2de0 [ 1150.939547][ T2129] ? __pfx_hook_capable+0x10/0x10 [ 1150.939566][ T2129] ? __dev_queue_xmit+0x29b/0x3920 [ 1150.939593][ T2129] ? __pfx_hook_capable+0x10/0x10 [ 1150.939612][ T2129] ? lockdep_hardirqs_on+0x7b/0x110 [ 1150.939660][ T2129] ? __pfx_rtnl_newlink+0x10/0x10 [ 1150.939679][ T2129] rtnetlink_rcv_msg+0x802/0xc00 [ 1150.939704][ T2129] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1150.939723][ T2129] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1150.939747][ T2129] ? __copy_skb_header+0xa3/0x4a0 [ 1150.939781][ T2129] netlink_rcv_skb+0x226/0x4a0 [ 1150.939810][ T2129] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1150.939832][ T2129] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1150.939873][ T2129] ? netlink_deliver_tap+0x2e/0x1b0 [ 1150.939908][ T2129] ? netlink_deliver_tap+0x2e/0x1b0 [ 1150.939941][ T2129] netlink_unicast+0x8ef/0xa80 [ 1150.939984][ T2129] netlink_sendmsg+0x7f0/0xb20 [ 1150.940014][ T2129] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1150.940044][ T2129] ? aa_sock_msg_perm+0x144/0x210 [ 1150.940065][ T2129] ? apparmor_socket_sendmsg+0x98/0x360 [ 1150.940091][ T2129] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1150.940117][ T2129] sock_sendmsg_nosec+0x14e/0x190 [ 1150.940146][ T2129] ____sys_sendmsg+0x54e/0x850 [ 1150.940174][ T2129] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1150.940206][ T2129] ? import_iovec+0x73/0xa0 [ 1150.940234][ T2129] ___sys_sendmsg+0x2a5/0x360 [ 1150.940253][ T2129] ? __lock_acquire+0x747/0x2de0 [ 1150.940283][ T2129] ? __pfx____sys_sendmsg+0x10/0x10 [ 1150.940344][ T2129] ? __fget_files+0x3a2/0x420 [ 1150.940367][ T2129] ? __fget_files+0x2a/0x420 [ 1150.940400][ T2129] __x64_sys_sendmsg+0x1b1/0x290 [ 1150.940425][ T2129] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1150.940468][ T2129] do_syscall_64+0x166/0x520 [ 1150.940490][ T2129] ? trace_irq_disable+0x3b/0x140 [ 1150.940517][ T2129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1150.940537][ T2129] ? clear_bhb_loop+0x70/0xc0 [ 1150.940560][ T2129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1150.940579][ T2129] RIP: 0033:0x7f526b59fb19 [ 1150.940598][ T2129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1150.940618][ T2129] RSP: 002b:00007f526c54c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1150.940638][ T2129] RAX: ffffffffffffffda RBX: 00007f526b825fa0 RCX: 00007f526b59fb19 [ 1150.940653][ T2129] RDX: 0000000000004040 RSI: 0000200000000240 RDI: 0000000000000003 [ 1150.940666][ T2129] RBP: 00007f526c54c090 R08: 0000000000000000 R09: 0000000000000000 [ 1150.940677][ T2129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1150.940689][ T2129] R13: 00007f526b826038 R14: 00007f526b825fa0 R15: 00007ffd50b8c028 [ 1150.940722][ T2129] [ 1151.115373][T24910] team0 (unregistering): Port device team_slave_1 removed [ 1151.166277][T24910] team0 (unregistering): Port device team_slave_0 removed [ 1151.340478][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1151.864892][T24910] IPVS: stop unused estimator thread 0... [ 1151.922948][ T2133] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.8876'. [ 1152.170146][ T2137] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8877'. [ 1152.264515][ T2131] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.287392][ T2145] FAULT_INJECTION: forcing a failure. [ 1152.287392][ T2145] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1152.287423][ T2145] CPU: 0 UID: 0 PID: 2145 Comm: syz.4.8879 Not tainted syzkaller #0 PREEMPT(full) [ 1152.287462][ T2145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1152.287474][ T2145] Call Trace: [ 1152.287482][ T2145] [ 1152.287491][ T2145] dump_stack_lvl+0xe8/0x150 [ 1152.287529][ T2145] should_fail_ex+0x3eb/0x540 [ 1152.287560][ T2145] _copy_from_user+0x2d/0xb0 [ 1152.287587][ T2145] ___sys_recvmsg+0x173/0x5a0 [ 1152.287618][ T2145] ? __pfx____sys_recvmsg+0x10/0x10 [ 1152.287645][ T2145] ? lock_acquire+0x115/0x350 [ 1152.287724][ T2145] do_recvmmsg+0x31a/0x800 [ 1152.287757][ T2145] ? __pfx_do_recvmmsg+0x10/0x10 [ 1152.287819][ T2145] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1152.287849][ T2145] ? fdget+0x1ac/0x250 [ 1152.287882][ T2145] __x64_sys_recvmmsg+0x198/0x250 [ 1152.287908][ T2145] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1152.287942][ T2145] do_syscall_64+0x166/0x520 [ 1152.287970][ T2145] ? trace_irq_disable+0x3b/0x140 [ 1152.287997][ T2145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.288019][ T2145] ? clear_bhb_loop+0x70/0xc0 [ 1152.288044][ T2145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.288065][ T2145] RIP: 0033:0x7f4f4379fb19 [ 1152.288084][ T2145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1152.288101][ T2145] RSP: 002b:00007f4f44617028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1152.288123][ T2145] RAX: ffffffffffffffda RBX: 00007f4f43a25fa0 RCX: 00007f4f4379fb19 [ 1152.288138][ T2145] RDX: 0000000003ffffbd RSI: 00002000000000c0 RDI: 0000000000000004 [ 1152.288152][ T2145] RBP: 00007f4f44617090 R08: 0000000000000000 R09: 0000000000000000 [ 1152.288165][ T2145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1152.288178][ T2145] R13: 00007f4f43a26038 R14: 00007f4f43a25fa0 R15: 00007ffc3ae105c8 [ 1152.288212][ T2145] [ 1152.515942][ T2148] FAULT_INJECTION: forcing a failure. [ 1152.515942][ T2148] name failslab, interval 1, probability 0, space 0, times 0 [ 1152.515973][ T2148] CPU: 1 UID: 0 PID: 2148 Comm: syz.4.8880 Not tainted syzkaller #0 PREEMPT(full) [ 1152.515996][ T2148] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1152.516009][ T2148] Call Trace: [ 1152.516017][ T2148] [ 1152.516026][ T2148] dump_stack_lvl+0xe8/0x150 [ 1152.516063][ T2148] should_fail_ex+0x3eb/0x540 [ 1152.516094][ T2148] should_failslab+0xa8/0x100 [ 1152.516126][ T2148] __kmalloc_cache_noprof+0x9e/0x600 [ 1152.516152][ T2148] ? __kmalloc_cache_noprof+0x148/0x600 [ 1152.516175][ T2148] ? sctp_add_bind_addr+0x8c/0x370 [ 1152.516198][ T2148] ? sctp_add_bind_addr+0x8c/0x370 [ 1152.516229][ T2148] sctp_add_bind_addr+0x8c/0x370 [ 1152.516265][ T2148] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1152.516293][ T2148] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1152.516319][ T2148] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1152.516346][ T2148] ? sctp_v6_is_any+0x64/0x80 [ 1152.516372][ T2148] ? sctp_copy_one_addr+0x93/0x360 [ 1152.516400][ T2148] sctp_bind_addr_copy+0xb3/0x3c0 [ 1152.516426][ T2148] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1152.516467][ T2148] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1152.516499][ T2148] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1152.516534][ T2148] ? __local_bh_enable_ip+0xd6/0x140 [ 1152.516560][ T2148] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1152.516588][ T2148] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1152.516620][ T2148] sctp_sendmsg+0x159b/0x2d00 [ 1152.516665][ T2148] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1152.516699][ T2148] ? __lock_acquire+0x747/0x2de0 [ 1152.516739][ T2148] ? aa_sock_msg_perm+0xf5/0x210 [ 1152.516758][ T2148] ? sock_rps_record_flow+0x19/0x350 [ 1152.516785][ T2148] ? inet_sendmsg+0x298/0x320 [ 1152.516810][ T2148] ? __pfx_inet_sendmsg+0x10/0x10 [ 1152.516833][ T2148] sock_sendmsg_nosec+0x10f/0x190 [ 1152.516865][ T2148] ____sys_sendmsg+0x54e/0x850 [ 1152.516894][ T2148] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1152.516927][ T2148] ? import_iovec+0x73/0xa0 [ 1152.516957][ T2148] ___sys_sendmsg+0x2a5/0x360 [ 1152.516977][ T2148] ? __lock_acquire+0x747/0x2de0 [ 1152.517008][ T2148] ? __pfx____sys_sendmsg+0x10/0x10 [ 1152.517037][ T2148] ? kstrtouint+0x6e/0xe0 [ 1152.517098][ T2148] ? __fget_files+0x3a2/0x420 [ 1152.517122][ T2148] ? __fget_files+0x2a/0x420 [ 1152.517157][ T2148] __sys_sendmmsg+0x273/0x4e0 [ 1152.517186][ T2148] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1152.517219][ T2148] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1152.517268][ T2148] ? ksys_write+0x242/0x270 [ 1152.517298][ T2148] ? __pfx_ksys_write+0x10/0x10 [ 1152.517332][ T2148] __x64_sys_sendmmsg+0xa0/0xc0 [ 1152.517358][ T2148] do_syscall_64+0x166/0x520 [ 1152.517380][ T2148] ? trace_irq_disable+0x3b/0x140 [ 1152.517407][ T2148] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.517428][ T2148] ? clear_bhb_loop+0x70/0xc0 [ 1152.517454][ T2148] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.517475][ T2148] RIP: 0033:0x7f4f4379fb19 [ 1152.517494][ T2148] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1152.517512][ T2148] RSP: 002b:00007f4f44617028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1152.517535][ T2148] RAX: ffffffffffffffda RBX: 00007f4f43a25fa0 RCX: 00007f4f4379fb19 [ 1152.517550][ T2148] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1152.517563][ T2148] RBP: 00007f4f44617090 R08: 0000000000000000 R09: 0000000000000000 [ 1152.517577][ T2148] R10: 00000000000488c4 R11: 0000000000000246 R12: 0000000000000002 [ 1152.517590][ T2148] R13: 00007f4f43a26038 R14: 00007f4f43a25fa0 R15: 00007ffc3ae105c8 [ 1152.517626][ T2148] [ 1152.548975][ T2150] FAULT_INJECTION: forcing a failure. [ 1152.548975][ T2150] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1152.549005][ T2150] CPU: 0 UID: 0 PID: 2150 Comm: syz.2.8882 Not tainted syzkaller #0 PREEMPT(full) [ 1152.549028][ T2150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1152.549041][ T2150] Call Trace: [ 1152.549049][ T2150] [ 1152.549060][ T2150] dump_stack_lvl+0xe8/0x150 [ 1152.549097][ T2150] should_fail_ex+0x3eb/0x540 [ 1152.549127][ T2150] _copy_from_user+0x2d/0xb0 [ 1152.549153][ T2150] ___sys_recvmsg+0x173/0x5a0 [ 1152.549182][ T2150] ? __pfx____sys_recvmsg+0x10/0x10 [ 1152.549209][ T2150] ? lock_acquire+0x115/0x350 [ 1152.549263][ T2150] do_recvmmsg+0x31a/0x800 [ 1152.549293][ T2150] ? __pfx_do_recvmmsg+0x10/0x10 [ 1152.549327][ T2150] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1152.549357][ T2150] ? fdget+0x1ac/0x250 [ 1152.549388][ T2150] __x64_sys_recvmmsg+0x198/0x250 [ 1152.549413][ T2150] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1152.549447][ T2150] do_syscall_64+0x166/0x520 [ 1152.549469][ T2150] ? trace_irq_disable+0x3b/0x140 [ 1152.549494][ T2150] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.549513][ T2150] ? clear_bhb_loop+0x70/0xc0 [ 1152.549538][ T2150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.549557][ T2150] RIP: 0033:0x7ffa09b9fb19 [ 1152.549576][ T2150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1152.549593][ T2150] RSP: 002b:00007ffa0a993028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1152.549614][ T2150] RAX: ffffffffffffffda RBX: 00007ffa09e25fa0 RCX: 00007ffa09b9fb19 [ 1152.549629][ T2150] RDX: 0000000003ffffbd RSI: 00002000000000c0 RDI: 0000000000000004 [ 1152.549642][ T2150] RBP: 00007ffa0a993090 R08: 0000000000000000 R09: 0000000000000000 [ 1152.549655][ T2150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1152.549667][ T2150] R13: 00007ffa09e26038 R14: 00007ffa09e25fa0 R15: 00007fffbb589e68 [ 1152.549700][ T2150] [ 1152.807469][ T2131] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1152.871369][ T7222] net_ratelimit: 2 callbacks suppressed [ 1152.871390][ T7222] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1152.922317][ T2160] nbd: socks must be embedded in a SOCK_ITEM attr [ 1153.039320][ T2160] block nbd3: shutting down sockets [ 1153.152790][ T30] audit: type=1804 audit(1793891941.501:54): pid=2166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.8885" name="/newroot/522/cgroup.controllers" dev="tmpfs" ino=2658 res=1 errno=0 [ 1153.153051][ T30] audit: type=1800 audit(1793891941.501:55): pid=2166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8885" name="cgroup.controllers" dev="tmpfs" ino=2658 res=0 errno=-22 [ 1153.154553][ T2166] FAULT_INJECTION: forcing a failure. [ 1153.154553][ T2166] name failslab, interval 1, probability 0, space 0, times 0 [ 1153.154580][ T2166] CPU: 1 UID: 0 PID: 2166 Comm: syz.4.8885 Not tainted syzkaller #0 PREEMPT(full) [ 1153.154601][ T2166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1153.154612][ T2166] Call Trace: [ 1153.154620][ T2166] [ 1153.154629][ T2166] dump_stack_lvl+0xe8/0x150 [ 1153.154663][ T2166] should_fail_ex+0x3eb/0x540 [ 1153.154692][ T2166] should_failslab+0xa8/0x100 [ 1153.154720][ T2166] ? vm_area_dup+0x28/0x760 [ 1153.154740][ T2166] kmem_cache_alloc_noprof+0x9c/0x600 [ 1153.154767][ T2166] ? vm_area_dup+0x28/0x760 [ 1153.154795][ T2166] vm_area_dup+0x28/0x760 [ 1153.154813][ T2166] ? __split_vma+0x1b7/0xa90 [ 1153.154839][ T2166] __split_vma+0x1d7/0xa90 [ 1153.154867][ T2166] ? mas_next_slot+0xc91/0xd70 [ 1153.154894][ T2166] ? __pfx___split_vma+0x10/0x10 [ 1153.154932][ T2166] ? mas_find+0x6d6/0xcb0 [ 1153.154961][ T2166] vms_gather_munmap_vmas+0x4e3/0x1370 [ 1153.155004][ T2166] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1153.155043][ T2166] ? mas_walk+0x37e/0x490 [ 1153.155075][ T2166] mmap_region+0x95a/0x2840 [ 1153.155102][ T2166] ? is_bpf_text_address+0x26/0x2b0 [ 1153.155128][ T2166] ? is_bpf_text_address+0x292/0x2b0 [ 1153.155152][ T2166] ? kernel_text_address+0xa5/0xe0 [ 1153.155178][ T2166] ? __kernel_text_address+0xd/0x30 [ 1153.155209][ T2166] ? unwind_get_return_address+0x4d/0x90 [ 1153.155239][ T2166] ? __pfx_mmap_region+0x10/0x10 [ 1153.155276][ T2166] ? stack_trace_save+0xa9/0x100 [ 1153.155300][ T2166] ? __pfx_stack_trace_save+0x10/0x10 [ 1153.155327][ T2166] ? stack_depot_save_flags+0x33/0x810 [ 1153.155348][ T2166] ? __lock_acquire+0x747/0x2de0 [ 1153.155377][ T2166] ? kasan_save_track+0x4f/0x80 [ 1153.155400][ T2166] ? kasan_save_track+0x3e/0x80 [ 1153.155419][ T2166] ? kasan_save_free_info+0x40/0x50 [ 1153.155436][ T2166] ? __kasan_slab_free+0x5c/0x80 [ 1153.155460][ T2166] ? kfree+0x1c5/0x650 [ 1153.155479][ T2166] ? process_measurement+0x13ea/0x1c10 [ 1153.155503][ T2166] ? ima_file_mmap+0x1a3/0x1f0 [ 1153.155524][ T2166] ? security_mmap_file+0x773/0xa20 [ 1153.155549][ T2166] ? vm_mmap_pgoff+0x13d/0x520 [ 1153.155570][ T2166] ? ksys_mmap_pgoff+0x4dc/0x760 [ 1153.155596][ T2166] ? do_syscall_64+0x166/0x520 [ 1153.155616][ T2166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1153.155696][ T2166] ? arch_get_unmapped_area_topdown+0x269/0xc30 [ 1153.155746][ T2166] ? mm_get_unmapped_area+0xd3/0x100 [ 1153.155769][ T2166] ? shmem_get_unmapped_area+0x2cf/0x8f0 [ 1153.155794][ T2166] ? cap_mmap_addr+0xaa/0xf0 [ 1153.155800][ T30] audit: type=1800 audit(1793891941.501:56): pid=2166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8885" name="cgroup.controllers" dev="tmpfs" ino=2658 res=0 errno=-22 [ 1153.155821][ T2166] ? bpf_lsm_mmap_addr+0x9/0x50 [ 1153.155846][ T2166] ? security_mmap_addr+0x71/0x240 [ 1153.155873][ T2166] ? shmem_mapping+0xd/0x50 [ 1153.155889][ T2166] ? memfd_check_seals_mmap+0x16f/0x220 [ 1153.155914][ T2166] do_mmap+0xe0a/0x1300 [ 1153.155939][ T2166] ? get_pid_task+0x20/0x1f0 [ 1153.155969][ T2166] ? __pfx_do_mmap+0x10/0x10 [ 1153.156009][ T2166] ? vm_mmap_pgoff+0x1ed/0x520 [ 1153.156029][ T2166] ? down_write_killable+0x179/0x230 [ 1153.156057][ T2166] ? __pfx_down_write_killable+0x10/0x10 [ 1153.156082][ T2166] ? apparmor_mmap_file+0x2e7/0x390 [ 1153.156113][ T2166] vm_mmap_pgoff+0x27a/0x520 [ 1153.156144][ T2166] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1153.156168][ T2166] ? __fget_files+0x2a/0x420 [ 1153.156195][ T2166] ? __fget_files+0x3a2/0x420 [ 1153.156225][ T2166] ? __fget_files+0x2a/0x420 [ 1153.156253][ T2166] ksys_mmap_pgoff+0x4dc/0x760 [ 1153.156287][ T2166] do_syscall_64+0x166/0x520 [ 1153.156308][ T2166] ? trace_irq_disable+0x3b/0x140 [ 1153.156334][ T2166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1153.156353][ T2166] ? clear_bhb_loop+0x70/0xc0 [ 1153.156377][ T2166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1153.156397][ T2166] RIP: 0033:0x7f4f4379fb19 [ 1153.156415][ T2166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1153.156432][ T2166] RSP: 002b:00007f4f44617028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1153.156454][ T2166] RAX: ffffffffffffffda RBX: 00007f4f43a25fa0 RCX: 00007f4f4379fb19 [ 1153.156468][ T2166] RDX: 000000000000000f RSI: 0000000000004000 RDI: 000 ** replaying previous printk message ** [ 1153.156468][ T2166] RDX: 000000000000000f RSI: 0000000000004000 RDI: 00002000005d4000 [ 1153.156481][ T2166] RBP: 00007f4f44617090 R08: 0000000000000004 R09: 00000000fffff000 [ 1153.156495][ T2166] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000002 [ 1153.156506][ T2166] R13: 00007f4f43a26038 R14: 00007f4f43a25fa0 R15: 00007ffc3ae105c8 [ 1153.156538][ T2166] [ 1153.300109][ T2131] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1153.381003][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1153.452200][ T2176] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1153.463661][ T2176] netlink: 56 bytes leftover after parsing attributes in process `syz.3.8888'. [ 1153.615508][ T2131] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1153.655054][ T2131] [ 1153.749198][ T2131] ====================================================== [ 1153.756204][ T2131] WARNING: possible circular locking dependency detected [ 1153.763218][ T2131] syzkaller #0 Not tainted [ 1153.767620][ T2131] ------------------------------------------------------ [ 1153.774623][ T2131] syz.1.8875/2131 is trying to acquire lock: [ 1153.780614][ T2131] ffff88801cec4aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove+0x35/0x80 [ 1153.790459][ T2131] [ 1153.790459][ T2131] but task is already holding lock: [ 1153.797810][ T2131] ffffffff90a1a600 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 1153.806588][ T2131] [ 1153.806588][ T2131] which lock already depends on the new lock. [ 1153.806588][ T2131] [ 1153.816976][ T2131] [ 1153.816976][ T2131] the existing dependency chain (in reverse order) is: [ 1153.825986][ T2131] [ 1153.825986][ T2131] -> #11 (gdp_mutex){+.+.}-{4:4}: [ 1153.833207][ T2131] __mutex_lock+0x197/0x15a0 [ 1153.838318][ T2131] get_device_parent+0x16f/0x3a0 [ 1153.843771][ T2131] device_add+0x2d4/0xb80 [ 1153.848610][ T2131] device_create+0x269/0x300 [ 1153.853785][ T2131] msr_device_create+0x33/0x50 [ 1153.859068][ T2131] cpuhp_invoke_callback+0x434/0x810 [ 1153.864878][ T2131] cpuhp_thread_fun+0x362/0x780 [ 1153.870247][ T2131] smpboot_thread_fn+0x5f8/0xb30 [ 1153.875703][ T2131] kthread+0x38b/0x480 [ 1153.880409][ T2131] ret_from_fork+0x514/0xb70 [ 1153.885543][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1153.890855][ T2131] [ 1153.890855][ T2131] -> #10 (cpuhp_state-up){+.+.}-{0:0}: [ 1153.898531][ T2131] cpuhp_thread_fun+0x127/0x780 [ 1153.903917][ T2131] smpboot_thread_fn+0x5f8/0xb30 [ 1153.909378][ T2131] kthread+0x38b/0x480 [ 1153.913960][ T2131] ret_from_fork+0x514/0xb70 [ 1153.919110][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1153.924414][ T2131] [ 1153.924414][ T2131] -> #9 (cpu_hotplug_lock){++++}-{0:0}: [ 1153.932160][ T2131] cpus_read_lock+0x3d/0x160 [ 1153.937276][ T2131] static_key_slow_inc+0x12/0x30 [ 1153.942726][ T2131] setup_udp_tunnel_sock+0x2df/0x4f0 [ 1153.948526][ T2131] l2tp_tunnel_register+0xe77/0x1570 [ 1153.954402][ T2131] pppol2tp_connect+0x8e3/0x18b0 [ 1153.959858][ T2131] __sys_connect+0x316/0x450 [ 1153.964991][ T2131] __x64_sys_connect+0x7a/0x90 [ 1153.970277][ T2131] do_syscall_64+0x166/0x520 [ 1153.975402][ T2131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1153.981821][ T2131] [ 1153.981821][ T2131] -> #8 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 1153.989551][ T2131] lock_sock_nested+0x41/0x100 [ 1153.994838][ T2131] inet_shutdown+0x6a/0x390 [ 1153.999877][ T2131] nbd_mark_nsock_dead+0x2cb/0x550 [ 1154.005595][ T2131] sock_shutdown+0x15e/0x260 [ 1154.007845][ T2181] ip_tables: iptables: counters copy to user failed while replacing table [ 1154.019191][ T2131] nbd_clear_sock+0x24/0x170 [ 1154.024309][ T2131] nbd_config_put+0x477/0x7e0 [ 1154.029509][ T2131] nbd_genl_connect+0x19b8/0x1cd0 [ 1154.035123][ T2131] genl_family_rcv_msg_doit+0x233/0x340 [ 1154.041194][ T2131] genl_rcv_msg+0x614/0x7a0 [ 1154.046221][ T2131] netlink_rcv_skb+0x226/0x4a0 [ 1154.051528][ T2131] genl_rcv+0x28/0x40 [ 1154.056036][ T2131] netlink_unicast+0x8ef/0xa80 [ 1154.061336][ T2131] netlink_sendmsg+0x7f0/0xb20 [ 1154.066681][ T2131] sock_sendmsg_nosec+0x14e/0x190 [ 1154.072234][ T2131] ____sys_sendmsg+0x54e/0x850 [ 1154.077521][ T2131] ___sys_sendmsg+0x2a5/0x360 [ 1154.082711][ T2131] __x64_sys_sendmsg+0x1b1/0x290 [ 1154.088161][ T2131] do_syscall_64+0x166/0x520 [ 1154.093277][ T2131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1154.099704][ T2131] [ 1154.099704][ T2131] -> #7 (&nsock->tx_lock){+.+.}-{4:4}: [ 1154.107350][ T2131] __mutex_lock+0x197/0x15a0 [ 1154.112467][ T2131] nbd_queue_rq+0x373/0xff0 [ 1154.117498][ T2131] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1154.123694][ T2131] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1154.130660][ T2131] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1154.137161][ T2131] blk_mq_run_work_fn+0x167/0x2f0 [ 1154.142710][ T2131] process_scheduled_works+0xc3d/0x1630 [ 1154.148783][ T2131] worker_thread+0xa47/0xfb0 [ 1154.153901][ T2131] kthread+0x38b/0x480 [ 1154.158492][ T2131] ret_from_fork+0x514/0xb70 [ 1154.163606][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1154.168905][ T2131] [ 1154.168905][ T2131] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 1154.176124][ T2131] __mutex_lock+0x197/0x15a0 [ 1154.181263][ T2131] nbd_queue_rq+0xc1/0xff0 [ 1154.186220][ T2131] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1154.192308][ T2131] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1154.199156][ T2131] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1154.205654][ T2131] blk_mq_run_work_fn+0x167/0x2f0 [ 1154.211194][ T2131] process_scheduled_works+0xc3d/0x1630 [ 1154.217259][ T2131] worker_thread+0xa47/0xfb0 [ 1154.222372][ T2131] kthread+0x38b/0x480 [ 1154.226963][ T2131] ret_from_fork+0x514/0xb70 [ 1154.232076][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1154.237353][ T2131] [ 1154.237353][ T2131] -> #5 (set->srcu){.+.+}-{0:0}: [ 1154.244472][ T2131] __synchronize_srcu+0xca/0x2f0 [ 1154.249932][ T2131] elevator_switch+0x1e8/0x7b0 [ 1154.255293][ T2131] elevator_change+0x2fa/0x480 [ 1154.260579][ T2131] elevator_set_default+0x375/0x440 [ 1154.266310][ T2131] blk_register_queue+0x404/0x4f0 [ 1154.271914][ T2131] __add_disk+0x6b8/0xdb0 [ 1154.276823][ T2131] add_disk_fwnode+0x100/0x3a0 [ 1154.282102][ T2131] nbd_dev_add+0x733/0xb60 [ 1154.287034][ T2131] nbd_init+0x168/0x1f0 [ 1154.291697][ T2131] do_one_initcall+0x250/0x870 [ 1154.296974][ T2131] do_initcall_level+0x10a/0x1a0 [ 1154.302424][ T2131] do_initcalls+0x59/0xa0 [ 1154.307269][ T2131] kernel_init_freeable+0x29d/0x3e0 [ 1154.312980][ T2131] kernel_init+0x22/0x1d0 [ 1154.317915][ T2131] ret_from_fork+0x514/0xb70 [ 1154.323020][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1154.328296][ T2131] [ 1154.328296][ T2131] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 1154.336104][ T2131] __mutex_lock+0x197/0x15a0 [ 1154.341211][ T2131] elevator_change+0x1af/0x480 [ 1154.346494][ T2131] elevator_set_none+0xb5/0x140 [ 1154.351862][ T2131] blk_mq_update_nr_hw_queues+0x5ef/0x19e0 [ 1154.358181][ T2131] nbd_start_device+0x189/0xb30 [ 1154.363539][ T2131] nbd_genl_connect+0x167d/0x1cd0 [ 1154.369082][ T2131] genl_family_rcv_msg_doit+0x233/0x340 [ 1154.375142][ T2131] genl_rcv_msg+0x614/0x7a0 [ 1154.380156][ T2131] netlink_rcv_skb+0x226/0x4a0 [ 1154.385447][ T2131] genl_rcv+0x28/0x40 [ 1154.389938][ T2131] netlink_unicast+0x8ef/0xa80 [ 1154.395217][ T2131] netlink_sendmsg+0x7f0/0xb20 [ 1154.400496][ T2131] sock_sendmsg_nosec+0x14e/0x190 [ 1154.406036][ T2131] ____sys_sendmsg+0x54e/0x850 [ 1154.411309][ T2131] ___sys_sendmsg+0x2a5/0x360 [ 1154.416495][ T2131] __x64_sys_sendmsg+0x1b1/0x290 [ 1154.421944][ T2131] do_syscall_64+0x166/0x520 [ 1154.427048][ T2131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1154.433451][ T2131] [ 1154.433451][ T2131] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 1154.442053][ T2131] blk_alloc_queue+0x544/0x690 [ 1154.447336][ T2131] __blk_mq_alloc_disk+0x194/0x390 [ 1154.452957][ T2131] nbd_dev_add+0x494/0xb60 [ 1154.457882][ T2131] nbd_init+0x168/0x1f0 [ 1154.462547][ T2131] do_one_initcall+0x250/0x870 [ 1154.467823][ T2131] do_initcall_level+0x10a/0x1a0 [ 1154.473284][ T2131] do_initcalls+0x59/0xa0 [ 1154.478129][ T2131] kernel_init_freeable+0x29d/0x3e0 [ 1154.483842][ T2131] kernel_init+0x22/0x1d0 [ 1154.488692][ T2131] ret_from_fork+0x514/0xb70 [ 1154.493795][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1154.499068][ T2131] [ 1154.499068][ T2131] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 1154.506268][ T2131] fs_reclaim_acquire+0x71/0x100 [ 1154.511726][ T2131] kmem_cache_alloc_lru_noprof+0x65/0x5f0 [ 1154.517960][ T2131] alloc_inode+0xb8/0x1b0 [ 1154.522805][ T2131] iget_locked+0x12c/0x690 [ 1154.527742][ T2131] kernfs_get_inode+0x4f/0x770 [ 1154.533452][ T2131] kernfs_get_tree+0x5cd/0x980 [ 1154.538732][ T2131] vfs_get_tree+0x92/0x2a0 [ 1154.543667][ T2131] do_new_mount+0x325/0xb00 [ 1154.548741][ T2131] __se_sys_mount+0x31d/0x420 [ 1154.553936][ T2131] do_syscall_64+0x166/0x520 [ 1154.559046][ T2131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1154.565455][ T2131] [ 1154.565455][ T2131] -> #1 (&root->kernfs_rwsem){++++}-{4:4}: [ 1154.573438][ T2131] down_write+0x91/0x200 [ 1154.578204][ T2131] kernfs_remove_by_name_ns+0x4e/0x140 [ 1154.584177][ T2131] device_links_driver_bound+0x4ab/0x1440 [ 1154.590471][ T2131] driver_bound+0xd8/0x2e0 [ 1154.595401][ T2131] really_probe+0x774/0xae0 [ 1154.600418][ T2131] __driver_probe_device+0x1e8/0x360 [ 1154.606214][ T2131] driver_probe_device+0x4f/0x240 [ 1154.611753][ T2131] __device_attach_driver+0x270/0x410 [ 1154.617637][ T2131] bus_for_each_drv+0x258/0x2f0 [ 1154.623006][ T2131] __device_attach+0x2bd/0x430 [ 1154.628293][ T2131] device_initial_probe+0x9c/0x100 [ 1154.633955][ T2131] __bus_probe_device+0x126/0x220 [ 1154.639524][ T2131] device_add+0x7d7/0xb80 [ 1154.644365][ T2131] faux_device_create_with_groups+0x1a5/0x2b0 [ 1154.651011][ T2131] regulator_dummy_init+0x19/0x40 [ 1154.656549][ T2131] regulator_init+0xca/0x110 [ 1154.661647][ T2131] do_one_initcall+0x250/0x870 [ 1154.666922][ T2131] do_initcall_level+0x10a/0x1a0 [ 1154.672374][ T2131] do_initcalls+0x59/0xa0 [ 1154.677217][ T2131] kernel_init_freeable+0x29d/0x3e0 [ 1154.682929][ T2131] kernel_init+0x22/0x1d0 [ 1154.687780][ T2131] ret_from_fork+0x514/0xb70 [ 1154.692892][ T2131] ret_from_fork_asm+0x1a/0x30 [ 1154.698195][ T2131] [ 1154.698195][ T2131] -> #0 (&root->kernfs_supers_rwsem){++++}-{4:4}: [ 1154.706818][ T2131] __lock_acquire+0x164c/0x2de0 [ 1154.712193][ T2131] lock_acquire+0x115/0x350 [ 1154.717209][ T2131] down_read+0x45/0x320 [ 1154.721879][ T2131] kernfs_remove+0x35/0x80 [ 1154.726830][ T2131] __kobject_del+0xe0/0x310 [ 1154.731853][ T2131] kobject_del+0x45/0x60 [ 1154.736616][ T2131] cleanup_glue_dir+0x1a3/0x220 [ 1154.741985][ T2131] device_del+0x77d/0x8f0 [ 1154.746822][ T2131] unregister_netdevice_many_notify+0x181a/0x1d80 [ 1154.753756][ T2131] unregister_netdevice_queue+0x2f5/0x340 [ 1154.759993][ T2131] nsim_destroy+0x275/0x800 [ 1154.765107][ T2131] __nsim_dev_port_del+0x14e/0x200 [ 1154.770729][ T2131] nsim_dev_reload_destroy+0x288/0x490 [ 1154.776708][ T2131] nsim_dev_reload_down+0x8a/0xc0 [ 1154.782239][ T2131] devlink_reload+0x1ed/0x7f0 [ 1154.787508][ T2131] devlink_nl_reload_doit+0x921/0xc80 [ 1154.793404][ T2131] genl_family_rcv_msg_doit+0x233/0x340 [ 1154.799464][ T2131] genl_rcv_msg+0x614/0x7a0 [ 1154.804480][ T2131] netlink_rcv_skb+0x226/0x4a0 [ 1154.809761][ T2131] genl_rcv+0x28/0x40 [ 1154.814255][ T2131] netlink_unicast+0x8ef/0xa80 [ 1154.819533][ T2131] netlink_sendmsg+0x7f0/0xb20 [ 1154.824815][ T2131] sock_sendmsg_nosec+0x14e/0x190 [ 1154.830353][ T2131] ____sys_sendmsg+0x54e/0x850 [ 1154.835633][ T2131] ___sys_sendmsg+0x2a5/0x360 [ 1154.840832][ T2131] __x64_sys_sendmsg+0x1b1/0x290 [ 1154.846306][ T2131] do_syscall_64+0x166/0x520 [ 1154.851430][ T2131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1154.857837][ T2131] [ 1154.857837][ T2131] other info that might help us debug this: [ 1154.857837][ T2131] [ 1154.868062][ T2131] Chain exists of: [ 1154.868062][ T2131] &root->kernfs_supers_rwsem --> cpuhp_state-up --> gdp_mutex [ 1154.868062][ T2131] [ 1154.881457][ T2131] Possible unsafe locking scenario: [ 1154.881457][ T2131] [ 1154.888901][ T2131] CPU0 CPU1 [ 1154.894254][ T2131] ---- ---- [ 1154.899608][ T2131] lock(gdp_mutex); [ 1154.903498][ T2131] lock(cpuhp_state-up); [ 1154.910338][ T2131] lock(gdp_mutex); [ 1154.916748][ T2131] rlock(&root->kernfs_supers_rwsem); [ 1154.922204][ T2131] [ 1154.922204][ T2131] *** DEADLOCK *** [ 1154.922204][ T2131] [ 1154.930341][ T2131] locks held by syz.1.8875/2131: 5, last CPU#0: [ 1154.936577][ T2131] #0: ffffffff914f05e8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1154.944766][ T2131] #1: ffff8880232da128 (&dev->mutex){....}-{4:4}, at: devlink_get_from_attrs_lock+0x34a/0x490 [ 1154.955119][ T2131] #2: ffff888021eb8258 (&devlink->lock_key#16){+.+.}-{4:4}, at: devlink_get_from_attrs_lock+0x360/0x490 [ 1154.966345][ T2131] #3: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 [ 1154.975307][ T2131] #4: ffffffff90a1a600 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 1154.984439][ T2131] [ 1154.984439][ T2131] stack backtrace: [ 1154.990316][ T2131] CPU: 0 UID: 0 PID: 2131 Comm: syz.1.8875 Not tainted syzkaller #0 PREEMPT(full) [ 1154.999599][ T2131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 1155.009652][ T2131] Call Trace: [ 1155.012923][ T2131] [ 1155.015843][ T2131] dump_stack_lvl+0xe8/0x150 [ 1155.020438][ T2131] print_circular_bug+0x2e2/0x300 [ 1155.025469][ T2131] check_noncircular+0x12f/0x150 [ 1155.030406][ T2131] __lock_acquire+0x164c/0x2de0 [ 1155.035264][ T2131] lock_acquire+0x115/0x350 [ 1155.039766][ T2131] ? kernfs_remove+0x35/0x80 [ 1155.044353][ T2131] down_read+0x45/0x320 [ 1155.048504][ T2131] ? kernfs_remove+0x35/0x80 [ 1155.053086][ T2131] kernfs_remove+0x35/0x80 [ 1155.057492][ T2131] __kobject_del+0xe0/0x310 [ 1155.061995][ T2131] kobject_del+0x45/0x60 [ 1155.066238][ T2131] cleanup_glue_dir+0x1a3/0x220 [ 1155.071082][ T2131] device_del+0x77d/0x8f0 [ 1155.075406][ T2131] ? __pfx_device_del+0x10/0x10 [ 1155.080273][ T2131] ? pm_runtime_set_memalloc_noio+0x1e7/0x260 [ 1155.086426][ T2131] ? netdev_unregister_kobject+0x347/0x450 [ 1155.092276][ T2131] unregister_netdevice_many_notify+0x181a/0x1d80 [ 1155.098700][ T2131] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1155.105470][ T2131] ? __mutex_lock+0x305/0x15a0 [ 1155.110235][ T2131] ? lock_acquire+0x115/0x350 [ 1155.114907][ T2131] ? __kfree_rcu_sheaf+0x21/0x690 [ 1155.119932][ T2131] unregister_netdevice_queue+0x2f5/0x340 [ 1155.125677][ T2131] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1155.131915][ T2131] ? mutex_destroy+0x39/0xf0 [ 1155.136505][ T2131] nsim_destroy+0x275/0x800 [ 1155.141012][ T2131] __nsim_dev_port_del+0x14e/0x200 [ 1155.146115][ T2131] nsim_dev_reload_destroy+0x288/0x490 [ 1155.151594][ T2131] ? __pfx_hook_capable+0x10/0x10 [ 1155.156637][ T2131] nsim_dev_reload_down+0x8a/0xc0 [ 1155.161843][ T2131] devlink_reload+0x1ed/0x7f0 [ 1155.166531][ T2131] ? __pfx_devlink_reload+0x10/0x10 [ 1155.171739][ T2131] ? apparmor_capable+0x126/0x170 [ 1155.176770][ T2131] ? bpf_lsm_capable+0x9/0x20 [ 1155.181441][ T2131] ? security_capable+0x7e/0x2c0 [ 1155.186388][ T2131] devlink_nl_reload_doit+0x921/0xc80 [ 1155.191776][ T2131] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 1155.197677][ T2131] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1155.203997][ T2131] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1155.210333][ T2131] genl_family_rcv_msg_doit+0x233/0x340 [ 1155.215876][ T2131] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1155.221945][ T2131] ? bpf_lsm_capable+0x9/0x20 [ 1155.226625][ T2131] ? security_capable+0x7e/0x2c0 [ 1155.231589][ T2131] genl_rcv_msg+0x614/0x7a0 [ 1155.236115][ T2131] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1155.241156][ T2131] ? __pfx_devlink_nl_pre_doit_dev_lock+0x10/0x10 [ 1155.247586][ T2131] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 1155.253483][ T2131] ? __pfx_devlink_nl_post_doit_dev_lock+0x10/0x10 [ 1155.259992][ T2131] netlink_rcv_skb+0x226/0x4a0 [ 1155.264776][ T2131] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1155.269795][ T2131] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1155.275088][ T2131] ? down_read+0x2b9/0x320 [ 1155.279506][ T2131] genl_rcv+0x28/0x40 [ 1155.283482][ T2131] netlink_unicast+0x8ef/0xa80 [ 1155.288268][ T2131] netlink_sendmsg+0x7f0/0xb20 [ 1155.293064][ T2131] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1155.298356][ T2131] ? aa_sock_msg_perm+0x144/0x210 [ 1155.303377][ T2131] ? apparmor_socket_sendmsg+0x98/0x360 [ 1155.308921][ T2131] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1155.314205][ T2131] sock_sendmsg_nosec+0x14e/0x190 [ 1155.319228][ T2131] ____sys_sendmsg+0x54e/0x850 [ 1155.323990][ T2131] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1155.329283][ T2131] ? import_iovec+0x73/0xa0 [ 1155.333787][ T2131] ___sys_sendmsg+0x2a5/0x360 [ 1155.338456][ T2131] ? __lock_acquire+0x747/0x2de0 [ 1155.343391][ T2131] ? __pfx____sys_sendmsg+0x10/0x10 [ 1155.348583][ T2131] ? futex_wait+0x2a2/0x390 [ 1155.353103][ T2131] ? __fget_files+0x3a2/0x420 [ 1155.357776][ T2131] ? __fget_files+0x2a/0x420 [ 1155.362367][ T2131] __x64_sys_sendmsg+0x1b1/0x290 [ 1155.367297][ T2131] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1155.372756][ T2131] do_syscall_64+0x166/0x520 [ 1155.377340][ T2131] ? trace_irq_disable+0x3b/0x140 [ 1155.382365][ T2131] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.388420][ T2131] ? clear_bhb_loop+0x70/0xc0 [ 1155.393095][ T2131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.398981][ T2131] RIP: 0033:0x7f526b59fb19 [ 1155.403392][ T2131] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1155.422995][ T2131] RSP: 002b:00007f526c54c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1155.431410][ T2131] RAX: ffffffffffffffda RBX: 00007f526b825fa0 RCX: 00007f526b59fb19 [ 1155.439374][ T2131] RDX: 00000000000000b0 RSI: 0000200000001000 RDI: 0000000000000009 [ 1155.447345][ T2131] RBP: 00007f526b637b70 R08: 0000000000000000 R09: 0000000000000000 [ 1155.455309][ T2131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1155.463274][ T2131] R13: 00007f526b826038 R14: 00007f526b825fa0 R15: 00007ffd50b8c028 [ 1155.471247][ T2131] [ 1155.492650][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1155.608874][T24911] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1155.639053][ T7225] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1155.649246][T24910] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1155.649548][T24910] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1155.999107][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1156.509195][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1156.819316][ C0] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 1157.019140][ T7216] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1157.529018][ T7216] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1158.039045][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1158.549021][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1159.059360][ T7216] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1159.569216][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1160.079111][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1160.588937][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1161.099132][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1161.608945][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1162.119437][ T7225] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1162.639224][T24910] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1163.149143][ T7221] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 1163.659127][T24911] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01