last executing test programs: 2.90330841s ago: executing program 0 (id=7715): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x22}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0xc0fe, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r0}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x3}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 2.606434965s ago: executing program 0 (id=7717): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xc1, 0x0, 0x0) 2.437296799s ago: executing program 0 (id=7720): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)}], 0x1}, 0x48002) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r4) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r4) sendmsg$NL802154_CMD_NEW_INTERFACE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x28, r5, 0x1, 0x0, 0x0, {0x1c}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}]}, 0x28}}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000003080)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r7}}, 0x24}}, 0x0) 2.206198622s ago: executing program 4 (id=7724): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00"/13], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xf, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x326}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xe, 0x0, &(0x7f0000000200)="449d060721b9e6bb51f2f6f20504", 0x0, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 2.085523002s ago: executing program 4 (id=7726): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="170010df670001002cbd7000fcdbeddf0f"], 0x18}, 0x1, 0x0, 0x0, 0x4482}, 0x100000000000000) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES32=r1, @ANYRESDEC=r0, @ANYRESHEX=r0], 0x14}, 0x1, 0x0, 0x0, 0x20000054}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r3) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3802f0ffb6c21fe7200a920ac84cdeef0512afe8a5a5c14b624515073698b2ac60b6dd3633e511e08db2dd81bdcda7db4767e3a39feec340c3f1321803d2bae167ccce73c313d93330933623ff8c344d3cee2030b6c8d3510d83fef49610a40baf1cc09433314f2d46a573adf3f87f5f87c2278b1bc22bb8b8bec2c26ae32dd1c2ab936ebaaf37e2bcf004df0df1414e4b8d178421eb2bf8b34a0095862a7a2fffebd6ec57d01d80ec7e7e2f0afbd41a26ca5a86e8a77f3d27a4b2cc77c6b2375421b91b7b7475b0f4ec6d3d20693769513c7636da484e778f111c6c167a9e6b7fc973547a800e279884b7a5a8312225c33c49892f599b6cad099e1979736a164413b4a2b5", @ANYRES16=r4, @ANYRESOCT=r5, @ANYRES16=r0, @ANYBLOB="1c00e7945c71b83650004fb9112c2b5f8846be003d535e6142fd2747"], 0x38}, 0x1, 0x0, 0x0, 0x40048}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'veth0_macvtap\x00', 0x100}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x2d75000) unshare(0x28000600) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000ec0)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442e05d9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x2, '\x00', 0x0, @sk_skb=0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="12000000050000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)=ANY=[@ANYRES32=r0, @ANYRES16=r6], 0x10) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)) socket$packet(0x11, 0x3, 0x300) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000880)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r8}, 0xc) sendmsg$NL80211_CMD_GET_COALESCE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="1df0a376ad11dbe8cb90e9b012"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x81) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f0000000100)=ANY=[], 0x32600) r10 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x10, '\x00', 0x0, @sk_msg}, 0x94) close(r10) r11 = socket(0x28, 0x5, 0x0) r12 = socket(0x26, 0x3, 0xfffffffd) bind$vsock_stream(r12, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r12, 0x4) connect$vsock_stream(r11, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) 1.970445169s ago: executing program 4 (id=7727): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000007c0)={0x14, 0x0, 0x20, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000024c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r1, @ANYBLOB="8249e900800005001c00378009000100626f6e64000000000c0002800500100006000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x20000c10}, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000440), 0xffffffffffffffff) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0xfffffffd}}, 0x10) bind$tipc(r5, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r6, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) bind$tipc(r5, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x20000003}}}, 0x10) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r7, 0x6, 0x24, &(0x7f0000000340), &(0x7f00000003c0)=0xffffffffffffffa0) bind$tipc(r6, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r6, 0x0, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000480)={0x54, r4, 0x409, 0x70bd29, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xffffffffffffff1e, 0x3, 0x2}}, {0x8, 0xb, 0xf}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0x550}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x40) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0041, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r8, 0x400454d8, &(0x7f0000000140)=0x90) write$tun(r8, &(0x7f0000000080)=ANY=[@ANYRESOCT], 0xfdef) 1.801588003s ago: executing program 0 (id=7728): bpf$PROG_LOAD(0x5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="400000001000010025bd3000ffdbdf2500000000d8086bf49e348976b007606b72a70288d64739c53f5559714c6e37522bfdd5f6447174cd20668e33fa84800306bf6092234cfeaa44f45689df9a9b9bf72703d859dfb6c537b7c0f473a0c04afdb7fc8c7599b2ac1c3cc4dfef0b21e0a47ceb75c51715533060095c81793d26a2e88964", @ANYRES32=0x0, @ANYBLOB="3a290600030000001f0022002edaaa357d695598d4e0e3fd22d366def58542c046b4dff6a8b34600"], 0x40}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) socket$nl_route(0x10, 0x3, 0x0) unshare(0x24020400) unshare(0x66000080) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448e7, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0x101, 0x0, 0x0, {}, [{0x54, 0x1, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20}, {0x72}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x5}, 0x1c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000200)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000280)={'filter\x00', 0x7, 0x4, 0x4f0, 0x2f8, 0x1e8, 0x0, 0x408, 0x408, 0x408, 0x8000000, 0x0, {[{{@arp={@multicast2, @dev={0xac, 0x14, 0x14, 0x12}, 0xff, 0x0, 0xe, 0x9, {@mac, {[0xff, 0xff, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0xb856, 0xc3c9, 0xb, 0x2, 0x4, 0x6, 'ip6erspan0\x00', 'vcan0\x00', {}, {0xff}, 0x0, 0x82}, 0xc0, 0x1e8}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0xc, 0xfff, 'system_u:object_r:urandom_device_t:s0\x00'}}}, {{@arp={@remote, @loopback, 0x0, 0xffffffff, 0x0, 0x6, {@empty, {[0x0, 0xff, 0xff, 0xff, 0xff]}}, {@empty, {[0x0, 0xff, 0x0, 0xff, 0xff, 0xff]}}, 0xe, 0xd735, 0x7f, 0x7f, 0x7fff, 0x3, 'bridge_slave_0\x00', 'macvtap0\x00', {0xff}, {0xff}, 0x0, 0x200}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @broadcast, 0x1, 0xffffffff}}}, {{@arp={@loopback, @local, 0xff000000, 0xffffffff, 0xd, 0xa, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}, {[0xff, 0x0, 0xff]}}, {@mac=@remote, {[0x0, 0x0, 0xff]}}, 0x3, 0x0, 0xffff, 0x200, 0xd538, 0x4, 'bond_slave_1\x00', 'veth1_vlan\x00', {0xff}, {0xff}, 0x0, 0x4b}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @dev={0xac, 0x14, 0x14, 0x29}, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x540) 1.799772351s ago: executing program 2 (id=7729): unshare(0x2a020480) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r3, &(0x7f0000000280)={&(0x7f0000000040)=@name={0x1e, 0x2, 0x2, {{0x43}, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="180000007000010025bd7000fbdbdf2b42f8278ffd826003cbb1968fb73297bd5f5a5e3c4a72e59dd03d9175083f2bbf63cb5838e15d4c1c75653be3e5cfa8bb87475e735de31f9023ffce7efde1917ad3d9cb9f72409e2dd386d34d189c32626df94eb45faa2c7dddb76b5d6d0b2c063ee210872eb8b5bd81f40451934c0b00e1e19989da3682c7772068060da5a900b897daa6fbeb380b25c9d23acf52b4c4c0f7ec21161b6dd5121b7eba292da97fd8aab35c", @ANYRES32=r2], 0x18}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, 0x0, 0x0) 1.640638685s ago: executing program 2 (id=7730): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r0, 0x2000012, 0xd, 0x0, &(0x7f0000000080)="63eced8e46dc3f2ddf33c9e9b9", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.638366772s ago: executing program 4 (id=7731): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000cc0)=[{{&(0x7f0000000100)=@l2tp={0x2, 0x0, @broadcast, 0x3}, 0x80, 0x0}}, {{&(0x7f0000000700)=@in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0x18}, 0x60}, 0x80, 0x0}}], 0x2, 0x48094) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xffffff6a) sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffff000) 1.466754245s ago: executing program 2 (id=7733): r0 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000040)=@qipcrtr, 0x80, 0x0}, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000100)={0xc, @dev={0xac, 0x14, 0x14, 0x29}, 0x4e23, 0x0, 'wrr\x00', 0x4, 0x1, 0x3c}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="1802000065f9bfff00000000fdffffff850000002c00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) unshare(0x2a020400) socket$kcm(0x10, 0x0, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0xffffffff}, [@call={0x85, 0x0, 0x0, 0x2e}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="380000002500090126bd7008fcffffff020000000c003d80080027004a010100080003004700000010003e80f7"], 0x38}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) 1.371866332s ago: executing program 0 (id=7735): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="600000001000030400000000fedbdf2500007400f728ab93db3c140d69363e3273752c18fb3ff28f25abc8f645000ea41d2c292d330aaf5f6c5bf158a72d1c01b4de725a894ffa6fc8934ef3402a646fc57b88bf57de4902c3699b4f6c9b7fa498e9356c7906056c02f02b4f9b6708737b9fe80ffb8fda620b071256eb58a45c85d673480dcf8a9036c4ea97302c3a5dbcfe7135c8ac04e1fd", @ANYBLOB="0008000000000000400034801400350076657468315f766c616e0000000000001400350076657468305f746f5f7465616d00000014003500776c616e3000"/72], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000840)={0xcc, 0x0, 0x8, 0x70bd2d, 0x25dfdbfe, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r4}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg2\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x6}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}]}, 0xcc}, 0x1, 0x0, 0x0, 0x60048090}, 0xc0) socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="140100002e00010000000000fbdbdd250401f2800c00160002ac0f0000000000140017"], 0x114}], 0x1, 0x0, 0x0, 0x41}, 0x4008080) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r7, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) connect$rose(r7, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) 1.206135453s ago: executing program 3 (id=7736): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x1d, 0x2, 0x6) unshare(0x20000400) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000040)=@ethtool_cmd={0x2e, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x87, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80000045, [0x8000002, 0x89ff]}}) socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) unshare(0x6020400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x3, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r2, 0x8000000000000002, {0x1, 0xf0}, 0xfd}, 0x18) 1.204413684s ago: executing program 2 (id=7737): bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="020000000400000008000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xf, &(0x7f0000000700)=ANY=[@ANYBLOB="1808000400008af825e500f30000000000000100000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca900001800000035090100000000009500000000000000bf9800000000000056080000020000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000300)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x44, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x200}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000280)={r4, 0x4}, &(0x7f00000002c0)=0x8) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r6, &(0x7f00000006c0)={&(0x7f0000000240)=@in6={0xa, 0x4e22, 0x7, @rand_addr=' \x01\x00', 0x6}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000500)="47bd5ba310ecba111530ba187b575c2176d68dd8f449e0f93bf58b3585929a635ac25829b0f60076c25d7cae155d4f8f26f496792bfeb84fd939ef0b4353cd7d89c729af89397bb816c67f187164b41d7deca58ebfb54ed96573d031289503154fe71346b316c47954869e46af428656f7ecce069abd71d98a287170b567f3308d8fb6e9e054b06e7d886159a72cbd6aab2c5f23b26f07d95800dce85977e9bd66314f1f8c2c32892d1c7f6723bb5c164b8c4d2ee35c78c0a5b03eda87372ac2aee38f1b9139cf416ed89f69c0255f04eb11c52569c67232e362b55ee738fc9e95a28d", 0xe3}, {&(0x7f0000000e00)="cca06bcb929342ac135df0ad2ccbff04b2220eb3ac0bff4ea4089b81f46cafcc7a87f7209a936332eaa8a6479873b8cdbd12178f65b9e7f31f12c92c7dd8fbb467178018f61dcc3a7df96565a6fa02d66d63f4ddd89c3546cc4d3bda87aac310a6b55d13b30d1cacb98a107b0c53cfa1590d792e4f6934f5758f0ad5741e91d02ab45a38aa3eafea89934a8b6cd7d0051a5283021d4682860199a1b3d79a520f2c5d1b71f8cf2597c2fdc23a1496b3ec339a01c73dabfe16a3e0b8383a7a5b142c0b42a61b479c2e7e91fcbe16ee58e5f0008e25ba41f754b866f5c82e489178f137ec22c2cfab86701d9c0c5fd12c0f2bb696e38acc6894a73c04cfda7a314ef7c630614ca07e52686654d7c316248cc6869448b26981b24b555200cca91fcda81adb710d8ae6fee919d48e7cf6903973e74cb23603354cd8c3f1ec8c3dffd442792583fac34ec8b01e85f87d7758a817eabd996cbab03d81dd6538fc4a6979005d8d8c883393a0b1307fe0b176eb3a95c45b59c5baaeed8f00486c1f1d408ab26f3d3447cbc09017eb6697ae696771ca66a9e66d2fd04a4ee356a3b51dced17bddafffb032a3d215288e372c03990a5e06970b7d3c22f3144cc4ece99ecf2fa54a6081dfae10b33320cc5dc6f930aaee917e12d744dca043ce790f05c9051c5e44872c6b69837dabaf53c3cec90503527c605d9277379eb6fdac53f54026dc7ea83ff83d32f826fe536963f28dea392750c70d4aa617670fcf97a3f74f425715f4a214afd524ddc997e19f2faf05978e4dca194c95c211c198fc63aa0d2f607be1c0ec1cf7289451c3d4b612f504710626dcdbe1e2fb4b6746c01254ab98244882b6502cae66c49b718b9203fc4f1b9c0e113997878238a84db1734d614366c28ce5f6ec29ed98963548e1e0d7ebfe9ccaffa3ee2fbee0a3e018e470a91dce894a7ea0043a6a4d43b449fd9eb7f33b3470ba889ce6786f1f510215e2ef133fbfbc1a4b1999e8db7d25c8d140b940293c1e78afea14a486423ef6417c58ca5b5e48ca2950862f65348e59e5e7d5cf1f6ee147a473edf085174c622b5e20d832616ded582db80efa9c7938c1e9a92d5a767f6f7ca33b489b07b68ca3de4ea216446af6e255e7d496f90b8dae924f353257a4195d55a72add44be5f10e7c128f7ce7a6f8ce9f71c332e5da55c35d61d5b1712c54bb8858bd0d15593af314343fc383787287c5f3464b2bb1e842978375eabddca68b9ad60b21aed72573c23c9f73577801ec47e856b517cdc2e6ade9bb64e0e3f1cf92276c55c8721d41fdfac2d77c14df9663df86fff29d9955cc85234b946e3eb5bb578eb2ba9ec45470731f399c1fc42bb2f862aa09f32b38ccd2aa8041b15df06c78777dcc691e7ef8043f2987953c07aaba5bb71a9d6a4aae3ca94c1082f375821d07d498a310f03b5a64afc1ee1f8d716bf06ada5848f2ef72a3738f8796b944fab234660652260b9d8d2a4d7004f2bb4ee7cbcd314539d0ef890a8c37ccd2731871864731b9378976c9377dfd184c6d925d58c98822ed9ecc47a732ed802042096d231dbb09b9c5bb29b03570a027db1ac89243ab9863c1b7c6b4dff45d2ce94c743334a5f16d46bcf4d534ef17a3dde8b2a4afb8da10741bb58440091ccb4878f47044de0863c9a3f16980efb5b1322b6c889303e33ca2350b354539d2fdc61885fb6c03c2d41f4ed9ab76f960f9ac179145db63cef419623cd02aafb94c93d672f7852137f14cf34ec34ea110209f3601dad24a771bfda7fdfbc971c41ef398b499b8a8d464ec8b253de40a93372c26f14319287cfc7f6f0dbbbb6a67ede4f86df57afbb667f4137eaf3534492047d2a29480e32a5dba0e215f11c87eb64cf3a31bab21590ab676a57d972eccd545697bba6be59036847b7da75bf834472b75e3c21efc3e04eb21e26e8618705ba121a324c699d9a44c9b5291b73d3ae3dc64db33fb0de98d4df31c1d643e29ab9a32ac14fc1f8f165099e27f16cab472167bbd0e8aa0b74632f398ad3b48d7ac4d0bbbda4a9a9155d59f556295d5ab4e09ff3881e1de06f770e2089eadc7c198f10c63b1ad54465a57953997882d850bdfb749402cf0e78130b8d584582c8c0124fa9b8ac54807d5daf8582fb73060b247fb9bca4cff9c7506b08f6a10a91827ee7a98a727420e90fa0fd6b9ac22c04e8ebad9abe1ed8ced6f8ea8a9db8f962ad657a267f8a624734a9ea3c0509334a598cf406efd9f621261f937a8e44dd0296098aacda9156bf7475fb2c6008aa45ef25d4e046d8cd5cb80f92b3f957b75a5a31bd0be2a67ef2d779ea571f61cc1c5565366193b18cfd531d9c59011cc2ff622c42098753037ba6cd6fda85531109cc40bc8e346b547088d29d1606c2f07221463c47686ad8e56127aaadb9acb7929b5ba3ec99554446700ff5f8ad335fd7658d2817c2d7a31c8af47a6d8830ae4aad5753f9857aeb19d175c6a6e76afd152e4925be8f8f7116bace64d259d64f7d48a296ae068ddbbc179cc61e91f6cf1a2ddb4743ede203c3eaa11e5c4a3e396de40746604aafa261defc3bb5db30d2c7c662ff0b51fb0d1a65f9c5ec34994cc2a01595f2799209771768961f26170b3c3dbaa9a22b974ab5fba5fe5012ab86cc3b2252263668d7a58826c9da6d093c1d085e3a0673cea79553a9eb4d6aa0d596aae01115bb9e0dfd330f64deaa63f3d1997f8e7e70c557679e35328d76880726ce9d5efdbb9ce4afe21125484c7220666063fc634d8d6ebdb83fac12d58a0662297f835e362c4b2798804d920e40b271a4b68def5636f089102639116c81e19d9eb24068c8a06f78fcbcb650b16bcb67eed718a3bb7e6b5122709db71293b21e7de9190e689b04d446f3593787e751134d035f3b58b0a238160cf3ef7bebabb0b920636560cd527bd10b2a0938c657c97daa4361358f1547da3196b337b4818fc33af702da60742126f2520a6ffd595f114ace4147f91067269cea92932d2230bbf7774e72245e9b21039ca05aa32e04b4e5acc59b5651e6458592639c990e2408b6f9f9244c9c7e8d3d338805640283fb2407909f1de641a71e4b6ae8ddad4d5d8e867e5866e67e8631b0c1d2548a9e305949398e125c5824de3d8551f6b80f8c3444433b1be926cd4af3a66a8de46194e68b6505b51e22a083d76df3db5d07d7db1721a1e23443a6ac803a2d2f8144cae1bbc7bccb1c16466b963ba3c37597a8aa664d0f10eff423bf86a4790306d365ba318278418165fcf0a012e43e79ed6ff0eff9909cf613480c05a123dac3103de137263d04eadd704b78b33ae7100520d1a4c9dc20a8e6bda1d87e1e34caafd9e9f986914c762ef08ac5ace1be7aa101a8f8d5ce23b62704edbb7b8962474f0b023a643176e8493d4060e6de9411130cfb45f7753db830e3813a6e946e61d48708c14bf432660178532a67225226a39990178023a995fda93e3d7181f419eb080731b215a21ce2248582c26c5821c6c0838080a166b7e47fedb9aa8f8d14c06ec73bb811e3b03ccfb9975e463f238f42a6fb460412b25232056182d0e7adf686665988e6f84ad379d93af7c3355550e128df7764a07bfe286bb4e3aec429d5fba50db4da7dcea734d0d25c2e80653053e81968aec3681ae54a82af5396b01ea3fddf46308026063a821d7123057861c27e4a00c7ad7ce699269b291f054effdd387560474872cb565a58ea11d0534799f3f761229621bc2249c24c9333d2c7a461e35185715bcc34f8dd3666341301706f689b3283f1b954674a99ac365d8ebd4f5d7a878a8593617935722215fe240f7e0a9bab68538cf4cb5e99647bb238ed67d25f7a3311bb9a94d0d09ea424d5e37f55a3d6733e3ee6c025dd669a5dd5ab6d491cd6f34cfd6a125156449db21c7668c05f04ae613d7a03429cc248c31eb449379b64ea535a707d6f4a607e350b850de4b1efcd77d1042a9a0c4b4dd486a92a616d89c0f99fdd65f105da66d4b60a40e849cfc4a49bf128763ce912e1fa17de4e1e1dcde6099dbdb7768bb09d87f9bb1e802864c4cdb3babd4ba0a44942427e4506cce3c3c35230623fec949df6a944858470373c968bddfed2ee18a3b802cb756fa3a3fc1dacc35ca68b0d2041b7945b74ee7c84a4d83a9a00112a4450e3a895a59f1c606105cd1b8480bd3b7d606218399b2f70423439f753a6ecc5d80d08059ce821974417b9773f58de1db4e0e63da082305a16a9550f5a32e6f42fd81de48719bebd7b7e47a6047177ad6ad1f065be598f23307fa480e5c4a5713a2437b3b5926bafda90a46a64efe9ec5cafcbca5a44f9e7fd98adeff03e796a3d13b6bff9540bb09b5686ed06656c1394092aaa03d441a5788d96108193ee26427d46f9f92c7f0174548987bc7c0ca123a113255231cf1f180eff3f885e39a724ed5343047972373ea6edb18081f6f42b6b22f5aaa647e2ec2f07131003166a999cb7f860023edf71665d392d525448f6a01b3324330bbde1682f73af3d3b2cc33e97da8bf41482be26f6acbd05898b07ce2da85c521c03fa88a1f63a8acebc18b6d5c260810efbc79d8d240923fa345ecb046a283209deba8dda060b722ba6c216c437c211defd8f0e868b768e46e7649e40b8160a0b7811e3c9e0533acf066bba2f6bec48df2285aab417a3fac3c981b92fd35e1ee6f8a4a5ef3ecfdfa121dac4812b448d55b58192697e8e95624f4dbd6959966d934a965b7c6353a1c342be01524681f7213f0f8adfec541e450a9cab3da6fda78ebd7c7796264a053f2a566cd8ae8a3c852990967d499f0693442c31d10532d2f0443c6840fafdcd557d9e56cd907f6b9fe7bf51200dee77d7cc75da8400c725a6dad099dd9a2240334e5fd5ee3a50f119145a9f1fa6fe60dac2257f5d1803f0b9e13579e3424c624fcbce861433744016df562aeae0e3cf27c5665d3c5a3298bea486a59c601222c6b2362941740dcb2e268a7de9819119926d5e567138263e9682d6c9a8869ca0d396ca0c34e558336b6c7edeff4d6010764d67cdd368071cb92257bfa207bd8fbf9cd789becbbb80b52a0f5e1d2e96aefc5502c00121ae75e86b5fd7a1c3b1758992276ba1f073552b0ec8dd0280d5cb4f2d13af6710a0101a51beb40ac4b1f9907f2fd45ef2386857684e20e2fa1533f19cd9213732f3842482c23e866e871971d157e2f1cb593e828c9ac355475f69e1ea86c901d064c11118755661a2a0dc9e1a49bbd37d2d47261b2e5a209a172fe256ef73fb416b201132225adfa8043707feb079c261927628f788222b64c343577a36f07cbfdabb22020e5e3efbe4fa39c1611e559c5c71772f0be4dfc9b2666abd53525c65a71889108fbaf099becd4556abf531fc2c3ac155a9cc75668c262cdb65f8b59038743765f51fd539d72fcd8f043c9034ea151781c0e4e3ac2ab7c31e67dbf4e6fec45e6fb8ea6429a1c154be6bc6f8c4338c72787ae5621851f75ced316724b7fa7ece3cf191be55bba5d1bbe8421b53598033a0fb72cbaebf75c311385fa7bd111e60fb0e3d5fb1dab655cc605a4d7bc04939a6152bbc1403ea69be8ec03c8839ec8818e81727a8e922ab9fecd91082c7850020a25443b6c0e6e73bc58762d024bb05a293c5806a9f575a38c3c821857ef149a1c9a0a37eae987c3330827ef53382ba645fc91c283119c1f6d00380fb2a79a2e2542f6b2c73bbc6af9be61f1dc1034b47c9e87e020ae6b5ca92418cad57c12de4b0ae60eff9998f6bd5090d34ece61cf7ce8d0fc2c9", 0x1000}], 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000008400000007004500640101020000000020000000000000008400000043d8c4810508000000fc0100000000000000000000001c000020000000000000008400000008000000fe88000000000000000000000000010118000000000000008400000007000004640101"], 0x70, 0x800}, 0x40f4) bpf$PROG_LOAD(0x5, 0xfffffffffffffffe, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000380), r5) sendmsg$NFC_CMD_LLC_SET_PARAMS(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01002603000000dbdf251000000005001000fe0000000600110060020000080001"], 0x2c}, 0x1, 0x0, 0x0, 0x90}, 0x8080) r9 = socket$rds(0x15, 0x5, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x9, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000000000000000000001812"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="351a0000100001"], 0x28}}, 0x20040881) write$tun(r11, &(0x7f0000000240)=ANY=[@ANYBLOB="1c0000f5"], 0xfd1) sendmsg$nl_netfilter(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="700000001200010100000000000000000700000008000000", @ANYRES32, @ANYBLOB="540000804e0031"], 0x70}, 0x1, 0x0, 0x0, 0x24014081}, 0x0) readv(r10, &(0x7f0000000380)=[{&(0x7f00000002c0)=""/168, 0xa8}], 0x1) bind$rds(r9, &(0x7f0000000040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) close(r9) 1.04591111s ago: executing program 3 (id=7739): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) setsockopt$inet_int(r0, 0x0, 0x7, 0x0, 0x0) r2 = socket$inet(0xa, 0x801, 0x84) connect$inet(r2, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r2, 0xfffffffd) r3 = accept4(r2, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x2, 0x79, 0x10, 0x28}, [@ldst={0x6, 0x3, 0x0, 0x0, 0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) recvmmsg(r3, &(0x7f0000001000), 0x581, 0x40000000, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f00000002c0)={0x1, 0x1, 0x2, 0xff, 0xa4, 0x0, 0x1, 0x0, 0x5, 0x28, 0x0, 0x0, 0x2, 0x20}, 0xe) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, 0x0, &(0x7f0000000180)) write$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000140)={'full'}, 0xfffffdef) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r4, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x50, r6, 0x917, 0x70bd26, 0x1000000, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3f}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @remote}}, @L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x50}}, 0x0) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000480)={@link_local, @random="c93707a23820", @void, {@ipv6={0x86dd, @generic={0x1, 0x6, "29fff2", 0x10, 0x2c, 0xff, @local, @mcast2, {[@hopopts={0x88, 0x1, '\x00', [@padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @enc_lim={0x4, 0x1, 0x2}]}]}}}}}, 0x0) 971.540478ms ago: executing program 1 (id=7740): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x0, 0x18fd9ca9fb75925e}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0xfff1}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x6, 0xfff3}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x408c0}, 0x4000) r5 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r5, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @link_local}, 0x14) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000000c0)={'wg1\x00', 0x0}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x1, 0x4, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000700)={&(0x7f0000000480)="b23c675f9d1ebb75c65b989f452f237f7dab5159c071f720bb7e68565346a61f76d8beac53f7802d8cfe93aab17093ee527628dfd2d73321c86f717c50cf315b624a539409c06af69f856f8e21d1f3e61c11249c0a99a246a22373b34ea1d389b6761896235785b2e021bcc5f5f71cf27f95f113f4215296a8fe61004b2aba0a7032547c4c66ad16b12c946c8bc084bab4af0025ab47fe8b6ecd4c3ac712af", &(0x7f0000000540)=""/147, &(0x7f0000000600)="b20781b075", &(0x7f0000000640)="0fa4f8c7f3cb8b9c44c4e3bd49e5f80d507be4063970ed49c0b648866207bf9afbeebdde60ab7eba8dbd29e30ded15ea1a48e6924e4ea9c73e6b48c35e722c621310481a152b6c4ffd6ec61900228c192759f1f546d32467bbf55b7c4e1fe3630d68352f74d3d8c1a987cb50dc8f920e205171ba0fea61ca61d829d33c9426fb7de4dfefbb7af14d41d7fe2729f8631f93f9d737a2768608e3387638415abc96703e", 0x3, r8, 0x4}, 0x38) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000100)={@broadcast, @empty, 0x0}, &(0x7f0000000140)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip_vti0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x10, 0x8000, 0x87, 0x9, {{0x25, 0x4, 0x0, 0x33, 0x94, 0x67, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@timestamp_addr={0x44, 0xc, 0x72, 0x1, 0x4, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}]}, @timestamp_addr={0x44, 0x3c, 0xdf, 0x1, 0xd, [{@broadcast, 0x7fffffff}, {@dev={0xac, 0x14, 0x14, 0x1c}, 0xa8ae}, {@multicast1, 0x8}, {@private=0xa010102, 0xd4}, {@broadcast, 0x3}, {@multicast1, 0x2a}, {@remote, 0xfffff000}]}, @lsrr={0x83, 0x1b, 0x8f, [@rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0xc}, @multicast2, @remote, @remote, @loopback]}, @noop, @timestamp_prespec={0x44, 0x1c, 0x99, 0x3, 0x0, [{@multicast2, 0x5}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xff8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}]}]}}}}}) sendmsg$ETHTOOL_MSG_COALESCE_GET(r1, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x9c, r2, 0x800, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x74, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x40}, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0xc3b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x6}]}}}]}, 0x48}}, 0x0) 896.895782ms ago: executing program 3 (id=7741): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @multicast1}}, 0x24) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) bind$rxrpc(r0, &(0x7f0000000340)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x0, @local}}, 0x24) 832.092224ms ago: executing program 2 (id=7742): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0xfffffffffffffdff, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x0, 0x33822}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_BROADCAST={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x26}}]}, 0x58}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x9, 0xfc, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', r2}, 0x50) getpeername(r0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$inet6_icmp(0xa, 0x2, 0x3a) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x4f23, 0x200000e, @loopback={0xe0}, 0x40000008}, 0x1c) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c001080080001"], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 766.775535ms ago: executing program 1 (id=7743): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000000100)={0x3c, r1, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast1}, @NLBL_MGMT_A_DOMAIN={0xe, 0x1, 'net/l2cap\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @private=0xa010101}]}, 0x3c}, 0x1, 0x2000700, 0x0, 0x20000000}, 0x24000080) 758.833992ms ago: executing program 4 (id=7744): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f0000000400)={0x7, 'wlan1\x00', {0x9}, 0x5}) unshare(0x28000600) syz_emit_ethernet(0x82, &(0x7f0000000000)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x2a}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa010101}, {@private}, {@dev}, {@remote}, {@private}, {@dev}, {@private}]}]}}}}}}}, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x1, 0x0, 0x1, 0x81, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x2}, 0x50) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000a80)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)='P', 0x1}], 0x1}}], 0x1, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) shutdown(r2, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0x9, @rand_addr=' \x01\x00'}}, 0x0, 0x3}, 0x90) getsockname$packet(0xffffffffffffffff, &(0x7f0000000380)={0x11, 0x0, 0x0}, &(0x7f0000000600)=0x14) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r4, &(0x7f0000000140)="c2", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) shutdown(r4, 0x1) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000180)={0x7, 0x7, 0xc, 0x9, 0x0, 0xc, 0x4, 0x6, 0x8, 0x2, 0xa1, 0x4, 0x3, 0x80}, 0xe) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=ANY=[@ANYRES16=r2], 0x34}, 0x1, 0x0, 0x0, 0x4084000}, 0x4000) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=0xffffffffffffffff, 0x4) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f000000000000000100000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000054000001b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000c309000001000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0xd}, 0x94) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x11, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000ff0f0000000000000100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000171e3b76055d015e2f3788a166d4e1000000008500000083000000bf0900000000000055090100000000009500000000000000185500000b0000000000000000000000bf91000000000000b7020000000000008500000084ac455a2d"], &(0x7f0000000300)='GPL\x00', 0xfffffff7, 0x20, &(0x7f0000000340)=""/32, 0x41000, 0x6, '\x00', r3, 0x25, r6, 0x8, &(0x7f0000000480)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x3, 0x5, 0xa, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000500)=[r7, r8], 0x0, 0x10, 0xc}, 0x94) socket(0x40000000015, 0x5, 0x0) socket$l2tp(0x2, 0x2, 0x73) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000140)={{0xffffffffffffffff, &(0x7f0000000000)='%]\xa0\x00', 0x80, &(0x7f0000000040)={@_ha_fsid={[0x9, 0x8]}, {0x8000, 0x427, 0x81, 0x101}}, 0x9, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0xfff}, {[0x7, 0xffffc9b3, 0xc, 0x3]}, 0x400, 0x35, &(0x7f0000000100)=""/53}) bind$inet(r9, 0x0, 0x0) 725.396712ms ago: executing program 3 (id=7745): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c"], 0x0, 0x58, 0x0, 0xa}, 0x28) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb97}], 0x1, 0x0, 0x100000, 0x1f000000}, 0x600) 724.226117ms ago: executing program 2 (id=7746): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000280)={'lo\x00', 0x7}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket(0x1e, 0x4, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) setsockopt$inet_MCAST_MSFILTER(r8, 0x0, 0x30, &(0x7f0000000b80)=ANY=[@ANYBLOB="fe"], 0x310) getsockname$packet(r8, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r7, 0x0, 0x40004) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x20000003, 0x8, 0x81, 0x1ff, 0x1, 0x1}, 0xffffffffffffffed) recvmmsg$unix(r6, &(0x7f0000004080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000440)=""/90, 0x5a}, {0x0}], 0x2}}, {{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000001dc0)=""/184, 0xb8}, {&(0x7f0000000500)=""/160, 0xa0}], 0x2}}, {{0x0, 0x0, 0x0}}], 0x3, 0x400123a0, 0x0) sendmmsg(r6, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, 0x0, 0x4, 0x8, 0x25dfdbff, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x45}, 0x4) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r9, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {}, {0x14, 0x18, {0x1, @bearer=@udp='udp:syz2\x00'}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000040}, 0x8000) ioctl$sock_inet_SIOCGIFADDR(r4, 0x8915, &(0x7f00000003c0)={'batadv0\x00', {0x2, 0x0, @loopback}}) r10 = socket(0x1, 0x803, 0x0) r11 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r11, &(0x7f0000001fc0)=[{{&(0x7f0000000440)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffc}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x22}}, {{&(0x7f0000000400)={0xa, 0x4e24, 0x0, @remote, 0x200}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="2400000000000000290000003200000020010000000000000000000000000002d5"], 0x28}}], 0x2, 0x800) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r13, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d80)=@newlink={0x54, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_FLAGS={0x6, 0x2, 0x1}, @IFLA_IPVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r12}, @IFLA_MASTER={0x8, 0xa, r14}]}, 0x54}}, 0x0) 595.569989ms ago: executing program 3 (id=7747): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000100)=@int=0x6, 0x4) syz_emit_ethernet(0x3e, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd607f00ef00084900fc000000000000000000000000fc010000000000000000000000000001200088be00089078"], 0x0) bind$inet6(r1, &(0x7f0000f67fe4)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r4, &(0x7f0000000000)="b892d6", 0x3) ioctl$BTRFS_IOC_TREE_SEARCH(r2, 0xd0009411, &(0x7f0000000440)={{0x0, 0x0, 0xc11, 0x1423, 0x7, 0x6, 0xa, 0x10001, 0x6, 0x8, 0x2, 0xe205, 0x3, 0xe, 0x9}}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000746c600848e0f005000000be352199b3d22eaceca0", @ANYRES16=r0, @ANYBLOB="03062fbd7000fddbdf25030000000c00018008000100", @ANYRES32=r3, @ANYBLOB="0500020000000000"], 0x28}, 0x1, 0x0, 0x0, 0x42000}, 0x4000054) 587.081051ms ago: executing program 1 (id=7748): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$rds(0x15, 0x5, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)}, 0x1f00) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f00000004c0)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x298, 0x168, 0x0, 0x0, 0x298, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x200}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'dvmrp0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) r3 = socket(0x840000000002, 0x3, 0x100) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) setsockopt$RDS_CANCEL_SENT_TO(r3, 0x114, 0x1, &(0x7f0000000240)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10) sendmmsg$inet(r3, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_buf(r3, 0x0, 0x30, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f0000000340)={'sit0\x00', &(0x7f0000000040)={@local, @loopback, 0xa, 0x6}}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0902000000000000000001000000050002000a00000014000700ff00000000000000000000000000000108000b00", @ANYRES32=r4], 0x38}, 0x1, 0x0, 0x0, 0x44851}, 0x0) sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x3c, r5, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @broadcast}, @FOU_ATTR_PEER_V4={0x8, 0x8, @empty}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x21}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x11}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000851}, 0x4000000) ioctl$sock_SIOCGIFINDEX(r0, 0x8927, &(0x7f00000001c0)={'wg2\x00'}) 471.641165ms ago: executing program 4 (id=7749): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020605000000000000000000000000030c000300686173683a6970000900020073797a32000000000500040000000000050005000a000000050001000600000014000780080006400000000208000c"], 0x58}}, 0x20000000) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000400), r1) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x20}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000001000ffff2bbd7000bbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="100a0500231a05003c0012800e00010069703665727370616e000000280002800600030030000000140007002001000000000000000000000000000206000e0003020000"], 0x5c}, 0x1, 0x0, 0x0, 0x24000840}, 0x9080) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x100}, 0x94) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010000104fefffffffcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="4012000000000000140012800b0001006970766c616e000004000280080005", @ANYRES32=r6, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x24000891}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2, 0x31}, 0x48) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000000c0)='highspeed', 0x9) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x38, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x28, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @typed={0x4, 0xe9}]}]}, 0x38}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet(r2, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"}) 427.081792ms ago: executing program 3 (id=7750): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300)=0x80de, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954e"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x100a, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002500010125bd7012a60c6f3b286159000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x4048957}, 0x28040) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002440)={0x1dc, 0x0, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TX_RATES={0x8, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4}]}, @NL80211_ATTR_TX_RATES={0x154, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0xfd}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x48, 0x4, 0x6, 0x4, 0x1b, 0x1, 0x6c, 0x18, 0x2b, 0x1b]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_60GHZ={0x7c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x16, 0x1, [0x6c, 0x1b, 0x6, 0xc, 0x36, 0x2, 0x5, 0x9, 0x9, 0xb, 0x1, 0xb, 0x18, 0x1b, 0x6c, 0x1b, 0x9, 0x6]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x60, 0x16, 0x12, 0x2, 0x12, 0x24, 0x24, 0x18, 0x18, 0x0, 0xc, 0x0, 0x48, 0x48, 0x6c, 0x1, 0x48, 0x0, 0x6, 0x24, 0x2, 0x3]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x42}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x7, 0x9, 0x15, 0x9, 0x1ff, 0x4, 0x1ff]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_2GHZ={0x6c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x1, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x2, 0x1000, 0x5, 0xdd, 0x7ff, 0x200, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x33, 0x2, [{0x2, 0x7}, {0x0, 0x6}, {0x6}, {0x1, 0xa}, {0x5, 0x6}, {0x0, 0x2}, {0x6, 0x5}, {0x1, 0x8}, {0x6, 0x6}, {0x7, 0xa}, {0x7, 0x2}, {0x1, 0x7}, {0x5, 0x4}, {0x1, 0x7}, {0x0, 0x8}, {0x3, 0x7}, {0x1, 0x7}, {0x5, 0x1}, {0x3, 0x9}, {0x2, 0x7}, {0x4, 0x8}, {0x6, 0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x6}, {0x2, 0x1}, {0x0, 0x4}, {0x0, 0x9}, {0x3, 0x6}, {0x0, 0x7}, {0x7, 0x3}, {0x5, 0x7}, {0x4, 0x9}, {0x7, 0x4}, {0x6, 0x4}, {0x7, 0x2}, {0x4}, {0x4, 0x7}, {0x3, 0x7}, {0x1, 0x3}, {0x2, 0x4}, {0x0, 0x1}, {0x1, 0x7}, {0x6, 0x8}, {0x7, 0xa}, {0x1, 0xa}, {0x7, 0x4}]}]}, @NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x4}, @NL80211_ATTR_TX_RATES={0x5c, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4}, @NL80211_BAND_5GHZ={0x54, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xfffe, 0x3ff, 0x9, 0xfffd, 0x3, 0xfd60, 0x4]}}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0x6c, 0x1b, 0x12, 0x6c, 0xc, 0x1, 0x6c, 0x36, 0x6, 0x5, 0x1b]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfffc, 0xffff, 0x6, 0x46f, 0x5, 0x8, 0x3, 0x8]}}]}]}, @NL80211_ATTR_TX_RATES={0x4}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_TX_TS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x28, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x86, 0x9}}}}}, 0x28}}, 0x4c014) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x400) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, 0x0, 0x4) 222.6314ms ago: executing program 0 (id=7751): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000300)=0x80de, 0x4) socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2649baca85309be96d5a45bbbdb5ff7ffffffd075b3eee14473f51be98db7efbb059842badcfc81364470e8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c11071adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eb47efb7b3f19046c6f1bd1bf56e5853ed96137f95b3a11954ed1c8a8676468cf2405e48723d4b1ff"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x18) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002500010125bd7012a60c6f3b286159000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x4048957}, 0x28040) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r3}]}, @IFLA_GROUP={0x8}]}, 0x34}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002440)={0x284, r6, 0x1, 0x0, 0x4, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_TX_RATES={0x8, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4}]}, @NL80211_ATTR_TX_RATES={0x158, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0xfd}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x48, 0x4, 0x6, 0x4, 0x1b, 0x1, 0x6c, 0x18, 0x2b, 0x1b]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_60GHZ={0x7c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x16, 0x1, [0x6c, 0x1b, 0x6, 0xc, 0x36, 0x2, 0x5, 0x9, 0x9, 0xb, 0x1, 0xb, 0x18, 0x1b, 0x6c, 0x1b, 0x9, 0x6]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x60, 0x16, 0x12, 0x2, 0x12, 0x24, 0x24, 0x18, 0x18, 0x0, 0xc, 0x0, 0x48, 0x48, 0x6c, 0x1, 0x48, 0x0, 0x6, 0x24, 0x2, 0x3]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x42}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x7, 0x9, 0x15, 0x9, 0x1ff, 0x4, 0x1ff]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_2GHZ={0x70, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x1, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x2, 0x1000, 0x5, 0xdd, 0x7ff, 0x200, 0x6]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x35, 0x2, [{0x2, 0x7}, {0x0, 0x6}, {0x6}, {0x1, 0xa}, {0x5, 0x6}, {0x0, 0x2}, {0x6, 0x5}, {0x1, 0x8}, {0x6, 0x6}, {0x7, 0xa}, {0x7, 0x2}, {0x1, 0x7}, {0x5, 0x4}, {0x1, 0x7}, {0x0, 0x8}, {0x3, 0x7}, {0x1, 0x7}, {0x5, 0x1}, {0x3, 0x9}, {0x2, 0x7}, {0x4, 0x8}, {0x6, 0x3}, {0x0, 0x4}, {0x0, 0x5}, {0x7, 0x6}, {0x2, 0x1}, {0x2, 0x2}, {0x0, 0x4}, {0x0, 0x9}, {0x3, 0x6}, {0x0, 0x7}, {0x7, 0x3}, {0x5, 0x7}, {0x4, 0x9}, {0x7, 0x4}, {0x6, 0x4}, {0x6, 0x6}, {0x7, 0x2}, {0x4}, {0x4, 0x7}, {0x3, 0x7}, {0x1, 0x3}, {0x2, 0x4}, {0x0, 0x1}, {0x1, 0x7}, {0x6, 0x8}, {0x7, 0xa}, {0x1, 0xa}, {0x7, 0x4}]}]}, @NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x4}, @NL80211_ATTR_TX_RATES={0x100, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x20b, 0x4, 0x0, 0x2, 0x7f, 0x8, 0x8, 0x3]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfff, 0x7, 0x5, 0x0, 0x3, 0x40, 0x64b0, 0xb]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x68, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x6bac, 0xc5, 0x6, 0x8, 0x5, 0x9, 0x44e3]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_LEGACY={0x10, 0x1, [0x3, 0x9, 0x16, 0x12, 0x1, 0x18, 0x16, 0x36, 0x18, 0x6, 0x18, 0x24]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x4, 0x5, 0x1ff, 0xe907, 0x8000, 0x1, 0xb0]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1c7, 0x4, 0x2, 0x80, 0x8, 0x0, 0x3, 0xfff1]}}, @NL80211_TXRATE_LEGACY={0x4}]}, @NL80211_BAND_5GHZ={0x58, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xfffe, 0x3ff, 0x9, 0xfffd, 0x3, 0xfd60, 0x4]}}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x6c, 0x1b, 0x12, 0x6c, 0xc, 0x1, 0x6c, 0x36, 0x30, 0x6, 0x60, 0x5, 0x1b]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfffc, 0xffff, 0x6, 0x46f, 0x5, 0x8, 0x3, 0x8]}}]}]}, @NL80211_ATTR_TX_RATES={0x4}]}, 0x284}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=r9, @ANYBLOB="08009f000600000008002600b409000005005201"], 0x3c}, 0x1, 0x0, 0x0, 0x4c854}, 0x4040000) sendmsg$NL80211_CMD_DEL_TX_TS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x28, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x86, 0x9}}}}}, 0x28}}, 0x4c014) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x20004080}, 0x400) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, 0x0, 0x4) 179.965856ms ago: executing program 1 (id=7752): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f00000031c0)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000ac0)="9eb8a2c0e241fb0402ac67d48d04ecbc724648d79b443d283855fdba1e1dc6283591a8a07eb1436788b6b641ed5ea90be62fc7499c9b017d2e73973395411b7efb244a226ba0ae76c057c57101711c5aa138abd03dec1e0899824e678aced03a92fec128f69d27d84ee2ff2e4ad3a3db73f406c4aec4ba5a715bf5abce312346bb7d7345e8df1fc10fa733c98030cb193341700961aa2ccb9f0f029190a1d34386c53e7017cf0fe0275d2d6f9531b12f12e29b903ffd774272360efe35269a1835d8f3e07382952f4fd47c9025f538c0bf576243026ed3d16af515d4e31055e765380602c4b42cb4e178350c5f387bdf01ff822a6a26b4cbd04523921adb0bddfd4c657e626ffa46f0a565ee807b56f98d90a48858679c0e5cada93389b479e4547690951c952e877d4139aaddd84d8b01dd791eff7b2c20cad352b1adc9f4e99da7f78d9ee00abe19e8e7a12840486f9d5e815d09095e482f0567ab86ff97caa5b1752897becb6e5985de8f402fcbccdce68c07a6", 0x175}, {&(0x7f0000000740)="4f0461e980a3df614c952ba937542c3956c268ef9da7fc364c6d5c543c3bd84159a349884fb4df8936363169ce8541c090bb5871df329e56747592fa4d29a09dcb4c416503ec1113680af76cba6417576ac2c0d3570f91a9c661f10e9bdab3c038f68844db4a19a8a613d78adb0405e27a1dea217288306169ac437c2401514510725ff144e75b83b8c67735520151c1018c3542bdfa2cae78aeb5d328f7d134706eb4d03bf4018be0f581f55e82cc1e851b8585d48a881144bfd5e96b52b62e62abe7ace71093fe8779d41feea0eb401dc005f2e3fe47320e7f945fb04e06c713f062ca47794f9c0b7fa88ccfacc4a51a4e816e0cb832c42d9f60561d5086ff512190d1129892fd541a0fbc9a41d70cd0d4501fed5545cd04b7800814bcbf492339bbfe784baba895beda447447a447e088a8d7cb795b3543a8cd8d8efb830dabc88b5b6466cd1d903833fca0e1049480810da129e746e2c9726a846ce85003a6bb9949e5dd140ab97a001c91323d5cb6648d4f61d40d4951ae36a1a404ba3452ae9a969c16a0918b4afe0b7b6afe4d59d8abfed8e7b38ce7c6c4daf306d0136c353c109f0a63c26df5f8866e", 0x1ad}], 0x2, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000002900000004"], 0x18}, 0x8080) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x5a0}], 0x1, 0x0, 0x0, 0x900}, 0x0) 123.269443ms ago: executing program 1 (id=7753): setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000000)={'security\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2, 0x9}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @restrict={0x0, 0x0, 0x0, 0xb, 0x2}]}}, 0x0, 0x4e}, 0x28) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="b40000000000000779116000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000700000085000000060000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0x18, &(0x7f000000cf3d)=""/195, 0x0, 0xc, '\x00', 0x0, @fallback=0xd}, 0x59) 0s ago: executing program 1 (id=7754): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000cc0)=[{{&(0x7f0000000100)=@l2tp={0x2, 0x0, @broadcast, 0x3}, 0x80, 0x0}}, {{&(0x7f0000000700)=@in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0x18}, 0x60}, 0x80, 0x0}}], 0x2, 0x48094) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r0, &(0x7f0000000000), 0xffffff6a) sendfile(0xffffffffffffffff, r0, 0x0, 0xffffffff000) kernel console output (not intermixed with test programs): 1 family 0 port 8472 - 0 [ 1024.481970][ T58] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.606361][ T13] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1024.619866][ T13] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.628558][ T13] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1024.638782][ T13] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.669099][ T3033] netlink: 'syz.0.6897': attribute type 1 has an invalid length. [ 1024.680051][ T3034] netlink: 'syz.4.6900': attribute type 11 has an invalid length. [ 1024.693618][ T3034] netlink: 'syz.4.6900': attribute type 23 has an invalid length. [ 1024.885785][ T3040] lo speed is unknown, defaulting to 1000 [ 1024.934420][ T3045] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1024.992507][ T3045] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.299872][ T3054] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1025.354265][ T3045] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1025.389795][ T3045] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.429274][ T3071] IPv6: Can't replace route, no match found [ 1025.465486][ T3071] netlink: 'syz.4.6908': attribute type 4 has an invalid length. [ 1025.480165][ T3045] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1025.502043][ T3045] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.599191][ T3045] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1025.638072][ T3045] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1025.811461][ T3085] FAULT_INJECTION: forcing a failure. [ 1025.811461][ T3085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1025.846969][ T3085] CPU: 1 UID: 0 PID: 3085 Comm: syz.4.6913 Not tainted syzkaller #0 PREEMPT(full) [ 1025.846999][ T3085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1025.847013][ T3085] Call Trace: [ 1025.847023][ T3085] [ 1025.847032][ T3085] dump_stack_lvl+0xe8/0x150 [ 1025.847074][ T3085] should_fail_ex+0x412/0x560 [ 1025.847108][ T3085] _copy_from_user+0x2d/0xb0 [ 1025.847141][ T3085] ___sys_sendmsg+0x1c6/0x360 [ 1025.847182][ T3085] ? __pfx____sys_sendmsg+0x10/0x10 [ 1025.847257][ T3085] ? __fget_files+0x2a/0x420 [ 1025.847287][ T3085] ? __fget_files+0x3a0/0x420 [ 1025.847327][ T3085] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1025.847363][ T3085] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1025.847409][ T3085] ? __pfx_ksys_write+0x10/0x10 [ 1025.847445][ T3085] do_syscall_64+0x14d/0xf80 [ 1025.847474][ T3085] ? trace_irq_disable+0x3b/0x150 [ 1025.847505][ T3085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.847528][ T3085] ? clear_bhb_loop+0x40/0x90 [ 1025.847555][ T3085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.847577][ T3085] RIP: 0033:0x7f124879c799 [ 1025.847598][ T3085] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1025.847617][ T3085] RSP: 002b:00007f12496ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1025.847640][ T3085] RAX: ffffffffffffffda RBX: 00007f1248a15fa0 RCX: 00007f124879c799 [ 1025.847657][ T3085] RDX: 0000000020000110 RSI: 0000200000000180 RDI: 0000000000000003 [ 1025.847671][ T3085] RBP: 00007f12496ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1025.847685][ T3085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1025.847698][ T3085] R13: 00007f1248a16038 R14: 00007f1248a15fa0 R15: 00007ffc7974eb98 [ 1025.847734][ T3085] [ 1026.083802][ T3090] netlink: 'syz.4.6915': attribute type 1 has an invalid length. [ 1026.160461][ T3088] netlink: 'syz.0.6914': attribute type 1 has an invalid length. [ 1026.335779][ T3096] netlink: 'syz.4.6916': attribute type 1 has an invalid length. [ 1026.657595][ T3114] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1026.682355][ T3114] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1026.756774][ T3116] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 1026.785151][ T3114] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1026.806498][ T3114] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1026.856332][ T3116] __nla_validate_parse: 16 callbacks suppressed [ 1026.856354][ T3116] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6922'. [ 1026.907351][ T3114] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1026.928715][ T3114] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1026.959084][ T3124] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6925'. [ 1026.987183][ T3124] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6925'. [ 1027.033328][ T3124] netlink: 'syz.2.6925': attribute type 1 has an invalid length. [ 1027.052094][ T3114] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1027.074239][ T3114] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1027.177804][ T3124] bond59: entered promiscuous mode [ 1027.213372][ T3142] netlink: 'syz.4.6926': attribute type 1 has an invalid length. [ 1027.222224][ T3124] 8021q: adding VLAN 0 to HW filter on device bond59 [ 1027.252183][ T3142] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6926'. [ 1027.280396][ T3127] lo speed is unknown, defaulting to 1000 [ 1027.395727][ T12] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.413139][ T12] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1027.441050][ T3147] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1027.481688][ T58] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.495995][ T58] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1027.525470][ T3147] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1027.593170][ T12] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.606116][ T12] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1027.634316][ T3147] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1027.675491][ T58] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1027.689555][ T58] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1027.732671][ T3147] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1027.882380][ T1095] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 1027.893786][ T3153] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6928'. [ 1027.903545][ T1095] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 1027.944614][ T1095] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 1027.993113][ T1095] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 1028.350360][ T3168] macvtap0: entered promiscuous mode [ 1028.355936][ T3168] veth0_to_bridge: entered promiscuous mode [ 1028.370863][ T3168] macvtap0: entered allmulticast mode [ 1028.376416][ T3168] veth0_to_bridge: entered allmulticast mode [ 1028.385834][ T3168] veth0_to_bridge: left allmulticast mode [ 1028.402472][ T3168] veth0_to_bridge: left promiscuous mode [ 1028.644333][ T3193] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6934'. [ 1028.934682][ T3205] validate_nla: 1 callbacks suppressed [ 1028.934703][ T3205] netlink: 'syz.4.6937': attribute type 1 has an invalid length. [ 1028.958517][ T3205] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6937'. [ 1029.026989][ T3210] IPv6: Can't replace route, no match found [ 1029.036313][ T3210] netlink: 'syz.1.6938': attribute type 4 has an invalid length. [ 1029.054402][ T3210] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6938'. [ 1029.114127][ T13] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.134310][ T3213] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6938'. [ 1029.137010][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1029.192619][ T13] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.205713][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1029.300060][ T3217] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1029.334638][ T3220] FAULT_INJECTION: forcing a failure. [ 1029.334638][ T3220] name failslab, interval 1, probability 0, space 0, times 0 [ 1029.367205][ T3217] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6939'. [ 1029.377824][ T3220] CPU: 1 UID: 0 PID: 3220 Comm: syz.4.6941 Not tainted syzkaller #0 PREEMPT(full) [ 1029.377853][ T3220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1029.377867][ T3220] Call Trace: [ 1029.377877][ T3220] [ 1029.377887][ T3220] dump_stack_lvl+0xe8/0x150 [ 1029.377924][ T3220] should_fail_ex+0x412/0x560 [ 1029.377958][ T3220] should_failslab+0xa8/0x100 [ 1029.377989][ T3220] __kmalloc_cache_noprof+0x88/0x660 [ 1029.378016][ T3220] ? sctp_add_bind_addr+0x8c/0x370 [ 1029.378048][ T3220] sctp_add_bind_addr+0x8c/0x370 [ 1029.378080][ T3220] sctp_copy_local_addr_list+0x314/0x4f0 [ 1029.378110][ T3220] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 1029.378137][ T3220] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1029.378167][ T3220] ? sctp_v6_is_any+0x64/0x80 [ 1029.378195][ T3220] ? sctp_copy_one_addr+0x93/0x360 [ 1029.378225][ T3220] sctp_bind_addr_copy+0xb3/0x3c0 [ 1029.378251][ T3220] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1029.378291][ T3220] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1029.378326][ T3220] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1029.378365][ T3220] ? __local_bh_enable_ip+0xd0/0x130 [ 1029.378393][ T3220] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1029.378418][ T3220] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1029.378458][ T3220] sctp_sendmsg+0x1528/0x2c10 [ 1029.378507][ T3220] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1029.378541][ T3220] ? aa_sk_perm+0x6d5/0x900 [ 1029.378577][ T3220] ? __pfx_aa_sk_perm+0x10/0x10 [ 1029.378606][ T3220] ? sock_rps_record_flow+0x19/0x400 [ 1029.378641][ T3220] ? inet_sendmsg+0x2f4/0x370 [ 1029.378676][ T3220] ____sys_sendmsg+0x894/0xad0 [ 1029.378719][ T3220] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1029.378764][ T3220] ? import_iovec+0x73/0xa0 [ 1029.378810][ T3220] ___sys_sendmsg+0x2a5/0x360 [ 1029.378853][ T3220] ? __pfx____sys_sendmsg+0x10/0x10 [ 1029.378893][ T3220] ? kstrtouint+0x6e/0xe0 [ 1029.378951][ T3220] ? __fget_files+0x2a/0x420 [ 1029.378981][ T3220] ? __fget_files+0x3a0/0x420 [ 1029.379026][ T3220] __sys_sendmmsg+0x27c/0x4e0 [ 1029.379066][ T3220] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1029.379097][ T3220] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1029.379162][ T3220] ? ksys_write+0x242/0x270 [ 1029.379189][ T3220] ? __pfx_ksys_write+0x10/0x10 [ 1029.379221][ T3220] __x64_sys_sendmmsg+0xa0/0xc0 [ 1029.379257][ T3220] do_syscall_64+0x14d/0xf80 [ 1029.379286][ T3220] ? trace_irq_disable+0x3b/0x150 [ 1029.379317][ T3220] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1029.379340][ T3220] ? clear_bhb_loop+0x40/0x90 [ 1029.379368][ T3220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1029.379390][ T3220] RIP: 0033:0x7f124879c799 [ 1029.379411][ T3220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1029.379431][ T3220] RSP: 002b:00007f12496ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1029.379455][ T3220] RAX: ffffffffffffffda RBX: 00007f1248a15fa0 RCX: 00007f124879c799 [ 1029.379472][ T3220] RDX: 0000000000000001 RSI: 0000200000000500 RDI: 0000000000000003 [ 1029.379486][ T3220] RBP: 00007f12496ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1029.379500][ T3220] R10: 0000000004000840 R11: 0000000000000246 R12: 0000000000000001 [ 1029.379514][ T3220] R13: 00007f1248a16038 R14: 00007f1248a15fa0 R15: 00007ffc7974eb98 [ 1029.379553][ T3220] [ 1029.387939][ T12] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.766504][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1029.823436][ T12] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1029.835144][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1029.978601][ T3237] netlink: 'syz.1.6946': attribute type 11 has an invalid length. [ 1030.012393][ T3237] netlink: 'syz.1.6946': attribute type 23 has an invalid length. [ 1030.273058][ T3256] IPv6: Can't replace route, no match found [ 1030.291363][ T3256] netlink: 'syz.2.6952': attribute type 4 has an invalid length. [ 1030.367623][ T3252] netlink: 'syz.3.6950': attribute type 1 has an invalid length. [ 1030.466980][ T3265] netlink: 'syz.1.6954': attribute type 1 has an invalid length. [ 1030.824664][ T3284] netlink: 'syz.1.6958': attribute type 1 has an invalid length. [ 1031.047479][ T3296] IPv6: Can't replace route, no match found [ 1031.104226][ T3296] netlink: 'syz.4.6966': attribute type 4 has an invalid length. [ 1031.152499][ T3299] openvswitch: netlink: Message has 200 unknown bytes. [ 1031.213376][ T3302] netlink: 'syz.2.6968': attribute type 1 has an invalid length. [ 1031.330978][ T3313] FAULT_INJECTION: forcing a failure. [ 1031.330978][ T3313] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1031.389781][ T3313] CPU: 1 UID: 0 PID: 3313 Comm: syz.4.6971 Not tainted syzkaller #0 PREEMPT(full) [ 1031.389812][ T3313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1031.389826][ T3313] Call Trace: [ 1031.389835][ T3313] [ 1031.389845][ T3313] dump_stack_lvl+0xe8/0x150 [ 1031.389883][ T3313] should_fail_ex+0x412/0x560 [ 1031.389916][ T3313] _copy_from_user+0x2d/0xb0 [ 1031.389949][ T3313] ___sys_sendmsg+0x1c6/0x360 [ 1031.390003][ T3313] ? __pfx____sys_sendmsg+0x10/0x10 [ 1031.390079][ T3313] ? __fget_files+0x2a/0x420 [ 1031.390109][ T3313] ? __fget_files+0x3a0/0x420 [ 1031.390154][ T3313] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1031.390190][ T3313] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1031.390236][ T3313] ? __pfx_ksys_write+0x10/0x10 [ 1031.390273][ T3313] do_syscall_64+0x14d/0xf80 [ 1031.390302][ T3313] ? trace_irq_disable+0x3b/0x150 [ 1031.390334][ T3313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.390357][ T3313] ? clear_bhb_loop+0x40/0x90 [ 1031.390385][ T3313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1031.390408][ T3313] RIP: 0033:0x7f124879c799 [ 1031.390430][ T3313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1031.390450][ T3313] RSP: 002b:00007f12496ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1031.390474][ T3313] RAX: ffffffffffffffda RBX: 00007f1248a15fa0 RCX: 00007f124879c799 [ 1031.390491][ T3313] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1031.390506][ T3313] RBP: 00007f12496ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1031.390520][ T3313] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1031.390535][ T3313] R13: 00007f1248a16038 R14: 00007f1248a15fa0 R15: 00007ffc7974eb98 [ 1031.390573][ T3313] [ 1031.391337][ T3317] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1031.420752][ T3311] lo speed is unknown, defaulting to 1000 [ 1031.635052][ T3304] netlink: 'syz.0.6969': attribute type 1 has an invalid length. [ 1031.856614][ T3304] bond60: entered promiscuous mode [ 1031.936706][ T3304] 8021q: adding VLAN 0 to HW filter on device bond60 [ 1032.408143][ T3363] __nla_validate_parse: 14 callbacks suppressed [ 1032.408166][ T3363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6987'. [ 1032.477080][ T3363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6987'. [ 1032.505584][ T3363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6987'. [ 1032.530276][ T3363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6987'. [ 1032.562260][ T3363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6987'. [ 1032.586603][ T3363] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6987'. [ 1032.640422][ T3363] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 1032.668292][ T3371] netlink: 156 bytes leftover after parsing attributes in process `syz.1.6989'. [ 1033.652473][ T3418] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6998'. [ 1033.668630][ T3420] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6999'. [ 1033.764283][T16540] lec:lec_start_xmit: lec0:No lecd attached [ 1034.114701][ T3451] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1034.153496][ T3450] netlink: 'syz.0.7005': attribute type 11 has an invalid length. [ 1034.188231][ T3450] validate_nla: 2 callbacks suppressed [ 1034.188251][ T3450] netlink: 'syz.0.7005': attribute type 23 has an invalid length. [ 1034.213668][ T3453] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7006'. [ 1034.242768][ T3457] FAULT_INJECTION: forcing a failure. [ 1034.242768][ T3457] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1034.269112][ T3457] CPU: 1 UID: 0 PID: 3457 Comm: syz.3.7007 Not tainted syzkaller #0 PREEMPT(full) [ 1034.269142][ T3457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1034.269169][ T3457] Call Trace: [ 1034.269178][ T3457] [ 1034.269188][ T3457] dump_stack_lvl+0xe8/0x150 [ 1034.269225][ T3457] should_fail_ex+0x412/0x560 [ 1034.269259][ T3457] _copy_to_user+0x31/0xb0 [ 1034.269294][ T3457] simple_read_from_buffer+0xe1/0x170 [ 1034.269331][ T3457] proc_fail_nth_read+0x1bb/0x230 [ 1034.269364][ T3457] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1034.269397][ T3457] ? rw_verify_area+0x2a6/0x4d0 [ 1034.269418][ T3457] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1034.269448][ T3457] vfs_read+0x20c/0xa70 [ 1034.269467][ T3457] ? irqentry_exit+0x59e/0x620 [ 1034.269494][ T3457] ? fdget_pos+0x246/0x320 [ 1034.269531][ T3457] ? __pfx___mutex_lock+0x10/0x10 [ 1034.269592][ T3457] ? __pfx_vfs_read+0x10/0x10 [ 1034.269622][ T3457] ? fdget_pos+0x27b/0x320 [ 1034.269666][ T3457] ksys_read+0x150/0x270 [ 1034.269690][ T3457] ? __pfx_ksys_read+0x10/0x10 [ 1034.269725][ T3457] do_syscall_64+0x14d/0xf80 [ 1034.269752][ T3457] ? trace_irq_disable+0x3b/0x150 [ 1034.269782][ T3457] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1034.269805][ T3457] ? clear_bhb_loop+0x40/0x90 [ 1034.269832][ T3457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1034.269854][ T3457] RIP: 0033:0x7fd27fd5cfce [ 1034.269875][ T3457] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1034.269901][ T3457] RSP: 002b:00007fd280cb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1034.269925][ T3457] RAX: ffffffffffffffda RBX: 00007fd280cb86c0 RCX: 00007fd27fd5cfce [ 1034.269941][ T3457] RDX: 000000000000000f RSI: 00007fd280cb80a0 RDI: 0000000000000004 [ 1034.269955][ T3457] RBP: 00007fd280cb8090 R08: 0000000000000000 R09: 0000000000000000 [ 1034.269969][ T3457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.269980][ T3457] R13: 00007fd280016038 R14: 00007fd280015fa0 R15: 00007ffe670d1778 [ 1034.270022][ T3457] [ 1034.776534][ T3469] IPv6: Can't replace route, no match found [ 1034.800327][ T3469] netlink: 'syz.1.7011': attribute type 4 has an invalid length. [ 1034.864168][ T3473] netlink: zone id is out of range [ 1034.879792][ T3473] netlink: zone id is out of range [ 1034.897546][ T3473] netlink: zone id is out of range [ 1034.921312][ T3473] netlink: zone id is out of range [ 1034.926491][ T3473] netlink: zone id is out of range [ 1034.941573][ T3473] netlink: zone id is out of range [ 1034.946937][ T3473] netlink: zone id is out of range [ 1034.970155][ T3477] FAULT_INJECTION: forcing a failure. [ 1034.970155][ T3477] name failslab, interval 1, probability 0, space 0, times 0 [ 1035.051394][ T3477] CPU: 1 UID: 0 PID: 3477 Comm: syz.0.7014 Not tainted syzkaller #0 PREEMPT(full) [ 1035.051428][ T3477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1035.051443][ T3477] Call Trace: [ 1035.051453][ T3477] [ 1035.051464][ T3477] dump_stack_lvl+0xe8/0x150 [ 1035.051502][ T3477] should_fail_ex+0x412/0x560 [ 1035.051536][ T3477] should_failslab+0xa8/0x100 [ 1035.051567][ T3477] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1035.051604][ T3477] ? __alloc_skb+0x186/0x7d0 [ 1035.051633][ T3477] ? __alloc_skb+0x1d0/0x7d0 [ 1035.051660][ T3477] ? __local_bh_enable_ip+0xd0/0x130 [ 1035.051695][ T3477] __alloc_skb+0x1d0/0x7d0 [ 1035.051733][ T3477] netlink_sendmsg+0x5d4/0xb40 [ 1035.051774][ T3477] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1035.051806][ T3477] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1035.051836][ T3477] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1035.051863][ T3477] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1035.051890][ T3477] ____sys_sendmsg+0xa68/0xad0 [ 1035.051935][ T3477] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1035.051988][ T3477] ? import_iovec+0x73/0xa0 [ 1035.052025][ T3477] ___sys_sendmsg+0x2a5/0x360 [ 1035.052065][ T3477] ? __pfx____sys_sendmsg+0x10/0x10 [ 1035.052142][ T3477] ? __fget_files+0x2a/0x420 [ 1035.052172][ T3477] ? __fget_files+0x3a0/0x420 [ 1035.052217][ T3477] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1035.052254][ T3477] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1035.052307][ T3477] ? __pfx_ksys_write+0x10/0x10 [ 1035.052345][ T3477] do_syscall_64+0x14d/0xf80 [ 1035.052375][ T3477] ? trace_irq_disable+0x3b/0x150 [ 1035.052407][ T3477] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.052431][ T3477] ? clear_bhb_loop+0x40/0x90 [ 1035.052459][ T3477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1035.052483][ T3477] RIP: 0033:0x7ff38c59c799 [ 1035.052504][ T3477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1035.052525][ T3477] RSP: 002b:00007ff38d4c7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1035.052558][ T3477] RAX: ffffffffffffffda RBX: 00007ff38c815fa0 RCX: 00007ff38c59c799 [ 1035.052575][ T3477] RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000004 [ 1035.052589][ T3477] RBP: 00007ff38d4c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1035.052604][ T3477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1035.052617][ T3477] R13: 00007ff38c816038 R14: 00007ff38c815fa0 R15: 00007fff2e182e68 [ 1035.052655][ T3477] [ 1035.790993][ T3509] netlink: 'syz.0.7022': attribute type 11 has an invalid length. [ 1035.819788][ T3509] netlink: 'syz.0.7022': attribute type 23 has an invalid length. [ 1035.850132][ T3512] netlink: 'syz.1.7023': attribute type 11 has an invalid length. [ 1035.863557][ T3512] netlink: 'syz.1.7023': attribute type 23 has an invalid length. [ 1035.905951][ T3519] netlink: 'syz.3.7025': attribute type 4 has an invalid length. [ 1036.160362][ T3537] FAULT_INJECTION: forcing a failure. [ 1036.160362][ T3537] name failslab, interval 1, probability 0, space 0, times 0 [ 1036.209900][ T3537] CPU: 1 UID: 0 PID: 3537 Comm: syz.1.7030 Not tainted syzkaller #0 PREEMPT(full) [ 1036.209932][ T3537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1036.209947][ T3537] Call Trace: [ 1036.209956][ T3537] [ 1036.209966][ T3537] dump_stack_lvl+0xe8/0x150 [ 1036.210005][ T3537] should_fail_ex+0x412/0x560 [ 1036.210038][ T3537] should_failslab+0xa8/0x100 [ 1036.210067][ T3537] __kmalloc_noprof+0xe8/0x760 [ 1036.210091][ T3537] ? kernfs_fop_write_iter+0x158/0x540 [ 1036.210124][ T3537] kernfs_fop_write_iter+0x158/0x540 [ 1036.210156][ T3537] vfs_write+0x61d/0xb90 [ 1036.210191][ T3537] ? __pfx_vfs_write+0x10/0x10 [ 1036.210228][ T3537] ? __fget_files+0x2a/0x420 [ 1036.210271][ T3537] ksys_write+0x150/0x270 [ 1036.210298][ T3537] ? __pfx_ksys_write+0x10/0x10 [ 1036.210335][ T3537] do_syscall_64+0x14d/0xf80 [ 1036.210366][ T3537] ? trace_irq_disable+0x3b/0x150 [ 1036.210398][ T3537] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1036.210420][ T3537] ? clear_bhb_loop+0x40/0x90 [ 1036.210449][ T3537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1036.210472][ T3537] RIP: 0033:0x7f9b4dd9c799 [ 1036.210494][ T3537] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1036.210513][ T3537] RSP: 002b:00007f9b4bfd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1036.210536][ T3537] RAX: ffffffffffffffda RBX: 00007f9b4e016090 RCX: 00007f9b4dd9c799 [ 1036.210553][ T3537] RDX: 0000000000000012 RSI: 00002000000001c0 RDI: 0000000000000007 [ 1036.210567][ T3537] RBP: 00007f9b4bfd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1036.210582][ T3537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1036.210595][ T3537] R13: 00007f9b4e016128 R14: 00007f9b4e016090 R15: 00007fffbfbdd338 [ 1036.210634][ T3537] [ 1037.118544][ T29] audit: type=1804 audit(1772307705.329:11): pid=3568 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.7036" name="/newroot/1316/cgroup.controllers" dev="tmpfs" ino=6704 res=1 errno=0 [ 1037.148127][ T3572] netlink: 'syz.4.7038': attribute type 1 has an invalid length. [ 1037.183406][ T29] audit: type=1800 audit(1772307705.329:12): pid=3568 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.7036" name="cgroup.controllers" dev="tmpfs" ino=6704 res=0 errno=0 [ 1037.248221][ T3572] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1037.274784][ T3575] vlan4: entered promiscuous mode [ 1037.280099][ T3575] bond19: entered promiscuous mode [ 1037.288537][ T3575] vlan4: entered allmulticast mode [ 1037.295246][ T3575] bond19: entered allmulticast mode [ 1037.311830][ T3572] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1037.322341][ T3572] bond19: (slave batadv1): making interface the new active one [ 1037.330195][ T3572] batadv1: entered promiscuous mode [ 1037.335744][ T3572] batadv1: entered allmulticast mode [ 1037.343991][ T3572] bond19: (slave batadv1): Enslaving as an active interface with an up link [ 1037.427439][ T3580] netlink: 'syz.0.7040': attribute type 11 has an invalid length. [ 1037.435425][ T3580] netlink: 'syz.0.7040': attribute type 23 has an invalid length. [ 1037.443513][ T3580] __nla_validate_parse: 19 callbacks suppressed [ 1037.443533][ T3580] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7040'. [ 1037.605232][ T3591] netlink: 'syz.3.7044': attribute type 1 has an invalid length. [ 1037.637950][ T3591] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7044'. [ 1037.671324][ T3596] netlink: 'syz.4.7045': attribute type 2 has an invalid length. [ 1037.814052][ T3603] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7047'. [ 1037.837844][ T3603] nbd: couldn't find device at index 0 [ 1037.943341][ T3609] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7049'. [ 1037.969411][ T3612] netlink: 184020 bytes leftover after parsing attributes in process `syz.1.7050'. [ 1038.401999][ T3633] netlink: 'syz.4.7057': attribute type 1 has an invalid length. [ 1038.418906][ T3633] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7057'. [ 1038.585369][ T3636] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7058'. [ 1038.675632][ T3639] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7059'. [ 1038.802408][ T3650] net_ratelimit: 9 callbacks suppressed [ 1038.802430][ T3650] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1038.823749][ T3653] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7063'. [ 1038.889622][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5120 ms [ 1038.897706][ C1] lec:lec_tx_timeout: lec0 [ 1038.958670][ T3656] netlink: 'syz.0.7066': attribute type 11 has an invalid length. [ 1038.967491][ T3656] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7066'. [ 1039.285184][ T58] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1039.316378][ T58] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1039.374351][ T3667] validate_nla: 2 callbacks suppressed [ 1039.374372][ T3667] netlink: 'syz.1.7071': attribute type 1 has an invalid length. [ 1039.408674][ T58] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1039.496030][ T3684] FAULT_INJECTION: forcing a failure. [ 1039.496030][ T3684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1039.519738][ T3684] CPU: 1 UID: 0 PID: 3684 Comm: syz.2.7075 Not tainted syzkaller #0 PREEMPT(full) [ 1039.519768][ T3684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1039.519782][ T3684] Call Trace: [ 1039.519791][ T3684] [ 1039.519801][ T3684] dump_stack_lvl+0xe8/0x150 [ 1039.519839][ T3684] should_fail_ex+0x412/0x560 [ 1039.519871][ T3684] _copy_from_iter+0x1d3/0x1670 [ 1039.519905][ T3684] ? rcu_is_watching+0x15/0xb0 [ 1039.519943][ T3684] ? __pfx__copy_from_iter+0x10/0x10 [ 1039.519981][ T3684] ? netlink_sendmsg+0x650/0xb40 [ 1039.520012][ T3684] ? skb_put+0x11b/0x210 [ 1039.520046][ T3684] netlink_sendmsg+0x6c0/0xb40 [ 1039.520084][ T3684] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1039.520116][ T3684] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1039.520144][ T3684] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1039.520170][ T3684] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1039.520196][ T3684] ____sys_sendmsg+0xa68/0xad0 [ 1039.520239][ T3684] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1039.520283][ T3684] ? import_iovec+0x73/0xa0 [ 1039.520318][ T3684] ___sys_sendmsg+0x2a5/0x360 [ 1039.520363][ T3684] ? __pfx____sys_sendmsg+0x10/0x10 [ 1039.520438][ T3684] ? __fget_files+0x2a/0x420 [ 1039.520469][ T3684] ? __fget_files+0x3a0/0x420 [ 1039.520518][ T3684] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1039.520555][ T3684] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1039.520599][ T3684] ? __pfx_ksys_write+0x10/0x10 [ 1039.520636][ T3684] do_syscall_64+0x14d/0xf80 [ 1039.520664][ T3684] ? trace_irq_disable+0x3b/0x150 [ 1039.520695][ T3684] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1039.520717][ T3684] ? clear_bhb_loop+0x40/0x90 [ 1039.520745][ T3684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1039.520768][ T3684] RIP: 0033:0x7f4e08f9c799 [ 1039.520789][ T3684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1039.520808][ T3684] RSP: 002b:00007f4e09d7b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1039.520831][ T3684] RAX: ffffffffffffffda RBX: 00007f4e09215fa0 RCX: 00007f4e08f9c799 [ 1039.520846][ T3684] RDX: 0000000020048010 RSI: 0000200000000980 RDI: 0000000000000003 [ 1039.520860][ T3684] RBP: 00007f4e09d7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1039.520875][ T3684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1039.520888][ T3684] R13: 00007f4e09216038 R14: 00007f4e09215fa0 R15: 00007ffda6d55e28 [ 1039.520926][ T3684] [ 1039.525019][ T3687] netlink: 'syz.3.7074': attribute type 2 has an invalid length. [ 1039.683247][ T3667] bond61: entered promiscuous mode [ 1039.844936][ T3667] 8021q: adding VLAN 0 to HW filter on device bond61 [ 1039.886412][ T3674] lo speed is unknown, defaulting to 1000 [ 1039.893388][ T58] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1039.939822][ T3676] lo speed is unknown, defaulting to 1000 [ 1040.045308][ T3693] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1040.364719][ T3710] FAULT_INJECTION: forcing a failure. [ 1040.364719][ T3710] name failslab, interval 1, probability 0, space 0, times 0 [ 1040.386124][ T3710] CPU: 1 UID: 0 PID: 3710 Comm: syz.0.7080 Not tainted syzkaller #0 PREEMPT(full) [ 1040.386151][ T3710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1040.386165][ T3710] Call Trace: [ 1040.386174][ T3710] [ 1040.386184][ T3710] dump_stack_lvl+0xe8/0x150 [ 1040.386216][ T3710] should_fail_ex+0x412/0x560 [ 1040.386247][ T3710] should_failslab+0xa8/0x100 [ 1040.386274][ T3710] __kmalloc_cache_noprof+0x88/0x660 [ 1040.386295][ T3710] ? __pfx_stack_trace_save+0x10/0x10 [ 1040.386317][ T3710] ? rtnl_newlink+0x136/0x1be0 [ 1040.386351][ T3710] rtnl_newlink+0x136/0x1be0 [ 1040.386379][ T3710] ? kasan_save_track+0x4f/0x80 [ 1040.386399][ T3710] ? kasan_save_track+0x3e/0x80 [ 1040.386417][ T3710] ? kasan_save_free_info+0x46/0x50 [ 1040.386446][ T3710] ? __kasan_slab_free+0x5c/0x80 [ 1040.386465][ T3710] ? kmem_cache_free+0x187/0x630 [ 1040.386499][ T3710] ? __dev_queue_xmit+0x16d1/0x3890 [ 1040.386518][ T3710] ? __netlink_deliver_tap+0x5ad/0x850 [ 1040.386541][ T3710] ? netlink_deliver_tap+0x19c/0x1b0 [ 1040.386562][ T3710] ? netlink_unicast+0x7e3/0x9b0 [ 1040.386582][ T3710] ? netlink_sendmsg+0x813/0xb40 [ 1040.386628][ T3710] ? __pfx_rtnl_newlink+0x10/0x10 [ 1040.386653][ T3710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.386732][ T3710] ? kasan_quarantine_put+0xbb/0x1f0 [ 1040.386754][ T3710] ? lockdep_hardirqs_on+0x7a/0x110 [ 1040.386791][ T3710] ? kmem_cache_free+0x187/0x630 [ 1040.386814][ T3710] ? nlmon_xmit+0xb0/0x100 [ 1040.386861][ T3710] ? __lock_acquire+0x6b5/0x2cf0 [ 1040.386897][ T3710] ? __local_bh_enable_ip+0xd0/0x130 [ 1040.386925][ T3710] ? lockdep_hardirqs_on+0x7a/0x110 [ 1040.386971][ T3710] ? __dev_queue_xmit+0x277/0x3890 [ 1040.387001][ T3710] ? __local_bh_enable_ip+0xd0/0x130 [ 1040.387028][ T3710] ? __dev_queue_xmit+0x277/0x3890 [ 1040.387078][ T3710] ? __pfx_rtnl_newlink+0x10/0x10 [ 1040.387106][ T3710] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1040.387139][ T3710] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1040.387166][ T3710] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1040.387193][ T3710] ? ref_tracker_free+0x693/0x840 [ 1040.387218][ T3710] ? __copy_skb_header+0xa3/0x4a0 [ 1040.387253][ T3710] ? __pfx_ref_tracker_free+0x10/0x10 [ 1040.387293][ T3710] netlink_rcv_skb+0x232/0x4b0 [ 1040.387322][ T3710] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1040.387352][ T3710] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1040.387393][ T3710] ? netlink_deliver_tap+0x2e/0x1b0 [ 1040.387428][ T3710] netlink_unicast+0x80f/0x9b0 [ 1040.387559][ T3710] ? __pfx_netlink_unicast+0x10/0x10 [ 1040.387587][ T3710] ? netlink_sendmsg+0x650/0xb40 [ 1040.387613][ T3710] ? skb_put+0x11b/0x210 [ 1040.387648][ T3710] netlink_sendmsg+0x813/0xb40 [ 1040.387693][ T3710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1040.387750][ T3710] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1040.387780][ T3710] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1040.387806][ T3710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1040.387832][ T3710] ____sys_sendmsg+0xa68/0xad0 [ 1040.387875][ T3710] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1040.387920][ T3710] ? import_iovec+0x73/0xa0 [ 1040.387956][ T3710] ___sys_sendmsg+0x2a5/0x360 [ 1040.387987][ T3710] ? get_pid_task+0x20/0x1f0 [ 1040.388014][ T3710] ? __pfx____sys_sendmsg+0x10/0x10 [ 1040.388074][ T3710] ? sb_end_write+0xe9/0x1c0 [ 1040.388118][ T3710] ? __pfx_vfs_write+0x10/0x10 [ 1040.388152][ T3710] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1040.388188][ T3710] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1040.388234][ T3710] ? __pfx_ksys_write+0x10/0x10 [ 1040.388271][ T3710] do_syscall_64+0x14d/0xf80 [ 1040.388301][ T3710] ? trace_irq_disable+0x3b/0x150 [ 1040.388332][ T3710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.388355][ T3710] ? clear_bhb_loop+0x40/0x90 [ 1040.388383][ T3710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1040.388405][ T3710] RIP: 0033:0x7ff38c59c799 [ 1040.388427][ T3710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1040.388446][ T3710] RSP: 002b:00007ff38d4c7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1040.388470][ T3710] RAX: ffffffffffffffda RBX: 00007ff38c815fa0 RCX: 00007ff38c59c799 [ 1040.388486][ T3710] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1040.388501][ T3710] RBP: 00007ff38d4c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1040.388515][ T3710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.388528][ T3710] R13: 00007ff38c816038 R14: 00007ff38c815fa0 R15: 00007fff2e182e68 [ 1040.388566][ T3710] [ 1041.065806][ T3719] FAULT_INJECTION: forcing a failure. [ 1041.065806][ T3719] name failslab, interval 1, probability 0, space 0, times 0 [ 1041.080615][ T3719] CPU: 1 UID: 0 PID: 3719 Comm: syz.3.7083 Not tainted syzkaller #0 PREEMPT(full) [ 1041.080643][ T3719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1041.080656][ T3719] Call Trace: [ 1041.080666][ T3719] [ 1041.080676][ T3719] dump_stack_lvl+0xe8/0x150 [ 1041.080712][ T3719] should_fail_ex+0x412/0x560 [ 1041.080744][ T3719] should_failslab+0xa8/0x100 [ 1041.080773][ T3719] __kmalloc_noprof+0xe8/0x760 [ 1041.080797][ T3719] ? sock_kmalloc+0xd6/0x160 [ 1041.080837][ T3719] sock_kmalloc+0xd6/0x160 [ 1041.080874][ T3719] __ipv6_sock_mc_join+0x408/0x750 [ 1041.080905][ T3719] ? __local_bh_enable_ip+0xd0/0x130 [ 1041.080940][ T3719] inet6_addr_add+0x3cf/0xb20 [ 1041.080974][ T3719] inet6_rtm_newaddr+0xa17/0xe30 [ 1041.081016][ T3719] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 1041.081045][ T3719] ? __dev_queue_xmit+0x277/0x3890 [ 1041.081103][ T3719] ? __pfx_inet6_rtm_newaddr+0x10/0x10 [ 1041.081134][ T3719] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 1041.081167][ T3719] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1041.081195][ T3719] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1041.081221][ T3719] ? ref_tracker_free+0x693/0x840 [ 1041.081247][ T3719] ? __copy_skb_header+0xa3/0x4a0 [ 1041.081282][ T3719] ? __pfx_ref_tracker_free+0x10/0x10 [ 1041.081322][ T3719] netlink_rcv_skb+0x232/0x4b0 [ 1041.081350][ T3719] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1041.081380][ T3719] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1041.081431][ T3719] ? netlink_deliver_tap+0x2e/0x1b0 [ 1041.081469][ T3719] netlink_unicast+0x80f/0x9b0 [ 1041.081504][ T3719] ? __pfx_netlink_unicast+0x10/0x10 [ 1041.081532][ T3719] ? netlink_sendmsg+0x650/0xb40 [ 1041.081557][ T3719] ? skb_put+0x11b/0x210 [ 1041.081591][ T3719] netlink_sendmsg+0x813/0xb40 [ 1041.081629][ T3719] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1041.081662][ T3719] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1041.081690][ T3719] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1041.081716][ T3719] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1041.081742][ T3719] ____sys_sendmsg+0xa68/0xad0 [ 1041.081787][ T3719] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1041.081832][ T3719] ? import_iovec+0x73/0xa0 [ 1041.081868][ T3719] ___sys_sendmsg+0x2a5/0x360 [ 1041.081909][ T3719] ? __pfx____sys_sendmsg+0x10/0x10 [ 1041.081989][ T3719] ? __fget_files+0x2a/0x420 [ 1041.082020][ T3719] ? __fget_files+0x3a0/0x420 [ 1041.082065][ T3719] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1041.082102][ T3719] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1041.082148][ T3719] ? __pfx_ksys_write+0x10/0x10 [ 1041.082186][ T3719] do_syscall_64+0x14d/0xf80 [ 1041.082214][ T3719] ? trace_irq_disable+0x3b/0x150 [ 1041.082243][ T3719] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1041.082264][ T3719] ? clear_bhb_loop+0x40/0x90 [ 1041.082291][ T3719] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1041.082312][ T3719] RIP: 0033:0x7fd27fd9c799 [ 1041.082333][ T3719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1041.082353][ T3719] RSP: 002b:00007fd280cb8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1041.082376][ T3719] RAX: ffffffffffffffda RBX: 00007fd280015fa0 RCX: 00007fd27fd9c799 [ 1041.082393][ T3719] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1041.082415][ T3719] RBP: 00007fd280cb8090 R08: 0000000000000000 R09: 0000000000000000 [ 1041.082429][ T3719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1041.082454][ T3719] R13: 00007fd280016038 R14: 00007fd280015fa0 R15: 00007ffe670d1778 [ 1041.082492][ T3719] [ 1041.654965][ T3729] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1041.739889][ T3729] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1041.759901][ T3733] netlink: 'syz.0.7087': attribute type 11 has an invalid length. [ 1041.778093][ T3733] netlink: 'syz.0.7087': attribute type 23 has an invalid length. [ 1041.839481][ T3739] netlink: 'syz.2.7088': attribute type 2 has an invalid length. [ 1041.866705][ T3732] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1041.917975][ T3729] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1041.931247][ T3729] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.114943][ T3729] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1042.140498][ T3729] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.240925][ T3729] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1042.251458][ T3729] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1042.542314][ T58] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1042.586867][ T58] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1042.749738][ T13] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1042.757979][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1042.826706][ T13] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1042.839672][ T13] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1042.901195][ T13] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1042.911243][ T13] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1043.110748][ T3774] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.185533][ T3774] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.276850][ T3774] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.342802][ T3788] __nla_validate_parse: 6 callbacks suppressed [ 1043.342824][ T3788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7100'. [ 1043.380700][ T3774] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1043.553829][ T58] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.563733][ T3794] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1043.576008][ T3794] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7101'. [ 1043.607268][ T58] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.640641][ T58] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.686102][ T8265] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1043.702372][ T58] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.943676][ T3810] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7103'. [ 1043.974440][ T3810] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7103'. [ 1044.223965][ T3822] netlink: 'syz.2.7106': attribute type 5 has an invalid length. [ 1044.232275][ T3822] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7106'. [ 1044.241520][ T3819] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7108'. [ 1044.270917][ T3819] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7108'. [ 1044.281430][ T3815] netlink: 'syz.2.7106': attribute type 21 has an invalid length. [ 1044.304954][ T3827] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7107'. [ 1044.318939][ T3815] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7106'. [ 1044.329120][ T3824] lo speed is unknown, defaulting to 1000 [ 1044.376804][ T3819] netlink: 'syz.0.7108': attribute type 1 has an invalid length. [ 1044.561531][ T3819] bond62: entered promiscuous mode [ 1044.675827][ T3819] 8021q: adding VLAN 0 to HW filter on device bond62 [ 1044.828194][ T3854] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7115'. [ 1045.440265][ T3877] bpq0: entered promiscuous mode [ 1045.445381][ T3877] bpq0: entered allmulticast mode [ 1045.463050][ T3877] netlink: 'syz.2.7120': attribute type 11 has an invalid length. [ 1045.479330][ T3877] netlink: 'syz.2.7120': attribute type 23 has an invalid length. [ 1046.495994][ T3924] netlink: 'syz.1.7131': attribute type 1 has an invalid length. [ 1046.719804][ T3937] sctp: [Deprecated]: syz.1.7135 (pid 3937) Use of int in max_burst socket option deprecated. [ 1046.719804][ T3937] Use struct sctp_assoc_value instead [ 1046.920476][ T3948] FAULT_INJECTION: forcing a failure. [ 1046.920476][ T3948] name failslab, interval 1, probability 0, space 0, times 0 [ 1046.967489][ T3948] CPU: 0 UID: 0 PID: 3948 Comm: syz.2.7137 Not tainted syzkaller #0 PREEMPT(full) [ 1046.967519][ T3948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1046.967532][ T3948] Call Trace: [ 1046.967541][ T3948] [ 1046.967550][ T3948] dump_stack_lvl+0xe8/0x150 [ 1046.967585][ T3948] should_fail_ex+0x412/0x560 [ 1046.967617][ T3948] should_failslab+0xa8/0x100 [ 1046.967641][ T3948] ? alloc_vfsmnt+0x23/0x420 [ 1046.967665][ T3948] kmem_cache_alloc_noprof+0x87/0x650 [ 1046.967708][ T3948] alloc_vfsmnt+0x23/0x420 [ 1046.967734][ T3948] clone_mnt+0x4b/0x9a0 [ 1046.967758][ T3948] ? do_raw_spin_unlock+0xf5/0x210 [ 1046.967786][ T3948] copy_tree+0x3d4/0x930 [ 1046.967834][ T3948] copy_mnt_ns+0x24d/0x990 [ 1046.967864][ T3948] ? kmem_cache_alloc_noprof+0x307/0x650 [ 1046.967896][ T3948] ? create_new_namespaces+0x33/0x6a0 [ 1046.967934][ T3948] create_new_namespaces+0xcf/0x6a0 [ 1046.967967][ T3948] ? bpf_lsm_capable+0x9/0x20 [ 1046.967993][ T3948] ? security_capable+0x7e/0x2c0 [ 1046.968026][ T3948] unshare_nsproxy_namespaces+0x11a/0x160 [ 1046.968060][ T3948] ksys_unshare+0x51d/0x930 [ 1046.968104][ T3948] ? __pfx_ksys_unshare+0x10/0x10 [ 1046.968137][ T3948] ? __pfx_ksys_write+0x10/0x10 [ 1046.968174][ T3948] __x64_sys_unshare+0x38/0x50 [ 1046.968216][ T3948] do_syscall_64+0x14d/0xf80 [ 1046.968246][ T3948] ? trace_irq_disable+0x3b/0x150 [ 1046.968277][ T3948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1046.968300][ T3948] ? clear_bhb_loop+0x40/0x90 [ 1046.968329][ T3948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1046.968351][ T3948] RIP: 0033:0x7f4e08f9c799 [ 1046.968376][ T3948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1046.968396][ T3948] RSP: 002b:00007f4e09d7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1046.968420][ T3948] RAX: ffffffffffffffda RBX: 00007f4e09215fa0 RCX: 00007f4e08f9c799 [ 1046.968436][ T3948] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000020000 [ 1046.968450][ T3948] RBP: 00007f4e09d7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1046.968464][ T3948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1046.968477][ T3948] R13: 00007f4e09216038 R14: 00007f4e09215fa0 R15: 00007ffda6d55e28 [ 1046.968516][ T3948] [ 1047.248697][ T3952] bpq0: left promiscuous mode [ 1047.255335][ T3952] bpq0: left allmulticast mode [ 1047.289995][ T3956] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 1047.321300][ T3952] netlink: 'syz.4.7139': attribute type 11 has an invalid length. [ 1047.329196][ T3952] netlink: 'syz.4.7139': attribute type 23 has an invalid length. [ 1048.123255][ T4006] bridge10: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1048.474675][ T4023] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1048.560342][ T4030] netlink: 'syz.0.7159': attribute type 21 has an invalid length. [ 1048.568312][ T4030] __nla_validate_parse: 8 callbacks suppressed [ 1048.568332][ T4030] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7159'. [ 1048.630092][ T4034] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7162'. [ 1048.709543][ T4034] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7162'. [ 1048.896470][ T4041] netlink: 'syz.0.7164': attribute type 11 has an invalid length. [ 1048.920075][ T4041] netlink: 'syz.0.7164': attribute type 23 has an invalid length. [ 1048.942045][ T4049] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7165'. [ 1048.960071][ T4041] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7164'. [ 1049.406906][ T4076] netlink: 'syz.1.7175': attribute type 1 has an invalid length. [ 1049.845466][ T4093] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1049.873395][ T4098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7184'. [ 1049.928213][ T4096] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7183'. [ 1050.342559][ T4118] lo speed is unknown, defaulting to 1000 [ 1050.364230][ T4120] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7193'. [ 1050.395104][ T4120] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7193'. [ 1050.420768][ T4123] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1050.452522][ T4120] netlink: 'syz.0.7193': attribute type 1 has an invalid length. [ 1050.539956][ T4120] bond19: entered promiscuous mode [ 1050.545667][ T4120] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1050.568553][ T4125] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7194'. [ 1050.582728][ T4125] netlink: 'syz.4.7194': attribute type 1 has an invalid length. [ 1050.630829][ T4123] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1050.780827][ T4125] bond63: entered promiscuous mode [ 1050.811789][ T4125] 8021q: adding VLAN 0 to HW filter on device bond63 [ 1050.852570][ T4130] lo speed is unknown, defaulting to 1000 [ 1050.863807][ T4123] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1050.929527][ T4123] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1051.199657][ T58] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1051.235569][ T12] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1051.271155][ T4145] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1051.317217][ T58] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1051.403854][ T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1051.937532][ T4166] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1052.105469][ T4172] FAULT_INJECTION: forcing a failure. [ 1052.105469][ T4172] name failslab, interval 1, probability 0, space 0, times 0 [ 1052.147358][ T4172] CPU: 0 UID: 0 PID: 4172 Comm: syz.2.7205 Not tainted syzkaller #0 PREEMPT(full) [ 1052.147390][ T4172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1052.147405][ T4172] Call Trace: [ 1052.147414][ T4172] [ 1052.147424][ T4172] dump_stack_lvl+0xe8/0x150 [ 1052.147462][ T4172] should_fail_ex+0x412/0x560 [ 1052.147495][ T4172] should_failslab+0xa8/0x100 [ 1052.147525][ T4172] __kvmalloc_node_noprof+0x178/0x8a0 [ 1052.147551][ T4172] ? bpf_test_run_xdp_live+0x223/0x1cf0 [ 1052.147581][ T4172] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 1052.147613][ T4172] bpf_test_run_xdp_live+0x223/0x1cf0 [ 1052.147648][ T4172] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1052.147693][ T4172] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 1052.147730][ T4172] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1052.147758][ T4172] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1052.147832][ T4172] ? 0xffffffffa02016f8 [ 1052.147852][ T4172] ? 0xffffffffa0208cd8 [ 1052.147871][ T4172] ? 0xffffffffa020c928 [ 1052.147889][ T4172] ? 0xffffffffa020ca0c [ 1052.147906][ T4172] ? 0xffffffffa020caa4 [ 1052.147925][ T4172] ? 0xffffffffa020cb34 [ 1052.147942][ T4172] ? 0xffffffffa020cc18 [ 1052.147961][ T4172] ? 0xffffffffa020cc8c [ 1052.148005][ T4172] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1052.148046][ T4172] ? _copy_from_user+0x94/0xb0 [ 1052.148084][ T4172] ? bpf_test_init+0x113/0x150 [ 1052.148107][ T4172] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1052.148137][ T4172] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1052.148183][ T4172] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1052.148215][ T4172] ? __fget_files+0x2a/0x420 [ 1052.148252][ T4172] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1052.148280][ T4172] bpf_prog_test_run+0x2c7/0x340 [ 1052.148307][ T4172] __sys_bpf+0x643/0x950 [ 1052.148342][ T4172] ? __pfx___sys_bpf+0x10/0x10 [ 1052.148406][ T4172] ? ksys_write+0x242/0x270 [ 1052.148431][ T4172] ? __pfx_ksys_write+0x10/0x10 [ 1052.148462][ T4172] __x64_sys_bpf+0x7c/0x90 [ 1052.148493][ T4172] do_syscall_64+0x14d/0xf80 [ 1052.148522][ T4172] ? trace_irq_disable+0x3b/0x150 [ 1052.148552][ T4172] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.148574][ T4172] ? clear_bhb_loop+0x40/0x90 [ 1052.148601][ T4172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1052.148622][ T4172] RIP: 0033:0x7f4e08f9c799 [ 1052.148642][ T4172] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1052.148661][ T4172] RSP: 002b:00007f4e09d7b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1052.148685][ T4172] RAX: ffffffffffffffda RBX: 00007f4e09215fa0 RCX: 00007f4e08f9c799 [ 1052.148701][ T4172] RDX: 0000000000000050 RSI: 0000200000000680 RDI: 000000000000000a [ 1052.148715][ T4172] RBP: 00007f4e09d7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1052.148729][ T4172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1052.148742][ T4172] R13: 00007f4e09216038 R14: 00007f4e09215fa0 R15: 00007ffda6d55e28 [ 1052.148778][ T4172] [ 1052.680501][ T4184] IPv6: Can't replace route, no match found [ 1052.743481][ T4187] dummy0: Caught tx_queue_len zero misconfig [ 1053.080195][ T4202] openvswitch: netlink: IP tunnel dst address not specified [ 1053.481793][ T4227] syzkaller0: entered promiscuous mode [ 1053.489743][ T4227] syzkaller0: entered allmulticast mode [ 1053.521053][ T4223] netlink: 'syz.3.7222': attribute type 1 has an invalid length. [ 1053.704557][ T4238] __nla_validate_parse: 10 callbacks suppressed [ 1053.704579][ T4238] netlink: 64 bytes leftover after parsing attributes in process `syz.1.7226'. [ 1053.734313][ T4240] netlink: 'syz.4.7227': attribute type 11 has an invalid length. [ 1053.754938][ T4240] netlink: 'syz.4.7227': attribute type 23 has an invalid length. [ 1053.769757][ T4240] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7227'. [ 1053.847455][ T4238] netlink: 'syz.1.7226': attribute type 11 has an invalid length. [ 1053.872021][ T4238] netlink: 'syz.1.7226': attribute type 23 has an invalid length. [ 1053.903153][ T4238] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7226'. [ 1053.950246][ T4252] netlink: 'syz.0.7228': attribute type 1 has an invalid length. [ 1053.977949][ T4252] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7228'. [ 1054.200229][ T4269] FAULT_INJECTION: forcing a failure. [ 1054.200229][ T4269] name failslab, interval 1, probability 0, space 0, times 0 [ 1054.231031][ T4269] CPU: 1 UID: 0 PID: 4269 Comm: syz.0.7233 Not tainted syzkaller #0 PREEMPT(full) [ 1054.231062][ T4269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1054.231077][ T4269] Call Trace: [ 1054.231087][ T4269] [ 1054.231097][ T4269] dump_stack_lvl+0xe8/0x150 [ 1054.231136][ T4269] should_fail_ex+0x412/0x560 [ 1054.231169][ T4269] should_failslab+0xa8/0x100 [ 1054.231196][ T4269] ? skb_clone+0x212/0x3a0 [ 1054.231230][ T4269] kmem_cache_alloc_noprof+0x87/0x650 [ 1054.231264][ T4269] ? __netlink_lookup+0xc6/0x8b0 [ 1054.231302][ T4269] skb_clone+0x212/0x3a0 [ 1054.231351][ T4269] __netlink_deliver_tap+0x404/0x850 [ 1054.231391][ T4269] ? netlink_deliver_tap+0x2e/0x1b0 [ 1054.231418][ T4269] netlink_deliver_tap+0x19c/0x1b0 [ 1054.231446][ T4269] netlink_unicast+0x7e3/0x9b0 [ 1054.231480][ T4269] ? __pfx_netlink_unicast+0x10/0x10 [ 1054.231506][ T4269] ? netlink_sendmsg+0x650/0xb40 [ 1054.231537][ T4269] ? skb_put+0x11b/0x210 [ 1054.231590][ T4269] netlink_sendmsg+0x813/0xb40 [ 1054.231630][ T4269] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1054.231663][ T4269] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1054.231692][ T4269] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1054.231719][ T4269] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1054.231748][ T4269] ____sys_sendmsg+0xa68/0xad0 [ 1054.231792][ T4269] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1054.231837][ T4269] ? import_iovec+0x73/0xa0 [ 1054.231874][ T4269] ___sys_sendmsg+0x2a5/0x360 [ 1054.231915][ T4269] ? __pfx____sys_sendmsg+0x10/0x10 [ 1054.232066][ T4269] ? __fget_files+0x2a/0x420 [ 1054.232097][ T4269] ? __fget_files+0x3a0/0x420 [ 1054.232140][ T4269] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1054.232178][ T4269] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1054.232224][ T4269] ? __pfx_ksys_write+0x10/0x10 [ 1054.232263][ T4269] do_syscall_64+0x14d/0xf80 [ 1054.232293][ T4269] ? trace_irq_disable+0x3b/0x150 [ 1054.232325][ T4269] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1054.232347][ T4269] ? clear_bhb_loop+0x40/0x90 [ 1054.232374][ T4269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1054.232397][ T4269] RIP: 0033:0x7ff38c59c799 [ 1054.232418][ T4269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1054.232438][ T4269] RSP: 002b:00007ff38d4c7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1054.232463][ T4269] RAX: ffffffffffffffda RBX: 00007ff38c815fa0 RCX: 00007ff38c59c799 [ 1054.232479][ T4269] RDX: 0000000020000110 RSI: 0000200000000180 RDI: 0000000000000003 [ 1054.232494][ T4269] RBP: 00007ff38d4c7090 R08: 0000000000000000 R09: 0000000000000000 [ 1054.232509][ T4269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1054.232522][ T4269] R13: 00007ff38c816038 R14: 00007ff38c815fa0 R15: 00007fff2e182e68 [ 1054.232560][ T4269] [ 1054.545674][ T1301] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1054.567453][ T1301] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1054.576790][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1054.743760][ T4280] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7234'. [ 1054.991832][ T4287] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7237'. [ 1055.189128][ T4296] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7242'. [ 1055.251750][ T4299] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1055.327988][ T4301] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7245'. [ 1055.395556][ T4309] FAULT_INJECTION: forcing a failure. [ 1055.395556][ T4309] name failslab, interval 1, probability 0, space 0, times 0 [ 1055.432807][ T4309] CPU: 1 UID: 0 PID: 4309 Comm: syz.3.7246 Not tainted syzkaller #0 PREEMPT(full) [ 1055.432837][ T4309] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1055.432852][ T4309] Call Trace: [ 1055.432861][ T4309] [ 1055.432872][ T4309] dump_stack_lvl+0xe8/0x150 [ 1055.432908][ T4309] should_fail_ex+0x412/0x560 [ 1055.432941][ T4309] should_failslab+0xa8/0x100 [ 1055.432977][ T4309] __kmalloc_cache_noprof+0x88/0x660 [ 1055.433003][ T4309] ? tcf_block_get_ext+0x8d3/0x17d0 [ 1055.433028][ T4309] ? __kmalloc_cache_noprof+0x15b/0x660 [ 1055.433058][ T4309] tcf_block_get_ext+0x8d3/0x17d0 [ 1055.433089][ T4309] ? is_dynamic_key+0xd6/0x1c0 [ 1055.433123][ T4309] ? __pfx_drr_init_qdisc+0x10/0x10 [ 1055.433151][ T4309] tcf_block_get+0x67/0xa0 [ 1055.433176][ T4309] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 1055.433211][ T4309] drr_init_qdisc+0x2e/0xd0 [ 1055.433240][ T4309] qdisc_create+0x7c4/0xf20 [ 1055.433267][ T4309] ? lockdep_rtnl_is_held+0x26/0x40 [ 1055.433308][ T4309] tc_modify_qdisc+0x16f0/0x2290 [ 1055.433331][ T4309] ? rcu_is_watching+0x15/0xb0 [ 1055.433380][ T4309] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1055.433404][ T4309] ? __dev_queue_xmit+0x277/0x3890 [ 1055.433459][ T4309] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1055.433481][ T4309] rtnetlink_rcv_msg+0x77e/0xbe0 [ 1055.433514][ T4309] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 1055.433542][ T4309] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1055.433568][ T4309] ? ref_tracker_free+0x693/0x840 [ 1055.433593][ T4309] ? __copy_skb_header+0xa3/0x4a0 [ 1055.433629][ T4309] ? __pfx_ref_tracker_free+0x10/0x10 [ 1055.433670][ T4309] netlink_rcv_skb+0x232/0x4b0 [ 1055.433699][ T4309] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1055.433730][ T4309] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1055.433771][ T4309] ? netlink_deliver_tap+0x2e/0x1b0 [ 1055.433808][ T4309] netlink_unicast+0x80f/0x9b0 [ 1055.433844][ T4309] ? __pfx_netlink_unicast+0x10/0x10 [ 1055.433871][ T4309] ? netlink_sendmsg+0x650/0xb40 [ 1055.433897][ T4309] ? skb_put+0x11b/0x210 [ 1055.433931][ T4309] netlink_sendmsg+0x813/0xb40 [ 1055.433977][ T4309] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1055.434010][ T4309] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1055.434039][ T4309] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1055.434065][ T4309] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1055.434091][ T4309] ____sys_sendmsg+0xa68/0xad0 [ 1055.434122][ T4309] ? __lock_acquire+0x6b5/0x2cf0 [ 1055.434159][ T4309] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1055.434202][ T4309] ? import_iovec+0x73/0xa0 [ 1055.434238][ T4309] ___sys_sendmsg+0x2a5/0x360 [ 1055.434278][ T4309] ? __pfx____sys_sendmsg+0x10/0x10 [ 1055.434318][ T4309] ? kstrtouint+0x6e/0xe0 [ 1055.434376][ T4309] ? __fget_files+0x2a/0x420 [ 1055.434407][ T4309] ? __fget_files+0x3a0/0x420 [ 1055.434450][ T4309] __sys_sendmmsg+0x27c/0x4e0 [ 1055.434491][ T4309] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1055.434521][ T4309] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1055.434587][ T4309] ? ksys_write+0x242/0x270 [ 1055.434613][ T4309] ? __pfx_ksys_write+0x10/0x10 [ 1055.434644][ T4309] __x64_sys_sendmmsg+0xa0/0xc0 [ 1055.434680][ T4309] do_syscall_64+0x14d/0xf80 [ 1055.434709][ T4309] ? trace_irq_disable+0x3b/0x150 [ 1055.434740][ T4309] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1055.434763][ T4309] ? clear_bhb_loop+0x40/0x90 [ 1055.434791][ T4309] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1055.434814][ T4309] RIP: 0033:0x7fd27fd9c799 [ 1055.434836][ T4309] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1055.434855][ T4309] RSP: 002b:00007fd280cb8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1055.434880][ T4309] RAX: ffffffffffffffda RBX: 00007fd280015fa0 RCX: 00007fd27fd9c799 [ 1055.434897][ T4309] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000005 [ 1055.434911][ T4309] RBP: 00007fd280cb8090 R08: 0000000000000000 R09: 0000000000000000 [ 1055.434926][ T4309] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1055.434939][ T4309] R13: 00007fd280016038 R14: 00007fd280015fa0 R15: 00007ffe670d1778 [ 1055.434985][ T4309] [ 1055.575253][ T4315] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7247'. [ 1055.739009][ T4319] FAULT_INJECTION: forcing a failure. [ 1055.739009][ T4319] name failslab, interval 1, probability 0, space 0, times 0 [ 1055.858270][ T4315] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7247'. [ 1055.919681][ T4319] CPU: 1 UID: 0 PID: 4319 Comm: syz.4.7249 Not tainted syzkaller #0 PREEMPT(full) [ 1055.919712][ T4319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1055.919726][ T4319] Call Trace: [ 1055.919735][ T4319] [ 1055.919745][ T4319] dump_stack_lvl+0xe8/0x150 [ 1055.919782][ T4319] should_fail_ex+0x412/0x560 [ 1055.919816][ T4319] should_failslab+0xa8/0x100 [ 1055.919842][ T4319] ? alloc_vfsmnt+0x23/0x420 [ 1055.919867][ T4319] kmem_cache_alloc_noprof+0x87/0x650 [ 1055.919914][ T4319] alloc_vfsmnt+0x23/0x420 [ 1055.919950][ T4319] clone_mnt+0x4b/0x9a0 [ 1055.919974][ T4319] ? do_raw_spin_unlock+0xf5/0x210 [ 1055.920004][ T4319] copy_tree+0x3d4/0x930 [ 1055.920052][ T4319] copy_mnt_ns+0x24d/0x990 [ 1055.920082][ T4319] ? kmem_cache_alloc_noprof+0x307/0x650 [ 1055.920115][ T4319] ? create_new_namespaces+0x33/0x6a0 [ 1055.920155][ T4319] create_new_namespaces+0xcf/0x6a0 [ 1055.920188][ T4319] ? bpf_lsm_capable+0x9/0x20 [ 1055.920216][ T4319] ? security_capable+0x7e/0x2c0 [ 1055.920251][ T4319] unshare_nsproxy_namespaces+0x11a/0x160 [ 1055.920287][ T4319] ksys_unshare+0x51d/0x930 [ 1055.920333][ T4319] ? __pfx_ksys_unshare+0x10/0x10 [ 1055.920368][ T4319] ? __pfx_ksys_write+0x10/0x10 [ 1055.920405][ T4319] __x64_sys_unshare+0x38/0x50 [ 1055.920438][ T4319] do_syscall_64+0x14d/0xf80 [ 1055.920468][ T4319] ? trace_irq_disable+0x3b/0x150 [ 1055.920499][ T4319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1055.920523][ T4319] ? clear_bhb_loop+0x40/0x90 [ 1055.920552][ T4319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1055.920574][ T4319] RIP: 0033:0x7f124879c799 [ 1055.920596][ T4319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1055.920616][ T4319] RSP: 002b:00007f12496ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1055.920641][ T4319] RAX: ffffffffffffffda RBX: 00007f1248a15fa0 RCX: 00007f124879c799 [ 1055.920658][ T4319] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000020000 [ 1055.920672][ T4319] RBP: 00007f12496ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1055.920686][ T4319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1055.920700][ T4319] R13: 00007f1248a16038 R14: 00007f1248a15fa0 R15: 00007ffc7974eb98 [ 1055.920739][ T4319] [ 1056.227479][ T4328] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1056.594807][ T4347] syzkaller1: entered promiscuous mode [ 1056.600456][ T4347] syzkaller1: entered allmulticast mode [ 1057.057425][ T4379] lo speed is unknown, defaulting to 1000 [ 1059.455208][ T4473] __nla_validate_parse: 12 callbacks suppressed [ 1059.455232][ T4473] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7297'. [ 1059.547131][ T4473] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7297'. [ 1059.557394][ T4473] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7297'. [ 1059.929591][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5350 ms [ 1059.937721][ C1] lec:lec_tx_timeout: lec0 [ 1060.314973][ T4508] bpq0: entered promiscuous mode [ 1060.320239][ T4508] bpq0: entered allmulticast mode [ 1060.327546][ T4508] netlink: 'syz.2.7306': attribute type 11 has an invalid length. [ 1060.336530][ T4508] netlink: 'syz.2.7306': attribute type 23 has an invalid length. [ 1060.379017][ T4508] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7306'. [ 1060.457043][ T4512] netlink: 64 bytes leftover after parsing attributes in process `syz.1.7308'. [ 1060.488467][ T4512] bpq0: left promiscuous mode [ 1060.493655][ T4512] bpq0: left allmulticast mode [ 1060.503812][ T4512] netlink: 'syz.1.7308': attribute type 11 has an invalid length. [ 1060.517200][ T4512] netlink: 'syz.1.7308': attribute type 23 has an invalid length. [ 1060.525583][ T4512] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7308'. [ 1060.560632][ T4514] FAULT_INJECTION: forcing a failure. [ 1060.560632][ T4514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1060.583790][ T4514] CPU: 1 UID: 0 PID: 4514 Comm: syz.3.7307 Not tainted syzkaller #0 PREEMPT(full) [ 1060.583821][ T4514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1060.583836][ T4514] Call Trace: [ 1060.583846][ T4514] [ 1060.583856][ T4514] dump_stack_lvl+0xe8/0x150 [ 1060.583893][ T4514] should_fail_ex+0x412/0x560 [ 1060.583927][ T4514] _copy_to_user+0x31/0xb0 [ 1060.583962][ T4514] simple_read_from_buffer+0xe1/0x170 [ 1060.584000][ T4514] proc_fail_nth_read+0x1bb/0x230 [ 1060.584035][ T4514] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1060.584076][ T4514] ? rw_verify_area+0x2a6/0x4d0 [ 1060.584098][ T4514] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1060.584130][ T4514] vfs_read+0x20c/0xa70 [ 1060.584150][ T4514] ? fdget_pos+0x246/0x320 [ 1060.584187][ T4514] ? __pfx___mutex_lock+0x10/0x10 [ 1060.584221][ T4514] ? __pfx_vfs_read+0x10/0x10 [ 1060.584251][ T4514] ? __fget_files+0x2a/0x420 [ 1060.584288][ T4514] ? __fget_files+0x3a0/0x420 [ 1060.584316][ T4514] ? __fget_files+0x2a/0x420 [ 1060.584359][ T4514] ksys_read+0x150/0x270 [ 1060.584385][ T4514] ? __pfx_ksys_read+0x10/0x10 [ 1060.584423][ T4514] do_syscall_64+0x14d/0xf80 [ 1060.584452][ T4514] ? trace_irq_disable+0x3b/0x150 [ 1060.584484][ T4514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1060.584507][ T4514] ? clear_bhb_loop+0x40/0x90 [ 1060.584535][ T4514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1060.584558][ T4514] RIP: 0033:0x7fd27fd5cfce [ 1060.584580][ T4514] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1060.584601][ T4514] RSP: 002b:00007fd280cb7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1060.584624][ T4514] RAX: ffffffffffffffda RBX: 00007fd280cb86c0 RCX: 00007fd27fd5cfce [ 1060.584641][ T4514] RDX: 000000000000000f RSI: 00007fd280cb80a0 RDI: 0000000000000007 [ 1060.584656][ T4514] RBP: 00007fd280cb8090 R08: 0000000000000000 R09: 0000000000000000 [ 1060.584670][ T4514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1060.584684][ T4514] R13: 00007fd280016038 R14: 00007fd280015fa0 R15: 00007ffe670d1778 [ 1060.584723][ T4514] [ 1061.045016][ T4527] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1061.132488][ T4533] æÿîÿ: entered promiscuous mode [ 1061.478863][ T4549] netlink: 116 bytes leftover after parsing attributes in process `syz.4.7320'. [ 1061.622095][ T4556] lo speed is unknown, defaulting to 1000 [ 1061.625891][ T4559] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7320'. [ 1061.754108][ T4563] netlink: 'syz.1.7323': attribute type 11 has an invalid length. [ 1061.789002][ T4563] netlink: 'syz.1.7323': attribute type 23 has an invalid length. [ 1061.840101][ T4563] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7323'. [ 1062.029124][ T4572] netlink: 64 bytes leftover after parsing attributes in process `syz.0.7325'. [ 1062.095815][ T4572] netlink: 'syz.0.7325': attribute type 11 has an invalid length. [ 1062.103912][ T4572] netlink: 'syz.0.7325': attribute type 23 has an invalid length. [ 1062.325594][ T4580] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.362094][ T4580] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.489467][ T4580] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.509928][ T4580] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.663106][ T4580] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.673160][ T4580] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.748948][ T4588] FAULT_INJECTION: forcing a failure. [ 1062.748948][ T4588] name failslab, interval 1, probability 0, space 0, times 0 [ 1062.783087][ T4580] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.817876][ T4588] CPU: 0 UID: 0 PID: 4588 Comm: syz.1.7327 Not tainted syzkaller #0 PREEMPT(full) [ 1062.817907][ T4588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1062.817931][ T4588] Call Trace: [ 1062.817940][ T4588] [ 1062.817951][ T4588] dump_stack_lvl+0xe8/0x150 [ 1062.817989][ T4588] should_fail_ex+0x412/0x560 [ 1062.818022][ T4588] should_failslab+0xa8/0x100 [ 1062.818052][ T4588] __kmalloc_cache_node_noprof+0x8a/0x6b0 [ 1062.818078][ T4588] ? trace_kmalloc+0x2a/0x110 [ 1062.818097][ T4588] ? page_pool_create_percpu+0x76/0xb80 [ 1062.818140][ T4588] page_pool_create_percpu+0x76/0xb80 [ 1062.818177][ T4588] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 1062.818209][ T4588] bpf_test_run_xdp_live+0x23d/0x1cf0 [ 1062.818246][ T4588] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1062.818290][ T4588] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 1062.818326][ T4588] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1062.818355][ T4588] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1062.818408][ T4588] ? 0xffffffffa02016f8 [ 1062.818429][ T4588] ? 0xffffffffa0208cd8 [ 1062.818448][ T4588] ? 0xffffffffa020c914 [ 1062.818467][ T4588] ? 0xffffffffa020ca0c [ 1062.818486][ T4588] ? 0xffffffffa020caa4 [ 1062.818505][ T4588] ? 0xffffffffa020cb34 [ 1062.818524][ T4588] ? 0xffffffffa020cc18 [ 1062.818571][ T4588] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1062.818614][ T4588] ? _copy_from_user+0x94/0xb0 [ 1062.818647][ T4588] ? bpf_test_init+0x113/0x150 [ 1062.818672][ T4588] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1062.818701][ T4588] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1062.818749][ T4588] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1062.818782][ T4588] ? __fget_files+0x2a/0x420 [ 1062.818820][ T4588] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1062.818848][ T4588] bpf_prog_test_run+0x2c7/0x340 [ 1062.818876][ T4588] __sys_bpf+0x643/0x950 [ 1062.818922][ T4588] ? __pfx___sys_bpf+0x10/0x10 [ 1062.818974][ T4588] ? ksys_write+0x242/0x270 [ 1062.819002][ T4588] ? __pfx_ksys_write+0x10/0x10 [ 1062.819033][ T4588] __x64_sys_bpf+0x7c/0x90 [ 1062.819065][ T4588] do_syscall_64+0x14d/0xf80 [ 1062.819095][ T4588] ? trace_irq_disable+0x3b/0x150 [ 1062.819127][ T4588] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1062.819150][ T4588] ? clear_bhb_loop+0x40/0x90 [ 1062.819179][ T4588] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1062.819202][ T4588] RIP: 0033:0x7f9b4dd9c799 [ 1062.819221][ T4588] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1062.819241][ T4588] RSP: 002b:00007f9b4bff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1062.819265][ T4588] RAX: ffffffffffffffda RBX: 00007f9b4e015fa0 RCX: 00007f9b4dd9c799 [ 1062.819282][ T4588] RDX: 0000000000000050 RSI: 0000200000000680 RDI: 000000000000000a [ 1062.819296][ T4588] RBP: 00007f9b4bff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1062.819310][ T4588] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1062.819324][ T4588] R13: 00007f9b4e016038 R14: 00007f9b4e015fa0 R15: 00007fffbfbdd338 [ 1062.819360][ T4588] [ 1062.819489][ T4580] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1063.379684][ T13] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1063.398248][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.543574][ T58] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1063.552513][ T58] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.637673][ T1004] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1063.646700][ T1004] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.721480][ T13] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1063.760313][ T13] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1064.126799][ T4618] lo speed is unknown, defaulting to 1000 [ 1064.176825][ T4611] netlink: 'syz.3.7333': attribute type 1 has an invalid length. [ 1064.455164][ T4611] bond24: entered promiscuous mode [ 1064.508250][ T4611] 8021q: adding VLAN 0 to HW filter on device bond24 [ 1064.540457][ T4633] __nla_validate_parse: 3 callbacks suppressed [ 1064.540479][ T4633] netlink: 64 bytes leftover after parsing attributes in process `syz.4.7338'. [ 1064.572183][ T4635] netlink: 'syz.1.7337': attribute type 11 has an invalid length. [ 1064.599799][ T4635] netlink: 'syz.1.7337': attribute type 23 has an invalid length. [ 1064.620391][ T4635] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7337'. [ 1064.660075][ T4633] netlink: 'syz.4.7338': attribute type 11 has an invalid length. [ 1064.675177][ T4633] netlink: 'syz.4.7338': attribute type 23 has an invalid length. [ 1064.703775][ T4633] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7338'. [ 1065.222808][ T4646] netlink: 'syz.2.7341': attribute type 1 has an invalid length. [ 1065.250915][ T4646] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7341'. [ 1065.558574][ T4655] sctp: [Deprecated]: syz.4.7343 (pid 4655) Use of int in maxseg socket option. [ 1065.558574][ T4655] Use struct sctp_assoc_value instead [ 1065.668705][ T4653] netlink: 'syz.2.7342': attribute type 1 has an invalid length. [ 1065.700022][ T4653] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7342'. [ 1065.733966][ T4659] netlink: 'syz.4.7343': attribute type 4 has an invalid length. [ 1065.779904][ T4655] netlink: 'syz.4.7343': attribute type 4 has an invalid length. [ 1066.121695][ T4670] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7347'. [ 1066.154145][ T4670] netlink: 'syz.4.7347': attribute type 1 has an invalid length. [ 1066.180176][ T4670] netlink: 232 bytes leftover after parsing attributes in process `syz.4.7347'. [ 1066.620060][ T4687] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1066.657978][ T4687] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1066.782806][ T4689] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 1066.868343][ T4693] netlink: 'syz.4.7354': attribute type 11 has an invalid length. [ 1066.876289][ T4693] netlink: 'syz.4.7354': attribute type 23 has an invalid length. [ 1066.884656][ T4693] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7354'. [ 1066.901170][ T4687] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1066.950114][ T4687] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1067.068423][ T4700] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1067.183529][ T4687] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1067.219302][ T4687] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1067.266619][ T4700] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1067.316449][ T4687] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1067.336324][ T4687] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1067.376593][ T4700] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1067.447857][ T4700] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1067.501644][ T1095] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.511104][ T1095] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1067.592469][ T58] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.601361][ T58] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1067.634399][ T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.663295][ T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.720390][ T13] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.771675][ T1095] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.790467][ T1095] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1067.818811][ T1095] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.888410][ T1095] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.919678][ T1095] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1068.029244][ T4712] netlink: 168 bytes leftover after parsing attributes in process `syz.4.7357'. [ 1068.062062][ T4712] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1068.250301][ T4717] netlink: 'syz.1.7359': attribute type 1 has an invalid length. [ 1068.258128][ T4717] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7359'. [ 1068.476284][ T4730] lo speed is unknown, defaulting to 1000 [ 1068.501888][ T4727] netlink: 'syz.3.7363': attribute type 1 has an invalid length. [ 1068.606212][ T4727] bond25: entered promiscuous mode [ 1068.671842][ T4727] 8021q: adding VLAN 0 to HW filter on device bond25 [ 1068.922195][ T4743] netlink: 'syz.1.7367': attribute type 11 has an invalid length. [ 1068.941236][ T4743] netlink: 'syz.1.7367': attribute type 23 has an invalid length. [ 1070.414245][ T4782] __nla_validate_parse: 4 callbacks suppressed [ 1070.414265][ T4782] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7380'. [ 1070.459861][ T4782] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7380'. [ 1070.493932][ T4782] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7380'. [ 1070.692346][ T4790] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1070.728671][ T4790] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1070.780038][ T4795] netlink: 60 bytes leftover after parsing attributes in process `syz.1.7384'. [ 1070.870505][ T4796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7382'. [ 1070.940297][ T4794] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1071.065578][ T4790] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.083281][ T4790] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.108846][ T4807] netlink: 'syz.4.7387': attribute type 11 has an invalid length. [ 1071.125356][ T4807] netlink: 'syz.4.7387': attribute type 23 has an invalid length. [ 1071.134777][ T4807] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7387'. [ 1071.154465][ T4790] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.185858][ T4790] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.217143][ T4813] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1071.246554][ T4790] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.259817][ T4790] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.292334][ T4812] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7389'. [ 1071.401361][ T4818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7391'. [ 1071.412647][ T4818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7391'. [ 1071.421966][ T4818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7391'. [ 1071.435817][ T1004] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1071.444964][ T1004] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1071.479297][ T1004] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1071.488258][ T1004] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1071.542510][ T1004] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1071.551075][ T1004] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1071.614926][ T1095] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1071.623911][ T1095] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1072.072052][ T4836] netlink: 'syz.4.7398': attribute type 61 has an invalid length. [ 1072.099759][ T4836] netlink: 'syz.4.7398': attribute type 62 has an invalid length. [ 1072.456431][ T4853] lo speed is unknown, defaulting to 1000 [ 1072.673886][ T4856] bond20: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1072.705035][ T4856] bond20 (unregistering): Released all slaves [ 1073.139766][ T4881] netlink: 'syz.1.7408': attribute type 11 has an invalid length. [ 1073.165837][ T4881] netlink: 'syz.1.7408': attribute type 23 has an invalid length. [ 1073.799333][ T4894] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1074.107802][ T4905] netlink: 'syz.2.7413': attribute type 61 has an invalid length. [ 1074.117871][ T4905] netlink: 'syz.2.7413': attribute type 62 has an invalid length. [ 1074.338415][ T4921] netlink: 'syz.4.7418': attribute type 4 has an invalid length. [ 1074.832720][ T4934] veth0: entered promiscuous mode [ 1074.838551][ T4934] vlan3: entered promiscuous mode [ 1075.002250][ T4940] netlink: 'syz.1.7424': attribute type 11 has an invalid length. [ 1075.040032][ T4940] netlink: 'syz.1.7424': attribute type 23 has an invalid length. [ 1075.567224][ T4965] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1075.624975][ T4965] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1075.668013][ T4970] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1075.698209][ T4972] __nla_validate_parse: 18 callbacks suppressed [ 1075.698230][ T4972] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7432'. [ 1075.717966][ T4972] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7432'. [ 1075.727738][ T4972] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7432'. [ 1075.742095][ T4965] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1075.790945][ T4970] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7431'. [ 1075.828518][ T4965] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1075.965417][ T1095] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 1076.002135][ T1095] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 1076.056246][ T1095] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 1076.094049][ T1095] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 1076.727343][ T5015] bpq0: entered promiscuous mode [ 1076.779809][ T5015] bpq0: entered allmulticast mode [ 1076.789920][ T5015] netlink: 'syz.2.7443': attribute type 11 has an invalid length. [ 1076.798260][ T5015] netlink: 'syz.2.7443': attribute type 23 has an invalid length. [ 1076.813116][ T5015] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7443'. [ 1077.076879][ T5020] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7444'. [ 1077.086087][ T5020] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7444'. [ 1077.095303][ T5020] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7444'. [ 1077.405792][ T5035] netlink: 'syz.3.7449': attribute type 10 has an invalid length. [ 1077.722739][ T5045] netlink: 'syz.2.7451': attribute type 10 has an invalid length. [ 1078.117696][ T5056] netlink: 156 bytes leftover after parsing attributes in process `syz.0.7454'. [ 1078.344095][ T5060] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7456'. [ 1078.661551][ T5074] bpq0: left promiscuous mode [ 1078.672085][ T5074] bpq0: left allmulticast mode [ 1078.687302][ T5074] netlink: 'syz.4.7461': attribute type 11 has an invalid length. [ 1078.698067][ T5074] netlink: 'syz.4.7461': attribute type 23 has an invalid length. [ 1078.751991][ T5078] hsr_slave_0: left promiscuous mode [ 1078.776367][ T5078] hsr_slave_1: left promiscuous mode [ 1078.936499][ T5086] netlink: 'syz.3.7466': attribute type 4 has an invalid length. [ 1080.162081][ T5128] bpq0: entered promiscuous mode [ 1080.171722][ T5128] bpq0: entered allmulticast mode [ 1080.186127][ T5128] netlink: 'syz.2.7483': attribute type 11 has an invalid length. [ 1080.199652][ T5128] netlink: 'syz.2.7483': attribute type 23 has an invalid length. [ 1080.871248][ T5152] netlink: 'syz.4.7489': attribute type 2 has an invalid length. [ 1080.892860][ T5159] FAULT_INJECTION: forcing a failure. [ 1080.892860][ T5159] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1080.921559][ T5159] CPU: 1 UID: 0 PID: 5159 Comm: syz.1.7490 Not tainted syzkaller #0 PREEMPT(full) [ 1080.921590][ T5159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1080.921605][ T5159] Call Trace: [ 1080.921614][ T5159] [ 1080.921624][ T5159] dump_stack_lvl+0xe8/0x150 [ 1080.921660][ T5159] should_fail_ex+0x412/0x560 [ 1080.921692][ T5159] _copy_to_user+0x31/0xb0 [ 1080.921727][ T5159] simple_read_from_buffer+0xe1/0x170 [ 1080.921764][ T5159] proc_fail_nth_read+0x1bb/0x230 [ 1080.921798][ T5159] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1080.921831][ T5159] ? rw_verify_area+0x2a6/0x4d0 [ 1080.921853][ T5159] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1080.921886][ T5159] vfs_read+0x20c/0xa70 [ 1080.921906][ T5159] ? fdget_pos+0x246/0x320 [ 1080.921943][ T5159] ? __pfx___mutex_lock+0x10/0x10 [ 1080.921976][ T5159] ? __pfx_vfs_read+0x10/0x10 [ 1080.922000][ T5159] ? __fget_files+0x2a/0x420 [ 1080.922037][ T5159] ? __fget_files+0x3a0/0x420 [ 1080.922067][ T5159] ? __fget_files+0x2a/0x420 [ 1080.922108][ T5159] ksys_read+0x150/0x270 [ 1080.922142][ T5159] ? __pfx_ksys_read+0x10/0x10 [ 1080.922177][ T5159] do_syscall_64+0x14d/0xf80 [ 1080.922203][ T5159] ? trace_irq_disable+0x3b/0x150 [ 1080.922232][ T5159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.922253][ T5159] ? clear_bhb_loop+0x40/0x90 [ 1080.922278][ T5159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1080.922298][ T5159] RIP: 0033:0x7f9b4dd5cfce [ 1080.922318][ T5159] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1080.922335][ T5159] RSP: 002b:00007f9b4bff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1080.922357][ T5159] RAX: ffffffffffffffda RBX: 00007f9b4bff66c0 RCX: 00007f9b4dd5cfce [ 1080.922372][ T5159] RDX: 000000000000000f RSI: 00007f9b4bff60a0 RDI: 0000000000000004 [ 1080.922386][ T5159] RBP: 00007f9b4bff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1080.922399][ T5159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1080.922411][ T5159] R13: 00007f9b4e016038 R14: 00007f9b4e015fa0 R15: 00007fffbfbdd338 [ 1080.922445][ T5159] [ 1080.925450][ T5158] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1081.164199][ T5158] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.217416][ T5163] __nla_validate_parse: 12 callbacks suppressed [ 1081.217439][ T5163] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7491'. [ 1081.345680][ T5160] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1081.419979][ T5158] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1081.438732][ T5158] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.621646][ T5158] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1081.631787][ T5158] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.705944][ T5158] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1081.719814][ T5158] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1081.762445][ T5188] 8021q: VLANs not supported on xfrm0 [ 1081.908551][ T6962] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.923620][ T6962] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.962590][ T6962] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1081.979776][ T6962] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.035599][ T6962] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1082.059264][ T6962] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.106246][ T6962] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1082.123916][ T6962] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.384312][ T5202] bpq0: left allmulticast mode [ 1082.433164][ T5202] netlink: 'syz.3.7503': attribute type 11 has an invalid length. [ 1082.475931][ T5202] netlink: 'syz.3.7503': attribute type 23 has an invalid length. [ 1082.513416][ T5202] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7503'. [ 1082.899797][ T5221] netlink: 'syz.0.7509': attribute type 4 has an invalid length. [ 1082.923080][ T5221] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7509'. [ 1083.006387][ T5226] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7509'. [ 1083.019122][ T5227] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7511'. [ 1083.074523][ T5229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7512'. [ 1083.088118][ T5229] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7512'. [ 1083.251164][ T5235] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1083.327777][ T5241] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7516'. [ 1083.371639][ T5235] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1083.466602][ T5235] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1083.562619][ T5235] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1083.595446][ T5249] bpq0: left promiscuous mode [ 1083.616351][ T5249] netlink: 'syz.0.7519': attribute type 11 has an invalid length. [ 1083.639804][ T5249] netlink: 'syz.0.7519': attribute type 23 has an invalid length. [ 1083.673599][ T5249] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7519'. [ 1083.714666][ T1095] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 1083.751406][ T58] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 1083.792490][ T58] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 1083.812944][ T5259] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1083.833102][ T5259] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1083.894984][ T1004] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 1083.927499][ T5262] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1083.967278][ T5262] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1084.026355][ T5259] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.036710][ T5259] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1084.065403][ T5264] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 1084.101221][ T5262] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.120204][ T5262] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1084.142079][ T5259] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.152765][ T5259] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1084.200760][ T5264] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7523'. [ 1084.220955][ T5262] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.234354][ T5262] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1084.274352][ T5259] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.290732][ T5259] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1084.312917][ T5262] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1084.324148][ T5262] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1084.413708][ T5272] netlink: 'syz.4.7526': attribute type 4 has an invalid length. [ 1084.481329][ T6962] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1084.501758][ T6962] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1084.539941][ T1004] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1084.548347][ T1004] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1084.581217][ T6962] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1084.605444][ T6962] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1084.669439][ T6962] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1084.686572][ T6962] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1085.006981][ T5295] bpq0: entered promiscuous mode [ 1085.012547][ T5295] bpq0: entered allmulticast mode [ 1085.038818][ T5295] netlink: 'syz.2.7536': attribute type 11 has an invalid length. [ 1085.048120][ T5295] netlink: 'syz.2.7536': attribute type 23 has an invalid length. [ 1085.133541][ T5299] bpq0: left promiscuous mode [ 1085.138611][ T5299] bpq0: left allmulticast mode [ 1085.145545][ T5299] netlink: 'syz.1.7538': attribute type 11 has an invalid length. [ 1085.154109][ T5299] netlink: 'syz.1.7538': attribute type 23 has an invalid length. [ 1085.182942][ T5304] netlink: 'syz.0.7539': attribute type 1 has an invalid length. [ 1085.198702][ T5303] netlink: 'syz.4.7540': attribute type 4 has an invalid length. [ 1085.478233][ T5313] netlink: 'syz.0.7544': attribute type 61 has an invalid length. [ 1085.486386][ T5313] netlink: 'syz.0.7544': attribute type 62 has an invalid length. [ 1085.586921][ T5324] block nbd7: Unsupported socket: should be TCP or UNIX. [ 1085.657033][ T5330] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1085.723530][ T6962] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.749665][ T6962] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.773281][ T6962] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.781905][ T6962] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.807800][ T6962] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.824662][ T6962] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.875134][ T6962] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1085.889279][ T6962] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1086.610806][ T5359] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1086.627198][ T5359] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1087.041324][ T6962] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.067217][ T6962] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.109766][ T6962] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.128551][ T6962] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.148496][ T6962] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.196076][ T6962] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.239792][ T6962] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.249255][ T6962] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.290105][ T5396] bpq0: entered promiscuous mode [ 1087.295210][ T5396] bpq0: entered allmulticast mode [ 1087.313522][ T5396] netlink: 'syz.2.7567': attribute type 11 has an invalid length. [ 1087.344680][ T5396] __nla_validate_parse: 15 callbacks suppressed [ 1087.344703][ T5396] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7567'. [ 1087.410245][ T5394] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7566'. [ 1087.555625][ T5411] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.566041][ T5410] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7573'. [ 1087.576203][ T5411] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1087.588267][ T5410] nbd: couldn't find device at index 0 [ 1087.679053][ T5411] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.690540][ T5411] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1087.745264][ T5422] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1087.788425][ T5411] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.799681][ T5411] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1087.835715][ T5422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7575'. [ 1087.863530][ T5424] netlink: 104 bytes leftover after parsing attributes in process `syz.3.7579'. [ 1087.879046][ T5411] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1087.889808][ T5411] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1087.999298][ T1004] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1088.009805][ T1004] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1088.036591][ T1004] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1088.045241][ T1004] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1088.068422][ T1004] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1088.078427][ T1004] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1088.129869][ T1004] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1088.148664][ T1004] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1088.290115][ T5433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7582'. [ 1088.402487][ T5435] validate_nla: 6 callbacks suppressed [ 1088.402507][ T5435] netlink: 'syz.3.7583': attribute type 1 has an invalid length. [ 1088.435284][ T5435] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7583'. [ 1088.556206][ T5447] RDS: rds_bind could not find a transport for ::ffff:172.30.0.3, load rds_tcp or rds_rdma? [ 1088.869528][ T5467] FAULT_INJECTION: forcing a failure. [ 1088.869528][ T5467] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1088.901988][ T5467] CPU: 1 UID: 0 PID: 5467 Comm: syz.4.7596 Not tainted syzkaller #0 PREEMPT(full) [ 1088.902019][ T5467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1088.902033][ T5467] Call Trace: [ 1088.902042][ T5467] [ 1088.902052][ T5467] dump_stack_lvl+0xe8/0x150 [ 1088.902088][ T5467] should_fail_ex+0x412/0x560 [ 1088.902120][ T5467] _copy_from_iter+0x1d3/0x1670 [ 1088.902153][ T5467] ? sock_alloc_send_pskb+0x896/0x990 [ 1088.902195][ T5467] ? __pfx__copy_from_iter+0x10/0x10 [ 1088.902234][ T5467] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1088.902270][ T5467] skb_copy_datagram_from_iter+0xf5/0x710 [ 1088.902308][ T5467] ? dev_get_by_index+0x22/0x2e0 [ 1088.902329][ T5467] ? skb_put+0x11b/0x210 [ 1088.902362][ T5467] packet_sendmsg+0x37e4/0x50f0 [ 1088.902403][ T5467] ? __lock_acquire+0x6b5/0x2cf0 [ 1088.902442][ T5467] ? __lock_acquire+0x6b5/0x2cf0 [ 1088.902488][ T5467] ? aa_sk_perm+0x6d5/0x900 [ 1088.902511][ T5467] ? __pfx_packet_sendmsg+0x10/0x10 [ 1088.902544][ T5467] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 1088.902579][ T5467] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1088.902605][ T5467] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1088.902633][ T5467] __sys_sendto+0x709/0x7a0 [ 1088.902665][ T5467] ? __pfx___sys_sendto+0x10/0x10 [ 1088.902691][ T5467] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1088.902735][ T5467] ? __fget_files+0x3a0/0x420 [ 1088.902779][ T5467] ? ksys_write+0x242/0x270 [ 1088.902804][ T5467] ? __pfx_ksys_write+0x10/0x10 [ 1088.902851][ T5467] __x64_sys_sendto+0xde/0x100 [ 1088.902905][ T5467] do_syscall_64+0x14d/0xf80 [ 1088.902935][ T5467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.902958][ T5467] ? clear_bhb_loop+0x40/0x90 [ 1088.902983][ T5467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1088.903005][ T5467] RIP: 0033:0x7f124879c799 [ 1088.903030][ T5467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1088.903050][ T5467] RSP: 002b:00007f12496ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1088.903073][ T5467] RAX: ffffffffffffffda RBX: 00007f1248a15fa0 RCX: 00007f124879c799 [ 1088.903090][ T5467] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1088.903106][ T5467] RBP: 00007f12496ba090 R08: 0000200000000140 R09: 0000000000000014 [ 1088.903121][ T5467] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 1088.903134][ T5467] R13: 00007f1248a16038 R14: 00007f1248a15fa0 R15: 00007ffc7974eb98 [ 1088.903172][ T5467] [ 1089.338151][ T5491] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7602'. [ 1089.797092][ T5506] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7607'. [ 1089.807902][ T5506] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7607'. [ 1089.965287][ T5514] bpq0: left promiscuous mode [ 1089.979397][ T5514] bpq0: left allmulticast mode [ 1090.001236][ T5514] netlink: 'syz.2.7610': attribute type 11 has an invalid length. [ 1090.009349][ T5514] netlink: 'syz.2.7610': attribute type 23 has an invalid length. [ 1090.111093][ T5520] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1090.598598][ T5548] netlink: 'syz.1.7623': attribute type 11 has an invalid length. [ 1090.614322][ T5548] netlink: 'syz.1.7623': attribute type 23 has an invalid length. [ 1090.838270][ T5564] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1090.934134][ T5569] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1091.022897][ T5573] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1091.083213][ T5575] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1091.113970][ T5573] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1091.183792][ T5573] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1091.254058][ T5573] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1091.487170][ T5595] netlink: 'syz.2.7639': attribute type 11 has an invalid length. [ 1091.495653][ T5595] netlink: 'syz.2.7639': attribute type 23 has an invalid length. [ 1091.501663][ T1004] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 1091.539172][ T1004] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 1091.631677][ T5598] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1091.679731][ T58] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 1091.729163][ T1095] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 1092.044645][ T5615] syzkaller1: left promiscuous mode [ 1092.051619][ T5615] syzkaller1: left allmulticast mode [ 1092.181938][ T5632] FAULT_INJECTION: forcing a failure. [ 1092.181938][ T5632] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1092.240016][ T5632] CPU: 0 UID: 0 PID: 5632 Comm: syz.3.7649 Not tainted syzkaller #0 PREEMPT(full) [ 1092.240049][ T5632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1092.240064][ T5632] Call Trace: [ 1092.240072][ T5632] [ 1092.240083][ T5632] dump_stack_lvl+0xe8/0x150 [ 1092.240119][ T5632] should_fail_ex+0x412/0x560 [ 1092.240152][ T5632] _copy_from_user+0x2d/0xb0 [ 1092.240183][ T5632] sk_getsockopt+0x1d4/0x2840 [ 1092.240223][ T5632] ? __pfx_sk_getsockopt+0x10/0x10 [ 1092.240276][ T5632] ? aa_sk_perm+0x6d5/0x900 [ 1092.240330][ T5632] do_sock_getsockopt+0x223/0x3f0 [ 1092.240367][ T5632] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1092.240400][ T5632] ? __fget_files+0x3a0/0x420 [ 1092.240430][ T5632] ? __fget_files+0x2a/0x420 [ 1092.240470][ T5632] __x64_sys_getsockopt+0x1a4/0x240 [ 1092.240512][ T5632] do_syscall_64+0x14d/0xf80 [ 1092.240542][ T5632] ? trace_irq_disable+0x3b/0x150 [ 1092.240572][ T5632] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1092.240595][ T5632] ? clear_bhb_loop+0x40/0x90 [ 1092.240621][ T5632] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1092.240643][ T5632] RIP: 0033:0x7fd27fd9c799 [ 1092.240666][ T5632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1092.240686][ T5632] RSP: 002b:00007fd280cb8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1092.240709][ T5632] RAX: ffffffffffffffda RBX: 00007fd280015fa0 RCX: 00007fd27fd9c799 [ 1092.240723][ T5632] RDX: 000000000000002d RSI: 0000000000000001 RDI: 0000000000000004 [ 1092.240735][ T5632] RBP: 00007fd280cb8090 R08: 00002000000002c0 R09: 0000000000000000 [ 1092.240747][ T5632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1092.240760][ T5632] R13: 00007fd280016038 R14: 00007fd280015fa0 R15: 00007ffe670d1778 [ 1092.240797][ T5632] [ 1092.487547][ T5638] netlink: 'syz.2.7651': attribute type 11 has an invalid length. [ 1092.512820][ T5638] netlink: 'syz.2.7651': attribute type 23 has an invalid length. [ 1092.530046][ T5638] __nla_validate_parse: 11 callbacks suppressed [ 1092.530069][ T5638] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7651'. [ 1093.024609][ T5673] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1093.036773][ T5673] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1093.102114][ T5673] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1093.129372][ T5673] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1093.154209][ T5676] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7661'. [ 1093.163526][ T5676] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7661'. [ 1093.177255][ T5676] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7661'. [ 1093.205744][ T5673] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1093.219516][ T5673] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1093.258484][ T5681] netlink: 48 bytes leftover after parsing attributes in process `syz.0.7663'. [ 1093.297921][ T5673] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1093.310839][ T5673] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1093.336214][ T5684] netlink: 'syz.4.7664': attribute type 11 has an invalid length. [ 1093.344446][ T5684] netlink: 'syz.4.7664': attribute type 23 has an invalid length. [ 1093.352710][ T5684] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7664'. [ 1093.434065][ T49] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.451285][ T49] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1093.478823][ T49] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.487919][ T49] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1093.523249][ T49] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.533235][ T49] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1093.558409][ T49] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.567368][ T49] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1093.820422][ T5704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7671'. [ 1093.847957][ T5709] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7673'. [ 1093.898149][ T5713] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7671'. [ 1093.907436][ T5713] netlink: 348 bytes leftover after parsing attributes in process `syz.1.7671'. [ 1093.938621][ T5709] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1094.065181][ T5721] nbd: couldn't find device at index 0 [ 1094.190349][ T5727] netlink: 'syz.3.7676': attribute type 11 has an invalid length. [ 1094.198229][ T5727] netlink: 'syz.3.7676': attribute type 23 has an invalid length. [ 1094.606138][ T5744] lo speed is unknown, defaulting to 1000 [ 1094.858909][ T5753] FAULT_INJECTION: forcing a failure. [ 1094.858909][ T5753] name failslab, interval 1, probability 0, space 0, times 0 [ 1094.875127][ T5753] CPU: 1 UID: 0 PID: 5753 Comm: syz.2.7686 Not tainted syzkaller #0 PREEMPT(full) [ 1094.875162][ T5753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1094.875177][ T5753] Call Trace: [ 1094.875186][ T5753] [ 1094.875196][ T5753] dump_stack_lvl+0xe8/0x150 [ 1094.875233][ T5753] should_fail_ex+0x412/0x560 [ 1094.875266][ T5753] should_failslab+0xa8/0x100 [ 1094.875293][ T5753] ? skb_clone+0x212/0x3a0 [ 1094.875327][ T5753] kmem_cache_alloc_noprof+0x87/0x650 [ 1094.875374][ T5753] skb_clone+0x212/0x3a0 [ 1094.875412][ T5753] __netlink_deliver_tap+0x404/0x850 [ 1094.875477][ T5753] ? netlink_deliver_tap+0x2e/0x1b0 [ 1094.875507][ T5753] netlink_deliver_tap+0x19c/0x1b0 [ 1094.875536][ T5753] netlink_sendskb+0x68/0x140 [ 1094.875563][ T5753] netlink_unicast+0x3a3/0x9b0 [ 1094.875598][ T5753] ? __pfx_netlink_unicast+0x10/0x10 [ 1094.875635][ T5753] netlink_rcv_skb+0x2b6/0x4b0 [ 1094.875664][ T5753] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1094.875695][ T5753] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1094.875737][ T5753] ? netlink_deliver_tap+0x2e/0x1b0 [ 1094.875775][ T5753] netlink_unicast+0x80f/0x9b0 [ 1094.875810][ T5753] ? __pfx_netlink_unicast+0x10/0x10 [ 1094.875837][ T5753] ? netlink_sendmsg+0x650/0xb40 [ 1094.875870][ T5753] ? skb_put+0x11b/0x210 [ 1094.875905][ T5753] netlink_sendmsg+0x813/0xb40 [ 1094.875944][ T5753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.875976][ T5753] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1094.876006][ T5753] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1094.876032][ T5753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1094.876058][ T5753] ____sys_sendmsg+0xa68/0xad0 [ 1094.876103][ T5753] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1094.876148][ T5753] ? import_iovec+0x73/0xa0 [ 1094.876184][ T5753] ___sys_sendmsg+0x2a5/0x360 [ 1094.876225][ T5753] ? __pfx____sys_sendmsg+0x10/0x10 [ 1094.876303][ T5753] ? __fget_files+0x2a/0x420 [ 1094.876334][ T5753] ? __fget_files+0x3a0/0x420 [ 1094.876380][ T5753] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1094.876417][ T5753] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1094.876463][ T5753] ? __pfx_ksys_write+0x10/0x10 [ 1094.876501][ T5753] do_syscall_64+0x14d/0xf80 [ 1094.876531][ T5753] ? trace_irq_disable+0x3b/0x150 [ 1094.876562][ T5753] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.876585][ T5753] ? clear_bhb_loop+0x40/0x90 [ 1094.876613][ T5753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1094.876637][ T5753] RIP: 0033:0x7f4e08f9c799 [ 1094.876658][ T5753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1094.876677][ T5753] RSP: 002b:00007f4e09d7b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1094.876701][ T5753] RAX: ffffffffffffffda RBX: 00007f4e09215fa0 RCX: 00007f4e08f9c799 [ 1094.876718][ T5753] RDX: 0000000020000110 RSI: 0000200000000180 RDI: 0000000000000003 [ 1094.876733][ T5753] RBP: 00007f4e09d7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1094.876747][ T5753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1094.876760][ T5753] R13: 00007f4e09216038 R14: 00007f4e09215fa0 R15: 00007ffda6d55e28 [ 1094.876798][ T5753] [ 1095.602267][ T5768] lo speed is unknown, defaulting to 1000 [ 1096.109181][ T5800] FAULT_INJECTION: forcing a failure. [ 1096.109181][ T5800] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1096.137409][ T5800] CPU: 0 UID: 0 PID: 5800 Comm: syz.2.7703 Not tainted syzkaller #0 PREEMPT(full) [ 1096.137439][ T5800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1096.137453][ T5800] Call Trace: [ 1096.137462][ T5800] [ 1096.137472][ T5800] dump_stack_lvl+0xe8/0x150 [ 1096.137509][ T5800] should_fail_ex+0x412/0x560 [ 1096.137541][ T5800] _copy_to_user+0x31/0xb0 [ 1096.137576][ T5800] simple_read_from_buffer+0xe1/0x170 [ 1096.137614][ T5800] proc_fail_nth_read+0x1bb/0x230 [ 1096.137657][ T5800] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1096.137691][ T5800] ? rw_verify_area+0x2a6/0x4d0 [ 1096.137713][ T5800] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1096.137744][ T5800] vfs_read+0x20c/0xa70 [ 1096.137762][ T5800] ? get_time_ns+0xfc/0x1f0 [ 1096.137788][ T5800] ? fdget_pos+0x246/0x320 [ 1096.137824][ T5800] ? __pfx___mutex_lock+0x10/0x10 [ 1096.137856][ T5800] ? __pfx_vfs_read+0x10/0x10 [ 1096.137881][ T5800] ? __fget_files+0x2a/0x420 [ 1096.137917][ T5800] ? __fget_files+0x3a0/0x420 [ 1096.137947][ T5800] ? __fget_files+0x2a/0x420 [ 1096.137989][ T5800] ksys_read+0x150/0x270 [ 1096.138014][ T5800] ? __pfx_ksys_read+0x10/0x10 [ 1096.138051][ T5800] do_syscall_64+0x14d/0xf80 [ 1096.138081][ T5800] ? trace_irq_disable+0x3b/0x150 [ 1096.138112][ T5800] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1096.138135][ T5800] ? clear_bhb_loop+0x40/0x90 [ 1096.138163][ T5800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1096.138184][ T5800] RIP: 0033:0x7f4e08f5cfce [ 1096.138205][ T5800] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1096.138224][ T5800] RSP: 002b:00007f4e09d7afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1096.138247][ T5800] RAX: ffffffffffffffda RBX: 00007f4e09d7b6c0 RCX: 00007f4e08f5cfce [ 1096.138267][ T5800] RDX: 000000000000000f RSI: 00007f4e09d7b0a0 RDI: 0000000000000003 [ 1096.138282][ T5800] RBP: 00007f4e09d7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1096.138295][ T5800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1096.138307][ T5800] R13: 00007f4e09216038 R14: 00007f4e09215fa0 R15: 00007ffda6d55e28 [ 1096.138345][ T5800] [ 1096.557133][ T5811] netlink: 'syz.1.7705': attribute type 4 has an invalid length. [ 1097.262607][T16540] lec:lec_start_xmit: lec0:No lecd attached [ 1097.391625][ T5855] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1097.788250][ T5906] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1098.093362][ T5921] sch_tbf: burst 5 is lower than device lo mtu (82) ! [ 1098.156207][ T5926] netlink: 'syz.0.7720': attribute type 4 has an invalid length. [ 1098.166909][ T5926] __nla_validate_parse: 20 callbacks suppressed [ 1098.166930][ T5926] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7720'. [ 1098.216912][ T5928] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1098.239712][ T5928] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1098.329184][ T5939] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7721'. [ 1098.352639][ T5926] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7720'. [ 1098.378139][ T5929] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 1098.416685][ T5928] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1098.475709][ T5928] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1098.570272][ T5944] netlink: 'syz.3.7723': attribute type 11 has an invalid length. [ 1098.578142][ T5944] netlink: 'syz.3.7723': attribute type 23 has an invalid length. [ 1098.587595][ T5944] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7723'. [ 1098.618053][ T5955] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7727'. [ 1098.646402][ T5950] bpq0: entered promiscuous mode [ 1098.674011][ T5928] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1098.712977][ T5928] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1098.734856][ T5953] netlink: 'syz.4.7727': attribute type 1 has an invalid length. [ 1098.743114][ T5953] netlink: 'syz.4.7727': attribute type 2 has an invalid length. [ 1098.758639][ T5958] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7728'. [ 1098.769430][ T5958] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7728'. [ 1098.779076][ T5958] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7728'. [ 1098.811763][ T5928] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1098.834723][ T5928] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 1098.974957][ T1004] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1098.992447][ T1004] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1099.053615][ T49] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1099.080492][ T49] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1099.106221][ T5972] netlink: 'syz.2.7733': attribute type 61 has an invalid length. [ 1099.120819][ T49] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1099.130652][ T49] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1099.139094][ T5972] netlink: 'syz.2.7733': attribute type 62 has an invalid length. [ 1099.164971][ T1004] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1099.174619][ T1004] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1099.235857][ T5977] netlink: 64 bytes leftover after parsing attributes in process `syz.0.7735'. [ 1099.291030][ T5977] bpq0: left promiscuous mode [ 1099.300856][ T5977] netlink: 'syz.0.7735': attribute type 11 has an invalid length. [ 1099.319667][ T5977] netlink: 'syz.0.7735': attribute type 23 has an invalid length. [ 1099.359484][ T5977] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7735'. [ 1099.438270][ T5983] netlink: 'syz.2.7737': attribute type 49 has an invalid length. [ 1099.462605][ T5983] netlink: 'syz.2.7737': attribute type 49 has an invalid length. [ 1099.480685][ T5983] RDS: rds_bind could not find a transport for ::ffff:172.20.20.50, load rds_tcp or rds_rdma? [ 1099.914908][ T6003] 8021q: adding VLAN 0 to HW filter on device bond17 [ 1100.045222][ T6005] ipvlan0: entered promiscuous mode [ 1100.051805][ T6005] ipvlan0: entered allmulticast mode [ 1100.057597][ T6005] hsr0: entered allmulticast mode [ 1100.070818][ T6005] hsr_slave_0: entered allmulticast mode [ 1100.097022][ T6005] hsr_slave_1: entered allmulticast mode [ 1100.117870][ T6005] team0: Device ipvlan0 failed to register rx_handler [ 1100.412694][ T6031] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1100.570917][ C1] ================================================================== [ 1100.579069][ C1] BUG: KASAN: slab-use-after-free in timer_is_static_object+0x35/0x80 [ 1100.587364][ C1] Read of size 8 at addr ffff888038685c98 by task syz.3.7750/6020 [ 1100.595218][ C1] [ 1100.597599][ C1] CPU: 1 UID: 0 PID: 6020 Comm: syz.3.7750 Not tainted syzkaller #0 PREEMPT(full) [ 1100.597627][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1100.597642][ C1] Call Trace: [ 1100.597652][ C1] [ 1100.597662][ C1] dump_stack_lvl+0xe8/0x150 [ 1100.597699][ C1] print_report+0xba/0x230 [ 1100.597726][ C1] ? timer_is_static_object+0x35/0x80 [ 1100.597754][ C1] kasan_report+0x117/0x150 [ 1100.597782][ C1] ? timer_is_static_object+0x35/0x80 [ 1100.597816][ C1] timer_is_static_object+0x35/0x80 [ 1100.597844][ C1] debug_object_activate+0x141/0x580 [ 1100.597876][ C1] __mod_timer+0xa4f/0xf30 [ 1100.597900][ C1] ? __msecs_to_jiffies+0x1e/0x50 [ 1100.597927][ C1] ? rose_t0timer_expiry+0x3ba/0x560 [ 1100.597959][ C1] call_timer_fn+0x192/0x640 [ 1100.597987][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1100.598013][ C1] ? call_timer_fn+0xd4/0x640 [ 1100.598039][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1100.598074][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1100.598103][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1100.598131][ C1] __run_timer_base+0x652/0x8b0 [ 1100.598156][ C1] ? ktime_get+0x45/0x200 [ 1100.598186][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 1100.598217][ C1] ? sched_clock_cpu+0x74/0x440 [ 1100.598250][ C1] run_timer_softirq+0xb7/0x170 [ 1100.598276][ C1] handle_softirqs+0x22a/0x870 [ 1100.598306][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 1100.598341][ C1] __irq_exit_rcu+0x5f/0x150 [ 1100.598368][ C1] irq_exit_rcu+0x9/0x30 [ 1100.598406][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1100.598437][ C1] [ 1100.598445][ C1] [ 1100.598454][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1100.598479][ C1] RIP: 0010:0xffffffffa0003774 [ 1100.598501][ C1] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc <41> ff e3 cc 41 ff e3 cc 41 ff e3 cc cc cc cc cc cc cc cc cc cc cc [ 1100.598522][ C1] RSP: 0018:ffffc9000ff1e640 EFLAGS: 00000286 [ 1100.598543][ C1] RAX: ffffffff898f81d8 RBX: ffffc9000ff1e700 RCX: 0000000000000000 [ 1100.598560][ C1] RDX: 0000000000000001 RSI: ffffffff898f81d8 RDI: ffffc9000ff1e700 [ 1100.598576][ C1] RBP: ffffc9000ff1e6d0 R08: ffffc9000ff1ebd8 R09: 0000000000000000 [ 1100.598592][ C1] R10: ffffc9000ff1e698 R11: ffffffff81b0b100 R12: ffff888035d2bc80 [ 1100.598609][ C1] R13: 00000000ffffffff R14: ffffffff81b0b100 R15: ffffc9000ff1e648 [ 1100.598627][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1100.598654][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1100.598678][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1100.598712][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1100.598749][ C1] ? arch_stack_walk+0x10f/0x150 [ 1100.598785][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1100.598822][ C1] ? stack_trace_save+0xa9/0x100 [ 1100.598844][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1100.598868][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 1100.598899][ C1] ? kasan_save_track+0x3e/0x80 [ 1100.598919][ C1] ? kasan_save_track+0x3e/0x80 [ 1100.598939][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 1100.598960][ C1] ? __kmalloc_node_track_caller_noprof+0x4db/0x7b0 [ 1100.598983][ C1] ? __alloc_skb+0x2c1/0x7d0 [ 1100.599018][ C1] ? netdev_genl_dev_notify+0x1d6/0x450 [ 1100.599085][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 1100.599110][ C1] ? __kmalloc_node_track_caller_noprof+0x4db/0x7b0 [ 1100.599134][ C1] ? netdev_genl_dev_notify+0x1d6/0x450 [ 1100.599165][ C1] ? __kmalloc_node_track_caller_noprof+0x34a/0x7b0 [ 1100.599193][ C1] ? __alloc_skb+0x2c1/0x7d0 [ 1100.599224][ C1] ? netdev_genl_dev_notify+0x1d6/0x450 [ 1100.599256][ C1] ? trace_contention_end+0x3d/0x150 [ 1100.599290][ C1] ? __pfx_netdev_genl_dev_notify+0x10/0x10 [ 1100.599321][ C1] ? __mutex_lock+0x319/0x1300 [ 1100.599368][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1100.599411][ C1] ? notifier_call_chain+0x1be/0x400 [ 1100.599452][ C1] ? register_netdevice+0x173a/0x1cf0 [ 1100.599483][ C1] ? dput+0x37/0x1a0 [ 1100.599522][ C1] ? __pfx_register_netdevice+0x10/0x10 [ 1100.599555][ C1] ? __debugfs_create_file+0x34f/0x400 [ 1100.599587][ C1] ? debugfs_create_file_full+0x3f/0x60 [ 1100.599620][ C1] ? nsim_create+0xb92/0x1100 [ 1100.599654][ C1] ? __nsim_dev_port_add+0x72a/0xb50 [ 1100.599692][ C1] ? __pfx___nsim_dev_port_add+0x10/0x10 [ 1100.599737][ C1] ? queue_delayed_work_on+0x171/0x1e0 [ 1100.599776][ C1] ? nsim_dev_port_add_all+0x37/0xf0 [ 1100.599811][ C1] ? nsim_dev_reload_up+0x45f/0x7c0 [ 1100.599836][ C1] ? __pfx_nsim_dev_reload_up+0x10/0x10 [ 1100.599868][ C1] ? devlink_reload+0x505/0x8d0 [ 1100.599905][ C1] ? __pfx_devlink_reload+0x10/0x10 [ 1100.599936][ C1] ? devlink_resources_validate+0xa7/0xd0 [ 1100.599970][ C1] ? devlink_resources_validate+0xa7/0xd0 [ 1100.600001][ C1] ? devlink_nl_reload_doit+0xaaa/0xc80 [ 1100.600038][ C1] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 1100.600072][ C1] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 1100.600112][ C1] ? genl_family_rcv_msg_doit+0x22a/0x330 [ 1100.600145][ C1] ? __asan_memcpy+0x40/0x70 [ 1100.600179][ C1] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1100.600221][ C1] ? bpf_lsm_capable+0x9/0x20 [ 1100.600250][ C1] ? security_capable+0x7e/0x2c0 [ 1100.600279][ C1] ? genl_rcv_msg+0x61c/0x7a0 [ 1100.600316][ C1] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1100.600346][ C1] ? __pfx_devlink_nl_pre_doit_dev_lock+0x10/0x10 [ 1100.600375][ C1] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 1100.600417][ C1] ? __pfx_devlink_nl_post_doit_dev_lock+0x10/0x10 [ 1100.600446][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 1100.600482][ C1] ? netlink_rcv_skb+0x232/0x4b0 [ 1100.600508][ C1] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1100.600540][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1100.600579][ C1] ? down_read+0x272/0x2e0 [ 1100.600609][ C1] ? genl_rcv+0xd/0x40 [ 1100.600641][ C1] ? genl_rcv+0x28/0x40 [ 1100.600669][ C1] ? netlink_unicast+0x80f/0x9b0 [ 1100.600698][ C1] ? __pfx_netlink_unicast+0x10/0x10 [ 1100.600723][ C1] ? netlink_sendmsg+0x650/0xb40 [ 1100.600748][ C1] ? skb_put+0x11b/0x210 [ 1100.600779][ C1] ? netlink_sendmsg+0x813/0xb40 [ 1100.600812][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1100.600842][ C1] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1100.600869][ C1] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1100.600894][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1100.600921][ C1] ? ____sys_sendmsg+0xa68/0xad0 [ 1100.600951][ C1] ? futex_unqueue+0x211/0x240 [ 1100.600983][ C1] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1100.601021][ C1] ? import_iovec+0x73/0xa0 [ 1100.601054][ C1] ? ___sys_sendmsg+0x2a5/0x360 [ 1100.601090][ C1] ? __pfx____sys_sendmsg+0x10/0x10 [ 1100.601127][ C1] ? futex_wait+0x29a/0x380 [ 1100.601177][ C1] ? __fget_files+0x2a/0x420 [ 1100.601215][ C1] ? __fget_files+0x3a0/0x420 [ 1100.601252][ C1] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 1100.601286][ C1] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1100.601324][ C1] ? rcu_is_watching+0x15/0xb0 [ 1100.601361][ C1] ? do_syscall_64+0x14d/0xf80 [ 1100.601388][ C1] ? trace_irq_disable+0x3b/0x150 [ 1100.601424][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1100.601445][ C1] ? clear_bhb_loop+0x40/0x90 [ 1100.601470][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1100.601503][ C1] [ 1100.601512][ C1] [ 1101.306610][ C1] Allocated by task 31185: [ 1101.311044][ C1] kasan_save_track+0x3e/0x80 [ 1101.315746][ C1] __kasan_kmalloc+0x93/0xb0 [ 1101.320353][ C1] __kmalloc_cache_noprof+0x31c/0x660 [ 1101.325833][ C1] rose_add_node+0x23c/0xf00 [ 1101.330461][ C1] rose_rt_ioctl+0xd35/0x12a0 [ 1101.335162][ C1] rose_ioctl+0x3fb/0x8f0 [ 1101.339506][ C1] sock_do_ioctl+0x101/0x320 [ 1101.344111][ C1] sock_ioctl+0x5c6/0x7f0 [ 1101.348487][ C1] __se_sys_ioctl+0xfc/0x170 [ 1101.353118][ C1] do_syscall_64+0x14d/0xf80 [ 1101.357780][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1101.363716][ C1] [ 1101.366053][ C1] Freed by task 6037: [ 1101.370050][ C1] kasan_save_track+0x3e/0x80 [ 1101.374753][ C1] kasan_save_free_info+0x46/0x50 [ 1101.379805][ C1] __kasan_slab_free+0x5c/0x80 [ 1101.384590][ C1] kfree+0x1c1/0x630 [ 1101.388509][ C1] rose_timer_expiry+0x4cb/0x600 [ 1101.393472][ C1] call_timer_fn+0x192/0x640 [ 1101.398086][ C1] __run_timer_base+0x652/0x8b0 [ 1101.402983][ C1] run_timer_softirq+0xb7/0x170 [ 1101.407859][ C1] handle_softirqs+0x22a/0x870 [ 1101.412642][ C1] __irq_exit_rcu+0x5f/0x150 [ 1101.417273][ C1] irq_exit_rcu+0x9/0x30 [ 1101.421541][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1101.427200][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1101.433198][ C1] [ 1101.435540][ C1] The buggy address belongs to the object at ffff888038685c00 [ 1101.435540][ C1] which belongs to the cache kmalloc-512 of size 512 [ 1101.449618][ C1] The buggy address is located 152 bytes inside of [ 1101.449618][ C1] freed 512-byte region [ffff888038685c00, ffff888038685e00) [ 1101.463448][ C1] [ 1101.465792][ C1] The buggy address belongs to the physical page: [ 1101.472232][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x38684 [ 1101.481032][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1101.489546][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1101.497114][ C1] page_type: f5(slab) [ 1101.501110][ C1] raw: 00fff00000000040 ffff88813fea8c80 dead000000000100 dead000000000122 [ 1101.509714][ C1] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1101.518318][ C1] head: 00fff00000000040 ffff88813fea8c80 dead000000000100 dead000000000122 [ 1101.527006][ C1] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 1101.535706][ C1] head: 00fff00000000002 ffffea0000e1a101 00000000ffffffff 00000000ffffffff [ 1101.544390][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 1101.553076][ C1] page dumped because: kasan: bad access detected [ 1101.559508][ C1] page_owner tracks the page as allocated [ 1101.565235][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 21000, tgid 21000 (dhcpcd-run-hook), ts 569594242051, free_ts 569529973791 [ 1101.587224][ C1] post_alloc_hook+0x231/0x280 [ 1101.592010][ C1] get_page_from_freelist+0x24dc/0x2580 [ 1101.597574][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1101.603403][ C1] allocate_slab+0x77/0x660 [ 1101.607931][ C1] refill_objects+0x331/0x3c0 [ 1101.612623][ C1] __pcs_replace_empty_main+0x2b9/0x620 [ 1101.618194][ C1] __kmalloc_cache_noprof+0x392/0x660 [ 1101.623586][ C1] alloc_bprm+0x7d/0x5c0 [ 1101.627843][ C1] do_execveat_common+0x175/0x690 [ 1101.632881][ C1] __x64_sys_execve+0x97/0xc0 [ 1101.637575][ C1] do_syscall_64+0x14d/0xf80 [ 1101.642193][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1101.648098][ C1] page last free pid 6962 tgid 6962 stack trace: [ 1101.654442][ C1] __free_frozen_pages+0xc2b/0xdb0 [ 1101.659595][ C1] build_detached_freelist+0x1cb/0x1f0 [ 1101.665089][ C1] kmem_cache_free_bulk+0xf9/0x1170 [ 1101.670336][ C1] kvfree_rcu_bulk+0xe5/0x1b0 [ 1101.675026][ C1] kfree_rcu_monitor+0x211/0x2a0 [ 1101.679972][ C1] process_scheduled_works+0xb02/0x1830 [ 1101.685538][ C1] worker_thread+0xa50/0xfc0 [ 1101.690150][ C1] kthread+0x388/0x470 [ 1101.694229][ C1] ret_from_fork+0x51e/0xb90 [ 1101.698838][ C1] ret_from_fork_asm+0x1a/0x30 [ 1101.703625][ C1] [ 1101.705957][ C1] Memory state around the buggy address: [ 1101.711601][ C1] ffff888038685b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1101.719683][ C1] ffff888038685c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1101.727757][ C1] >ffff888038685c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1101.735836][ C1] ^ [ 1101.740699][ C1] ffff888038685d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1101.748831][ C1] ffff888038685d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1101.756904][ C1] ================================================================== [ 1101.764985][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1101.772198][ C1] CPU: 1 UID: 0 PID: 6020 Comm: syz.3.7750 Not tainted syzkaller #0 PREEMPT(full) [ 1101.781495][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1101.791568][ C1] Call Trace: [ 1101.794873][ C1] [ 1101.797736][ C1] vpanic+0x56c/0xa60 [ 1101.801749][ C1] ? __pfx_vpanic+0x10/0x10 [ 1101.806288][ C1] panic+0xc5/0xd0 [ 1101.810032][ C1] ? __pfx_panic+0x10/0x10 [ 1101.814475][ C1] ? timer_is_static_object+0x35/0x80 [ 1101.819876][ C1] ? timer_is_static_object+0x35/0x80 [ 1101.825398][ C1] ? timer_is_static_object+0x35/0x80 [ 1101.830817][ C1] check_panic_on_warn+0x89/0xb0 [ 1101.835799][ C1] ? timer_is_static_object+0x35/0x80 [ 1101.841208][ C1] end_report+0x73/0x180 [ 1101.845493][ C1] ? timer_is_static_object+0x35/0x80 [ 1101.850909][ C1] kasan_report+0x128/0x150 [ 1101.855446][ C1] ? timer_is_static_object+0x35/0x80 [ 1101.860876][ C1] timer_is_static_object+0x35/0x80 [ 1101.866110][ C1] debug_object_activate+0x141/0x580 [ 1101.871434][ C1] __mod_timer+0xa4f/0xf30 [ 1101.875967][ C1] ? __msecs_to_jiffies+0x1e/0x50 [ 1101.881016][ C1] ? rose_t0timer_expiry+0x3ba/0x560 [ 1101.886330][ C1] call_timer_fn+0x192/0x640 [ 1101.890942][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1101.896599][ C1] ? call_timer_fn+0xd4/0x640 [ 1101.901335][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1101.906475][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1101.911693][ C1] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 1101.917436][ C1] __run_timer_base+0x652/0x8b0 [ 1101.922303][ C1] ? ktime_get+0x45/0x200 [ 1101.926682][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 1101.932079][ C1] ? sched_clock_cpu+0x74/0x440 [ 1101.936979][ C1] run_timer_softirq+0xb7/0x170 [ 1101.941855][ C1] handle_softirqs+0x22a/0x870 [ 1101.946645][ C1] ? __irq_exit_rcu+0x5f/0x150 [ 1101.951434][ C1] __irq_exit_rcu+0x5f/0x150 [ 1101.956055][ C1] irq_exit_rcu+0x9/0x30 [ 1101.960326][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1101.965985][ C1] [ 1101.968931][ C1] [ 1101.971881][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1101.977964][ C1] RIP: 0010:0xffffffffa0003774 [ 1101.982830][ C1] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc 41 ff e3 cc <41> ff e3 cc 41 ff e3 cc 41 ff e3 cc cc cc cc cc cc cc cc cc cc cc [ 1102.002454][ C1] RSP: 0018:ffffc9000ff1e640 EFLAGS: 00000286 [ 1102.008713][ C1] RAX: ffffffff898f81d8 RBX: ffffc9000ff1e700 RCX: 0000000000000000 [ 1102.016697][ C1] RDX: 0000000000000001 RSI: ffffffff898f81d8 RDI: ffffc9000ff1e700 [ 1102.024774][ C1] RBP: ffffc9000ff1e6d0 R08: ffffc9000ff1ebd8 R09: 0000000000000000 [ 1102.032761][ C1] R10: ffffc9000ff1e698 R11: ffffffff81b0b100 R12: ffff888035d2bc80 [ 1102.040748][ C1] R13: 00000000ffffffff R14: ffffffff81b0b100 R15: ffffc9000ff1e648 [ 1102.048831][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1102.055031][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1102.061209][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1102.067212][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1102.073223][ C1] ? arch_stack_walk+0x10f/0x150 [ 1102.078193][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1102.084221][ C1] ? stack_trace_save+0xa9/0x100 [ 1102.089177][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1102.094587][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 1102.099560][ C1] ? kasan_save_track+0x3e/0x80 [ 1102.104444][ C1] ? kasan_save_track+0x3e/0x80 [ 1102.109307][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 1102.114084][ C1] ? __kmalloc_node_track_caller_noprof+0x4db/0x7b0 [ 1102.120693][ C1] ? __alloc_skb+0x2c1/0x7d0 [ 1102.125306][ C1] ? netdev_genl_dev_notify+0x1d6/0x450 [ 1102.130908][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 1102.135700][ C1] ? __kmalloc_node_track_caller_noprof+0x4db/0x7b0 [ 1102.142348][ C1] ? netdev_genl_dev_notify+0x1d6/0x450 [ 1102.147926][ C1] ? __kmalloc_node_track_caller_noprof+0x34a/0x7b0 [ 1102.154536][ C1] ? __alloc_skb+0x2c1/0x7d0 [ 1102.159150][ C1] ? netdev_genl_dev_notify+0x1d6/0x450 [ 1102.164719][ C1] ? trace_contention_end+0x3d/0x150 [ 1102.170034][ C1] ? __pfx_netdev_genl_dev_notify+0x10/0x10 [ 1102.176041][ C1] ? __mutex_lock+0x319/0x1300 [ 1102.180847][ C1] ? netdev_genl_netdevice_event+0x218/0x3e0 [ 1102.186853][ C1] ? notifier_call_chain+0x1be/0x400 [ 1102.192173][ C1] ? register_netdevice+0x173a/0x1cf0 [ 1102.197576][ C1] ? dput+0x37/0x1a0 [ 1102.201513][ C1] ? __pfx_register_netdevice+0x10/0x10 [ 1102.207083][ C1] ? __debugfs_create_file+0x34f/0x400 [ 1102.212568][ C1] ? debugfs_create_file_full+0x3f/0x60 [ 1102.218145][ C1] ? nsim_create+0xb92/0x1100 [ 1102.222937][ C1] ? __nsim_dev_port_add+0x72a/0xb50 [ 1102.228364][ C1] ? __pfx___nsim_dev_port_add+0x10/0x10 [ 1102.234048][ C1] ? queue_delayed_work_on+0x171/0x1e0 [ 1102.239544][ C1] ? nsim_dev_port_add_all+0x37/0xf0 [ 1102.244894][ C1] ? nsim_dev_reload_up+0x45f/0x7c0 [ 1102.250118][ C1] ? __pfx_nsim_dev_reload_up+0x10/0x10 [ 1102.255691][ C1] ? devlink_reload+0x505/0x8d0 [ 1102.260579][ C1] ? __pfx_devlink_reload+0x10/0x10 [ 1102.265822][ C1] ? devlink_resources_validate+0xa7/0xd0 [ 1102.271590][ C1] ? devlink_resources_validate+0xa7/0xd0 [ 1102.277348][ C1] ? devlink_nl_reload_doit+0xaaa/0xc80 [ 1102.283027][ C1] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 1102.288966][ C1] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 1102.295331][ C1] ? genl_family_rcv_msg_doit+0x22a/0x330 [ 1102.301101][ C1] ? __asan_memcpy+0x40/0x70 [ 1102.305730][ C1] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1102.311922][ C1] ? bpf_lsm_capable+0x9/0x20 [ 1102.316639][ C1] ? security_capable+0x7e/0x2c0 [ 1102.321599][ C1] ? genl_rcv_msg+0x61c/0x7a0 [ 1102.326392][ C1] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1102.331618][ C1] ? __pfx_devlink_nl_pre_doit_dev_lock+0x10/0x10 [ 1102.338067][ C1] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 1102.343990][ C1] ? __pfx_devlink_nl_post_doit_dev_lock+0x10/0x10 [ 1102.350516][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 1102.355572][ C1] ? netlink_rcv_skb+0x232/0x4b0 [ 1102.360537][ C1] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1102.365590][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1102.370909][ C1] ? down_read+0x272/0x2e0 [ 1102.375414][ C1] ? genl_rcv+0xd/0x40 [ 1102.379510][ C1] ? genl_rcv+0x28/0x40 [ 1102.383691][ C1] ? netlink_unicast+0x80f/0x9b0 [ 1102.388747][ C1] ? __pfx_netlink_unicast+0x10/0x10 [ 1102.394144][ C1] ? netlink_sendmsg+0x650/0xb40 [ 1102.399103][ C1] ? skb_put+0x11b/0x210 [ 1102.403375][ C1] ? netlink_sendmsg+0x813/0xb40 [ 1102.408343][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1102.413664][ C1] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1102.418620][ C1] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1102.423927][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1102.429229][ C1] ? ____sys_sendmsg+0xa68/0xad0 [ 1102.434208][ C1] ? futex_unqueue+0x211/0x240 [ 1102.438999][ C1] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1102.444325][ C1] ? import_iovec+0x73/0xa0 [ 1102.448856][ C1] ? ___sys_sendmsg+0x2a5/0x360 [ 1102.453741][ C1] ? __pfx____sys_sendmsg+0x10/0x10 [ 1102.458979][ C1] ? futex_wait+0x29a/0x380 [ 1102.463527][ C1] ? __fget_files+0x2a/0x420 [ 1102.468142][ C1] ? __fget_files+0x3a0/0x420 [ 1102.472845][ C1] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 1102.477983][ C1] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1102.483479][ C1] ? rcu_is_watching+0x15/0xb0 [ 1102.488274][ C1] ? do_syscall_64+0x14d/0xf80 [ 1102.493088][ C1] ? trace_irq_disable+0x3b/0x150 [ 1102.498171][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.504271][ C1] ? clear_bhb_loop+0x40/0x90 [ 1102.509051][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1102.515286][ C1] [ 1102.518930][ C1] Kernel Offset: disabled [ 1102.523299][ C1] Rebooting in 86400 seconds..