last executing test programs: 1m19.013309641s ago: executing program 0 (id=1466): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000680)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x74, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x60, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x58}, @TIPC_NLA_NET_NODEID={0xc}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc27e}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1ff}]}]}, 0x74}}, 0x4004840) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x4}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x9}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x94}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@ipv6_getanyicast={0x14, 0x3e, 0x200, 0x70bd2a, 0x25dfdbfb, {}, ["", "", ""]}, 0x14}}, 0x444) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x14, 0x3, "840000000000110002000f116b61979e"}, @NFTA_MATCH_NAME={0x9, 0x1, 'l2tp\x00'}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r3, &(0x7f000000a1c0)=[{{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f000000b580)=""/4110, 0x100e}, {&(0x7f0000000900)=""/85, 0x55}, {&(0x7f00000006c0)=""/23, 0x17}, {&(0x7f0000000b40)=""/206, 0xce}, {&(0x7f0000003640)=""/224, 0xe0}], 0x5}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x9}], 0x3, 0x2202, 0x0) r4 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000000)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) sendmsg$netlink(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1800000042008991"], 0x18}], 0x1}, 0x2000080) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001c00)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000440)="9eb1d91a92dc7c8fff658bb539e2ffb332c9d223a7dfe52c1f51218206f5abfd2a", 0x21}], 0x2}, 0x20008b88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b1a, &(0x7f0000000000)={'wlan1\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x40, 0x0) write$tun(r9, &(0x7f0000000500)={@val={0x0, 0x19}, @void, @llc={@llc={0x80, 0x1, "7f0d", "25a38e70d0368156737bd5db88fc374a6d62f0e6380452d392006fc717c6433321f07b2d26db2f828aba802cbb77a78ef1b8a64d60aac87cd93ee5b05160c6798fcf433bd27b15b53619b610ce74784e209ad475d1875c4423f95755295f5df0099263e3ae58ef0ccad747f1b1058e285f4c7a2cd150ca023a5750a7a5642069e65337f9b359ad2ca4452675967d45f0fd60b505"}}}, 0x9c) sendmsg$unix(r7, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="14"], 0x18}, 0xc800) setsockopt$sock_int(r8, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r8, &(0x7f0000002d40)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x2, 0x0) sendto(r7, 0x0, 0x0, 0x20000044, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c000b"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 1m18.146052988s ago: executing program 3 (id=1471): ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000280)={0x0, @hci={0x1f, 0x3, 0x4}, @hci={0x1f, 0x4, 0x3}, @can, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0xa, 0x5}) r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f40108807000008048000980280000f8060001000a00000014000200fe8000000000000000000000000000aa05000300030000001c000080060001000200000908000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a034e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d4000980"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="58000000021400022bbd7000fddbdf25050054000000000005005400010000000900020073797a3100004c291074f41275960000000008004400", @ANYRES32, @ANYBLOB="0900020073797a300000000008004400", @ANYRES32, @ANYBLOB], 0x58}}, 0x4044091) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000140)=ANY=[], 0x0, 0x2, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r3, 0x215eb000) socket(0x40000000015, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) 1m18.023358711s ago: executing program 0 (id=1473): sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)=ANY=[@ANYBLOB="78000000070a010200000000000000000a0000060900010073797a31000000005800048054000180090001006d6574610000000044000280080001400000000c080003400000000008000140000000010800014000000009080001400000000b0800014000000015080001400000001508000240000080"], 0x78}, 0x1, 0x0, 0x0, 0x48055}, 0x1000c080) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000002311e90c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000e50003000000000085100000fcffffff250000001000000006000000faffffff95"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) 1m17.729712812s ago: executing program 4 (id=1475): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0xd4, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x98, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x58, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}, @CTA_EXPECT_NAT={0x28, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x1c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x20c3, &(0x7f0000003700)={0x77359400}) 1m17.587034734s ago: executing program 0 (id=1476): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="0600cd006800"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1m17.487544322s ago: executing program 4 (id=1477): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001540)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="42000e0080000000ffffffffffffffffffffffff080211000000000200000003000000000200010003010606020100050304ab0725030099012a01073c0400810a03000045000f00013fb0ce3eb7dcbbc42513bc9511df75646f725dded3afe0879f9b48b16cc5e489db1d95029fd6d8a410ae0a5339400000000000000024ba8946b2e6e0eff6967b000000080026006c09000008000c006400000008000d"], 0xc0}}, 0x0) 1m17.328475881s ago: executing program 0 (id=1478): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0904000000000000f3770200000048000480300001800e000100696d6d6564696174650000001c000280100002800c00028008000180fffffffb0800014000000000140001800d00010073796e70726f7879000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x9c}, 0x1, 0x0, 0x0, 0x11000000}, 0x0) 1m16.942667003s ago: executing program 3 (id=1481): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="840000001300200029bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="04400000402000001400030076657468305f766c616e0000000000001400030067656e6576653100000000000000000008002e000300000008001300", @ANYRES32=0x0, @ANYBLOB="0a000200aaaaaaaaaaaa00000800230000f8ffff05082700c800000005e573018000007dd13bdec02f0216f831004700fc00000008002800ae2f000028fd7d652deda6e223b17d7b5a684f4064b884226807835633e175c32004000000ef70cc7e89c2c9d964fa7125d0298ea209879d5d99bc22685b488017c8a73a212417996996dd43965e5285eb7a8afa243618eca10d298ba36e06ffdb2e4aabf825e4"], 0x84}, 0x1, 0x0, 0x0, 0x24040081}, 0x40880) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES64=0x0, @ANYRESHEX=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000d40)={{r1}, &(0x7f0000000cc0), &(0x7f0000000d00)='%pS \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000080)=0x0, &(0x7f0000000280)=0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x3, 0x10, &(0x7f0000000080)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x2f08, 0x8, 0x8, &(0x7f00000006c0)="0000000000000005", &(0x7f0000000700)=""/8, 0x447, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x50) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r10) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r7, @ANYRES16=r11, @ANYRESOCT=r1, @ANYRES32=r9], 0x1c}, 0x1, 0x0, 0x0, 0xc054}, 0x1f40) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a010800000000000000000100fffc0900010073797a30000000002c000000030a0101000000000000000001000000090003612be7185a026313b580892283dd5c377816db377200000900010073797a300000000040000000060a010400000000000000000100000018000480140001800e000100696d6d65646900030900010073797a3000000000140000001100"/180], 0xb4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendto$packet(r5, &(0x7f00000001c0)="056cb9000000000000000015880000000000", 0x12, 0x0, &(0x7f0000000140)={0x11, 0x86dd, r6}, 0x14) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r12, 0x10f, 0x87, &(0x7f0000000340)={0x42, 0x2}, 0x10) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) accept4$inet6(r13, 0x0, 0x0, 0x800) ioctl$AUTOFS_IOC_ASKUMOUNT(r13, 0x80049370, &(0x7f0000000180)) 1m8.949191727s ago: executing program 4 (id=1484): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="02180000100000000000000000000000030006000000000002000004000000000000000000000000080012000000000000000000000000003000000000000000000000000000000002000001000000000000000000000000fc020000000000000000000000000000030005000000000002"], 0x80}, 0x1, 0x0, 0x300000000000000}, 0x0) 1m7.715897269s ago: executing program 0 (id=1486): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a8, r1, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x6, 0x26}}}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x5}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x78, 0x3, 0x0, 0x1, [{0x74, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0x70, 0x1, "3e9a0492894b4f14f1f5542abf006ec1a2b80f0ce29c5afd892513732d652289b7d54a6d9bbf5048029421afd6930206e216f78be8af38ff78909b7544f1e037343472c88ea50d24427a62c1c3a61880388c36d531209457f10e13a9d9e4f21c4799fdfada5106516a5518d8"}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x84, 0x3, 0x0, 0x1, [{0x74, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0x6f, 0x1, "bae928f85c33e5b34841274b451ca66aa26c6731d0d1043b88b28507de9584197664291587001f6df1bc130e97f06d358ec63c7d370c30a8e8d1ac0b440395412490ff39571759b51edfef1c2dd7547256b5c5ed4823cb61932391fddd37416d25185e864fe9cbbefd2032"}}, {0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x2}}]}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x7c, 0x3, 0x0, 0x1, [{0x70, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x69, 0x2, "c1beb2c223cb59e57e3c6eadcdb6bd04fef6868f0162c6c0366ce21193604c5d143c3b4f4bfea25c3fc025a987f3bea2c16b516174332ec43a0bfbf1ce71c25ae4fded8f04d1581499ca8f6dbcc601b966a28897dccf582f1c92a3361d8355174d1704de17"}}, {0x8, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x4}}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x40000}, 0x800) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x7, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000000010000000000000000007110b500000000009500000000000000a282cb8ecd0d254d03d44df656abed5011c51ed827438a464f0b0000ea8d4765d847ed7b45e44c2cf1d547595d12d986d5ad7f6f3399a109b3b8e3b287f14844d9231b179588f77bff8932de820630bb62e5f3d2293b3c1745ff4ef48ca55b608a4b303a0ea7e467acf15d3aa394b4d0a007ad46963de72c59651f5e4a34b44f95c9beacd193eac4640ecff86c3267b405d516b4293d20df01c27d9c081a8f04b101e57029ded08052df2ad551884d14b15a99cce8e2fa81f83a"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) 1m7.70760933s ago: executing program 4 (id=1487): r0 = socket$netlink(0x10, 0x3, 0x8) socket$netlink(0x10, 0x3, 0x10) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) sendmmsg(r1, &(0x7f0000003580)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)="db", 0x1}], 0x1, &(0x7f0000000a00)=ANY=[], 0x1348}}, {{0x0, 0x0, &(0x7f00000020c0)=[{&(0x7f0000001f40)='\n', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000002980)=[{&(0x7f00000028c0)='J', 0x1}], 0x1}}], 0x3, 0x4000000) shutdown(r1, 0x1) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r0) sendmsg$nl_generic(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20004840}, 0x20028840) 1m7.253419792s ago: executing program 2 (id=1489): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="97eb01001800000000000000500000005000000002000000090000000000000e03000000010000000a0000000000000203000000000000000500000d0000fa8c99dc00000100000000000000000000000000000000000000090000"], 0x0, 0x6a, 0x0, 0x0, 0x7fffffff}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 1m7.15582185s ago: executing program 3 (id=1490): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r1 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x40000000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4000001) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000b00)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=@newtfilter={0x3c, 0x2c, 0x52f, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {}, {0x8, 0xe}}, [@filter_kind_options=@f_bpf={{0x8}, {0x10, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2004c8d0}, 0x14) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a6c000000060a0b040000000000000000020000004000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c08000340000000150900010073797a30000000000900020073797a320000000014000000110001"], 0x94}, 0x1, 0x0, 0x0, 0x40801}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000f00)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0200", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x15, 0xd}}}}}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB], 0x128}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x8000) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000040140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) 1m6.996676669s ago: executing program 0 (id=1491): ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000280)={0x0, @hci={0x1f, 0x3, 0x4}, @hci={0x1f, 0x4, 0x3}, @can, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0xa, 0x5}) r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f40108807000008048000980280000f8060001000a00000014000200fe8000000000000000000000000000aa05000300030000001c000080060001000200000908000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a034e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d4000980"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="58000000021400022bbd7000fddbdf25050054000000000005005400010000000900020073797a3100004c291074f41275960000000008004400", @ANYRES32, @ANYBLOB="0900020073797a300000000008004400", @ANYRES32, @ANYBLOB], 0x58}}, 0x4044091) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000140)=ANY=[], 0x0, 0x2, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r3, 0x215eb000) socket(0x40000000015, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) 1m6.837812792s ago: executing program 4 (id=1493): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000009c0), r2) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000a00)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r2, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x1c, r3, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000180)=0x6, 0x4) (async) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb010018000000005f5c93288c077755a4de02f48aa5628c0000003000000030000000020000eaff0000000100000408200000000000000000b44a23e38f2a6a2d00000000000004000000000000"], 0x0, 0x4a}, 0x20) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, r6, 0x0, 0x1}, 0x50) (async) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x9c, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4041}, 0x0) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x52}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit={0x95, 0x0, 0x1008}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0xa0, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0xa0}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_OKEY={0x8, 0x18, 0x28e}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x48}}, 0x0) 1m6.406271473s ago: executing program 3 (id=1494): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x44, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="0000080001050600030080"], 0x22e) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000004a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_DELSET={0x2c, 0xb, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x40091}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="4800000010000d0428bd70f2fbdbff2500008000499b22cd0e3caf79296b84e48f51f9f675d9cbf22fe0cb88fd3636ad2b131473a9d44e828a76542752b8176cfad763d73bc4ed2928e24f29872cb62cb2c5c698e07534201f8027034aea41bf3bd7aeed8125c6ada0f616a961d6998ea18d010f2407d0fbbe3015206e8e8fff4819e3053b6037754e9921ccebcb0e26e0382d6b98", @ANYRESOCT, @ANYRESDEC], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090b000000000000000000000003000600000000000200000000000000000000000000000002000100000000000000fb0200000000030005000000000002000000ac1414aa0000000000000000010008000029"], 0x58}, 0x1, 0x7}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1m6.359511109s ago: executing program 4 (id=1495): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a3000"], 0xfc}}, 0x0) write$tun(r0, &(0x7f0000000440)={@val={0x0, 0x6005}, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x86dd, @dccp={{0x5, 0x4, 0x3, 0x3, 0x24, 0x64, 0x0, 0x8, 0x21, 0x0, @empty, @multicast2}, {{0x4e24, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x6, 0x2, "6d85ea", 0x1e, "e908f9"}}}}}}}, 0x3e) 1m6.358668685s ago: executing program 2 (id=1496): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=@newsa={0x170, 0x10, 0x633, 0x0, 0x200000, {{@in=@local, @in6=@empty, 0xffff, 0x3ffc, 0x5e21, 0x8001, 0x0, 0x20}, {@in=@loopback, 0x4d4, 0x32}, @in=@remote, {0x323, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200000, 0x7efffffe}, {0x2000000, 0xfffffffffffffffc, 0x0, 0x20000000000}, {0x7, 0x0, 0x2}, 0x70bd01, 0x3500, 0x2, 0x4, 0x1}, [@algo_crypt={0x48, 0x2, {{'ctr(cast6)\x00'}}}, @encap={0x1c, 0x20, {0x0, 0x4e1e, 0x0, @in=@private=0xa010100}}, @encap={0x1c, 0x4, {0x1, 0x4e20, 0x0, @in6=@local}}]}, 0x170}}, 0x24008800) 1m5.927834502s ago: executing program 2 (id=1497): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0904000000000000f3770200000048000480300001800e000100696d6d6564696174650000001c000280100002800c00028008000180fffffffb0800014000000000140001800d00010073796e70726f7879000000000900010073797a30000000000900020073797a320000000014000000110001"], 0x9c}, 0x1, 0x0, 0x0, 0x14000000}, 0x0) 1m5.738454115s ago: executing program 2 (id=1498): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f00000031c0)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x0, 0x4}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000f00)="9eb8a2", 0x3}], 0x1, &(0x7f0000000580)=ANY=[@ANYBLOB="1800"], 0x18}, 0x8080) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x5a0}], 0x1, 0x0, 0x0, 0x900}, 0x3000000) 1m5.641741524s ago: executing program 2 (id=1499): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="010026bd7000000000003b00000008000300", @ANYRES32=r1, @ANYBLOB="0600cd00680000006c"], 0x90}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 52.303795419s ago: executing program 3 (id=1503): r0 = socket$rxrpc(0x21, 0x2, 0x2) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x600000a, 0x8032, 0xffffffffffffffff, 0x0) (async) ioctl$BTRFS_IOC_START_SYNC(r1, 0x80089418, &(0x7f0000000080)=0x0) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, &(0x7f0000000100)=r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r2, 0x215eb000) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), r4) sendmsg$DEVLINK_CMD_RATE_GET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="01070000adccb234f6e93d"], 0x14}}, 0x0) 51.9268365s ago: executing program 32 (id=1491): ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000280)={0x0, @hci={0x1f, 0x3, 0x4}, @hci={0x1f, 0x4, 0x3}, @can, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0xa, 0x5}) r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000d00)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000001400020077673100000000000000000000000000f40108807000008048000980280000f8060001000a00000014000200fe8000000000000000000000000000aa05000300030000001c000080060001000200000908000200e0000001050003000000000024000100000000000000000000000000000000000000000000000000000000000000000080010080200004000a004e2000000005200100000000000000000000000000000800000006000500b01f00000800030006000000060005000500000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a034e200000040100000000000000000000ffffac14142a06000000240001000000000000000000000000000000000000000000000000000000000000000000d4000980"], 0x21c}, 0x1, 0x0, 0x0, 0x20040010}, 0x4008804) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="58000000021400022bbd7000fddbdf25050054000000000005005400010000000900020073797a3100004c291074f41275960000000008004400", @ANYRES32, @ANYBLOB="0900020073797a300000000008004400", @ANYRES32, @ANYBLOB], 0x58}}, 0x4044091) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000140)=ANY=[], 0x0, 0x2, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee6, 0x8031, r3, 0x215eb000) socket(0x40000000015, 0x5, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000f40)=@ethtool_stats}) 51.83618579s ago: executing program 2 (id=1506): syz_80211_inject_frame(0x0, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) bind$alg(r1, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(generic-gcm-aesni)\x00'}, 0x58) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000004000000480311802ef9"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)) ioctl$SIOCSIFHWADDR(r2, 0x8b26, &(0x7f0000000080)={'wlan1\x00', @random="09fe000500"}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0xffff, 0xa}, {0x1, 0x3}}}, 0x24}}, 0x40080) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r2, 0x800442d2, &(0x7f0000000180)={0x4, &(0x7f0000000200)=[{}, {0x0, 0x0, 0x0, @multicast}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @local}]}) 51.269662948s ago: executing program 3 (id=1507): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNGETVNETBE(r2, 0x800454df, &(0x7f0000000180)=0x1) getsockopt$inet_int(r1, 0x0, 0xf, 0x0, &(0x7f000000eb40)) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448df, &(0x7f00000002c0)) r4 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) 51.231179163s ago: executing program 33 (id=1495): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a3000"], 0xfc}}, 0x0) write$tun(r0, &(0x7f0000000440)={@val={0x0, 0x6005}, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x86dd, @dccp={{0x5, 0x4, 0x3, 0x3, 0x24, 0x64, 0x0, 0x8, 0x21, 0x0, @empty, @multicast2}, {{0x4e24, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x6, 0x2, "6d85ea", 0x1e, "e908f9"}}}}}}}, 0x3e) 36.685573405s ago: executing program 34 (id=1506): syz_80211_inject_frame(0x0, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) bind$alg(r1, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(generic-gcm-aesni)\x00'}, 0x58) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000004000000480311802ef9"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)) ioctl$SIOCSIFHWADDR(r2, 0x8b26, &(0x7f0000000080)={'wlan1\x00', @random="09fe000500"}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r5, {0x1}, {0xffff, 0xa}, {0x1, 0x3}}}, 0x24}}, 0x40080) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r2, 0x800442d2, &(0x7f0000000180)={0x4, &(0x7f0000000200)=[{}, {0x0, 0x0, 0x0, @multicast}, {0x0, 0x0, 0x0, @dev}, {0x0, 0x0, 0x0, @local}]}) 36.042179183s ago: executing program 35 (id=1507): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNGETVNETBE(r2, 0x800454df, &(0x7f0000000180)=0x1) getsockopt$inet_int(r1, 0x0, 0xf, 0x0, &(0x7f000000eb40)) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448df, &(0x7f00000002c0)) r4 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) 29.298393497s ago: executing program 1 (id=1522): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) sendmsg$NLBL_MGMT_C_ADD(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x114, r2, 0xe701ac47a3d23ecd, 0x0, 0x0, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_DOMAIN={0xce, 0x1, 'C\xec\xf8\xa0w\x15|\xd8\xbcs\xe1\xb93\x14\xcd\xcb\xb6\xb9\xbb\x84\xe5\xbc\xdb\x7f\x9a\xf2\xea\xcc\x91:v@\xe83-\x1d\xaagQl\x7f\tKt\fc\x1f\x17]\xd5\xd0\xf0\xa8\xeb\xd2g\x92\x04\x02\v\x00od\xe6,\xd3@I\x17\xf3\xbees0\xad\xc6\xbf/*\xb6(o\x91t\x12\x93U6\xf4@n\xdc\xdc\x8a7y\x81FY\xbe\xbbc\xd2\xc3\x01\xa5\xe2V\x8c\xb3im~\xd2V\xdaG\xbdbF\xc8n\x86\xac\x9c\xfb\xda\xe2&\"\xb4:\x13\xe9\tc\x85\xb4\xcb\x17\xbfm\x846\xe7\x7fp\x9eCdb\xad;\xa2\x8fs\xbf6\xe8\xe3Xg3&\xe2 \xd6\n\x9d=~<\x93/\xaf\x89\x06+\x96]\xb5+\xee\xff8^D*\xdb\xb8\xd8t\x80\xd4\x8fK=E0\xe8R\x83'}, @NLBL_MGMT_A_IPV6ADDR={0x114, 0x5, @dev}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}]}, 0x114}}, 0x0) r3 = socket$kcm(0x2, 0x3, 0x106) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x20, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_ADDR_MIN={0x8, 0x3, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x7, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8800) sendmsg$inet(r3, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="fbd2b9ed29d8974a6ce75f08916ac3b4da11bc1a", 0xffeb}], 0x1}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x6c, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x58, 0x1, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xffffffff, 0x10001, 0xffffffffffffffff, 0x3c, 0x3}, 0x400000000a}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) r5 = socket$kcm(0x10, 0x2, 0x10) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) r7 = socket$nl_route(0x10, 0x3, 0x0) splice(r7, 0x0, r6, 0x0, 0x2, 0x2) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000001100000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20010840) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=@ipv6_getaddr={0x18, 0x16, 0x1, 0x70bd25, 0x0, {0xa, 0x3f, 0x0, 0xc8}}, 0x18}, 0x1, 0x0, 0x0, 0x8800}, 0x0) 28.244430011s ago: executing program 1 (id=1523): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001540)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r1, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="42000e0080000000ffffffffffffffffffffffff080211000000000200000000000000000200010003010606020100050304ab0725030099012a01073c0400810a03000345000f00013fb0ce3eb7dcbbc42513bc9511df75646f725dded3afe0879f9b48b16cc5e489db1d95029fd6d8a410ae0a5339400000000000000024ba8946b2e6e0eff6967b000000080026006c09000008000c006400000008000d"], 0xc0}}, 0x0) 17.02733681s ago: executing program 1 (id=1524): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="660a000000000000611177000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001ac0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4}, 0x28) 16.960217717s ago: executing program 1 (id=1525): r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f00000031c0)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x0, 0x4}, 0x80, &(0x7f0000000780)=[{&(0x7f0000000f00)="9eb8a2", 0x3}], 0x1, &(0x7f0000000580)=ANY=[@ANYBLOB="1800"], 0x18}, 0x8080) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000100)=@l2tp6={0xa, 0x0, 0x2, @remote}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000180)='S\x00', 0x5a0}], 0x1, 0x0, 0x0, 0x900}, 0x12000000) 16.852482476s ago: executing program 1 (id=1526): r0 = socket$nl_route(0x10, 0x3, 0x0) shutdown(r0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$IPSET_CMD_DEL(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x44, 0xa, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}, @IPSET_ATTR_LINENO={0x8}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x4010}, 0x10) ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f0000000200)) recvmsg(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)=[{&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/60, 0x3c}], 0x2}, 0x40000141) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000001340)={0x0, 0x5, 0x30}, 0xc) r5 = socket$pppoe(0x18, 0x1, 0x0) r6 = socket$inet(0x2, 0x4, 0xffffffc0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f0000001380)={0x0, 0x1000, "fe55ca86f8bced9d6bae59efb2c881ffd84cea212d03c2defd5954a123a85abd682350c0ae718f30e8e494dd04f76c272a8a739f05aaf7295c66d878400810f624edcb7b1e3248aa59983df8a980f488e134fdc11066452d4bba6d235e77de8b82d8f01a8444baa0ad9aad2e02d0d3a49d410bc6ed94952dfe587345e6ae982ed76c8662ce4be698634afd590856673b4eb7d09b44b753bc68df7d3469cf700ba7d5a312047db680d832fa5237bcbe40ffc4ddec4414e15fd5f4a356cf30cf7a2e455ce697c12447feb328def993635631dbefa4a58cb6940cdcc53cb740f457034c2f15a8dc062f2d7c24748cb94e878967b646d5f787315374d7069f96a7d9d72196b48912dd0e9553128f0db7ae2eb3cffaba09de4ab3ec692889769b0c7bab961181da8a61ca7513ed66df87dca9cdf27d2a55b10c83d8ba4fc50f246a2fdc231cb4ea2cd3455c1333183e086ed11cbd29a1c4a858b9cf8103f34e51d1c31b546271914d963c92d093619f04f6284b80e9402b9a52b9d224d6eabe4552e9ad8b856683b844f0dbbb8fe9a52acb8805aa7dfb874428977cd757dcbc2ee07e8ae7f06633c3a8edd8120867e13bc7f34313bd5c1b6915f7b9091bb2a7c8586544e4d2f5dabdb481a64a19c448db4d90bad4cc3531ef5b1fc353122535152e3feec0982faa1ccd6868a31e0706983c7d167a880a260aaf9dad0d0556aeb03ceee7a0efd42f159bd5d354fa6d038340f98a7fbf00e1197070d64b4a705916cef0da0ac0070693f41eb92ba35c338f947293914e2c4f99a8921b5b30d4f3f7bc0cdd425c763960232bb7f54060905976c43059190236bc07cfbffe747e74a5b16c27e644225db246c4682970b6bccf50aa0f05768f74532c9395e672b609fac15f4c9c4097b1bbca3b9d6602dbe12b6d7c74202b8b107ae2a157b434d0f1b620ef75d0269b2ed0ee822fbad0015db0b6c1b287a901cc78f0f3a7453567dfc0c649cc332d41a1d509c29266381e837a6df5a750aabf8a70eab3da1a8fff72e10925fd41379a811788be6ac0ad1a7c9c507df7be5bdce6fed83648e6d787d777a4e452ba8d8c87dd8b88cfa7603d136df03cb3c48c33e9117470ca77abca9ed3fe6e3fe76657c105606f24ff294404bd6cffccc9ae6593bc2800fa7e675b9c27e697bec3a7f70856c9d50f3fd0bc8d417f45749489316dc091779f8efbe0f737334ee6c60ea21513cb9d23d28d823522d4643c22a14d00a865332e91b2e751c94bfc412086501ad61da1a6824d513ee6a38f52cac69548be3ea2f5ec2c11ff4b5a499f90d515b7e4bf3eb58acd72d85f883dad9f71ea448689bd0333ad1f522f73d11614f93a4e63b583c43ba6d56bd6e812cab57358dbf48edce76851f763d5641a812cb62d77ce60c66f6903352a3d690fd07a3cbedeaaae0496c19c6a485c1bdb64e8258f9f8eebb148514db9c29f6ae7f71017a8f59dd44492ea5907056bd2342085ba67f19d921bbae33bf3a5eb63b8430b1c97461c2523c336255f5932fc5ac064f85981602591a318866ef3d9a5fd1247cdcd01b8f376e215967f6cca3066e66369b946089665cb9afcff643731bdcda6c6efbb8684a2e96e42e6980413ae6efc29a7e1f5c61e5ed2eee676e63bde8d8f4dd6eac26939fdd6564049faf381d1ae40fff56ce9f698364dbc6b75108aa3b9930bd1bfb37f3c290841188accb024f1c2ce9d8b4bf1e774e96aefa3da82d68ca46d8d7bf64a6936f1b0d02d3534ae0a4c2514a62f2c42ea443322d051d83bacb8c7a85970b77ba33af5ec4b2ddfdff6166b8ecc2cdebe66c3fa1afe1ecd630de9f107908293f67db82c7989e9371a2452b87eff6066abca09dc8272617a85cb4544d7db516c354ae3aed5af1061f97aa69daecedb8fe37150a1fcaaaff3191c40df575a966e777ba05de597bdf8b79fd354ab8d41c21e4352a9ed5c07e42a739652cabb7960dd77649ad262a670a434fd88f41cf5a8a112b247a30504df771c62bc6409f6c09cc62d8a0e5c7efaa13486562cb3977879ce92e481c84067155adfadc087e38984931644f49fc4f751b25ca81f9d5dd751caab3e64ecee09d2c53ec27702be79839a5c3b333aa01ba35dddbf44ab1d9dcdb687309774bc87fe75a095e4534924196ffb437f7c1af16911c270ab68982542491512557488da7e50e15af1188a30126c8616298dcf35e25c473854bd1346ce9d532302629bb3ec8d7d2eac0ddb47cffdc16cb2e68de3a73bf9bc1238a2c0d6397f0dec3ebee1db363984475dd3725080db98fe178613dc3eabe06e420bdfbfc53462fd507fb508cf48c9f17fd1d3ad774b5714c091286ae5da88f05cd63344196b0986361ae97cc1cb44a41a3fb8dec6720c79a05fc4437076e41d899b99d922342164b35a91416e02880e20297a8e0f4dffafb22e26ca7e1425b656ecaf2381937a7b265d929d18a1182ea33f464594b04442779a5d06fb6c20b83d201d4b7180d2226e182dabf034c781ade41b7424f7d02a8af58e353f749501cd49e15a662c67b99007beaafc1d94305fe7d44e4b8b2e9c2225accb401f7ee53c0a72a5fbd675b90310a6c286cad4b34b077d7cc04e235138964abd39b292d5dc391e311430e33c03bfc9905f03a11682f01d64102f6b58191e9dd7f1a1c751743c91d8147af5971de5ea21c530b371f0d6025c77f2adece68799da5a87c6c852e67d9eb654cdca763a16f3af29b26341c90c7e28c740b997971463235f791380a9232a2f686eb7289479e18450cd3fb3f7121579801ab922ab123015c3ad1550e247bde0b93b5bb696599961d1dee12fb7c926871c65dd219701c69ba09634244be059f7db54494656127a69b7d02aaefdbde378fc8e2fa069ba623146607a19265ee9070878996af20be915ec351ce557ce7571aa20067d87587006a43c318d36399efa89ef1a8b2bf7710a039680a4b68d0c013709af591fb4049f450e80d1e8d43404f0e5970ebf95bf5dcf96e51e00538d2d57af5f57f528db52d0ae09aea832667a2385e0e1f49ceeb84c93e0dca44efd5e2aa4836652c74768fd84708536a4a0b09bf51088997427588934d3a499b67a5f2307b45859e152ec6b3cea0602a046fd35b37f7778724a9ca7a7d7e6f2faa305c866863d3c70b78c65be0f4b93b7d849dc7d6a38d7b4e178deb52de72490bf0838cefbecde003e74eac13bb763fce29191a29bf70b13c391df45b073dc2aa7cb0455f5a80b9a82f04dd55ac548d7df189960428931ab2965ba5580a494b46d3706b72bc791bd8afd3ba28c09947a4f08ec2646630f2570111ed3df71d47ccd4f3ecc67b5e932f2de2bbcd4a1c201fe8dd35978c887caa53866c7bc64ec5df82bd51b708d9cf5d434f3d1642f005bb9b994114067159f24f8e6000df182f67df1a8c0a7058ec0dd0e3632d0ea4e494ad4d4e3a8940d144d113db1d07802b365eed4ed2da7d257aedaea5e100dc2cbcaab425f0a7421e940558e81bfda2466b076698ecd9d155064ec64f91b1378cb0e1efb5f836b285d35e73fd6afe64df02fcaf7c863f2d1b20f693fa7071465c24614d602443503d2b067264e0304c4e124aad24a3a330c6e36220bf3c55997075a0f3abb7e8921ec1fd3bd8d8852d75d5060325283ee9c62c0ec13d0a663eb51942772616ec2202a1f5bdb1cd243d3ba026b6ec948de65d5c010a853f72b522d73a9a48713bdc7639baaae556bd15ea57afb1c02fae182eafcec98e0e1e2c2d56401a46e856398860ac16910b6bcfd76cd64da9b8ec7bf85a6c934188e442a21f107e1c34cd3fd00cbe1a5b7d686785a4b81dd833dc74911b49320bd83b94d37b856d46cfbed3c91b57d71cf7d116050f8225ba2b7009cfd3b11049730670c8ae0d4fb4a70c23a0308b07f45d5c062762a38c37fc6d6326fc6336cb05be68aeea0cbbf0750fc66f80a989e124ba1cbdf21691b8b5b9d1655bf1ba3105406a40ade5a5e51c1b2a6570bdec9e2dab8543a0c2276c0f9baf9d9798491cdd81b09afa72ddd9c8a5aa27edb9fa240b8caf3ab5acdf56d4e4dc35f9f091d16d33540b64c930e0ac153f12966a05658c6d456f9f977fe99301e584a53e97f081ab3a93ebd135b5e8c2b8cac50b74119847596300d6ab9d036162122834564f5194a364c7fba8b21ff9eed3097c59d148962c0f7712fd348783505efdef69e7959988777e81edb554bc592ee4a1a5bdc226f1646638d7145f997e211c5a84ed6fe7d6d190a8d339b09cca0c0f522111289b35e8a7c8894a350fe8218123fe24f2f240aac4afe1c6b13d3eb808103e53d285e99f0dc74b8edae235415d2f4f6af1f0d6c958a64c926ff7d8657ab4d9d63eb786c558048e92ceed7030a4370d8e5f6528362590782fa2b21182fc0b85a41b3260b387a9ef6418f5c0db1e81a46a9551d8c3ac031d039a2511f73c6c557211b981664601ede483dcec2284b72931bb25edbb00933337c22520b771d1176085af211f99eef66de4c298e4d996387e87c70c62b577fcc28925741407e5f623639ec0539b7ed83d4ff6473ad413f18943fdb9034a015b7e7064098a19a8d4b094bb73e01720421d537ceb08edae2fb3cbfe4457a4707fcf7a8921eecd32fb90592fcf43a7ee429c163c952468a293aa056b3d44f915e4be0764dfe4df9b7f7b9d5a87f552e27815a335ce59f14a1c068f675965246b1e0b3daebb4099243c473c0805e65b7e50780279b7ac268afe5cdcaf8034d297c9359ee28da0bbbc3b6aea558c8ad9a1c8649d05d90de632d69b6273e14ac033aa6463ef555174a862d914b20fcaea3dcbc2bd6b9a7de8f6ad6ac27c0a3f5bfbe6fa0fbe325ce0715546dd30698e8d37ff32c361c2b84fbafdf4e2464a2b8277c8cf139eea769ec3ba43fb2701c21f84ded1a7556b6e14a9b76366c79a251ccc6f84527f18dda4d9798df6995d589ac9eafe7055e8aec8a199666bcf4f6fb15cd62ae01c47a00451cfc80b1551552e501d7320dc9b4a1323825d24fc94874f40906285f50f9e90c273dc30317aa457f65a6c4167c3ddd44973150525d1f6773097dcd1fc64b2fba6f7ee2d80dbbf9dfb8f7da4bbcfd7ab2e119c3f12d9968f3eb81114dc75c6fe47ac16e80288280d5be1fe3587140ed4b9e13e5d2af0513abb7889a1dbcdd12e2486a9115c12ff121bb275469920a270c40354d9fb7b687126d02bca85d10532b2ccdc1249315243ea8eb5e77feee693fdffb4bbf5769f2ef557a1e4d4f4cec3d56f09375309d1c561dbd1b4e46a08f8432e5f95d3eaadc52c8868f6c94c97ca6a1bc91ce82de0370aa0e3513ea1ad94ce1b34a3d4545debddf1ad23a11d6a8fe0021f158cdee95eb7cacafd78f111364cd0479f178816dd2b1296a894f0a3301946e5fbf5402006278dd068dd3fe3b2924bc7d9f934b4b5b364cad04af1dd76a8fa17c07905f916b95dfb49bd0552612b6ac3dc71d880300dcafa06c69a9d0aa6be6acbfe668184c1cace4da9f0ee6981e1a1821557814de219f963157bf3aa44258e88e5204333b2d11bcf7025bf2b3a2b16107ab1375a2026f02401e9c9d6bd0b4f6cdfd1d6d6d19ee2958221f790210fa98b928e03fa0d102d987510aa92cf58da0a38804030f769e4a7bde2eaf1aa60d17d189dca156fd64fc11a35eea16b2c4301a5aed4eb80ff45d49147258e77d4ee45171789dc2e04a091939b921efa14e8651d62d195eb00b51ee6595d158dd4f4655fa851511786de69e7ff9fe4e080db7e90d9979babfcc9ec0403054"}, &(0x7f00000023c0)=0x1008) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000002400)={r7, 0x1}, &(0x7f0000002440)=0x8) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000002480)={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, r1}, 0xc) ioctl$XFS_IOC_FSGROWFSLOG(r3, 0x4008586f, &(0x7f00000024c0)={0x9, 0x1}) ioctl$XFS_IOC_AG_GEOMETRY(r5, 0xc080583d, &(0x7f0000002500)={0x3, 0xfffffff7, 0x8001, 0x7fffffff, 0x10000, 0x7, 0x9, 0x27f}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000025c0)={r4}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000002680)={0xffffffffffffffff}) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000002700), r8) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r9, &(0x7f00000027c0)={&(0x7f00000026c0)={0x10, 0x0, 0x0, 0x12821ee1f0e3eb2b}, 0xc, &(0x7f0000002780)={&(0x7f0000002740)={0x38, r10, 0x4, 0x70bd26, 0x25dfdbfb, {{}, {}, {0x1c, 0x18, {0xe, @bearer=@l2={'eth', 0x3a, 'veth1_to_bridge\x00'}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x48c1) syz_genetlink_get_family_id$team(&(0x7f0000002840), r8) getpeername$packet(r2, &(0x7f0000002880)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000028c0)=0x14) read$nci(r2, &(0x7f0000002fc0), 0x0) syz_80211_inject_frame(&(0x7f0000003000)=@device_b, &(0x7f0000003040)=@mgmt_frame=@auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x4}, @device_b, @device_a, @from_mac=@broadcast, {0xd, 0xff}, @value=@ver_80211n={0x0, 0x2, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1}}, 0x0, 0x4, 0x3, @void, [{0xdd, 0x8, "8932e656811077c3"}]}, 0x2c) 15.927792027s ago: executing program 1 (id=1527): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001740)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x104}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000040)={0x28, r1, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x4}}}}}, 0x28}}, 0x0) 0s ago: executing program 36 (id=1527): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001740)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$phonet_pipe(0x23, 0x5, 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x68, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x30, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x104}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000040)={0x28, r1, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x4}}}}}, 0x28}}, 0x0) kernel console output (not intermixed with test programs): 88.826134][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.854811][ T5636] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.866962][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.875563][ T5636] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.886993][ T5636] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.981152][ T5638] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.995115][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.021895][ T5638] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.032067][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.040092][ T5638] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.054675][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.063930][ T5638] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 89.076432][ T5638] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.123041][ T5651] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.197289][ T5639] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.208494][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.219134][ T5639] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.229554][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.239216][ T5639] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.250076][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.271393][ T5639] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.282277][ T5639] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.302877][ T5651] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.336771][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.344798][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.379906][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.387173][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.430574][ T5637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.513368][ T5637] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.550194][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.557446][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.572650][ T5636] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.597674][ T1014] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.604865][ T1014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.648176][ T5636] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.673431][ T1014] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.680615][ T1014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.748414][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.756737][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.798599][ T5638] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.828206][ T5639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.890124][ T5638] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.948148][ T3296] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.955504][ T3296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.982577][ T5639] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.992464][ T3296] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.999695][ T3296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.024171][ T1014] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.031465][ T1014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.073981][ T1014] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.081339][ T1014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.123301][ T5650] Bluetooth: hci0: command tx timeout [ 90.125283][ T5654] Bluetooth: hci2: command tx timeout [ 90.202330][ T5654] Bluetooth: hci4: command tx timeout [ 90.202961][ T5650] Bluetooth: hci1: command tx timeout [ 90.209393][ T5645] Bluetooth: hci3: command tx timeout [ 91.076114][ T5651] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.302224][ T5651] veth0_vlan: entered promiscuous mode [ 91.350339][ T5651] veth1_vlan: entered promiscuous mode [ 91.376502][ T5637] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.494708][ T5651] veth0_macvtap: entered promiscuous mode [ 91.537969][ T5651] veth1_macvtap: entered promiscuous mode [ 91.647941][ T5651] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.697873][ T5651] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.726966][ T5636] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.759288][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.782510][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.824836][ T5639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.837798][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.847637][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.867045][ T5638] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.967283][ T809] cfg80211: failed to load regulatory.db [ 92.042266][ T1127] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.053663][ T1127] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.139898][ T5636] veth0_vlan: entered promiscuous mode [ 92.167379][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.175390][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.200337][ T5639] veth0_vlan: entered promiscuous mode [ 92.202268][ T5645] Bluetooth: hci0: command tx timeout [ 92.208740][ T5654] Bluetooth: hci2: command tx timeout [ 92.246493][ T5638] veth0_vlan: entered promiscuous mode [ 92.259116][ T5636] veth1_vlan: entered promiscuous mode [ 92.275196][ T5637] veth0_vlan: entered promiscuous mode [ 92.285149][ T5651] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.291849][ T5654] Bluetooth: hci3: command tx timeout [ 92.301862][ T5645] Bluetooth: hci4: command tx timeout [ 92.307383][ T5654] Bluetooth: hci1: command tx timeout [ 92.338200][ T5639] veth1_vlan: entered promiscuous mode [ 92.364703][ T5638] veth1_vlan: entered promiscuous mode [ 92.391690][ T5637] veth1_vlan: entered promiscuous mode [ 92.510096][ T5636] veth0_macvtap: entered promiscuous mode [ 92.531283][ T5639] veth0_macvtap: entered promiscuous mode [ 92.582401][ T5636] veth1_macvtap: entered promiscuous mode [ 92.607608][ T5638] veth0_macvtap: entered promiscuous mode [ 92.615633][ T5639] veth1_macvtap: entered promiscuous mode [ 92.637954][ T5637] veth0_macvtap: entered promiscuous mode [ 92.648183][ T5638] veth1_macvtap: entered promiscuous mode [ 92.709661][ T5636] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.732143][ T5637] veth1_macvtap: entered promiscuous mode [ 92.770810][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.794722][ T5636] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.840270][ T5639] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.876514][ T5845] syz.2.9 uses obsolete (PF_INET,SOCK_PACKET) [ 92.880646][ T5638] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.910882][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.923029][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.938995][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.953610][ T5638] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.974329][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.987181][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.028028][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.045484][ T5847] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9'. [ 93.048254][ T5637] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.070692][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.095959][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.107219][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.163217][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.194966][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.204926][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.258461][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.267679][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.294772][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.329956][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.346097][ T1014] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.355061][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.364725][ T1014] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.500675][ T3296] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.511289][ T3296] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.520063][ T5852] syzkaller0: entered promiscuous mode [ 93.527817][ T5852] syzkaller0: entered allmulticast mode [ 93.577968][ T1127] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.588977][ T1127] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.623367][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.631427][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.675325][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.695857][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.788720][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.811572][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.846910][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.868517][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.003941][ T5854] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4'. [ 94.015930][ T5856] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4'. [ 94.044080][ T1014] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.074624][ T1014] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.318900][ T5863] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12'. [ 94.507787][ T5869] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2'. [ 94.570675][ T5871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14'. [ 94.593212][ T5871] Zero length message leads to an empty skb [ 94.698689][ T5875] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15'. [ 94.908583][ T5879] syzkaller0: entered promiscuous mode [ 94.914378][ T5879] syzkaller0: entered allmulticast mode [ 95.091746][ T5889] netlink: 'syz.2.22': attribute type 1 has an invalid length. [ 95.102910][ T5890] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17'. [ 95.333346][ T5899] netlink: 12 bytes leftover after parsing attributes in process `syz.0.24'. [ 95.342896][ T5901] netlink: 'syz.2.25': attribute type 8 has an invalid length. [ 95.342954][ T5901] netlink: 4 bytes leftover after parsing attributes in process `syz.2.25'. [ 95.417587][ T5901] veth1_to_team: entered promiscuous mode [ 95.453447][ T5901] gretap0: entered promiscuous mode [ 95.475397][ T5901] dummy0: entered promiscuous mode [ 95.485429][ T5901] hsr1: entered promiscuous mode [ 95.829320][ T29] audit: type=1800 audit(1781634237.490:2): pid=5916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.30" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 95.833418][ T5916] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 95.910210][ T5916] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 95.924244][ T5916] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 96.090626][ T5929] netlink: 'syz.2.35': attribute type 1 has an invalid length. [ 96.142782][ T5931] FAULT_INJECTION: forcing a failure. [ 96.142782][ T5931] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 96.159127][ T5931] CPU: 1 UID: 0 PID: 5931 Comm: syz.1.36 Not tainted syzkaller #0 PREEMPT(full) [ 96.159156][ T5931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 96.159176][ T5931] Call Trace: [ 96.159185][ T5931] [ 96.159197][ T5931] dump_stack_lvl+0xe8/0x150 [ 96.159236][ T5931] should_fail_ex+0x40c/0x560 [ 96.159264][ T5931] _copy_from_user+0x2d/0xb0 [ 96.159292][ T5931] ___sys_sendmsg+0x1c6/0x360 [ 96.159325][ T5931] ? __lock_acquire+0x683/0x2cd0 [ 96.159354][ T5931] ? __pfx____sys_sendmsg+0x10/0x10 [ 96.159426][ T5931] ? __fget_files+0x2a/0x420 [ 96.159453][ T5931] ? __fget_files+0x3a2/0x420 [ 96.159489][ T5931] __x64_sys_sendmsg+0x1bd/0x2a0 [ 96.159536][ T5931] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 96.159580][ T5931] ? rcu_is_watching+0x15/0xb0 [ 96.159614][ T5931] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.159634][ T5931] do_syscall_64+0x174/0x580 [ 96.159654][ T5931] ? trace_irq_disable+0x3b/0x140 [ 96.159688][ T5931] ? clear_bhb_loop+0x40/0x90 [ 96.159715][ T5931] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.159736][ T5931] RIP: 0033:0x7fa66379ce59 [ 96.159761][ T5931] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.159778][ T5931] RSP: 002b:00007fa664601028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 96.159800][ T5931] RAX: ffffffffffffffda RBX: 00007fa663a15fa0 RCX: 00007fa66379ce59 [ 96.159816][ T5931] RDX: 0000000000000040 RSI: 00002000000009c0 RDI: 0000000000000003 [ 96.159829][ T5931] RBP: 00007fa664601090 R08: 0000000000000000 R09: 0000000000000000 [ 96.159842][ T5931] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 96.159854][ T5931] R13: 00007fa663a16038 R14: 00007fa663a15fa0 R15: 00007fff874dff78 [ 96.159887][ T5931] [ 96.746970][ T5765] IPVS: starting estimator thread 0... [ 96.862066][ T5952] IPVS: using max 28 ests per chain, 67200 per kthread [ 97.528956][ T5984] netlink: 'syz.2.58': attribute type 1 has an invalid length. [ 97.648768][ T5994] netlink: 'syz.1.62': attribute type 32 has an invalid length. [ 97.799517][ T5996] FAULT_INJECTION: forcing a failure. [ 97.799517][ T5996] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 97.824888][ T5996] CPU: 1 UID: 0 PID: 5996 Comm: syz.1.64 Not tainted syzkaller #0 PREEMPT(full) [ 97.824918][ T5996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 97.824932][ T5996] Call Trace: [ 97.824940][ T5996] [ 97.824949][ T5996] dump_stack_lvl+0xe8/0x150 [ 97.824980][ T5996] should_fail_ex+0x40c/0x560 [ 97.825008][ T5996] _copy_from_iter+0x1d3/0x1660 [ 97.825037][ T5996] ? rcu_is_watching+0x15/0xb0 [ 97.825068][ T5996] ? __pfx__copy_from_iter+0x10/0x10 [ 97.825089][ T5996] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 97.825129][ T5996] ? netlink_sendmsg+0x650/0xb40 [ 97.825161][ T5996] ? skb_put+0x112/0x210 [ 97.825194][ T5996] netlink_sendmsg+0x6c0/0xb40 [ 97.825237][ T5996] ? __pfx_netlink_sendmsg+0x10/0x10 [ 97.825274][ T5996] ? aa_sock_msg_perm+0xf1/0x1b0 [ 97.825307][ T5996] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 97.825336][ T5996] ? __pfx_netlink_sendmsg+0x10/0x10 [ 97.825369][ T5996] ____sys_sendmsg+0x9b9/0xa20 [ 97.825403][ T5996] ? __might_fault+0xaf/0x130 [ 97.825437][ T5996] ? __pfx_____sys_sendmsg+0x10/0x10 [ 97.825488][ T5996] ? import_iovec+0x73/0xa0 [ 97.825520][ T5996] ___sys_sendmsg+0x2a5/0x360 [ 97.825552][ T5996] ? __lock_acquire+0x683/0x2cd0 [ 97.825578][ T5996] ? __pfx____sys_sendmsg+0x10/0x10 [ 97.825643][ T5996] ? __fget_files+0x2a/0x420 [ 97.825669][ T5996] ? __fget_files+0x3a2/0x420 [ 97.825705][ T5996] __x64_sys_sendmsg+0x1bd/0x2a0 [ 97.825740][ T5996] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 97.825782][ T5996] ? __pfx_ksys_write+0x10/0x10 [ 97.825824][ T5996] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.825847][ T5996] do_syscall_64+0x174/0x580 [ 97.825868][ T5996] ? trace_irq_disable+0x3b/0x140 [ 97.825900][ T5996] ? clear_bhb_loop+0x40/0x90 [ 97.825926][ T5996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 97.825949][ T5996] RIP: 0033:0x7fa66379ce59 [ 97.825969][ T5996] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 97.825987][ T5996] RSP: 002b:00007fa664601028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 97.826010][ T5996] RAX: ffffffffffffffda RBX: 00007fa663a15fa0 RCX: 00007fa66379ce59 [ 97.826025][ T5996] RDX: 0000000000000040 RSI: 00002000000009c0 RDI: 0000000000000003 [ 97.826039][ T5996] RBP: 00007fa664601090 R08: 0000000000000000 R09: 0000000000000000 [ 97.826052][ T5996] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 97.826064][ T5996] R13: 00007fa663a16038 R14: 00007fa663a15fa0 R15: 00007fff874dff78 [ 97.826098][ T5996] [ 98.088716][ T5998] netlink: 'syz.0.66': attribute type 8 has an invalid length. [ 98.096407][ T5998] __nla_validate_parse: 8 callbacks suppressed [ 98.096425][ T5998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.66'. [ 98.186208][ T5998] veth1_to_team: entered promiscuous mode [ 98.195112][ T5998] gretap0: entered promiscuous mode [ 98.204531][ T5998] dummy0: entered promiscuous mode [ 98.210664][ T5998] debugfs: 'hsr1' already exists in 'hsr' [ 98.216908][ T5998] Cannot create hsr debugfs directory [ 98.228636][ T5998] hsr1: entered promiscuous mode [ 98.328763][ T6008] netlink: 28 bytes leftover after parsing attributes in process `syz.3.69'. [ 98.548307][ T6005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.68'. [ 98.746659][ T6022] netlink: 8 bytes leftover after parsing attributes in process `syz.3.74'. [ 98.984615][ T6031] FAULT_INJECTION: forcing a failure. [ 98.984615][ T6031] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.017573][ T6031] CPU: 0 UID: 0 PID: 6031 Comm: syz.4.78 Not tainted syzkaller #0 PREEMPT(full) [ 99.017602][ T6031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 99.017616][ T6031] Call Trace: [ 99.017624][ T6031] [ 99.017633][ T6031] dump_stack_lvl+0xe8/0x150 [ 99.017665][ T6031] should_fail_ex+0x40c/0x560 [ 99.017694][ T6031] _copy_from_iter+0x1d3/0x1660 [ 99.017722][ T6031] ? rcu_is_watching+0x15/0xb0 [ 99.017753][ T6031] ? __pfx__copy_from_iter+0x10/0x10 [ 99.017774][ T6031] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 99.017813][ T6031] ? netlink_sendmsg+0x650/0xb40 [ 99.017844][ T6031] ? skb_put+0x112/0x210 [ 99.017878][ T6031] netlink_sendmsg+0x6c0/0xb40 [ 99.017919][ T6031] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.017973][ T6031] ? aa_sock_msg_perm+0xf1/0x1b0 [ 99.018006][ T6031] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 99.018033][ T6031] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.018067][ T6031] ____sys_sendmsg+0x9b9/0xa20 [ 99.018101][ T6031] ? __might_fault+0xaf/0x130 [ 99.018134][ T6031] ? __pfx_____sys_sendmsg+0x10/0x10 [ 99.018174][ T6031] ? import_iovec+0x73/0xa0 [ 99.018210][ T6031] ___sys_sendmsg+0x2a5/0x360 [ 99.018248][ T6031] ? __lock_acquire+0x683/0x2cd0 [ 99.018272][ T6031] ? __pfx____sys_sendmsg+0x10/0x10 [ 99.018334][ T6031] ? __fget_files+0x2a/0x420 [ 99.018371][ T6031] ? __fget_files+0x3a2/0x420 [ 99.018402][ T6031] __x64_sys_sendmsg+0x1bd/0x2a0 [ 99.018434][ T6031] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 99.018477][ T6031] ? __pfx_ksys_write+0x10/0x10 [ 99.018517][ T6031] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.018541][ T6031] do_syscall_64+0x174/0x580 [ 99.018562][ T6031] ? trace_irq_disable+0x3b/0x140 [ 99.018593][ T6031] ? clear_bhb_loop+0x40/0x90 [ 99.018620][ T6031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.018642][ T6031] RIP: 0033:0x7f5a0039ce59 [ 99.018662][ T6031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.018680][ T6031] RSP: 002b:00007f5a012bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 99.018705][ T6031] RAX: ffffffffffffffda RBX: 00007f5a00615fa0 RCX: 00007f5a0039ce59 [ 99.018720][ T6031] RDX: 0000000000000040 RSI: 00002000000009c0 RDI: 0000000000000003 [ 99.018733][ T6031] RBP: 00007f5a012bf090 R08: 0000000000000000 R09: 0000000000000000 [ 99.018746][ T6031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.018759][ T6031] R13: 00007f5a00616038 R14: 00007f5a00615fa0 R15: 00007ffe30a85ac8 [ 99.018791][ T6031] [ 99.147615][ T6034] netlink: 36 bytes leftover after parsing attributes in process `syz.0.79'. [ 99.347141][ T6037] netlink: 24 bytes leftover after parsing attributes in process `syz.2.80'. [ 99.400206][ T6038] netlink: 'syz.4.81': attribute type 8 has an invalid length. [ 99.442377][ T6038] netlink: 4 bytes leftover after parsing attributes in process `syz.4.81'. [ 99.506376][ T6038] veth1_to_team: entered promiscuous mode [ 99.533700][ T6038] gretap0: entered promiscuous mode [ 99.556641][ T6038] dummy0: entered promiscuous mode [ 99.586743][ T6038] debugfs: 'hsr1' already exists in 'hsr' [ 99.609166][ T6038] Cannot create hsr debugfs directory [ 99.628622][ T6038] hsr1: entered promiscuous mode [ 99.885929][ T6057] netlink: 28 bytes leftover after parsing attributes in process `syz.4.91'. [ 99.923078][ T6059] netlink: 'syz.0.89': attribute type 13 has an invalid length. [ 100.179623][ T6076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.93'. [ 100.451763][ T6088] netlink: 8 bytes leftover after parsing attributes in process `syz.4.97'. [ 100.478647][ T6077] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 100.955439][ T42] IPVS: starting estimator thread 0... [ 101.061026][ T6111] IPVS: using max 30 ests per chain, 72000 per kthread [ 101.207499][ T6118] tipc: Started in network mode [ 101.231236][ T6118] tipc: Node identity e635e041ffbb, cluster identity 4711 [ 101.253203][ T6118] tipc: Enabled bearer , priority 0 [ 101.274075][ T6118] syzkaller0: entered promiscuous mode [ 101.282465][ T6118] syzkaller0: entered allmulticast mode [ 101.295524][ T6115] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 101.310467][ T6118] tipc: Resetting bearer [ 101.338285][ T6117] tipc: Resetting bearer [ 101.396027][ T6117] tipc: Disabling bearer [ 101.674543][ T6135] netlink: 'syz.2.114': attribute type 32 has an invalid length. [ 102.243401][ T6159] netlink: 'syz.0.124': attribute type 1 has an invalid length. [ 102.254484][ T6162] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 102.264587][ T6155] bridge2: entered promiscuous mode [ 102.281915][ T5650] Bluetooth: hci4: command 0x0405 tx timeout [ 102.297551][ T6155] bridge2: entered allmulticast mode [ 102.385737][ T6169] netlink: 'syz.3.127': attribute type 32 has an invalid length. [ 102.585802][ T6179] netlink: 'syz.2.131': attribute type 8 has an invalid length. [ 102.772992][ T6177] syzkaller0: entered promiscuous mode [ 102.779376][ T6177] syzkaller0: entered allmulticast mode [ 102.951851][ T5749] IPVS: starting estimator thread 0... [ 103.082938][ T6192] IPVS: using max 35 ests per chain, 84000 per kthread [ 104.894081][ T6220] Bluetooth: MGMT ver 1.23 [ 104.925628][ T6220] __nla_validate_parse: 5 callbacks suppressed [ 104.925649][ T6220] netlink: 8 bytes leftover after parsing attributes in process `syz.2.145'. [ 105.127029][ T6227] netlink: 100 bytes leftover after parsing attributes in process `syz.3.148'. [ 105.348970][ T6237] netlink: 8 bytes leftover after parsing attributes in process `syz.4.153'. [ 105.507184][ T6239] netlink: 48 bytes leftover after parsing attributes in process `syz.1.154'. [ 105.529355][ T6245] IPVS: sed: FWM 3 0x00000003 - no destination available [ 105.800639][ T6256] warning: `syz.3.161' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 105.845471][ T6259] netlink: 'syz.4.163': attribute type 23 has an invalid length. [ 105.877510][ T6256] mac80211_hwsim hwsim7 ÿ: renamed from wlan1 (while UP) [ 105.966228][ T6264] netlink: 'syz.1.164': attribute type 1 has an invalid length. [ 106.185227][ T6276] netlink: 8 bytes leftover after parsing attributes in process `syz.4.169'. [ 106.198716][ T6277] FAULT_INJECTION: forcing a failure. [ 106.198716][ T6277] name failslab, interval 1, probability 0, space 0, times 0 [ 106.218732][ T6277] CPU: 0 UID: 0 PID: 6277 Comm: syz.3.168 Not tainted syzkaller #0 PREEMPT(full) [ 106.218761][ T6277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 106.218774][ T6277] Call Trace: [ 106.218783][ T6277] [ 106.218792][ T6277] dump_stack_lvl+0xe8/0x150 [ 106.218823][ T6277] should_fail_ex+0x40c/0x560 [ 106.218852][ T6277] should_failslab+0xa8/0x100 [ 106.218888][ T6277] ? skb_clone+0x212/0x3a0 [ 106.218908][ T6277] kmem_cache_alloc_noprof+0x87/0x650 [ 106.218946][ T6277] skb_clone+0x212/0x3a0 [ 106.218970][ T6277] __netlink_deliver_tap+0x413/0x860 [ 106.219015][ T6277] ? netlink_deliver_tap+0x2e/0x1b0 [ 106.219048][ T6277] netlink_deliver_tap+0x19c/0x1b0 [ 106.219082][ T6277] netlink_unicast+0x77f/0x940 [ 106.219124][ T6277] netlink_sendmsg+0x813/0xb40 [ 106.219166][ T6277] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.219203][ T6277] ? aa_sock_msg_perm+0xf1/0x1b0 [ 106.219237][ T6277] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 106.219265][ T6277] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.219299][ T6277] ____sys_sendmsg+0x9b9/0xa20 [ 106.219331][ T6277] ? __might_fault+0xaf/0x130 [ 106.219366][ T6277] ? __pfx_____sys_sendmsg+0x10/0x10 [ 106.219409][ T6277] ? import_iovec+0x73/0xa0 [ 106.219439][ T6277] ___sys_sendmsg+0x2a5/0x360 [ 106.219471][ T6277] ? __lock_acquire+0x683/0x2cd0 [ 106.219498][ T6277] ? __pfx____sys_sendmsg+0x10/0x10 [ 106.219577][ T6277] ? __fget_files+0x2a/0x420 [ 106.219610][ T6277] ? __fget_files+0x3a2/0x420 [ 106.219653][ T6277] __x64_sys_sendmsg+0x1bd/0x2a0 [ 106.219688][ T6277] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 106.219732][ T6277] ? __pfx_ksys_write+0x10/0x10 [ 106.219774][ T6277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.219797][ T6277] do_syscall_64+0x174/0x580 [ 106.219818][ T6277] ? trace_irq_disable+0x3b/0x140 [ 106.219850][ T6277] ? clear_bhb_loop+0x40/0x90 [ 106.219877][ T6277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.219898][ T6277] RIP: 0033:0x7f89e5f9ce59 [ 106.219918][ T6277] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.219935][ T6277] RSP: 002b:00007f89e6ec2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 106.219958][ T6277] RAX: ffffffffffffffda RBX: 00007f89e6216090 RCX: 00007f89e5f9ce59 [ 106.219974][ T6277] RDX: 0000000000004090 RSI: 0000200000000400 RDI: 0000000000000003 [ 106.219987][ T6277] RBP: 00007f89e6ec2090 R08: 0000000000000000 R09: 0000000000000000 [ 106.220000][ T6277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.220012][ T6277] R13: 00007f89e6216128 R14: 00007f89e6216090 R15: 00007ffd22d51e78 [ 106.220047][ T6277] [ 106.523953][ T6264] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 106.527060][ T6271] netem: incorrect gi model size [ 106.553767][ T6271] netem: change failed [ 106.798511][ T6289] FAULT_INJECTION: forcing a failure. [ 106.798511][ T6289] name failslab, interval 1, probability 0, space 0, times 0 [ 106.819436][ T6289] CPU: 1 UID: 0 PID: 6289 Comm: syz.3.175 Not tainted syzkaller #0 PREEMPT(full) [ 106.819465][ T6289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 106.819477][ T6289] Call Trace: [ 106.819486][ T6289] [ 106.819495][ T6289] dump_stack_lvl+0xe8/0x150 [ 106.819526][ T6289] should_fail_ex+0x40c/0x560 [ 106.819555][ T6289] should_failslab+0xa8/0x100 [ 106.819592][ T6289] ? skb_clone+0x212/0x3a0 [ 106.819613][ T6289] kmem_cache_alloc_noprof+0x87/0x650 [ 106.819647][ T6289] skb_clone+0x212/0x3a0 [ 106.819667][ T6289] __netlink_deliver_tap+0x413/0x860 [ 106.819704][ T6289] ? netlink_deliver_tap+0x2e/0x1b0 [ 106.819731][ T6289] netlink_deliver_tap+0x19c/0x1b0 [ 106.819759][ T6289] netlink_unicast+0x77f/0x940 [ 106.819792][ T6289] netlink_sendmsg+0x813/0xb40 [ 106.819826][ T6289] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.819856][ T6289] ? aa_sock_msg_perm+0xf1/0x1b0 [ 106.819892][ T6289] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 106.819915][ T6289] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.819949][ T6289] ____sys_sendmsg+0x9b9/0xa20 [ 106.819976][ T6289] ? __might_fault+0xaf/0x130 [ 106.820005][ T6289] ? __pfx_____sys_sendmsg+0x10/0x10 [ 106.820040][ T6289] ? import_iovec+0x73/0xa0 [ 106.820064][ T6289] ___sys_sendmsg+0x2a5/0x360 [ 106.820091][ T6289] ? __lock_acquire+0x683/0x2cd0 [ 106.820112][ T6289] ? __pfx____sys_sendmsg+0x10/0x10 [ 106.820175][ T6289] ? __fget_files+0x2a/0x420 [ 106.820196][ T6289] ? __fget_files+0x3a2/0x420 [ 106.820226][ T6289] __x64_sys_sendmsg+0x1bd/0x2a0 [ 106.820257][ T6289] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 106.820292][ T6289] ? __pfx_ksys_write+0x10/0x10 [ 106.820330][ T6289] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.820353][ T6289] do_syscall_64+0x174/0x580 [ 106.820373][ T6289] ? trace_irq_disable+0x3b/0x140 [ 106.820405][ T6289] ? clear_bhb_loop+0x40/0x90 [ 106.820432][ T6289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.820454][ T6289] RIP: 0033:0x7f89e5f9ce59 [ 106.820473][ T6289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.820490][ T6289] RSP: 002b:00007f89e6ee3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 106.820513][ T6289] RAX: ffffffffffffffda RBX: 00007f89e6215fa0 RCX: 00007f89e5f9ce59 [ 106.820529][ T6289] RDX: 0000000000040014 RSI: 0000200000000580 RDI: 0000000000000004 [ 106.820542][ T6289] RBP: 00007f89e6ee3090 R08: 0000000000000000 R09: 0000000000000000 [ 106.820556][ T6289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.820568][ T6289] R13: 00007f89e6216038 R14: 00007f89e6215fa0 R15: 00007ffd22d51e78 [ 106.820602][ T6289] [ 107.100507][ T6299] netlink: 156 bytes leftover after parsing attributes in process `syz.2.173'. [ 107.373421][ T6306] netlink: 52 bytes leftover after parsing attributes in process `syz.2.179'. [ 107.451942][ T6310] syzkaller1: entered promiscuous mode [ 107.471231][ T6310] syzkaller1: entered allmulticast mode [ 108.044307][ T6338] netlink: 76 bytes leftover after parsing attributes in process `syz.3.188'. [ 108.201248][ T6342] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 108.236663][ T6342] bond0: (slave lo): Error: Device can not be enslaved while up [ 108.270264][ T6343] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 108.307735][ T6343] bond0: (slave lo): Error: Device can not be enslaved while up [ 108.316438][ T6342] netlink: 8 bytes leftover after parsing attributes in process `syz.0.190'. [ 108.367959][ T10] IPVS: starting estimator thread 0... [ 108.471088][ T6359] IPVS: using max 28 ests per chain, 67200 per kthread [ 108.710264][ T6370] netlink: 8 bytes leftover after parsing attributes in process `syz.3.199'. [ 109.214818][ T6394] syzkaller1: entered promiscuous mode [ 109.220711][ T6394] syzkaller1: entered allmulticast mode [ 109.917685][ T6425] netem: change failed [ 109.935891][ T6425] netlink: 'syz.4.216': attribute type 2 has an invalid length. [ 109.961644][ T6425] __nla_validate_parse: 4 callbacks suppressed [ 109.961665][ T6425] netlink: 244 bytes leftover after parsing attributes in process `syz.4.216'. [ 110.186768][ T6433] netlink: 8 bytes leftover after parsing attributes in process `syz.2.219'. [ 110.197888][ T6435] netlink: 'syz.1.220': attribute type 10 has an invalid length. [ 110.364221][ T6435] team0: Port device dummy0 added [ 110.369498][ T6438] netlink: set zone limit has 4 unknown bytes [ 110.378641][ T6440] netlink: 16 bytes leftover after parsing attributes in process `syz.3.221'. [ 110.578449][ T6450] netlink: 28 bytes leftover after parsing attributes in process `syz.1.226'. [ 110.594526][ T6446] IPVS: sed: FWM 3 0x00000003 - no destination available [ 110.681927][ T6454] netlink: 4 bytes leftover after parsing attributes in process `syz.4.228'. [ 110.692594][ T5749] IPVS: starting estimator thread 0... [ 110.781110][ T6455] IPVS: using max 26 ests per chain, 62400 per kthread [ 110.889511][ T6454] team0: Port device team_slave_0 removed [ 110.902205][ T6465] netlink: 'syz.3.231': attribute type 8 has an invalid length. [ 110.921861][ T6465] netlink: 4 bytes leftover after parsing attributes in process `syz.3.231'. [ 111.041927][ T6465] veth1_to_team: entered promiscuous mode [ 111.049336][ T6465] gretap0: entered promiscuous mode [ 111.056520][ T6465] dummy0: entered promiscuous mode [ 111.068602][ T6465] debugfs: 'hsr1' already exists in 'hsr' [ 111.082707][ T6465] Cannot create hsr debugfs directory [ 111.101401][ T6465] hsr1: entered promiscuous mode [ 111.106700][ T6460] netlink: 8 bytes leftover after parsing attributes in process `syz.4.228'. [ 111.334559][ T6479] vcan0: tx drop: invalid da for name 0x0000000000000003 [ 111.342216][ T6484] netlink: 84 bytes leftover after parsing attributes in process `syz.1.238'. [ 111.534702][ T6487] netlink: 28 bytes leftover after parsing attributes in process `syz.3.239'. [ 111.568440][ T6494] netlink: 20 bytes leftover after parsing attributes in process `syz.1.242'. [ 111.586562][ T6491] IPVS: sed: FWM 3 0x00000003 - no destination available [ 111.934970][ T6508] netlink: 'syz.3.247': attribute type 8 has an invalid length. [ 111.998465][ T6514] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 111.998730][ T6513] Cannot find add_set index 0 as target [ 112.259150][ T6523] netlink: 'syz.4.251': attribute type 2 has an invalid length. [ 113.207264][ T6561] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 113.500664][ T6593] netlink: 'syz.2.270': attribute type 32 has an invalid length. [ 115.946110][ T6558] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 116.237523][ T6619] netlink: 'syz.1.279': attribute type 21 has an invalid length. [ 116.258278][ T6625] openvswitch: netlink: IPv6 tunnel dst address is zero [ 116.266939][ T6618] __nla_validate_parse: 8 callbacks suppressed [ 116.266957][ T6618] netlink: 4 bytes leftover after parsing attributes in process `syz.4.277'. [ 116.298701][ T6618] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 116.560287][ T6634] netlink: 'syz.1.283': attribute type 32 has an invalid length. [ 116.737212][ T6643] netlink: 28 bytes leftover after parsing attributes in process `syz.0.289'. [ 117.012253][ T6650] netlink: 16 bytes leftover after parsing attributes in process `syz.0.293'. [ 117.116029][ T6657] netlink: 24 bytes leftover after parsing attributes in process `syz.3.295'. [ 117.324087][ T6664] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 117.346491][ T6664] syzkaller1: Refused to change device type [ 117.373511][ T6662] netlink: 'syz.0.297': attribute type 1 has an invalid length. [ 117.384912][ T6662] netlink: 'syz.0.297': attribute type 7 has an invalid length. [ 117.394619][ T6662] netlink: 'syz.0.297': attribute type 8 has an invalid length. [ 117.406791][ T6662] netlink: 208 bytes leftover after parsing attributes in process `syz.0.297'. [ 117.419091][ T6662] NCSI netlink: No device for ifindex 65584 [ 117.633395][ T6673] netlink: 'syz.4.302': attribute type 8 has an invalid length. [ 117.660455][ T6673] netlink: 4 bytes leftover after parsing attributes in process `syz.4.302'. [ 117.703558][ T6677] netlink: 28 bytes leftover after parsing attributes in process `syz.3.303'. [ 118.257251][ T6703] netlink: 212360 bytes leftover after parsing attributes in process `syz.4.312'. [ 118.606801][ T6717] netlink: 'syz.1.317': attribute type 8 has an invalid length. [ 118.633841][ T6717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.317'. [ 118.830263][ T6717] veth1_to_team: entered promiscuous mode [ 118.863175][ T6725] netlink: 28 bytes leftover after parsing attributes in process `syz.3.321'. [ 118.923511][ T6717] gretap0: entered promiscuous mode [ 118.961367][ T6717] dummy0: entered promiscuous mode [ 118.983222][ T6717] dummy0: left promiscuous mode [ 118.998754][ T6717] veth1_to_team: left promiscuous mode [ 119.023278][ T6717] gretap0: left promiscuous mode [ 119.333694][ T6740] netlink: 'syz.1.326': attribute type 32 has an invalid length. [ 120.089118][ T6760] pim6reg527: entered allmulticast mode [ 120.105210][ T6764] x_tables: unsorted entry at hook 2 [ 121.234856][ T6805] xt_ecn: cannot match TCP bits for non-tcp packets [ 121.307676][ T6809] __nla_validate_parse: 1 callbacks suppressed [ 121.307697][ T6809] netlink: 4 bytes leftover after parsing attributes in process `syz.4.346'. [ 121.542548][ T6815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 121.567622][ T6815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 121.824388][ T6824] netlink: 48 bytes leftover after parsing attributes in process `syz.2.348'. [ 121.897014][ T6824] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 122.066505][ T6836] netlink: 8 bytes leftover after parsing attributes in process `syz.4.352'. [ 122.823026][ T6859] netlink: 'syz.3.358': attribute type 32 has an invalid length. [ 123.022322][ T6862] geneve2: entered promiscuous mode [ 123.030385][ T6841] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 123.041658][ T6862] netlink: 210960 bytes leftover after parsing attributes in process `syz.3.359'. [ 123.087870][ T6861] netlink: 5 bytes leftover after parsing attributes in process `syz.3.359'. [ 123.382193][ T6872] netlink: 72 bytes leftover after parsing attributes in process `syz.2.363'. [ 123.411676][ T6872] netlink: 'syz.2.363': attribute type 9 has an invalid length. [ 123.465423][ T6877] netlink: 24 bytes leftover after parsing attributes in process `syz.1.365'. [ 123.496361][ T6872] netlink: 12 bytes leftover after parsing attributes in process `syz.2.363'. [ 123.809892][ T6890] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 124.098853][ T6901] netlink: 'syz.3.370': attribute type 32 has an invalid length. [ 124.244235][ T6904] netlink: 'syz.1.374': attribute type 1 has an invalid length. [ 124.310763][ T6904] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 124.917869][ T6710] Set syz1 is full, maxelem 65536 reached [ 125.112245][ T6907] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 125.237579][ T6945] geneve2: entered promiscuous mode [ 125.409329][ T6951] netlink: 'syz.1.385': attribute type 32 has an invalid length. [ 125.433168][ T6955] netlink: 'syz.4.388': attribute type 2 has an invalid length. [ 125.639516][ T6960] IPVS: sed: FWM 3 0x00000003 - no destination available [ 125.856465][ T57] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 125.888515][ T57] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 125.899819][ T6977] netlink: 8 bytes leftover after parsing attributes in process `syz.3.395'. [ 126.038137][ T57] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 126.058872][ T6985] netlink: 'syz.2.398': attribute type 29 has an invalid length. [ 126.067211][ T57] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 126.085948][ T6985] netlink: 'syz.2.398': attribute type 29 has an invalid length. [ 126.089726][ T6982] netlink: 8 bytes leftover after parsing attributes in process `syz.4.396'. [ 126.097985][ T6986] netlink: 'syz.2.398': attribute type 29 has an invalid length. [ 126.270314][ T6992] tipc: Can't bind to reserved service type 3 [ 126.439066][ T7001] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 126.651721][ T6972] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 126.877205][ T7013] __nla_validate_parse: 1 callbacks suppressed [ 126.877226][ T7013] netlink: 24 bytes leftover after parsing attributes in process `syz.3.408'. [ 126.976576][ T7017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.410'. [ 130.117594][ T7024] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 130.398979][ T7055] netlink: 60 bytes leftover after parsing attributes in process `syz.2.422'. [ 130.425915][ T7060] netlink: 24 bytes leftover after parsing attributes in process `syz.3.423'. [ 130.631795][ T7066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.426'. [ 130.805909][ T7078] netlink: 124 bytes leftover after parsing attributes in process `syz.4.430'. [ 130.903118][ T7080] netlink: 52 bytes leftover after parsing attributes in process `syz.3.431'. [ 131.098023][ T7086] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 131.149893][ T7093] netlink: 12 bytes leftover after parsing attributes in process `syz.3.437'. [ 131.273212][ T7096] netlink: 20 bytes leftover after parsing attributes in process `syz.1.438'. [ 131.545675][ T7113] netlink: 'syz.1.441': attribute type 32 has an invalid length. [ 131.805623][ T7124] netlink: 8 bytes leftover after parsing attributes in process `syz.1.446'. [ 131.988738][ T7137] xt_ecn: cannot match TCP bits for non-tcp packets [ 132.924530][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.935031][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.504107][ T7148] bond0: Caught tx_queue_len zero misconfig [ 133.677015][ T7160] can: request_module (can-proto-4) failed. [ 133.790452][ T7162] syzkaller0: entered promiscuous mode [ 133.796473][ T7162] syzkaller0: entered allmulticast mode [ 134.885826][ T7130] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 134.960297][ T7171] netlink: 'syz.4.456': attribute type 32 has an invalid length. [ 135.213770][ T7181] netlink: 12 bytes leftover after parsing attributes in process `syz.2.458'. [ 135.297749][ T7181] IPVS: set_ctl: invalid protocol: 108 172.20.20.49:63485 [ 135.319620][ T7181] IPVS: set_ctl: invalid protocol: 1 100.1.1.1:20004 [ 135.331181][ T7183] netlink: 112 bytes leftover after parsing attributes in process `syz.4.462'. [ 135.432127][ T7189] xt_nat: multiple ranges no longer supported [ 135.474602][ T7191] netlink: 8 bytes leftover after parsing attributes in process `syz.1.464'. [ 135.657338][ T7199] netlink: 'syz.0.468': attribute type 32 has an invalid length. [ 135.817609][ T7205] netlink: 14 bytes leftover after parsing attributes in process `syz.2.470'. [ 135.917476][ T7205] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 135.970273][ T7210] netlink: 20 bytes leftover after parsing attributes in process `syz.2.470'. [ 135.982816][ T7205] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 136.034500][ T7214] netlink: 'syz.0.473': attribute type 8 has an invalid length. [ 136.047312][ T7214] netlink: 4 bytes leftover after parsing attributes in process `syz.0.473'. [ 136.053667][ T7205] bond0 (unregistering): Released all slaves [ 136.256076][ T7219] netlink: 20 bytes leftover after parsing attributes in process `syz.1.475'. [ 136.297270][ T7219] netlink: 'syz.1.475': attribute type 1 has an invalid length. [ 136.315822][ T7219] netlink: 24 bytes leftover after parsing attributes in process `syz.1.475'. [ 136.322800][ T7221] netlink: 16 bytes leftover after parsing attributes in process `syz.4.476'. [ 136.344097][ T7219] netlink: 8 bytes leftover after parsing attributes in process `syz.1.475'. [ 136.559533][ T7233] netlink: 'syz.2.480': attribute type 1 has an invalid length. [ 136.580047][ T7233] netlink: 'syz.2.480': attribute type 1 has an invalid length. [ 136.918995][ T7215] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 137.008276][ T7258] netlink: 'syz.2.488': attribute type 8 has an invalid length. [ 137.018004][ T7253] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 137.370777][ T7273] IPVS: set_ctl: invalid protocol: 103 172.20.20.170:20002 [ 137.917194][ T7298] netlink: 'syz.0.505': attribute type 8 has an invalid length. [ 138.528990][ T7321] hsr_slave_1 (unregistering): left promiscuous mode [ 138.576612][ T7329] netlink: 'syz.3.516': attribute type 4 has an invalid length. [ 138.941485][ T7342] : renamed from bond0 (while UP) [ 139.195106][ T7359] netlink: 'syz.1.523': attribute type 8 has an invalid length. [ 139.226158][ T7359] veth1_to_team: entered promiscuous mode [ 139.247577][ T7359] gretap0: entered promiscuous mode [ 139.274596][ T7359] dummy0: entered promiscuous mode [ 139.290363][ T7359] dummy0: left promiscuous mode [ 139.312003][ T7359] veth1_to_team: left promiscuous mode [ 139.326217][ T7359] gretap0: left promiscuous mode [ 140.494143][ T7420] __nla_validate_parse: 20 callbacks suppressed [ 140.494166][ T7420] netlink: 28 bytes leftover after parsing attributes in process `syz.4.544'. [ 140.553144][ T7423] netlink: 24 bytes leftover after parsing attributes in process `syz.2.545'. [ 141.011532][ T7446] IPVS: ip_vs_add_dest(): server weight less than zero [ 141.184972][ T7457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.556'. [ 141.379857][ T7471] trusted_key: syz.1.560 sent an empty control message without MSG_MORE. [ 141.546977][ T7477] netlink: 'syz.1.563': attribute type 8 has an invalid length. [ 141.555428][ T7477] netlink: 4 bytes leftover after parsing attributes in process `syz.1.563'. [ 141.571016][ T7477] veth1_to_team: entered promiscuous mode [ 141.577945][ T7477] gretap0: entered promiscuous mode [ 141.586996][ T7477] dummy0: entered promiscuous mode [ 141.594281][ T7477] dummy0: left promiscuous mode [ 141.599710][ T7477] veth1_to_team: left promiscuous mode [ 141.607057][ T7477] gretap0: left promiscuous mode [ 144.116801][ T7453] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 144.376402][ T7499] netlink: 12 bytes leftover after parsing attributes in process `syz.1.570'. [ 144.495813][ T7508] netlink: 'syz.4.571': attribute type 32 has an invalid length. [ 144.507816][ T7510] netlink: 8 bytes leftover after parsing attributes in process `syz.1.572'. [ 144.630115][ T7517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.574'. [ 145.379418][ T7548] sctp: [Deprecated]: syz.0.586 (pid 7548) Use of struct sctp_assoc_value in delayed_ack socket option. [ 145.379418][ T7548] Use struct sctp_sack_info instead [ 145.465774][ T7547] tipc: Started in network mode [ 145.481837][ T7547] tipc: Node identity d6d9674272be, cluster identity 4711 [ 145.499521][ T7547] tipc: Enabled bearer , priority 0 [ 145.629851][ T7547] syzkaller0: entered promiscuous mode [ 145.654080][ T7547] syzkaller0: entered allmulticast mode [ 145.673131][ T7565] netlink: 8 bytes leftover after parsing attributes in process `syz.0.590'. [ 145.682446][ T7547] tipc: Resetting bearer [ 145.897416][ T7544] tipc: Resetting bearer [ 147.509601][ T7544] tipc: Disabling bearer [ 147.551519][ T7590] tipc: Started in network mode [ 147.560698][ T7590] tipc: Node identity 2e79c0ffcc71, cluster identity 4711 [ 147.580564][ T7590] tipc: Enabled bearer , priority 0 [ 147.817809][ T7591] syzkaller0: entered promiscuous mode [ 147.832596][ T7591] syzkaller0: entered allmulticast mode [ 147.848886][ T7591] tipc: Resetting bearer [ 147.870171][ T5765] tipc: Node number set to 2758240066 [ 147.905462][ T7588] tipc: Resetting bearer [ 147.918839][ T7609] netlink: 12 bytes leftover after parsing attributes in process `syz.4.600'. [ 147.959296][ T7612] netlink: 12 bytes leftover after parsing attributes in process `syz.4.600'. [ 148.159762][ T7620] netlink: 4 bytes leftover after parsing attributes in process `syz.3.597'. [ 148.248912][ T7624] xt_hashlimit: invalid interval [ 148.572723][ T7598] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 148.577924][ T7631] netlink: 8 bytes leftover after parsing attributes in process `syz.2.605'. [ 149.878271][ T7588] tipc: Disabling bearer [ 149.889169][ T7606] veth0: entered promiscuous mode [ 149.896827][ T7611] veth0: left promiscuous mode [ 149.945447][ T5765] tipc: Node number set to 3792224511 [ 150.094272][ T7636] netem: change failed [ 150.118545][ T29] audit: type=1800 audit(1781634291.780:3): pid=7640 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.608" name="memory.events" dev="tmpfs" ino=538 res=0 errno=0 [ 150.144270][ T7638] netlink: 28 bytes leftover after parsing attributes in process `syz.1.607'. [ 150.194736][ T7636] netem: change failed [ 150.233381][ T7636] netem: change failed [ 150.253142][ T7644] netlink: 4 bytes leftover after parsing attributes in process `syz.2.609'. [ 150.270601][ T7636] netem: change failed [ 150.326416][ T7644] bridge_slave_1: left allmulticast mode [ 150.334412][ T7644] bridge_slave_1: left promiscuous mode [ 150.353448][ T7644] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.380190][ T7649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.611'. [ 150.393810][ T7644] bridge_slave_0: left allmulticast mode [ 150.406347][ T7644] bridge_slave_0: left promiscuous mode [ 150.412246][ T7652] netlink: 'syz.0.612': attribute type 32 has an invalid length. [ 150.420792][ T7644] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.567777][ T7636] netem: change failed [ 150.577458][ T7636] netem: change failed [ 150.594331][ T7636] netem: change failed [ 150.658215][ T7636] netem: change failed [ 150.694707][ T7636] netem: change failed [ 150.718420][ T7659] netlink: 'syz.3.614': attribute type 5 has an invalid length. [ 150.745953][ T7636] netem: change failed [ 150.770379][ T7636] netem: change failed [ 150.803953][ T7636] netem: change failed [ 150.826436][ T7636] netem: change failed [ 150.873665][ T7636] netem: change failed [ 151.005200][ T7675] netlink: 8 bytes leftover after parsing attributes in process `syz.2.619'. [ 151.073857][ T7676] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 151.178840][ T1014] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 151.488148][ T7700] netlink: 'syz.3.628': attribute type 3 has an invalid length. [ 151.496371][ T7700] netlink: 224 bytes leftover after parsing attributes in process `syz.3.628'. [ 154.143173][ T7685] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 154.618225][ T7731] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 154.699350][ T1014] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 155.015267][ T7749] netlink: 20 bytes leftover after parsing attributes in process `syz.0.644'. [ 155.102837][ T7758] netlink: 16 bytes leftover after parsing attributes in process `syz.4.645'. [ 155.312906][ T7768] netlink: 32 bytes leftover after parsing attributes in process `syz.3.650'. [ 155.583836][ T7775] netlink: 4 bytes leftover after parsing attributes in process `syz.4.653'. [ 155.668238][ T7775] macsec1: entered promiscuous mode [ 155.697307][ T7775] bridge0: entered promiscuous mode [ 155.717245][ T7775] macsec1: entered allmulticast mode [ 155.728837][ T7775] bridge0: entered allmulticast mode [ 155.750388][ T7775] bridge0: port 3(macsec1) entered blocking state [ 155.770654][ T7775] bridge0: port 3(macsec1) entered disabled state [ 155.806810][ T7775] bridge0: left allmulticast mode [ 155.847136][ T7786] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 155.874596][ T5772] bridge0: left promiscuous mode [ 155.945071][ T1127] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 155.971293][ T7791] netlink: 16215 bytes leftover after parsing attributes in process `syz.1.658'. [ 155.999876][ T7793] netlink: 20 bytes leftover after parsing attributes in process `syz.0.659'. [ 156.298327][ T7805] x_tables: duplicate underflow at hook 1 [ 156.615419][ T7821] FAULT_INJECTION: forcing a failure. [ 156.615419][ T7821] name failslab, interval 1, probability 0, space 0, times 0 [ 156.663024][ T7821] CPU: 0 UID: 0 PID: 7821 Comm: syz.0.670 Not tainted syzkaller #0 PREEMPT(full) [ 156.663054][ T7821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 156.663067][ T7821] Call Trace: [ 156.663075][ T7821] [ 156.663084][ T7821] dump_stack_lvl+0xe8/0x150 [ 156.663125][ T7821] should_fail_ex+0x40c/0x560 [ 156.663154][ T7821] should_failslab+0xa8/0x100 [ 156.663191][ T7821] __kmalloc_noprof+0xe8/0x750 [ 156.663223][ T7821] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 156.663258][ T7821] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 156.663293][ T7821] genl_family_rcv_msg_doit+0xda/0x340 [ 156.663326][ T7821] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 156.663361][ T7821] ? apparmor_capable+0x126/0x170 [ 156.663387][ T7821] ? bpf_lsm_capable+0x9/0x20 [ 156.663408][ T7821] ? security_capable+0x7e/0x2c0 [ 156.663445][ T7821] genl_rcv_msg+0x614/0x7a0 [ 156.663476][ T7821] ? __pfx_genl_rcv_msg+0x10/0x10 [ 156.663500][ T7821] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 156.663529][ T7821] ? __pfx_nl80211_trigger_scan+0x10/0x10 [ 156.663559][ T7821] ? __pfx_nl80211_post_doit+0x10/0x10 [ 156.663591][ T7821] ? __pfx_ref_tracker_free+0x10/0x10 [ 156.663615][ T7821] ? __asan_memcpy+0x40/0x70 [ 156.663640][ T7821] ? __skb_clone+0x5c/0x6c0 [ 156.663680][ T7821] netlink_rcv_skb+0x226/0x4a0 [ 156.663713][ T7821] ? __pfx_genl_rcv_msg+0x10/0x10 [ 156.663738][ T7821] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 156.663791][ T7821] ? down_read+0x270/0x2e0 [ 156.663814][ T7821] ? genl_rcv+0xd/0x40 [ 156.663838][ T7821] genl_rcv+0x28/0x40 [ 156.663860][ T7821] netlink_unicast+0x7bb/0x940 [ 156.663901][ T7821] netlink_sendmsg+0x813/0xb40 [ 156.663944][ T7821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.663981][ T7821] ? aa_sock_msg_perm+0xf1/0x1b0 [ 156.664015][ T7821] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 156.664043][ T7821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 156.664078][ T7821] ____sys_sendmsg+0x9b9/0xa20 [ 156.664111][ T7821] ? __might_fault+0xaf/0x130 [ 156.664147][ T7821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 156.664190][ T7821] ? import_iovec+0x73/0xa0 [ 156.664221][ T7821] ___sys_sendmsg+0x2a5/0x360 [ 156.664253][ T7821] ? __lock_acquire+0x683/0x2cd0 [ 156.664281][ T7821] ? __pfx____sys_sendmsg+0x10/0x10 [ 156.664356][ T7821] ? __fget_files+0x2a/0x420 [ 156.664381][ T7821] ? __fget_files+0x3a2/0x420 [ 156.664420][ T7821] __x64_sys_sendmsg+0x1bd/0x2a0 [ 156.664457][ T7821] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 156.664501][ T7821] ? __pfx_ksys_write+0x10/0x10 [ 156.664550][ T7821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.664575][ T7821] do_syscall_64+0x174/0x580 [ 156.664595][ T7821] ? trace_irq_disable+0x3b/0x140 [ 156.664628][ T7821] ? clear_bhb_loop+0x40/0x90 [ 156.664655][ T7821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.664677][ T7821] RIP: 0033:0x7f6867b9ce59 [ 156.664706][ T7821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.664723][ T7821] RSP: 002b:00007f68689f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 156.664750][ T7821] RAX: ffffffffffffffda RBX: 00007f6867e15fa0 RCX: 00007f6867b9ce59 [ 156.664766][ T7821] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 156.664779][ T7821] RBP: 00007f68689f8090 R08: 0000000000000000 R09: 0000000000000000 [ 156.664792][ T7821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 156.664804][ T7821] R13: 00007f6867e16038 R14: 00007f6867e15fa0 R15: 00007ffe154c2418 [ 156.664840][ T7821] [ 156.675831][ T7820] netlink: 68 bytes leftover after parsing attributes in process `syz.1.669'. [ 157.221579][ T7831] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 157.286684][ T13] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 157.575757][ T7858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.680'. [ 157.827134][ T7865] netlink: 10636 bytes leftover after parsing attributes in process `syz.3.683'. [ 157.860426][ T7865] openvswitch: netlink: Flow key attr not present in new flow. [ 157.893066][ T7865] netlink: 4 bytes leftover after parsing attributes in process `syz.3.683'. [ 158.092751][ T7873] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 158.118152][ T7873] syzkaller1: linktype set to 823 [ 158.155536][ T7879] team_slave_1: Device is already in use. [ 158.372540][ T7892] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 158.476155][ T13] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 158.763737][ T7916] netlink: 104 bytes leftover after parsing attributes in process `syz.0.701'. [ 158.783801][ T7910] bond1: Unable to set down delay as MII monitoring is disabled [ 158.795508][ T7910] bond1 (unregistering): Released all slaves [ 159.228688][ T7933] Bluetooth: MGMT ver 1.23 [ 159.365980][ T7941] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 159.443021][ T1127] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 159.576448][ T7950] netlink: 24 bytes leftover after parsing attributes in process `syz.0.712'. [ 159.794776][ T7958] tipc: Enabling of bearer rejected, failed to enable media [ 160.585448][ T7991] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 162.835658][ T7968] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 163.148269][ T8009] netlink: 24 bytes leftover after parsing attributes in process `syz.0.730'. [ 163.329095][ T8015] netlink: 'syz.1.731': attribute type 32 has an invalid length. [ 163.446139][ T29] audit: type=1800 audit(1781634305.110:4): pid=8020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.733" name="memory.events" dev="tmpfs" ino=800 res=0 errno=0 [ 163.945172][ T8038] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 164.145933][ T8058] netlink: 'syz.2.745': attribute type 32 has an invalid length. [ 164.388911][ T8063] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.748'. [ 164.415223][ T8071] netlink: 16 bytes leftover after parsing attributes in process `syz.4.750'. [ 164.835537][ T8096] netlink: 16 bytes leftover after parsing attributes in process `syz.0.756'. [ 164.916386][ T8091] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 165.036139][ T8103] netlink: 24 bytes leftover after parsing attributes in process `syz.4.759'. [ 165.065270][ T8105] netlink: 'syz.1.760': attribute type 32 has an invalid length. [ 168.170057][ T8109] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 168.409456][ T8156] netlink: 24 bytes leftover after parsing attributes in process `syz.1.773'. [ 168.561304][ T8164] netlink: 12 bytes leftover after parsing attributes in process `syz.2.775'. [ 168.709450][ T8170] x_tables: duplicate underflow at hook 1 [ 168.887456][ T8183] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 169.194681][ T8178] syzkaller0: entered promiscuous mode [ 169.227742][ T8178] syzkaller0: entered allmulticast mode [ 169.309280][ T8203] netlink: 'syz.0.787': attribute type 7 has an invalid length. [ 169.330825][ T8203] netlink: 'syz.0.787': attribute type 7 has an invalid length. [ 169.342509][ T8203] netlink: 4 bytes leftover after parsing attributes in process `syz.0.787'. [ 169.415982][ T8209] netlink: 24 bytes leftover after parsing attributes in process `syz.0.788'. [ 169.608193][ T8215] sctp: [Deprecated]: syz.0.790 (pid 8215) Use of struct sctp_assoc_value in delayed_ack socket option. [ 169.608193][ T8215] Use struct sctp_sack_info instead [ 172.019919][ T8192] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 172.290851][ T8254] netlink: 24 bytes leftover after parsing attributes in process `syz.0.800'. [ 172.367333][ T8250] netlink: 40 bytes leftover after parsing attributes in process `syz.1.798'. [ 172.467119][ T8257] openvswitch: netlink: IPv4 tun info is not correct [ 172.714724][ T8270] netlink: 28 bytes leftover after parsing attributes in process `syz.4.806'. [ 172.844887][ T8282] netlink: 'syz.2.807': attribute type 32 has an invalid length. [ 172.942604][ T8267] netlink: 8 bytes leftover after parsing attributes in process `syz.0.804'. [ 173.022787][ T8287] netlink: 12 bytes leftover after parsing attributes in process `syz.2.809'. [ 173.023070][ T8291] netlink: 12 bytes leftover after parsing attributes in process `syz.2.809'. [ 175.481612][ T8268] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 175.696424][ T8309] netlink: 24 bytes leftover after parsing attributes in process `syz.1.815'. [ 175.725606][ T8306] lo: entered allmulticast mode [ 175.840293][ T8306] lo: left allmulticast mode [ 175.955455][ T8326] netlink: 'syz.1.819': attribute type 32 has an invalid length. [ 176.595053][ T8358] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 176.788009][ T8364] netlink: 'syz.1.829': attribute type 4 has an invalid length. [ 177.625309][ T8414] syzkaller0: entered promiscuous mode [ 177.641565][ T8414] syzkaller0: entered allmulticast mode [ 177.655698][ T8414] netlink: 72 bytes leftover after parsing attributes in process `syz.1.845'. [ 177.665683][ T8414] netlink: 8 bytes leftover after parsing attributes in process `syz.1.845'. [ 177.993596][ T8436] netlink: 8 bytes leftover after parsing attributes in process `syz.1.851'. [ 178.211125][ T8439] netlink: 'syz.2.852': attribute type 2 has an invalid length. [ 180.808961][ T8426] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 181.037915][ T8467] netlink: 8 bytes leftover after parsing attributes in process `syz.0.863'. [ 181.206807][ T8481] sctp: [Deprecated]: syz.2.865 (pid 8481) Use of int in maxseg socket option. [ 181.206807][ T8481] Use struct sctp_assoc_value instead [ 181.276540][ T8483] sctp: [Deprecated]: syz.0.867 (pid 8483) Use of struct sctp_assoc_value in delayed_ack socket option. [ 181.276540][ T8483] Use struct sctp_sack_info instead [ 181.305515][ T8483] sctp: [Deprecated]: syz.0.867 (pid 8483) Use of struct sctp_assoc_value in delayed_ack socket option. [ 181.305515][ T8483] Use struct sctp_sack_info instead [ 181.644387][ T8501] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 181.729272][ T8507] netlink: 20 bytes leftover after parsing attributes in process `syz.1.875'. [ 181.790140][ T8511] netlink: 8 bytes leftover after parsing attributes in process `syz.2.877'. [ 181.952701][ T8518] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 181.954173][ T8519] 8021q: VLANs not supported on ip_vti0 [ 182.265704][ T8540] sctp: [Deprecated]: syz.4.885 (pid 8540) Use of int in maxseg socket option. [ 182.265704][ T8540] Use struct sctp_assoc_value instead [ 182.297279][ T8542] netlink: 'syz.0.886': attribute type 11 has an invalid length. [ 182.549993][ T8549] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 182.552776][ T8552] bond1 (unregistering): Released all slaves [ 182.850476][ T8567] netlink: 8 bytes leftover after parsing attributes in process `syz.0.892'. [ 183.176844][ T8583] netlink: 'syz.1.898': attribute type 32 has an invalid length. [ 183.392512][ T8591] sock: sock_timestamping_bind_phc: sock not bind to device [ 183.439231][ T8593] netlink: 'syz.3.903': attribute type 29 has an invalid length. [ 183.481067][ T8593] netlink: 4 bytes leftover after parsing attributes in process `syz.3.903'. [ 183.553358][ T8603] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 183.804962][ T8615] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.851315][ T8616] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.909458][ T8614] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 184.106166][ T8628] netlink: 28 bytes leftover after parsing attributes in process `syz.3.913'. [ 184.117839][ T8628] ipvlan1: entered allmulticast mode [ 184.126166][ T8628] veth0_vlan: entered allmulticast mode [ 184.160480][ T8630] netlink: 148 bytes leftover after parsing attributes in process `syz.2.914'. [ 184.356104][ T8648] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 184.387476][ T8650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 184.527542][ T8654] netlink: 212344 bytes leftover after parsing attributes in process `syz.2.919'. [ 184.616573][ T8656] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 184.628087][ T8662] netlink: 16 bytes leftover after parsing attributes in process `syz.2.921'. [ 184.698393][ T13] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 184.717135][ T8664] xt_hashlimit: size too large, truncated to 1048576 [ 184.790639][ T8666] IPVS: ovf: SCTP 172.20.20.187:0 - no destination available [ 184.882616][ T8670] tipc: Enabling of bearer rejected, failed to enable media [ 184.929068][ T8672] netlink: 8 bytes leftover after parsing attributes in process `syz.0.924'. [ 185.374661][ T8691] netlink: 'syz.0.931': attribute type 32 has an invalid length. [ 185.624407][ T8700] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 185.747564][ T8709] veth0: entered promiscuous mode [ 185.776985][ T1014] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x10 [ 185.901543][ T8711] netlink: 'syz.2.935': attribute type 4 has an invalid length. [ 186.162637][ T8729] __nla_validate_parse: 4 callbacks suppressed [ 186.162657][ T8729] netlink: 24 bytes leftover after parsing attributes in process `syz.3.938'. [ 186.386391][ T8737] netlink: 'syz.0.943': attribute type 32 has an invalid length. [ 186.406511][ T8745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.946'. [ 186.435362][ T8745] netlink: 24 bytes leftover after parsing attributes in process `syz.2.946'. [ 186.474423][ T8748] netlink: 24 bytes leftover after parsing attributes in process `syz.1.942'. [ 186.866280][ T8767] mac80211_hwsim hwsim14 ÿ: renamed from wlan1 [ 187.036338][ T8775] ip6tnl2: entered allmulticast mode [ 187.152717][ T8784] netlink: 'syz.2.958': attribute type 1 has an invalid length. [ 187.349645][ T8785] bond0: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 187.385579][ T8785] bond0: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 187.421549][ T8785] bond0: (slave ip6gre1): making interface the new active one [ 187.434839][ T8785] bond0: (slave ip6gre1): Enslaving as an active interface with an up link [ 188.086792][ T8820] macsec1: entered promiscuous mode [ 188.096226][ T8820] bond0: entered promiscuous mode [ 188.112104][ T8820] bond_slave_0: entered promiscuous mode [ 188.127573][ T8820] bond_slave_1: entered promiscuous mode [ 188.159033][ T8820] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 188.168943][ T8825] xt_hashlimit: size too large, truncated to 1048576 [ 188.186802][ T8820] bond0: left promiscuous mode [ 188.234969][ T8829] sctp: [Deprecated]: syz.2.975 (pid 8829) Use of int in max_burst socket option. [ 188.234969][ T8829] Use struct sctp_assoc_value instead [ 188.306317][ T5742] bond_slave_0: left promiscuous mode [ 188.313742][ T5742] bond_slave_1: left promiscuous mode [ 188.354388][ T8833] netlink: 'syz.1.977': attribute type 29 has an invalid length. [ 188.375628][ T8837] netlink: 'syz.1.977': attribute type 29 has an invalid length. [ 188.619966][ T8845] netlink: 8 bytes leftover after parsing attributes in process `syz.1.980'. [ 188.959130][ T8860] netlink: 'syz.1.985': attribute type 33 has an invalid length. [ 189.144074][ T8860] bond0: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 189.231810][ T8860] bond0 (unregistering): Released all slaves [ 189.748521][ T8891] netlink: 8 bytes leftover after parsing attributes in process `syz.4.994'. [ 190.012206][ T8912] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.1001'. [ 190.286070][ T8920] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1004'. [ 190.648868][ T8935] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1011'. [ 190.823595][ T8945] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1015'. [ 191.357012][ T8972] Driver unsupported XDP return value 0 on prog (id 287) dev N/A, expect packet loss! [ 191.428927][ T8978] netlink: 'syz.2.1030': attribute type 32 has an invalid length. [ 191.506278][ T8981] __nla_validate_parse: 1 callbacks suppressed [ 191.506297][ T8981] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1029'. [ 191.716085][ T8998] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.1033'. [ 192.046429][ T9014] syz.1.1036: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 192.064917][ T9014] CPU: 0 UID: 0 PID: 9014 Comm: syz.1.1036 Not tainted syzkaller #0 PREEMPT(full) [ 192.064947][ T9014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 192.064960][ T9014] Call Trace: [ 192.064968][ T9014] [ 192.064978][ T9014] dump_stack_lvl+0xe8/0x150 [ 192.065010][ T9014] warn_alloc+0x249/0x340 [ 192.065046][ T9014] ? __pfx_stack_trace_save+0x10/0x10 [ 192.065087][ T9014] ? __pfx_warn_alloc+0x10/0x10 [ 192.065126][ T9014] ? __kasan_kmalloc+0x93/0xb0 [ 192.065157][ T9014] ? __kmalloc_cache_noprof+0x318/0x660 [ 192.065188][ T9014] ? xskq_create+0x56/0x170 [ 192.065217][ T9014] ? xsk_init_queue+0x8a/0xe0 [ 192.065244][ T9014] ? xsk_setsockopt+0x52a/0x960 [ 192.065271][ T9014] ? do_sock_setsockopt+0x17c/0x1b0 [ 192.065302][ T9014] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 192.065334][ T9014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.065364][ T9014] __vmalloc_node_range_noprof+0x12c/0x1730 [ 192.065427][ T9014] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 192.065467][ T9014] ? __kasan_kmalloc+0x93/0xb0 [ 192.065507][ T9014] vmalloc_user_noprof+0xad/0xe0 [ 192.065539][ T9014] ? xskq_create+0xbf/0x170 [ 192.065571][ T9014] xskq_create+0xbf/0x170 [ 192.065606][ T9014] xsk_init_queue+0x8a/0xe0 [ 192.065639][ T9014] xsk_setsockopt+0x52a/0x960 [ 192.065669][ T9014] ? __fget_files+0x2a/0x420 [ 192.065698][ T9014] ? __pfx_xsk_setsockopt+0x10/0x10 [ 192.065725][ T9014] ? __pfx_aa_sk_perm+0x10/0x10 [ 192.065750][ T9014] ? aa_sock_opt_perm+0xff/0x1a0 [ 192.065776][ T9014] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 192.065827][ T9014] ? __pfx_xsk_setsockopt+0x10/0x10 [ 192.065858][ T9014] do_sock_setsockopt+0x17c/0x1b0 [ 192.065894][ T9014] __x64_sys_setsockopt+0x13d/0x1b0 [ 192.065929][ T9014] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.065954][ T9014] do_syscall_64+0x174/0x580 [ 192.065974][ T9014] ? trace_irq_disable+0x3b/0x140 [ 192.066012][ T9014] ? clear_bhb_loop+0x40/0x90 [ 192.066040][ T9014] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 192.066062][ T9014] RIP: 0033:0x7fa66379ce59 [ 192.066082][ T9014] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 192.066100][ T9014] RSP: 002b:00007fa6645bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 192.066123][ T9014] RAX: ffffffffffffffda RBX: 00007fa663a16180 RCX: 00007fa66379ce59 [ 192.066139][ T9014] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000a [ 192.066152][ T9014] RBP: 00007fa663832d6f R08: 0000000000000004 R09: 0000000000000000 [ 192.066166][ T9014] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 192.066179][ T9014] R13: 00007fa663a16218 R14: 00007fa663a16180 R15: 00007fff874dff78 [ 192.066214][ T9014] [ 192.342762][ T9014] Mem-Info: [ 192.346423][ T9014] active_anon:5891 inactive_anon:0 isolated_anon:0 [ 192.346423][ T9014] active_file:3383 inactive_file:39991 isolated_file:0 [ 192.346423][ T9014] unevictable:768 dirty:75 writeback:0 [ 192.346423][ T9014] slab_reclaimable:10206 slab_unreclaimable:96518 [ 192.346423][ T9014] mapped:29464 shmem:1288 pagetables:1181 [ 192.346423][ T9014] sec_pagetables:0 bounce:0 [ 192.346423][ T9014] kernel_misc_reclaimable:0 [ 192.346423][ T9014] free:1330871 free_pcp:9550 free_cma:0 [ 192.392649][ T9014] Node 0 active_anon:23564kB inactive_anon:0kB active_file:13532kB inactive_file:159764kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117856kB dirty:300kB writeback:0kB shmem:3616kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12600kB pagetables:4672kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 192.429288][ T9014] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 192.465312][ T9014] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 192.496049][ T9014] lowmem_reserve[]: 0 2493 2494 2494 2494 [ 192.503142][ T9014] Node 0 DMA32 free:1371700kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23664kB inactive_anon:0kB active_file:13532kB inactive_file:159764kB unevictable:1536kB writepending:300kB zspages:0kB present:3129332kB managed:2553212kB mlocked:0kB bounce:0kB free_pcp:37660kB local_pcp:19128kB free_cma:0kB [ 192.537401][ T9014] lowmem_reserve[]: 0 0 0 0 0 [ 192.542513][ T9014] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:692kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:8kB free_cma:0kB [ 192.572263][ T9014] lowmem_reserve[]: 0 0 0 0 0 [ 192.577144][ T9014] Node 1 Normal free:3936424kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 192.609177][ T9014] lowmem_reserve[]: 0 0 0 0 0 [ 192.615083][ T9014] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 192.628013][ T9014] Node 0 DMA32: 3543*4kB (UME) 1573*8kB (UME) 759*16kB (UM) 245*32kB (UME) 105*64kB (UME) 38*128kB (UE) 26*256kB (UE) 8*512kB (UE) 0*1024kB 10*2048kB (UME) 313*4096kB (M) = 1371604kB [ 192.648121][ T9014] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 192.659933][ T9014] Node 1 Normal: 4*4kB (UM) 3*8kB (UM) 6*16kB (UM) 9*32kB (UM) 4*64kB (UM) 6*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 0*2048kB 960*4096kB (M) = 3936424kB [ 192.676695][ T9014] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 192.686953][ T9014] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 192.696480][ T9014] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 192.706579][ T9014] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 192.715996][ T9014] 44658 total pagecache pages [ 192.720717][ T9014] 0 pages in swap cache [ 192.725243][ T9014] Free swap = 124996kB [ 192.729487][ T9014] Total swap = 124996kB [ 192.734728][ T9014] 2097051 pages RAM [ 192.738614][ T9014] 0 pages HighMem/MovableOnly [ 192.743784][ T9014] 426960 pages reserved [ 192.748022][ T9014] 0 pages cma reserved [ 192.870468][ T9025] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1042'. [ 192.924104][ T9025] nftables ruleset with unbound set [ 194.362422][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.369029][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.560142][ T8992] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 194.889561][ T9048] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.1047'. [ 194.989798][ T9053] lo: Caught tx_queue_len zero misconfig [ 195.018020][ T9053] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1051'. [ 195.225245][ T9063] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1056'. [ 195.239365][ T9061] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1055'. [ 195.292660][ T9067] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1056'. [ 195.736369][ T9091] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1063'. [ 195.997295][ T9104] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.1066'. [ 196.088458][ T29] audit: type=1804 audit(1781634337.750:5): pid=9109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1067" name="/newroot/222/cgroup.controllers" dev="tmpfs" ino=1143 res=1 errno=0 [ 196.147373][ T29] audit: type=1800 audit(1781634337.790:6): pid=9109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1067" name="cgroup.controllers" dev="tmpfs" ino=1143 res=0 errno=0 [ 196.326426][ T9113] netlink: 'syz.2.1069': attribute type 32 has an invalid length. [ 196.539223][ T9122] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 196.854936][ T9134] netlink: 'syz.4.1077': attribute type 8 has an invalid length. [ 196.890042][ T9134] __nla_validate_parse: 1 callbacks suppressed [ 196.890061][ T9134] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1077'. [ 196.979934][ T9141] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.1079'. [ 197.150175][ T9151] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 197.496466][ T9170] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1090'. [ 197.933599][ T9190] netlink: 'syz.3.1097': attribute type 8 has an invalid length. [ 197.958297][ T9190] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1097'. [ 198.032159][ T9199] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1099'. [ 198.111134][ T9201] --map-set only usable from mangle table [ 198.577420][ T9218] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1104'. [ 198.636363][ T9220] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1107'. [ 198.699224][ T9222] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1108'. [ 199.058502][ T9242] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1115'. [ 199.416436][ T9259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1121'. [ 199.457053][ T9261] netlink: 'syz.2.1123': attribute type 83 has an invalid length. [ 199.618920][ T9269] ip6gre1: entered allmulticast mode [ 200.140640][ T9302] veth1_macvtap: left promiscuous mode [ 200.158931][ T9302] macsec0: entered promiscuous mode [ 200.186285][ T9302] macsec0: entered allmulticast mode [ 200.262018][ T9302] veth1_macvtap: entered promiscuous mode [ 200.297302][ T9302] veth1_macvtap: entered allmulticast mode [ 200.328174][ T9302] macsec0: left promiscuous mode [ 200.334513][ T9302] macsec0: left allmulticast mode [ 200.339998][ T9302] veth1_macvtap: left allmulticast mode [ 200.754594][ T9326] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 200.917371][ T9333] netlink: 'syz.3.1147': attribute type 11 has an invalid length. [ 200.938335][ T9335] netlink: 'syz.0.1148': attribute type 32 has an invalid length. [ 201.644625][ T9368] tc_dump_action: action bad kind [ 202.183300][ T9389] __nla_validate_parse: 6 callbacks suppressed [ 202.183320][ T9389] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1169'. [ 202.553200][ T9408] openvswitch: netlink: nsh attr 7 is out of range max 3 [ 202.579709][ T9408] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 202.956709][ T9425] netlink: 164 bytes leftover after parsing attributes in process `syz.2.1182'. [ 204.244441][ T9500] tipc: Failed to remove unknown binding: 66,0,0/2758240066:2383879403/2383879405 [ 204.255788][ T9500] tipc: Failed to remove unknown binding: 66,0,0/2758240066:2383879403/2383879404 [ 204.266120][ T9501] tipc: Failed to remove unknown binding: 66,0,0/2758240066:2383879403/2383879405 [ 204.283604][ T9501] tipc: Failed to remove unknown binding: 66,0,0/2758240066:2383879403/2383879404 [ 204.496152][ T9506] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1206'. [ 205.268960][ T9546] syzkaller0: entered promiscuous mode [ 205.277571][ T9546] syzkaller0: entered allmulticast mode [ 205.286622][ T9550] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1222'. [ 205.456321][ T9550] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1222'. [ 205.755418][ T9571] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1227'. [ 206.688425][ T4952] Bluetooth: hci2: command 0x0406 tx timeout [ 206.695507][ T5655] Bluetooth: hci3: command 0x0406 tx timeout [ 206.695528][ T5646] Bluetooth: hci0: command 0x0406 tx timeout [ 206.708934][ T5641] Bluetooth: hci1: command 0x0406 tx timeout [ 208.110337][ T9562] xfrm2: entered allmulticast mode [ 208.541713][ T9601] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1235'. [ 208.723737][ T9607] FAULT_INJECTION: forcing a failure. [ 208.723737][ T9607] name failslab, interval 1, probability 0, space 0, times 0 [ 208.793404][ T9607] CPU: 0 UID: 0 PID: 9607 Comm: syz.3.1237 Not tainted syzkaller #0 PREEMPT(full) [ 208.793434][ T9607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 208.793447][ T9607] Call Trace: [ 208.793455][ T9607] [ 208.793465][ T9607] dump_stack_lvl+0xe8/0x150 [ 208.793496][ T9607] should_fail_ex+0x40c/0x560 [ 208.793526][ T9607] should_failslab+0xa8/0x100 [ 208.793564][ T9607] kmem_cache_alloc_node_noprof+0x8f/0x680 [ 208.793596][ T9607] ? __alloc_skb+0x189/0x7a0 [ 208.793625][ T9607] ? __alloc_skb+0x1d7/0x7a0 [ 208.793653][ T9607] ? __local_bh_enable_ip+0xd0/0x130 [ 208.793680][ T9607] __alloc_skb+0x1d7/0x7a0 [ 208.793715][ T9607] netlink_sendmsg+0x5d4/0xb40 [ 208.793760][ T9607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 208.793797][ T9607] ? aa_sock_msg_perm+0xf1/0x1b0 [ 208.793831][ T9607] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 208.793860][ T9607] ? __pfx_netlink_sendmsg+0x10/0x10 [ 208.793895][ T9607] ____sys_sendmsg+0x9b9/0xa20 [ 208.793929][ T9607] ? __might_fault+0xaf/0x130 [ 208.793964][ T9607] ? __pfx_____sys_sendmsg+0x10/0x10 [ 208.794008][ T9607] ? import_iovec+0x73/0xa0 [ 208.794040][ T9607] ___sys_sendmsg+0x2a5/0x360 [ 208.794072][ T9607] ? __lock_acquire+0x683/0x2cd0 [ 208.794100][ T9607] ? __pfx____sys_sendmsg+0x10/0x10 [ 208.794172][ T9607] ? __fget_files+0x2a/0x420 [ 208.794199][ T9607] ? __fget_files+0x3a2/0x420 [ 208.794237][ T9607] __x64_sys_sendmsg+0x1bd/0x2a0 [ 208.794275][ T9607] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 208.794320][ T9607] ? __pfx_ksys_write+0x10/0x10 [ 208.794370][ T9607] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.794394][ T9607] do_syscall_64+0x174/0x580 [ 208.794415][ T9607] ? trace_irq_disable+0x3b/0x140 [ 208.794448][ T9607] ? clear_bhb_loop+0x40/0x90 [ 208.794475][ T9607] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 208.794497][ T9607] RIP: 0033:0x7f89e5f9ce59 [ 208.794519][ T9607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 208.794536][ T9607] RSP: 002b:00007f89e6ec2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 208.794559][ T9607] RAX: ffffffffffffffda RBX: 00007f89e6216090 RCX: 00007f89e5f9ce59 [ 208.794575][ T9607] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 208.794589][ T9607] RBP: 00007f89e6ec2090 R08: 0000000000000000 R09: 0000000000000000 [ 208.794602][ T9607] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 208.794614][ T9607] R13: 00007f89e6216128 R14: 00007f89e6216090 R15: 00007ffd22d51e78 [ 208.794652][ T9607] [ 209.148658][ T9619] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 209.283837][ T9622] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1241'. [ 209.424814][ T9626] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 209.796627][ T9638] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1248'. [ 210.194949][ T9645] syzkaller0: entered promiscuous mode [ 210.201530][ T9645] syzkaller0: entered allmulticast mode [ 210.324712][ T9657] netlink: 'syz.3.1255': attribute type 32 has an invalid length. [ 210.665400][ T9663] FAULT_INJECTION: forcing a failure. [ 210.665400][ T9663] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 210.720976][ T9663] CPU: 0 UID: 0 PID: 9663 Comm: syz.3.1257 Not tainted syzkaller #0 PREEMPT(full) [ 210.721006][ T9663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 210.721019][ T9663] Call Trace: [ 210.721027][ T9663] [ 210.721037][ T9663] dump_stack_lvl+0xe8/0x150 [ 210.721069][ T9663] should_fail_ex+0x40c/0x560 [ 210.721099][ T9663] _copy_from_iter+0x1d3/0x1660 [ 210.721128][ T9663] ? rcu_is_watching+0x15/0xb0 [ 210.721160][ T9663] ? __pfx__copy_from_iter+0x10/0x10 [ 210.721181][ T9663] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 210.721221][ T9663] ? netlink_sendmsg+0x650/0xb40 [ 210.721263][ T9663] ? skb_put+0x112/0x210 [ 210.721298][ T9663] netlink_sendmsg+0x6c0/0xb40 [ 210.721341][ T9663] ? __pfx_netlink_sendmsg+0x10/0x10 [ 210.721377][ T9663] ? lockdep_hardirqs_on+0x7a/0x110 [ 210.721411][ T9663] ? aa_sock_msg_perm+0xf1/0x1b0 [ 210.721446][ T9663] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 210.721475][ T9663] ? __pfx_netlink_sendmsg+0x10/0x10 [ 210.721510][ T9663] ____sys_sendmsg+0x9b9/0xa20 [ 210.721545][ T9663] ? __might_fault+0xaf/0x130 [ 210.721580][ T9663] ? __pfx_____sys_sendmsg+0x10/0x10 [ 210.721625][ T9663] ? import_iovec+0x73/0xa0 [ 210.721656][ T9663] ___sys_sendmsg+0x2a5/0x360 [ 210.721690][ T9663] ? __lock_acquire+0x683/0x2cd0 [ 210.721717][ T9663] ? __pfx____sys_sendmsg+0x10/0x10 [ 210.721793][ T9663] ? __fget_files+0x2a/0x420 [ 210.721819][ T9663] ? __fget_files+0x3a2/0x420 [ 210.721858][ T9663] __x64_sys_sendmsg+0x1bd/0x2a0 [ 210.721896][ T9663] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 210.721942][ T9663] ? __pfx_ksys_write+0x10/0x10 [ 210.721983][ T9663] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.722008][ T9663] do_syscall_64+0x174/0x580 [ 210.722031][ T9663] ? clear_bhb_loop+0x40/0x90 [ 210.722058][ T9663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.722080][ T9663] RIP: 0033:0x7f89e5f9ce59 [ 210.722101][ T9663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.722119][ T9663] RSP: 002b:00007f89e6ec2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 210.722142][ T9663] RAX: ffffffffffffffda RBX: 00007f89e6216090 RCX: 00007f89e5f9ce59 [ 210.722159][ T9663] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 210.722171][ T9663] RBP: 00007f89e6ec2090 R08: 0000000000000000 R09: 0000000000000000 [ 210.722185][ T9663] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 210.722197][ T9663] R13: 00007f89e6216128 R14: 00007f89e6216090 R15: 00007ffd22d51e78 [ 210.722230][ T9663] [ 211.079828][ T9650] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1254'. [ 211.089167][ T9650] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1254'. [ 211.119183][ T9650] bridge0: entered promiscuous mode [ 211.124623][ T9650] bridge0: entered allmulticast mode [ 211.155267][ T9669] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1258'. [ 211.451267][ T9675] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1260'. [ 211.490385][ T9674] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 211.530550][ T9675] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1260'. [ 211.635557][ T9681] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1264'. [ 212.028783][ T9691] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 212.462670][ T9702] netlink: 'syz.4.1270': attribute type 32 has an invalid length. [ 212.585344][ T9705] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1272'. [ 212.689257][ T9710] FAULT_INJECTION: forcing a failure. [ 212.689257][ T9710] name failslab, interval 1, probability 0, space 0, times 0 [ 212.764798][ T9710] CPU: 1 UID: 0 PID: 9710 Comm: syz.2.1274 Not tainted syzkaller #0 PREEMPT(full) [ 212.764828][ T9710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 212.764841][ T9710] Call Trace: [ 212.764849][ T9710] [ 212.764858][ T9710] dump_stack_lvl+0xe8/0x150 [ 212.764889][ T9710] should_fail_ex+0x40c/0x560 [ 212.764917][ T9710] should_failslab+0xa8/0x100 [ 212.764951][ T9710] ? skb_clone+0x212/0x3a0 [ 212.764973][ T9710] kmem_cache_alloc_noprof+0x87/0x650 [ 212.765012][ T9710] skb_clone+0x212/0x3a0 [ 212.765037][ T9710] __netlink_deliver_tap+0x413/0x860 [ 212.765082][ T9710] ? netlink_deliver_tap+0x2e/0x1b0 [ 212.765115][ T9710] netlink_deliver_tap+0x19c/0x1b0 [ 212.765148][ T9710] netlink_unicast+0x77f/0x940 [ 212.765189][ T9710] netlink_sendmsg+0x813/0xb40 [ 212.765230][ T9710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 212.765266][ T9710] ? aa_sock_msg_perm+0xf1/0x1b0 [ 212.765299][ T9710] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 212.765327][ T9710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 212.765361][ T9710] ____sys_sendmsg+0x9b9/0xa20 [ 212.765394][ T9710] ? __might_fault+0xaf/0x130 [ 212.765440][ T9710] ? __pfx_____sys_sendmsg+0x10/0x10 [ 212.765484][ T9710] ? import_iovec+0x73/0xa0 [ 212.765513][ T9710] ___sys_sendmsg+0x2a5/0x360 [ 212.765544][ T9710] ? __lock_acquire+0x683/0x2cd0 [ 212.765571][ T9710] ? __pfx____sys_sendmsg+0x10/0x10 [ 212.765643][ T9710] ? __fget_files+0x2a/0x420 [ 212.765669][ T9710] ? __fget_files+0x3a2/0x420 [ 212.765706][ T9710] __x64_sys_sendmsg+0x1bd/0x2a0 [ 212.765743][ T9710] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 212.765787][ T9710] ? __pfx_ksys_write+0x10/0x10 [ 212.765829][ T9710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.765852][ T9710] do_syscall_64+0x174/0x580 [ 212.765876][ T9710] ? clear_bhb_loop+0x40/0x90 [ 212.765903][ T9710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 212.765925][ T9710] RIP: 0033:0x7f864b59ce59 [ 212.765946][ T9710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 212.765964][ T9710] RSP: 002b:00007f864c41c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 212.765987][ T9710] RAX: ffffffffffffffda RBX: 00007f864b816090 RCX: 00007f864b59ce59 [ 212.766003][ T9710] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 212.766016][ T9710] RBP: 00007f864c41c090 R08: 0000000000000000 R09: 0000000000000000 [ 212.766029][ T9710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 212.766041][ T9710] R13: 00007f864b816128 R14: 00007f864b816090 R15: 00007ffc583759f8 [ 212.766076][ T9710] [ 213.328326][ T9726] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 213.559401][ T9733] syzkaller0: entered promiscuous mode [ 213.571412][ T9733] syzkaller0: entered allmulticast mode [ 213.638565][ T9733] netlink: 'syz.2.1285': attribute type 1 has an invalid length. [ 213.848520][ T9749] __nla_validate_parse: 4 callbacks suppressed [ 213.848544][ T9749] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1291'. [ 213.965118][ T9751] FAULT_INJECTION: forcing a failure. [ 213.965118][ T9751] name failslab, interval 1, probability 0, space 0, times 0 [ 214.005525][ T9751] CPU: 0 UID: 0 PID: 9751 Comm: syz.4.1292 Not tainted syzkaller #0 PREEMPT(full) [ 214.005555][ T9751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 214.005568][ T9751] Call Trace: [ 214.005577][ T9751] [ 214.005586][ T9751] dump_stack_lvl+0xe8/0x150 [ 214.005617][ T9751] should_fail_ex+0x40c/0x560 [ 214.005646][ T9751] should_failslab+0xa8/0x100 [ 214.005681][ T9751] ? skb_clone+0x212/0x3a0 [ 214.005703][ T9751] kmem_cache_alloc_noprof+0x87/0x650 [ 214.005742][ T9751] skb_clone+0x212/0x3a0 [ 214.005768][ T9751] __netlink_deliver_tap+0x413/0x860 [ 214.005823][ T9751] ? netlink_deliver_tap+0x2e/0x1b0 [ 214.005858][ T9751] netlink_deliver_tap+0x19c/0x1b0 [ 214.005892][ T9751] netlink_unicast+0x77f/0x940 [ 214.005934][ T9751] netlink_sendmsg+0x813/0xb40 [ 214.005977][ T9751] ? __pfx_netlink_sendmsg+0x10/0x10 [ 214.006014][ T9751] ? aa_sock_msg_perm+0xf1/0x1b0 [ 214.006048][ T9751] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 214.006077][ T9751] ? __pfx_netlink_sendmsg+0x10/0x10 [ 214.006112][ T9751] ____sys_sendmsg+0x9b9/0xa20 [ 214.006146][ T9751] ? __might_fault+0xaf/0x130 [ 214.006181][ T9751] ? __pfx_____sys_sendmsg+0x10/0x10 [ 214.006226][ T9751] ? import_iovec+0x73/0xa0 [ 214.006257][ T9751] ___sys_sendmsg+0x2a5/0x360 [ 214.006290][ T9751] ? __lock_acquire+0x683/0x2cd0 [ 214.006318][ T9751] ? __pfx____sys_sendmsg+0x10/0x10 [ 214.006392][ T9751] ? __fget_files+0x2a/0x420 [ 214.006418][ T9751] ? __fget_files+0x3a2/0x420 [ 214.006457][ T9751] __x64_sys_sendmsg+0x1bd/0x2a0 [ 214.006494][ T9751] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 214.006538][ T9751] ? __pfx_ksys_write+0x10/0x10 [ 214.006581][ T9751] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.006605][ T9751] do_syscall_64+0x174/0x580 [ 214.006625][ T9751] ? trace_irq_disable+0x3b/0x140 [ 214.006658][ T9751] ? clear_bhb_loop+0x40/0x90 [ 214.006685][ T9751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 214.006707][ T9751] RIP: 0033:0x7f5a0039ce59 [ 214.006727][ T9751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 214.006744][ T9751] RSP: 002b:00007f5a012bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 214.006767][ T9751] RAX: ffffffffffffffda RBX: 00007f5a00615fa0 RCX: 00007f5a0039ce59 [ 214.006789][ T9751] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 214.006802][ T9751] RBP: 00007f5a012bf090 R08: 0000000000000000 R09: 0000000000000000 [ 214.006815][ T9751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 214.006827][ T9751] R13: 00007f5a00616038 R14: 00007f5a00615fa0 R15: 00007ffe30a85ac8 [ 214.006861][ T9751] [ 214.788337][ T9784] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 214.850077][ T9786] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1306'. [ 215.101477][ T9799] netlink: 'syz.1.1311': attribute type 32 has an invalid length. [ 215.402854][ T9814] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1316'. [ 215.411902][ T9814] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 215.585570][ T9823] gre1: entered promiscuous mode [ 215.639755][ T9828] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1321'. [ 215.665938][ T9831] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1319'. [ 215.666487][ T9819] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1318'. [ 215.899615][ T9841] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1325'. [ 215.953916][ T9845] netlink: 'syz.4.1324': attribute type 32 has an invalid length. [ 216.040286][ T9849] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 216.191572][ T9855] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1330'. [ 216.209524][ T9855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1330'. [ 216.364877][ T9865] IPVS: ip_vs_edit_dest(): server weight less than zero [ 216.401144][ T9866] netlink: 256 bytes leftover after parsing attributes in process `syz.4.1334'. [ 216.836183][ T9888] netlink: 'syz.1.1344': attribute type 1 has an invalid length. [ 216.859382][ T9888] netlink: 'syz.1.1344': attribute type 2 has an invalid length. [ 217.346589][ T9913] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 217.554696][ T9925] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 217.749019][ T9933] netlink: 'syz.4.1361': attribute type 1 has an invalid length. [ 217.854154][ T9933] bond2: entered promiscuous mode [ 217.877058][ T9933] 8021q: adding VLAN 0 to HW filter on device bond2 [ 217.920185][ T9937] 8021q: adding VLAN 0 to HW filter on device bond2 [ 217.927440][ T9937] bond2: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 217.938001][ T9937] bond2: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 217.952778][ T9937] bond2: (slave ip6gre2): making interface the new active one [ 217.960306][ T9937] ip6gre2: entered promiscuous mode [ 217.967427][ T9937] bond2: (slave ip6gre2): Enslaving as an active interface with an up link [ 218.416245][ T9964] FAULT_INJECTION: forcing a failure. [ 218.416245][ T9964] name failslab, interval 1, probability 0, space 0, times 0 [ 218.452108][ T9964] CPU: 1 UID: 0 PID: 9964 Comm: syz.2.1369 Not tainted syzkaller #0 PREEMPT(full) [ 218.452138][ T9964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 218.452151][ T9964] Call Trace: [ 218.452159][ T9964] [ 218.452168][ T9964] dump_stack_lvl+0xe8/0x150 [ 218.452201][ T9964] should_fail_ex+0x40c/0x560 [ 218.452230][ T9964] should_failslab+0xa8/0x100 [ 218.452264][ T9964] ? skb_clone+0x212/0x3a0 [ 218.452285][ T9964] kmem_cache_alloc_noprof+0x87/0x650 [ 218.452325][ T9964] skb_clone+0x212/0x3a0 [ 218.452350][ T9964] __netlink_deliver_tap+0x413/0x860 [ 218.452396][ T9964] ? netlink_deliver_tap+0x2e/0x1b0 [ 218.452439][ T9964] netlink_deliver_tap+0x19c/0x1b0 [ 218.452473][ T9964] netlink_sendskb+0x68/0x140 [ 218.452505][ T9964] netlink_rcv_skb+0x2a4/0x4a0 [ 218.452538][ T9964] ? __pfx_genl_rcv_msg+0x10/0x10 [ 218.452565][ T9964] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 218.452615][ T9964] ? down_read+0x270/0x2e0 [ 218.452638][ T9964] ? genl_rcv+0xd/0x40 [ 218.452664][ T9964] genl_rcv+0x28/0x40 [ 218.452686][ T9964] netlink_unicast+0x7bb/0x940 [ 218.452728][ T9964] netlink_sendmsg+0x813/0xb40 [ 218.452770][ T9964] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.452807][ T9964] ? aa_sock_msg_perm+0xf1/0x1b0 [ 218.452842][ T9964] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 218.452869][ T9964] ? __pfx_netlink_sendmsg+0x10/0x10 [ 218.452905][ T9964] ____sys_sendmsg+0x9b9/0xa20 [ 218.452938][ T9964] ? __might_fault+0xaf/0x130 [ 218.452974][ T9964] ? __pfx_____sys_sendmsg+0x10/0x10 [ 218.453018][ T9964] ? import_iovec+0x73/0xa0 [ 218.453048][ T9964] ___sys_sendmsg+0x2a5/0x360 [ 218.453081][ T9964] ? __lock_acquire+0x683/0x2cd0 [ 218.453109][ T9964] ? __pfx____sys_sendmsg+0x10/0x10 [ 218.453184][ T9964] ? __fget_files+0x2a/0x420 [ 218.453210][ T9964] ? __fget_files+0x3a2/0x420 [ 218.453248][ T9964] __x64_sys_sendmsg+0x1bd/0x2a0 [ 218.453285][ T9964] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 218.453330][ T9964] ? __pfx_ksys_write+0x10/0x10 [ 218.453372][ T9964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.453396][ T9964] do_syscall_64+0x174/0x580 [ 218.453424][ T9964] ? trace_irq_disable+0x3b/0x140 [ 218.453457][ T9964] ? clear_bhb_loop+0x40/0x90 [ 218.453485][ T9964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 218.453506][ T9964] RIP: 0033:0x7f864b59ce59 [ 218.453527][ T9964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 218.453544][ T9964] RSP: 002b:00007f864c41c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 218.453566][ T9964] RAX: ffffffffffffffda RBX: 00007f864b816090 RCX: 00007f864b59ce59 [ 218.453581][ T9964] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 218.453594][ T9964] RBP: 00007f864c41c090 R08: 0000000000000000 R09: 0000000000000000 [ 218.453607][ T9964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 218.453619][ T9964] R13: 00007f864b816128 R14: 00007f864b816090 R15: 00007ffc583759f8 [ 218.453655][ T9964] [ 219.201615][ T9989] : entered promiscuous mode [ 219.275175][ T9991] __nla_validate_parse: 10 callbacks suppressed [ 219.275204][ T9991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1377'. [ 219.354381][ T9981] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1377'. [ 219.411593][ T9996] netlink: 'syz.0.1381': attribute type 32 has an invalid length. [ 219.715779][T10017] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1389'. [ 219.768901][T10019] FAULT_INJECTION: forcing a failure. [ 219.768901][T10019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 219.786939][T10018] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1389'. [ 219.812456][T10019] CPU: 0 UID: 0 PID: 10019 Comm: syz.3.1388 Not tainted syzkaller #0 PREEMPT(full) [ 219.812484][T10019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 219.812497][T10019] Call Trace: [ 219.812505][T10019] [ 219.812514][T10019] dump_stack_lvl+0xe8/0x150 [ 219.812544][T10019] should_fail_ex+0x40c/0x560 [ 219.812573][T10019] _copy_to_user+0x31/0xb0 [ 219.812610][T10019] simple_read_from_buffer+0xe1/0x170 [ 219.812644][T10019] proc_fail_nth_read+0x1bb/0x230 [ 219.812678][T10019] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 219.812710][T10019] ? rw_verify_area+0x24a/0x4c0 [ 219.812743][T10019] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 219.812770][T10019] vfs_read+0x213/0xa80 [ 219.812806][T10019] ? __pfx___mutex_lock+0x10/0x10 [ 219.812829][T10019] ? __pfx_vfs_read+0x10/0x10 [ 219.812862][T10019] ? __fget_files+0x2a/0x420 [ 219.812893][T10019] ? __fget_files+0x3a2/0x420 [ 219.812918][T10019] ? __fget_files+0x2a/0x420 [ 219.812954][T10019] ksys_read+0x150/0x270 [ 219.812988][T10019] ? __pfx_ksys_read+0x10/0x10 [ 219.813028][T10019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.813052][T10019] do_syscall_64+0x174/0x580 [ 219.813072][T10019] ? trace_irq_disable+0x3b/0x140 [ 219.813105][T10019] ? clear_bhb_loop+0x40/0x90 [ 219.813132][T10019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 219.813154][T10019] RIP: 0033:0x7f89e5f5d68e [ 219.813182][T10019] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 219.813203][T10019] RSP: 002b:00007f89e6ec1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 219.813225][T10019] RAX: ffffffffffffffda RBX: 00007f89e6ec26c0 RCX: 00007f89e5f5d68e [ 219.813241][T10019] RDX: 000000000000000f RSI: 00007f89e6ec20a0 RDI: 0000000000000005 [ 219.813254][T10019] RBP: 00007f89e6ec2090 R08: 0000000000000000 R09: 0000000000000000 [ 219.813267][T10019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 219.813280][T10019] R13: 00007f89e6216128 R14: 00007f89e6216090 R15: 00007ffd22d51e78 [ 219.813318][T10019] [ 220.352877][T10038] netlink: 'syz.1.1396': attribute type 32 has an invalid length. [ 220.654217][T10051] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1397'. [ 220.932145][T10065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1405'. [ 221.377625][T10080] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1411'. [ 221.389568][T10083] openvswitch: netlink: Message has 8 unknown bytes. [ 221.402174][T10084] openvswitch: netlink: Message has 8 unknown bytes. [ 221.409045][T10084] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.435775][T10083] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 221.547623][T10087] vlan1: entered promiscuous mode [ 222.196028][T10110] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1423'. [ 222.343358][T10118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1428'. [ 223.023518][T10141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1431'. [ 224.057510][T10166] netlink: 'syz.3.1441': attribute type 1 has an invalid length. [ 224.147382][T10166] netlink: 'syz.3.1441': attribute type 1 has an invalid length. [ 224.225188][T10166] netlink: 'syz.3.1441': attribute type 1 has an invalid length. [ 224.277496][T10166] netlink: 'syz.3.1441': attribute type 1 has an invalid length. [ 224.299510][T10172] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 225.526850][T10192] FAULT_INJECTION: forcing a failure. [ 225.526850][T10192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 225.651830][T10192] CPU: 1 UID: 0 PID: 10192 Comm: syz.4.1450 Not tainted syzkaller #0 PREEMPT(full) [ 225.651861][T10192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 225.651873][T10192] Call Trace: [ 225.651882][T10192] [ 225.651892][T10192] dump_stack_lvl+0xe8/0x150 [ 225.651924][T10192] should_fail_ex+0x40c/0x560 [ 225.651953][T10192] _copy_from_iter+0x1d3/0x1660 [ 225.651982][T10192] ? rcu_is_watching+0x15/0xb0 [ 225.652015][T10192] ? __pfx__copy_from_iter+0x10/0x10 [ 225.652036][T10192] ? kmem_cache_alloc_node_noprof+0x3ca/0x680 [ 225.652077][T10192] ? netlink_sendmsg+0x650/0xb40 [ 225.652109][T10192] ? skb_put+0x112/0x210 [ 225.652144][T10192] netlink_sendmsg+0x6c0/0xb40 [ 225.652188][T10192] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.652225][T10192] ? aa_sock_msg_perm+0xf1/0x1b0 [ 225.652260][T10192] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 225.652289][T10192] ? __pfx_netlink_sendmsg+0x10/0x10 [ 225.652328][T10192] ____sys_sendmsg+0x9b9/0xa20 [ 225.652362][T10192] ? __might_fault+0xaf/0x130 [ 225.652397][T10192] ? __pfx_____sys_sendmsg+0x10/0x10 [ 225.652441][T10192] ? import_iovec+0x73/0xa0 [ 225.652473][T10192] ___sys_sendmsg+0x2a5/0x360 [ 225.652505][T10192] ? __lock_acquire+0x683/0x2cd0 [ 225.652542][T10192] ? __pfx____sys_sendmsg+0x10/0x10 [ 225.652615][T10192] ? __fget_files+0x2a/0x420 [ 225.652650][T10192] ? __fget_files+0x3a2/0x420 [ 225.652689][T10192] __x64_sys_sendmsg+0x1bd/0x2a0 [ 225.652727][T10192] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 225.652773][T10192] ? __pfx_ksys_write+0x10/0x10 [ 225.652815][T10192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.652839][T10192] do_syscall_64+0x174/0x580 [ 225.652860][T10192] ? trace_irq_disable+0x3b/0x140 [ 225.652893][T10192] ? clear_bhb_loop+0x40/0x90 [ 225.652921][T10192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.652943][T10192] RIP: 0033:0x7f5a0039ce59 [ 225.652964][T10192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.652983][T10192] RSP: 002b:00007f5a012bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 225.653006][T10192] RAX: ffffffffffffffda RBX: 00007f5a00615fa0 RCX: 00007f5a0039ce59 [ 225.653022][T10192] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 225.653036][T10192] RBP: 00007f5a012bf090 R08: 0000000000000000 R09: 0000000000000000 [ 225.653049][T10192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 225.653061][T10192] R13: 00007f5a00616038 R14: 00007f5a00615fa0 R15: 00007ffe30a85ac8 [ 225.653096][T10192] [ 226.328798][T10195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1449'. [ 228.570695][T10193] syzkaller0: entered promiscuous mode [ 228.576248][T10193] syzkaller0: entered allmulticast mode [ 237.759767][T10239] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 237.810210][T10244] netlink: 108 bytes leftover after parsing attributes in process `syz.0.1462'. [ 238.241298][T10249] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1464'. [ 238.250259][T10249] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1464'. [ 238.379022][T10252] xt_l2tp: v2 sid > 0xffff: 1114112 [ 238.851347][T10261] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 239.302208][T10273] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1473'. [ 239.738932][T10282] netlink: 108 bytes leftover after parsing attributes in process `syz.0.1476'. [ 240.112678][T10290] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 240.724687][T10297] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1481'. [ 249.635816][T10327] netlink: 'syz.0.1486': attribute type 3 has an invalid length. [ 249.643704][T10327] netlink: 'syz.0.1486': attribute type 3 has an invalid length. [ 249.651458][T10327] netlink: 'syz.0.1486': attribute type 3 has an invalid length. [ 249.749931][T10331] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1488'. [ 250.556832][T10350] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 250.592708][T10353] netlink: 'syz.4.1493': attribute type 24 has an invalid length. [ 250.963630][T10360] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1495'. [ 250.972597][T10360] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1495'. [ 250.992885][T10361] netlink: 'syz.2.1496': attribute type 32 has an invalid length. [ 255.819822][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.826195][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 264.960883][ C0] sched: DL replenish lagged too much [ 265.763410][T10386] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1506'. [ 266.199972][ T5650] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 266.210533][ T5650] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 266.221937][ T5650] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 266.231413][ T5650] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 266.239703][ T5650] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 266.247413][ T5650] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 266.256487][ T50] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 266.365945][ T5650] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 266.421128][ T5650] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 266.431455][ T5650] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 268.415953][ T5650] Bluetooth: hci5: command tx timeout [ 268.533257][ T5650] Bluetooth: hci6: command tx timeout [ 270.531711][ T5650] Bluetooth: hci5: command tx timeout [ 270.642778][ T5650] Bluetooth: hci6: command tx timeout [ 272.654338][ T5650] Bluetooth: hci5: command tx timeout [ 272.765704][ T5650] Bluetooth: hci6: command tx timeout [ 274.771708][ T5650] Bluetooth: hci5: command tx timeout [ 274.883170][ T5650] Bluetooth: hci6: command tx timeout [ 279.508184][T10386] team0 (unregistering): Port device team_slave_0 removed [ 279.742251][T10386] team0 (unregistering): Port device team_slave_1 removed [ 279.852442][T10384] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 280.137885][T10415] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 280.756342][ T5654] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 280.767218][ T5654] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 280.776236][ T5654] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 280.810188][ T5654] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 280.818063][ T5654] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 281.627558][ T5646] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 281.639778][ T5646] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 281.647835][ T5646] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 281.657599][ T5646] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 281.665392][ T5646] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 282.921012][ T5646] Bluetooth: hci7: command tx timeout [ 283.583446][ T5646] Bluetooth: hci4: command 0x0405 tx timeout [ 283.838368][ T5654] Bluetooth: hci8: command tx timeout [ 284.267856][T10446] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1516'. [ 284.932502][ T5654] Bluetooth: hci7: command tx timeout [ 285.949719][ T5654] Bluetooth: hci8: command tx timeout [ 286.509282][T10474] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 287.033206][T10403] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.040493][T10403] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.067714][ T5654] Bluetooth: hci7: command tx timeout [ 287.111197][T10403] bridge_slave_0: entered allmulticast mode [ 287.119306][T10403] bridge_slave_0: entered promiscuous mode [ 287.220736][T10403] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.228582][T10403] bridge0: port 2(bridge_slave_1) entered disabled state [ 287.235878][T10403] bridge_slave_1: entered allmulticast mode [ 287.348293][T10403] bridge_slave_1: entered promiscuous mode [ 287.974533][T10495] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1522'. [ 288.070760][ T5654] Bluetooth: hci8: command tx timeout [ 288.185601][T10496] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1522'. [ 289.186986][ T5654] Bluetooth: hci7: command tx timeout [ 290.182379][ T5654] Bluetooth: hci8: command tx timeout [ 300.360294][T10510] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 300.499479][T10403] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 300.813566][ T48] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 300.839642][T10403] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 300.971379][T10418] bridge0: port 1(bridge_slave_0) entered blocking state [ 300.978710][T10418] bridge0: port 1(bridge_slave_0) entered disabled state [ 300.986019][T10418] bridge_slave_0: entered allmulticast mode [ 300.995032][T10418] bridge_slave_0: entered promiscuous mode [ 301.024150][T10401] bridge0: port 1(bridge_slave_0) entered blocking state [ 301.031331][T10401] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.038588][T10401] bridge_slave_0: entered allmulticast mode [ 301.047688][T10401] bridge_slave_0: entered promiscuous mode [ 301.073333][T10403] team0: Port device team_slave_0 added [ 301.079289][T10418] bridge0: port 2(bridge_slave_1) entered blocking state [ 301.086462][T10418] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.093768][T10418] bridge_slave_1: entered allmulticast mode [ 301.104075][T10418] bridge_slave_1: entered promiscuous mode [ 301.218597][T10401] bridge0: port 2(bridge_slave_1) entered blocking state [ 301.249216][T10401] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.256618][T10401] bridge_slave_1: entered allmulticast mode [ 301.264582][T10401] bridge_slave_1: entered promiscuous mode [ 301.275182][T10403] team0: Port device team_slave_1 added [ 301.281110][T10430] bridge0: port 1(bridge_slave_0) entered blocking state [ 301.288278][T10430] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.295591][T10430] bridge_slave_0: entered allmulticast mode [ 301.304235][T10430] bridge_slave_0: entered promiscuous mode [ 317.287577][ T5646] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 317.318080][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.324475][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.334923][ T5646] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 317.344427][ T5646] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 317.352543][ T5646] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 317.360386][ T5646] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 319.430347][ T5646] Bluetooth: hci0: command tx timeout [ 321.549327][ T5646] Bluetooth: hci0: command tx timeout [ 323.672227][ T5646] Bluetooth: hci0: command tx timeout [ 325.792467][ T5646] Bluetooth: hci0: command tx timeout [ 326.140162][ T5654] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 326.150493][ T5654] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 326.159695][ T5654] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 326.167851][ T5654] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 326.175681][ T5654] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 327.200077][ T5646] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 327.209668][ T5646] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 327.218856][ T5646] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 327.227236][ T5646] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 327.257308][ T5646] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 328.251322][ T5646] Bluetooth: hci1: command tx timeout [ 329.365319][ T5646] Bluetooth: hci3: command tx timeout [ 330.368665][ T5646] Bluetooth: hci1: command tx timeout [ 331.488078][ T5646] Bluetooth: hci3: command tx timeout [ 332.491089][ T5646] Bluetooth: hci1: command tx timeout [ 333.609668][ T5646] Bluetooth: hci3: command tx timeout [ 334.618461][ T5646] Bluetooth: hci1: command tx timeout [ 335.735997][ T5646] Bluetooth: hci3: command tx timeout [ 341.254834][ T5654] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 341.265519][ T5654] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 341.273826][ T5654] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 341.281955][ T5654] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 341.289780][ T5654] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 342.417275][ T5646] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 342.449911][ T5646] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 342.457903][ T5646] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 342.468468][ T5646] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 342.476281][ T5646] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 343.338386][ T5646] Bluetooth: hci4: command tx timeout [ 344.566473][ T5646] Bluetooth: hci9: command tx timeout [ 345.464637][ T5646] Bluetooth: hci4: command tx timeout [ 346.684672][ T5646] Bluetooth: hci9: command tx timeout [ 347.577757][ T5646] Bluetooth: hci4: command tx timeout [ 348.803080][ T5646] Bluetooth: hci9: command tx timeout [ 349.694680][ T5646] Bluetooth: hci4: command tx timeout [ 350.920965][ T5646] Bluetooth: hci9: command tx timeout [ 360.797001][T10430] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.804198][T10430] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.811641][T10430] bridge_slave_1: entered allmulticast mode [ 360.887060][T10430] bridge_slave_1: entered promiscuous mode [ 364.233739][T10532] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.240950][T10532] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.248237][T10532] bridge_slave_0: entered allmulticast mode [ 364.290011][T10532] bridge_slave_0: entered promiscuous mode [ 364.299042][T10532] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.306300][T10532] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.333608][T10532] bridge_slave_1: entered allmulticast mode [ 364.342470][T10532] bridge_slave_1: entered promiscuous mode [ 364.573459][T10532] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 364.582769][T10544] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.590017][T10544] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.597300][T10544] bridge_slave_0: entered allmulticast mode [ 364.606823][T10544] bridge_slave_0: entered promiscuous mode [ 364.682768][T10532] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 364.692582][T10544] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.699865][T10544] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.707163][T10544] bridge_slave_1: entered allmulticast mode [ 364.715790][T10544] bridge_slave_1: entered promiscuous mode [ 364.817185][T10539] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.824372][T10539] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.831640][T10539] bridge_slave_0: entered allmulticast mode [ 364.839947][T10539] bridge_slave_0: entered promiscuous mode [ 364.848001][T10552] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.855209][T10552] bridge0: port 1(bridge_slave_0) entered disabled state [ 364.862567][T10552] bridge_slave_0: entered allmulticast mode [ 364.871509][T10552] bridge_slave_0: entered promiscuous mode [ 364.936298][T10539] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.943484][T10539] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.950757][T10539] bridge_slave_1: entered allmulticast mode [ 364.960987][T10539] bridge_slave_1: entered promiscuous mode [ 364.968844][T10552] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.976591][T10552] bridge0: port 2(bridge_slave_1) entered disabled state [ 364.983879][T10552] bridge_slave_1: entered allmulticast mode [ 365.010374][T10552] bridge_slave_1: entered promiscuous mode [ 365.022748][T10544] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.034496][T10532] team0: Port device team_slave_0 added [ 365.092969][T10532] team0: Port device team_slave_1 added [ 365.122209][T10544] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.208735][T10524] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.238693][T10524] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.245997][T10524] bridge_slave_0: entered allmulticast mode [ 365.254085][T10524] bridge_slave_0: entered promiscuous mode [ 365.267944][T10539] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.281798][T10552] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 365.295077][T10539] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.373527][T10544] team0: Port device team_slave_0 added [ 365.379335][T10524] bridge0: port 2(bridge_slave_1) entered blocking state [ 365.386517][T10524] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.395180][T10524] bridge_slave_1: entered allmulticast mode [ 365.403137][T10524] bridge_slave_1: entered promiscuous mode [ 365.416183][T10552] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 365.466500][T10539] team0: Port device team_slave_0 added [ 365.587709][T10532] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 365.595061][T10532] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 365.621067][T10532] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 365.976696][T10544] team0: Port device team_slave_1 added [ 365.999201][T10532] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 366.244186][T10532] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.270271][T10532] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.376639][T10552] team0: Port device team_slave_0 added [ 366.385727][T10552] team0: Port device team_slave_1 added [ 377.589127][ T5654] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 377.603033][ T5654] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 377.611395][ T5654] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 377.640330][ T5654] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 377.648596][ T5654] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 378.753370][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.759775][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.642859][ T5654] Bluetooth: hci10: command tx timeout [ 381.766103][ T5654] Bluetooth: hci10: command tx timeout [ 383.352370][T10539] team0: Port device team_slave_1 added [ 383.894791][ T5654] Bluetooth: hci10: command tx timeout [ 386.015779][ T5654] Bluetooth: hci10: command tx timeout [ 386.462194][ T30] INFO: task kworker/1:1:42 blocked for more than 143 seconds. [ 386.469822][ T30] Not tainted syzkaller #0 [ 386.474794][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 386.483496][ T30] task:kworker/1:1 state:D stack:23432 pid:42 tgid:42 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 386.495577][ T30] Workqueue: events drain_vmap_area_work [ 386.501413][ T30] Call Trace: [ 386.504718][ T30] [ 386.507707][ T30] __schedule+0x1840/0x57a0 [ 386.512367][ T30] ? __pfx___schedule+0x10/0x10 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 386.701179][ T30] ? __pfx___schedule+0x10/0x10 [ 386.706164][ T30] ? schedule+0x90/0x360 [ 386.710505][ T30] schedule+0x164/0x360 [ 386.714897][ T30] schedule_timeout+0xc0/0x2c0 [ 386.720214][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 386.725647][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 386.730792][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 386.736045][ T30] ? wait_for_completion+0x272/0x5e0 [ 386.741394][ T30] wait_for_completion+0x2ca/0x5e0 [ 386.746576][ T30] ? __pfx_wait_for_completion+0x10/0x10 [ 386.752358][ T30] ? __flush_work+0x101/0xca0 [ 386.757125][ T30] __flush_work+0xa63/0xca0 [ 386.761683][ T30] ? reclaim_list_global+0x137c/0x13b0 [ 386.767200][ T30] ? __flush_work+0x101/0xca0 [ 386.771924][ T30] ? __pfx___flush_work+0x10/0x10 [ 386.776994][ T30] ? __pfx_wq_barrier_func+0x10/0x10 [ 386.782349][ T30] ? flush_work+0xd/0x30 [ 386.818986][ T30] __purge_vmap_area_lazy+0x880/0xb40 [ 386.824509][ T30] ? process_scheduled_works+0xa20/0x14e0 [ 386.830281][ T30] drain_vmap_area_work+0x27/0x40 [ 386.835470][ T30] process_scheduled_works+0xa8e/0x14e0 [ 386.841100][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 386.847145][ T30] ? assign_work+0x3cf/0x5d0 [ 386.851800][ T30] worker_thread+0xa47/0xfb0 [ 386.856468][ T30] kthread+0x389/0x470 [ 386.860609][ T30] ? __pfx_worker_thread+0x10/0x10 [ 386.865759][ T30] ? __pfx_kthread+0x10/0x10 [ 386.870409][ T30] ret_from_fork+0x514/0xb70 [ 386.875107][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 386.880270][ T30] ? __switch_to+0xc89/0x1420 [ 386.885004][ T30] ? __pfx_kthread+0x10/0x10 [ 386.889642][ T30] ret_from_fork_asm+0x1a/0x30 [ 386.894849][ T30] [ 386.898159][ T30] [ 386.898159][ T30] Showing all locks held in the system: [ 386.953742][ T30] 1 lock held by khungtaskd/30: [ 386.958658][ T30] #0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 386.968629][ T30] 3 locks held by kworker/1:1/42: [ 386.973699][ T30] #0: ffff88813fe3f140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 386.984745][ T30] #1: ffffc90000b27c40 (drain_vmap_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 386.995276][ T30] #2: ffffffff8ea80960 (vmap_purge_lock){+.+.}-{4:4}, at: drain_vmap_area_work+0x17/0x40 [ 387.005287][ T30] 7 locks held by kworker/u8:3/48: [ 387.010427][ T30] #0: ffff88801be86140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 387.044338][ T30] #1: ffffc90000b87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 387.054985][ T30] #2: ffffffff8fdb19a8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 387.064544][ T30] #3: ffff888056f7d128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 [ 387.074730][ T30] #4: ffff888056f06258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 [ 387.085620][ T30] #5: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x16b/0x800 [ 387.094746][ T30] #6: ffffffff8e7eb350 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many_notify+0xcac/0x2370 [ 387.106595][ T30] 3 locks held by kworker/u8:12/3296: [ 387.112018][ T30] #0: ffff88813fe7c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 387.123752][ T30] #1: ffffc9000e3c7c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 387.156803][ T30] #2: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 387.165958][ T30] 2 locks held by getty/5392: [ 387.170715][ T30] #0: ffff888035be90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 387.180841][ T30] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1380 [ 387.191024][ T30] 3 locks held by kworker/0:3/5643: [ 387.196438][ T30] 4 locks held by kworker/0:4/5735: [ 387.201672][ T30] 6 locks held by kworker/0:6/5749: [ 387.206913][ T30] 2 locks held by syz-executor/10532: [ 387.212710][ T30] #0: ffffffff903153d8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 387.222383][ T30] #1: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 387.231537][ T30] 2 locks held by syz-executor/10539: [ 387.236944][ T30] #0: ffffffff8f53ed68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 387.246532][ T30] #1: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 387.277250][ T30] 2 locks held by syz-executor/10544: [ 387.282705][ T30] #0: ffffffff8f53ed68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 387.292297][ T30] #1: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 387.301432][ T30] 1 lock held by syz-executor/10552: [ 387.306839][ T30] #0: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 387.316338][ T30] 1 lock held by syz-executor/10627: [ 387.321748][ T30] #0: ffffffff8fdc0700 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 [ 387.331398][ T30] [ 387.333761][ T30] ============================================= [ 387.333761][ T30] [ 387.342207][ T30] NMI backtrace for cpu 1 [ 387.342227][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 387.342265][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 387.342286][ T30] Call Trace: [ 387.342295][ T30] [ 387.342304][ T30] dump_stack_lvl+0xe8/0x150 [ 387.342343][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 387.342524][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 387.342580][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 387.342613][ T30] sys_info+0x135/0x170 [ 387.342666][ T30] watchdog+0xfd7/0x1030 [ 387.342724][ T30] ? watchdog+0x1c7/0x1030 [ 387.342763][ T30] kthread+0x389/0x470 [ 387.342792][ T30] ? __pfx_watchdog+0x10/0x10 [ 387.342821][ T30] ? __pfx_kthread+0x10/0x10 [ 387.342850][ T30] ret_from_fork+0x514/0xb70 [ 387.342876][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 387.342898][ T30] ? __switch_to+0xc89/0x1420 [ 387.342933][ T30] ? __pfx_kthread+0x10/0x10 [ 387.342963][ T30] ret_from_fork_asm+0x1a/0x30 [ 387.343006][ T30] [ 387.343014][ T30] Sending NMI from CPU 1 to CPUs 0: [ 387.466043][ C0] NMI backtrace for cpu 0 [ 387.466064][ C0] CPU: 0 UID: 0 PID: 5749 Comm: kworker/0:6 Not tainted syzkaller #0 PREEMPT(full) [ 387.466084][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 387.466097][ C0] Workqueue: wg-crypt-wg1 wg_packet_decrypt_worker [ 387.466197][ C0] RIP: 0010:rcuref_put+0x0/0x170 [ 387.466250][ C0] Code: 89 ff e8 53 4d b4 f8 e9 02 ff ff ff 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <55> 41 56 53 48 89 fb e8 a4 0f 49 f8 bf 01 00 00 00 e8 ba 43 17 f8 [ 387.466266][ C0] RSP: 0018:ffffc900000073a0 EFLAGS: 00000286 [ 387.466281][ C0] RAX: ffffffff897c2ed6 RBX: ffff888056f39500 RCX: ffff888025f29f00 [ 387.466295][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff888056f39540 [ 387.466307][ C0] RBP: ffffc90000007510 R08: ffffffff902f89f7 R09: 1ffffffff205f13e [ 387.466321][ C0] R10: dffffc0000000000 R11: fffffbfff205f13f R12: dffffc0000000000 [ 387.466334][ C0] R13: 1ffff110065946ab R14: ffff888032ca3558 R15: ffff888056f39500 [ 387.466348][ C0] FS: 0000000000000000(0000) GS:ffff8881252b9000(0000) knlGS:0000000000000000 [ 387.466362][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 387.466374][ C0] CR2: 0000200000000050 CR3: 000000000e74a000 CR4: 00000000003526f0 [ 387.466390][ C0] Call Trace: [ 387.466397][ C0] [ 387.466403][ C0] dst_release+0x24/0x1b0 [ 387.466425][ C0] skb_release_head_state+0x71/0x360 [ 387.466508][ C0] __kfree_skb+0x24/0x210 [ 387.466534][ C0] nft_synproxy_eval_v4+0x383/0x530 [ 387.466586][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 387.466608][ C0] ? nf_ip_checksum+0x13c/0x510 [ 387.466653][ C0] nft_synproxy_do_eval+0x335/0x550 [ 387.466671][ C0] ? lock_acquire+0x106/0x350 [ 387.466691][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 387.466709][ C0] ? nft_trace_init+0x280/0x4d0 [ 387.466835][ C0] nft_do_chain+0x48d/0x1ad0 [ 387.466904][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 387.466928][ C0] ? __pfx_ip_vs_fill_iph_skb_off+0x10/0x10 [ 387.467012][ C0] nft_do_chain_inet+0x360/0x4b0 [ 387.467034][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 387.467059][ C0] ? nf_nat_ipv4_local_in+0x21f/0x720 [ 387.467107][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 387.467128][ C0] nf_hook_slow+0xc5/0x220 [ 387.467147][ C0] NF_HOOK+0x21f/0x3c0 [ 387.467216][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 387.467240][ C0] ? NF_HOOK+0x9e/0x3c0 [ 387.467263][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 387.467288][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 387.467317][ C0] ? ip_local_deliver+0x113/0x190 [ 387.467342][ C0] NF_HOOK+0x336/0x3c0 [ 387.467367][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 387.467391][ C0] ? NF_HOOK+0x9e/0x3c0 [ 387.467414][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 387.467439][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 387.467463][ C0] ? ip_rcv_core+0x88d/0xd50 [ 387.467489][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 387.467513][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 387.467537][ C0] process_backlog+0xa34/0x1860 [ 387.467570][ C0] ? process_backlog+0x3c3/0x1860 [ 387.467600][ C0] __napi_poll+0xaa/0x330 [ 387.467623][ C0] net_rx_action+0x61d/0xf50 [ 387.467653][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 387.467675][ C0] ? xfrm_dev_backlog+0x24b/0x3c0 [ 387.467742][ C0] handle_softirqs+0x225/0x840 [ 387.467771][ C0] ? do_softirq+0x76/0xd0 [ 387.467789][ C0] ? wg_packet_decrypt_worker+0x2ae/0xda0 [ 387.467811][ C0] do_softirq+0x76/0xd0 [ 387.467827][ C0] [ 387.467832][ C0] [ 387.467839][ C0] __local_bh_enable_ip+0xf8/0x130 [ 387.467856][ C0] wg_packet_decrypt_worker+0x2ae/0xda0 [ 387.467885][ C0] ? __lock_acquire+0x683/0x2cd0 [ 387.467904][ C0] ? __pfx_wg_packet_decrypt_worker+0x10/0x10 [ 387.467926][ C0] ? kasan_save_stack+0x4d/0x60 [ 387.467956][ C0] ? kasan_save_stack+0x3e/0x60 [ 387.467978][ C0] ? kasan_record_aux_stack+0xbd/0xd0 [ 387.467997][ C0] ? call_rcu+0xee/0x8b0 [ 387.468026][ C0] ? rht_deferred_worker+0x1a91/0x2250 [ 387.468071][ C0] ? process_scheduled_works+0xa8e/0x14e0 [ 387.468087][ C0] ? worker_thread+0xa47/0xfb0 [ 387.468104][ C0] ? kthread+0x389/0x470 [ 387.468125][ C0] ? ret_from_fork+0x514/0xb70 [ 387.468143][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 387.468170][ C0] ? __lock_acquire+0x683/0x2cd0 [ 387.468193][ C0] ? __lock_acquire+0x683/0x2cd0 [ 387.468214][ C0] ? __lock_acquire+0x683/0x2cd0 [ 387.468230][ C0] ? look_up_lock_class+0x57/0x110 [ 387.468248][ C0] ? register_lock_class+0x31/0x2e0 [ 387.468268][ C0] ? __lock_acquire+0x683/0x2cd0 [ 387.468288][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 387.468313][ C0] ? lock_acquire+0x106/0x350 [ 387.468336][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 387.468362][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 387.468380][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 387.468400][ C0] ? rcu_is_watching+0x15/0xb0 [ 387.468422][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 387.468439][ C0] process_scheduled_works+0xa8e/0x14e0 [ 387.468471][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 387.468504][ C0] ? assign_work+0x3cf/0x5d0 [ 387.468535][ C0] worker_thread+0xa47/0xfb0 [ 387.468574][ C0] kthread+0x389/0x470 [ 387.468596][ C0] ? __pfx_worker_thread+0x10/0x10 [ 387.468613][ C0] ? __pfx_kthread+0x10/0x10 [ 387.468636][ C0] ret_from_fork+0x514/0xb70 [ 387.468655][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 387.468673][ C0] ? __switch_to+0xc89/0x1420 [ 387.468699][ C0] ? __pfx_kthread+0x10/0x10 [ 387.468722][ C0] ret_from_fork_asm+0x1a/0x30 [ 387.468752][ C0] [ 388.129929][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 388.136863][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 388.146012][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 388.156110][ T30] Call Trace: [ 388.159437][ T30] [ 388.162403][ T30] vpanic+0x56c/0xa60 [ 388.166516][ T30] ? __pfx___schedule+0x10/0x10 [ 388.171422][ T30] ? __pfx_vpanic+0x10/0x10 [ 388.175989][ T30] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 388.182219][ T30] panic+0xc5/0xd0 [ 388.186009][ T30] ? __pfx_panic+0x10/0x10 [ 388.190607][ T30] ? preempt_schedule_common+0x82/0xd0 [ 388.196129][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 388.201587][ T30] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 388.207803][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 388.214109][ T30] watchdog+0x1030/0x1030 [ 388.218512][ T30] ? watchdog+0x1c7/0x1030 [ 388.223175][ T30] kthread+0x389/0x470 [ 388.227306][ T30] ? __pfx_watchdog+0x10/0x10 [ 388.232048][ T30] ? __pfx_kthread+0x10/0x10 [ 388.236707][ T30] ret_from_fork+0x514/0xb70 [ 388.241359][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 388.246544][ T30] ? __switch_to+0xc89/0x1420 [ 388.251277][ T30] ? __pfx_kthread+0x10/0x10 [ 388.255916][ T30] ret_from_fork_asm+0x1a/0x30 [ 388.260756][ T30] [ 388.264350][ T30] Kernel Offset: disabled [ 388.268715][ T30] Rebooting in 86400 seconds..