last executing test programs: 26.273903352s ago: executing program 0 (id=258): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x4d}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000000180)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4a0, 0x288, 0x5802, 0x294, 0x288, 0x294, 0x3d0, 0x325, 0x378, 0x3d0, 0x378, 0x3, 0x0, {[{{@uncond, 0x0, 0x220, 0x288, 0x52020000, {}, [@common=@inet=@hashlimit2={{0x150}, {'netpci0\x00', {0xfffffffffffffffd, 0x4, 0x0, 0x0, 0x0, 0x6, 0x7fffffff, 0x40, 0x78}}}, @common=@ipv6header={{0x28}, {0x88, 0xa}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x8, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@dst={{0x48}, {0x1, 0x0, 0x0, [0x8, 0x7, 0x8, 0x6, 0x101, 0x800, 0x8, 0x8000, 0x4a, 0x9, 0xff, 0x1000, 0x1, 0x8, 0x4c8, 0xa68], 0xa}}, @common=@frag={{0x30}, {[0x3]}}]}, @common=@unspec=@NFQUEUE0={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x500) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000500)={0x2, 'wlan0\x00', {}, 0xb}) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000400)="110000001000ffffff9700"/22, 0x16) 25.92234584s ago: executing program 0 (id=267): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES64=0x0, @ANYRES16=0x0, @ANYBLOB="0017c43a334e1a2ab60000000000008fdabbb50100"/34, @ANYRES32=0x0, @ANYRES32, @ANYRESOCT], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x801, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x1feff, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17, 0x74}}], 0x400000000000179, 0x0, 0x0) 24.428450053s ago: executing program 0 (id=277): syz_emit_ethernet(0xd2, &(0x7f0000010a00)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "3000bb", 0x9c, 0x2b, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x81}, {[], {0x0, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x2, "8a2e0b0ec46fadbd18834312e9385e5b91593453652ca34faa9af7e503cdd8a4", "c7d38cffe3874f77f421060f4ddfabe88f79f6a4b16e6508ccf912ff63750351be9e6f00000000000000002c00", "a9b67a62f584fabf708cf4e004a87a4898ab17058c5d1c20e471b1ae", {"18904dfcb9386eca1bb9020b9c18d3e0", "e760555695aaf81ffd8de70c81ecf313"}}}}}}}}, 0x0) 24.007510885s ago: executing program 0 (id=280): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61123000000000006113100000950000bf200000000000001600020038e873a23d030100000000009500000000000000bc26000000000000bf67000000000000070200000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) 23.736168675s ago: executing program 3 (id=282): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x55) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x60, 0x12, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {}, 0xffffffff}, [@INET_DIAG_REQ_BYTECODE={0x14, 0x1, "0710100002200000ffffffff00000000"}]}, 0x60}}, 0xff0f) 23.565662041s ago: executing program 0 (id=284): r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000040)={@rand_addr, 0x0}, &(0x7f0000000080)=0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000001c0)={'sit0\x00', &(0x7f00000000c0)={'gre0\x00', r1, 0x20, 0x8000, 0x4, 0x200, {{0x7, 0x4, 0x1, 0x25, 0x1c, 0x64, 0x0, 0x6, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, {[@ra={0x94, 0x4, 0x1}, @noop, @end, @noop]}}}}}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r2 = socket$inet(0xa, 0x801, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f00000046c0)={'filter\x00', 0x7, 0x4, 0x3c8, 0x110, 0x110, 0x1f8, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@arp={@multicast2, @local, 0xff, 0xffffff00, 0xc, 0x4, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xbe9240b8a223bba0]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x2, 0x6, 0x23b0, 0x9dd7, 0x80, 0x9, 'veth1_vlan\x00', 'ip_vti0\x00', {0xff}, {0xff}, 0x0, 0x12}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x400, 0x1, 0x2}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x3b8) (async) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f00000046c0)={'filter\x00', 0x7, 0x4, 0x3c8, 0x110, 0x110, 0x1f8, 0x2e0, 0x2e0, 0x2e0, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x2e}, @mac=@remote, @loopback, @local, 0x1, 0x1}}}, {{@arp={@multicast2, @local, 0xff, 0xffffff00, 0xc, 0x4, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xbe9240b8a223bba0]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x2, 0x6, 0x23b0, 0x9dd7, 0x80, 0x9, 'veth1_vlan\x00', 'ip_vti0\x00', {0xff}, {0xff}, 0x0, 0x12}, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x400, 0x1, 0x2}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x3b8) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket(0x1d, 0x2, 0x6) (async) r4 = socket(0x1d, 0x2, 0x6) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) (async) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad4c90c200"/16, 0x10) getsockopt$SO_NETNS_COOKIE(r0, 0x1, 0x47, &(0x7f0000000240), &(0x7f00000003c0)=0x8) accept4(r5, 0x0, 0x0, 0x0) (async) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x48}, 0x1, 0x0, 0x0, 0xc004}, 0xc804) (async) sendmsg$nl_route(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={0x0, 0x48}, 0x1, 0x0, 0x0, 0xc004}, 0xc804) recvmmsg$unix(r6, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f00000005c0), 0x2}}], 0x400000000000378, 0x40000100, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x5) openat$cgroup_ro(r3, &(0x7f0000000140)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000740)=ANY=[@ANYBLOB="2b68756765000000002a93f01181658625c7a611aa018913144254285c2322877f303170dc44e66e93c41751153ebe7fd52e9aa49a00de45e18562caad894a0cfb52f08b417531cfe51235e544c9f89a48ea0ff6f401f1bbad52e43e4f4444f3deb6d1869be2c90012d7b2388ae51ba6ac168e2e9ea6221c575d199443061edb03c76602ce5e5144d978570d1b8af21c61d30d4d40b900"/162], 0x9) (async) write$cgroup_subtree(r5, &(0x7f0000000740)=ANY=[@ANYBLOB="2b68756765000000002a93f01181658625c7a611aa018913144254285c2322877f303170dc44e66e93c41751153ebe7fd52e9aa49a00de45e18562caad894a0cfb52f08b417531cfe51235e544c9f89a48ea0ff6f401f1bbad52e43e4f4444f3deb6d1869be2c90012d7b2388ae51ba6ac168e2e9ea6221c575d199443061edb03c76602ce5e5144d978570d1b8af21c61d30d4d40b900"/162], 0x9) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) (async) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b000000040000000400000010000000000000003f12d348ce326dc9b5b4fecd9a985f85096c8f01530385d6c594f6ca0705df2840a98bb16d803066d8b29b76b4a274c239c97515d8e29b00a6c8b36466daeff18b7cea10cd5de595b0da3c7c135f45ee6233c0f813f2a97f5ee4", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="000700000c800200000000000000100000000000bb5a8b375a5318abac0aa12d9ea54b9ea94e274b1b517d3d6d3f11f58112d62a2802d3b800496a7b096a223637e296cfe682986497a143f416b38ee2d685ed752b14ca8b1abbdc82a0aee2f7562b1c0d3462e7908170027acdbd4b82fc6d335d4e2e23ad7f1f", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r9, r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r9, r7}, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) 23.333894377s ago: executing program 3 (id=286): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB="14000000100001ffffff6a00000000000200000a20000000000a050000000000000000000100fffc0900010073797a30000000002c000000030a01010000000000000000010000000900030073797a30000000000900010073797a300000000054000000060a01040000000000000000010000002c0004802800018007000100637400001c00028005000300010000000800014000000012080002400000000e08000b40000000000900010073797a30"], 0xc8}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 23.296294234s ago: executing program 2 (id=287): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xe, 0x4, 0x290, 0xffffffff, 0x0, 0x98, 0x130, 0xffffffff, 0xffffffff, 0x0, 0x98, 0x1f8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x11}, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x1, 0x1, 0x2, 0x1, 0x9}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0) sendto$inet(r2, &(0x7f0000000100)="1962", 0x2, 0x20000040, &(0x7f0000000200)={0x2, 0x1234, @loopback}, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) write$tun(r1, &(0x7f0000000280)=ANY=[], 0xfd6c) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000010003b1500000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100736974000c000280050009008404ffed6623a3102900000075ed7c96d639f71ef73022bc1e0c7858b075e9f2e96bde6acc8b43e349ddbb53ba629958ae243f39ce3576a8be3007a03b3fcfb44815567792544b20079872fa77483d5e22c6a6e8"], 0x38}, 0x1, 0x0, 0x0, 0x2400c000}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) recvmmsg$unix(r4, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000008c0)=""/200, 0xc8}, {&(0x7f0000000640)=""/249, 0xf9}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000007c0)=""/92, 0x5c}, {&(0x7f00000001c0)=""/104, 0x68}, {&(0x7f0000000300)=""/25, 0x19}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/133, 0x85}], 0x9}}], 0x1, 0x2080, 0x0) write(r4, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x1, &(0x7f0000000600)=@raw=[@ldst={0x2, 0x3, 0x1, 0x0, 0x1, 0x10, 0x1}], &(0x7f0000000040)='GPL\x00', 0x40000000, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0xe}, 0x94) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000000100), 0x4) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000080)='macvtap0\x00') r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x60, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x1234}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x60}}, 0x0) syz_extract_tcp_res(&(0x7f0000000040), 0xe, 0xbb70) 23.066857029s ago: executing program 4 (id=289): r0 = socket$nl_generic(0x10, 0x3, 0x10) close(0x3) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, 'macvlan1\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000100)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000220000000400000002"], 0x48) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), r4) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000000280)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000000100000008000100ffffffff08000200020000002c00048005000300020000000500030000000000050003000000000005000300050000000500030001"], 0x50}}, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, &(0x7f0000000000)=""/10, 0x2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r3, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000140)=r2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r6, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f00000002c0)=r2}, 0x20) r8 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r8, &(0x7f0000001f40)={0x0, 0x0, 0x0}, 0x8808) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r7}, &(0x7f0000000080), &(0x7f0000000100)=r8}, 0x20) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x1c, 0x0, 0x1, 0x70bd29, 0x4, {{}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4804}, 0x80) 22.753914151s ago: executing program 1 (id=290): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f00000025c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x28, 0x2e, 0xa01, 0x0, 0x0, {0x1f}, [@typed={0xc, 0x0, 0x0, 0x0, @u64=0x1}, @typed={0x8, 0xb, 0x0, 0x0, @ipv4}]}, 0x28}}, 0x8000) (async) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0x3}, 0x6) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000002440)={0x0, 0x0, &(0x7f0000002400)={&(0x7f0000002080)={0x18, r4, 0xd01, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}}, 0x0) r5 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$alg(r5, &(0x7f0000001340)={0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000000080)="e35262b694736ea2b69ea6f362912044b78fa62051c470dba91736adbb0e315b6c90c7020760cc3f3a7e19ff39d62d64cd1d255d1e9b57532c49741883cdd6ee16bd9527c9ed2bbf8030c9b755609f6052be6191f27678c3cc2d69d4599cd301ce6785fe6113ee46cc47", 0x6a}, {&(0x7f0000000100)="8d59a5e49be2709e3972cfc1b082af237205921d710a01c48557783678d0f99264d9bb122dfa0ff930d60ac510851b99d3b62894aaa7cdb4cc30d12d5ae8dc37ff715c6eb473e6b79738", 0x4a}, {&(0x7f0000000180)="d8f71ec3f99a93e8015cc4ff5c0934b3a7813ecbd8", 0x15}, {&(0x7f00000001c0)="f2d41e17dff470b6fd5fbda5d051b45aaad0156d40beafd331a83124a8b02e002ab531c1f540803db913931006e5d82b36de995a3cb41f67f7f75dbf5f9cb99286add401da1295ca3b0eda51f24fa64a1477699593887b09d676e7c0fee4d6702fbfe93a570561f01c95feec5c51fe1f81f77e3471c9a28ec64436dda751c5661ae3d4f5c00e355396ab9f625a75669663bdd9fb5670c7067ed1711d8124e2cc241874dc153c5a098ad45d92556bdf7b4f3fee82261addcb72cd1981eef1a844f1412950d8996bad75ea41760aef67b771449e1be119cd1bed717062df4bcdf380e059b103d29b2511b8d999b058b27921ea04581f6b5775534dbb8bf2fcf4ab929326ca73b1c09739613ebdf9d4457767c150c7c5651a4a1fa11ff0f396cd72a3c3861037a03ef386875582b7ccd2c776fd6ba9e4b2601506d025ee305dc673e73e9c15b84923bf91965a3de0fa1f92f4be1250b5c736a571d075b3d8f3c7d18795fe543740fd691f99c0b32a2a39aa0d05918fb0c262f8ff08df7693ba0a91c4ac735482c75ea38981788b488aa4271caf57439876acdb47f83cc0a612050cb6b58149d7ff87fdb439e0a278eeb4aacf2b79411b4fbb7409c4ab8af6228805d96eda45d6526352e3f59bf07005ae3e6bbb2e551058c93565ca4be0d75cadc84864ba17deae4637ef470d4463adb252f1e1f348f7cf1aa7c25c46323e95f395e9bf237628e01cd92476bfc01d106dffac57197d42a92a9191ccc517790c02408660f227d18a769f65b974d519884175405790b6e265fb26cfbd86c7de258046ad2d94a34d6dc8390c24941f88c345c7cfac3ef91fedfdca41d06232da0501116713d5f245267d34042e7646048d4d72a19c023e13e7132e1251be6863592b635f3ec686d031ff1b0b9219e65b6be6416f5d07af09a12e559be640d827021c2bd4f1b031552e40e8ea21492f0f4d5d1983204a15d253095e749cf9df874f5ee469b866d1467d40d70a07b107dbf5410afc58a24b0e79e1299619d34242356bc92240b1ef6345ac5fe1042ca6563df21186215f1187a5b4c40860658f68467ad76b65be088452d9a47b20ee9b9d1e1143d4d8424a9106ab8ea63ef8aeb2c6545f40d6a8f117ae579f7cd242cf07e0c37485257bd4409ea66410d61b5321e77bc155990893897e8a0cdfa957371f909fa230b286b40ea4e31b86c7af861c7d6ed85bf576b1aae085372c7f8d5b07207c68d3b7da9a575f709dd5241f69ddd200f03528ad3adf51da99b667d376353620a260cae8aa39314706ec31814a4322dfcd800b73bff92c61c0ecf52421d2479511e9e74266f88cd4b2b95fd42223d61ee4ae82748155d0bc28f8344f240ac0f96ceafb481693a8753fe0ea7d44c2e68605b770ac24136c1c6aaa0ea41ccce75d8878798349661021f3581ec4d3b85b4aa9c7076b37110fa369fde903de7e1df04902e5a6d9583fc7e26927abe5bd2623eab1ae1d199cf4588e83422e69b46105bf1a6f2cb94ae0e4bd6ac8b3192cb5a90bd83f3c5a8287d595ab1e1a7f01d33a6ca348e10063a3254d6825db96cc132689615429ae942a7e07924688cd968a7c1b307473b85bd5721603f1970768096003c8c6deac25ceffd5564af938f11e474048c6de909fda77a9573d2fb29bb67ccecff56e3618016a532a80510a0d89e9ae79be0493adf6f7a3904e28ff26d358fc25bed9888c76c0d8e02fa6d9b07048c081b1c1886868ffce79b79db37e362359aab082184792c381d2f9d0d9b0a828f563be20b6c642c2b751ebe7cb1ee812327929aad978a7f90b15a24dd4201575cec9111d3e8a1a6e1705f7c88a2ddd02590268b6ec579816d2ea1a2e87dbff31204254fa2b927e1eeea85784719e202a2700cb5e90fef740c5c1976e0a571fc72f2d3851c300374cdef610ae83c57baba5d2625065533c48a16e57c179b4dd56fa61a49ebab440b825458bf53b94eae9bdf2d8658a67b375efe946c19fe72b7de528449a1f4acb3210ac719e1b1f6ce09cda515a680f2ae75752af744f423b58ad8055aa7ddbfb1df11bda066d877c6144a4f06faf73322d23231eaa2f1fa23c2cb3005931e7fc1396fdff9883abb0617ee82eeba0d94202b5364d2dd3e99ed88424935abb498e98afb3534314fb8f76a801d77e19e32702afad760cb912b3fafb1abc8fa3664c59b26be9c470ab3ffa24503e93720f4743664c551cd34a2649ec554a7f4995ccd8f6bc675ef16d6105e890ef780e98aee9c9fd4c735058fca8a3a18315c5a020ea98e3866a2766a1c98e37996f62d3a4a149c7f9ee2ca0b5c5ad8b783ca8a51a1fb1c8193d7f9fd8c808a97ebd3baf0ccf3c6774f4aa9c99aa032c1e91b06b4b70dfb79c5fee5491375625659f1da62061de2fc6f19fef59d984e5bc51bd0c34784f7c2e45416368c4ba01a9043fa85902b038a4a79df7049891b817a9cb85e5493015ba2512397fa505f292ac7e00e6d269e0f7388aa2f3f1aa45c7bf8b7b51ec5af366ffc989666da87a92c972bdb4e2c32f045d519de53df066056a2b0fdaca93fdd575328d6bb01fbaf4441b19272539e111c275e1f4ff7bd511c6fcdb0e15bc1eea089a096e80f49dd763c7dc584eabf08c410e99955769a7b0a63f505b663ab5e41892396a2e22cc4b5d8d6c9a2bff3a315b8a3ddb6f929f55d8f97c41bba64190831b09a30fc81642659341bbec09cbf7a0187ed1f80b5ca3aa4fbacefa7794ebe593cac6c1aacf8bae90a7ab10327626a7b70d1cc0658e76299f55f2fe58eedd49b61b9affabe63622a4fa54d6e6a73da7fa1fba63255ea064b87f617e483b2edf3c88e0c18b691ea2107efad53276d75a0d3eb765ce498db2f74933f77edb7e1258f78390cbfb9f30ceb562a83f0967b64204e214eefd2410a46edaa6fe9d3671e5cefe2ae1e0d6b5dd5e3cfdedb2a70594d5c998631f13262c182dbd22397a956e254373e8aac0b29f3fdec44c0a4bbef239e1f2a487f793ad56750701fe34a03d9e103e584025c98967520a13b1c19e2b46336649de5cefc4d9c64c96e9ffa206c937ffc0d133c7e740bfa708fb5e63ce42538f6513958bfa5f19b1a9712ae80e7a84ba89fbd5b143fea397f8c4073c3d8f7369622ee4504fb09244f4b9e14e0d58d7aaf8fffdd9fc43f63cc651dc0aea6ce1488b2422dec7bf19059fffe4bd47d2e7c20ca41bdc13c44f9de5bc30d87bd632e4eea9fbce0e5cefda8ccfd6c5af9e760d8b34e9ab5817aa112644cc1e01b1d00775884d5d3c032eb2246e4fa819abc99c15980263b8fd718bdea245d369ea6790e2f989a13ac3a76d12a8d7ba3e147bce8bf6cc922613ea979e197104386116eeb8b0694c2df02b38b7b309154758a6896d36506a5061383837055c853e22db00a45eaa51d86331e607e826f42b96f653203d237809ebfeff2ea8ac7484fac9b3d5d2972fa3f6567cc6f204f86c3cc2472d3c765c6853aec4a235b23982a4d1ed6139a114029e64dd4cdcdc9a75a8be9536ae8c72bde9db927f26146b8ce9c8694a4dd7f6563dff9d7e57d5f8148e7ca95ecd89b52082ab22d196a0fc3b19cbf31eb04f6b97e1bfc631d1a1c4a24297ddb479588b76b96c2251b3768dd3cb5fdc9b015d89014b1603ff038e833a9bb17beeabaaf15890d91459621549c8d30eeffab6fcbae3197bb9c60c81825c4aacf2fa019c9a203499dae4e903e4f9f57a4a1818a8c3db590a68731d2bc9fbbcf1e2e958e1380190986b421f694b1a296c94879147f4d82b0736d66d7742543c4cbde07a1388b015601f98afedbbcaf42e5a7334634f9036a92139a83e1a99c86db25d9684376e81baa28711b1f6324e2e66ce24d024b3dd5bafc3d6d6efd792e22a2e87032a7b55a9778e0e7a07e0a90e0774929d504c8336727b7ec81b35c4e8883b7d15bf3615e50799dcbaa43b671ee1bcf459841539345493fb7eae76bfd354eef46292693a79b88a390ddf5315abfa0c99caa73c08fe61db320183e6aa7558db98da5acdf788dc54dc0e79f01be33c9f118a71b1719679143d1f5d1caf951a931693107f32b76175f7e4fc588f2f9a9cf5d0aaf6100e25a9baafb2836f03057e01c401db866a30ad3f3b2c7bccc3676a37b61d3b3042bdd992c783f7e3c6822c89f5fff14ab6e6d81c41e12cbbcd2fb76a1c4d4c578273c8706a2ccf45c3b9503fc68a627acd473aaaad767bb0b62663c6e2b2289aba71559027f84fd9d79c9d1e8f2185eb1692b5205c1412b2928688d8d9db8dad3bb160b503a69dd7fd2f45970aa63c4b83641a27f34d15ff77be5ad3acb9b58d92abfa9dd527e0feae4b1e3351c1d8c4fed68a4635005248ad358d8f086431cd18c69466d3828812abe1a9980b8791179a7d87f09e8e6cae14c0a6b38e3097cc9506342ad522076dc4420a29c7aaf35d94680fb53a5b76e7a2b4cbe3822af23ff9e93217bb873ef06ce314f481466463325fd91f48837ee34b9e07dc8bc54cf1896a343cc375c82c47b21314290eae15459b20efdb905605d3c0392944d9186d037df35a9e9e2bd9aec73153053d82e531665dcb5563224a8fdbd2f903a2e36ce341646674a9326d93a07f44fee342c105fd90bfdc4122bc6e5f2de413684c8d22ec002d62b0515f7073019b6189f1eecdd4614e70cd9bcc317064a8e79adde56cbc0d58418d1583b1d454df0a1a3a703019bdab9407750f657d6fef57049e3373c1ac61360c923472dbbc90b984b9da45a7d40f6eb42c961a1f7346e9580bc78915fc500bd35255364f3dbb72c5467dd42fe3eece108a254e813663aedce428b227648e63b11b4a3b90a82d75eb656bf7842340f70f9ceaea797cdf9cbd4f62c40e92dba32e2df33b2737e13658bdd4cede4642b5b390ab69e7c39d86da7f458e59d9404cf73fec2067d7cd39c30bd0cf7874d857f62d5a734abd01fdfb4e910bda210c7ed8d3254f0edd96fade294e9d9081a092ef75f6d4fdd735623a14847fdf8f5842d325e83f9ae823e405b20374fb08420e8f6c1f8f27de1ee9aee074619644cb7a40135e8682b02a324915ab2da767bbcfbd3dcba9159a369133b5f5e185aae4a4e3e04dab039bff10ddf0b4c629e2087648bf25bbfab4956c4732f48ba65cd8b50c8b29c65fb77eed25a38f2ca43def9d21d3c9139122ea742853d928cfcdb816af0f39706db5872486a1e2fe3c6d998fb6f9c87fc820b191a6b97d328cebf6c37f2148cc931187672dd5e9e04cfe306910dc42b4e1dac512ce2552db02091b65bc2055ed73108a487a3714ad9e0e139cc3dee2a1eb4a59f82c0305b90290305f95e69a3e883f3f48615f80f1e4fa6990fcbb1fc456ea685c47d0b3b8d1cc44165a1cbda9e7120043104f59209fce6be898d9f8a978c42cfcfd73b5806756a6e03a681be6c07ae35b6c9412dbbf62992f9d8ba339597cb3cd16b6f9ec920ddb64012bd16c2859991ad4f4baf372458726c7a04eacd9e7ae675c6b13a1c65645b9c8a82f98bd96161e5e35ffc8ecf4cda550d8bd9a2a089e18ca0b104b39fc7f7cb2a4859e68702d04af9883f3e67b61bf8cbe74b6e05c0c8cc3b914a4ab9ea3a522eb6ba43c59d9354a81fe24079c59abef163c6740dafbe072f55fffdc9c0a04bb651392f19d4d8b594bfa81bef1d82cefe26fd724d7bf672ca2e93b112c72c4b70d1a734a19bf455d98fa89dd42873ffc80d113ba67dbfc97c4238f83bf9d97bef0f746fb3821c0191c9e92fe1482f8a70685a46c8599dbc355deb2f9e01a622885fa5f8146", 0x1000}, {&(0x7f00000011c0)="cd422ef53fad9d0d", 0x8}, {&(0x7f0000001200)="a4c278dfa9fe9fedfccce07102c2dab117ef7692f76453896d329fcadaf800cf445ebbd32e59739982cb875a4bb0dfe995fcccb31960df0faa0964d426e7375676db80c4ffd297950db86f0eb9af5f404b553be82e7538b7b3f4cb3dba7e4e9a389e0260b9", 0x65}, {&(0x7f0000001280)="9dca2045a0da697752", 0x9}], 0x7, 0x0, 0x0, 0x11}, 0x8800) (async) write$bt_hci(r2, &(0x7f0000001800)=ANY=[], 0x7) 22.574193362s ago: executing program 3 (id=291): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x2000000) 22.573841486s ago: executing program 4 (id=292): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xf}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x34, 0x3, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x24, 0xb, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x8400000000000000}]}}}]}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x40000000}}, 0xe4}}, 0x0) 22.558355694s ago: executing program 0 (id=293): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000240), 0x4) (async, rerun: 64) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x840) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000003c0)=0x0) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r11], 0x1c}}, 0x4008054) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000400)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x54, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}]}, 0x54}, 0x1, 0x0, 0x0, 0x8800}, 0x84) splice(r0, 0x0, r2, 0x0, 0x80, 0x4) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r13, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r14 = socket$netlink(0x10, 0x3, 0x0) r15 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r17 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r17, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r18, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) (async) r19 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r19, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r18, {}, {0xffff, 0x6}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x80, 0x10000, 0x9}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x85c}, 0x0) (async) sendmsg$nl_route_sched(r14, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r16, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24008890}, 0x4000080) (async) ioctl$SIOCPNDELRESOURCE(r0, 0x89ef, &(0x7f0000000000)=0xa5) 22.456558517s ago: executing program 2 (id=294): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4000000010000d0400000000000000000000c300", @ANYRES32=0x0, @ANYBLOB="00000000498005000a1101004af29c3ff0490000140035006d6163766c616e30"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x8000) 22.355358605s ago: executing program 1 (id=295): r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x8000) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b87031100c3001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) 22.254141102s ago: executing program 3 (id=296): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0x8, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000016c0)={0x6, 0xf, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018210000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70a000014000000b70300000000000085000000ce000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b70000000000000095"], &(0x7f0000001540)='GPL\x00'}, 0x90) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000016c0)={0x6, 0xf, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018210000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70a000014000000b70300000000000085000000ce000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b70000000000000095"], &(0x7f0000001540)='GPL\x00'}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={@map=r0, 0x2, 0x0, 0x0, &(0x7f0000000000)=[0x0], 0x1, 0x0, &(0x7f0000000040)=[0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) 22.200632663s ago: executing program 4 (id=297): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="110000001000ffffff9700"/22, 0x16) (fail_nth: 3) 21.961823997s ago: executing program 2 (id=298): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000180001efff00000000000000050041000800b8"], 0x1c}, 0x1, 0x0, 0x0, 0x400d1}, 0x0) 21.405090092s ago: executing program 3 (id=299): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000000740)=0xffffffbf, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) 21.397478111s ago: executing program 4 (id=300): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="110000001000ffffff9700"/22, 0x16) 21.258761747s ago: executing program 2 (id=301): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000010)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000020)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000030)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000070)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000480)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000090)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000a0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000b0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000140)) socket(0x1e, 0x4, 0x0) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x200}, 0x10) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r1, &(0x7f0000000200)="580000001400010300000000000000001e000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff00"/88, 0x58) 21.251045789s ago: executing program 1 (id=302): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r2, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000001c0)={0x64, 0x2, 0x7, 0x5, 0x0, 0x0, {0x0, 0x0, 0x1}, [@NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x2}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x1}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x9}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x4}, @NFACCT_PKTS={0xc}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000840}, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000010000000500000a4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310084bb000000200003801c0000800c00018006000100000000000c0004400000000000000007140000001100010000000000000000000100000a"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000001300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001340)={0x44, r4, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x20000002) 20.913266282s ago: executing program 4 (id=303): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="1400000010000100000000f5000000000200000a20000000000a01040000000000000000020000000900010073797a300000000040000000030a01040000000000000000020000000900010073797a30000000000900030073797a3100000000140004000800010000000001080002000000000050000000120a01040000000000000000020000000900010073797a30000000000900020073797a3000000000080003000000000a1c0004000600010005b400000500020007000000080003000000000358000000060a01040000000000000000020000000900010073797a30000000000900020073797a31000000002c000400280001000b0001006f626a726566000018000200080001000000000a0900020073797a300000000014000000110001"], 0x130}}, 0x0) 20.742462904s ago: executing program 2 (id=304): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000140)={&(0x7f0000003d80)=ANY=[@ANYBLOB="020200030c00000000000000000000000200090008000000e90000000000000003000600000000000200000000000000000000010000000002000100000000800000000200000000030005000000000002"], 0x60}, 0x1, 0x7}, 0x40080) 20.73808308s ago: executing program 1 (id=305): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x66, &(0x7f0000000640)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd600107000000000000000000ff02000000000000000000000000000100000e220030905bb500788b833bdd4d5c11dacf7abb64c77922fcf4057d118589e08d8851add500"/93], 0x0) ioctl$sock_TIOCOUTQ(r0, 0x5411, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="4c000000150097f87059ae08060c040002ff0f0200000000000001870182fa73a69d35a2cca84708f7abca1bac1414aabd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) 20.654125286s ago: executing program 3 (id=306): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010c00000000000000000000000a20000000000a01010000000000000000010000000900010073f97a30000000003c000000090a0104000001000003000001000000080024090000000d0900020073797a32000000000900010073797a3000000000080005"], 0xe4}}, 0x0) 20.485596448s ago: executing program 4 (id=307): r0 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r0, &(0x7f0000000f40)={0xfd, 0x0, 0x0, @empty}, 0x20) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, 0x0) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x24044010) r4 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r4, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xff8d, @loopback={0xffffffffffff0000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000500)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f0000000080)={0x0, 0x53, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="7c034c470000", @ANYRES8=r5, @ANYBLOB="050000000000000000000b00000008000300", @ANYRES32=0x0, @ANYBLOB="18005080080007000200000009000100fbf9b94de1000000"], 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x4008880) 20.416075844s ago: executing program 2 (id=308): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x6d93, 0x4) sendmsg$sock(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000580)=@in6={0xa, 0x4e23, 0x81, @dev={0xfe, 0x80, '\x00', 0x1d}, 0x5}, 0x80, 0x0}, 0x4044040) close(0x3) r2 = socket$phonet(0x23, 0x2, 0x1) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='erspan0\x00', 0x10) ioctl$SIOCPNGETOBJECT(r2, 0x89e0, &(0x7f0000000000)=0x2f9d) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='veth1_vlan\x00', 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)=[{0x0}], 0x1, 0x0, 0x0, 0x60000000}, 0x20008004) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, 0x0, 0x10) r4 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r4, &(0x7f0000000300)={0xa, 0x4e22, 0x2002, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1000005}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="02d81d82bb3670c00200"/25], 0x20) socket$packet(0x11, 0x3, 0x300) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x80800, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRES16=0x0, @ANYRESHEX=r5, @ANYRESOCT=r3, @ANYRES32=0x0, @ANYRES64, @ANYRESDEC=r0], 0xe0}, 0x1, 0x0, 0x0, 0x40}, 0x0) openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYRESDEC], 0x18}}, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x4001, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) listen(r7, 0xfffffff5) recvmmsg(r0, &(0x7f0000005500)=[{{0x0, 0x0, &(0x7f0000000500)}, 0x7}, {{&(0x7f0000000380)=@sco, 0x80, &(0x7f0000002940)=[{&(0x7f0000000740)=""/4096, 0x1000}, {&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000002740)=""/232, 0xe8}, {&(0x7f0000002840)=""/183, 0xb7}, {&(0x7f0000000140)=""/11, 0xb}], 0x5, &(0x7f00000029c0)=""/192, 0xc0}, 0x7}, {{&(0x7f0000002a80)=@tipc=@name, 0x80, &(0x7f0000002cc0)=[{&(0x7f0000002b00)=""/12, 0xc}, {&(0x7f0000002b40)=""/89, 0x59}, {&(0x7f0000002bc0)=""/187, 0xbb}, {&(0x7f0000002c80)=""/48, 0x30}], 0x4, &(0x7f0000002d00)=""/108, 0x6c}, 0xff}, {{&(0x7f0000002d80)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000003fc0)=[{&(0x7f0000002e00)=""/227, 0xe3}, {&(0x7f0000002f00)=""/21, 0x15}, {&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f0000003f40)=""/66, 0x42}], 0x4, &(0x7f0000004000)=""/186, 0xba}, 0x7fff}, {{&(0x7f00000040c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10}, 0x80, &(0x7f0000005380)=[{&(0x7f0000004140)=""/114, 0x72}, {&(0x7f0000000500)=""/64, 0x40}, {&(0x7f0000000400)=""/212, 0xd4}, {&(0x7f0000004300)=""/107, 0x6b}, {&(0x7f0000004380)=""/4096, 0x1000}], 0x5, &(0x7f0000005400)=""/193, 0xc1}, 0x8}], 0x5, 0x102, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 20.392631686s ago: executing program 1 (id=309): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000100000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 20.184791931s ago: executing program 1 (id=310): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x6, 0x5, 0x4, 0x1000, 0x1, 0x17, 0x0, 0x10000101}, 0x3f) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000300001c0001000600060008000000100007007f0000017f000001910040001400020010000c000c0006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) 0s ago: executing program 32 (id=293): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socket$packet(0x11, 0x3, 0x300) (async, rerun: 64) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f0000000240), 0x4) (async, rerun: 64) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r6], 0x1c}}, 0x840) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000003c0)=0x0) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r11], 0x1c}}, 0x4008054) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000400)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x54, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r11}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r12}]}, 0x54}, 0x1, 0x0, 0x0, 0x8800}, 0x84) splice(r0, 0x0, r2, 0x0, 0x80, 0x4) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r13, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r14 = socket$netlink(0x10, 0x3, 0x0) r15 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r17 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r17, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r18, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) (async) r19 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r19, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x44, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfb, {0x0, 0x0, 0x0, r18, {}, {0xffff, 0x6}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x80, 0x10000, 0x9}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x85c}, 0x0) (async) sendmsg$nl_route_sched(r14, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r16, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24008890}, 0x4000080) (async) ioctl$SIOCPNDELRESOURCE(r0, 0x89ef, &(0x7f0000000000)=0xa5) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.160' (ED25519) to the list of known hosts. [ 60.672833][ T5595] cgroup: Unknown subsys name 'net' [ 60.753456][ T5595] cgroup: Unknown subsys name 'cpuset' [ 60.756024][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 62.038872][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 65.101636][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.104233][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.109005][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.133740][ T5624] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.134854][ T5624] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 65.137496][ T5626] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.148024][ T5624] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 65.148453][ T5626] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.148737][ T5626] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.148879][ T5626] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.150145][ T5624] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 65.150593][ T5626] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.151373][ T5624] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 65.151833][ T5626] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 65.152270][ T5626] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.153571][ T5624] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 65.153908][ T5624] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 65.156427][ T5624] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.158964][ T4931] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 65.159510][ T4931] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.160627][ T5624] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 65.160986][ T5624] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 65.161723][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.164714][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.191845][ T5620] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 66.683890][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.684012][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.684161][ T5612] bridge_slave_0: entered allmulticast mode [ 66.686435][ T5612] bridge_slave_0: entered promiscuous mode [ 66.745174][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.745333][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.745457][ T5612] bridge_slave_1: entered allmulticast mode [ 66.747103][ T5612] bridge_slave_1: entered promiscuous mode [ 66.913889][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.927210][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.927578][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.927993][ T5611] bridge_slave_0: entered allmulticast mode [ 66.929705][ T5611] bridge_slave_0: entered promiscuous mode [ 66.946253][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.955755][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.955862][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.956219][ T5611] bridge_slave_1: entered allmulticast mode [ 66.958154][ T5611] bridge_slave_1: entered promiscuous mode [ 66.996643][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.996763][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.996882][ T5609] bridge_slave_0: entered allmulticast mode [ 66.998569][ T5609] bridge_slave_0: entered promiscuous mode [ 67.002204][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.002341][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.002685][ T5609] bridge_slave_1: entered allmulticast mode [ 67.004166][ T5609] bridge_slave_1: entered promiscuous mode [ 67.098480][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.115818][ T5612] team0: Port device team_slave_0 added [ 67.129529][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.132577][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.153394][ T5612] team0: Port device team_slave_1 added [ 67.166392][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.192952][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.193073][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.193275][ T5613] bridge_slave_0: entered allmulticast mode [ 67.194165][ T5613] bridge_slave_0: entered promiscuous mode [ 67.201385][ T5619] Bluetooth: hci2: command tx timeout [ 67.201537][ T5619] Bluetooth: hci4: command tx timeout [ 67.201627][ T5619] Bluetooth: hci0: command tx timeout [ 67.227842][ T5609] team0: Port device team_slave_0 added [ 67.257141][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.257234][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.257340][ T5613] bridge_slave_1: entered allmulticast mode [ 67.258696][ T5613] bridge_slave_1: entered promiscuous mode [ 67.275868][ T5611] team0: Port device team_slave_0 added [ 67.278951][ T5609] team0: Port device team_slave_1 added [ 67.280322][ T5615] Bluetooth: hci3: command tx timeout [ 67.285936][ T5615] Bluetooth: hci1: command tx timeout [ 67.295978][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.295997][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.296017][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.301124][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.301137][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.301156][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.374453][ T5611] team0: Port device team_slave_1 added [ 67.401305][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.401407][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 67.401512][ T5610] bridge_slave_0: entered allmulticast mode [ 67.404119][ T5610] bridge_slave_0: entered promiscuous mode [ 67.407748][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.407843][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 67.407964][ T5610] bridge_slave_1: entered allmulticast mode [ 67.409649][ T5610] bridge_slave_1: entered promiscuous mode [ 67.442041][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.476721][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 67.487891][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.487907][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.487926][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.491153][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.491166][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.491190][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.542909][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.574120][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 67.601427][ T5609] hsr_slave_0: entered promiscuous mode [ 67.602784][ T5609] hsr_slave_1: entered promiscuous mode [ 67.623553][ T5612] hsr_slave_0: entered promiscuous mode [ 67.624164][ T5612] hsr_slave_1: entered promiscuous mode [ 67.624606][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 67.624668][ T5612] Cannot create hsr debugfs directory [ 67.637281][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.637295][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.637314][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.644194][ T5610] team0: Port device team_slave_0 added [ 67.661567][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.661582][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.661601][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.664722][ T5613] team0: Port device team_slave_0 added [ 67.682964][ T5610] team0: Port device team_slave_1 added [ 67.716621][ T5613] team0: Port device team_slave_1 added [ 67.829588][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.829604][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.829622][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.863211][ T5611] hsr_slave_0: entered promiscuous mode [ 67.867207][ T5611] hsr_slave_1: entered promiscuous mode [ 67.867903][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 67.867919][ T5611] Cannot create hsr debugfs directory [ 67.894414][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.894429][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.894448][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.896418][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.896430][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.896450][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.915117][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.915134][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 67.915153][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.103176][ T5610] hsr_slave_0: entered promiscuous mode [ 68.103735][ T5610] hsr_slave_1: entered promiscuous mode [ 68.104150][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 68.104167][ T5610] Cannot create hsr debugfs directory [ 68.136722][ T5613] hsr_slave_0: entered promiscuous mode [ 68.137331][ T5613] hsr_slave_1: entered promiscuous mode [ 68.137763][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 68.137779][ T5613] Cannot create hsr debugfs directory [ 68.423360][ T5609] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.428833][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.429895][ T5609] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.442388][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.466750][ T5609] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.472229][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.473106][ T5609] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.482287][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.572028][ T5612] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 68.575655][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.576498][ T5612] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 68.579079][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.608833][ T5612] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 68.621192][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.626886][ T5612] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 68.641921][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.720047][ T5611] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 68.731259][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.732320][ T5611] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 68.735096][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.736024][ T5611] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 68.739451][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.740036][ T5611] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 68.752726][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.783785][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.869995][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.899641][ T5613] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 68.909503][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 68.910150][ T5613] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 68.921807][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 68.924139][ T5613] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 68.927799][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 68.932101][ T5613] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 68.938718][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 68.976413][ T415] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.976538][ T415] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.978465][ T415] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.978535][ T415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.043830][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.117147][ T5610] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 69.125002][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.127482][ T5610] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 69.137974][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.154791][ T5610] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 69.157240][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.164390][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.172961][ T5610] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 69.189002][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 69.235679][ T83] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.235851][ T83] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.280492][ T5615] Bluetooth: hci0: command tx timeout [ 69.280523][ T5615] Bluetooth: hci4: command tx timeout [ 69.280542][ T5615] Bluetooth: hci2: command tx timeout [ 69.314860][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.317448][ T415] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.317807][ T415] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.361600][ T5619] Bluetooth: hci1: command tx timeout [ 69.361631][ T5619] Bluetooth: hci3: command tx timeout [ 69.436714][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.440381][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.483984][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.484084][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.528288][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.533515][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.533612][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.608569][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.608665][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.642859][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.642991][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.724308][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.829476][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.855897][ T159] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.856039][ T159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.879712][ T159] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.879795][ T159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.971405][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.280164][ T5609] veth0_vlan: entered promiscuous mode [ 70.323730][ T5609] veth1_vlan: entered promiscuous mode [ 70.447072][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.449689][ T5609] veth0_macvtap: entered promiscuous mode [ 70.483512][ T5609] veth1_macvtap: entered promiscuous mode [ 70.574571][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.614065][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.686379][ T5612] veth0_vlan: entered promiscuous mode [ 70.770912][ T83] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.773141][ T5612] veth1_vlan: entered promiscuous mode [ 70.852878][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.961516][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.961619][ T50] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.961678][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.983339][ T5612] veth0_macvtap: entered promiscuous mode [ 70.987910][ T5612] veth1_macvtap: entered promiscuous mode [ 71.006335][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.010992][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.033835][ T83] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.075897][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.075918][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.104467][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.149688][ T5611] veth0_vlan: entered promiscuous mode [ 71.207435][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.218157][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.218174][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.222794][ T5611] veth1_vlan: entered promiscuous mode [ 71.282660][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.282727][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.313409][ T50] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.314211][ T50] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.314560][ T50] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.335222][ T415] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.335241][ T415] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.359044][ T5609] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 71.365008][ T5615] Bluetooth: hci2: command tx timeout [ 71.365039][ T5615] Bluetooth: hci4: command tx timeout [ 71.365057][ T5615] Bluetooth: hci0: command tx timeout [ 71.440598][ T5615] Bluetooth: hci1: command tx timeout [ 71.440679][ T5619] Bluetooth: hci3: command tx timeout [ 71.506803][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.506823][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.533701][ T5611] veth0_macvtap: entered promiscuous mode [ 71.547901][ T5610] veth0_vlan: entered promiscuous mode [ 71.557288][ T5611] veth1_macvtap: entered promiscuous mode [ 71.620733][ T5610] veth1_vlan: entered promiscuous mode [ 71.678493][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.719762][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.819185][ T5803] syz_tun: entered allmulticast mode [ 71.824100][ T5610] veth0_macvtap: entered promiscuous mode [ 71.849328][ T5803] wg2: entered allmulticast mode [ 71.864145][ T415] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.864218][ T415] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.864251][ T415] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.864280][ T415] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.865115][ T5610] veth1_macvtap: entered promiscuous mode [ 71.963870][ T5802] syz_tun: left allmulticast mode [ 72.040028][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.089984][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.126108][ T5812] netlink: 'syz.0.9': attribute type 1 has an invalid length. [ 72.162834][ T5613] veth0_vlan: entered promiscuous mode [ 72.168411][ T5813] netlink: 2 bytes leftover after parsing attributes in process `syz.2.8'. [ 72.176373][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.176391][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.301130][ T5613] veth1_vlan: entered promiscuous mode [ 72.319976][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.319997][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.375757][ T5817] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11'. [ 72.422196][ T159] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.422241][ T159] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.422268][ T159] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.422298][ T159] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.474216][ T5819] netlink: zone id is out of range [ 72.474276][ T5819] netlink: zone id is out of range [ 72.474297][ T5819] netlink: zone id is out of range [ 72.474304][ T5819] netlink: zone id is out of range [ 72.474310][ T5819] netlink: zone id is out of range [ 72.474317][ T5819] netlink: zone id is out of range [ 72.474394][ T5819] netlink: zone id is out of range [ 72.474401][ T5819] netlink: zone id is out of range [ 72.474489][ T5819] netlink: zone id is out of range [ 72.474496][ T5819] netlink: zone id is out of range [ 72.510600][ T5817] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.585426][ T415] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.585444][ T415] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.678468][ T5613] veth0_macvtap: entered promiscuous mode [ 72.718943][ T5613] veth1_macvtap: entered promiscuous mode [ 72.792990][ T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.793024][ T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.914094][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.934412][ T5833] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16'. [ 72.934521][ T5833] netlink: 2 bytes leftover after parsing attributes in process `syz.0.16'. [ 72.966224][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.966474][ T5833] netlink: 80 bytes leftover after parsing attributes in process `syz.0.16'. [ 73.188020][ T5838] FAULT_INJECTION: forcing a failure. [ 73.188020][ T5838] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 73.188063][ T5838] CPU: 0 UID: 0 PID: 5838 Comm: syz.2.18 Not tainted syzkaller #0 PREEMPT(full) [ 73.188082][ T5838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 73.188099][ T5838] Call Trace: [ 73.188109][ T5838] [ 73.188116][ T5838] dump_stack_lvl+0xe8/0x150 [ 73.188151][ T5838] should_fail_ex+0x410/0x560 [ 73.188176][ T5838] _copy_to_user+0x31/0xb0 [ 73.188201][ T5838] simple_read_from_buffer+0xe1/0x170 [ 73.188231][ T5838] proc_fail_nth_read+0x1bb/0x230 [ 73.188257][ T5838] ? common_file_perm+0x20e/0x2b0 [ 73.188281][ T5838] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 73.188310][ T5838] ? rw_verify_area+0x24a/0x4c0 [ 73.188336][ T5838] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 73.188362][ T5838] vfs_read+0x213/0xa80 [ 73.188392][ T5838] ? __pfx___mutex_lock+0x10/0x10 [ 73.188416][ T5838] ? __pfx_vfs_read+0x10/0x10 [ 73.188442][ T5838] ? __fget_files+0x2a/0x420 [ 73.188469][ T5838] ? __fget_files+0x3a2/0x420 [ 73.188490][ T5838] ? __fget_files+0x2a/0x420 [ 73.188522][ T5838] ksys_read+0x150/0x270 [ 73.188548][ T5838] ? __pfx_ksys_read+0x10/0x10 [ 73.188584][ T5838] do_syscall_64+0x166/0x520 [ 73.188604][ T5838] ? trace_irq_disable+0x3b/0x140 [ 73.188620][ T5838] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.188638][ T5838] ? clear_bhb_loop+0x70/0xc0 [ 73.188660][ T5838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.188684][ T5838] RIP: 0033:0x7f91f1d5e98e [ 73.188706][ T5838] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 73.188720][ T5838] RSP: 002b:00007f91f2c7afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 73.188747][ T5838] RAX: ffffffffffffffda RBX: 00007f91f2c7b6c0 RCX: 00007f91f1d5e98e [ 73.188760][ T5838] RDX: 000000000000000f RSI: 00007f91f2c7b0a0 RDI: 0000000000000004 [ 73.188771][ T5838] RBP: 00007f91f2c7b090 R08: 0000000000000000 R09: 0000000000000000 [ 73.188781][ T5838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 73.188791][ T5838] R13: 00007f91f2026038 R14: 00007f91f2025fa0 R15: 00007ffe569c28b8 [ 73.188820][ T5838] [ 73.378462][ T38] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.378501][ T38] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.378530][ T38] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.378556][ T38] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.439518][ T5845] netlink: 8 bytes leftover after parsing attributes in process `syz.1.21'. [ 73.440783][ T5619] Bluetooth: hci0: command tx timeout [ 73.440811][ T5619] Bluetooth: hci4: command tx timeout [ 73.440830][ T5619] Bluetooth: hci2: command tx timeout [ 73.458407][ T5841] netlink: 4 bytes leftover after parsing attributes in process `syz.0.19'. [ 73.487472][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.487492][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.520971][ T5615] Bluetooth: hci3: command tx timeout [ 73.521002][ T5615] Bluetooth: hci1: command tx timeout [ 73.678062][ T5854] netlink: 36 bytes leftover after parsing attributes in process `syz.3.23'. [ 73.747819][ T5850] Zero length message leads to an empty skb [ 73.811894][ T159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.811913][ T159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.960467][ T5866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.29'. [ 73.960526][ T5866] IPv6: Can't replace route, no match found [ 74.221944][ T5880] geneve2: entered allmulticast mode [ 74.537572][ T5895] netlink: 12 bytes leftover after parsing attributes in process `syz.3.35'. [ 74.598597][ T5895] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 74.611969][ T5895] netlink: 'syz.3.35': attribute type 10 has an invalid length. [ 74.649177][ T5899] xt_bpf: check failed: parse error [ 74.988013][ T5909] syz.0.39 uses obsolete (PF_INET,SOCK_PACKET) [ 75.540524][ T5943] Bluetooth: MGMT ver 1.23 [ 75.615135][ T83] IPVS: starting estimator thread 0... [ 75.700386][ T5947] IPVS: using max 33 ests per chain, 79200 per kthread [ 76.541190][ T5990] syz_tun: entered allmulticast mode [ 76.577723][ T5994] wg2: entered allmulticast mode [ 76.599924][ T5986] syz_tun: left allmulticast mode [ 77.263333][ T6038] __nla_validate_parse: 6 callbacks suppressed [ 77.263353][ T6038] netlink: 36 bytes leftover after parsing attributes in process `syz.1.79'. [ 77.444123][ T6049] netlink: 12 bytes leftover after parsing attributes in process `syz.1.85'. [ 77.463614][ T6049] netlink: 'syz.1.85': attribute type 10 has an invalid length. [ 77.463635][ T6049] netlink: 40 bytes leftover after parsing attributes in process `syz.1.85'. [ 77.600338][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 77.601133][ T5619] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 77.675810][ T6054] netlink: 32 bytes leftover after parsing attributes in process `syz.1.86'. [ 77.839849][ T6061] netlink: 32 bytes leftover after parsing attributes in process `syz.1.88'. [ 77.895943][ T6063] netlink: 32 bytes leftover after parsing attributes in process `syz.1.88'. [ 78.405110][ T6070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.91'. [ 78.869843][ T6093] netlink: 'syz.2.97': attribute type 30 has an invalid length. [ 79.681010][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 79.681355][ T5619] Bluetooth: hci0: Opcode 0x0c3a failed: -110 [ 79.845817][ T6009] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 79.860686][ T6100] netlink: 40 bytes leftover after parsing attributes in process `syz.2.100'. [ 80.194178][ T6109] netlink: 'syz.3.104': attribute type 1 has an invalid length. [ 80.194199][ T6109] netlink: 'syz.3.104': attribute type 3 has an invalid length. [ 80.194209][ T6109] netlink: 172 bytes leftover after parsing attributes in process `syz.3.104'. [ 80.194242][ T6109] NCSI netlink: No device for ifindex 813332851 [ 80.238396][ T6112] net_ratelimit: 293 callbacks suppressed [ 80.238423][ T6112] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 80.238448][ T6112] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 80.461155][ T6125] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 80.644186][ T6127] netlink: 316 bytes leftover after parsing attributes in process `syz.1.113'. [ 80.756665][ T6145] syz_tun: entered allmulticast mode [ 80.758766][ T6144] syz_tun: left allmulticast mode [ 80.961953][ T6155] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 81.094165][ T6159] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 81.176115][ T6159] syzkaller0: entered promiscuous mode [ 81.176137][ T6159] syzkaller0: entered allmulticast mode [ 81.263722][ T6167] ieee802154 phy0 wpan0: encryption failed: -22 [ 81.269995][ T6167] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 81.534665][ T1224] cfg80211: failed to load regulatory.db [ 81.682693][ T6182] netlink: 'syz.3.130': attribute type 15 has an invalid length. [ 81.980561][ T6191] netlink: 'syz.4.137': attribute type 10 has an invalid length. [ 82.163135][ T5619] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 82.163868][ T5619] Bluetooth: hci0: command 0x0c1a tx timeout [ 82.429385][ T6218] __nla_validate_parse: 8 callbacks suppressed [ 82.429403][ T6218] netlink: 8 bytes leftover after parsing attributes in process `syz.2.143'. [ 82.989801][ T6245] netlink: 40 bytes leftover after parsing attributes in process `syz.3.153'. [ 83.057979][ T6247] netlink: 'syz.0.152': attribute type 49 has an invalid length. [ 83.236427][ T6232] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 83.248919][ T83] IPVS: starting estimator thread 0... [ 83.340945][ T6256] IPVS: using max 35 ests per chain, 84000 per kthread [ 83.358672][ T6247] ip6gretap0: entered promiscuous mode [ 83.358695][ T6247] ip6gretap0: entered allmulticast mode [ 83.418323][ T6261] netlink: 'syz.4.155': attribute type 12 has an invalid length. [ 83.610588][ T6269] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 83.610618][ T6269] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 83.988259][ T6288] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 84.218115][ T6296] netlink: 24 bytes leftover after parsing attributes in process `syz.2.164'. [ 84.268149][ T6302] netlink: 24 bytes leftover after parsing attributes in process `syz.2.164'. [ 84.287825][ T6298] netlink: 316 bytes leftover after parsing attributes in process `syz.1.165'. [ 84.604042][ T6312] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 84.617128][ T6319] syz_tun: entered allmulticast mode [ 84.630129][ T6314] syz_tun: left allmulticast mode [ 85.081702][ T6351] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 85.154489][ T6352] netlink: 'syz.2.173': attribute type 3 has an invalid length. [ 85.464759][ T6367] netlink: 8 bytes leftover after parsing attributes in process `syz.2.178'. [ 85.600754][ T5619] Bluetooth: hci0: command 0x0c1a tx timeout [ 85.600818][ T5615] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 85.762855][ T6382] netlink: 36 bytes leftover after parsing attributes in process `syz.3.183'. [ 85.979108][ T6390] netlink: 12 bytes leftover after parsing attributes in process `syz.1.187'. [ 86.034662][ T6393] netlink: 32 bytes leftover after parsing attributes in process `syz.3.188'. [ 86.059857][ T6390] bridge1: port 1(dummy0) entered blocking state [ 86.059962][ T6390] bridge1: port 1(dummy0) entered disabled state [ 86.060121][ T6390] dummy0: entered allmulticast mode [ 86.096577][ T6385] netlink: 84 bytes leftover after parsing attributes in process `syz.0.185'. [ 86.096818][ T6390] dummy0: entered promiscuous mode [ 86.113346][ T6400] netlink: 'syz.1.187': attribute type 10 has an invalid length. [ 86.416588][ T6416] FAULT_INJECTION: forcing a failure. [ 86.416588][ T6416] name failslab, interval 1, probability 0, space 0, times 1 [ 86.416617][ T6416] CPU: 0 UID: 0 PID: 6416 Comm: syz.1.193 Not tainted syzkaller #0 PREEMPT(full) [ 86.416635][ T6416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.416644][ T6416] Call Trace: [ 86.416651][ T6416] [ 86.416658][ T6416] dump_stack_lvl+0xe8/0x150 [ 86.416686][ T6416] should_fail_ex+0x410/0x560 [ 86.416708][ T6416] ? __alloc_skb+0x1db/0x7a0 [ 86.416728][ T6416] should_failslab+0xa8/0x100 [ 86.416750][ T6416] ? __alloc_skb+0x1db/0x7a0 [ 86.416768][ T6416] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 86.416795][ T6416] ? __alloc_skb+0x18d/0x7a0 [ 86.416815][ T6416] ? __alloc_skb+0x1db/0x7a0 [ 86.416840][ T6416] __alloc_skb+0x1db/0x7a0 [ 86.416865][ T6416] alloc_skb_with_frags+0xc6/0x760 [ 86.416892][ T6416] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 86.416927][ T6416] sock_alloc_send_pskb+0x878/0x990 [ 86.416969][ T6416] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 86.416997][ T6416] ? aa_file_perm+0x18b/0x15f0 [ 86.417024][ T6416] ? aa_sk_perm+0x713/0x900 [ 86.417046][ T6416] hci_sock_sendmsg+0x20b/0xfb0 [ 86.417084][ T6416] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 86.417113][ T6416] ? apparmor_socket_sendmsg+0x98/0x360 [ 86.417130][ T6416] ? lock_acquire+0x115/0x350 [ 86.417150][ T6416] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 86.417174][ T6416] sock_sendmsg_nosec+0x13a/0x180 [ 86.417194][ T6416] sock_write_iter+0x2de/0x3e0 [ 86.417222][ T6416] ? __pfx_sock_write_iter+0x10/0x10 [ 86.417252][ T6416] ? bpf_lsm_file_permission+0x9/0x20 [ 86.417276][ T6416] ? security_file_permission+0x75/0x260 [ 86.417301][ T6416] vfs_write+0x612/0xba0 [ 86.417334][ T6416] ? __pfx_vfs_write+0x10/0x10 [ 86.417369][ T6416] ? __fget_files+0x2a/0x420 [ 86.417399][ T6416] ksys_write+0x150/0x270 [ 86.417426][ T6416] ? __pfx_ksys_write+0x10/0x10 [ 86.417461][ T6416] do_syscall_64+0x166/0x520 [ 86.417481][ T6416] ? trace_irq_disable+0x3b/0x140 [ 86.417499][ T6416] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.417516][ T6416] ? clear_bhb_loop+0x70/0xc0 [ 86.417538][ T6416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.417555][ T6416] RIP: 0033:0x7f32f2b9e159 [ 86.417572][ T6416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.417585][ T6416] RSP: 002b:00007f32f39d6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.417604][ T6416] RAX: ffffffffffffffda RBX: 00007f32f2e25fa0 RCX: 00007f32f2b9e159 [ 86.417616][ T6416] RDX: 0000000000000016 RSI: 0000200000000400 RDI: 0000000000000004 [ 86.417627][ T6416] RBP: 00007f32f39d6090 R08: 0000000000000000 R09: 0000000000000000 [ 86.417638][ T6416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 86.417648][ T6416] R13: 00007f32f2e26038 R14: 00007f32f2e25fa0 R15: 00007fffdf55f6c8 [ 86.417676][ T6416] [ 86.536263][ T6418] warning: `syz.0.194' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 87.189158][ T6445] bridge1: port 1(dummy0) entered blocking state [ 87.189295][ T6445] bridge1: port 1(dummy0) entered forwarding state [ 87.465483][ T6457] __nla_validate_parse: 3 callbacks suppressed [ 87.465500][ T6457] netlink: 128 bytes leftover after parsing attributes in process `syz.4.209'. [ 87.642084][ T6466] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 87.642115][ T6466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 87.838494][ T6471] syzkaller0: entered promiscuous mode [ 87.838515][ T6471] syzkaller0: entered allmulticast mode [ 87.869504][ T6471] netlink: 'syz.0.212': attribute type 20 has an invalid length. [ 87.869523][ T6471] netlink: 4 bytes leftover after parsing attributes in process `syz.0.212'. [ 87.973940][ T6471] netlink: 'syz.0.212': attribute type 20 has an invalid length. [ 87.973961][ T6471] netlink: 4 bytes leftover after parsing attributes in process `syz.0.212'. [ 88.010556][ T6482] netlink: 76 bytes leftover after parsing attributes in process `syz.2.215'. [ 88.087418][ T6486] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 88.100984][ T5771] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 88.111666][ T5771] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 88.111702][ T5771] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 88.111731][ T5771] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 88.216660][ T6485] netlink: 316 bytes leftover after parsing attributes in process `syz.3.217'. [ 88.518781][ T6503] syz_tun: entered allmulticast mode [ 88.539480][ T6503] wg2: entered allmulticast mode [ 88.555057][ T6502] syz_tun: left allmulticast mode [ 88.673226][ T6514] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 88.973343][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.3.231'. [ 88.975428][ T6530] netlink: 8 bytes leftover after parsing attributes in process `syz.4.230'. [ 89.046055][ T6530] netlink: 516 bytes leftover after parsing attributes in process `syz.4.230'. [ 89.048941][ T6530] Illegal XDP return value 4294967274 on prog (id 30) dev N/A, expect packet loss! [ 89.401020][ T6551] netlink: 36 bytes leftover after parsing attributes in process `syz.2.237'. [ 89.623324][ T6559] Bluetooth: hci0: unsupported parameter 5135 [ 89.623355][ T6559] Bluetooth: hci0: unsupported parameter 8192 [ 89.623371][ T6559] Bluetooth: hci0: unsupported parameter 5135 [ 89.623382][ T6559] Bluetooth: hci0: unsupported parameter 8192 [ 89.682128][ T5615] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 89.683379][ T5615] Bluetooth: hci0: command 0x0c1a tx timeout [ 89.715662][ T6562] netlink: 32 bytes leftover after parsing attributes in process `syz.2.241'. [ 89.802698][ T6566] bridge2: port 1(dummy0) entered blocking state [ 89.802882][ T6566] bridge2: port 1(dummy0) entered disabled state [ 89.803022][ T6566] dummy0: entered allmulticast mode [ 89.804841][ T6566] dummy0: entered promiscuous mode [ 89.834215][ T6566] netlink: 'syz.0.243': attribute type 10 has an invalid length. [ 90.509148][ T6606] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 90.518475][ T6609] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 90.518504][ T6609] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 90.569066][ T6608] openvswitch: netlink: ct_state flags ffffffff unsupported [ 90.777150][ T6622] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 90.879471][ T6627] bridge2: port 1(dummy0) entered blocking state [ 90.879618][ T6627] bridge2: port 1(dummy0) entered forwarding state [ 91.049106][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.049205][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.977061][ T6647] syz_tun: entered allmulticast mode [ 91.979335][ T6646] syz_tun: left allmulticast mode [ 92.472332][ T6659] IPVS: set_ctl: invalid protocol: 92 100.1.1.0:20002 [ 92.571349][ T5619] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 92.571636][ T5619] Bluetooth: hci0: command 0x0c1a tx timeout [ 92.683736][ T6664] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 93.298557][ T6675] __nla_validate_parse: 9 callbacks suppressed [ 93.298576][ T6675] netlink: 8 bytes leftover after parsing attributes in process `syz.1.283'. [ 93.468971][ T6677] trusted_key: syz.0.284 sent an empty control message without MSG_MORE. [ 93.763243][ T6684] ip_tables: iptables: counters copy to user failed while replacing table [ 93.790784][ T6686] netlink: 36 bytes leftover after parsing attributes in process `syz.1.288'. [ 94.000850][ T6690] netlink: 4 bytes leftover after parsing attributes in process `syz.1.290'. [ 94.416776][ T6705] netlink: 32 bytes leftover after parsing attributes in process `syz.2.294'. [ 94.625856][ T6715] bridge1: port 1(dummy0) entered disabled state [ 94.629229][ T6715] dummy0: left allmulticast mode [ 94.629269][ T6715] dummy0: left promiscuous mode [ 94.629482][ T6715] bridge1: port 1(dummy0) entered disabled state [ 94.680552][ T6716] netlink: 'syz.1.295': attribute type 10 has an invalid length. [ 94.680572][ T6716] netlink: 40 bytes leftover after parsing attributes in process `syz.1.295'. [ 94.779717][ T6720] FAULT_INJECTION: forcing a failure. [ 94.779717][ T6720] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 94.779779][ T6720] CPU: 1 UID: 0 PID: 6720 Comm: syz.4.297 Not tainted syzkaller #0 PREEMPT(full) [ 94.779798][ T6720] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.779808][ T6720] Call Trace: [ 94.779816][ T6720] [ 94.779823][ T6720] dump_stack_lvl+0xe8/0x150 [ 94.779854][ T6720] should_fail_ex+0x410/0x560 [ 94.779879][ T6720] _copy_from_iter+0x1d3/0x1660 [ 94.779909][ T6720] ? __pfx__copy_from_iter+0x10/0x10 [ 94.779947][ T6720] ? aa_file_perm+0x18b/0x15f0 [ 94.779975][ T6720] ? skb_put+0x112/0x210 [ 94.779997][ T6720] hci_sock_sendmsg+0x426/0xfb0 [ 94.780031][ T6720] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 94.780058][ T6720] ? apparmor_socket_sendmsg+0x98/0x360 [ 94.780075][ T6720] ? lock_acquire+0x115/0x350 [ 94.780094][ T6720] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 94.780117][ T6720] sock_sendmsg_nosec+0x13a/0x180 [ 94.780138][ T6720] sock_write_iter+0x2de/0x3e0 [ 94.780207][ T6720] ? __pfx_sock_write_iter+0x10/0x10 [ 94.780235][ T6720] ? bpf_lsm_file_permission+0x9/0x20 [ 94.780259][ T6720] ? security_file_permission+0x75/0x260 [ 94.780284][ T6720] vfs_write+0x612/0xba0 [ 94.780317][ T6720] ? __pfx_vfs_write+0x10/0x10 [ 94.780360][ T6720] ? __fget_files+0x2a/0x420 [ 94.780391][ T6720] ksys_write+0x150/0x270 [ 94.780419][ T6720] ? __pfx_ksys_write+0x10/0x10 [ 94.780454][ T6720] do_syscall_64+0x166/0x520 [ 94.780474][ T6720] ? trace_irq_disable+0x3b/0x140 [ 94.780491][ T6720] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.780509][ T6720] ? clear_bhb_loop+0x70/0xc0 [ 94.780531][ T6720] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.780553][ T6720] RIP: 0033:0x7fe285b9e159 [ 94.780571][ T6720] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.780585][ T6720] RSP: 002b:00007fe286985028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.780603][ T6720] RAX: ffffffffffffffda RBX: 00007fe285e25fa0 RCX: 00007fe285b9e159 [ 94.780616][ T6720] RDX: 0000000000000016 RSI: 0000200000000400 RDI: 0000000000000004 [ 94.780627][ T6720] RBP: 00007fe286985090 R08: 0000000000000000 R09: 0000000000000000 [ 94.780637][ T6720] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 94.780648][ T6720] R13: 00007fe285e26038 R14: 00007fe285e25fa0 R15: 00007ffc3181eb08 [ 94.780676][ T6720] [ 95.647481][ T6734] netlink: 32 bytes leftover after parsing attributes in process `syz.1.302'. [ 101.900241][ C0] sched: DL replenish lagged too much [ 133.431231][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.441074][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.424020][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.430913][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.562409][ T5628] Bluetooth: hci1: command 0x0406 tx timeout [ 196.562471][ T5628] Bluetooth: hci2: command 0x0406 tx timeout [ 196.562507][ T5628] Bluetooth: hci0: command 0x0c1a tx timeout [ 196.562529][ T5628] Bluetooth: hci4: command 0x0406 tx timeout [ 196.562561][ T5628] Bluetooth: hci3: command 0x0406 tx timeout [ 256.984632][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.991563][ T1309] ieee802154 phy1 wpan1: encryption failed: -22 [ 276.920557][ T31] INFO: task dhcpcd:5276 blocked for more than 147 seconds. [ 276.920587][ T31] Not tainted syzkaller #0 [ 276.920597][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 276.920604][ T31] task:dhcpcd state:D stack:21384 pid:5276 tgid:5276 ppid:5275 task_flags:0x400140 flags:0x00080800 [ 276.920666][ T31] Call Trace: [ 276.920673][ T31] [ 276.920686][ T31] __schedule+0x17db/0x58f0 [ 276.920734][ T31] ? trace_irq_disable+0x3b/0x140 [ 276.920764][ T31] ? __pfx___schedule+0x10/0x10 [ 276.920793][ T31] ? schedule+0x90/0x2b0 [ 276.920816][ T31] schedule+0x164/0x2b0 [ 276.920837][ T31] schedule_preempt_disabled+0x13/0x30 [ 276.920856][ T31] __mutex_lock+0x7c1/0x1550 [ 276.920882][ T31] ? __mutex_lock+0x5d4/0x1550 [ 276.920906][ T31] ? inet_rtm_newaddr+0x470/0x19f0 [ 276.920934][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 276.920967][ T31] ? __nla_parse+0x40/0x60 [ 276.920996][ T31] inet_rtm_newaddr+0x470/0x19f0 [ 276.921022][ T31] ? __kernel_text_address+0xd/0x30 [ 276.921044][ T31] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 276.921069][ T31] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 276.921115][ T31] ? __pfx_inet_rtm_newaddr+0x10/0x10 [ 276.921139][ T31] rtnetlink_rcv_msg+0x802/0xc00 [ 276.921161][ T31] ? netlink_sendmsg+0x5d4/0xb40 [ 276.921190][ T31] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 276.921211][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 276.921233][ T31] ? __lock_acquire+0x747/0x2de0 [ 276.921265][ T31] netlink_rcv_skb+0x226/0x4a0 [ 276.921292][ T31] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 276.921316][ T31] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 276.921354][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 276.921380][ T31] ? netlink_deliver_tap+0x2e/0x1b0 [ 276.921418][ T31] netlink_unicast+0x7bd/0x940 [ 276.921453][ T31] netlink_sendmsg+0x813/0xb40 [ 276.921490][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 276.921524][ T31] ? apparmor_socket_sendmsg+0x98/0x360 [ 276.921547][ T31] ? __pfx_netlink_sendmsg+0x10/0x10 [ 276.921572][ T31] sock_sendmsg_nosec+0x13a/0x180 [ 276.921594][ T31] ____sys_sendmsg+0x54e/0x850 [ 276.921623][ T31] ? __pfx_____sys_sendmsg+0x10/0x10 [ 276.921656][ T31] ? import_iovec+0x73/0xa0 [ 276.921682][ T31] ___sys_sendmsg+0x2a5/0x360 [ 276.921704][ T31] ? count_memcg_event_mm+0x21/0x260 [ 276.921732][ T31] ? __pfx____sys_sendmsg+0x10/0x10 [ 276.921792][ T31] ? __pfx_handle_mm_fault+0x10/0x10 [ 276.921814][ T31] ? lock_vma_under_rcu+0x45a/0x500 [ 276.921849][ T31] __x64_sys_sendmsg+0x1b1/0x290 [ 276.921876][ T31] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 276.921907][ T31] ? do_user_addr_fault+0xc4c/0x1340 [ 276.921941][ T31] do_syscall_64+0x166/0x520 [ 276.921962][ T31] ? trace_irq_disable+0x3b/0x140 [ 276.921979][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.921997][ T31] ? clear_bhb_loop+0x70/0xc0 [ 276.922020][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.922038][ T31] RIP: 0033:0x7fbfc92b3407 [ 276.922064][ T31] RSP: 002b:00007ffdbfb118b0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e [ 276.922082][ T31] RAX: ffffffffffffffda RBX: 00007fbfc9229780 RCX: 00007fbfc92b3407 [ 276.922096][ T31] RDX: 0000000000000000 RSI: 00007ffdbfb25a90 RDI: 0000000000000004 [ 276.922107][ T31] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 276.922117][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffdbfb35cc0 [ 276.922128][ T31] R13: 00007fbfc9229708 R14: 0000000000000044 R15: 00007ffdbfb25a90 [ 276.922158][ T31] [ 276.922176][ T31] INFO: task kworker/1:4:5618 blocked for more than 147 seconds. [ 276.922189][ T31] Not tainted syzkaller #0 [ 276.922198][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 276.922205][ T31] task:kworker/1:4 state:D stack:23816 pid:5618 tgid:5618 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 276.922249][ T31] Workqueue: events reg_todo [ 276.922270][ T31] Call Trace: [ 276.922276][ T31] [ 276.922286][ T31] __schedule+0x17db/0x58f0 [ 276.922309][ T31] ? update_protect_slice+0x128/0x210 [ 276.922349][ T31] ? do_raw_spin_unlock+0xf5/0x200 [ 276.922379][ T31] ? __pfx___schedule+0x10/0x10 [ 276.922416][ T31] ? schedule+0x90/0x2b0 [ 276.922438][ T31] schedule+0x164/0x2b0 [ 276.922460][ T31] schedule_preempt_disabled+0x13/0x30 [ 276.922479][ T31] __mutex_lock+0x7c1/0x1550 [ 276.922505][ T31] ? __mutex_lock+0x5d4/0x1550 [ 276.922530][ T31] ? reg_process_self_managed_hints+0x8d/0x160 [ 276.922553][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 276.922573][ T31] ? reg_process_self_managed_hint+0x1ab/0x4d0 [ 276.922593][ T31] ? __pfx_reg_process_self_managed_hint+0x10/0x10 [ 276.922620][ T31] ? preempt_schedule_common+0x7f/0xd0 [ 276.922639][ T31] ? reg_todo+0x8da/0xa40 [ 276.922658][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 276.922683][ T31] reg_process_self_managed_hints+0x8d/0x160 [ 276.922705][ T31] reg_todo+0x8df/0xa40 [ 276.922729][ T31] ? process_scheduled_works+0x97a/0x1630 [ 276.922753][ T31] process_scheduled_works+0xc3d/0x1630 [ 276.922806][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 276.922835][ T31] ? assign_work+0x3cf/0x5d0 [ 276.922863][ T31] worker_thread+0xa47/0xfb0 [ 276.922899][ T31] ? __kthread_parkme+0x71/0x1f0 [ 276.922934][ T31] kthread+0x38b/0x480 [ 276.922952][ T31] ? __pfx_worker_thread+0x10/0x10 [ 276.922973][ T31] ? __pfx_kthread+0x10/0x10 [ 276.922992][ T31] ret_from_fork+0x514/0xb70 [ 276.923013][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 276.923030][ T31] ? __switch_to+0xc89/0x1420 [ 276.923057][ T31] ? __pfx_kthread+0x10/0x10 [ 276.923076][ T31] ret_from_fork_asm+0x1a/0x30 [ 276.923118][ T31] [ 276.923168][ T31] [ 276.923168][ T31] Showing all locks held in the system: [ 276.923176][ T31] locks held by kthreadd/2: 1, last CPU#1: [ 276.923188][ T31] #0: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.923235][ T31] locks held by kworker/0:0/9: 3, on CPU#0: [ 276.923247][ T31] #0: ffff8880322f1140 ((wq_completion)wg-kex-wg2#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923299][ T31] #1: ffffc900000e7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923358][ T31] #2: ffff8880790098e0 (&cookie->lock){++++}-{4:4}, at: wg_cookie_add_mac_to_packet+0x3e/0x1a0 [ 276.923415][ T31] locks held by kworker/u8:0/12: 6, last CPU#0: [ 276.923427][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923474][ T31] #1: ffffc90000117c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923539][ T31] #2: ffff888021aed258 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 276.923594][ T31] #3: ffff88807f932ce0 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x19e/0xb40 [ 276.923643][ T31] #4: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 276.923687][ T31] #5: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 276.923733][ T31] locks held by kworker/u8:1/13: 3, last CPU#1: [ 276.923746][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923792][ T31] #1: ffffc90000127c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923839][ T31] #2: ffff88806a340800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 276.923883][ T31] locks held by kworker/1:0/25: 4, on CPU#1: [ 276.923894][ T31] #0: ffff8880323c2540 ((wq_completion)wg-kex-wg1#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.923946][ T31] #1: ffffc900001f7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924003][ T31] #2: ffff88807751d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 276.924056][ T31] #3: ffff88807900aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 276.924108][ T31] locks held by khungtaskd/31: 1, last CPU#1: [ 276.924120][ T31] #0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 276.924163][ T31] locks held by kworker/u8:2/38: 2, on CPU#1: [ 276.924179][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924226][ T31] #1: ffffc90000ae7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924275][ T31] locks held by kworker/1:1/44: 5, last CPU#1: [ 276.924287][ T31] #0: ffff8880325cb540 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924338][ T31] #1: ffffc90000b47c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924401][ T31] #2: ffff8880796cf028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.924453][ T31] #3: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.924494][ T31] #4: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 276.924540][ T31] locks held by kworker/u8:3/50: 4, last CPU#1: [ 276.924552][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924599][ T31] #1: ffffc90000bb7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924646][ T31] #2: ffff888056950800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 276.924687][ T31] #3: ffff8880575d8140 (&sb->s_type->i_mutex_key#9/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x19a/0x520 [ 276.924745][ T31] locks held by kworker/u9:0/52: 7, on CPU#1: [ 276.924757][ T31] #0: ffff8880334c7140 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924804][ T31] #1: ffffc90000bd7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.924851][ T31] #2: ffff88807eff8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 276.924893][ T31] #3: ffff88807eff80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 276.924941][ T31] #4: ffffffff903da340 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 276.924986][ T31] #5: ffff8880349f2af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x550 [ 276.925038][ T31] #6: ffffffff8ed62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 276.925087][ T31] locks held by kworker/u8:4/59: 4, last CPU#1: [ 276.925099][ T31] #0: ffff888034608940 ((wq_completion)wg-kex-wg0#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925149][ T31] #1: ffffc9000200fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925194][ T31] #2: ffff8880345cd440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 276.925245][ T31] #3: ffff8880368c9700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 276.925295][ T31] locks held by kworker/u8:5/83: 5, last CPU#1: [ 276.925308][ T31] #0: ffff8880202e3940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925355][ T31] #1: ffffc900024efc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925408][ T31] #2: ffff8880368720e8 (&type->s_umount_key#34){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 [ 276.925461][ T31] #3: ffff888036870c98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x205/0x3b0 [ 276.925503][ T31] #4: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.925547][ T31] locks held by kworker/u8:6/159: 3, last CPU#1: [ 276.925559][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925606][ T31] #1: ffffc90002ebfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925653][ T31] #2: ffff88806a140800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 276.925695][ T31] locks held by kworker/u8:7/415: 3, last CPU#0: [ 276.925708][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925754][ T31] #1: ffffc9000327fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925802][ T31] #2: ffff888031819258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 276.925858][ T31] locks held by kworker/0:2/988: 3, last CPU#0: [ 276.925870][ T31] #0: ffff88807a9f3940 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925919][ T31] #1: ffffc90004e07c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.925976][ T31] #2: ffff8880796cb4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.926040][ T31] locks held by kworker/R-ipv6_/3193: 3, on CPU#1: [ 276.926053][ T31] #0: ffff88803277f140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.926100][ T31] #1: ffffc9000deb7c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.926148][ T31] #2: ffffffff90253400 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 276.926195][ T31] locks held by kworker/1:3/3215: 3, last CPU#1: [ 276.926207][ T31] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.926255][ T31] #1: ffffc9000db27c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.926301][ T31] #2: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: reg_check_chans_work+0x25/0x220 [ 276.926347][ T31] locks held by klogd/4970: 2, last CPU#1: [ 276.926359][ T31] #0: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.926406][ T31] #1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: __page_table_check_zero+0x6c/0x430 [ 276.926450][ T31] locks held by udevd/4981: 5, last CPU#1: [ 276.926462][ T31] #0: ffffffff8ee363b0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 276.926508][ T31] #1: ffff88807e9703b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 [ 276.926557][ T31] #2: ffff88807fa1dcf8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 [ 276.926610][ T31] #3: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.926651][ T31] #4: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 276.926695][ T31] locks held by dhcpcd/5276: 1, on CPU#0: [ 276.926707][ T31] #0: ffffffff90253400 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 [ 276.926757][ T31] locks held by getty/5374: 2, on CPU#1: [ 276.926769][ T31] #0: ffff8880213f50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 276.926818][ T31] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 276.926865][ T31] locks held by syz-executor/5609: 1, last CPU#1: [ 276.926877][ T31] #0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 276.926921][ T31] locks held by syz-executor/5610: 2, last CPU#0: [ 276.926933][ T31] #0: ffffffff8f4f1938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 276.926975][ T31] #1: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.927016][ T31] locks held by syz-executor/5611: 3, last CPU#1: [ 276.927028][ T31] #0: ffffffff8f4f1938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 276.927070][ T31] #1: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.927111][ T31] #2: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 276.927156][ T31] locks held by syz-executor/5612: 2, last CPU#1: [ 276.927168][ T31] #0: ffffffff8f4f1938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 276.927210][ T31] #1: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.927252][ T31] locks held by syz-executor/5613: 2, last CPU#1: [ 276.927264][ T31] #0: ffffffff8f4f1938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560 [ 276.927306][ T31] #1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 276.927351][ T31] locks held by kworker/u9:2/5615: 4, on CPU#0: [ 276.927363][ T31] #0: ffff88807fa71140 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.927416][ T31] #1: ffffc90003e3fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.927463][ T31] #2: ffff88807ee98ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 276.927505][ T31] #3: ffff88807ee980b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 276.927553][ T31] locks held by kworker/1:4/5618: 4, on CPU#1: [ 276.927565][ T31] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.927612][ T31] #1: ffffc9000426fc40 (reg_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.927658][ T31] #2: ffffffff90253400 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0xa40 [ 276.927700][ T31] #3: ffff88806a340800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x8d/0x160 [ 276.927745][ T31] locks held by kworker/u9:3/5619: 5, on CPU#1: [ 276.927758][ T31] #0: ffff8880334c5140 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.927804][ T31] #1: ffffc9000427fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.927852][ T31] #2: ffff88807ee8cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 276.927893][ T31] #3: ffff88807ee8c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 276.927940][ T31] #4: ffffffff903da340 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 276.927985][ T31] locks held by kworker/u9:4/5620: 5, on CPU#1: [ 276.927997][ T31] #0: ffff8880334c0940 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928045][ T31] #1: ffffc9000428fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928092][ T31] #2: ffff888035454ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 276.928133][ T31] #3: ffff8880354540b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 276.928180][ T31] #4: ffffffff903da340 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 276.928232][ T31] locks held by kworker/u9:8/5629: 5, on CPU#1: [ 276.928245][ T31] #0: ffff88807754e940 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928291][ T31] #1: ffffc9000432fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928338][ T31] #2: ffff888032b00ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 276.928380][ T31] #3: ffff888032b000b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 276.928433][ T31] #4: ffffffff903da340 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x17f/0x370 [ 276.928482][ T31] locks held by kworker/0:3/5706: 3, on CPU#0: [ 276.928494][ T31] #0: ffff8880323c2540 ((wq_completion)wg-kex-wg1#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928562][ T31] #1: ffffc9000492fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928620][ T31] #2: ffff88807900aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.928672][ T31] locks held by kworker/0:4/5713: 3, on CPU#0: [ 276.928684][ T31] #0: ffff8880325cb540 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928735][ T31] #1: ffffc9000499fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928793][ T31] #2: ffff8880796cf028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.928846][ T31] locks held by kworker/0:5/5720: 3, last CPU#0: [ 276.928858][ T31] #0: ffff8880325c8940 ((wq_completion)wg-kex-wg1#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928908][ T31] #1: ffffc90004a6fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.928962][ T31] #2: ffff8880368c8330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.929005][ T31] locks held by kworker/1:5/5727: 4, last CPU#1: [ 276.929015][ T31] #0: ffff8880322f1140 ((wq_completion)wg-kex-wg2#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929059][ T31] #1: ffffc90004b0fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929107][ T31] #2: ffff88807900a0e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.929149][ T31] #3: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 276.929187][ T31] locks held by kworker/1:6/5734: 3, on CPU#1: [ 276.929196][ T31] #0: ffff88801b069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929236][ T31] #1: ffffc90004bbfc40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929276][ T31] #2: ffffffff90253400 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x80 [ 276.929317][ T31] locks held by kworker/0:6/5744: 4, on CPU#0: [ 276.929326][ T31] #0: ffff888032b1bd40 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929369][ T31] #1: ffffc90004c7fc40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929426][ T31] #2: ffff88802a731440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 276.929475][ T31] #3: ffff8880368cd270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 276.929526][ T31] locks held by kworker/u8:8/5771: 4, last CPU#0: [ 276.929538][ T31] #0: ffff888035854940 ((wq_completion)wg-kex-wg2#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929589][ T31] #1: ffffc90004d0fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929636][ T31] #2: ffff88807e479440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 276.929687][ T31] #3: ffff8880368cb4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 276.929739][ T31] locks held by kworker/1:8/5801: 3, last CPU#1: [ 276.929752][ T31] #0: ffff888032b1bd40 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929803][ T31] #1: ffffc90004ed7c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929860][ T31] #2: ffff8880368cd270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 276.929911][ T31] locks held by kworker/u8:9/6342: 4, last CPU#0: [ 276.929923][ T31] #0: ffff88803690c940 ((wq_completion)wg-kex-wg1#9){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.929974][ T31] #1: ffffc9000d757c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 276.930022][ T31] #2: ffff88807751d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 276.930073][ T31] #3: ffff88807900b4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 280.499694][ T31] locks held by kworker/u8:10/6344: 3, last CPU#0: [ 280.499713][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.499770][ T31] #1: ffffc9000d777c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.499819][ T31] #2: ffff888021aed258 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 280.499875][ T31] locks held by kworker/u8:11/6347: 3, last CPU#0: [ 280.499887][ T31] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.499934][ T31] #1: ffffc9000d59fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.499981][ T31] #2: ffff88807c964258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 [ 280.500035][ T31] locks held by syz.0.293/6722: 2, last CPU#0: [ 280.500048][ T31] #0: ffff888077347540 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 [ 280.500102][ T31] #1: ffffffff8ed62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 280.507664][ T31] locks held by dhcpcd/6748: 1, last CPU#0: [ 280.507677][ T31] #0: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 280.507720][ T31] locks held by modprobe/6755: 2, last CPU#0: [ 280.507732][ T31] #0: ffff88807eccdcf8 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 [ 280.507780][ T31] #1: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 280.507821][ T31] locks held by kworker/u8:12/6756: 4, last CPU#0: [ 280.507833][ T31] #0: ffff88803690c940 ((wq_completion)wg-kex-wg1#9){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.507885][ T31] #1: ffffc90003e4fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.507932][ T31] #2: ffff88807751d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 280.507985][ T31] #3: ffff88807900aad0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 280.508035][ T31] locks held by kworker/u8:13/6757: 7, last CPU#1: [ 280.508048][ T31] #0: ffff88803460f140 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.508101][ T31] #1: ffffc900042ffc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.508148][ T31] #2: ffff88807f31d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 280.508199][ T31] #3: ffff88807900f028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 280.508249][ T31] #4: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 280.508311][ T31] #5: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 280.508357][ T31] #6: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 280.508401][ T31] locks held by kworker/u8:14/6758: 2, last CPU#0: [ 280.508413][ T31] #0: ffff888032b6d940 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.508460][ T31] #1: ffffc9001aab7c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 280.508508][ T31] locks held by syz-executor/6759: 3, last CPU#0: [ 280.508520][ T31] #0: ffff88807fa1f678 (&mm->mmap_lock){++++}-{4:4}, at: setup_arg_pages+0x30e/0xbd0 [ 280.508568][ T31] #1: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 280.508608][ T31] #2: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 280.508654][ T31] [ 280.508659][ T31] ============================================= [ 280.508659][ T31] [ 280.508684][ T31] NMI backtrace for cpu 0 [ 280.508703][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 280.508742][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.508752][ T31] Call Trace: [ 280.508758][ T31] [ 280.508766][ T31] dump_stack_lvl+0xe8/0x150 [ 280.508793][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 280.508821][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 280.508849][ T31] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 280.508879][ T31] sys_info+0x135/0x170 [ 280.508902][ T31] watchdog+0xfd7/0x1030 [ 280.508927][ T31] ? watchdog+0x1c7/0x1030 [ 280.508950][ T31] kthread+0x38b/0x480 [ 280.508968][ T31] ? __pfx_watchdog+0x10/0x10 [ 280.508983][ T31] ? __pfx_kthread+0x10/0x10 [ 280.509001][ T31] ret_from_fork+0x514/0xb70 [ 280.509021][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 280.509037][ T31] ? __switch_to+0xc89/0x1420 [ 280.509063][ T31] ? __pfx_kthread+0x10/0x10 [ 280.509088][ T31] ret_from_fork_asm+0x1a/0x30 [ 280.509127][ T31] [ 280.509134][ T31] Sending NMI from CPU 0 to CPUs 1: [ 280.509171][ C1] NMI backtrace for cpu 1 [ 280.509184][ C1] CPU: 1 UID: 0 PID: 6757 Comm: kworker/u8:13 Not tainted syzkaller #0 PREEMPT(full) [ 280.509224][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 280.509246][ C1] Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker [ 280.509272][ C1] RIP: 0010:check_preemption_disabled+0x1a/0xd0 [ 280.509298][ C1] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 65 8b 05 db 2d af 07 65 48 8b 0d ab 2d af 07 85 c9 74 0c 5b <41> 5e 41 5f 5d c3 cc cc cc cc cc 9c 59 f7 c1 00 02 00 00 74 ea 65 [ 280.509311][ C1] RSP: 0018:ffffc90000a17e48 EFLAGS: 00000002 [ 280.509325][ C1] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 8000000000000101 [ 280.509337][ C1] RDX: 0000000000000000 RSI: ffffffff8e42e9f8 RDI: ffffffff8c6da080 [ 280.509349][ C1] RBP: ffff888035df8000 R08: 0000000000000000 R09: 0000000000000000 [ 280.509360][ C1] R10: ffffc90000a17ff8 R11: ffffffff81b28ab0 R12: ffffffff8ed5c8e0 [ 280.509373][ C1] R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000246 [ 280.509383][ C1] FS: 0000000000000000(0000) GS:ffff888124dce000(0000) knlGS:0000000000000000 [ 280.509397][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 280.509409][ C1] CR2: 00007ff9aaa94a10 CR3: 0000000060b42000 CR4: 00000000003526f0 [ 280.509424][ C1] Call Trace: [ 280.509430][ C1] [ 280.509437][ C1] lock_acquire+0xc6/0x350 [ 280.509457][ C1] ? unwind_next_frame+0x8f/0x2550 [ 280.509476][ C1] ? kthread+0x38b/0x480 [ 280.509491][ C1] ? unwind_next_frame+0x8f/0x2550 [ 280.509511][ C1] unwind_next_frame+0xac/0x2550 [ 280.509530][ C1] ? unwind_next_frame+0x8f/0x2550 [ 280.509551][ C1] ? worker_thread+0xa47/0xfb0 [ 280.509579][ C1] ? unwind_next_frame+0x8f/0x2550 [ 280.509600][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 280.509618][ C1] arch_stack_walk+0x11b/0x150 [ 280.509640][ C1] ? kthread+0x38b/0x480 [ 280.509657][ C1] stack_trace_save+0xa9/0x100 [ 280.509673][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 280.509690][ C1] ? __lock_acquire+0x747/0x2de0 [ 280.509709][ C1] kasan_save_track+0x3e/0x80 [ 280.509726][ C1] ? kasan_save_track+0x3e/0x80 [ 280.509742][ C1] ? kasan_save_free_info+0x40/0x50 [ 280.509770][ C1] ? __kasan_slab_free+0x5c/0x80 [ 280.509788][ C1] ? kfree+0x1c5/0x650 [ 280.509810][ C1] ? skb_release_data+0x82e/0xa80 [ 280.509832][ C1] ? __kfree_skb+0x5d/0x210 [ 280.509851][ C1] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 280.509872][ C1] ? nft_synproxy_do_eval+0x389/0x5d0 [ 280.509893][ C1] ? nft_do_chain+0x48d/0x1b10 [ 280.509914][ C1] ? nft_do_chain_ipv4+0x195/0x290 [ 280.509934][ C1] ? nf_hook_slow+0xc5/0x220 [ 280.509951][ C1] ? NF_HOOK+0x21f/0x3c0 [ 280.509971][ C1] ? NF_HOOK+0x336/0x3c0 [ 280.509990][ C1] ? process_backlog+0xa6b/0x18b0 [ 280.510008][ C1] ? __napi_poll+0xaa/0x330 [ 280.510024][ C1] ? net_rx_action+0x61d/0xf50 [ 280.510042][ C1] ? handle_softirqs+0x226/0x860 [ 280.510063][ C1] ? do_softirq+0x77/0xd0 [ 280.510083][ C1] ? __local_bh_enable_ip+0x100/0x140 [ 280.510107][ C1] ? blake2s_compress+0xfa/0x1c00 [ 280.510129][ C1] ? blake2s_final+0x10f/0x270 [ 280.510151][ C1] ? hmac+0x2dc/0x3b0 [ 280.510171][ C1] ? message_ephemeral+0x233/0x310 [ 280.510195][ C1] ? wg_noise_handshake_create_initiation+0x24f/0x810 [ 280.510221][ C1] ? wg_packet_handshake_send_worker+0x18c/0x370 [ 280.510241][ C1] ? process_scheduled_works+0xc3d/0x1630 [ 280.510264][ C1] ? worker_thread+0xa47/0xfb0 [ 280.510286][ C1] ? kthread+0x38b/0x480 [ 280.510319][ C1] kasan_save_free_info+0x40/0x50 [ 280.510346][ C1] __kasan_slab_free+0x5c/0x80 [ 280.510367][ C1] kfree+0x1c5/0x650 [ 280.510392][ C1] ? skb_release_data+0x82e/0xa80 [ 280.510419][ C1] skb_release_data+0x82e/0xa80 [ 280.510450][ C1] __kfree_skb+0x5d/0x210 [ 280.510474][ C1] nft_synproxy_eval_v4+0x36a/0x4e0 [ 280.510501][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 280.510526][ C1] ? nf_ip_checksum+0x13c/0x510 [ 280.510553][ C1] nft_synproxy_do_eval+0x389/0x5d0 [ 280.510584][ C1] ? lock_acquire+0x115/0x350 [ 280.510604][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 280.510633][ C1] ? lock_acquire+0x115/0x350 [ 280.510659][ C1] nft_do_chain+0x48d/0x1b10 [ 280.510684][ C1] ? seqcount_lockdep_reader_access+0xd4/0x100 [ 280.510707][ C1] ? lapic_next_event+0x11/0x20 [ 280.510729][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 280.510758][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 280.510782][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 280.510819][ C1] nft_do_chain_ipv4+0x195/0x290 [ 280.510842][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 280.510865][ C1] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 280.510891][ C1] ? iptable_mangle_hook+0x18a/0x4c0 [ 280.510918][ C1] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 280.510943][ C1] nf_hook_slow+0xc5/0x220 [ 280.510965][ C1] NF_HOOK+0x21f/0x3c0 [ 280.510989][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 280.511014][ C1] ? NF_HOOK+0x9e/0x3c0 [ 280.511036][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 280.511061][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 280.511088][ C1] ? ip_local_deliver+0x113/0x190 [ 280.511113][ C1] NF_HOOK+0x336/0x3c0 [ 280.511137][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 280.511160][ C1] ? NF_HOOK+0x9e/0x3c0 [ 280.511182][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 280.511207][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 280.511230][ C1] ? ip_rcv_core+0x88d/0xd50 [ 280.511256][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 280.511279][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 280.511302][ C1] process_backlog+0xa6b/0x18b0 [ 280.511326][ C1] ? process_backlog+0x3de/0x18b0 [ 280.511354][ C1] __napi_poll+0xaa/0x330 [ 280.511375][ C1] net_rx_action+0x61d/0xf50 [ 280.511403][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 280.511423][ C1] ? kvm_sched_clock_read+0x11/0x20 [ 280.511449][ C1] ? __pfx_sched_clock_cpu+0x10/0x10 [ 280.511476][ C1] handle_softirqs+0x226/0x860 [ 280.511502][ C1] ? do_softirq+0x77/0xd0 [ 280.511528][ C1] ? kernel_fpu_end+0x62/0x80 [ 280.511551][ C1] do_softirq+0x77/0xd0 [ 280.511581][ C1] [ 280.511587][ C1] [ 280.511594][ C1] __local_bh_enable_ip+0x100/0x140 [ 280.511618][ C1] blake2s_compress+0xfa/0x1c00 [ 280.511648][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 280.511681][ C1] ? __asan_memset+0x22/0x50 [ 280.511711][ C1] ? kernel_fpu_begin_mask+0x2bb/0x380 [ 280.511735][ C1] ? __pfx_blake2s_compress+0x10/0x10 [ 280.511763][ C1] ? kernel_fpu_end+0x62/0x80 [ 280.511787][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 280.511811][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 280.511833][ C1] ? kernel_fpu_end+0x62/0x80 [ 280.511854][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 280.511878][ C1] ? blake2s_compress+0x1b4d/0x1c00 [ 280.511911][ C1] blake2s_final+0x10f/0x270 [ 280.511940][ C1] hmac+0x2dc/0x3b0 [ 280.511968][ C1] ? __pfx_hmac+0x10/0x10 [ 280.511999][ C1] ? curve25519_generate_public+0x2fed/0x3050 [ 280.512027][ C1] ? __asan_memset+0x22/0x50 [ 280.512058][ C1] message_ephemeral+0x233/0x310 [ 280.512086][ C1] ? __pfx_message_ephemeral+0x10/0x10 [ 280.512131][ C1] ? down_read+0x2be/0x330 [ 280.512158][ C1] wg_noise_handshake_create_initiation+0x24f/0x810 [ 280.512190][ C1] ? __pfx_wg_noise_handshake_create_initiation+0x10/0x10 [ 280.512220][ C1] ? __lock_acquire+0x747/0x2de0 [ 280.512245][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 280.512277][ C1] ? lock_acquire+0x115/0x350 [ 280.512299][ C1] ? ktime_get_coarse_with_offset+0x8a/0x150 [ 280.512322][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 280.512343][ C1] ? ktime_get_coarse_with_offset+0x8a/0x150 [ 280.512364][ C1] ? ktime_get_coarse_with_offset+0x102/0x150 [ 280.512385][ C1] wg_packet_handshake_send_worker+0x18c/0x370 [ 280.512409][ C1] ? __pfx_wg_packet_handshake_send_worker+0x10/0x10 [ 280.512430][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 280.512467][ C1] ? rcu_is_watching+0x16/0xb0 [ 280.512491][ C1] ? process_scheduled_works+0x97a/0x1630 [ 280.512516][ C1] process_scheduled_works+0xc3d/0x1630 [ 280.512540][ C1] ? __lock_acquire+0x747/0x2de0 [ 280.512579][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 280.512608][ C1] ? assign_work+0x3cf/0x5d0 [ 280.512634][ C1] worker_thread+0xa47/0xfb0 [ 280.512674][ C1] kthread+0x38b/0x480 [ 280.512692][ C1] ? __pfx_worker_thread+0x10/0x10 [ 280.512716][ C1] ? __pfx_kthread+0x10/0x10 [ 280.512734][ C1] ret_from_fork+0x514/0xb70 [ 280.512753][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 280.512770][ C1] ? __switch_to+0xc89/0x1420 [ 280.512797][ C1] ? __pfx_kthread+0x10/0x10 [ 280.512816][ C1] ret_from_fork_asm+0x1a/0x30 [ 280.512853][ C1] [ 280.517203][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 283.809705][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 283.818813][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 283.828876][ T31] Call Trace: [ 283.832161][ T31] [ 283.835095][ T31] vpanic+0x56d/0xa60 [ 283.839090][ T31] ? __pfx___schedule+0x10/0x10 [ 283.843946][ T31] ? __pfx_vpanic+0x10/0x10 [ 283.848468][ T31] panic+0xc5/0xd0 [ 283.852197][ T31] ? __pfx_panic+0x10/0x10 [ 283.856618][ T31] ? preempt_schedule_common+0x7f/0xd0 [ 283.862080][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 283.867458][ T31] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 283.873625][ T31] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 283.879791][ T31] watchdog+0x1030/0x1030 [ 283.884130][ T31] ? watchdog+0x1c7/0x1030 [ 283.888551][ T31] kthread+0x38b/0x480 [ 283.892623][ T31] ? __pfx_watchdog+0x10/0x10 [ 283.897298][ T31] ? __pfx_kthread+0x10/0x10 [ 283.901890][ T31] ret_from_fork+0x514/0xb70 [ 283.906481][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 283.911589][ T31] ? __switch_to+0xc89/0x1420 [ 283.916274][ T31] ? __pfx_kthread+0x10/0x10 [ 283.920904][ T31] ret_from_fork_asm+0x1a/0x30 [ 283.925689][ T31] [ 283.929010][ T31] Kernel Offset: disabled [ 283.933340][ T31] Rebooting in 86400 seconds..