last executing test programs: 6.957197168s ago: executing program 0 (id=2956): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000200), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x58, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x58}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000008c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @mcast1}]}]}, 0xac}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd700000000040020000000800", @ANYRES32=r6, @ANYBLOB="0c009900d308000079000000080026006c0900000800a08d1d4a2a390800270002"], 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010400000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x17}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="6000000010000108fdfffffffddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="000000042104020008001b000000000038001a8004002d8030000a80050008"], 0x60}, 0x1, 0x0, 0x0, 0x4040080}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}, {0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x12, 0x1, 0x0, 0x0, {0x5}}}, 0xa0}}, 0x0) 5.949494304s ago: executing program 0 (id=2961): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001400010028bd691b7794f3b72d5b11c8", @ANYBLOB="080002"], 0x20}, 0x1, 0x0, 0x0, 0x823be637d8173150}, 0x40000c0) 5.759915496s ago: executing program 0 (id=2964): poll(&(0x7f00000001c0)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x1102}], 0x2, 0xc511) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(0xffffffffffffffff, 0x402) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0xf500, {[@fastopen={0x1e, 0x3, "11"}]}}}}}}}}, 0x0) 4.77329398s ago: executing program 0 (id=2970): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)={0x2c, 0x0, 0x801, 0x400, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_KEY_DEFAULT_TYPES={0x4}, @NL80211_ATTR_KEY_SEQ={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}]}, 0x2c}}, 0x0) 4.555384474s ago: executing program 0 (id=2972): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x3) listen(0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket(0xa, 0x1, 0x0) listen(r3, 0x7f) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x7) listen(0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 4.148088643s ago: executing program 0 (id=2974): socket$rds(0x15, 0x5, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, 0x0, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) write$nci(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x8000) write$nci(r2, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) write$nci(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="5001", @ANYRES64=r1], 0x14) 3.589088037s ago: executing program 2 (id=2979): poll(&(0x7f00000001c0)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x1102}], 0x2, 0xc511) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(0xffffffffffffffff, 0x402) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0xf500, {[@fastopen={0x1e, 0x3, "11"}]}}}}}}}}, 0x0) 2.627669917s ago: executing program 2 (id=2984): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f0000000680)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x20, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0xc044}, 0x84000) sendmmsg$inet(r0, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98, 0x0, {0x0, 0x1e01}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty=0x98, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r4 = socket$l2tp6(0xa, 0x2, 0x73) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0xf0, &(0x7f0000000480)={@empty, @empty, @void, {@mpls_mc={0x8848, {[{0xedba, 0x0, 0x1}, {0x8ba}, {0xffbff}, {0xaad0}, {0x0, 0x0, 0x1}, {0x1, 0x0, 0x1}], @generic="0513f004d1da1dd0e3f63024a95b1bbadb68d4badccfbb9f95373adc908280687fe507a02ae0ecc64ff43b219fbc2323429fc1f3c32f135216d88b04fe5a9448d85413164cbae657d6d68c127b3e05c0fffa2743aeadcf8266201c60ad9b761010de4f97b4ec718b5372a8c801001b8692b0ee85124cfb99edff5ab7a8e3dae21831431d6589e3130bea25e7491636033121823156efbf803eb9f216f05a1f0cbf5e02fbccdd2f8049c93e76647a29f137702fc4cc2b12c7a7fb54ae83583598d79fdbf21f2f0de6a712"}}}}, &(0x7f0000000580)={0x0, 0x2, [0x6d6, 0x783, 0x77a, 0xa6d]}) syz_genetlink_get_family_id$team(&(0x7f0000000380), r5) sendmsg$TEAM_CMD_PORT_LIST_GET(r5, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40040880}, 0x4048890) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x38, 0xd, 0x6, 0x3, 0x0, 0x0, {0x3, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000060}, 0x40000000) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2a8, 0x110, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2a}, @private1={0xfc, 0x1, '\x00', 0x7}, [0x0, 0xff, 0xffffff00, 0xffff00], [0x0, 0xff000000, 0x0, 0xff000000], 'veth0_vlan\x00', 'veth0_to_team\x00', {}, {}, 0x2f, 0x1, 0x1, 0x9}, 0x0, 0xd8, 0x110, 0x60030000, {0x0, 0xff000000}, [@common=@srh={{0x30}, {0x1bb, 0x4, 0x50, 0x7, 0x3, 0x8, 0x83f15b5406f1ba61}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x2, 0x6, 0x6}, {0x3, 0x2, 0x5}, {0xffffffffffffffff, 0x4, 0x6}, 0x1, 0x3}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x308) 2.172364598s ago: executing program 3 (id=2988): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x2000000, 0xe, 0x0, &(0x7f0000000700)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.049470828s ago: executing program 3 (id=2990): r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r0, 0x9) socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x0, 0x40, 0x4, 0x7fff8, 0x6}, 0x14) sendto$inet(0xffffffffffffffff, &(0x7f0000000380)="ab", 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x4e22, @loopback}, 0x10) 1.815702253s ago: executing program 3 (id=2993): poll(&(0x7f00000001c0)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x1102}], 0x2, 0xc511) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(0xffffffffffffffff, 0x402) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0xf500, {[@fastopen={0x1e, 0x3, "11"}]}}}}}}}}, 0x0) 1.810822665s ago: executing program 2 (id=2994): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, 0x0, &(0x7f0000000040)) 1.696239087s ago: executing program 1 (id=2996): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x20, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x2401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xbc}}, 0x0) 1.600019484s ago: executing program 1 (id=2997): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfd, {0x0, 0x0, 0x0, r5, {0x4}, {0xffff, 0xffff}, {0xf, 0xb}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c9}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, r3, {0x4}, {0xffff, 0xffff}, {0x7, 0x1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0x1}}}}, @TCA_RATE={0x6, 0x5, {0x1, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000810}, 0x4000080) 1.451420868s ago: executing program 1 (id=2999): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x0, 0x0, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000340)="c1fc0a0869fd0e76753a00000400", 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.275667274s ago: executing program 1 (id=3001): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000380)="c4f6567b42428c351d0eb7e00adfac40f6f3c6ddfeee4f9b47f2ae534b00a80cf8bfe9952dadad722784be00d5e05f8aa568711892567737d85ade9858ea72a66a3a417d6fbdfe0c98a369e4e8de7139ea726aa8fd9e2b80cf70a64914c3cc12d10db3f785dcc90135", 0x69}, {&(0x7f0000000640)="18f2539a86f4267acf60e40dadcc211bb186706861b663e404ae5430d948a3deeb5982fbb1551c83edaad587e700949a9d32f5e7ab7cf7f52b86771efac9c04f3e30497f94e49127658062a15683e89b0aceb57d125d3b4ea3d1ad05f4e14c85034917bea1f128a1f6f3f33e7fd479c0c7124b558f472800bd87b2b9bb1221098d2ed2f09ae682935416", 0x8a}, {&(0x7f0000000800)="1c98baccf3c4dda10bf3823360bf673a13af18c90ee53a5b0ab6833eee1edc56059d6fdcb3", 0x25}], 0x3}}], 0x1, 0x4000000) sendmsg$nl_route_sched_retired(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000001200)=@deltclass={0x474, 0x29, 0x1, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x13, 0x6}, {0x7, 0xffec}, {0x6, 0x8}}, [@c_cbq={{0x8}, {0x2c, 0x2, [@TCA_CBQ_LSSOPT={0x18, 0x1, {0x11, 0x1, 0x1a, 0x5, 0xcc6, 0x10001, 0x8, 0x2}}, @TCA_CBQ_FOPT={0x10, 0x3, {{0x5, 0x2}, 0x845, 0x1}}]}}, @c_cbq={{0x8}, {0x4}}, @c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x5768, 0x4, 0x6, 0xf8, 0x40, 0x8, 0x40, 0x80000001, 0x5222, 0x1, 0x4, 0x5, 0x100, 0x2, 0xa6, 0x2, 0xcab5, 0x6, 0x0, 0x8, 0x5, 0x7, 0x40, 0x1, 0x7, 0x5, 0xf, 0x2, 0x0, 0x3d, 0xaf4f, 0x3, 0xe, 0x0, 0x5, 0x8, 0x3, 0x399, 0xc, 0x1ff, 0xc, 0x7, 0x6, 0x6, 0x4, 0x7ff, 0x2c, 0x401, 0x0, 0x4, 0x8, 0x8, 0x356, 0x7fffffff, 0xfc65, 0x6, 0x1, 0x4, 0x7, 0x1, 0x3, 0x7, 0x9, 0x8, 0x1, 0x5, 0xfffffff9, 0x7, 0x262, 0x6, 0x60b, 0x204, 0x6, 0x2, 0xd, 0x6a71, 0x5, 0x0, 0x5, 0x400, 0x6, 0xb, 0x8001, 0x561, 0x6, 0x2, 0xe, 0xc, 0x0, 0x0, 0x1155, 0x1, 0x7, 0xde1, 0x5, 0x8, 0x0, 0x4, 0x89, 0x7, 0xfffffffc, 0x9, 0x2, 0x1, 0x4, 0x4, 0xfff, 0x9, 0x401, 0x4, 0x4d, 0xffffffdc, 0x6, 0x9, 0x9, 0x10000000, 0xc, 0x1000, 0x1, 0x9, 0x1, 0x80000001, 0x0, 0x7, 0x1, 0x8, 0x1d, 0x9f, 0x5, 0x88, 0x8, 0x5, 0x8001, 0x6962, 0x800, 0x1000, 0x3, 0x325, 0x8, 0x1, 0xc, 0x8, 0x4, 0x4, 0x5, 0x4, 0x68f1, 0x4de, 0x4, 0xe4, 0x3, 0x7, 0x3, 0x8, 0x69484c88, 0xfffffff8, 0x9, 0x1, 0x1000, 0x9, 0x6, 0x6, 0x5, 0x5abc, 0x275, 0x10001, 0xc787, 0x9, 0xa, 0xd659, 0xfff, 0x10001, 0x7fff, 0x6, 0xfffffffe, 0x7, 0x581, 0x7, 0x4, 0x789, 0xe95d, 0x8, 0x8, 0x8, 0x41d5806b, 0x9, 0xe, 0x10, 0x7ff, 0x4af9, 0x6bf070d4, 0x80000000, 0xcf4, 0xc796, 0x1, 0x2, 0x4, 0x1c4, 0x5, 0x7, 0x8, 0x7fffffff, 0x7, 0x0, 0x8, 0x9, 0x87, 0x0, 0x2, 0x1000, 0x0, 0x297e419b, 0x80000001, 0xffffff39, 0x7, 0x200, 0xb21c, 0x80, 0x4, 0xb, 0x6703, 0xc7b, 0xf48, 0x6, 0x8, 0x1, 0x2, 0x3, 0x101, 0xe0b, 0x1, 0x502f, 0x1, 0x4, 0x9, 0xfffffff7, 0x3, 0x9, 0x3, 0xdfc7, 0x0, 0x9, 0x8, 0x2, 0x7fff, 0x10001, 0x4, 0x73f, 0xcfca, 0xd, 0xd3a, 0x9, 0xc2f3, 0x8, 0x3]}]}}]}, 0x474}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1.260543313s ago: executing program 4 (id=3002): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f03446b000000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) 1.146914765s ago: executing program 4 (id=3003): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$sock(r0, &(0x7f0000003f80)=[{{&(0x7f0000000000)=@l2={0x1f, 0x6, @any, 0x643}, 0x80, &(0x7f00000022c0), 0x0, &(0x7f0000002340)}}], 0x1, 0x80008) 1.017685995s ago: executing program 4 (id=3004): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="840000001000010027bd700402d4df2500000000", @ANYRES32=r2, @ANYBLOB="94e40700100c000064001280110001006272696467655f736c617665000000004c0005800800030001000000050021000000000005001b000000000005000c0001000000080022"], 0x84}}, 0x200088c2) 796.896511ms ago: executing program 3 (id=3006): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x2c, 0x0, 0xa11, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x12}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 754.009579ms ago: executing program 2 (id=3007): bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) close(0x3) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa171100756695acf0af839ec5300a584fe44c80de0b061417e9ade22cecede5d5be6ab3d7828ee094518a5800000082c81ddfe3960a29ea15fa7e26f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000010000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41a73b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee350123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9abc92145677e14054331801b1412b39049ed782742f9a1b6aca9123b243c1a68c047f2db79701b62c8cc0d2f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18ec83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b077e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000400000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7000eb305c936d26964a2a85e133d01368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0244e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416ffff6f2e4e36306630052a2b03ee36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefaf8576b363690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005ea800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e06744bda63134223416102aea1254d57c390e1f84ec7d5c3a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96b22394afb840247e5d69473b836f070dc0bf9302e33b03d4e07395c82e33667726b51ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962ff5e75c81f583c64b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553066de7cb767a121d56d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33a73ac00337067dfd3ecaf4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70ad7ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e0000000000000000004076eac7e605f8de6f0ce5702af52c5d78bac0097d92f078a3a98229ebf281c3c876d2614109b69967871fea621fb2a29a77a1516b51d9b1c3c5ef1436f50fad4a1cd92a211fec61d37c8b410a20fbdeb642228d6cfeb8cda8eea3a7f343fcaa0459b9d916abb668d4799534307084ee7d854dd0850000000000000000000000002f40c3e24f9c0a56edf543425058c35febda26a43bdab770212186b84421d8b841cf9181d47c08cb392e414c1efba9978a97769e65ae443644dbdb32a50cdc717a34d1aa9ced37820a6d1cd0920a9a07e36a85e967bfa7f2caf1c9b52c06f4d178fbb91a169e9533e401819e57cab814761819b0fc517239a6777dbb92a7462538dbd8a4b82f87df7982b44b160a598c75bafa5a9b388a44303dbebc83ac2ad2da3ae80c851bc2fdb8d444597fdac4538aa33bb9204ffe534b15a1878be30157d0815d38fc2effeb7b87d6bd15e21c7b7c7d1ad7b3fd69b4bd06716a203e82f4c0413719eae0967fc70f03570375c2d0986b0200897e505afb87b878f3e13187001bba6a401bd56f3f8eb5384e33"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0xa, &(0x7f0000000300)=ANY=[@ANYBLOB="b70200000a0000007b2ac0ff00000000632ac8ff00000000b70200000001010abfa200000000000007020000c0ffffffb703000040000000b704000000000000850000004500000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r0, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 687.420791ms ago: executing program 4 (id=3008): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x3) listen(0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket(0xa, 0x1, 0x0) listen(r3, 0x7f) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 615.539147ms ago: executing program 3 (id=3009): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x5, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x3b}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r4, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x4}, {}, {0x6, 0x8}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x7, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x3, 0x9, 0x2d}, {0xffffff8a, 0x9d2, 0x2, 0x10000}, {0x9, 0xc, 0x8, 0x8}, {0x0, 0x1, 0x3b7, 0x5}, {0x553e3387, 0x3, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0x1000, 0xa8c, 0xfffffff8, 0xd}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r8, {0xc, 0x10}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=@newtfilter={0x30, 0x2c, 0xd27, 0x30bd2b, 0x25dfdbfa, {0x0, 0x0, 0x0, r10, {0xf, 0xf}, {}, {0xffff, 0xc}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x110}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r13, {0x6}, {}, {0x5, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x62b9, 0x5, 0xfffffff7, 0x5, 0x3, 0xe1cb, 0x5, 0x1, 0x3, 0x0, 0x1, 0x2, 0x6, 0xacd, 0x0, 0x364, 0x1, 0x2, 0xffffff41, 0x3, 0x2, 0x8, 0x3, 0x9, 0xffffffc0, 0xf0000000, 0x688, 0xffff, 0x0, 0x2, 0x80000001, 0x0, 0xe, 0x5, 0xe018, 0x5, 0xffffadc0, 0x8001, 0xf, 0x4, 0x8d2a00, 0x8, 0xf, 0x4ba, 0x10001, 0x80, 0xffff, 0x1, 0xb, 0x0, 0x400, 0xe5, 0x93, 0x5, 0x45a5, 0x8, 0x6, 0x4, 0x0, 0x2, 0x3, 0x80, 0x0, 0x1, 0x9, 0x5, 0x403, 0x9, 0x3f32f5d7, 0x3, 0x4, 0x7f, 0x101, 0xde, 0x101, 0x7, 0x6, 0x7f, 0xfff, 0x6, 0x9, 0xf7, 0x5, 0x2, 0x81, 0x0, 0x6, 0x7, 0x1, 0x437, 0x6, 0x3, 0x2, 0x7000000, 0x5, 0x9, 0xeca, 0x6, 0x4, 0x8, 0x400, 0x7a5, 0x9, 0x9, 0x0, 0x9, 0x8, 0x9, 0x3, 0x7ff, 0x5, 0x6, 0x4, 0x7, 0x10, 0x4001d1da, 0x8, 0x5, 0x1, 0x7, 0x8001, 0xe3c8, 0xffffffff, 0xd, 0x8006, 0x4, 0x9, 0x7fffffff, 0x3, 0xb8b4, 0x723, 0x15, 0x9367, 0x81, 0x400000, 0x9, 0x6, 0x75, 0x1ff, 0xc695, 0x4, 0xf, 0x7, 0x3, 0x0, 0x3ff, 0x8000, 0xff, 0x8005, 0x0, 0x6496, 0x7f, 0x3, 0x0, 0xf528, 0x6, 0x80000000, 0x6, 0x157b, 0x7, 0x40, 0x1, 0x10001, 0x3, 0x9, 0x2, 0x5, 0x2450, 0x86d, 0x2, 0x7, 0x7, 0xfffffffa, 0x804, 0xfffffffc, 0x4, 0xb6, 0x5, 0x7fff, 0x9f4c, 0x1, 0x8, 0xe, 0x121, 0x7fff, 0x3, 0x8, 0x3, 0xa, 0x9, 0x9, 0x2, 0x4, 0x2, 0x8, 0x5, 0x5, 0x401, 0x9, 0x4b8, 0xa78, 0xec8, 0x1, 0xfffffffa, 0x80020003, 0x0, 0x0, 0x2, 0x8c1, 0x5, 0xfffffffa, 0x6, 0x175b, 0x7fffffff, 0x4, 0xb4, 0xffff8001, 0x8001, 0xffff, 0x5, 0x0, 0x401, 0x5, 0x10, 0x7fff, 0xffffff00, 0x3, 0x8, 0x9268, 0x80000000, 0x2, 0x7, 0x4, 0x3, 0x4, 0xced, 0x5, 0xa524, 0x7, 0x81f, 0x3, 0x10, 0x80, 0x1ff, 0x1109, 0x9, 0x1, 0x1, 0x2, 0x0, 0x8, 0x7f, 0x3, 0x6, 0x4]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x2004009c}, 0x0) 456.322785ms ago: executing program 2 (id=3010): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r1, 0x30011}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @rand_addr=0x64010102}, @IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0xf2c0}, @IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) 343.590147ms ago: executing program 4 (id=3011): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001140)={'wlan1\x00', 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$NL80211_CMD_DISASSOCIATE(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="01002abd7000fcdbdf252800000008000300", @ANYRES32=r1, @ANYBLOB="0a00060050505050d25050000006003600fa00"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x20000004) 253.084208ms ago: executing program 1 (id=3012): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xe, 0x0, &(0x7f0000000700)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 119.679419ms ago: executing program 4 (id=3013): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg$inet6(r0, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000001fc0)=[{0x0}, {&(0x7f0000000340)="9991778a2e9d997cd424440a0b2d9dc2bdec97af36b665e7217d78f0594c37a9d1d0ac2300614a4c9653d4296089a43c88e56bc4a2c0ec89fa4f87a0ad610a3cc5dd515f83763aa295c82be8f2a2cf7734def29c805d1f43dee25cfd23076411e8fc32ae5a8749df4471610fce10e74d8cefd7d62421bd1d43c872168bc4a10b02b0182af55dcfac087fe8c223d915d88802ccf34011d5d84351b158dabc3ad5189043e28910ec8ff81f957afbe80d261b5aab39fec06044792d49e91517b3a617cd1f9820b7569901955be37dd94548a9808f0670b728183841b038981f9c08893a9cc9babda3b8c7ff1882af89d3110046c4d1bfc5d481446b92ce7ed75deccfc027d40a1e0e3bc63a1d60052bdd8000e48f2c3b0ca971129fe97b7ecb13c71e066007b2e25544f0055fad178872f539fd8bc1ea68ab0a995b", 0x5ac}], 0x2, &(0x7f0000000600)=ANY=[], 0x28}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)="399ab932fca8", 0x6}], 0x1}}], 0x2, 0x4008c04) 69.351333ms ago: executing program 3 (id=3014): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@updsa={0x13c, 0x1a, 0x1, 0x0, 0x0, {{@in=@loopback, @in6=@empty}, {@in=@local, 0x0, 0x33}, @in6=@rand_addr=' \x01\x00', {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'xcbc(aes)\x00'}}}]}, 0x13c}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0xfffffffe, 0x0, 0x3fc, 0x0, 0x32, 0x9}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x1, 0x20}, 0xc) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x4, 0x800, 0x0, 0x0, 0x8a, 0xfffffffc}, 0x9c) unshare(0x2c020400) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000100)=0x6, 0x4) setsockopt$sock_int(r2, 0x1, 0x2d, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet6_int(r0, 0x29, 0x48, &(0x7f0000000280), &(0x7f00000002c0)=0x4) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)={0x18, 0x0, 0x1, 0x101, 0x0, 0x0, {0xf, 0x0, 0xa}, [@CTA_TUPLE_REPLY={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4020004}, 0x80) getsockopt$bt_hci(r1, 0x0, 0x2, &(0x7f0000000300)=""/200, &(0x7f0000000400)=0xc8) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x1c, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc020000000000000000000000000000140004"], 0x84}}, 0x0) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r7, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x100, 0x0, 0x0, 0x0, 0x54}, 0x9c) 205.966µs ago: executing program 1 (id=3015): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) poll(0x0, 0x0, 0xc511) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0xf500, {[@fastopen={0x1e, 0x3, "11"}]}}}}}}}}, 0x0) 0s ago: executing program 2 (id=3016): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfdfffdfd, {0x0, 0x0, 0x0, r5, {0x4}, {0xffff, 0xffff}, {0xf, 0xb}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c9}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x5001, 0xfffffdfb, {0x0, 0x0, 0x0, 0x0, {0x4}, {0xffff, 0xffff}, {0x7, 0x1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0x1}}}}, @TCA_RATE={0x6, 0x5, {0x1, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000810}, 0x4000080) kernel console output (not intermixed with test programs): devsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 232.241885][ T9005] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.053849][ T9998] __nla_validate_parse: 1 callbacks suppressed [ 233.053868][ T9998] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1301'. [ 233.092418][ T9998] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1301'. [ 233.107978][ T9998] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1301'. [ 233.240663][T10007] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1304'. [ 233.335519][T10009] netlink: 'syz.1.1306': attribute type 1 has an invalid length. [ 233.504151][T10009] 8021q: adding VLAN 0 to HW filter on device bond15 [ 233.572053][T10027] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1311'. [ 233.586248][T10025] netlink: 'syz.1.1306': attribute type 10 has an invalid length. [ 233.626137][T10015] bond15: (slave gretap7): making interface the new active one [ 233.646820][T10025] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1306'. [ 233.661666][T10015] bond15: (slave gretap7): Enslaving as an active interface with an up link [ 233.689388][T10019] dummy0: left promiscuous mode [ 233.707559][T10019] bond15: (slave dummy0): Enslaving as an active interface with an up link [ 233.738629][T10025] dummy0: entered promiscuous mode [ 233.747841][T10025] bond15: (slave dummy0): Releasing active interface [ 234.054109][T10039] block nbd0: server does not support multiple connections per device. [ 234.127753][T10039] block nbd0: shutting down sockets [ 234.322631][T10050] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1319'. [ 234.365615][T10050] netlink: 224 bytes leftover after parsing attributes in process `syz.3.1319'. [ 234.402223][T10050] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1319'. [ 234.636280][T10066] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1325'. [ 235.063871][T10084] netlink: 'syz.0.1332': attribute type 1 has an invalid length. [ 235.183577][T10084] 8021q: adding VLAN 0 to HW filter on device bond6 [ 235.326553][T10084] netlink: 'syz.0.1332': attribute type 10 has an invalid length. [ 235.360913][T10090] bond6: (slave gretap4): making interface the new active one [ 235.385169][T10090] bond6: (slave gretap4): Enslaving as an active interface with an up link [ 235.435610][T10093] bond3: (slave dummy0): Releasing active interface [ 235.503070][T10093] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 235.538636][T10084] dummy0: entered promiscuous mode [ 235.567465][T10084] bond6: (slave dummy0): Releasing active interface [ 236.405586][T10136] netlink: 'syz.1.1348': attribute type 7 has an invalid length. [ 236.529123][T10141] FAULT_INJECTION: forcing a failure. [ 236.529123][T10141] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 236.573493][T10141] CPU: 1 UID: 0 PID: 10141 Comm: syz.4.1350 Not tainted syzkaller #0 PREEMPT(full) [ 236.573541][T10141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 236.573580][T10141] Call Trace: [ 236.573587][T10141] [ 236.573595][T10141] dump_stack_lvl+0xe8/0x150 [ 236.573628][T10141] should_fail_ex+0x410/0x560 [ 236.573661][T10141] _copy_from_user+0x2d/0xb0 [ 236.573682][T10141] ___sys_sendmsg+0x1c6/0x360 [ 236.573710][T10141] ? __lock_acquire+0x683/0x2cf0 [ 236.573739][T10141] ? __pfx____sys_sendmsg+0x10/0x10 [ 236.573796][T10141] ? __fget_files+0x2a/0x420 [ 236.573822][T10141] ? __fget_files+0x3a2/0x420 [ 236.573857][T10141] __x64_sys_sendmsg+0x1b1/0x290 [ 236.573888][T10141] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 236.573936][T10141] do_syscall_64+0x166/0x520 [ 236.573957][T10141] ? trace_irq_disable+0x3b/0x140 [ 236.573982][T10141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.574001][T10141] ? clear_bhb_loop+0x70/0xc0 [ 236.574024][T10141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 236.574043][T10141] RIP: 0033:0x7fb1c0b9e0d9 [ 236.574061][T10141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 236.574079][T10141] RSP: 002b:00007fb1c1b2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 236.574101][T10141] RAX: ffffffffffffffda RBX: 00007fb1c0e25fa0 RCX: 00007fb1c0b9e0d9 [ 236.574114][T10141] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 236.574125][T10141] RBP: 00007fb1c1b2d090 R08: 0000000000000000 R09: 0000000000000000 [ 236.574137][T10141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 236.574148][T10141] R13: 00007fb1c0e26038 R14: 00007fb1c0e25fa0 R15: 00007ffec253c0b8 [ 236.574179][T10141] [ 236.921250][T10157] netlink: 'syz.2.1359': attribute type 24 has an invalid length. [ 237.227340][T10175] FAULT_INJECTION: forcing a failure. [ 237.227340][T10175] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.280442][T10175] CPU: 0 UID: 0 PID: 10175 Comm: syz.2.1364 Not tainted syzkaller #0 PREEMPT(full) [ 237.280476][T10175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 237.280488][T10175] Call Trace: [ 237.280494][T10175] [ 237.280502][T10175] dump_stack_lvl+0xe8/0x150 [ 237.280534][T10175] should_fail_ex+0x410/0x560 [ 237.280568][T10175] _copy_from_user+0x2d/0xb0 [ 237.280587][T10175] ___sys_recvmsg+0x173/0x5a0 [ 237.280621][T10175] ? __pfx____sys_recvmsg+0x10/0x10 [ 237.280653][T10175] ? __fget_files+0x2a/0x420 [ 237.280704][T10175] do_recvmmsg+0x31a/0x7f0 [ 237.280729][T10175] ? __pfx_do_recvmmsg+0x10/0x10 [ 237.280767][T10175] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 237.280789][T10175] ? __fget_files+0x3a2/0x420 [ 237.280821][T10175] __x64_sys_recvmmsg+0x198/0x250 [ 237.280842][T10175] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 237.280873][T10175] do_syscall_64+0x166/0x520 [ 237.280896][T10175] ? trace_irq_disable+0x3b/0x140 [ 237.280920][T10175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 237.280939][T10175] ? clear_bhb_loop+0x70/0xc0 [ 237.280962][T10175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 237.280979][T10175] RIP: 0033:0x7fbb5d99e0d9 [ 237.280995][T10175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.281010][T10175] RSP: 002b:00007fbb5e83d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 237.281031][T10175] RAX: ffffffffffffffda RBX: 00007fbb5dc25fa0 RCX: 00007fbb5d99e0d9 [ 237.281045][T10175] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 237.281057][T10175] RBP: 00007fbb5e83d090 R08: 0000000000000000 R09: 0000000000000000 [ 237.281069][T10175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 237.281081][T10175] R13: 00007fbb5dc26038 R14: 00007fbb5dc25fa0 R15: 00007fff8a598e98 [ 237.281110][T10175] [ 238.057062][T10199] openvswitch: netlink: Message has 13080 unknown bytes. [ 238.078065][T10199] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 238.103814][T10197] 8021q: adding VLAN 0 to HW filter on device bond7 [ 238.132900][T10198] bond7: (slave ip6erspan0): making interface the new active one [ 238.173958][T10198] bond7: (slave ip6erspan0): Enslaving as an active interface with an up link [ 238.384837][T10210] __nla_validate_parse: 6 callbacks suppressed [ 238.384855][T10210] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1377'. [ 238.546871][T10215] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1378'. [ 238.667802][T10215] ip6t_srh: unknown srh invflags BA61 [ 238.788615][T10228] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1382'. [ 238.827353][T10228] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1382'. [ 238.858257][ T30] audit: type=1800 audit(1787580537.813:5): pid=10230 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1380" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1312 res=0 errno=0 [ 238.877074][T10228] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 239.154937][T10244] netlink: 'syz.0.1388': attribute type 1 has an invalid length. [ 239.278387][T10244] 8021q: adding VLAN 0 to HW filter on device bond8 [ 239.307714][T10253] dummy0: left promiscuous mode [ 239.318794][T10253] bond8: (slave dummy0): making interface the new active one [ 239.329786][T10253] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 239.373495][T10250] bond8: (slave gretap5): Enslaving as an active interface with an up link [ 239.405152][T10244] netlink: 'syz.0.1388': attribute type 10 has an invalid length. [ 239.447358][T10244] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1388'. [ 239.512102][T10244] dummy0: entered promiscuous mode [ 239.558953][T10244] bond8: (slave dummy0): Releasing active interface [ 239.564691][T10260] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1389'. [ 239.595736][T10244] bond8: (slave dummy0): the permanent HWaddr of slave - aa:aa:aa:aa:aa:24 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 239.659721][T10244] bond8: (slave gretap5): making interface the new active one [ 239.717335][T10268] ip6t_srh: unknown srh invflags BA61 [ 239.829165][T10272] Cannot find del_set index 4 as target [ 240.235170][T10283] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1393'. [ 240.309615][T10282] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 240.351772][T10283] ip6t_srh: unknown srh invflags BA61 [ 240.519969][T10294] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1399'. [ 240.722255][T10303] openvswitch: netlink: Message has 6676 unknown bytes. [ 240.744827][T10303] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 240.885730][T10308] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1403'. [ 240.982752][T10308] 8021q: adding VLAN 0 to HW filter on device bond9 [ 241.014309][T10314] dummy0: left promiscuous mode [ 241.024608][T10308] netlink: 'syz.0.1403': attribute type 10 has an invalid length. [ 241.061105][T10308] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1403'. [ 241.078602][T10314] bond9: (slave dummy0): Enslaving as an active interface with an up link [ 241.337275][T10308] dummy0: entered promiscuous mode [ 241.344805][T10308] bond9: (slave dummy0): Releasing backup interface [ 241.685897][T10338] ip_tables: iptables: counters copy to user failed while replacing table [ 241.817058][T10338] ip6t_srh: unknown srh invflags BA61 [ 242.280060][T10359] wg0: Caught tx_queue_len zero misconfig [ 242.793650][T10392] openvswitch: netlink: Missing valid actions attribute. [ 242.803362][T10392] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 243.058712][T10400] netlink: 'syz.2.1433': attribute type 1 has an invalid length. [ 243.171753][T10400] 8021q: adding VLAN 0 to HW filter on device bond10 [ 243.244862][T10411] ipip0: entered promiscuous mode [ 243.272207][T10414] netlink: 'syz.3.1438': attribute type 2 has an invalid length. [ 243.824085][T10438] netlink: 'syz.1.1447': attribute type 1 has an invalid length. [ 243.832208][T10438] netlink: 'syz.1.1447': attribute type 4 has an invalid length. [ 243.840587][T10438] __nla_validate_parse: 9 callbacks suppressed [ 243.840602][T10438] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.1447'. [ 243.864970][T10438] netlink: 'syz.1.1447': attribute type 1 has an invalid length. [ 243.873429][T10438] netlink: 'syz.1.1447': attribute type 4 has an invalid length. [ 243.881639][T10438] netlink: 9462 bytes leftover after parsing attributes in process `syz.1.1447'. [ 243.904232][T10438] netlink: 'syz.1.1447': attribute type 34 has an invalid length. [ 244.022529][T10443] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1448'. [ 244.690951][T10478] tunl0: Caught tx_queue_len zero misconfig [ 244.981256][T10494] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1466'. [ 245.020111][T10494] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1466'. [ 245.040339][T10494] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1466'. [ 245.066152][T10494] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1466'. [ 245.108152][T10494] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1466'. [ 245.128570][T10500] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1468'. [ 245.150381][T10494] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1466'. [ 245.424801][T10494] bridge0: port 3(bond0) entered disabled state [ 245.431539][T10494] bridge0: port 2(bridge_slave_1) entered disabled state [ 245.439210][T10494] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.688433][T10494] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.737417][T10494] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 245.888696][T10518] netlink: 'syz.3.1472': attribute type 11 has an invalid length. [ 246.263487][T10511] syzkaller0: left promiscuous mode [ 246.288486][T10511] syzkaller0: left allmulticast mode [ 246.533451][ T8999] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.547250][ T8999] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.558543][T10519] tipc: Started in network mode [ 246.564435][T10519] tipc: Node identity 4e9c4a97675, cluster identity 4711 [ 246.574930][T10519] tipc: Enabled bearer , priority 0 [ 246.587368][ T8999] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.601064][ T8999] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.627058][ T8999] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.657761][ T8999] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.692172][ T8999] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 246.709601][ T8999] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 246.936567][T10548] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 247.039223][T10545] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 247.532799][T10571] netlink: 'syz.0.1490': attribute type 1 has an invalid length. [ 247.637050][T10571] 8021q: adding VLAN 0 to HW filter on device bond10 [ 247.687944][T10574] bond10: (slave gretap6): making interface the new active one [ 247.697114][T10574] bond10: (slave gretap6): Enslaving as an active interface with an up link [ 247.706093][T10571] dummy0: left promiscuous mode [ 247.718779][T10571] bond10: (slave dummy0): Enslaving as an active interface with an up link [ 247.730179][ T7908] tipc: Node number set to 701254295 [ 247.731288][T10571] netlink: 'syz.0.1490': attribute type 10 has an invalid length. [ 247.755146][T10571] dummy0: entered promiscuous mode [ 247.778650][T10571] bond10: (slave dummy0): Releasing active interface [ 248.031418][T10594] veth1_to_bond: entered allmulticast mode [ 248.089034][T10594] veth1_to_bond: left allmulticast mode [ 249.039966][T10634] block nbd0: server does not support multiple connections per device. [ 249.090638][T10640] __nla_validate_parse: 200 callbacks suppressed [ 249.090659][T10640] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1515'. [ 249.100631][T10634] block nbd0: shutting down sockets [ 249.283136][T10647] FAULT_INJECTION: forcing a failure. [ 249.283136][T10647] name failslab, interval 1, probability 0, space 0, times 0 [ 249.315507][T10647] CPU: 0 UID: 0 PID: 10647 Comm: syz.0.1518 Not tainted syzkaller #0 PREEMPT(full) [ 249.315536][T10647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 249.315547][T10647] Call Trace: [ 249.315554][T10647] [ 249.315562][T10647] dump_stack_lvl+0xe8/0x150 [ 249.315594][T10647] should_fail_ex+0x410/0x560 [ 249.315627][T10647] should_failslab+0xa8/0x100 [ 249.315655][T10647] __kmalloc_noprof+0xfe/0x720 [ 249.315679][T10647] ? is_bpf_text_address+0x26/0x2b0 [ 249.315708][T10647] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 249.315732][T10647] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 249.315764][T10647] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 249.315798][T10647] genl_family_rcv_msg_doit+0xda/0x340 [ 249.315830][T10647] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 249.315859][T10647] ? apparmor_capable+0x126/0x170 [ 249.315884][T10647] ? bpf_lsm_capable+0x9/0x20 [ 249.315905][T10647] ? security_capable+0x7e/0x2c0 [ 249.315932][T10647] genl_rcv_msg+0x614/0x7a0 [ 249.315954][T10647] ? __pfx_genl_rcv_msg+0x10/0x10 [ 249.315973][T10647] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 249.315994][T10647] ? __pfx_nl80211_new_station+0x10/0x10 [ 249.316011][T10647] ? __pfx_nl80211_post_doit+0x10/0x10 [ 249.316045][T10647] netlink_rcv_skb+0x226/0x4a0 [ 249.316065][T10647] ? __pfx_genl_rcv_msg+0x10/0x10 [ 249.316089][T10647] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 249.316123][T10647] ? down_read+0x2be/0x330 [ 249.316150][T10647] genl_rcv+0x28/0x40 [ 249.316170][T10647] netlink_unicast+0x7bd/0x940 [ 249.316208][T10647] netlink_sendmsg+0x813/0xb40 [ 249.316232][T10647] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.316254][T10647] ? aa_sock_msg_perm+0xf6/0x1c0 [ 249.316286][T10647] ? __pfx_netlink_sendmsg+0x10/0x10 [ 249.316304][T10647] sock_sendmsg_nosec+0x13a/0x180 [ 249.316328][T10647] ____sys_sendmsg+0x54e/0x850 [ 249.316362][T10647] ? __pfx_____sys_sendmsg+0x10/0x10 [ 249.316396][T10647] ? import_iovec+0x73/0xa0 [ 249.316427][T10647] ___sys_sendmsg+0x2a5/0x360 [ 249.316453][T10647] ? __lock_acquire+0x683/0x2cf0 [ 249.316484][T10647] ? __pfx____sys_sendmsg+0x10/0x10 [ 249.316550][T10647] ? __fget_files+0x2a/0x420 [ 249.316576][T10647] ? __fget_files+0x3a2/0x420 [ 249.316612][T10647] __x64_sys_sendmsg+0x1b1/0x290 [ 249.316642][T10647] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 249.316691][T10647] do_syscall_64+0x166/0x520 [ 249.316712][T10647] ? trace_irq_disable+0x3b/0x140 [ 249.316736][T10647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.316756][T10647] ? clear_bhb_loop+0x70/0xc0 [ 249.316778][T10647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 249.316797][T10647] RIP: 0033:0x7f949799e0d9 [ 249.316815][T10647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 249.316832][T10647] RSP: 002b:00007f9498868028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 249.316852][T10647] RAX: ffffffffffffffda RBX: 00007f9497c25fa0 RCX: 00007f949799e0d9 [ 249.316866][T10647] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000003 [ 249.316878][T10647] RBP: 00007f9498868090 R08: 0000000000000000 R09: 0000000000000000 [ 249.316889][T10647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 249.316900][T10647] R13: 00007f9497c26038 R14: 00007f9497c25fa0 R15: 00007ffd7fef7958 [ 249.316930][T10647] [ 249.594966][T10651] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1517'. [ 249.820122][T10651] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1517'. [ 249.991641][T10665] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1523'. [ 250.386114][T10676] netlink: 'syz.4.1527': attribute type 1 has an invalid length. [ 250.409284][T10678] veth1_to_bond: entered allmulticast mode [ 250.443621][T10680] netlink: 'syz.1.1529': attribute type 1 has an invalid length. [ 250.456092][T10676] 8021q: adding VLAN 0 to HW filter on device bond11 [ 250.516932][T10676] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1527'. [ 250.540895][T10680] 8021q: adding VLAN 0 to HW filter on device bond16 [ 250.669224][T10678] veth1_to_bond: left allmulticast mode [ 250.831277][T10691] bond16: (slave veth3): Enslaving as an active interface with a down link [ 250.889129][T10680] dummy0: left promiscuous mode [ 250.897745][T10696] xt_hashlimit: size too large, truncated to 1048576 [ 250.904694][T10680] bond16: (slave dummy0): making interface the new active one [ 250.919402][T10680] bond16: (slave dummy0): Enslaving as an active interface with an up link [ 251.428478][T10718] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1538'. [ 251.449387][T10718] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1538'. [ 251.825605][T10738] ip_tables: iptables: counters copy to user failed while replacing table [ 251.861379][T10732] IPv6: sit1: Disabled Multicast RS [ 251.891017][T10741] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1542'. [ 251.990113][T10741] ip6t_srh: unknown srh invflags BA61 [ 252.065729][T10746] netlink: 'syz.1.1547': attribute type 1 has an invalid length. [ 252.094306][T10746] netlink: 'syz.1.1547': attribute type 2 has an invalid length. [ 252.197759][T10746] xt_hashlimit: size too large, truncated to 1048576 [ 252.389517][T10756] netlink: 393 bytes leftover after parsing attributes in process `syz.2.1550'. [ 252.455074][T10752] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1548'. [ 252.678017][T10748] bond10: entered promiscuous mode [ 252.696558][T10748] bond10: entered allmulticast mode [ 252.714540][T10748] 8021q: adding VLAN 0 to HW filter on device bond10 [ 252.751876][T10771] netlink: 'syz.0.1551': attribute type 1 has an invalid length. [ 252.860802][T10771] 8021q: adding VLAN 0 to HW filter on device bond11 [ 252.945926][T10779] netlink: 'syz.0.1551': attribute type 10 has an invalid length. [ 252.981445][T10768] bond11: (slave gretap7): making interface the new active one [ 252.992259][T10768] bond11: (slave gretap7): Enslaving as an active interface with an up link [ 253.006296][T10775] dummy0: left promiscuous mode [ 253.020037][T10775] bond11: (slave dummy0): Enslaving as an active interface with an up link [ 253.055598][T10779] dummy0: entered promiscuous mode [ 253.062935][T10779] bond11: (slave dummy0): Releasing active interface [ 253.069983][T10779] gretap7: entered promiscuous mode [ 253.276084][T10785] vlan2: entered promiscuous mode [ 253.286234][T10785] syz_tun: entered promiscuous mode [ 254.042662][T10784] vlan2: left promiscuous mode [ 254.057200][T10784] syz_tun: left promiscuous mode [ 254.292900][T10828] __nla_validate_parse: 5 callbacks suppressed [ 254.292919][T10828] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1573'. [ 254.349027][T10828] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1573'. [ 254.735918][T10851] netlink: 'syz.1.1579': attribute type 32 has an invalid length. [ 254.762786][T10851] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1579'. [ 254.789078][T10851] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 254.815924][T10855] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1581'. [ 254.839001][T10855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1581'. [ 254.872706][T10855] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1581'. [ 254.901355][T10855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1581'. [ 255.081768][T10865] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1585'. [ 255.276310][T10875] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1588'. [ 255.444643][T10883] netlink: 'syz.2.1591': attribute type 15 has an invalid length. [ 255.509514][T10885] bond16: (slave dummy0): Releasing active interface [ 255.747501][T10901] ip_tables: iptables: counters copy to user failed while replacing table [ 255.780760][T10901] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1598'. [ 255.868659][T10911] ip6t_srh: unknown srh invflags BA61 [ 255.893408][T10910] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 256.103360][T10922] Bluetooth: hci0: unsupported parameter 5135 [ 256.124118][T10922] Bluetooth: hci0: unsupported parameter 8192 [ 256.152455][T10922] Bluetooth: hci0: unsupported parameter 5135 [ 256.191110][T10922] Bluetooth: hci0: unsupported parameter 8192 [ 256.378286][T10934] ip_tables: iptables: counters copy to user failed while replacing table [ 256.463531][T10937] ip6t_srh: unknown srh invflags BA61 [ 256.640200][T10940] netlink: 'syz.0.1609': attribute type 1 has an invalid length. [ 256.673368][T10940] 8021q: adding VLAN 0 to HW filter on device bond12 [ 256.704020][T10940] bond12: (slave gretap8): making interface the new active one [ 256.712964][T10940] bond12: (slave gretap8): Enslaving as an active interface with an up link [ 256.730931][T10940] dummy0: left promiscuous mode [ 256.743352][T10940] bond12: (slave dummy0): Enslaving as an active interface with an up link [ 256.767221][T10940] netlink: 'syz.0.1609': attribute type 10 has an invalid length. [ 256.794794][T10940] dummy0: entered promiscuous mode [ 256.804489][T10940] bond12: (slave dummy0): Releasing active interface [ 257.199902][T10958] 8021q: adding VLAN 0 to HW filter on device bond12 [ 257.223915][T10968] dummy0: left promiscuous mode [ 257.258190][T10968] bond12: (slave dummy0): Enslaving as an active interface with an up link [ 257.820248][T11001] syzkaller0: left promiscuous mode [ 257.837130][T11001] syzkaller0: left allmulticast mode [ 258.163362][T11014] ip_tables: iptables: counters copy to user failed while replacing table [ 258.249504][T11016] ip6t_srh: unknown srh invflags BA61 [ 258.835406][T11033] x_tables: duplicate underflow at hook 1 [ 258.868190][T11035] netlink: 'syz.3.1638': attribute type 1 has an invalid length. [ 258.921823][T11035] 8021q: adding VLAN 0 to HW filter on device bond11 [ 258.967359][T11040] bond11: (slave gretap6): making interface the new active one [ 258.986158][T11040] bond11: (slave gretap6): Enslaving as an active interface with an up link [ 259.000104][T11035] dummy0: left promiscuous mode [ 259.011786][T11035] bond11: (slave dummy0): Enslaving as an active interface with an up link [ 259.038453][T11035] netlink: 'syz.3.1638': attribute type 10 has an invalid length. [ 259.047094][T11035] dummy0: entered promiscuous mode [ 259.059445][T11035] bond11: (slave dummy0): Releasing active interface [ 259.493652][T11061] sctp: [Deprecated]: syz.2.1644 (pid 11061) Use of struct sctp_assoc_value in delayed_ack socket option. [ 259.493652][T11061] Use struct sctp_sack_info instead [ 259.585679][T11065] sctp: [Deprecated]: syz.2.1644 (pid 11065) Use of struct sctp_assoc_value in delayed_ack socket option. [ 259.585679][T11065] Use struct sctp_sack_info instead [ 259.882712][T11074] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 260.675151][T11110] FAULT_INJECTION: forcing a failure. [ 260.675151][T11110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.713253][T11110] CPU: 1 UID: 0 PID: 11110 Comm: syz.0.1663 Not tainted syzkaller #0 PREEMPT(full) [ 260.713280][T11110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 260.713291][T11110] Call Trace: [ 260.713299][T11110] [ 260.713306][T11110] dump_stack_lvl+0xe8/0x150 [ 260.713338][T11110] should_fail_ex+0x410/0x560 [ 260.713373][T11110] _copy_from_user+0x2d/0xb0 [ 260.713394][T11110] ___sys_sendmsg+0x1c6/0x360 [ 260.713430][T11110] ? __lock_acquire+0x683/0x2cf0 [ 260.713462][T11110] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.713523][T11110] ? __fget_files+0x2a/0x420 [ 260.713547][T11110] ? __fget_files+0x3a2/0x420 [ 260.713583][T11110] __x64_sys_sendmsg+0x1b1/0x290 [ 260.713614][T11110] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 260.713663][T11110] do_syscall_64+0x166/0x520 [ 260.713684][T11110] ? trace_irq_disable+0x3b/0x140 [ 260.713708][T11110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.713728][T11110] ? clear_bhb_loop+0x70/0xc0 [ 260.713751][T11110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.713769][T11110] RIP: 0033:0x7f949799e0d9 [ 260.713786][T11110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.713803][T11110] RSP: 002b:00007f9498868028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 260.713824][T11110] RAX: ffffffffffffffda RBX: 00007f9497c25fa0 RCX: 00007f949799e0d9 [ 260.713839][T11110] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000004 [ 260.713851][T11110] RBP: 00007f9498868090 R08: 0000000000000000 R09: 0000000000000000 [ 260.713863][T11110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.713874][T11110] R13: 00007f9497c26038 R14: 00007f9497c25fa0 R15: 00007ffd7fef7958 [ 260.713905][T11110] [ 261.189465][T11126] netlink: 'syz.4.1668': attribute type 1 has an invalid length. [ 261.303315][T11126] 8021q: adding VLAN 0 to HW filter on device bond13 [ 261.344111][T11129] bond13: (slave gretap5): making interface the new active one [ 261.353391][T11129] bond13: (slave gretap5): Enslaving as an active interface with an up link [ 261.365784][T11131] veth1_to_hsr: entered promiscuous mode [ 261.399143][T11134] bond12: (slave dummy0): Releasing backup interface [ 261.450481][T11134] bond13: (slave dummy0): Enslaving as an active interface with an up link [ 261.476244][T11126] dummy0: entered promiscuous mode [ 261.616055][T11135] __nla_validate_parse: 7 callbacks suppressed [ 261.616075][T11135] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1671'. [ 261.649256][T11143] FAULT_INJECTION: forcing a failure. [ 261.649256][T11143] name failslab, interval 1, probability 0, space 0, times 0 [ 261.715585][T11143] CPU: 1 UID: 0 PID: 11143 Comm: syz.4.1674 Not tainted syzkaller #0 PREEMPT(full) [ 261.715615][T11143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 261.715626][T11143] Call Trace: [ 261.715633][T11143] [ 261.715640][T11143] dump_stack_lvl+0xe8/0x150 [ 261.715671][T11143] should_fail_ex+0x410/0x560 [ 261.715701][T11143] ? __rhashtable_init_noprof+0x545/0xaf0 [ 261.715730][T11143] should_failslab+0xa8/0x100 [ 261.715757][T11143] __kvmalloc_node_noprof+0x176/0x870 [ 261.715795][T11143] ? __rhashtable_init_noprof+0x545/0xaf0 [ 261.715829][T11143] __rhashtable_init_noprof+0x545/0xaf0 [ 261.715861][T11143] __rhltable_init_noprof+0x26/0x70 [ 261.715891][T11143] nf_tables_newtable+0x6e0/0x1990 [ 261.715936][T11143] nfnetlink_rcv+0x1288/0x28c0 [ 261.715996][T11143] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 261.716069][T11143] ? netlink_deliver_tap+0x2e/0x1b0 [ 261.716098][T11143] ? netlink_deliver_tap+0x2e/0x1b0 [ 261.716116][T11143] ? netlink_deliver_tap+0x2e/0x1b0 [ 261.716140][T11143] netlink_unicast+0x7bd/0x940 [ 261.716178][T11143] netlink_sendmsg+0x813/0xb40 [ 261.716205][T11143] ? __pfx_netlink_sendmsg+0x10/0x10 [ 261.716228][T11143] ? aa_sock_msg_perm+0xf6/0x1c0 [ 261.716263][T11143] ? __pfx_netlink_sendmsg+0x10/0x10 [ 261.716280][T11143] sock_sendmsg_nosec+0x13a/0x180 [ 261.716305][T11143] ____sys_sendmsg+0x54e/0x850 [ 261.716338][T11143] ? __pfx_____sys_sendmsg+0x10/0x10 [ 261.716374][T11143] ? import_iovec+0x73/0xa0 [ 261.716397][T11143] ___sys_sendmsg+0x2a5/0x360 [ 261.716421][T11143] ? __lock_acquire+0x683/0x2cf0 [ 261.716449][T11143] ? __pfx____sys_sendmsg+0x10/0x10 [ 261.716645][T11143] ? __fget_files+0x2a/0x420 [ 261.716685][T11143] ? __fget_files+0x3a2/0x420 [ 261.716715][T11143] __x64_sys_sendmsg+0x1b1/0x290 [ 261.716748][T11143] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 261.716793][T11143] do_syscall_64+0x166/0x520 [ 261.716812][T11143] ? trace_irq_disable+0x3b/0x140 [ 261.716835][T11143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.716851][T11143] ? clear_bhb_loop+0x70/0xc0 [ 261.716872][T11143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 261.716890][T11143] RIP: 0033:0x7fb1c0b9e0d9 [ 261.716908][T11143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 261.716924][T11143] RSP: 002b:00007fb1c1b2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 261.716943][T11143] RAX: ffffffffffffffda RBX: 00007fb1c0e25fa0 RCX: 00007fb1c0b9e0d9 [ 261.716955][T11143] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 261.716965][T11143] RBP: 00007fb1c1b2d090 R08: 0000000000000000 R09: 0000000000000000 [ 261.716976][T11143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 261.716985][T11143] R13: 00007fb1c0e26038 R14: 00007fb1c0e25fa0 R15: 00007ffec253c0b8 [ 261.717017][T11143] [ 262.255710][T11149] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 262.809663][T11180] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 262.966825][T11187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1692'. [ 263.153295][T11189] netlink: 'syz.4.1693': attribute type 21 has an invalid length. [ 263.169289][T11189] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1693'. [ 263.544699][T11201] FAULT_INJECTION: forcing a failure. [ 263.544699][T11201] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 263.615373][T11201] CPU: 1 UID: 0 PID: 11201 Comm: syz.4.1699 Not tainted syzkaller #0 PREEMPT(full) [ 263.615401][T11201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 263.615412][T11201] Call Trace: [ 263.615420][T11201] [ 263.615428][T11201] dump_stack_lvl+0xe8/0x150 [ 263.615460][T11201] should_fail_ex+0x410/0x560 [ 263.615493][T11201] _copy_from_user+0x2d/0xb0 [ 263.615514][T11201] ___sys_recvmsg+0x173/0x5a0 [ 263.615549][T11201] ? __pfx____sys_recvmsg+0x10/0x10 [ 263.615583][T11201] ? __fget_files+0x2a/0x420 [ 263.615638][T11201] do_recvmmsg+0x31a/0x7f0 [ 263.615663][T11201] ? __pfx_do_recvmmsg+0x10/0x10 [ 263.615704][T11201] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 263.615727][T11201] ? __fget_files+0x3a2/0x420 [ 263.615763][T11201] __x64_sys_recvmmsg+0x198/0x250 [ 263.615783][T11201] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 263.615813][T11201] do_syscall_64+0x166/0x520 [ 263.615834][T11201] ? trace_irq_disable+0x3b/0x140 [ 263.615860][T11201] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.615882][T11201] ? clear_bhb_loop+0x70/0xc0 [ 263.615905][T11201] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.615924][T11201] RIP: 0033:0x7fb1c0b9e0d9 [ 263.615941][T11201] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 263.615959][T11201] RSP: 002b:00007fb1c1b2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 263.615979][T11201] RAX: ffffffffffffffda RBX: 00007fb1c0e25fa0 RCX: 00007fb1c0b9e0d9 [ 263.615993][T11201] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 263.616004][T11201] RBP: 00007fb1c1b2d090 R08: 0000000000000000 R09: 0000000000000000 [ 263.616016][T11201] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 263.616027][T11201] R13: 00007fb1c0e26038 R14: 00007fb1c0e25fa0 R15: 00007ffec253c0b8 [ 263.616058][T11201] [ 264.020614][T11211] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1703'. [ 264.333264][T11226] xt_l2tp: v2 tid > 0xffff: 37482740 [ 264.445622][T11205] veth5: entered promiscuous mode [ 264.490107][T11205] veth5: entered allmulticast mode [ 264.643112][ T8999] gretap7: left promiscuous mode [ 264.705774][T11231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1708'. [ 264.731762][T11231] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1708'. [ 264.738698][T11239] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1711'. [ 264.755623][T11231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1708'. [ 265.098088][T11256] FAULT_INJECTION: forcing a failure. [ 265.098088][T11256] name failslab, interval 1, probability 0, space 0, times 0 [ 265.132903][T11256] CPU: 0 UID: 0 PID: 11256 Comm: syz.1.1715 Not tainted syzkaller #0 PREEMPT(full) [ 265.132927][T11256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 265.132937][T11256] Call Trace: [ 265.132942][T11256] [ 265.132949][T11256] dump_stack_lvl+0xe8/0x150 [ 265.132981][T11256] should_fail_ex+0x410/0x560 [ 265.133017][T11256] should_failslab+0xa8/0x100 [ 265.133044][T11256] __kmalloc_cache_noprof+0xa8/0x660 [ 265.133067][T11256] ? dev_ethtool+0x13f/0x29c0 [ 265.133088][T11256] ? dev_ethtool+0x13f/0x29c0 [ 265.133115][T11256] dev_ethtool+0x13f/0x29c0 [ 265.133136][T11256] ? __lock_acquire+0x683/0x2cf0 [ 265.133173][T11256] ? __pfx_dev_ethtool+0x10/0x10 [ 265.133192][T11256] ? inet_ioctl+0x484/0x560 [ 265.133216][T11256] ? dev_load+0x21/0x1f0 [ 265.133246][T11256] ? dev_load+0x21/0x1f0 [ 265.133271][T11256] ? dev_load+0x21/0x1f0 [ 265.133295][T11256] dev_ioctl+0x392/0x1150 [ 265.133324][T11256] sock_do_ioctl+0x23e/0x320 [ 265.133348][T11256] ? __pfx_sock_do_ioctl+0x10/0x10 [ 265.133367][T11256] ? hook_file_ioctl+0x1f0/0x5f0 [ 265.133407][T11256] sock_ioctl+0x57a/0x7e0 [ 265.133427][T11256] ? __pfx_sock_ioctl+0x10/0x10 [ 265.133446][T11256] ? __fget_files+0x2a/0x420 [ 265.133470][T11256] ? __fget_files+0x3a2/0x420 [ 265.133492][T11256] ? __fget_files+0x2a/0x420 [ 265.133519][T11256] ? bpf_lsm_file_ioctl+0x9/0x20 [ 265.133539][T11256] ? __pfx_sock_ioctl+0x10/0x10 [ 265.133575][T11256] __se_sys_ioctl+0xfc/0x170 [ 265.133599][T11256] do_syscall_64+0x166/0x520 [ 265.133619][T11256] ? trace_irq_disable+0x3b/0x140 [ 265.133643][T11256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.133661][T11256] ? clear_bhb_loop+0x70/0xc0 [ 265.133684][T11256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.133702][T11256] RIP: 0033:0x7f3df319e0d9 [ 265.133719][T11256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.133735][T11256] RSP: 002b:00007f3df4037028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 265.133755][T11256] RAX: ffffffffffffffda RBX: 00007f3df3425fa0 RCX: 00007f3df319e0d9 [ 265.133769][T11256] RDX: 00002000000001c0 RSI: 0000000000008946 RDI: 0000000000000003 [ 265.133782][T11256] RBP: 00007f3df4037090 R08: 0000000000000000 R09: 0000000000000000 [ 265.133793][T11256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 265.133804][T11256] R13: 00007f3df3426038 R14: 00007f3df3425fa0 R15: 00007ffe48268338 [ 265.133833][T11256] [ 265.151288][T11258] gretap5: entered promiscuous mode [ 266.074222][T11289] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1724'. [ 266.089044][T11288] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1723'. [ 266.525075][T11302] netlink: 'syz.4.1728': attribute type 24 has an invalid length. [ 266.628912][T11312] 8021q: adding VLAN 0 to HW filter on device bond11 [ 266.722359][T11312] dummy0: left promiscuous mode [ 266.757530][T11312] bond11: (slave dummy0): Enslaving as an active interface with an up link [ 266.789595][T11316] netlink: 'syz.2.1732': attribute type 10 has an invalid length. [ 266.848200][T11316] __nla_validate_parse: 4 callbacks suppressed [ 266.848219][T11316] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1732'. [ 266.942254][T11316] dummy0: entered promiscuous mode [ 267.017222][T11316] bond11: (slave dummy0): Releasing backup interface [ 267.343252][T11325] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1735'. [ 267.384537][T11325] nbd: must specify a device to reconfigure [ 267.390603][T11326] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1735'. [ 267.433920][T11326] nbd: must specify a device to reconfigure [ 267.715243][T11335] xt_hashlimit: size too large, truncated to 1048576 [ 267.901288][T11347] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1742'. [ 267.955730][T11347] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1742'. [ 268.017663][T11353] FAULT_INJECTION: forcing a failure. [ 268.017663][T11353] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.040518][T11347] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1742'. [ 268.093029][T11353] CPU: 1 UID: 0 PID: 11353 Comm: syz.2.1743 Not tainted syzkaller #0 PREEMPT(full) [ 268.093056][T11353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 268.093067][T11353] Call Trace: [ 268.093075][T11353] [ 268.093083][T11353] dump_stack_lvl+0xe8/0x150 [ 268.093115][T11353] should_fail_ex+0x410/0x560 [ 268.093149][T11353] _copy_from_iter+0x1d3/0x1660 [ 268.093176][T11353] ? kmem_cache_alloc_node_noprof+0x1c1/0x620 [ 268.093200][T11353] ? rcu_is_watching+0x16/0xb0 [ 268.093215][T11353] ? trace_kmem_cache_alloc+0x29/0xe0 [ 268.093237][T11353] ? kmem_cache_alloc_node_noprof+0x3bc/0x620 [ 268.093259][T11353] ? __pfx__copy_from_iter+0x10/0x10 [ 268.093286][T11353] ? __alloc_skb+0x27a/0x7a0 [ 268.093310][T11353] ? __alloc_skb+0x27a/0x7a0 [ 268.093340][T11353] ? netlink_sendmsg+0x650/0xb40 [ 268.093358][T11353] ? skb_put+0x112/0x210 [ 268.093387][T11353] netlink_sendmsg+0x6c0/0xb40 [ 268.093416][T11353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 268.093439][T11353] ? aa_sock_msg_perm+0xf6/0x1c0 [ 268.093474][T11353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 268.093492][T11353] sock_sendmsg_nosec+0x13a/0x180 [ 268.093517][T11353] ____sys_sendmsg+0x54e/0x850 [ 268.093552][T11353] ? __pfx_____sys_sendmsg+0x10/0x10 [ 268.093588][T11353] ? import_iovec+0x73/0xa0 [ 268.093611][T11353] ___sys_sendmsg+0x2a5/0x360 [ 268.093637][T11353] ? __lock_acquire+0x683/0x2cf0 [ 268.093669][T11353] ? __pfx____sys_sendmsg+0x10/0x10 [ 268.093737][T11353] ? __fget_files+0x2a/0x420 [ 268.093760][T11353] ? __fget_files+0x3a2/0x420 [ 268.093794][T11353] __x64_sys_sendmsg+0x1b1/0x290 [ 268.093825][T11353] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 268.093875][T11353] do_syscall_64+0x166/0x520 [ 268.093896][T11353] ? trace_irq_disable+0x3b/0x140 [ 268.093920][T11353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.093940][T11353] ? clear_bhb_loop+0x70/0xc0 [ 268.093964][T11353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.093982][T11353] RIP: 0033:0x7fbb5d99e0d9 [ 268.094001][T11353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.094017][T11353] RSP: 002b:00007fbb5e81c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 268.094038][T11353] RAX: ffffffffffffffda RBX: 00007fbb5dc26090 RCX: 00007fbb5d99e0d9 [ 268.094053][T11353] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000004 [ 268.094065][T11353] RBP: 00007fbb5e81c090 R08: 0000000000000000 R09: 0000000000000000 [ 268.094078][T11353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 268.094089][T11353] R13: 00007fbb5dc26128 R14: 00007fbb5dc26090 R15: 00007fff8a598e98 [ 268.094120][T11353] [ 268.987597][T11379] FAULT_INJECTION: forcing a failure. [ 268.987597][T11379] name failslab, interval 1, probability 0, space 0, times 0 [ 269.013819][T11379] CPU: 1 UID: 0 PID: 11379 Comm: syz.4.1752 Not tainted syzkaller #0 PREEMPT(full) [ 269.013843][T11379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 269.013852][T11379] Call Trace: [ 269.013859][T11379] [ 269.013865][T11379] dump_stack_lvl+0xe8/0x150 [ 269.013892][T11379] should_fail_ex+0x410/0x560 [ 269.013916][T11379] should_failslab+0xa8/0x100 [ 269.013937][T11379] __kmalloc_cache_noprof+0xa8/0x660 [ 269.013959][T11379] ? rtnl_newlink+0x143/0x1c30 [ 269.013978][T11379] ? rtnl_newlink+0x143/0x1c30 [ 269.014005][T11379] rtnl_newlink+0x143/0x1c30 [ 269.014038][T11379] ? __pfx_rtnl_newlink+0x10/0x10 [ 269.014058][T11379] ? __lock_acquire+0x683/0x2cf0 [ 269.014086][T11379] ? __lock_acquire+0x683/0x2cf0 [ 269.014107][T11379] ? __lock_acquire+0x683/0x2cf0 [ 269.014134][T11379] ? unwind_next_frame+0x8f/0x2550 [ 269.014155][T11379] ? is_bpf_text_address+0x26/0x2b0 [ 269.014195][T11379] ? is_bpf_text_address+0x26/0x2b0 [ 269.014223][T11379] ? __lock_acquire+0x683/0x2cf0 [ 269.014247][T11379] ? kernel_text_address+0xa5/0xe0 [ 269.014263][T11379] ? __kernel_text_address+0xd/0x30 [ 269.014276][T11379] ? unwind_get_return_address+0x4d/0x90 [ 269.014291][T11379] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 269.014312][T11379] ? arch_stack_walk+0xfb/0x150 [ 269.014337][T11379] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 269.014361][T11379] ? __pfx_rtnl_newlink+0x10/0x10 [ 269.014394][T11379] ? __pfx_rtnl_newlink+0x10/0x10 [ 269.014417][T11379] rtnetlink_rcv_msg+0x802/0xc00 [ 269.014439][T11379] ? netlink_sendmsg+0x5d4/0xb40 [ 269.014460][T11379] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 269.014484][T11379] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 269.014510][T11379] ? __lock_acquire+0x683/0x2cf0 [ 269.014555][T11379] netlink_rcv_skb+0x226/0x4a0 [ 269.014575][T11379] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 269.014602][T11379] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 269.014634][T11379] ? netlink_deliver_tap+0x2e/0x1b0 [ 269.014652][T11379] ? netlink_deliver_tap+0x2e/0x1b0 [ 269.014675][T11379] netlink_unicast+0x7bd/0x940 [ 269.014713][T11379] netlink_sendmsg+0x813/0xb40 [ 269.014742][T11379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 269.014764][T11379] ? aa_sock_msg_perm+0xf6/0x1c0 [ 269.014800][T11379] ? __pfx_netlink_sendmsg+0x10/0x10 [ 269.014818][T11379] sock_sendmsg_nosec+0x13a/0x180 [ 269.014844][T11379] ____sys_sendmsg+0x54e/0x850 [ 269.014878][T11379] ? __pfx_____sys_sendmsg+0x10/0x10 [ 269.014914][T11379] ? import_iovec+0x73/0xa0 [ 269.014936][T11379] ___sys_sendmsg+0x2a5/0x360 [ 269.014958][T11379] ? __lock_acquire+0x683/0x2cf0 [ 269.014982][T11379] ? __pfx____sys_sendmsg+0x10/0x10 [ 269.015043][T11379] ? __fget_files+0x2a/0x420 [ 269.015067][T11379] ? __fget_files+0x3a2/0x420 [ 269.015102][T11379] __x64_sys_sendmsg+0x1b1/0x290 [ 269.015133][T11379] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 269.015189][T11379] do_syscall_64+0x166/0x520 [ 269.015213][T11379] ? trace_irq_disable+0x3b/0x140 [ 269.015237][T11379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.015257][T11379] ? clear_bhb_loop+0x70/0xc0 [ 269.015280][T11379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.015299][T11379] RIP: 0033:0x7fb1c0b9e0d9 [ 269.015318][T11379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 269.015335][T11379] RSP: 002b:00007fb1c1b2d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 269.015355][T11379] RAX: ffffffffffffffda RBX: 00007fb1c0e25fa0 RCX: 00007fb1c0b9e0d9 [ 269.015368][T11379] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 269.015378][T11379] RBP: 00007fb1c1b2d090 R08: 0000000000000000 R09: 0000000000000000 [ 269.015390][T11379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 269.015401][T11379] R13: 00007fb1c0e26038 R14: 00007fb1c0e25fa0 R15: 00007ffec253c0b8 [ 269.015430][T11379] [ 269.741777][T11389] ip_tables: iptables: counters copy to user failed while replacing table [ 269.823955][T11389] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1754'. [ 269.950743][T11391] ip6t_srh: unknown srh invflags BA61 [ 270.200797][T11404] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1761'. [ 270.264413][T11404] FAULT_INJECTION: forcing a failure. [ 270.264413][T11404] name failslab, interval 1, probability 0, space 0, times 0 [ 270.277266][T11404] CPU: 0 UID: 0 PID: 11404 Comm: syz.0.1761 Not tainted syzkaller #0 PREEMPT(full) [ 270.277290][T11404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 270.277299][T11404] Call Trace: [ 270.277306][T11404] [ 270.277312][T11404] dump_stack_lvl+0xe8/0x150 [ 270.277339][T11404] should_fail_ex+0x410/0x560 [ 270.277366][T11404] should_failslab+0xa8/0x100 [ 270.277390][T11404] kmem_cache_alloc_bulk_noprof+0x8b/0x7b0 [ 270.277416][T11404] ? pfn_valid+0x125/0x4c0 [ 270.277435][T11404] ? pfn_valid+0x125/0x4c0 [ 270.277454][T11404] ? pfn_valid+0x125/0x4c0 [ 270.277475][T11404] bpf_test_run_xdp_live+0x16e9/0x1c20 [ 270.277504][T11404] ? bpf_test_run_xdp_live+0x43e/0x1c20 [ 270.277533][T11404] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 270.277553][T11404] ? 0xffffffffa0404480 [ 270.277612][T11404] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 270.277638][T11404] ? _copy_from_user+0x94/0xb0 [ 270.277657][T11404] ? bpf_test_init+0x113/0x150 [ 270.277679][T11404] ? xdp_convert_md_to_buff+0x5b/0x330 [ 270.277699][T11404] bpf_prog_test_run_xdp+0x7d8/0x11d0 [ 270.277733][T11404] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 270.277757][T11404] ? __fget_files+0x2a/0x420 [ 270.277786][T11404] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 270.277807][T11404] bpf_prog_test_run+0x2c5/0x340 [ 270.277840][T11404] __sys_bpf+0xa22/0xd90 [ 270.277875][T11404] ? __pfx___sys_bpf+0x10/0x10 [ 270.277913][T11404] ? __fget_files+0x2a/0x420 [ 270.277955][T11404] ? ksys_write+0x242/0x270 [ 270.277984][T11404] ? __pfx_ksys_write+0x10/0x10 [ 270.278017][T11404] __x64_sys_bpf+0xba/0xd0 [ 270.278044][T11404] do_syscall_64+0x166/0x520 [ 270.278074][T11404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.278093][T11404] ? clear_bhb_loop+0x70/0xc0 [ 270.278116][T11404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 270.278134][T11404] RIP: 0033:0x7f949799e0d9 [ 270.278152][T11404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.278168][T11404] RSP: 002b:00007f9498868028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 270.278189][T11404] RAX: ffffffffffffffda RBX: 00007f9497c25fa0 RCX: 00007f949799e0d9 [ 270.278203][T11404] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 270.278215][T11404] RBP: 00007f9498868090 R08: 0000000000000000 R09: 0000000000000000 [ 270.278227][T11404] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 270.278238][T11404] R13: 00007f9497c26038 R14: 00007f9497c25fa0 R15: 00007ffd7fef7958 [ 270.278270][T11404] [ 270.304414][T11409] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1763'. [ 271.004232][T11433] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1770'. [ 271.063442][T11427] block nbd0: server does not support multiple connections per device. [ 271.097832][T11427] block nbd0: shutting down sockets [ 271.355378][T11446] ip_tables: iptables: counters copy to user failed while replacing table [ 271.528002][T11447] ip6t_srh: unknown srh invflags BA61 [ 272.108325][T11468] netlink: 'syz.0.1780': attribute type 3 has an invalid length. [ 272.318140][T11474] __nla_validate_parse: 2 callbacks suppressed [ 272.318158][T11474] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1781'. [ 272.954141][T11504] ip_tables: iptables: counters copy to user failed while replacing table [ 273.003002][T11504] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1789'. [ 273.105890][T11509] ip6t_srh: unknown srh invflags BA61 [ 274.102727][T11538] block nbd0: server does not support multiple connections per device. [ 274.132775][T11538] block nbd0: shutting down sockets [ 274.199038][T11546] FAULT_INJECTION: forcing a failure. [ 274.199038][T11546] name failslab, interval 1, probability 0, space 0, times 0 [ 274.234129][T11546] CPU: 0 UID: 0 PID: 11546 Comm: syz.3.1802 Not tainted syzkaller #0 PREEMPT(full) [ 274.234156][T11546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 274.234168][T11546] Call Trace: [ 274.234174][T11546] [ 274.234183][T11546] dump_stack_lvl+0xe8/0x150 [ 274.234222][T11546] should_fail_ex+0x410/0x560 [ 274.234254][T11546] should_failslab+0xa8/0x100 [ 274.234282][T11546] __kmalloc_noprof+0xfe/0x720 [ 274.234306][T11546] ? sock_kmalloc+0xd6/0x160 [ 274.234323][T11546] ? sock_kmalloc+0xd6/0x160 [ 274.234346][T11546] sock_kmalloc+0xd6/0x160 [ 274.234365][T11546] hash_recvmsg+0x1d0/0x860 [ 274.234394][T11546] ? __pfx_hash_recvmsg+0x10/0x10 [ 274.234421][T11546] sock_recvmsg_nosec+0x130/0x170 [ 274.234447][T11546] ____sys_recvmsg+0x3e3/0x4a0 [ 274.234485][T11546] ? __pfx_____sys_recvmsg+0x10/0x10 [ 274.234530][T11546] ? import_iovec+0x73/0xa0 [ 274.234552][T11546] ___sys_recvmsg+0x213/0x5a0 [ 274.234587][T11546] ? __pfx____sys_recvmsg+0x10/0x10 [ 274.234618][T11546] ? __fget_files+0x2a/0x420 [ 274.234671][T11546] do_recvmmsg+0x31a/0x7f0 [ 274.234698][T11546] ? __pfx_do_recvmmsg+0x10/0x10 [ 274.234738][T11546] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 274.234763][T11546] ? __fget_files+0x3a2/0x420 [ 274.234798][T11546] __x64_sys_recvmmsg+0x198/0x250 [ 274.234818][T11546] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 274.234846][T11546] do_syscall_64+0x166/0x520 [ 274.234866][T11546] ? trace_irq_disable+0x3b/0x140 [ 274.234891][T11546] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.234910][T11546] ? clear_bhb_loop+0x70/0xc0 [ 274.234933][T11546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.234952][T11546] RIP: 0033:0x7f719759e0d9 [ 274.234970][T11546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.234989][T11546] RSP: 002b:00007f7198552028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 274.235010][T11546] RAX: ffffffffffffffda RBX: 00007f7197825fa0 RCX: 00007f719759e0d9 [ 274.235024][T11546] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 274.235035][T11546] RBP: 00007f7198552090 R08: 0000000000000000 R09: 0000000000000000 [ 274.235047][T11546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 274.235058][T11546] R13: 00007f7197826038 R14: 00007f7197825fa0 R15: 00007ffcd29c4b48 [ 274.235089][T11546] [ 274.701417][T11551] openvswitch: netlink: Missing key (keys=c0, expected=20100) [ 274.733386][T11543] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1801'. [ 274.842850][T11557] ip_tables: iptables: counters copy to user failed while replacing table [ 274.878474][T11557] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1804'. [ 274.978633][T11557] ip6t_srh: unknown srh invflags BA61 [ 275.185504][T11565] block nbd0: server does not support multiple connections per device. [ 275.220163][T11565] block nbd0: shutting down sockets [ 275.308410][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1809'. [ 275.323917][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1809'. [ 275.348136][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1809'. [ 275.358128][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1809'. [ 275.421935][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1809'. [ 275.485635][T11570] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1809'. [ 275.779472][T11576] pimreg: entered allmulticast mode [ 275.832581][ T9002] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 275.866492][ T9002] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 275.895651][ T9002] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 275.926518][ T9002] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 276.071098][T11594] xt_hashlimit: size too large, truncated to 1048576 [ 276.496114][T11619] v: renamed from veth0_vlan [ 276.500492][ T9002] IPVS: starting estimator thread 0... [ 276.623436][T11621] IPVS: using max 32 ests per chain, 76800 per kthread [ 276.752054][T11626] bridge3: port 1(veth5) entered blocking state [ 276.776035][T11626] bridge3: port 1(veth5) entered disabled state [ 276.803107][T11626] veth5: entered allmulticast mode [ 276.824290][T11626] veth5: entered promiscuous mode [ 276.988080][T11628] bridge3: port 2(veth7) entered blocking state [ 276.998152][T11628] bridge3: port 2(veth7) entered disabled state [ 277.015081][T11628] veth7: entered allmulticast mode [ 277.035571][T11628] veth7: entered promiscuous mode [ 277.680856][T11664] netlink: 'syz.3.1836': attribute type 11 has an invalid length. [ 277.741681][T11664] 8021q: adding VLAN 0 to HW filter on device bond0 [ 277.750467][T11664] 8021q: adding VLAN 0 to HW filter on device team0 [ 277.766627][T11664] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 277.818961][T11664] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 277.844876][T11664] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 277.888826][T11664] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 277.907044][T11664] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 277.927059][T11664] veth1_vlan: left promiscuous mode [ 277.943333][T11664] veth1_vlan: entered promiscuous mode [ 278.001832][T11664] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 278.020995][T11664] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 278.030871][T11664] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 278.040747][T11664] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 278.053904][T11664] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 278.063780][T11664] 8021q: adding VLAN 0 to HW filter on device bond1 [ 278.072097][T11664] 8021q: adding VLAN 0 to HW filter on device bond2 [ 278.080341][T11664] 8021q: adding VLAN 0 to HW filter on device bond3 [ 278.130925][T11664] 8021q: adding VLAN 0 to HW filter on device bond4 [ 278.157700][T11664] 8021q: adding VLAN 0 to HW filter on device bond5 [ 278.167376][T11664] 8021q: adding VLAN 0 to HW filter on device bond6 [ 278.180820][T11664] 8021q: adding VLAN 0 to HW filter on device bond7 [ 278.196762][T11664] 8021q: adding VLAN 0 to HW filter on device bond8 [ 278.226974][T11664] 8021q: adding VLAN 0 to HW filter on device bond9 [ 278.240652][T11664] A link change request failed with some changes committed already. Interface veth1_to_bod may have been left with an inconsistent configuration, please check. [ 278.259951][ T5800] bond_slave_0: entered promiscuous mode [ 278.265709][ T5800] bond_slave_1: entered promiscuous mode [ 278.329010][ T8999] bridge0: port 1(bridge_slave_0) entered blocking state [ 278.336280][ T8999] bridge0: port 1(bridge_slave_0) entered forwarding state [ 278.353646][ T8999] bridge0: port 2(bridge_slave_1) entered blocking state [ 278.360853][ T8999] bridge0: port 2(bridge_slave_1) entered forwarding state [ 278.409118][ T8999] bridge0: port 3(team0) entered blocking state [ 278.415862][ T8999] bridge0: port 3(team0) entered forwarding state [ 278.430892][T11670] batadv_slave_1: entered promiscuous mode [ 278.538425][T11683] __nla_validate_parse: 221 callbacks suppressed [ 278.538445][T11683] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1841'. [ 278.585308][T11672] batadv_slave_1: left promiscuous mode [ 278.664127][ T9005] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 278.674236][ T9005] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.710667][ T9005] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 278.746603][ T9005] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.754462][T11693] openvswitch: netlink: Message has 13052 unknown bytes. [ 278.789022][ T9003] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 278.808311][T11693] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 278.820826][ T9003] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 278.841707][ T9003] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 278.863156][ T9003] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 279.232007][T11709] xt_hashlimit: size too large, truncated to 1048576 [ 279.256032][T11714] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1851'. [ 279.301760][T11714] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1851'. [ 279.353823][T11714] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1851'. [ 279.693815][T11731] FAULT_INJECTION: forcing a failure. [ 279.693815][T11731] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 279.756328][T11731] CPU: 0 UID: 0 PID: 11731 Comm: syz.0.1854 Not tainted syzkaller #0 PREEMPT(full) [ 279.756355][T11731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 279.756366][T11731] Call Trace: [ 279.756374][T11731] [ 279.756381][T11731] dump_stack_lvl+0xe8/0x150 [ 279.756412][T11731] should_fail_ex+0x410/0x560 [ 279.756445][T11731] _copy_from_iter+0x1d3/0x1660 [ 279.756471][T11731] ? kmem_cache_alloc_node_noprof+0x1c1/0x620 [ 279.756494][T11731] ? rcu_is_watching+0x16/0xb0 [ 279.756514][T11731] ? trace_kmem_cache_alloc+0x29/0xe0 [ 279.756536][T11731] ? kmem_cache_alloc_node_noprof+0x3bc/0x620 [ 279.756558][T11731] ? __pfx__copy_from_iter+0x10/0x10 [ 279.756585][T11731] ? __alloc_skb+0x27a/0x7a0 [ 279.756609][T11731] ? __alloc_skb+0x27a/0x7a0 [ 279.756638][T11731] ? netlink_sendmsg+0x650/0xb40 [ 279.756658][T11731] ? skb_put+0x112/0x210 [ 279.756686][T11731] netlink_sendmsg+0x6c0/0xb40 [ 279.756722][T11731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 279.756745][T11731] ? aa_sock_msg_perm+0xf6/0x1c0 [ 279.756780][T11731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 279.756799][T11731] sock_sendmsg_nosec+0x13a/0x180 [ 279.756824][T11731] ____sys_sendmsg+0x54e/0x850 [ 279.756857][T11731] ? __pfx_____sys_sendmsg+0x10/0x10 [ 279.756894][T11731] ? import_iovec+0x73/0xa0 [ 279.756917][T11731] ___sys_sendmsg+0x2a5/0x360 [ 279.756944][T11731] ? __lock_acquire+0x683/0x2cf0 [ 279.756974][T11731] ? __pfx____sys_sendmsg+0x10/0x10 [ 279.757033][T11731] ? __fget_files+0x2a/0x420 [ 279.757056][T11731] ? __fget_files+0x3a2/0x420 [ 279.757092][T11731] __x64_sys_sendmsg+0x1b1/0x290 [ 279.757123][T11731] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 279.757171][T11731] do_syscall_64+0x166/0x520 [ 279.757192][T11731] ? trace_irq_disable+0x3b/0x140 [ 279.757216][T11731] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.757236][T11731] ? clear_bhb_loop+0x70/0xc0 [ 279.757259][T11731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.757278][T11731] RIP: 0033:0x7f949799e0d9 [ 279.757296][T11731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.757312][T11731] RSP: 002b:00007f9498868028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 279.757332][T11731] RAX: ffffffffffffffda RBX: 00007f9497c25fa0 RCX: 00007f949799e0d9 [ 279.757346][T11731] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000003 [ 279.757362][T11731] RBP: 00007f9498868090 R08: 0000000000000000 R09: 0000000000000000 [ 279.757374][T11731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 279.757385][T11731] R13: 00007f9497c26038 R14: 00007f9497c25fa0 R15: 00007ffd7fef7958 [ 279.757417][T11731] [ 280.075076][T11739] netlink: 'syz.1.1857': attribute type 15 has an invalid length. [ 280.350663][T11747] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1860'. [ 280.407421][T11741] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1858'. [ 280.600805][T11759] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1863'. [ 281.026141][T11768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1867'. [ 281.047013][T11768] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1867'. [ 281.061371][T11768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1867'. [ 281.542193][T11794] syzkaller0: entered promiscuous mode [ 281.555623][T11794] syzkaller0: entered allmulticast mode [ 281.716559][T11805] FAULT_INJECTION: forcing a failure. [ 281.716559][T11805] name failslab, interval 1, probability 0, space 0, times 0 [ 281.745511][T11805] CPU: 1 UID: 0 PID: 11805 Comm: syz.3.1880 Not tainted syzkaller #0 PREEMPT(full) [ 281.745537][T11805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 281.745556][T11805] Call Trace: [ 281.745564][T11805] [ 281.745572][T11805] dump_stack_lvl+0xe8/0x150 [ 281.745610][T11805] should_fail_ex+0x410/0x560 [ 281.745640][T11805] ? __rhashtable_init_noprof+0x545/0xaf0 [ 281.745668][T11805] should_failslab+0xa8/0x100 [ 281.745693][T11805] __kvmalloc_node_noprof+0x176/0x870 [ 281.745724][T11805] ? __rhashtable_init_noprof+0x545/0xaf0 [ 281.745757][T11805] __rhashtable_init_noprof+0x545/0xaf0 [ 281.745786][T11805] __rhltable_init_noprof+0x26/0x70 [ 281.745814][T11805] nf_tables_newtable+0x6a7/0x1990 [ 281.745860][T11805] nfnetlink_rcv+0x1288/0x28c0 [ 281.745923][T11805] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 281.745967][T11805] ? ref_tracker_free+0x689/0x830 [ 281.746014][T11805] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 281.746035][T11805] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90 [ 281.746081][T11805] netlink_unicast+0x7bd/0x940 [ 281.746119][T11805] netlink_sendmsg+0x813/0xb40 [ 281.746149][T11805] ? __pfx_netlink_sendmsg+0x10/0x10 [ 281.746172][T11805] ? aa_sock_msg_perm+0xf6/0x1c0 [ 281.746208][T11805] ? __pfx_netlink_sendmsg+0x10/0x10 [ 281.746227][T11805] sock_sendmsg_nosec+0x13a/0x180 [ 281.746253][T11805] ____sys_sendmsg+0x54e/0x850 [ 281.746288][T11805] ? __pfx_____sys_sendmsg+0x10/0x10 [ 281.746323][T11805] ? import_iovec+0x73/0xa0 [ 281.746345][T11805] ___sys_sendmsg+0x2a5/0x360 [ 281.746372][T11805] ? __lock_acquire+0x683/0x2cf0 [ 281.746403][T11805] ? __pfx____sys_sendmsg+0x10/0x10 [ 281.746465][T11805] ? __fget_files+0x2a/0x420 [ 281.746490][T11805] ? __fget_files+0x3a2/0x420 [ 281.746526][T11805] __x64_sys_sendmsg+0x1b1/0x290 [ 281.746565][T11805] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 281.746615][T11805] do_syscall_64+0x166/0x520 [ 281.746636][T11805] ? trace_irq_disable+0x3b/0x140 [ 281.746660][T11805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.746680][T11805] ? clear_bhb_loop+0x70/0xc0 [ 281.746703][T11805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.746722][T11805] RIP: 0033:0x7f719759e0d9 [ 281.746740][T11805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 281.746757][T11805] RSP: 002b:00007f7198552028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 281.746777][T11805] RAX: ffffffffffffffda RBX: 00007f7197825fa0 RCX: 00007f719759e0d9 [ 281.746791][T11805] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 281.746803][T11805] RBP: 00007f7198552090 R08: 0000000000000000 R09: 0000000000000000 [ 281.746815][T11805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.746827][T11805] R13: 00007f7197826038 R14: 00007f7197825fa0 R15: 00007ffcd29c4b48 [ 281.746859][T11805] [ 282.553287][T11824] netlink: 'syz.1.1885': attribute type 32 has an invalid length. [ 282.585670][T11824] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 282.618683][T11829] openvswitch: netlink: Message has 12852 unknown bytes. [ 282.638712][T11829] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 283.120142][T11841] block nbd0: server does not support multiple connections per device. [ 283.152866][T11841] block nbd0: shutting down sockets [ 283.515790][T11860] netlink: 'syz.0.1898': attribute type 11 has an invalid length. [ 283.592060][T11863] netlink: 'syz.4.1899': attribute type 11 has an invalid length. [ 284.045713][T11877] __nla_validate_parse: 6 callbacks suppressed [ 284.045731][T11877] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1904'. [ 284.105152][T11881] C: renamed from veth1_to_team [ 284.135971][T11881] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1905'. [ 284.165683][T11883] FAULT_INJECTION: forcing a failure. [ 284.165683][T11883] name failslab, interval 1, probability 0, space 0, times 0 [ 284.219046][T11881] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1905'. [ 284.265971][T11883] CPU: 1 UID: 0 PID: 11883 Comm: syz.4.1903 Not tainted syzkaller #0 PREEMPT(full) [ 284.265998][T11883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 284.266009][T11883] Call Trace: [ 284.266016][T11883] [ 284.266024][T11883] dump_stack_lvl+0xe8/0x150 [ 284.266056][T11883] should_fail_ex+0x410/0x560 [ 284.266090][T11883] should_failslab+0xa8/0x100 [ 284.266117][T11883] __kmalloc_noprof+0xfe/0x720 [ 284.266140][T11883] ? sock_kmalloc+0xd6/0x160 [ 284.266156][T11883] ? sock_kmalloc+0xd6/0x160 [ 284.266180][T11883] sock_kmalloc+0xd6/0x160 [ 284.266201][T11883] ____sys_sendmsg+0x1be/0x850 [ 284.266233][T11883] ? __pfx_____sys_sendmsg+0x10/0x10 [ 284.266269][T11883] ? import_iovec+0x73/0xa0 [ 284.266291][T11883] ___sys_sendmsg+0x2a5/0x360 [ 284.266316][T11883] ? __lock_acquire+0x683/0x2cf0 [ 284.266346][T11883] ? __pfx____sys_sendmsg+0x10/0x10 [ 284.266379][T11883] ? kstrtouint+0x6e/0xe0 [ 284.266426][T11883] ? __fget_files+0x2a/0x420 [ 284.266449][T11883] ? __fget_files+0x3a2/0x420 [ 284.266487][T11883] __sys_sendmmsg+0x273/0x4d0 [ 284.266519][T11883] ? __pfx___sys_sendmmsg+0x10/0x10 [ 284.266557][T11883] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 284.266593][T11883] ? ksys_write+0x242/0x270 [ 284.266622][T11883] ? __pfx_ksys_write+0x10/0x10 [ 284.266656][T11883] __x64_sys_sendmmsg+0xa0/0xc0 [ 284.266686][T11883] do_syscall_64+0x166/0x520 [ 284.266706][T11883] ? trace_irq_disable+0x3b/0x140 [ 284.266730][T11883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.266749][T11883] ? clear_bhb_loop+0x70/0xc0 [ 284.266772][T11883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.266791][T11883] RIP: 0033:0x7fb1c0b9e0d9 [ 284.266808][T11883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 284.266832][T11883] RSP: 002b:00007fb1c1b0c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 284.266852][T11883] RAX: ffffffffffffffda RBX: 00007fb1c0e26090 RCX: 00007fb1c0b9e0d9 [ 284.266866][T11883] RDX: 0000000000000002 RSI: 0000200000000740 RDI: 000000000000000a [ 284.266878][T11883] RBP: 00007fb1c1b0c090 R08: 0000000000000000 R09: 0000000000000000 [ 284.266889][T11883] R10: 0000000004008c04 R11: 0000000000000246 R12: 0000000000000001 [ 284.266901][T11883] R13: 00007fb1c0e26128 R14: 00007fb1c0e26090 R15: 00007ffec253c0b8 [ 284.266931][T11883] [ 284.864016][T11905] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1914'. [ 284.893329][T11905] netlink: 'syz.0.1914': attribute type 26 has an invalid length. [ 284.924222][T11905] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1914'. [ 285.037117][T11905] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1914'. [ 285.114455][T11905] netlink: 'syz.0.1914': attribute type 26 has an invalid length. [ 285.165454][T11905] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1914'. [ 286.170959][T11938] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1924'. [ 286.221486][T11940] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1925'. [ 286.338505][T11946] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1925'. [ 286.735415][T11959] ip_tables: iptables: counters copy to user failed while replacing table [ 286.809571][T11961] ip6t_srh: unknown srh invflags BA61 [ 287.658642][T11987] bond13: Removing last arp target with arp_interval on [ 287.787911][T11997] ip_tables: iptables: counters copy to user failed while replacing table [ 287.877383][T12003] ip6t_srh: unknown srh invflags BA61 [ 288.714329][T12036] netlink: 'syz.0.1959': attribute type 11 has an invalid length. [ 288.906508][T12042] xt_hashlimit: size too large, truncated to 1048576 [ 289.236733][T12056] netlink: zone id is out of range [ 289.255065][T12056] netlink: zone id is out of range [ 289.271792][T12057] ip_tables: iptables: counters copy to user failed while replacing table [ 289.285876][T12056] netlink: zone id is out of range [ 289.297651][T12056] netlink: zone id is out of range [ 289.319812][T12056] netlink: zone id is out of range [ 289.342961][T12057] __nla_validate_parse: 10 callbacks suppressed [ 289.342982][T12057] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1966'. [ 289.376185][T12056] netlink: zone id is out of range [ 289.407254][T12056] netlink: zone id is out of range [ 289.444471][T12056] netlink: zone id is out of range [ 289.474750][T12069] ip6t_srh: unknown srh invflags BA61 [ 289.566650][T12068] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1968'. [ 289.665092][T12074] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1970'. [ 289.753519][T12078] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1971'. [ 290.250777][T12090] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1977'. [ 290.265254][T12100] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1980'. [ 290.481569][T12106] tipc: Enabled bearer , priority 0 [ 290.492162][T12106] syzkaller0: entered promiscuous mode [ 290.515688][T12106] syzkaller0: entered allmulticast mode [ 290.649130][T12117] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1984'. [ 290.782082][T12125] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1985'. [ 290.792890][T12124] FAULT_INJECTION: forcing a failure. [ 290.792890][T12124] name failslab, interval 1, probability 0, space 0, times 0 [ 290.805843][T12124] CPU: 1 UID: 0 PID: 12124 Comm: syz.2.1987 Not tainted syzkaller #0 PREEMPT(full) [ 290.805889][T12124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 290.805911][T12124] Call Trace: [ 290.805919][T12124] [ 290.805926][T12124] dump_stack_lvl+0xe8/0x150 [ 290.805959][T12124] should_fail_ex+0x410/0x560 [ 290.805993][T12124] should_failslab+0xa8/0x100 [ 290.806020][T12124] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 290.806041][T12124] ? skb_clone+0x212/0x3a0 [ 290.806057][T12124] ? skb_clone+0x212/0x3a0 [ 290.806078][T12124] skb_clone+0x212/0x3a0 [ 290.806099][T12124] bpf_clone_redirect+0x170/0x4b0 [ 290.806130][T12124] ? bpf_test_run+0x1d1/0x830 [ 290.806149][T12124] bpf_prog_cfa4bf6e1e03aea2+0x5f/0x68 [ 290.806184][T12124] ? __pfx___schedule+0x10/0x10 [ 290.806201][T12124] ? ktime_get+0x45/0x220 [ 290.806237][T12124] ? preempt_schedule_thunk+0x16/0x40 [ 290.806260][T12124] ? preempt_schedule_common+0x7f/0xd0 [ 290.806278][T12124] ? bpf_test_run+0x1d1/0x830 [ 290.806300][T12124] ? bpf_test_timer_continue+0x10c/0x320 [ 290.806324][T12124] bpf_test_run+0x354/0x830 [ 290.806364][T12124] ? __pfx_bpf_test_run+0x10/0x10 [ 290.806398][T12124] ? __kasan_krealloc+0xec/0x110 [ 290.806432][T12124] ? skb_dst_set+0x72/0x140 [ 290.806453][T12124] bpf_prog_test_run_skb+0xe35/0x2230 [ 290.806503][T12124] ? __fget_files+0x3a2/0x420 [ 290.806528][T12124] ? __fget_files+0x2a/0x420 [ 290.806557][T12124] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 290.806587][T12124] bpf_prog_test_run+0x2c5/0x340 [ 290.806620][T12124] __sys_bpf+0xa22/0xd90 [ 290.806655][T12124] ? __pfx___sys_bpf+0x10/0x10 [ 290.806715][T12124] ? __fget_files+0x2a/0x420 [ 290.806766][T12124] ? ksys_write+0x242/0x270 [ 290.806807][T12124] ? __pfx_ksys_write+0x10/0x10 [ 290.806842][T12124] __x64_sys_bpf+0xba/0xd0 [ 290.806902][T12124] do_syscall_64+0x166/0x520 [ 290.806921][T12124] ? trace_irq_disable+0x3b/0x140 [ 290.806945][T12124] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 290.806964][T12124] ? clear_bhb_loop+0x70/0xc0 [ 290.806988][T12124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 290.807006][T12124] RIP: 0033:0x7fbb5d99e0d9 [ 290.807024][T12124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 290.807041][T12124] RSP: 002b:00007fbb5e83d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 290.807061][T12124] RAX: ffffffffffffffda RBX: 00007fbb5dc25fa0 RCX: 00007fbb5d99e0d9 [ 290.807075][T12124] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 290.807087][T12124] RBP: 00007fbb5e83d090 R08: 0000000000000000 R09: 0000000000000000 [ 290.807099][T12124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 290.807110][T12124] R13: 00007fbb5dc26038 R14: 00007fbb5dc25fa0 R15: 00007fff8a598e98 [ 290.807139][T12124] [ 290.843401][T12126] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1986'. [ 291.122987][T12130] ip6t_srh: unknown srh invflags BA61 [ 291.301986][T12137] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1991'. [ 291.874429][T12150] bond14: up delay (7) is not a multiple of miimon (100), value rounded to 0 ms [ 291.961667][T12150] bond14: down delay (1) is not a multiple of miimon (100), value rounded to 0 ms [ 292.021345][T12150] bond14: entered allmulticast mode [ 292.367927][T12186] ip6t_srh: unknown srh invflags BA61 [ 292.689284][T12203] netlink: 'syz.4.2014': attribute type 4 has an invalid length. [ 292.728666][T12203] netlink: 'syz.4.2014': attribute type 4 has an invalid length. [ 293.833686][T12251] net_ratelimit: 1711 callbacks suppressed [ 293.833705][T12251] ip_tables: iptables: counters copy to user failed while replacing table [ 293.963133][T12251] ip6t_srh: unknown srh invflags BA61 [ 294.313254][T12261] netlink: 'syz.3.2032': attribute type 32 has an invalid length. [ 294.342458][T12261] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 294.837422][T12274] __nla_validate_parse: 9 callbacks suppressed [ 294.837450][T12274] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2037'. [ 295.062866][T12275] bond13: entered promiscuous mode [ 295.110646][T12275] bond13: entered allmulticast mode [ 295.217855][T12282] netlink: 'syz.2.2039': attribute type 1 has an invalid length. [ 295.300108][T12282] 8021q: adding VLAN 0 to HW filter on device bond12 [ 295.424470][T12285] bond12: (slave gretap6): making interface the new active one [ 295.475222][T12285] bond12: (slave gretap6): Enslaving as an active interface with an up link [ 295.530132][T12282] dummy0: left promiscuous mode [ 295.583695][T12282] bond12: (slave dummy0): Enslaving as an active interface with an up link [ 296.026270][T12302] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2046'. [ 296.289555][T12308] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2049'. [ 296.673739][T12322] batman_adv: batadv0: Adding interface: vlan2 [ 296.691720][T12322] batman_adv: batadv0: The MTU of interface vlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.812970][T12322] batman_adv: batadv0: Not using interface vlan2 (retrying later): interface not active [ 296.922157][T12330] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 298.109882][T12376] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 298.833772][T12397] openvswitch: netlink: Message has 13076 unknown bytes. [ 298.841231][T12397] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 299.150912][T12407] Bluetooth: hci0: invalid length 0, exp 1 for type 31 [ 299.491269][T12418] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2083'. [ 299.832803][T12428] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2086'. [ 299.862421][T12428] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2086'. [ 300.399380][T12436] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2090'. [ 300.635971][T12444] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2091'. [ 300.664043][T12444] netlink: 260 bytes leftover after parsing attributes in process `syz.2.2091'. [ 300.750347][T12445] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2094'. [ 300.866935][T12452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2095'. [ 301.035351][T12460] netlink: 'syz.0.2097': attribute type 1 has an invalid length. [ 301.095589][T12460] 8021q: adding VLAN 0 to HW filter on device bond14 [ 301.160714][T12464] bond14: (slave gretap9): making interface the new active one [ 301.179844][T12464] bond14: (slave gretap9): Enslaving as an active interface with an up link [ 301.208605][T12460] dummy0: left promiscuous mode [ 301.256060][T12468] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2100'. [ 301.276587][T12460] bond14: (slave dummy0): Enslaving as an active interface with an up link [ 301.613748][T12480] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2105'. [ 302.005005][T12501] netlink: 176 bytes leftover after parsing attributes in process `syz.0.2113'. [ 302.459471][T12520] Unsupported ieee802154 address type: 0 [ 302.476305][T12520] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2119'. [ 302.863144][ T9006] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.896069][ T9006] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.923205][ T9006] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 302.940336][ T9006] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 304.895125][T12608] __nla_validate_parse: 17 callbacks suppressed [ 304.895144][T12608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2150'. [ 304.942521][T12608] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2150'. [ 304.961903][T12608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2150'. [ 305.069909][T12618] FAULT_INJECTION: forcing a failure. [ 305.069909][T12618] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 305.157481][T12618] CPU: 1 UID: 0 PID: 12618 Comm: syz.0.2152 Not tainted syzkaller #0 PREEMPT(full) [ 305.157509][T12618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 305.157520][T12618] Call Trace: [ 305.157528][T12618] [ 305.157535][T12618] dump_stack_lvl+0xe8/0x150 [ 305.157576][T12618] should_fail_ex+0x410/0x560 [ 305.157610][T12618] _copy_to_user+0x31/0xb0 [ 305.157632][T12618] simple_read_from_buffer+0xe1/0x170 [ 305.157664][T12618] proc_fail_nth_read+0x1bb/0x230 [ 305.157697][T12618] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 305.157732][T12618] ? rw_verify_area+0x24a/0x4c0 [ 305.157760][T12618] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 305.157788][T12618] vfs_read+0x213/0xa80 [ 305.157819][T12618] ? __pfx___mutex_lock+0x10/0x10 [ 305.157842][T12618] ? __pfx_vfs_read+0x10/0x10 [ 305.157871][T12618] ? __fget_files+0x2a/0x420 [ 305.157900][T12618] ? __fget_files+0x3a2/0x420 [ 305.157925][T12618] ? __fget_files+0x2a/0x420 [ 305.157958][T12618] ksys_read+0x150/0x270 [ 305.157988][T12618] ? __pfx_ksys_read+0x10/0x10 [ 305.158026][T12618] do_syscall_64+0x166/0x520 [ 305.158046][T12618] ? trace_irq_disable+0x3b/0x140 [ 305.158069][T12618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.158088][T12618] ? clear_bhb_loop+0x70/0xc0 [ 305.158111][T12618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.158130][T12618] RIP: 0033:0x7f949795e90e [ 305.158146][T12618] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 305.158161][T12618] RSP: 002b:00007f9498867fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 305.158181][T12618] RAX: ffffffffffffffda RBX: 00007f94988686c0 RCX: 00007f949795e90e [ 305.158195][T12618] RDX: 000000000000000f RSI: 00007f94988680a0 RDI: 0000000000000004 [ 305.158206][T12618] RBP: 00007f9498868090 R08: 0000000000000000 R09: 0000000000000000 [ 305.158214][T12618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 305.158225][T12618] R13: 00007f9497c26038 R14: 00007f9497c25fa0 R15: 00007ffd7fef7958 [ 305.158251][T12618] [ 305.678225][T12625] syzkaller0: entered promiscuous mode [ 305.716648][T12625] syzkaller0: entered allmulticast mode [ 305.730004][T12626] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2154'. [ 305.880726][T12641] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2160'. [ 306.651429][T12658] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2166'. [ 306.668288][T12658] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2166'. [ 306.685706][T12658] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2166'. [ 306.708554][T12659] netlink: 'syz.4.2167': attribute type 29 has an invalid length. [ 306.723880][T12662] netlink: 'syz.0.2168': attribute type 1 has an invalid length. [ 306.735324][T12659] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2167'. [ 306.890419][T12662] 8021q: adding VLAN 0 to HW filter on device bond15 [ 307.045696][T12665] bond15: (slave gretap10): making interface the new active one [ 307.094500][T12665] bond15: (slave gretap10): Enslaving as an active interface with an up link [ 307.151727][T12661] netlink: 'syz.4.2167': attribute type 29 has an invalid length. [ 307.178108][T12661] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2167'. [ 307.207440][T12669] bond14: (slave dummy0): Releasing active interface [ 307.244747][T12669] bond15: (slave dummy0): Enslaving as an active interface with an up link [ 308.255548][T12725] ip_tables: iptables: counters copy to user failed while replacing table [ 308.290722][T12722] macsec1: entered promiscuous mode [ 308.380679][T12729] ip6t_srh: unknown srh invflags BA61 [ 308.605762][T12734] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 308.868738][T12749] ip_tables: iptables: counters copy to user failed while replacing table [ 308.983363][T12749] ip6t_srh: unknown srh invflags BA61 [ 310.440527][T12800] __nla_validate_parse: 10 callbacks suppressed [ 310.440548][T12800] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2214'. [ 310.500284][T12801] ip_tables: iptables: counters copy to user failed while replacing table [ 310.550063][T12801] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2213'. [ 310.644274][T12806] ip6t_srh: unknown srh invflags BA61 [ 310.687245][T12804] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2215'. [ 310.724499][T12804] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2215'. [ 310.764607][T12804] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2215'. [ 310.915326][T12814] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2217'. [ 311.192632][T12823] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2219'. [ 311.662494][T12845] netlink: 'syz.3.2228': attribute type 1 has an invalid length. [ 311.699128][T12845] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2228'. [ 311.775058][T12854] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2231'. [ 311.785003][T12854] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2231'. [ 311.878075][T12857] x_tables: duplicate underflow at hook 2 [ 311.944450][T12857] lo: entered promiscuous mode [ 311.960157][T12857] tunl0: entered promiscuous mode [ 311.975060][T12857] gre0: entered promiscuous mode [ 311.986351][T12857] gretap0: entered promiscuous mode [ 312.001041][T12857] erspan0: entered promiscuous mode [ 312.024543][T12857] ip_vti0: entered promiscuous mode [ 312.051784][T12857] ip6_vti0: entered promiscuous mode [ 312.080706][T12857] sit0: entered promiscuous mode [ 312.102251][T12857] ip6tnl0: entered promiscuous mode [ 312.124427][T12857] ip6gre0: entered promiscuous mode [ 312.158336][T12857] ip6gretap0: entered promiscuous mode [ 312.184841][T12857] bridge0: entered promiscuous mode [ 312.200505][T12857] bond0: entered promiscuous mode [ 312.223279][T12857] bond_slave_0: entered promiscuous mode [ 312.389186][T12857] bond_slave_1: entered promiscuous mode [ 312.417310][T12857] dummy0: entered promiscuous mode [ 312.427849][T12857] nlmon0: entered promiscuous mode [ 312.444658][T12857] batadv0: entered promiscuous mode [ 312.463099][T12857] veth0: entered promiscuous mode [ 312.474731][T12857] veth1: entered promiscuous mode [ 312.497944][T12857] wg0: entered promiscuous mode [ 312.510065][T12857] wg1: entered promiscuous mode [ 312.523265][T12857] wg2: entered promiscuous mode [ 312.531860][T12857] veth0_to_bridge: entered promiscuous mode [ 312.555287][T12857] veth1_to_bridge: entered promiscuous mode [ 312.565529][T12857] veth0_to_bond: entered promiscuous mode [ 312.585223][T12857] veth1_to_bond: entered promiscuous mode [ 312.603192][T12857] veth0_to_team: entered promiscuous mode [ 312.623499][T12857] team_slave_0: entered promiscuous mode [ 312.641056][T12857] veth1_to_team: entered promiscuous mode [ 312.678490][T12857] team_slave_1: entered promiscuous mode [ 312.702131][T12857] veth0_to_batadv: entered promiscuous mode [ 312.741683][T12857] batadv_slave_0: entered promiscuous mode [ 312.767892][T12857] veth1_to_batadv: entered promiscuous mode [ 312.789961][T12857] batadv_slave_1: entered promiscuous mode [ 312.802932][T12857] xfrm0: entered promiscuous mode [ 312.815172][T12857] veth0_to_hsr: entered promiscuous mode [ 312.837248][T12857] veth1_to_hsr: entered promiscuous mode [ 312.895585][ T36] bond12: (slave dummy0): link status definitely down, disabling slave [ 312.964449][T12878] syzkaller0: Caught tx_queue_len zero misconfig [ 313.523902][T12903] netlink: 'syz.0.2247': attribute type 10 has an invalid length. [ 314.144360][T12931] netlink: 'syz.0.2255': attribute type 15 has an invalid length. [ 314.913368][T12963] tipc: Enabling of bearer rejected, already enabled [ 315.376641][T12983] Bluetooth: hci0: invalid length 0, exp 2 for type 19 [ 315.425128][T12986] FAULT_INJECTION: forcing a failure. [ 315.425128][T12986] name failslab, interval 1, probability 0, space 0, times 0 [ 315.470721][T12986] CPU: 0 UID: 0 PID: 12986 Comm: syz.2.2277 Not tainted syzkaller #0 PREEMPT(full) [ 315.470749][T12986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 315.470761][T12986] Call Trace: [ 315.470768][T12986] [ 315.470776][T12986] dump_stack_lvl+0xe8/0x150 [ 315.470807][T12986] should_fail_ex+0x410/0x560 [ 315.470841][T12986] should_failslab+0xa8/0x100 [ 315.470869][T12986] kmem_cache_alloc_node_noprof+0xb3/0x620 [ 315.470890][T12986] ? local_lock_release+0x9c/0x160 [ 315.470917][T12986] ? __alloc_skb+0x1db/0x7a0 [ 315.470939][T12986] ? __alloc_skb+0x1db/0x7a0 [ 315.470978][T12986] __alloc_skb+0x1db/0x7a0 [ 315.471007][T12986] netlink_ack+0x136/0xb30 [ 315.471033][T12986] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 315.471060][T12986] ? __lock_acquire+0x683/0x2cf0 [ 315.471098][T12986] netlink_rcv_skb+0x2a4/0x4a0 [ 315.471118][T12986] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 315.471145][T12986] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 315.471176][T12986] ? netlink_deliver_tap+0x2e/0x1b0 [ 315.471195][T12986] ? netlink_deliver_tap+0x2e/0x1b0 [ 315.471219][T12986] netlink_unicast+0x7bd/0x940 [ 315.471256][T12986] netlink_sendmsg+0x813/0xb40 [ 315.471284][T12986] ? __pfx_netlink_sendmsg+0x10/0x10 [ 315.471307][T12986] ? aa_sock_msg_perm+0xf6/0x1c0 [ 315.471340][T12986] ? __pfx_netlink_sendmsg+0x10/0x10 [ 315.471359][T12986] sock_sendmsg_nosec+0x13a/0x180 [ 315.471383][T12986] ____sys_sendmsg+0x54e/0x850 [ 315.471416][T12986] ? __pfx_____sys_sendmsg+0x10/0x10 [ 315.471450][T12986] ? import_iovec+0x73/0xa0 [ 315.471468][T12986] ___sys_sendmsg+0x2a5/0x360 [ 315.471493][T12986] ? __lock_acquire+0x683/0x2cf0 [ 315.471523][T12986] ? __pfx____sys_sendmsg+0x10/0x10 [ 315.471585][T12986] ? __fget_files+0x2a/0x420 [ 315.471609][T12986] ? __fget_files+0x3a2/0x420 [ 315.471640][T12986] __x64_sys_sendmsg+0x1b1/0x290 [ 315.471670][T12986] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 315.471716][T12986] do_syscall_64+0x166/0x520 [ 315.471736][T12986] ? trace_irq_disable+0x3b/0x140 [ 315.471761][T12986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.471780][T12986] ? clear_bhb_loop+0x70/0xc0 [ 315.471801][T12986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.471819][T12986] RIP: 0033:0x7fbb5d99e0d9 [ 315.471837][T12986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 315.471854][T12986] RSP: 002b:00007fbb5e83d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 315.471874][T12986] RAX: ffffffffffffffda RBX: 00007fbb5dc25fa0 RCX: 00007fbb5d99e0d9 [ 315.471888][T12986] RDX: 0000000000008000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 315.471900][T12986] RBP: 00007fbb5e83d090 R08: 0000000000000000 R09: 0000000000000000 [ 315.471912][T12986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.471924][T12986] R13: 00007fbb5dc26038 R14: 00007fbb5dc25fa0 R15: 00007fff8a598e98 [ 315.472005][T12986] [ 315.913749][T12994] __nla_validate_parse: 31 callbacks suppressed [ 315.913768][T12994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2280'. [ 315.966342][T12996] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2281'. [ 316.014691][T12994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2280'. [ 316.053633][T13000] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2282'. [ 316.080275][T12994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2280'. [ 316.126301][T12994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2280'. [ 316.180821][T12994] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2280'. [ 316.209692][T12994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2280'. [ 316.685296][T13032] tipc: Enabling of bearer rejected, already enabled [ 316.837068][T13038] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2296'. [ 316.978267][T13043] vlan3: entered promiscuous mode [ 316.989507][T13042] vlan3: left promiscuous mode [ 317.081144][T13046] netlink: 179624 bytes leftover after parsing attributes in process `syz.0.2300'. [ 319.516976][T13110] FAULT_INJECTION: forcing a failure. [ 319.516976][T13110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 319.592449][T13110] CPU: 1 UID: 0 PID: 13110 Comm: syz.3.2319 Not tainted syzkaller #0 PREEMPT(full) [ 319.592479][T13110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 319.592490][T13110] Call Trace: [ 319.592498][T13110] [ 319.592506][T13110] dump_stack_lvl+0xe8/0x150 [ 319.592539][T13110] should_fail_ex+0x410/0x560 [ 319.592574][T13110] _copy_to_user+0x31/0xb0 [ 319.592595][T13110] ethtool_get_link_ksettings+0x3eb/0x570 [ 319.592626][T13110] ? __pfx_ethtool_get_link_ksettings+0x10/0x10 [ 319.592670][T13110] ? dev_ethtool+0x3a0/0x29c0 [ 319.592705][T13110] ? dev_get_by_name+0x21/0x200 [ 319.592723][T13110] ? dev_get_by_name+0x21/0x200 [ 319.592753][T13110] dev_ethtool+0x1000/0x29c0 [ 319.592773][T13110] ? __lock_acquire+0x683/0x2cf0 [ 319.592813][T13110] ? __pfx_dev_ethtool+0x10/0x10 [ 319.592834][T13110] ? inet_ioctl+0x484/0x560 [ 319.592861][T13110] ? dev_load+0x21/0x1f0 [ 319.592896][T13110] ? dev_load+0x21/0x1f0 [ 319.592923][T13110] ? dev_load+0x21/0x1f0 [ 319.592950][T13110] dev_ioctl+0x392/0x1150 [ 319.592980][T13110] sock_do_ioctl+0x23e/0x320 [ 319.593004][T13110] ? __pfx_sock_do_ioctl+0x10/0x10 [ 319.593023][T13110] ? hook_file_ioctl+0x1f0/0x5f0 [ 319.593066][T13110] sock_ioctl+0x57a/0x7e0 [ 319.593089][T13110] ? __pfx_sock_ioctl+0x10/0x10 [ 319.593110][T13110] ? __fget_files+0x2a/0x420 [ 319.593135][T13110] ? __fget_files+0x3a2/0x420 [ 319.593158][T13110] ? __fget_files+0x2a/0x420 [ 319.593187][T13110] ? bpf_lsm_file_ioctl+0x9/0x20 [ 319.593208][T13110] ? __pfx_sock_ioctl+0x10/0x10 [ 319.593229][T13110] __se_sys_ioctl+0xfc/0x170 [ 319.593252][T13110] do_syscall_64+0x166/0x520 [ 319.593272][T13110] ? trace_irq_disable+0x3b/0x140 [ 319.593297][T13110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.593316][T13110] ? clear_bhb_loop+0x70/0xc0 [ 319.593339][T13110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.593358][T13110] RIP: 0033:0x7f719759e0d9 [ 319.593377][T13110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.593393][T13110] RSP: 002b:00007f7198552028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 319.593414][T13110] RAX: ffffffffffffffda RBX: 00007f7197825fa0 RCX: 00007f719759e0d9 [ 319.593428][T13110] RDX: 00002000000001c0 RSI: 0000000000008946 RDI: 0000000000000003 [ 319.593441][T13110] RBP: 00007f7198552090 R08: 0000000000000000 R09: 0000000000000000 [ 319.593453][T13110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.593465][T13110] R13: 00007f7197826038 R14: 00007f7197825fa0 R15: 00007ffcd29c4b48 [ 319.593498][T13110] [ 319.644385][ T30] audit: type=1804 audit(1787580618.563:6): pid=13112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2320" name="/newroot/450/cgroup.controllers" dev="tmpfs" ino=2324 res=1 errno=0 [ 319.911312][ T30] audit: type=1800 audit(1787580618.663:7): pid=13112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2320" name="cgroup.controllers" dev="tmpfs" ino=2324 res=0 errno=0 [ 319.983893][ T30] audit: type=1804 audit(1787580618.853:8): pid=13112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.2320" name="/newroot/450/cgroup.controllers" dev="tmpfs" ino=2324 res=1 errno=0 [ 335.454217][T13157] __nla_validate_parse: 4 callbacks suppressed [ 335.454238][T13157] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2334'. [ 335.518541][T13157] netlink: 'syz.0.2334': attribute type 1 has an invalid length. [ 335.701481][T13171] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2339'. [ 335.919916][T13180] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2342'. [ 336.045975][T13185] netlink: 'syz.4.2344': attribute type 32 has an invalid length. [ 336.088261][T13185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2344'. [ 336.121093][T13185] bond0: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 336.458935][T13205] netlink: 'syz.2.2353': attribute type 1 has an invalid length. [ 336.556846][T13205] 8021q: adding VLAN 0 to HW filter on device bond13 [ 336.610414][T13212] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2355'. [ 336.647620][T13208] bond13: (slave gretap7): making interface the new active one [ 336.668025][T13208] bond13: (slave gretap7): Enslaving as an active interface with an up link [ 336.757044][T13211] dummy0: left promiscuous mode [ 336.779823][T13211] bond12: (slave dummy0): Releasing active interface [ 336.789032][T13222] netlink: 112 bytes leftover after parsing attributes in process `syz.0.2358'. [ 336.807529][T13211] bond13: (slave dummy0): Enslaving as an active interface with an up link [ 336.819222][T13216] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2357'. [ 336.928079][T13222] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2358'. [ 337.008636][T13231] openvswitch: netlink: Message has 13072 unknown bytes. [ 337.026769][T13231] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 337.129405][T13233] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2362'. [ 337.157879][T13233] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2362'. [ 337.201208][T13224] netlink: 'syz.0.2358': attribute type 14 has an invalid length. [ 340.141899][T13235] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 340.596969][T13277] __nla_validate_parse: 6 callbacks suppressed [ 340.596989][T13277] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2372'. [ 341.400305][T13315] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2387'. [ 341.648339][T13318] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2388'. [ 341.678328][T13318] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2388'. [ 341.707266][T13318] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2388'. [ 341.799175][T13318] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2388'. [ 341.907707][T13333] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2393'. [ 342.042838][T13342] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2393'. [ 342.084358][T13345] FAULT_INJECTION: forcing a failure. [ 342.084358][T13345] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 342.165779][T13345] CPU: 1 UID: 0 PID: 13345 Comm: syz.0.2396 Not tainted syzkaller #0 PREEMPT(full) [ 342.165807][T13345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 342.165819][T13345] Call Trace: [ 342.165826][T13345] [ 342.165834][T13345] dump_stack_lvl+0xe8/0x150 [ 342.165866][T13345] should_fail_ex+0x410/0x560 [ 342.165899][T13345] _copy_from_user+0x2d/0xb0 [ 342.165920][T13345] ___sys_recvmsg+0x173/0x5a0 [ 342.165955][T13345] ? __pfx____sys_recvmsg+0x10/0x10 [ 342.165988][T13345] ? __fget_files+0x2a/0x420 [ 342.166042][T13345] do_recvmmsg+0x31a/0x7f0 [ 342.166069][T13345] ? __pfx_do_recvmmsg+0x10/0x10 [ 342.166109][T13345] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 342.166134][T13345] ? __fget_files+0x3a2/0x420 [ 342.166168][T13345] __x64_sys_recvmmsg+0x198/0x250 [ 342.166189][T13345] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 342.166216][T13345] do_syscall_64+0x166/0x520 [ 342.166237][T13345] ? trace_irq_disable+0x3b/0x140 [ 342.166261][T13345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.166280][T13345] ? clear_bhb_loop+0x70/0xc0 [ 342.166303][T13345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.166321][T13345] RIP: 0033:0x7f949799e0d9 [ 342.166339][T13345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.166355][T13345] RSP: 002b:00007f9498868028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 342.166378][T13345] RAX: ffffffffffffffda RBX: 00007f9497c25fa0 RCX: 00007f949799e0d9 [ 342.166392][T13345] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 342.166405][T13345] RBP: 00007f9498868090 R08: 0000000000000000 R09: 0000000000000000 [ 342.166416][T13345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 342.166428][T13345] R13: 00007f9497c26038 R14: 00007f9497c25fa0 R15: 00007ffd7fef7958 [ 342.166459][T13345] [ 342.389786][T13342] bond15 (unregistering): Released all slaves [ 342.570433][T13359] netlink: 'syz.4.2399': attribute type 2 has an invalid length. [ 342.607356][T13359] : entered promiscuous mode [ 343.057199][T13387] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 343.273104][T13383] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 343.802151][ T9002] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 344.311134][T13446] netlink: 'syz.0.2418': attribute type 2 has an invalid length. [ 345.130631][T13461] openvswitch: netlink: Missing valid actions attribute. [ 345.141195][T13461] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 346.694344][T13415] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 346.882581][T13468] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2425'. [ 346.976345][T13475] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 347.035707][T13477] 8021q: VLANs not supported on ip6gre0 [ 347.119249][T13473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2427'. [ 347.141210][T13481] vlan3: entered promiscuous mode [ 347.177687][T13481] syz_tun: entered promiscuous mode [ 347.261430][T13474] vlan3: left promiscuous mode [ 347.294800][T13474] syz_tun: left promiscuous mode [ 347.421678][T13497] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2434'. [ 347.558374][T13505] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2435'. [ 348.001289][T13514] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2436'. [ 348.472390][T13530] nbd: couldn't find device at index 65536 [ 348.489527][T13528] 8021q: VLANs not supported on ip6gre0 [ 348.619341][T13534] openvswitch: netlink: Message has 8 unknown bytes. [ 349.264114][T13549] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2445'. [ 349.298333][T13549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2445'. [ 349.341304][T13549] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2445'. [ 349.413871][T13549] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2445'. [ 350.011370][T13579] syzkaller0: entered promiscuous mode [ 350.021665][T13579] syzkaller0: entered allmulticast mode [ 350.051305][T13580] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2452'. [ 350.977771][T13625] netlink: 'syz.3.2465': attribute type 2 has an invalid length. [ 351.170832][T13629] netlink: 'syz.0.2464': attribute type 12 has an invalid length. [ 351.218189][T13626] netlink: 'syz.0.2464': attribute type 1 has an invalid length. [ 351.352246][T13626] bond16: entered promiscuous mode [ 351.367696][T13626] 8021q: adding VLAN 0 to HW filter on device bond16 [ 351.511918][T13638] 8021q: adding VLAN 0 to HW filter on device bond16 [ 351.541367][T13638] bond16: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 351.583802][T13638] bond16: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 351.605031][T13638] bond16: (slave ip6gre1): making interface the new active one [ 351.613788][T13638] ip6gre1: entered promiscuous mode [ 351.620780][T13638] bond16: (slave ip6gre1): Enslaving as an active interface with an up link [ 351.667689][T13626] netlink: 'syz.0.2464': attribute type 15 has an invalid length. [ 352.065354][T13656] vlan2: entered promiscuous mode [ 352.078469][T13656] syz_tun: entered promiscuous mode [ 352.098005][T13655] vlan2: left promiscuous mode [ 352.115302][T13655] syz_tun: left promiscuous mode [ 352.288436][T13664] __nla_validate_parse: 6 callbacks suppressed [ 352.288455][T13664] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2472'. [ 352.297668][T13666] openvswitch: netlink: Message has 4872 unknown bytes. [ 352.350606][T13664] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2472'. [ 352.382649][T13666] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 352.494396][T13664] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2472'. [ 352.559572][T13664] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2472'. [ 353.276235][T13707] sctp: [Deprecated]: syz.3.2485 (pid 13707) Use of struct sctp_assoc_value in delayed_ack socket option. [ 353.276235][T13707] Use struct sctp_sack_info instead [ 353.286525][T13710] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 353.404672][T13595] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 353.417778][T13716] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2488'. [ 355.332846][T13798] bond13: (slave dummy0): Releasing active interface [ 355.564762][T13812] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2525'. [ 356.976030][T13875] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2550'. [ 357.055485][T13875] bridge0: port 1(syz_tun) entered blocking state [ 357.081519][T13875] bridge0: port 1(syz_tun) entered disabled state [ 357.106058][T13875] syz_tun: entered allmulticast mode [ 357.176168][T13875] syz_tun: entered promiscuous mode [ 357.640635][T13904] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2561'. [ 357.676847][T13908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2563'. [ 357.987018][T13922] tipc: Resetting bearer [ 358.007060][T13929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2565'. [ 358.058054][T13929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2565'. [ 358.212774][ T9002] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 358.243984][ T9005] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 358.261840][ T9005] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 358.297388][ T9005] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 358.384557][T13945] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2574'. [ 358.479058][T13949] netlink: 'syz.3.2575': attribute type 1 has an invalid length. [ 358.561249][T13953] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2575'. [ 358.654399][T13953] 8021q: adding VLAN 0 to HW filter on device bond15 [ 358.835373][T13949] 8021q: adding VLAN 0 to HW filter on device bond15 [ 358.974682][T13949] bond15: (slave geneve2): making interface the new active one [ 359.029464][T13949] bond15: (slave geneve2): Enslaving as an active interface with an up link [ 359.205678][T13986] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 359.242736][ T9001] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 359.262186][ T9001] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 359.295651][ T9001] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 359.334822][ T9001] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 359.855632][T14013] tipc: Enabling of bearer rejected, already enabled [ 359.896368][T14013] syzkaller0: mtu less than device minimum [ 360.010558][T14025] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2600'. [ 360.049497][T14028] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2601'. [ 360.084485][T14030] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2602'. [ 360.244346][T14030] 8021q: adding VLAN 0 to HW filter on device team1 [ 360.799710][T14066] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2612'. [ 360.855580][T14070] netlink: 'syz.0.2613': attribute type 16 has an invalid length. [ 360.881315][T14070] netlink: 'syz.0.2613': attribute type 17 has an invalid length. [ 361.058869][T14070] team0: left promiscuous mode [ 361.086492][T14070] vlan0: left promiscuous mode [ 361.119195][T14070] syzkaller0: left promiscuous mode [ 361.143484][T14070] syzkaller0: left allmulticast mode [ 361.191841][T14070] bond13: left promiscuous mode [ 361.223028][T14070] bond13: left allmulticast mode [ 361.296744][T14070] macsec1: left promiscuous mode [ 361.336102][T14070] bond16: left promiscuous mode [ 361.361414][T14070] ip6gre1: left promiscuous mode [ 361.639795][T14096] syzkaller0: entered promiscuous mode [ 361.681594][T14096] syzkaller0: entered allmulticast mode [ 361.735256][T14101] erspan0: entered promiscuous mode [ 361.763110][T14101] vlan3: entered promiscuous mode [ 362.426854][T14136] xt_hashlimit: size too large, truncated to 1048576 [ 363.822048][T14206] __nla_validate_parse: 2 callbacks suppressed [ 363.822067][T14206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2660'. [ 364.116858][T14226] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2668'. [ 364.624981][T14253] netlink: 'syz.2.2676': attribute type 1 has an invalid length. [ 364.794929][T14253] 8021q: adding VLAN 0 to HW filter on device bond15 [ 364.850515][T14264] netlink: 'syz.2.2676': attribute type 10 has an invalid length. [ 364.874344][T14264] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2676'. [ 364.966487][T14256] bond15: (slave veth9): Enslaving as a backup interface with a down link [ 365.093331][T14270] syzkaller0: left promiscuous mode [ 365.112545][T14270] syzkaller0: left allmulticast mode [ 365.398179][T14287] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2689'. [ 366.502997][T14352] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2716'. [ 366.842279][T14369] syzkaller0: left promiscuous mode [ 366.856620][T14369] syzkaller0: left allmulticast mode [ 367.114653][T14378] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2726'. [ 367.269486][T14385] netlink: 'syz.0.2728': attribute type 7 has an invalid length. [ 367.310376][T14385] netlink: 'syz.0.2728': attribute type 7 has an invalid length. [ 367.423035][T14392] syzkaller0: entered promiscuous mode [ 367.448488][T14392] syzkaller0: entered allmulticast mode [ 367.761936][T14412] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2738'. [ 368.031524][T14428] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2745'. [ 368.456014][T14446] syzkaller0: entered promiscuous mode [ 368.473838][T14446] syzkaller0: entered allmulticast mode [ 368.733729][T14459] netlink: 'syz.1.2755': attribute type 1 has an invalid length. [ 368.890803][T14466] syzkaller1: entered promiscuous mode [ 368.909457][T14466] syzkaller1: entered allmulticast mode [ 368.933974][T14468] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input5 [ 369.390235][T14488] veth0: entered promiscuous mode [ 369.413071][T14487] veth0: left promiscuous mode [ 369.661822][T14498] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2765'. [ 370.656116][T14536] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 370.689190][T14539] netlink: 'syz.3.2774': attribute type 4 has an invalid length. [ 370.704420][T14542] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 370.767078][T14536] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 370.820427][T14542] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 370.879097][T14536] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 370.955528][T14542] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 371.071766][T14536] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 371.104141][T14542] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 371.173999][T14536] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 371.226066][T14542] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 371.736757][T14587] syz_tun: entered allmulticast mode [ 371.772216][ T5621] Bluetooth: hci4: link tx timeout [ 371.781271][ T5621] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 372.392102][T14617] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2798'. [ 373.217929][T14625] syzkaller0: left promiscuous mode [ 373.287507][T14625] syzkaller0: left allmulticast mode [ 373.852751][ T5621] Bluetooth: hci4: command 0x0406 tx timeout [ 374.990903][T14600] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 375.314751][T14677] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2817'. [ 376.711685][T14744] netlink: ct family unspecified [ 376.779080][T14748] syzkaller0: entered promiscuous mode [ 376.802426][T14748] syzkaller0: entered allmulticast mode [ 378.587254][ T5621] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 378.600752][ T5621] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 378.622799][ T5621] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 378.637649][ T5621] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 378.648192][ T5621] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 379.330150][ T5615] syz_tun (unregistering): left allmulticast mode [ 380.740427][ T5611] Bluetooth: hci5: command tx timeout [ 380.874178][T14894] netlink: 'syz.4.2890': attribute type 29 has an invalid length. [ 380.919515][T14894] netlink: 'syz.4.2890': attribute type 29 has an invalid length. [ 381.020605][T14886] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 381.057904][T14886] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 381.099481][T14886] batman_adv: batadv0: Removing interface: vlan2 [ 381.591866][T14824] bridge0: port 1(bridge_slave_0) entered blocking state [ 381.614074][T14824] bridge0: port 1(bridge_slave_0) entered disabled state [ 381.632972][T14824] bridge_slave_0: entered allmulticast mode [ 381.652503][T14824] bridge_slave_0: entered promiscuous mode [ 381.666570][T14824] bridge0: port 2(bridge_slave_1) entered blocking state [ 381.685555][T14824] bridge0: port 2(bridge_slave_1) entered disabled state [ 381.706931][T14824] bridge_slave_1: entered allmulticast mode [ 381.746745][T14824] bridge_slave_1: entered promiscuous mode [ 381.870231][T14824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 381.923505][T14824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 382.182463][T14824] team0: Port device team_slave_0 added [ 382.211660][T14824] team0: Port device team_slave_1 added [ 382.391500][T14824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 382.419392][T14824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 382.520248][T14824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 382.563423][T14824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 382.570633][T14824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 382.641244][T14824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 382.770008][T14824] hsr_slave_0: entered promiscuous mode [ 382.779307][T14824] hsr_slave_1: entered promiscuous mode [ 382.787304][T14824] debugfs: 'hsr0' already exists in 'hsr' [ 382.793927][T14824] Cannot create hsr debugfs directory [ 382.814435][ T5611] Bluetooth: hci5: command tx timeout [ 383.690312][T14824] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 383.740694][T14824] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 383.787005][T14824] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 383.919347][T14784] Set syz1 is full, maxelem 65536 reached [ 384.090062][T14824] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 384.119655][T14824] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.157857][T14824] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 384.406235][T14824] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 384.444353][T14824] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.472516][T14824] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 384.628937][T14824] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 384.644507][T14824] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 384.658809][T14824] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 384.892418][ T5611] Bluetooth: hci5: command tx timeout [ 386.790985][T15088] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2949'. [ 386.972611][ T5611] Bluetooth: hci5: command tx timeout [ 387.039744][T15098] netlink: 'syz.0.2955': attribute type 1 has an invalid length. [ 387.096111][T15098] 8021q: adding VLAN 0 to HW filter on device bond17 [ 387.119244][T15101] bond17: (slave gretap11): making interface the new active one [ 387.128212][T15101] bond17: (slave gretap11): Enslaving as an active interface with an up link [ 387.164150][T15098] bond15: (slave dummy0): Releasing active interface [ 387.178543][T15098] bond17: (slave dummy0): Enslaving as an active interface with an up link [ 387.313070][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.322258][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.336325][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.346879][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.356341][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.366636][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.377223][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.388394][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 387.397885][T15104] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2956'. [ 388.051603][T15036] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 388.159558][T14824] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 388.216525][T14824] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 388.248463][T14824] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 388.326848][T14824] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 388.364584][T14824] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 388.449282][T14824] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 388.472059][T14824] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 388.506995][T14824] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 388.873761][T14824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 388.941008][T14824] 8021q: adding VLAN 0 to HW filter on device team0 [ 388.979607][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 388.986850][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.060157][ T9001] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.067495][ T9001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 389.243987][T15155] ip_tables: iptables: counters copy to user failed while replacing table [ 389.415089][T15158] ip6t_srh: unknown srh invflags BA61 [ 389.719773][T15168] ip_tables: iptables: counters copy to user failed while replacing table [ 389.857268][T15171] ip6t_srh: unknown srh invflags BA61 [ 390.745299][T14824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 390.884104][T14824] veth0_vlan: entered promiscuous mode [ 390.920879][T14824] veth1_vlan: entered promiscuous mode [ 391.008645][T14824] veth0_macvtap: entered promiscuous mode [ 391.035606][T14824] veth1_macvtap: entered promiscuous mode [ 391.087995][T14824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 391.133902][T14824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 391.184463][ T36] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.212898][ T9002] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.266992][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.305201][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 391.387710][ T8999] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.411822][ T8999] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.488284][ T9001] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.517400][ T9001] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.765847][T15231] ip_tables: iptables: counters copy to user failed while replacing table [ 391.855183][T15236] __nla_validate_parse: 238 callbacks suppressed [ 391.855203][T15236] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2986'. [ 391.879272][T15240] ip6t_srh: unknown srh invflags BA61 [ 392.006375][T15236] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 64993 [ 393.122609][T15179] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 393.341252][T15298] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3004'. [ 393.818000][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 393.835977][ T5621] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 393.845753][ T5621] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 393.889372][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 393.897250][ T5621] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 394.318759][ T7833] Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN PTI [ 394.330786][ T7833] KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f] [ 394.339248][ T7833] CPU: 0 UID: 0 PID: 7833 Comm: kbnepd bnep0 Not tainted syzkaller #0 PREEMPT(full) [ 394.348704][ T7833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 394.358758][ T7833] RIP: 0010:klist_del+0x49/0x110 [ 394.363745][ T7833] Code: f5 49 89 dd 49 c1 ed 03 43 80 7c 25 00 00 74 08 48 89 df e8 c9 68 67 f6 4c 8b 33 49 83 e6 fe 49 8d 7e 58 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 ab 68 67 f6 4d 8b 7e 58 4c 89 f7 e8 3f 46 [ 394.383353][ T7833] RSP: 0018:ffffc900038af848 EFLAGS: 00010202 [ 394.389423][ T7833] RAX: 000000000000000b RBX: ffff8880553e2860 RCX: ffff88802bf1be80 [ 394.397385][ T7833] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000058 [ 394.405348][ T7833] RBP: ffffc900038af970 R08: ffff888042d5b5a3 R09: 1ffff110085ab6b4 [ 394.413311][ T7833] R10: dffffc0000000000 R11: ffffed10085ab6b5 R12: dffffc0000000000 [ 394.421272][ T7833] R13: 1ffff1100aa7c50c R14: 0000000000000000 R15: ffff888053e08888 [ 394.429245][ T7833] FS: 0000000000000000(0000) GS:ffff888124f24000(0000) knlGS:0000000000000000 [ 394.438171][ T7833] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 394.444759][ T7833] CR2: 0000001b33220ff8 CR3: 000000007bd46000 CR4: 00000000003526f0 [ 394.452727][ T7833] Call Trace: [ 394.456001][ T7833] [ 394.459022][ T7833] device_del+0x27f/0x8f0 [ 394.463359][ T7833] ? __pfx_device_del+0x10/0x10 [ 394.468288][ T7833] ? pm_runtime_set_memalloc_noio+0x1e7/0x260 [ 394.474352][ T7833] ? netdev_unregister_kobject+0x347/0x450 [ 394.480325][ T7833] unregister_netdevice_many_notify+0x1be1/0x2140 [ 394.486765][ T7833] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 394.493623][ T7833] ? rtnl_net_dev_lock+0x36/0x2f0 [ 394.498655][ T7833] ? rtnl_net_dev_lock+0x36/0x2f0 [ 394.503783][ T7833] unregister_netdev+0x155/0x1f0 [ 394.508765][ T7833] ? __pfx_unregister_netdev+0x10/0x10 [ 394.514222][ T7833] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 394.520026][ T7833] bnep_session+0x2af2/0x2d20 [ 394.524709][ T7833] ? __lock_acquire+0x683/0x2cf0 [ 394.529670][ T7833] ? kthread_affine_node+0x2b2/0x360 [ 394.535058][ T7833] ? __pfx_bnep_session+0x10/0x10 [ 394.540123][ T7833] ? do_raw_spin_lock+0x12b/0x2f0 [ 394.545137][ T7833] ? __pfx_woken_wake_function+0x10/0x10 [ 394.550776][ T7833] ? __kthread_parkme+0x71/0x1f0 [ 394.555707][ T7833] ? __kthread_parkme+0x199/0x1f0 [ 394.560725][ T7833] kthread+0x38b/0x480 [ 394.564790][ T7833] ? __pfx_bnep_session+0x10/0x10 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 394.569815][ T7833] ? __pfx_kthread+0x10/0x10 [ 394.574414][ T7833] ret_from_fork+0x514/0xb70 [ 394.579018][ T7833] ? __pfx_ret_from_fork+0x10/0x10 [ 394.584146][ T7833] ? __switch_to+0xc89/0x1420 [ 394.589022][ T7833] ? __pfx_kthread+0x10/0x10 [ 394.593608][ T7833] ret_from_fork_asm+0x1a/0x30 [ 394.598379][ T7833] [ 394.601402][ T7833] Modules linked in: [ 394.606930][ T7833] ---[ end trace 0000000000000000 ]--- [ 394.628176][ T7833] RIP: 0010:klist_del+0x49/0x110 [ 394.633786][ T7833] Code: f5 49 89 dd 49 c1 ed 03 43 80 7c 25 00 00 74 08 48 89 df e8 c9 68 67 f6 4c 8b 33 49 83 e6 fe 49 8d 7e 58 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 74 05 e8 ab 68 67 f6 4d 8b 7e 58 4c 89 f7 e8 3f 46 [ 394.655855][ T7833] RSP: 0018:ffffc900038af848 EFLAGS: 00010202 [ 394.661976][ T7833] RAX: 000000000000000b RBX: ffff8880553e2860 RCX: ffff88802bf1be80 [ 394.670786][ T7833] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000058 [ 394.679103][ T7833] RBP: ffffc900038af970 R08: ffff888042d5b5a3 R09: 1ffff110085ab6b4 [ 394.688842][ T7833] R10: dffffc0000000000 R11: ffffed10085ab6b5 R12: dffffc0000000000 [ 394.697146][ T7833] R13: 1ffff1100aa7c50c R14: 0000000000000000 R15: ffff888053e08888 [ 394.705703][ T7833] FS: 0000000000000000(0000) GS:ffff888124f24000(0000) knlGS:0000000000000000 [ 394.715749][ T7833] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 394.722904][ T7833] CR2: 0000001b3321fff8 CR3: 000000007fabc000 CR4: 00000000003526f0 [ 394.733053][ T7833] Kernel panic - not syncing: Fatal exception [ 394.739701][ T7833] Kernel Offset: disabled [ 394.744057][ T7833] Rebooting in 86400 seconds..