last executing test programs: 2.601780769s ago: executing program 3 (id=13126): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000080)=ANY=[], 0x0, 0x3e, 0x0, 0x4, 0x80000001}, 0x28) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000007d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) r4 = socket(0x1e, 0x4, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r7, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) listen(r5, 0xd) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) r11 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r11, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f00000007683815b12e890300000a000000059afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000010007bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0000000", 0xb8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000004000010000001c000180060001000200000008000300ac1414b60800060003"], 0x30}}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r13, 0x1, 0x70bd2c, 0x25dfdbff, {0x4, 0x0, 0x2000}}, 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16=r4], 0x14) 1.86216842s ago: executing program 2 (id=13136): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01002bbd7000ffdbfb251100000005"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01002bbd7000ffdbfb251100000005"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x5, &(0x7f0000000d80)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x10000000, 0x0, 0x0, 0x41100, 0x16, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x33, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="00000000031000002400128009000100576f6e64000000001400028008000700090000000500010004000000"], 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x33, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000370400"/20, @ANYRES32=0x0, @ANYBLOB="00000000031000002400128009000100576f6e64000000001400028008000700090000000500010004000000"], 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000ac1e0001000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ff02000000ffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000ff0700000000000000000000000000000200000000000000"], 0xb8}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2801000010000100feffffff0001000000000000000000000000000000000000fc010000000000000000000000000001000107144e240005000000003a000000e14537171550acd43da336e7171013e2f72ed24a76218ef996489b73380c626de435011df20ab581eeff310edf7f16199696ffe8faedc04357da470f585323f69842804d2302b50e9d6ccfb35d86fa245cf425efb14f1ae35a2e64fe0ec05b4d8815c9e86be702f8c59dd750b330350ddc6914c0364b0ba704e22dd1ccbb9c00000000000000001a0a43bff91489c69319390bb154b3d15f6649d7fb1c2450b06cffc71ae238a2a605add8ecfc541da5d47da40ed256181fa7d07ed8a29009297698f349aeecb06369faf476eb1763bebb5517aa80ce5bd50455e19435", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc020000000000000000000000000000000004d46c0000007f000001000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002400000000000000480003006465666c61746500"/240], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x24000000) socket$nl_xfrm(0x10, 0x3, 0x6) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socket$unix(0x1, 0x2, 0x0) (async) r6 = socket$unix(0x1, 0x2, 0x0) connect$unix(r6, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r6, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) bind$unix(r6, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x306737e2, 0x6}, 0x0, &(0x7f0000000240)={0x1f, 0x2}, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002880)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40030040, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r7) sendmsg$NLBL_MGMT_C_ADDDEF(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYRESDEC, @ANYRESDEC=r5, @ANYRESDEC=r0], 0x4c}, 0x1, 0x0, 0x0, 0x48005}, 0x40000) (async) sendmsg$NLBL_MGMT_C_ADDDEF(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYRESDEC, @ANYRESDEC=r5, @ANYRESDEC=r0], 0x4c}, 0x1, 0x0, 0x0, 0x48005}, 0x40000) unshare(0x22020400) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x5, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000fffaffffffffffffdf020000186100000700000000000000090000009500000000000000"], &(0x7f0000000500)='syzkaller\x00', 0x5, 0x1d, &(0x7f0000000540)=""/29, 0x41000, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580), 0x0, 0x10, 0xad}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x18, 0x5, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000fffaffffffffffffdf020000186100000700000000000000090000009500000000000000"], &(0x7f0000000500)='syzkaller\x00', 0x5, 0x1d, &(0x7f0000000540)=""/29, 0x41000, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580), 0x0, 0x10, 0xad}, 0x94) socket(0xa, 0x5, 0x0) (async) r8 = socket(0xa, 0x5, 0x0) getsockname$packet(r8, 0x0, &(0x7f0000000080)) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x44, 0x800000, 0x8, 0x7, 0x2}) 1.642804956s ago: executing program 0 (id=13138): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000300), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000640)=0xcde, 0x4) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x3c1, 0x3, 0x450, 0x150, 0x168, 0x9, 0x0, 0xb, 0x380, 0x250, 0x250, 0x380, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x108, 0x150, 0x0, {0x0, 0x28e}, [@common=@inet=@ipcomp={{0x30}}, @common=@inet=@ipcomp={{0x30}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0x200, 0x230, 0x0, {}, [@common=@inet=@policy={{0x158}, {[{@ipv4=@local, [0x0, 0xff000000, 0xffffffff, 0xff000000], @ipv6=@private1, [0x0, 0x1fffffeff, 0xff000000, 0xffffff00], 0x4d6, 0x0, 0x0, 0x0, 0x10, 0x2}, {@ipv4=@remote, [0xff000000, 0xffffff00, 0xffffff00, 0xff], @ipv6=@local, [0x7f, 0xff000000, 0xffffff00, 0xff], 0x4d4, 0x34ff, 0x6c, 0x0, 0x12, 0x4}, {@ipv6=@mcast1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff], @ipv6=@mcast2, [0xffffff00, 0x0, 0xffff00, 0xff000000], 0x4d2, 0x0, 0x0, 0x1, 0x0, 0xd}, {@ipv6=@ipv4={'\x00', '\xff\xff', @multicast2}, [0xffffffff, 0xffffff00], @ipv4=@rand_addr=0x64010100, [0xffffffff, 0xffffff00, 0xffffffff], 0x4d4, 0x3502, 0x32, 0x0, 0x0, 0x6}], 0xa, 0x4}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, 0x0, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e24, 0x1, @loopback, 0x9}}, 0x0, 0x0, 0x32, 0x0, "aae37be4753f0a28060a80cdd60fe31d6ba25cec257a3a485a338d600a8402d23df4854ed4cf29109f0e30e8d115e434392db157494620680fffb8cb989ab0cfc17eb88225e0fb0a062dd7a81eb098d3"}, 0xd8) (async) sendmsg$sock(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000000)="c1a0", 0x2}, {&(0x7f0000000200)="d5a4d3c9d7a9604b87df4f39a67c9713a3eaf859c37583dbe36168e892750c67ad43f1fef71898237673e7311d1c6b9b75381ce83736b17dc98d644a66a707ebbdf604880b8e58dcef5961cb4d1f326fa4345ef94e8e3361ca4f2008284465ea7101af9b6ed6b5af8fe5304ce9328cb008d50402abf3ec2ea91841accea82801ebc3e7765d6471", 0x87}, {&(0x7f0000000480)="6d1088ad88882e3800987b388adb2c829c3a65881b88d496e030d54e46fe9e6750db9b14132b7b92b5540d83ab89c47e662cfda472c6242e6195bef053d1d79ec1e72195d5f5ef002097880f61b3a255f7bd28cf7846b4635d1183f69ca1884fc55c9850bf06628b848a23195a83c2753ccd4f2536fcc738b752116a7db22835ee986e31574dd1d4ecb41dc730a15b7887b86b902e82f6c4534bd5064bbfd11ad1f7636b4ac16dc844765cf555cceb41720ec8c4e846a52eb6c1241481628bfbcac1f8ed683d51f62771cabcf228d94f1c2b1eca321d665173119dbde7e8dfb0122ce6ff900d6ec4b1132693a336f309cce5", 0xf2}], 0x3}, 0x8000) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, 0x0, 0x8010) (async) r3 = socket(0x400000000010, 0x3, 0x0) (async) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) accept4(r4, 0x0, 0x0, 0x80000) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) (async) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000013c0)=@newtfilter={0x884, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xd}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x84c, 0x2, [@TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x6, 0x10000000, 0x92, 0x5, 0x9bc, {0x2, 0x2, 0x4, 0x9, 0xff, 0x3}, {0x2, 0x1, 0x8, 0x9, 0x80, 0x8e}, 0x1, 0x4, 0x6}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x800, 0x2, 0x5, 0x4, 0x0, 0xfffffc00, 0xb80, 0x7, 0xee13, 0x4, 0x6, 0x3, 0x5, 0x2, 0xc0f9, 0x9e60, 0x10001, 0x4, 0x5, 0x1, 0x9, 0x9a, 0x7, 0x6, 0x2, 0x0, 0xfffffffc, 0x8, 0x8, 0x9, 0x0, 0x619d, 0x37, 0x39, 0x2, 0x3ff, 0x800, 0x559, 0x4, 0x101, 0x7, 0xfffffffe, 0x2, 0x9, 0xffff, 0x2, 0x3, 0x0, 0x800, 0x8, 0x0, 0x9, 0xfffffffb, 0x9, 0x2, 0xa55b, 0x0, 0x400, 0x1, 0x3, 0x25, 0x7, 0x1, 0x1, 0xd, 0x10001, 0x5, 0xfffffffe, 0x72a2c416, 0xfffffff7, 0x9, 0x3d, 0x4, 0x3, 0x4, 0x1, 0x7, 0x4, 0x92, 0x401, 0x3, 0xfffffff7, 0x0, 0x1, 0xd6f, 0x8, 0x80000001, 0x401, 0x2, 0x8, 0x3, 0xd9, 0xfffdffff, 0xfffffffd, 0x4, 0x7f4, 0x2, 0xfffffbf8, 0x3, 0x9, 0x4, 0x6, 0x4, 0xfffffff7, 0x0, 0xfb, 0x9, 0x6, 0x400, 0xfc000000, 0x400, 0x7, 0x7, 0x0, 0x1, 0x5, 0x7, 0x7fffffff, 0x401, 0xffffffff, 0x4, 0x10, 0xfffffff7, 0x6, 0x964, 0x5, 0x8, 0x101, 0x6, 0xff, 0x1, 0x2, 0x4a, 0x10001, 0xffff, 0x0, 0x14, 0x200, 0xfff, 0x100, 0xc, 0x9, 0x9, 0x0, 0x0, 0x1, 0x8000000, 0x6, 0x0, 0x9a7c, 0x3fc, 0x3, 0x5, 0x0, 0x6, 0x9, 0x3, 0x43, 0x80000000, 0x3, 0xffffffff, 0x1, 0x9, 0x8, 0x5, 0xefd2, 0x795, 0x5, 0x1ff, 0x5, 0x3, 0xffffffff, 0x5, 0x2, 0xc, 0x1e, 0x1, 0x1, 0x8001, 0x200, 0x8001, 0x7, 0x800, 0x5, 0x80000001, 0x0, 0x7fff, 0x8, 0x1d23, 0x7fff, 0x90, 0x5, 0xffffffff, 0xd, 0x3, 0x0, 0x5, 0x10, 0x9, 0x6, 0x9, 0x80000001, 0x2, 0x0, 0x0, 0x7010, 0xfffffe01, 0x2, 0x6, 0xc4e, 0xb, 0x5a, 0xe74, 0x9, 0x1, 0x3, 0x97df, 0x0, 0x2, 0x7, 0x1c, 0x9, 0x1, 0x8, 0x24, 0xfffffff8, 0x10000, 0xffff, 0x6, 0x8d5b, 0x7, 0x2, 0xfffffffd, 0x2, 0x8, 0x5, 0xc9, 0x0, 0x1, 0x4, 0x8, 0xc74, 0x800, 0x1, 0x8, 0x5, 0x6, 0x2, 0xfffffffa, 0x2b, 0x5, 0x8, 0x9, 0x1, 0x3, 0x9a]}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x3, 0xc396, 0x2, 0x2, 0x9, 0x2, 0xfffffff9, 0x8, 0x101, 0xff, 0x9, 0x4, 0x9, 0x0, 0xf, 0x5, 0x4, 0x4a96, 0x4, 0xffffffff, 0x5, 0x1000, 0x2, 0x2, 0x1, 0x6, 0x7, 0x9, 0x68a2, 0x6, 0x7, 0x3, 0x4, 0x7, 0x7ff, 0x2, 0x4, 0xfffffff9, 0x6, 0x7, 0x1, 0x5, 0xffffff7f, 0x6e, 0x0, 0x5, 0x0, 0x3, 0x9674, 0x9, 0x401, 0x7, 0x5, 0x5, 0x101, 0x5, 0x6, 0xa8e, 0xfe, 0xa9, 0x60, 0x80000001, 0x5, 0x1, 0x401, 0x800, 0x5, 0x6, 0x6, 0x9, 0x0, 0x2, 0xc32, 0x6, 0xfffffff8, 0x9, 0x1, 0x3, 0x77a, 0x6, 0x7, 0x31, 0x9, 0x4, 0x6, 0x5, 0xa58, 0x8, 0xffff, 0x8000, 0x9, 0x6, 0x2, 0x1, 0x0, 0x1, 0x2, 0x0, 0xa, 0xe1f, 0x3ff, 0xfffffffd, 0x1, 0xc4, 0x2, 0x80000001, 0x28, 0xe, 0xff, 0x4cd2, 0xfffffffa, 0x6e, 0xff, 0x0, 0x2, 0x57c6, 0x8, 0x80000001, 0x7, 0x7, 0x2, 0x3ff, 0x6, 0x5, 0x81a, 0x3, 0x9, 0x3, 0x8, 0xac54, 0xc, 0x9, 0x91, 0x9, 0x8, 0x800, 0x2, 0x3, 0x7, 0x4, 0x10, 0xfffffffb, 0x7ff, 0xfffffff8, 0x7, 0x1, 0x8, 0x1, 0x6, 0x4000000, 0x2026ee35, 0x0, 0x7fffffff, 0xfffffffc, 0x1, 0x4, 0x6, 0xf, 0x9, 0x1, 0xc, 0x4, 0xc166, 0x6, 0x101, 0xfffff466, 0x0, 0x0, 0x8, 0x8, 0x6, 0x27, 0xe5f, 0x8, 0xe0, 0x4, 0xfffffffd, 0x1, 0x247800, 0x0, 0xa6f7, 0x2, 0x5, 0xf, 0x0, 0x9, 0x9, 0x9, 0x2, 0x2, 0xb91, 0x401, 0x73a7, 0x0, 0xa9fd, 0x4, 0x0, 0x10001, 0x0, 0xff, 0xfffffff3, 0x2, 0xb8ec, 0x8, 0x1, 0x8, 0xb, 0x7fff, 0x0, 0xa2a, 0xe, 0x80000001, 0x10000, 0x17c2, 0xfffffffe, 0x1, 0x80000000, 0x8, 0x7e54, 0x2, 0xe6, 0x9, 0x5b, 0x9, 0x2, 0x3, 0x1, 0xd25, 0x3, 0xa, 0x8, 0x0, 0xdd55, 0x6, 0x1, 0x400, 0x4, 0x8, 0xe8, 0x8bef, 0x4, 0x400, 0x2, 0x2, 0x1, 0x6, 0x3fb9, 0x7, 0x5, 0x4, 0x0, 0x62e0, 0x9, 0x4, 0x4]}]}]}}, @TCA_RATE={0x6, 0x5, {0x1, 0xff}}]}, 0x884}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x20, 0x2f, 0x9, 0x70bd25, 0x0, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @u32=0x2}, @typed={0x4, 0x1f}]}, 0x20}, 0x1, 0x0, 0x0, 0x42014}, 0x4080040) 1.34060093s ago: executing program 3 (id=13141): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.124204814s ago: executing program 0 (id=13142): r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) getsockname$packet(r0, 0x0, &(0x7f00000000c0)) 1.124073538s ago: executing program 1 (id=13143): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f00000002c0)) 1.123992669s ago: executing program 4 (id=13144): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@bridge_dellink={0x2c, 0x13, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r1, 0xa006}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x5, 0x0, 0x1, {0x4}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 1.038112542s ago: executing program 0 (id=13145): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x30, r1, 0x1, 0x4000, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0xc082}, 0x20004080) 1.014488899s ago: executing program 1 (id=13146): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e22, 0x10000009, @loopback, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f00000031c0)=[{&(0x7f0000002140)='$|', 0x2}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4040881) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f00000020c0)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000000e40)=""/4096, 0x1000, 0x0, 0x0}, &(0x7f0000002100)=0x40) 949.982663ms ago: executing program 3 (id=13147): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4001}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'syzkaller1\x00', {0x2, 0x0, @rand_addr=0x64010101}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', 0x1}) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0000080001031400e803140008004500005c000000004084b019640101026401010104d2270f00000000000000000600003c"], 0x6a) 924.199676ms ago: executing program 4 (id=13148): r0 = socket$nl_generic(0x10, 0x3, 0x10) close(0x3) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x4, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, 'macvlan1\x00'}}, 0x1e) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x8302, 0x0, 0x1, 0x70bd29, 0x4, {{}, {@val={0x8}, @void}}}, 0x5ea}, 0x1, 0x0, 0x0, 0x4804}, 0x80) 888.981555ms ago: executing program 1 (id=13149): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x80) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000070605000000000000000000010000020500010097"], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r0, &(0x7f000000c1c0)={0x0, 0x0, 0x0}, 0x20) 830.133819ms ago: executing program 2 (id=13150): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)={0x3c, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xffffffff}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1000}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x2a}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8004}, 0x80) 822.871384ms ago: executing program 0 (id=13151): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000400100004112200a4e2000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000580), 0x2000cc0, r0}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r0}, 0x38) 747.501853ms ago: executing program 4 (id=13152): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000000900010073797a300000000050000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d0c00098008000140ffffffff0800031b36000110140000001000010000000000000000000a84000a"], 0x98}}, 0x20050800) 605.993861ms ago: executing program 3 (id=13153): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448d4, &(0x7f0000000040)={0x3, 0x86, "407c0f", 0x4e, 0xfe}) 605.795803ms ago: executing program 2 (id=13154): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x5e, &(0x7f00000000c0)={@local, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x28, 0x3a, 0xff, @local, @remote, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @remote, @mcast2={0xe}}}}}}}, 0x0) 605.708599ms ago: executing program 4 (id=13155): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r3, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010000000000000000002300000008000300", @ANYRES32=r2], 0x2c}}, 0x0) 527.751903ms ago: executing program 1 (id=13156): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1, 0x4, 0x4, 0xa, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x7, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @alu={0x7, 0x1, 0xb, 0x2, 0xa}, @alu={0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc}, @call={0x85, 0x0, 0x0, 0x1}, @ldst={0x1, 0x0, 0x3, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 497.61736ms ago: executing program 2 (id=13157): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x24, 0x1, 0x1, 0x201, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x20d}]}, @CTA_TUPLE_ORIG={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x24008850) 358.613198ms ago: executing program 3 (id=13158): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000240)="a68770a2d4aa", 0x6, 0x24040001, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x400d}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000180)='veno', 0x4) shutdown(r0, 0x1) 325.752937ms ago: executing program 1 (id=13159): r0 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000140)="01154e000100001122334455892f", 0xe, 0x44011, &(0x7f0000000040)={0x11, 0xd, r1, 0x0, 0x0, 0x0}, 0x14) 218.832548ms ago: executing program 2 (id=13160): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x14, r1, 0x1, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x40080) 118.642551ms ago: executing program 0 (id=13161): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000d80), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x14, r1, 0x403, 0x70bd27, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x10000000}, 0x40) 118.435622ms ago: executing program 3 (id=13162): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002bbd700000100000010000000c00020009000000000000001c0007800c00018008000100", @ANYRES32=r0, @ANYBLOB="0c00018008000100", @ANYRES32=r0, @ANYBLOB="0c0005007de5"], 0x48}}, 0x400400c) 118.372236ms ago: executing program 4 (id=13163): syz_emit_ethernet(0x7e, &(0x7f0000000080)={@random="79ee7ca42eea", @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x48, 0x11, 0x0, @local, @mcast2, {[], {0x4e1d, 0x4e20, 0x48, 0x0, @wg=@cookie={0x3, 0x1, "dc521c259b538a2bf2a113dc2eeec0a072edf20b6d59027f", "d646c098cfc27eb8549d66e7b219c2c3b85e4508546e551af9e59631718ba089"}}}}}}}, 0x0) 118.301366ms ago: executing program 1 (id=13164): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000cc0)={0x24, 0x26, 0x109, 0x870bd23, 0xfffffffa, {0x2}, [@typed={0x8, 0x61, 0x0, 0x0, @pid}, @typed={0x8, 0x3, 0x0, 0x0, @binary='G\x00\x00\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x1000c957}, 0x600c800) 10.94863ms ago: executing program 2 (id=13165): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4055}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000001800)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 10.813817ms ago: executing program 4 (id=13166): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="480000000206050400000000000000000a00000005000100070000000900020073797a30000000000d000300686173683a6e6574000000000500040000000000050005000a"], 0x48}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000600)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {0xa}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @empty}}]}]}, 0x44}}, 0x0) 0s ago: executing program 0 (id=13167): r0 = socket$inet6(0xa, 0x3, 0xff) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x4, 0x340, 0xffffffff, 0x0, 0x1a0, 0x270, 0xffffffff, 0xffffffff, 0xd0, 0x1a0, 0x270, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x7, 0x5a0}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) syz_emit_ethernet(0x5a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x24, 0x6, 0x40, @private1, @mcast2, {[], {{0x4e22, 0x4e22, 0x1000, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0x3, 0x0, 0x0, {[@fastopen={0x22, 0xf, "4df7e10e8e27c73b0829c2c924"}]}}}}}}}}, 0x0) kernel console output (not intermixed with test programs): tooth: hci1: command tx timeout [ 1517.546361][T19499] netlink: 'syz.3.12111': attribute type 10 has an invalid length. [ 1517.871040][T19538] tipc: Enabled bearer , priority 0 [ 1518.145137][T19538] syzkaller0: mtu less than device minimum [ 1518.162801][T19430] bridge0: port 1(bridge_slave_0) entered blocking state [ 1518.162951][T19430] bridge0: port 1(bridge_slave_0) entered disabled state [ 1518.163143][T19430] bridge_slave_0: entered allmulticast mode [ 1518.165234][T19430] bridge_slave_0: entered promiscuous mode [ 1518.225214][T19430] bridge0: port 2(bridge_slave_1) entered blocking state [ 1518.225328][T19430] bridge0: port 2(bridge_slave_1) entered disabled state [ 1518.225500][T19430] bridge_slave_1: entered allmulticast mode [ 1518.251856][T19430] bridge_slave_1: entered promiscuous mode [ 1518.315215][T19430] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1518.329576][T19430] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1518.378196][T19430] team0: Port device team_slave_0 added [ 1518.381515][T19430] team0: Port device team_slave_1 added [ 1518.432035][T19430] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1518.432056][T19430] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1518.432085][T19430] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1518.435958][T19430] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1518.435977][T19430] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1518.436009][T19430] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1518.583527][T19430] hsr_slave_0: entered promiscuous mode [ 1518.584685][T19430] hsr_slave_1: entered promiscuous mode [ 1518.585469][T19430] debugfs: 'hsr0' already exists in 'hsr' [ 1518.585491][T19430] Cannot create hsr debugfs directory [ 1518.758393][T14322] Bluetooth: hci1: command tx timeout [ 1519.273937][T19430] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1519.273978][T19430] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1519.429063][T19571] openvswitch: netlink: Flow actions attr not present in new flow. [ 1520.063631][T19430] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1520.063673][T19430] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1520.201651][T19561] batadv2: left promiscuous mode [ 1520.448613][T19430] team0: Port device netdevsim1 removed [ 1520.450644][T19430] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1520.450682][T19430] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1520.839227][T14322] Bluetooth: hci1: command tx timeout [ 1521.308431][T19598] __nla_validate_parse: 31 callbacks suppressed [ 1521.308455][T19598] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12133'. [ 1522.018232][T19430] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1522.040849][T19430] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1522.043782][T19430] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1522.073040][T19430] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1522.076343][T19430] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1522.103011][T19430] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1522.106239][T19430] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1522.144938][T19430] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1522.204249][T14322] Bluetooth: hci3: connection err: -111 [ 1522.274022][T19615] syzkaller0: entered promiscuous mode [ 1522.274047][T19615] syzkaller0: entered allmulticast mode [ 1522.332323][T19615] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 1522.922255][T14322] Bluetooth: hci1: command tx timeout [ 1523.605092][T19644] batadv_slave_1: left promiscuous mode [ 1523.631449][T19644] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1523.631480][T19644] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1523.632974][T19644] veth1_vlan: left promiscuous mode [ 1523.634228][T19644] veth0_vlan: left promiscuous mode [ 1523.635946][T19644] veth0_vlan: entered promiscuous mode [ 1523.646838][T19644] veth1_vlan: entered promiscuous mode [ 1523.668712][T19644] veth1_macvtap: left promiscuous mode [ 1523.676682][T19644] veth1_macvtap: entered promiscuous mode [ 1523.727792][T19644] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1523.729848][T19644] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1523.731250][T19644] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1523.732611][T19644] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1523.735662][T19644] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1523.736352][T19644] A link change request failed with some changes committed already. Interface veth1_to_bod may have been left with an inconsistent configuration, please check. [ 1523.967708][T16690] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1523.967792][T16690] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1523.967954][T16690] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1523.968705][T16690] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1524.100686][T19430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1524.105480][T19666] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12147'. [ 1524.209558][T19669] netlink: zone id is out of range [ 1524.209577][T19669] netlink: zone id is out of range [ 1524.209588][T19669] netlink: zone id is out of range [ 1524.209598][T19669] netlink: zone id is out of range [ 1524.209608][T19669] netlink: zone id is out of range [ 1524.209618][T19669] netlink: zone id is out of range [ 1524.209632][T19669] netlink: zone id is out of range [ 1524.209642][T19669] netlink: zone id is out of range [ 1524.209652][T19669] netlink: zone id is out of range [ 1524.645049][T19666] dummy0: left promiscuous mode [ 1525.746031][T19666] netdevsim netdevsim1 netdevsim0: left allmulticast mode [ 1525.850539][T19666] ip6gre1: left allmulticast mode [ 1525.943136][T19666] erspan1: left allmulticast mode [ 1526.006548][T19666] vti0: left promiscuous mode [ 1526.059874][T19666] tipc: Resetting bearer [ 1526.082433][T19666] mac80211_hwsim hwsim108 syzkaller0: left promiscuous mode [ 1526.082455][T19666] mac80211_hwsim hwsim108 syzkaller0: left allmulticast mode [ 1526.209237][ T1001] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.209293][ T1001] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.209334][ T1001] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.278326][T19430] 8021q: adding VLAN 0 to HW filter on device team0 [ 1526.363265][T16693] bridge0: port 1(bridge_slave_0) entered blocking state [ 1526.363404][T16693] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1526.404573][T16693] bridge0: port 2(bridge_slave_1) entered blocking state [ 1526.404689][T16693] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1526.431939][T16685] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.554981][T19702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12155'. [ 1526.555015][T19702] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12155'. [ 1526.694117][T19709] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12156'. [ 1526.711403][T19709] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12156'. [ 1526.797097][T19705] lo speed is unknown, defaulting to 1000 [ 1527.163461][T19722] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12160'. [ 1527.163492][T19722] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12160'. [ 1527.189258][T19722] FAULT_INJECTION: forcing a failure. [ 1527.189258][T19722] name failslab, interval 1, probability 0, space 0, times 0 [ 1527.189294][T19722] CPU: 1 UID: 0 PID: 19722 Comm: syz.3.12160 Not tainted syzkaller #0 PREEMPT(full) [ 1527.189319][T19722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1527.189335][T19722] Call Trace: [ 1527.189345][T19722] [ 1527.189355][T19722] dump_stack_lvl+0xe8/0x150 [ 1527.189395][T19722] should_fail_ex+0x410/0x560 [ 1527.189427][T19722] ? __alloc_skb+0x1db/0x7a0 [ 1527.189455][T19722] should_failslab+0xa8/0x100 [ 1527.189486][T19722] ? __alloc_skb+0x1db/0x7a0 [ 1527.189511][T19722] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1527.189547][T19722] ? __alloc_skb+0x18d/0x7a0 [ 1527.189575][T19722] ? __alloc_skb+0x1db/0x7a0 [ 1527.189609][T19722] __alloc_skb+0x1db/0x7a0 [ 1527.189641][T19722] netlink_sendmsg+0x5d4/0xb40 [ 1527.189675][T19722] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1527.189707][T19722] ? apparmor_socket_sendmsg+0x98/0x360 [ 1527.189736][T19722] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1527.189765][T19722] sock_sendmsg_nosec+0x13a/0x180 [ 1527.189793][T19722] ____sys_sendmsg+0x54e/0x850 [ 1527.189830][T19722] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1527.189872][T19722] ? import_iovec+0x73/0xa0 [ 1527.189906][T19722] ___sys_sendmsg+0x2a5/0x360 [ 1527.189936][T19722] ? __lock_acquire+0x747/0x2de0 [ 1527.189966][T19722] ? __pfx____sys_sendmsg+0x10/0x10 [ 1527.190035][T19722] ? __fget_files+0x2a/0x420 [ 1527.190067][T19722] ? __fget_files+0x3a2/0x420 [ 1527.190110][T19722] __x64_sys_sendmsg+0x1b1/0x290 [ 1527.190145][T19722] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1527.190206][T19722] do_syscall_64+0x166/0x520 [ 1527.190235][T19722] ? trace_irq_disable+0x3b/0x140 [ 1527.190258][T19722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1527.190283][T19722] ? clear_bhb_loop+0x70/0xc0 [ 1527.190311][T19722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1527.190335][T19722] RIP: 0033:0x7f3cf0f9e159 [ 1527.190357][T19722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1527.190377][T19722] RSP: 002b:00007f3cf1eb9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1527.190402][T19722] RAX: ffffffffffffffda RBX: 00007f3cf1225fa0 RCX: 00007f3cf0f9e159 [ 1527.190420][T19722] RDX: 0000000000000000 RSI: 0000200000000e80 RDI: 0000000000000003 [ 1527.190436][T19722] RBP: 00007f3cf1eb9090 R08: 0000000000000000 R09: 0000000000000000 [ 1527.190450][T19722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1527.190465][T19722] R13: 00007f3cf1226038 R14: 00007f3cf1225fa0 R15: 00007ffd6017a9e8 [ 1527.190501][T19722] [ 1528.949972][T19728] netlink: 'syz.3.12162': attribute type 4 has an invalid length. [ 1529.201492][T19430] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1529.439074][T19430] veth0_vlan: entered promiscuous mode [ 1529.440736][T19741] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12165'. [ 1529.560154][T19430] veth1_vlan: entered promiscuous mode [ 1529.772945][T19430] veth0_macvtap: entered promiscuous mode [ 1529.803575][T19430] veth1_macvtap: entered promiscuous mode [ 1529.839710][T19430] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1529.878308][T19430] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1530.033064][T16690] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1530.033119][T16690] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1530.033158][T16690] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1530.033237][T19756] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12170'. [ 1530.035197][T19756] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12170'. [ 1530.036357][T19756] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12170'. [ 1530.251522][T16690] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1530.568772][T16685] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1530.568797][T16685] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1530.624990][T19770] syzkaller1: entered allmulticast mode [ 1530.676816][T16673] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1530.676842][T16673] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1531.104777][T19789] netdevsim netdevsim4 €Â: renamed from netdevsim0 (while UP) [ 1531.289338][T16673] IPVS: starting estimator thread 0... [ 1531.377315][T19803] IPVS: using max 29 ests per chain, 69600 per kthread [ 1531.473593][T19814] FAULT_INJECTION: forcing a failure. [ 1531.473593][T19814] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1531.473630][T19814] CPU: 1 UID: 0 PID: 19814 Comm: syz.2.12184 Not tainted syzkaller #0 PREEMPT(full) [ 1531.473656][T19814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1531.473671][T19814] Call Trace: [ 1531.473680][T19814] [ 1531.473691][T19814] dump_stack_lvl+0xe8/0x150 [ 1531.473731][T19814] should_fail_ex+0x410/0x560 [ 1531.473763][T19814] _copy_from_iter+0x1d3/0x1660 [ 1531.473804][T19814] ? __pfx__copy_from_iter+0x10/0x10 [ 1531.473829][T19814] ? __kmalloc_node_track_caller_noprof+0x2eb/0x720 [ 1531.473854][T19814] ? netlink_sendmsg+0x5d4/0xb40 [ 1531.473874][T19814] ? netlink_sendmsg+0x5d4/0xb40 [ 1531.473903][T19814] ? netlink_sendmsg+0x650/0xb40 [ 1531.473924][T19814] ? skb_put+0x112/0x210 [ 1531.473956][T19814] netlink_sendmsg+0x6c0/0xb40 [ 1531.473991][T19814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1531.474024][T19814] ? apparmor_socket_sendmsg+0x98/0x360 [ 1531.474053][T19814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1531.474075][T19814] sock_sendmsg_nosec+0x13a/0x180 [ 1531.474103][T19814] ____sys_sendmsg+0x54e/0x850 [ 1531.474140][T19814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1531.474183][T19814] ? import_iovec+0x73/0xa0 [ 1531.474216][T19814] ___sys_sendmsg+0x2a5/0x360 [ 1531.474246][T19814] ? __lock_acquire+0x747/0x2de0 [ 1531.474275][T19814] ? __pfx____sys_sendmsg+0x10/0x10 [ 1531.474345][T19814] ? __fget_files+0x2a/0x420 [ 1531.474376][T19814] ? __fget_files+0x3a2/0x420 [ 1531.474420][T19814] __x64_sys_sendmsg+0x1b1/0x290 [ 1531.474454][T19814] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1531.474509][T19814] do_syscall_64+0x166/0x520 [ 1531.474538][T19814] ? trace_irq_disable+0x3b/0x140 [ 1531.474567][T19814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.474591][T19814] ? clear_bhb_loop+0x70/0xc0 [ 1531.474619][T19814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.474643][T19814] RIP: 0033:0x7f4b6b79e159 [ 1531.474664][T19814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1531.474684][T19814] RSP: 002b:00007f4b6c6c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1531.474711][T19814] RAX: ffffffffffffffda RBX: 00007f4b6ba25fa0 RCX: 00007f4b6b79e159 [ 1531.474728][T19814] RDX: 0000000000000000 RSI: 0000200000000e80 RDI: 0000000000000003 [ 1531.474744][T19814] RBP: 00007f4b6c6c4090 R08: 0000000000000000 R09: 0000000000000000 [ 1531.474758][T19814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1531.474772][T19814] R13: 00007f4b6ba26038 R14: 00007f4b6ba25fa0 R15: 00007ffe7a955d68 [ 1531.474809][T19814] [ 1531.962877][T19821] net_ratelimit: 500 callbacks suppressed [ 1531.962902][T19821] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1532.263762][T19837] netlink: Failed to add helper -22 [ 1532.263826][T19837] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1532.462460][T19850] __nla_validate_parse: 7 callbacks suppressed [ 1532.462484][T19850] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12192'. [ 1532.464389][T19850] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12192'. [ 1532.699650][T19853] veth1_macvtap: left promiscuous mode [ 1532.699684][T19853] macsec0: entered promiscuous mode [ 1532.720682][T19857] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12195'. [ 1532.725995][T19853] veth1_macvtap: entered promiscuous mode [ 1532.737784][T19853] macsec0: left promiscuous mode [ 1532.754471][T19857] lo: entered promiscuous mode [ 1532.755026][T19857] tunl0: entered promiscuous mode [ 1532.755148][T19857] gre0: entered promiscuous mode [ 1532.755331][T19857] gretap0: entered promiscuous mode [ 1532.755449][T19857] erspan0: entered promiscuous mode [ 1532.755572][T19857] ip_vti0: entered promiscuous mode [ 1532.764291][T19857] ip6_vti0: entered promiscuous mode [ 1532.768964][T19857] sit0: entered promiscuous mode [ 1532.769437][T19857] ip6tnl0: entered promiscuous mode [ 1532.769804][T19857] ip6gre0: entered promiscuous mode [ 1532.806335][T19857] syz_tun: entered promiscuous mode [ 1532.813636][T19857] ip6gretap0: entered promiscuous mode [ 1532.831930][T19857] vcan0: entered promiscuous mode [ 1532.832103][T19857] team0: entered promiscuous mode [ 1532.832120][T19857] team_slave_0: entered promiscuous mode [ 1532.832339][T19857] team_slave_1: entered promiscuous mode [ 1532.832673][T19857] dummy0: entered promiscuous mode [ 1532.867746][T19857] nlmon0: entered promiscuous mode [ 1532.867942][T19857] veth0: entered promiscuous mode [ 1532.868102][T19857] veth1: entered promiscuous mode [ 1532.868258][T19857] wg0: entered promiscuous mode [ 1532.868498][T19857] wg1: entered promiscuous mode [ 1532.868648][T19857] wg2: entered promiscuous mode [ 1532.868799][T19857] veth0_to_bridge: entered promiscuous mode [ 1532.868971][T19857] bridge_slave_0: entered promiscuous mode [ 1532.869163][T19857] veth1_to_bridge: entered promiscuous mode [ 1532.869319][T19857] bridge_slave_1: entered promiscuous mode [ 1532.869483][T19857] veth0_to_bond: entered promiscuous mode [ 1532.869646][T19857] bond_slave_0: entered promiscuous mode [ 1532.869826][T19857] veth1_to_bond: entered promiscuous mode [ 1532.869992][T19857] bond_slave_1: entered promiscuous mode [ 1532.870144][T19857] veth0_to_team: entered promiscuous mode [ 1532.870452][T19857] veth1_to_team: entered promiscuous mode [ 1532.870759][T19857] veth1_to_batadv: entered promiscuous mode [ 1532.870913][T19857] batadv_slave_1: entered promiscuous mode [ 1532.871119][T19857] xfrm0: entered promiscuous mode [ 1532.871274][T19857] veth0_to_hsr: entered promiscuous mode [ 1532.871585][T19857] veth1_to_hsr: entered promiscuous mode [ 1532.872080][T19857] hsr0: entered promiscuous mode [ 1532.872250][T19857] veth1_virt_wifi: entered promiscuous mode [ 1532.872421][T19857] veth0_virt_wifi: entered promiscuous mode [ 1532.873448][T19857] virt_wifi0: entered promiscuous mode [ 1532.873885][T19857] vlan1: entered promiscuous mode [ 1532.874227][T19857] macvlan0: entered promiscuous mode [ 1532.874392][T19857] macvlan1: entered promiscuous mode [ 1532.874554][T19857] ipvlan0: entered promiscuous mode [ 1532.874773][T19857] ipvlan1: entered promiscuous mode [ 1532.875190][T19857] macvtap0: entered promiscuous mode [ 1532.875411][T19857] macsec0: entered promiscuous mode [ 1532.875534][T19857] geneve0: entered promiscuous mode [ 1532.875690][T19857] geneve1: entered promiscuous mode [ 1532.875858][T19857] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 1532.876027][T19857] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 1532.876155][T19857] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 1532.876301][T19857] netdevsim netdevsim1 netdevsim3: entered promiscuous mode [ 1532.876434][T19857] mac80211_hwsim hwsim107 wlan0: entered promiscuous mode [ 1532.876579][T19857] mac80211_hwsim hwsim108 wlan1: entered promiscuous mode [ 1532.876734][T19857] bridge1: entered promiscuous mode [ 1533.021755][T19857] veth2: entered promiscuous mode [ 1533.022403][T19857] veth3: entered promiscuous mode [ 1533.055504][T19857] mac80211_hwsim hwsim107 veth1_to_bod: entered promiscuous mode [ 1533.056051][T19857] veth4: entered promiscuous mode [ 1533.059500][T19857] veth5: entered promiscuous mode [ 1533.059662][T19857] gtp0: entered promiscuous mode [ 1533.067643][T19857] veth6: entered promiscuous mode [ 1533.070980][T19857] veth7: entered promiscuous mode [ 1533.101559][T19857] bond1: entered promiscuous mode [ 1533.104432][T19857] veth8: entered promiscuous mode [ 1533.118295][T19857] veth9: entered promiscuous mode [ 1533.118879][T19857] bridge0: entered promiscuous mode [ 1533.119312][T19857] veth10: entered promiscuous mode [ 1533.200723][T19857] veth11: entered promiscuous mode [ 1533.201344][T19857] sit1: entered promiscuous mode [ 1533.201774][T19857] veth12: entered promiscuous mode [ 1533.220073][T19857] veth13: entered promiscuous mode [ 1533.220273][T19857] sit2: entered promiscuous mode [ 1533.220414][T19857] veth14: entered promiscuous mode [ 1533.220575][T19857] veth15: entered promiscuous mode [ 1533.220721][T19857] xfrm1: entered promiscuous mode [ 1533.220880][T19857] veth16: entered promiscuous mode [ 1533.221066][T19857] veth17: entered promiscuous mode [ 1533.221218][T19857] veth18: entered promiscuous mode [ 1533.221376][T19857] veth19: entered promiscuous mode [ 1533.221569][T19857] veth20: entered promiscuous mode [ 1533.221718][T19857] veth21: entered promiscuous mode [ 1533.221878][T19857] syztnl2: entered promiscuous mode [ 1533.222007][T19857] wireguard0: entered promiscuous mode [ 1533.222161][T19857] syztnl1: entered promiscuous mode [ 1533.222287][T19857] ip6gre1: entered promiscuous mode [ 1533.222417][T19857] ip6gretap1: entered promiscuous mode [ 1533.222544][T19857] syztnl0: entered promiscuous mode [ 1533.222667][T19857] veth22: entered promiscuous mode [ 1533.222858][T19857] veth23: entered promiscuous mode [ 1533.223012][T19857] bridge2: entered promiscuous mode [ 1533.223151][T19857] mac80211_hwsim hwsim116 wlan2: entered promiscuous mode [ 1533.223298][T19857] bridge3: entered promiscuous mode [ 1533.223443][T19857] bond2: entered promiscuous mode [ 1533.223478][T19857] geneve2: entered promiscuous mode [ 1533.223838][T19857] bond3: entered promiscuous mode [ 1533.223998][T19857] bridge4: entered promiscuous mode [ 1533.224136][T19857] mac80211_hwsim hwsim119 wlan3: entered promiscuous mode [ 1533.224290][T19857] bridge5: entered promiscuous mode [ 1533.224430][T19857] bridge6: entered promiscuous mode [ 1533.224596][T19857] mac80211_hwsim hwsim120 wlan4: entered promiscuous mode [ 1533.224782][T19857] erspan1: entered promiscuous mode [ 1533.224905][T19857] bridge7: entered promiscuous mode [ 1533.225036][T19857] sit3: entered promiscuous mode [ 1533.225193][T19857] ip6erspan0: entered promiscuous mode [ 1533.225329][T19857] bridge8: entered promiscuous mode [ 1533.225459][T19857] vti0: entered promiscuous mode [ 1533.225614][T19857] ipvlan2: entered promiscuous mode [ 1533.225806][T19857] mac80211_hwsim hwsim108 syzkaller0: entered promiscuous mode [ 1533.225963][T19857] tun0: entered promiscuous mode [ 1533.226120][T19857] ipip0: entered promiscuous mode [ 1533.226276][T19857] bond4: entered promiscuous mode [ 1533.226443][T19857] veth24: entered promiscuous mode [ 1533.226599][T19857] veth25: entered promiscuous mode [ 1533.226753][T19857] ip6tnl1: entered promiscuous mode [ 1533.226877][T19857] bond5: entered promiscuous mode [ 1533.279466][T19857] vti1: entered promiscuous mode [ 1533.334515][T19857] bond6: entered promiscuous mode [ 1533.335024][T19857] veth26: entered promiscuous mode [ 1533.335593][T19857] veth27: entered promiscuous mode [ 1533.361808][T19857] ip6tnl2: entered promiscuous mode [ 1533.362326][T19857] erspan2: entered promiscuous mode [ 1533.364595][T19857] bridge9: entered promiscuous mode [ 1533.364974][T19857] macvlan2: entered promiscuous mode [ 1533.381079][T19857] gtp1: entered promiscuous mode [ 1533.381588][T19857] geneve3: entered promiscuous mode [ 1533.382022][T19857] ip6tnl3: entered promiscuous mode [ 1533.437706][T19857] mac80211_hwsim hwsim133 wlan5: entered promiscuous mode [ 1533.437884][T19857] mac80211_hwsim hwsim134 wlan6: entered promiscuous mode [ 1533.829345][T19877] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12202'. [ 1533.862047][T19886] netlink: 'syz.4.12198': attribute type 3 has an invalid length. [ 1533.934479][T16690] nci: nci_rf_intf_activated_ntf_packet: unsupported rf_interface 0x2c [ 1534.002621][T19892] netlink: 15231 bytes leftover after parsing attributes in process `syz.0.12202'. [ 1534.231293][T19897] openvswitch: netlink: IPv4 frag type 228 is out of range max 2 [ 1534.310986][T19897] netlink: 'syz.2.12199': attribute type 11 has an invalid length. [ 1534.311012][T19897] netlink: 4320 bytes leftover after parsing attributes in process `syz.2.12199'. [ 1534.341737][T19899] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12203'. [ 1534.430954][T19892] lo speed is unknown, defaulting to 1000 [ 1534.475803][T19899] netlink: 7 bytes leftover after parsing attributes in process `syz.3.12203'. [ 1534.641612][T19902] can: request_module (can-proto-3) failed. [ 1534.853591][T19911] netlink: 'syz.3.12207': attribute type 1 has an invalid length. [ 1534.951274][T19911] bond1: entered promiscuous mode [ 1534.951775][T19911] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1535.068805][T19917] netlink: 'syz.1.12209': attribute type 39 has an invalid length. [ 1535.967952][T19432] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1535.986002][T19432] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1535.998822][T19432] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1536.014790][T19432] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1536.026610][T19432] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1536.402806][T19953] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12218'. [ 1536.402838][T19953] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12218'. [ 1536.494948][T19958] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1536.658289][T19967] netlink: 'syz.3.12222': attribute type 32 has an invalid length. [ 1536.688766][T19968] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1536.829260][T19972] netlink: 'syz.3.12225': attribute type 11 has an invalid length. [ 1537.055348][T19974] syzkaller0: entered promiscuous mode [ 1537.055377][T19974] syzkaller0: entered allmulticast mode [ 1538.127443][T14322] Bluetooth: hci4: command tx timeout [ 1540.213846][T14322] Bluetooth: hci4: command tx timeout [ 1542.218743][T19937] lo speed is unknown, defaulting to 1000 [ 1542.277630][T14322] Bluetooth: hci4: command tx timeout [ 1542.939468][T20019] __nla_validate_parse: 5 callbacks suppressed [ 1542.939490][T20019] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12237'. [ 1543.274709][T20028] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12238'. [ 1543.274742][T20028] netlink: 20 bytes leftover after parsing attributes in process `syz.4.12238'. [ 1543.306427][T20028] FAULT_INJECTION: forcing a failure. [ 1543.306427][T20028] name failslab, interval 1, probability 0, space 0, times 0 [ 1543.306465][T20028] CPU: 0 UID: 0 PID: 20028 Comm: syz.4.12238 Not tainted syzkaller #0 PREEMPT(full) [ 1543.306491][T20028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1543.306506][T20028] Call Trace: [ 1543.306516][T20028] [ 1543.306527][T20028] dump_stack_lvl+0xe8/0x150 [ 1543.306567][T20028] should_fail_ex+0x410/0x560 [ 1543.306600][T20028] should_failslab+0xa8/0x100 [ 1543.306630][T20028] ? skb_clone+0x212/0x3a0 [ 1543.306664][T20028] kmem_cache_alloc_noprof+0xa1/0x600 [ 1543.306701][T20028] ? skb_clone+0x212/0x3a0 [ 1543.306740][T20028] skb_clone+0x212/0x3a0 [ 1543.306770][T20028] ? nfnetlink_rcv+0x4b0/0x28c0 [ 1543.306806][T20028] nfnetlink_rcv+0x4de/0x28c0 [ 1543.306847][T20028] ? __dev_queue_xmit+0x29b/0x3820 [ 1543.306891][T20028] ? __local_bh_enable_ip+0xd6/0x140 [ 1543.306951][T20028] ? lockdep_hardirqs_on+0x7b/0x110 [ 1543.306981][T20028] ? __dev_queue_xmit+0x29b/0x3820 [ 1543.307014][T20028] ? __local_bh_enable_ip+0xd6/0x140 [ 1543.307043][T20028] ? __dev_queue_xmit+0x29b/0x3820 [ 1543.307076][T20028] ? __dev_queue_xmit+0x1edc/0x3820 [ 1543.307124][T20028] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1543.307181][T20028] ? __copy_skb_header+0xa3/0x4a0 [ 1543.307236][T20028] ? skb_clone+0x246/0x3a0 [ 1543.307272][T20028] ? __netlink_deliver_tap+0x681/0x6e0 [ 1543.307306][T20028] ? netlink_deliver_tap+0x2e/0x1b0 [ 1543.307349][T20028] ? netlink_deliver_tap+0x2e/0x1b0 [ 1543.307384][T20028] ? netlink_deliver_tap+0x2e/0x1b0 [ 1543.307425][T20028] netlink_unicast+0x7bd/0x940 [ 1543.307471][T20028] netlink_sendmsg+0x813/0xb40 [ 1543.307504][T20028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1543.307536][T20028] ? apparmor_socket_sendmsg+0x98/0x360 [ 1543.307566][T20028] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1543.307588][T20028] sock_sendmsg_nosec+0x13a/0x180 [ 1543.307614][T20028] ____sys_sendmsg+0x54e/0x850 [ 1543.307652][T20028] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1543.307694][T20028] ? import_iovec+0x73/0xa0 [ 1543.307727][T20028] ___sys_sendmsg+0x2a5/0x360 [ 1543.307758][T20028] ? __lock_acquire+0x747/0x2de0 [ 1543.307787][T20028] ? __pfx____sys_sendmsg+0x10/0x10 [ 1543.307859][T20028] ? __fget_files+0x2a/0x420 [ 1543.307890][T20028] ? __fget_files+0x3a2/0x420 [ 1543.307941][T20028] __x64_sys_sendmsg+0x1b1/0x290 [ 1543.307977][T20028] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1543.308033][T20028] do_syscall_64+0x166/0x520 [ 1543.308062][T20028] ? trace_irq_disable+0x3b/0x140 [ 1543.308085][T20028] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1543.308109][T20028] ? clear_bhb_loop+0x70/0xc0 [ 1543.308138][T20028] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1543.308162][T20028] RIP: 0033:0x7f94fbd9e159 [ 1543.308185][T20028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1543.308205][T20028] RSP: 002b:00007f94fcd4a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1543.308230][T20028] RAX: ffffffffffffffda RBX: 00007f94fc025fa0 RCX: 00007f94fbd9e159 [ 1543.308248][T20028] RDX: 0000000000000000 RSI: 0000200000000e80 RDI: 0000000000000003 [ 1543.308263][T20028] RBP: 00007f94fcd4a090 R08: 0000000000000000 R09: 0000000000000000 [ 1543.308278][T20028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1543.308292][T20028] R13: 00007f94fc026038 R14: 00007f94fc025fa0 R15: 00007fffdd34e5a8 [ 1543.308330][T20028] [ 1544.161398][T20047] ip_tables: iptables: counters copy to user failed while replacing table [ 1544.281328][T19937] bridge0: port 1(bridge_slave_0) entered blocking state [ 1544.281531][T19937] bridge0: port 1(bridge_slave_0) entered disabled state [ 1544.282034][T19937] bridge_slave_0: entered allmulticast mode [ 1544.284132][T19937] bridge_slave_0: entered promiscuous mode [ 1544.323358][T19937] bridge0: port 2(bridge_slave_1) entered blocking state [ 1544.323541][T19937] bridge0: port 2(bridge_slave_1) entered disabled state [ 1544.323997][T19937] bridge_slave_1: entered allmulticast mode [ 1544.326090][T19937] bridge_slave_1: entered promiscuous mode [ 1544.370456][T14322] Bluetooth: hci4: command tx timeout [ 1544.404383][T19937] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1544.418382][T19937] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1544.516797][T19937] team0: Port device team_slave_0 added [ 1544.542725][T19937] team0: Port device team_slave_1 added [ 1544.623251][T19937] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1544.623285][T19937] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1544.623316][T19937] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1544.625449][T19937] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1544.625467][T19937] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1544.625498][T19937] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1544.790867][T19937] hsr_slave_0: entered promiscuous mode [ 1544.791950][T19937] hsr_slave_1: entered promiscuous mode [ 1544.792736][T19937] debugfs: 'hsr0' already exists in 'hsr' [ 1544.792758][T19937] Cannot create hsr debugfs directory [ 1545.118013][T20062] ip_tables: iptables: counters copy to user failed while replacing table [ 1545.609382][T20062] bond0 (unregistering): Released all slaves [ 1546.112527][T20078] netlink: 'syz.3.12246': attribute type 1 has an invalid length. [ 1546.196617][T20078] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1546.451392][T20086] macsec2: entered promiscuous mode [ 1546.451420][T20086] bridge0: entered promiscuous mode [ 1546.616178][T20099] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12249'. [ 1546.669866][T20098] veth1_macvtap: left promiscuous mode [ 1547.361656][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.361984][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.362270][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.362550][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.362839][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.415594][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.415943][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.416221][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1547.416501][T20130] netlink: 'syz.4.12257': attribute type 3 has an invalid length. [ 1548.057972][T20159] FAULT_INJECTION: forcing a failure. [ 1548.057972][T20159] name failslab, interval 1, probability 0, space 0, times 0 [ 1548.058012][T20159] CPU: 0 UID: 0 PID: 20159 Comm: syz.4.12262 Not tainted syzkaller #0 PREEMPT(full) [ 1548.058045][T20159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1548.058057][T20159] Call Trace: [ 1548.058065][T20159] [ 1548.058075][T20159] dump_stack_lvl+0xe8/0x150 [ 1548.058115][T20159] should_fail_ex+0x410/0x560 [ 1548.058146][T20159] ? __alloc_skb+0x1db/0x7a0 [ 1548.058175][T20159] should_failslab+0xa8/0x100 [ 1548.058205][T20159] ? __alloc_skb+0x1db/0x7a0 [ 1548.058231][T20159] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1548.058265][T20159] ? __alloc_skb+0x18d/0x7a0 [ 1548.058294][T20159] ? __alloc_skb+0x1db/0x7a0 [ 1548.058328][T20159] __alloc_skb+0x1db/0x7a0 [ 1548.058361][T20159] wireless_send_event+0x2a1/0xc10 [ 1548.058429][T20159] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 1548.058532][T20159] ? __pfx_wireless_send_event+0x10/0x10 [ 1548.058571][T20159] ioctl_standard_call+0x125/0x160 [ 1548.058595][T20159] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 1548.058628][T20159] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1548.058654][T20159] ? __pfx_cfg80211_wext_siwfreq+0x10/0x10 [ 1548.058686][T20159] wext_ioctl_dispatch+0xee/0x410 [ 1548.058709][T20159] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1548.058737][T20159] wext_handle_ioctl+0x110/0x1d0 [ 1548.058762][T20159] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1548.058784][T20159] ? hook_file_ioctl+0x1f2/0x600 [ 1548.058831][T20159] sock_ioctl+0x159/0x7e0 [ 1548.058871][T20159] ? __pfx_sock_ioctl+0x10/0x10 [ 1548.058906][T20159] ? __fget_files+0x2a/0x420 [ 1548.058938][T20159] ? __fget_files+0x3a2/0x420 [ 1548.058969][T20159] ? __fget_files+0x2a/0x420 [ 1548.059004][T20159] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1548.059045][T20159] ? __pfx_sock_ioctl+0x10/0x10 [ 1548.059081][T20159] __se_sys_ioctl+0xfc/0x170 [ 1548.059110][T20159] do_syscall_64+0x166/0x520 [ 1548.059139][T20159] ? trace_irq_disable+0x3b/0x140 [ 1548.059162][T20159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.059187][T20159] ? clear_bhb_loop+0x70/0xc0 [ 1548.059216][T20159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.059240][T20159] RIP: 0033:0x7f94fbd9e159 [ 1548.059262][T20159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1548.059283][T20159] RSP: 002b:00007f94fcd4a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1548.059309][T20159] RAX: ffffffffffffffda RBX: 00007f94fc025fa0 RCX: 00007f94fbd9e159 [ 1548.059328][T20159] RDX: 0000200000000040 RSI: 0000000000008b04 RDI: 0000000000000004 [ 1548.059343][T20159] RBP: 00007f94fcd4a090 R08: 0000000000000000 R09: 0000000000000000 [ 1548.059358][T20159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1548.059372][T20159] R13: 00007f94fc026038 R14: 00007f94fc025fa0 R15: 00007fffdd34e5a8 [ 1548.059410][T20159] [ 1548.382642][T20164] syzkaller0: entered promiscuous mode [ 1548.382670][T20164] syzkaller0: entered allmulticast mode [ 1548.603800][T19937] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1548.621214][T19937] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1548.660386][T19937] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1548.674521][T19937] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1548.689269][T19937] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1548.732319][T19937] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1548.750283][T19937] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1548.816448][T19937] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1549.274181][T20204] tipc: Started in network mode [ 1549.274218][T20204] tipc: Node identity aaaaaaaaaa3a, cluster identity 4711 [ 1549.274504][T20204] tipc: Enabled bearer , priority 7 [ 1549.440113][T19937] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1549.569668][T19937] 8021q: adding VLAN 0 to HW filter on device team0 [ 1549.625873][T16673] bridge0: port 1(bridge_slave_0) entered blocking state [ 1549.626017][T16673] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1549.704604][ T1001] bridge0: port 2(bridge_slave_1) entered blocking state [ 1549.704717][ T1001] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1550.284578][ T5278] veth1_macvtap: entered promiscuous mode [ 1550.407614][T20244] netlink: 32 bytes leftover after parsing attributes in process `syz.3.12274'. [ 1550.464994][T12155] tipc: Node number set to 9480874 [ 1550.764202][T20249] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12275'. [ 1550.872043][T20264] netlink: 52 bytes leftover after parsing attributes in process `syz.0.12278'. [ 1550.872086][T20264] netlink: 48 bytes leftover after parsing attributes in process `syz.0.12278'. [ 1550.937106][T20265] netlink: 132 bytes leftover after parsing attributes in process `syz.0.12278'. [ 1551.384802][T20284] validate_nla: 24 callbacks suppressed [ 1551.384825][T20284] netlink: 'syz.0.12279': attribute type 1 has an invalid length. [ 1552.022599][T20303] netlink: 'syz.2.12281': attribute type 10 has an invalid length. [ 1552.158720][T20303] team0 (unregistering): Port device team_slave_0 removed [ 1552.371185][T20303] team0 (unregistering): Port device team_slave_1 removed [ 1552.419541][T19937] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1552.634126][T19937] veth0_vlan: entered promiscuous mode [ 1552.685417][T19937] veth1_vlan: entered promiscuous mode [ 1552.854588][T19937] veth0_macvtap: entered promiscuous mode [ 1552.856754][T20327] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1552.874405][T19937] veth1_macvtap: entered promiscuous mode [ 1552.954850][T19937] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1552.972858][T20327] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1552.999645][T19937] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1553.040105][T16693] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.058634][T17494] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.063541][ T1030] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.105080][T20330] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1553.167789][ T1001] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.454129][T17494] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1553.454188][T17494] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1553.552711][T17494] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1553.552736][T17494] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1553.994024][T20361] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1554.144112][T20374] netlink: 124 bytes leftover after parsing attributes in process `syz.2.12296'. [ 1554.144142][T20374] openvswitch: netlink: Flow key attr not present in new flow. [ 1554.150768][T20365] tipc: Enabling of bearer rejected, failed to enable media [ 1554.253024][T20361] xt_CT: No such helper "netbios-ns" [ 1554.352923][T20359] 0: reclassify loop, rule prio 0, protocol 03 [ 1554.380663][T20359] netlink: 'syz.1.12294': attribute type 2 has an invalid length. [ 1554.446032][T20359] : entered promiscuous mode [ 1554.575753][T20386] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1554.671487][T20400] --map-set only usable from mangle table [ 1554.759954][T20404] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12302'. [ 1554.779049][T20404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12302'. [ 1554.983987][T20411] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 1555.348697][T20432] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12311'. [ 1555.369860][T20418] netlink: 'syz.0.12306': attribute type 1 has an invalid length. [ 1555.423774][T20418] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1555.472989][T20422] bond0: (slave veth23): Enslaving as an active interface with a down link [ 1555.514678][T20418] netlink: 40 bytes leftover after parsing attributes in process `syz.0.12306'. [ 1555.614849][T20440] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12312'. [ 1555.614880][T20440] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12312'. [ 1555.668495][T20441] netlink: 100 bytes leftover after parsing attributes in process `syz.4.12313'. [ 1555.762326][T20444] only policy match revision 0 supported [ 1555.762342][T20444] unable to load match [ 1555.823895][T20450] netlink: 'syz.0.12314': attribute type 23 has an invalid length. [ 1556.259005][T20465] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12319'. [ 1556.259042][T20465] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12319'. [ 1556.319178][T20466] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1556.655094][T20481] syzkaller1: entered promiscuous mode [ 1556.655134][T20481] syzkaller1: entered allmulticast mode [ 1556.691273][T20484] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12325'. [ 1556.691315][T20484] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12325'. [ 1556.920332][T20493] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12327'. [ 1556.920363][T20493] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12327'. [ 1560.956375][T20634] __nla_validate_parse: 6 callbacks suppressed [ 1560.956398][T20634] netlink: 32 bytes leftover after parsing attributes in process `syz.4.12363'. [ 1561.080495][T20640] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1561.081174][T20639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1561.118680][T20640] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1561.118825][T20639] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1561.119051][T20632] tc_dump_action: action bad kind [ 1561.163167][T20638] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12365'. [ 1561.408826][T20645] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12367'. [ 1561.408858][T20645] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12367'. [ 1561.725069][T20653] netlink: 'syz.1.12370': attribute type 1 has an invalid length. [ 1561.856626][T20653] bond1: entered promiscuous mode [ 1561.863503][T20653] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1562.062372][T20678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1562.085956][T20678] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1562.110534][T20672] sctp_setsockopt_maxseg: 24 callbacks suppressed [ 1562.110562][T20672] sctp: [Deprecated]: syz.3.12373 (pid 20672) Use of int in maxseg socket option. [ 1562.110562][T20672] Use struct sctp_assoc_value instead [ 1562.552896][T20699] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12377'. [ 1562.651040][T20699] lo: entered promiscuous mode [ 1562.720974][T20699] tunl0: entered promiscuous mode [ 1562.726493][T20699] gre0: entered promiscuous mode [ 1563.399812][T20699] 0ªî{X¹¦: entered promiscuous mode [ 1563.460196][T20699] erspan0: entered promiscuous mode [ 1563.462930][T20699] ip_vti0: entered promiscuous mode [ 1563.529024][T20699] ip6_vti0: entered promiscuous mode [ 1563.545563][T20699] sit0: entered promiscuous mode [ 1563.585235][T20699] ip6tnl0: entered promiscuous mode [ 1563.678717][T20699] ip6gre0: entered promiscuous mode [ 1563.711064][T20699] ip6gretap0: entered promiscuous mode [ 1563.762589][T20699] dummy0: entered promiscuous mode [ 1563.787645][T20699] nlmon0: entered promiscuous mode [ 1563.814906][T20699] veth0: entered promiscuous mode [ 1563.835121][T20699] veth1: entered promiscuous mode [ 1564.108982][T20720] IPVS: set_ctl: invalid protocol: 135 172.20.20.187:20001 [ 1564.109411][T20720] TCP: tcp_parse_options: Illegal window scaling value 81 > 14 received [ 1564.718638][T20699] wg0: entered promiscuous mode [ 1564.865117][T20729] netlink: 524 bytes leftover after parsing attributes in process `syz.0.12385'. [ 1564.894540][T20699] wg2: entered promiscuous mode [ 1564.906520][T20699] veth0_to_bridge: entered promiscuous mode [ 1564.924677][T20699] bridge_slave_0: entered promiscuous mode [ 1564.959851][T20699] veth1_to_bridge: entered promiscuous mode [ 1564.998284][T20699] bridge_slave_1: entered promiscuous mode [ 1565.018744][T20699] veth0_to_bond: entered promiscuous mode [ 1565.120402][T20699] bond_slave_0: entered promiscuous mode [ 1565.154937][T20699] veth1_to_bond: entered promiscuous mode [ 1565.236885][T20699] bond_slave_1: entered promiscuous mode [ 1565.315735][T20699] veth0_to_team: entered promiscuous mode [ 1565.390505][T20699] team_slave_0: entered promiscuous mode [ 1565.458039][T20699] veth1_to_team: entered promiscuous mode [ 1565.541704][T20699] team_slave_1: entered promiscuous mode [ 1565.586218][T20699] veth0_to_batadv: entered promiscuous mode [ 1565.623378][T20699] batadv_slave_0: entered promiscuous mode [ 1565.655059][T20699] veth1_to_batadv: entered promiscuous mode [ 1565.711162][T20699] batadv_slave_1: entered promiscuous mode [ 1565.814562][T20699] xfrm0: entered promiscuous mode [ 1565.918982][T20699] veth0_to_hsr: entered promiscuous mode [ 1565.993687][T20699] veth1_to_hsr: entered promiscuous mode [ 1566.067450][T20699] hsr0: entered promiscuous mode [ 1566.135071][T20699] vlan1: entered promiscuous mode [ 1566.166489][T20699] macvlan0: entered promiscuous mode [ 1566.204912][T20699] macvlan1: entered promiscuous mode [ 1566.222538][T20699] ipvlan0: entered promiscuous mode [ 1566.248366][T20699] ipvlan1: entered promiscuous mode [ 1566.296792][T20699] veth0_macvtap: entered promiscuous mode [ 1566.323903][T20699] macsec0: entered promiscuous mode [ 1566.352626][T20699] geneve0: entered promiscuous mode [ 1566.378435][T20699] geneve1: entered promiscuous mode [ 1566.406441][T20699] netdevsim netdevsim4 netdevsim1: entered promiscuous mode [ 1566.450780][T20699] netdevsim netdevsim4 netdevsim2: entered promiscuous mode [ 1566.469210][T20699] netdevsim netdevsim4 netdevsim3: entered promiscuous mode [ 1566.485552][T20699] mac80211_hwsim hwsim112 wlan1: entered promiscuous mode [ 1566.494669][T20699] bond1: entered promiscuous mode [ 1566.509339][T20699] mac80211_hwsim hwsim111 veth1_to_bod: entered promiscuous mode [ 1566.509538][T20699] veth2: entered promiscuous mode [ 1566.509710][T20699] veth3: entered promiscuous mode [ 1566.509868][T20699] veth4: entered promiscuous mode [ 1566.510029][T20699] veth5: entered promiscuous mode [ 1566.510217][T20699] veth6: entered promiscuous mode [ 1566.511928][T20699] veth7: entered promiscuous mode [ 1566.512104][T20699] veth8: entered promiscuous mode [ 1566.512307][T20699] veth9: entered promiscuous mode [ 1566.512473][T20699] syztnl2: entered promiscuous mode [ 1566.512601][T20699] gre1: entered promiscuous mode [ 1566.512725][T20699] gtp0: entered promiscuous mode [ 1566.512880][T20699] sit1: entered promiscuous mode [ 1566.513205][T20699] bridge_slave_1.: entered promiscuous mode [ 1566.621131][T20699] mac80211_hwsim hwsim114 wlan2: entered promiscuous mode [ 1566.621354][T20699] ip6gre1: entered promiscuous mode [ 1566.621487][T20699] ipip0: entered promiscuous mode [ 1566.621645][T20699] gre2: entered promiscuous mode [ 1566.621761][T20699] vrf0: entered promiscuous mode [ 1566.621910][T20699] L: entered promiscuous mode [ 1566.622043][T20699] veth10: entered promiscuous mode [ 1566.623747][T20699] veth11: entered promiscuous mode [ 1566.623904][T20699] veth12: entered promiscuous mode [ 1566.624066][T20699] veth13: entered promiscuous mode [ 1566.624248][T20699] vxlan0: entered promiscuous mode [ 1566.624412][T20699] ipip1: entered promiscuous mode [ 1566.624533][T20699] gre3: entered promiscuous mode [ 1566.624656][T20699] bond2: entered promiscuous mode [ 1566.624784][T20699] macsec1: entered promiscuous mode [ 1566.624947][T20699] mac80211_hwsim hwsim123 wlan0: entered promiscuous mode [ 1566.626632][T20699] ipip2: entered promiscuous mode [ 1566.626795][T20699] bond3: entered promiscuous mode [ 1566.626811][T20699] geneve2: entered promiscuous mode [ 1566.668271][T20699] bridge1: entered promiscuous mode [ 1566.670889][T20699] vlan0: entered promiscuous mode [ 1566.671960][T20699] bridge3: entered promiscuous mode [ 1566.676517][T20699] vlan0004: entered promiscuous mode [ 1566.749579][T20699] ip6gretap1: entered promiscuous mode [ 1566.750015][T20699] sit2: entered promiscuous mode [ 1566.750230][T20699] mac80211_hwsim hwsim127 wlan3: entered promiscuous mode [ 1566.756470][T20699] mac80211_hwsim hwsim128 wlan4: entered promiscuous mode [ 1566.771191][T20699] vxcan2: entered promiscuous mode [ 1566.771719][T20699] vxcan3: entered promiscuous mode [ 1566.772118][T20699] syztnl0: entered promiscuous mode [ 1566.948805][T17528] netdevsim netdevsim4 €Â: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1566.948862][T17528] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1566.948904][T17528] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1566.948944][T17528] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.030913][T20740] tap0: tun_chr_ioctl cmd 1074025677 [ 1567.031045][T20740] tap0: linktype set to 776 [ 1567.065562][T20748] lo speed is unknown, defaulting to 1000 [ 1567.111358][T20766] __nla_validate_parse: 2 callbacks suppressed [ 1567.111385][T20766] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12391'. [ 1567.179461][T20772] netlink: 32 bytes leftover after parsing attributes in process `syz.4.12392'. [ 1567.247147][T20779] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12393'. [ 1567.247204][T20779] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12393'. [ 1567.254383][T20772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12392'. [ 1567.318933][T20782] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1567.635694][T20782] xt_CT: No such helper "netbios-ns" [ 1567.805840][T20771] udevd[20771]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1567.836193][T20771] udevd[20771]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1567.919433][T20797] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12396'. [ 1569.015673][T20833] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12404'. [ 1569.401712][T20825] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1569.571902][T20833] gtp0: entered promiscuous mode [ 1569.571928][T20833] gtp0: entered allmulticast mode [ 1569.605599][T20847] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12405'. [ 1569.605631][T20847] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12405'. [ 1569.959561][T20825] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1570.210009][T20825] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1570.474263][T20825] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1570.721878][T20888] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12414'. [ 1571.457556][T17522] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.548238][T17522] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.700531][T17522] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.757077][T17531] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.825650][T20939] openvswitch: netlink: Tunnel attr 15884 out of range max 16 [ 1572.037423][T20953] C: renamed from veth1_to_team (while UP) [ 1572.087878][T20942] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1572.139578][T20956] __nla_validate_parse: 8 callbacks suppressed [ 1572.139600][T20956] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12428'. [ 1572.301614][T17522] IPVS: starting estimator thread 0... [ 1572.316308][T20963] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 1572.417115][T20965] IPVS: using max 25 ests per chain, 60000 per kthread [ 1572.632899][T20953] netlink: 128 bytes leftover after parsing attributes in process `syz.1.12426'. [ 1573.068394][T20974] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12431'. [ 1573.068429][T20974] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12431'. [ 1573.220865][T20981] netlink: 84 bytes leftover after parsing attributes in process `syz.4.12435'. [ 1573.272280][T20984] netlink: 844 bytes leftover after parsing attributes in process `syz.1.12437'. [ 1573.272309][T20984] netlink: 844 bytes leftover after parsing attributes in process `syz.1.12437'. [ 1573.309031][T20986] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12436'. [ 1573.309064][T20986] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12436'. [ 1573.310853][T20981] pim6reg0: tun_chr_ioctl cmd 35111 [ 1573.469503][T20992] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12438'. [ 1573.696502][T21002] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 1573.767956][T21002] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 1574.301419][T21010] syzkaller0: entered promiscuous mode [ 1574.301446][T21010] syzkaller0: entered allmulticast mode [ 1574.339468][T21013] syzkaller0: entered promiscuous mode [ 1574.339495][T21013] syzkaller0: entered allmulticast mode [ 1574.512922][T21024] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1574.669004][T21017] IPv6: sit1: Disabled Multicast RS [ 1575.112633][T21031] netlink: 'syz.3.12448': attribute type 12 has an invalid length. [ 1575.112663][T21031] netlink: 'syz.3.12448': attribute type 29 has an invalid length. [ 1575.164608][T21037] netlink: 'syz.4.12450': attribute type 26 has an invalid length. [ 1575.615327][T21054] syzkaller0: entered promiscuous mode [ 1575.615386][T21054] syzkaller0: entered allmulticast mode [ 1576.422236][T21077] FAULT_INJECTION: forcing a failure. [ 1576.422236][T21077] name failslab, interval 1, probability 0, space 0, times 0 [ 1576.422274][T21077] CPU: 1 UID: 0 PID: 21077 Comm: syz.4.12464 Not tainted syzkaller #0 PREEMPT(full) [ 1576.422300][T21077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1576.422315][T21077] Call Trace: [ 1576.422325][T21077] [ 1576.422335][T21077] dump_stack_lvl+0xe8/0x150 [ 1576.422377][T21077] should_fail_ex+0x410/0x560 [ 1576.422410][T21077] should_failslab+0xa8/0x100 [ 1576.422444][T21077] __kmalloc_cache_noprof+0xa3/0x600 [ 1576.422469][T21077] ? nft_delrule+0x58/0xba0 [ 1576.422505][T21077] ? nft_delrule+0x58/0xba0 [ 1576.422545][T21077] nft_delrule+0x58/0xba0 [ 1576.422582][T21077] ? lock_acquire+0x115/0x350 [ 1576.422627][T21077] nft_flush_table+0x29c/0x1d40 [ 1576.422664][T21077] ? nft_pernet+0x23/0x240 [ 1576.422696][T21077] ? nft_pernet+0x23/0x240 [ 1576.422723][T21077] ? nft_pernet+0x23/0x240 [ 1576.422760][T21077] nf_tables_deltable+0x5d2/0xe80 [ 1576.422787][T21077] ? nft_pernet+0x23/0x240 [ 1576.422826][T21077] ? __pfx_nf_tables_deltable+0x10/0x10 [ 1576.422855][T21077] ? nfnl_pernet+0x23/0x240 [ 1576.422899][T21077] ? __nla_parse+0x40/0x60 [ 1576.422935][T21077] nfnetlink_rcv+0x1288/0x28c0 [ 1576.423005][T21077] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1576.423094][T21077] ? lock_acquire+0x115/0x350 [ 1576.423130][T21077] ? netlink_deliver_tap+0x2e/0x1b0 [ 1576.423167][T21077] ? netlink_deliver_tap+0x2e/0x1b0 [ 1576.423210][T21077] netlink_unicast+0x7bd/0x940 [ 1576.423257][T21077] netlink_sendmsg+0x813/0xb40 [ 1576.423291][T21077] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1576.423322][T21077] ? apparmor_socket_sendmsg+0x98/0x360 [ 1576.423350][T21077] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1576.423370][T21077] sock_sendmsg_nosec+0x13a/0x180 [ 1576.423399][T21077] ____sys_sendmsg+0x54e/0x850 [ 1576.423435][T21077] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1576.423476][T21077] ? import_iovec+0x73/0xa0 [ 1576.423510][T21077] ___sys_sendmsg+0x2a5/0x360 [ 1576.423540][T21077] ? __lock_acquire+0x747/0x2de0 [ 1576.423570][T21077] ? __pfx____sys_sendmsg+0x10/0x10 [ 1576.423651][T21077] ? __fget_files+0x2a/0x420 [ 1576.423684][T21077] ? __fget_files+0x3a2/0x420 [ 1576.423728][T21077] __x64_sys_sendmsg+0x1b1/0x290 [ 1576.423764][T21077] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1576.423821][T21077] do_syscall_64+0x166/0x520 [ 1576.423850][T21077] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1576.423873][T21077] ? clear_bhb_loop+0x70/0xc0 [ 1576.423911][T21077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1576.423932][T21077] RIP: 0033:0x7f94fbd9e159 [ 1576.423951][T21077] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1576.423968][T21077] RSP: 002b:00007f94fcd4a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1576.423990][T21077] RAX: ffffffffffffffda RBX: 00007f94fc025fa0 RCX: 00007f94fbd9e159 [ 1576.424006][T21077] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1576.424019][T21077] RBP: 00007f94fcd4a090 R08: 0000000000000000 R09: 0000000000000000 [ 1576.424032][T21077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1576.424044][T21077] R13: 00007f94fc026038 R14: 00007f94fc025fa0 R15: 00007fffdd34e5a8 [ 1576.424077][T21077] [ 1577.129676][T21103] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1577.242589][T21098] syzkaller0: entered promiscuous mode [ 1577.242617][T21098] syzkaller0: entered allmulticast mode [ 1577.245588][T21102] syzkaller0: entered promiscuous mode [ 1577.245610][T21102] syzkaller0: entered allmulticast mode [ 1577.251697][T21100] syzkaller0: entered promiscuous mode [ 1577.251757][T21100] syzkaller0: entered allmulticast mode [ 1577.335558][T21098] __nla_validate_parse: 11 callbacks suppressed [ 1577.335583][T21098] netlink: 56 bytes leftover after parsing attributes in process `syz.2.12469'. [ 1577.403152][T21113] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12473'. [ 1577.533882][T21100] tipc: Enabled bearer , priority 0 [ 1577.697702][T21118] tipc: Resetting bearer [ 1577.722364][T21113] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12473'. [ 1577.801180][T21099] tipc: Resetting bearer [ 1577.882837][T21129] FAULT_INJECTION: forcing a failure. [ 1577.882837][T21129] name failslab, interval 1, probability 0, space 0, times 0 [ 1577.882875][T21129] CPU: 0 UID: 0 PID: 21129 Comm: syz.2.12477 Not tainted syzkaller #0 PREEMPT(full) [ 1577.882901][T21129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1577.882915][T21129] Call Trace: [ 1577.882925][T21129] [ 1577.882935][T21129] dump_stack_lvl+0xe8/0x150 [ 1577.882974][T21129] should_fail_ex+0x410/0x560 [ 1577.883008][T21129] should_failslab+0xa8/0x100 [ 1577.883041][T21129] __kmalloc_cache_noprof+0xa3/0x600 [ 1577.883067][T21129] ? nf_tables_newtable+0x43e/0x1990 [ 1577.883098][T21129] ? nf_tables_newtable+0x43e/0x1990 [ 1577.883136][T21129] nf_tables_newtable+0x43e/0x1990 [ 1577.883190][T21129] nfnetlink_rcv+0x1288/0x28c0 [ 1577.883269][T21129] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1577.883352][T21129] ? skb_clone+0x246/0x3a0 [ 1577.883403][T21129] ? netlink_deliver_tap+0x2e/0x1b0 [ 1577.883439][T21129] ? netlink_deliver_tap+0x2e/0x1b0 [ 1577.883480][T21129] netlink_unicast+0x7bd/0x940 [ 1577.883534][T21129] netlink_sendmsg+0x813/0xb40 [ 1577.883567][T21129] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1577.883598][T21129] ? apparmor_socket_sendmsg+0x98/0x360 [ 1577.883627][T21129] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1577.883649][T21129] sock_sendmsg_nosec+0x13a/0x180 [ 1577.883676][T21129] ____sys_sendmsg+0x54e/0x850 [ 1577.883716][T21129] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1577.883759][T21129] ? import_iovec+0x73/0xa0 [ 1577.883793][T21129] ___sys_sendmsg+0x2a5/0x360 [ 1577.883823][T21129] ? __lock_acquire+0x747/0x2de0 [ 1577.883853][T21129] ? __pfx____sys_sendmsg+0x10/0x10 [ 1577.883924][T21129] ? __fget_files+0x2a/0x420 [ 1577.883956][T21129] ? __fget_files+0x3a2/0x420 [ 1577.883999][T21129] __x64_sys_sendmsg+0x1b1/0x290 [ 1577.884034][T21129] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1577.884092][T21129] do_syscall_64+0x166/0x520 [ 1577.884120][T21129] ? trace_irq_disable+0x3b/0x140 [ 1577.884145][T21129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.884169][T21129] ? clear_bhb_loop+0x70/0xc0 [ 1577.884199][T21129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.884222][T21129] RIP: 0033:0x7f4b6b79e159 [ 1577.884244][T21129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1577.884264][T21129] RSP: 002b:00007f4b6c6c4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1577.884289][T21129] RAX: ffffffffffffffda RBX: 00007f4b6ba25fa0 RCX: 00007f4b6b79e159 [ 1577.884307][T21129] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1577.884323][T21129] RBP: 00007f4b6c6c4090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.884337][T21129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1577.884352][T21129] R13: 00007f4b6ba26038 R14: 00007f4b6ba25fa0 R15: 00007ffe7a955d68 [ 1577.884390][T21129] [ 1577.885284][T21099] tipc: Disabling bearer [ 1577.983581][T21131] netlink: 40 bytes leftover after parsing attributes in process `syz.3.12476'. [ 1578.654284][T21151] netlink: 'syz.0.12480': attribute type 1 has an invalid length. [ 1578.846326][T21156] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12480'. [ 1578.960119][T21148] veth25: entered promiscuous mode [ 1579.338004][T21170] syzkaller0: entered promiscuous mode [ 1579.338031][T21170] syzkaller0: entered allmulticast mode [ 1579.414403][T21177] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12487'. [ 1579.574965][T21177] gtp0: entered promiscuous mode [ 1579.574991][T21177] gtp0: entered allmulticast mode [ 1579.705655][T21183] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12490'. [ 1579.796610][T21186] netlink: 64 bytes leftover after parsing attributes in process `syz.3.12490'. [ 1579.925656][T21186] ip6erspan0: entered allmulticast mode [ 1580.091303][ T5737] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1580.219087][T21198] netlink: 32 bytes leftover after parsing attributes in process `syz.3.12494'. [ 1580.400262][T21202] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1580.473133][T21204] netlink: 19 bytes leftover after parsing attributes in process `syz.3.12494'. [ 1580.645903][T21212] openvswitch: netlink: Multiple metadata blocks provided [ 1580.920027][T31197] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1580.994393][T21223] syzkaller0: entered promiscuous mode [ 1580.994418][T21223] syzkaller0: entered allmulticast mode [ 1581.122876][T21229] netlink: 'syz.3.12500': attribute type 1 has an invalid length. [ 1581.274099][T21228] macvlan3: entered promiscuous mode [ 1581.274127][T21228] macvlan3: entered allmulticast mode [ 1581.274426][T21228] geneve1: entered promiscuous mode [ 1581.274445][T21228] geneve1: entered allmulticast mode [ 1581.338528][T21238] netlink: 'syz.1.12504': attribute type 1 has an invalid length. [ 1581.370118][T21228] team0: Port device macvlan3 added [ 1581.711730][T21251] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1581.797193][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1582.294364][T21269] syzkaller0: entered promiscuous mode [ 1582.294392][T21269] syzkaller0: entered allmulticast mode [ 1583.186816][T21310] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1583.324474][T21316] IPv6: NLM_F_CREATE should be specified when creating new route [ 1583.382131][T21318] __nla_validate_parse: 5 callbacks suppressed [ 1583.382155][T21318] netlink: 136 bytes leftover after parsing attributes in process `syz.2.12527'. [ 1583.468679][T21321] syzkaller0: entered promiscuous mode [ 1583.468707][T21321] syzkaller0: entered allmulticast mode [ 1584.066552][T21349] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1584.211012][T21359] netlink: 92 bytes leftover after parsing attributes in process `syz.2.12538'. [ 1584.211073][T21359] netlink: 100 bytes leftover after parsing attributes in process `syz.2.12538'. [ 1584.260416][T21348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12535'. [ 1584.260444][T21348] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12535'. [ 1584.420829][T21340] bridge0: port 2(bridge_slave_1) entered disabled state [ 1584.421432][T21340] bridge0: port 1(bridge_slave_0) entered disabled state [ 1584.713445][T21340] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1584.742647][T21340] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1584.963785][T21353] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 1585.020959][ T1030] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.037694][T16698] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.038247][ T1001] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.039429][T16698] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.214453][T21379] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12544'. [ 1585.256549][T21376] syzkaller0: entered promiscuous mode [ 1585.256576][T21376] syzkaller0: entered allmulticast mode [ 1585.882411][T19432] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1585.900846][T19432] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1585.901383][T21396] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12549'. [ 1585.905464][T19432] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1585.907896][T19432] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1585.915794][T19432] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1586.225149][T21404] ip_tables: iptables: counters copy to user failed while replacing table [ 1586.242645][T21404] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12550'. [ 1586.242692][T21404] tipc: Started in network mode [ 1586.242710][T21404] tipc: Node identity 4, cluster identity 4711 [ 1586.242724][T21404] tipc: Node number set to 4 [ 1586.326740][T21402] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1586.351870][T21402] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1586.355504][T21402] bond0 (unregistering): Released all slaves [ 1586.462132][T21407] syzkaller0: entered promiscuous mode [ 1586.462159][T21407] syzkaller0: entered allmulticast mode [ 1586.702068][T21421] FAULT_INJECTION: forcing a failure. [ 1586.702068][T21421] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1586.702104][T21421] CPU: 1 UID: 0 PID: 21421 Comm: syz.1.12554 Not tainted syzkaller #0 PREEMPT(full) [ 1586.702128][T21421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1586.702145][T21421] Call Trace: [ 1586.702153][T21421] [ 1586.702164][T21421] dump_stack_lvl+0xe8/0x150 [ 1586.702201][T21421] should_fail_ex+0x410/0x560 [ 1586.702230][T21421] _copy_from_user+0x2d/0xb0 [ 1586.702258][T21421] __sys_bind+0x1c6/0x410 [ 1586.702285][T21421] ? __pfx___sys_bind+0x10/0x10 [ 1586.702321][T21421] ? __pfx_ksys_write+0x10/0x10 [ 1586.702363][T21421] __x64_sys_bind+0x7a/0x90 [ 1586.702387][T21421] do_syscall_64+0x166/0x520 [ 1586.702414][T21421] ? trace_irq_disable+0x3b/0x140 [ 1586.702435][T21421] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1586.702457][T21421] ? clear_bhb_loop+0x70/0xc0 [ 1586.702482][T21421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1586.702503][T21421] RIP: 0033:0x7f0c6739e159 [ 1586.702523][T21421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1586.702540][T21421] RSP: 002b:00007f0c682a0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 1586.702563][T21421] RAX: ffffffffffffffda RBX: 00007f0c67625fa0 RCX: 00007f0c6739e159 [ 1586.702579][T21421] RDX: 0000000000000080 RSI: 0000200000000300 RDI: 0000000000000004 [ 1586.702593][T21421] RBP: 00007f0c682a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1586.702606][T21421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1586.702619][T21421] R13: 00007f0c67626038 R14: 00007f0c67625fa0 R15: 00007fff59c074d8 [ 1586.702652][T21421] [ 1586.919829][ C0] TC_ACT_REPEAT abuse ? [ 1586.919913][ C0] TC_ACT_REPEAT abuse ? [ 1587.112568][T21430] bridge_slave_1: left allmulticast mode [ 1587.112597][T21430] bridge_slave_1: left promiscuous mode [ 1587.112810][T21430] bridge0: port 2(bridge_slave_1) entered disabled state [ 1587.136063][T21427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1587.150749][T21430] bridge_slave_0: left allmulticast mode [ 1587.150776][T21430] bridge_slave_0: left promiscuous mode [ 1587.153444][T21430] bridge0: port 1(bridge_slave_0) entered disabled state [ 1587.800916][T16698] bond2 (unregistering): (slave geneve2): Releasing backup interface [ 1587.924358][T16698] bond1 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 1587.925363][T16698] bond1 (unregistering): Released all slaves [ 1587.954314][T16698] bond2 (unregistering): Released all slaves [ 1587.958462][T14322] Bluetooth: hci5: command tx timeout [ 1587.982351][T16698] bond3 (unregistering): Released all slaves [ 1588.007743][T16698] bond4 (unregistering): Released all slaves [ 1588.028695][T16698] bond5 (unregistering): Released all slaves [ 1588.047619][T16698] bond6 (unregistering): Released all slaves [ 1588.068947][T21393] lo speed is unknown, defaulting to 1000 [ 1588.073048][T21435] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12557'. [ 1588.073497][T21443] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12561'. [ 1588.276871][T21459] ip_tables: iptables: counters copy to user failed while replacing table [ 1588.390342][T21459] __nla_validate_parse: 1 callbacks suppressed [ 1588.390366][T21459] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12563'. [ 1588.390389][T21459] tipc: Started in network mode [ 1588.390404][T21459] tipc: Node identity 4, cluster identity 4711 [ 1588.390416][T21459] tipc: Node number set to 4 [ 1588.390783][T16698] tipc: Disabling bearer [ 1588.459012][T16698] tipc: Left network mode [ 1588.528613][T16698] IPVS: stopping backup sync thread 18960 ... [ 1588.568102][T21459] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1588.648767][T21459] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1588.651577][T21472] FAULT_INJECTION: forcing a failure. [ 1588.651577][T21472] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1588.651621][T21472] CPU: 1 UID: 0 PID: 21472 Comm: syz.4.12566 Not tainted syzkaller #0 PREEMPT(full) [ 1588.651648][T21472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1588.651662][T21472] Call Trace: [ 1588.651672][T21472] [ 1588.651682][T21472] dump_stack_lvl+0xe8/0x150 [ 1588.651721][T21472] should_fail_ex+0x410/0x560 [ 1588.651755][T21472] _copy_to_user+0x31/0xb0 [ 1588.651789][T21472] simple_read_from_buffer+0xe1/0x170 [ 1588.651830][T21472] proc_fail_nth_read+0x1bb/0x230 [ 1588.651866][T21472] ? common_file_perm+0x20e/0x2b0 [ 1588.651899][T21472] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1588.651940][T21472] ? rw_verify_area+0x24a/0x4c0 [ 1588.651974][T21472] ? __local_bh_enable_ip+0xd6/0x140 [ 1588.652006][T21472] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1588.652041][T21472] vfs_read+0x213/0xa80 [ 1588.652081][T21472] ? __pfx___mutex_lock+0x10/0x10 [ 1588.652113][T21472] ? __pfx_vfs_read+0x10/0x10 [ 1588.652153][T21472] ? __fget_files+0x2a/0x420 [ 1588.652190][T21472] ? __fget_files+0x3a2/0x420 [ 1588.652221][T21472] ? __fget_files+0x2a/0x420 [ 1588.652264][T21472] ksys_read+0x150/0x270 [ 1588.652302][T21472] ? __pfx_ksys_read+0x10/0x10 [ 1588.652350][T21472] do_syscall_64+0x166/0x520 [ 1588.652378][T21472] ? trace_irq_disable+0x3b/0x140 [ 1588.652402][T21472] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.652426][T21472] ? clear_bhb_loop+0x70/0xc0 [ 1588.652456][T21472] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.652478][T21472] RIP: 0033:0x7f94fbd5e98e [ 1588.652499][T21472] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1588.652517][T21472] RSP: 002b:00007f94fcd49fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1588.652540][T21472] RAX: ffffffffffffffda RBX: 00007f94fcd4a6c0 RCX: 00007f94fbd5e98e [ 1588.652558][T21472] RDX: 000000000000000f RSI: 00007f94fcd4a0a0 RDI: 0000000000000003 [ 1588.652573][T21472] RBP: 00007f94fcd4a090 R08: 0000000000000000 R09: 0000000000000000 [ 1588.652595][T21472] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1588.652610][T21472] R13: 00007f94fc026038 R14: 00007f94fc025fa0 R15: 00007fffdd34e5a8 [ 1588.652647][T21472] [ 1588.914087][T21459] bond0 (unregistering): Released all slaves [ 1589.326720][T21483] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1589.438390][T21485] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12570'. [ 1589.595660][T21486] vlan0: entered promiscuous mode [ 1589.666804][T21486] team0: Port device vlan0 added [ 1590.037873][T14322] Bluetooth: hci5: command tx timeout [ 1590.094046][T21499] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12573'. [ 1590.094074][T21499] netlink: 468 bytes leftover after parsing attributes in process `syz.2.12573'. [ 1590.228880][T21499] macsec1: entered promiscuous mode [ 1590.347500][T21504] netlink: 'syz.3.12575': attribute type 1 has an invalid length. [ 1590.583809][T21504] bond3: entered promiscuous mode [ 1590.584448][T21504] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1590.679816][T21506] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1590.682656][T21506] bond3: (slave gre1): The slave device specified does not support setting the MAC address [ 1590.682683][T21506] bond3: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 1590.725473][T21506] bond3: (slave gre1): making interface the new active one [ 1590.725500][T21506] gre1: entered promiscuous mode [ 1590.740923][T21506] bond3: (slave gre1): Enslaving as an active interface with an up link [ 1590.795831][T21518] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12578'. [ 1590.896534][T21519] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 1590.979225][T21518] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12578'. [ 1591.259632][T21528] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12581'. [ 1591.401669][T21528] gtp1: entered promiscuous mode [ 1591.401694][T21528] gtp1: entered allmulticast mode [ 1591.555652][T21540] xt_hashlimit: size too large, truncated to 1048576 [ 1591.782120][T21393] bridge0: port 1(bridge_slave_0) entered blocking state [ 1591.783949][T21393] bridge0: port 1(bridge_slave_0) entered disabled state [ 1591.784128][T21393] bridge_slave_0: entered allmulticast mode [ 1591.786153][T21549] netlink: 32 bytes leftover after parsing attributes in process `syz.4.12586'. [ 1591.802267][T21393] bridge_slave_0: entered promiscuous mode [ 1591.833496][T21393] bridge0: port 2(bridge_slave_1) entered blocking state [ 1591.834244][T21393] bridge0: port 2(bridge_slave_1) entered disabled state [ 1591.834421][T21393] bridge_slave_1: entered allmulticast mode [ 1591.872019][T21393] bridge_slave_1: entered promiscuous mode [ 1592.062265][T21553] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12586'. [ 1592.119242][T14322] Bluetooth: hci5: command tx timeout [ 1592.119876][T21393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1592.366595][T21566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12588'. [ 1592.938725][T16698] team0 (unregistering): Port device team_slave_1 removed [ 1592.969832][T16698] team0 (unregistering): Port device team_slave_0 removed [ 1593.196088][T21393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1593.216075][T21573] tunl0: left promiscuous mode [ 1593.453113][T21393] team0: Port device team_slave_0 added [ 1593.468184][T21393] team0: Port device team_slave_1 added [ 1593.596793][T21393] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1593.596813][T21393] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1593.596839][T21393] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1593.625888][T21393] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1593.625942][T21393] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1593.626020][T21393] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1593.972097][T21617] __nla_validate_parse: 3 callbacks suppressed [ 1593.972118][T21617] netlink: 64 bytes leftover after parsing attributes in process `syz.3.12601'. [ 1594.094710][T21606] netlink: 'syz.1.12599': attribute type 1 has an invalid length. [ 1594.121908][T21393] hsr_slave_0: entered promiscuous mode [ 1594.123130][T21393] hsr_slave_1: entered promiscuous mode [ 1594.199484][T14322] Bluetooth: hci5: command tx timeout [ 1594.268482][T21606] bond0: entered promiscuous mode [ 1594.268944][T21606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1594.346741][T21626] syzkaller0: entered promiscuous mode [ 1594.346767][T21626] syzkaller0: entered allmulticast mode [ 1594.371393][T21623] tipc: Enabled bearer , priority 0 [ 1594.404984][T16698] IPVS: stop unused estimator thread 0... [ 1594.435588][T21609] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12599'. [ 1594.840332][T21605] tipc: Resetting bearer [ 1594.916759][T21605] tipc: Disabling bearer [ 1595.402075][T21393] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1595.402114][T21393] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1595.630486][T21660] pimreg: entered allmulticast mode [ 1595.630799][T21672] sit0: left promiscuous mode [ 1595.630870][T21672] sit0: entered allmulticast mode [ 1596.401818][T21393] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1596.401857][T21393] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1596.614372][T21712] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12622'. [ 1596.634781][T21393] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1596.634823][T21393] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1596.711074][T21717] netlink: 'syz.4.12626': attribute type 1 has an invalid length. [ 1596.740445][T21722] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12625'. [ 1596.780426][T21717] bond0: entered promiscuous mode [ 1596.780942][T21717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1596.813360][T21724] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12625'. [ 1596.835096][T21719] bond0: (slave bridge4): making interface the new active one [ 1596.835123][T21719] bridge4: entered promiscuous mode [ 1596.856400][T21719] bond0: (slave bridge4): Enslaving as an active interface with an up link [ 1597.269565][T21732] sock: sock_timestamping_bind_phc: sock not bind to device [ 1597.534493][T21741] ip6tnl1: entered allmulticast mode [ 1597.548475][ T1001] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1597.548726][ T1001] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1597.578733][T25382] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1597.739979][T21750] netlink: 'syz.2.12632': attribute type 11 has an invalid length. [ 1597.828334][T25382] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1597.920578][T12155] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1598.205606][T21774] netlink: 'syz.1.12639': attribute type 11 has an invalid length. [ 1598.344347][T21774] netlink: 48 bytes leftover after parsing attributes in process `syz.1.12639'. [ 1598.442975][T21773] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1598.651743][T21393] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1598.674033][T21393] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1598.675706][T21393] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1598.701861][T21393] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1598.703140][T21393] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1598.725097][T21393] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1598.726338][T21393] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1598.748775][T21393] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1598.891762][T21803] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1599.004384][T21393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1599.076065][T21393] 8021q: adding VLAN 0 to HW filter on device team0 [ 1599.112997][T17522] bridge0: port 1(bridge_slave_0) entered blocking state [ 1599.113107][T17522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1599.155092][T16673] bridge0: port 2(bridge_slave_1) entered blocking state [ 1599.155203][T16673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1599.282473][T21816] syzkaller0: entered promiscuous mode [ 1599.282500][T21816] syzkaller0: entered allmulticast mode [ 1599.549803][T21828] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12648'. [ 1599.832288][T21840] netlink: 'syz.1.12652': attribute type 1 has an invalid length. [ 1600.031304][T21393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1600.176047][T21393] veth0_vlan: entered promiscuous mode [ 1600.234798][T21393] veth1_vlan: entered promiscuous mode [ 1600.335592][T21393] veth0_macvtap: entered promiscuous mode [ 1600.346515][T21858] xt_hashlimit: size too large, truncated to 1048576 [ 1600.346806][T21858] xt_hashlimit: Unknown mode mask A2BF, kernel too old? [ 1600.370874][T21393] veth1_macvtap: entered promiscuous mode [ 1600.390046][T21858] RDS: rds_bind could not find a transport for fe80::37, load rds_tcp or rds_rdma? [ 1600.418637][T21393] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1600.453225][T21393] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1600.507425][ T1030] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.507530][ T1030] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.507631][ T1030] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.507718][ T1030] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.514299][T21866] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1600.800614][T16693] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1600.800639][T16693] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1601.014575][T21877] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12660'. [ 1601.014607][T21877] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12660'. [ 1601.065153][T21875] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12660'. [ 1601.118850][T21876] syzkaller1: entered promiscuous mode [ 1601.118875][T21876] syzkaller1: entered allmulticast mode [ 1601.180739][T21875] team0: Port device team_slave_0 removed [ 1601.254991][T17531] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1601.255016][T17531] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1601.717396][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1602.191624][T21920] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1602.238028][T21922] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 1602.335461][T21925] lo speed is unknown, defaulting to 1000 [ 1603.315581][T21945] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12674'. [ 1603.769371][T21967] netlink: 'syz.3.12681': attribute type 1 has an invalid length. [ 1603.769397][T21967] netlink: 'syz.3.12681': attribute type 268 has an invalid length. [ 1603.769414][T21967] netlink: 224 bytes leftover after parsing attributes in process `syz.3.12681'. [ 1604.160359][T21975] netlink: 'syz.0.12682': attribute type 2 has an invalid length. [ 1604.160389][T21975] netlink: 224 bytes leftover after parsing attributes in process `syz.0.12682'. [ 1604.326375][T21975] netlink: 'syz.0.12682': attribute type 10 has an invalid length. [ 1604.385158][T21975] team0: Port device dummy0 added [ 1604.431319][T21987] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12684'. [ 1605.059479][T22013] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1605.293732][T22031] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1605.460182][T22035] netlink: 52 bytes leftover after parsing attributes in process `syz.3.12693'. [ 1605.885527][T22054] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12696'. [ 1606.109586][T22064] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1606.168500][T22064] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1606.241639][T22069] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1606.496964][T22073] ip_tables: iptables: counters copy to user failed while replacing table [ 1606.499938][T22073] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12701'. [ 1606.499961][T22073] tipc: Started in network mode [ 1606.499976][T22073] tipc: Node identity 4, cluster identity 4711 [ 1606.499989][T22073] tipc: Node number set to 4 [ 1606.561437][T22073] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1606.565568][T22073] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1606.587417][T22073] bond0 (unregistering): Released all slaves [ 1607.549148][T22114] netlink: 14 bytes leftover after parsing attributes in process `syz.4.12709'. [ 1607.581357][T14322] Bluetooth: hci4: link tx timeout [ 1607.581648][T14322] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 1607.584320][T14322] Bluetooth: hci4: link tx timeout [ 1607.584338][T14322] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 1608.072985][T22126] netlink: 72 bytes leftover after parsing attributes in process `syz.1.12711'. [ 1608.231586][T22132] netlink: 'syz.0.12714': attribute type 2 has an invalid length. [ 1608.591505][T20263] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1608.601721][T20263] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1608.611630][T20263] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1608.634717][T20263] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1608.644980][T20263] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1609.210159][T22159] tipc: Enabled bearer , priority 0 [ 1609.502051][T22173] nftables ruleset with unbound set [ 1609.641371][T14322] Bluetooth: hci4: command 0x0406 tx timeout [ 1610.174758][T22136] lo speed is unknown, defaulting to 1000 [ 1610.597621][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1610.677776][T14322] Bluetooth: hci2: command tx timeout [ 1610.816707][T16673] bridge0: port 3(vlan2) entered disabled state [ 1610.865971][T22235] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12735'. [ 1611.276088][T22231] lo speed is unknown, defaulting to 1000 [ 1611.374903][T22242] netlink: 'syz.1.12736': attribute type 4 has an invalid length. [ 1611.374949][T22242] netlink: 152 bytes leftover after parsing attributes in process `syz.1.12736'. [ 1611.750254][T22260] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12739'. [ 1611.750297][T22260] netlink: 'syz.3.12739': attribute type 10 has an invalid length. [ 1611.750315][T22260] netlink: 'syz.3.12739': attribute type 5 has an invalid length. [ 1611.750330][T22260] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12739'. [ 1611.797109][T14322] Bluetooth: hci4: command 0x0406 tx timeout [ 1612.175977][T22260] geneve3: entered promiscuous mode [ 1612.176005][T22260] geneve3: entered allmulticast mode [ 1612.284316][T16698] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 59445 - 0 [ 1612.286265][T17531] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 59445 - 0 [ 1612.290210][ T1001] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 59445 - 0 [ 1612.290374][ T1001] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 59445 - 0 [ 1612.759045][T19432] Bluetooth: hci2: command tx timeout [ 1613.362627][T22320] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 1613.374760][T22323] IPVS: set_ctl: invalid protocol: 29 172.20.20.170:20000 [ 1613.388756][T22319] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12747'. [ 1613.390984][T22323] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12746'. [ 1613.392241][T22323] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12746'. [ 1613.392262][T22323] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12746'. [ 1613.568446][T22288] team0: Port device vlan0 removed [ 1613.858899][T22319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1614.030715][T16673] dummy0: left allmulticast mode [ 1614.030891][T16673] pimreg: left allmulticast mode [ 1614.143271][T22345] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12749'. [ 1614.732350][T16673] bond3 (unregistering): (slave geneve2): Releasing active interface [ 1614.783407][T16673] bond4 (unregistering): (slave bridge2): Releasing backup interface [ 1614.783434][T16673] bond4 (unregistering): (slave bridge2): the permanent HWaddr of slave - ba:29:85:20:cc:f5 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1614.783467][T16673] bridge2 (unregistering): left allmulticast mode [ 1614.783493][T16673] bond4 (unregistering): (slave bridge3): making interface the new active one [ 1614.783506][T16673] bridge3 (unregistering): entered allmulticast mode [ 1614.837940][T19432] Bluetooth: hci2: command tx timeout [ 1614.853759][T16673] bond4 (unregistering): (slave bridge3): Releasing backup interface [ 1614.853793][T16673] bridge3 (unregistering): left allmulticast mode [ 1614.879277][T16673] bond0 (unregistering): (slave bridge4): Releasing backup interface [ 1614.879308][T16673] bridge4 (unregistering): left promiscuous mode [ 1614.903812][T16673] bond1 (unregistering): Released all slaves [ 1614.926048][T16673] bond2 (unregistering): Released all slaves [ 1614.945517][T16673] bond3 (unregistering): Released all slaves [ 1614.971500][T16673] bond4 (unregistering): Released all slaves [ 1614.993488][T16673] bond0 (unregistering): Released all slaves [ 1615.010082][T22136] bridge0: port 1(bridge_slave_0) entered blocking state [ 1615.010243][T22136] bridge0: port 1(bridge_slave_0) entered disabled state [ 1615.010385][T22136] bridge_slave_0: entered allmulticast mode [ 1615.011798][T22136] bridge_slave_0: entered promiscuous mode [ 1615.044208][T22345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1615.184860][T22345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1615.364603][T22136] bridge0: port 2(bridge_slave_1) entered blocking state [ 1615.364819][T22136] bridge0: port 2(bridge_slave_1) entered disabled state [ 1615.364995][T22136] bridge_slave_1: entered allmulticast mode [ 1615.385975][T22358] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12750'. [ 1615.398500][T22136] bridge_slave_1: entered promiscuous mode [ 1615.433112][T16673] tipc: Left network mode [ 1615.537559][T22136] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1615.543757][T22136] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1615.614247][T22136] team0: Port device team_slave_0 added [ 1615.624865][T22136] team0: Port device team_slave_1 added [ 1615.830706][T22353] syzkaller0: entered promiscuous mode [ 1615.830731][T22353] syzkaller0: entered allmulticast mode [ 1615.933840][T22136] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1615.933862][T22136] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1615.933893][T22136] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1616.104496][T22376] netlink: 'syz.3.12753': attribute type 1 has an invalid length. [ 1616.304467][T22136] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1616.304486][T22136] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1616.304516][T22136] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1616.548921][T22376] bond4: entered promiscuous mode [ 1616.549001][T22376] bond4: entered allmulticast mode [ 1616.549550][T22376] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1616.582338][T22371] erspan1: entered allmulticast mode [ 1616.645115][T22371] bond4: (slave erspan1): making interface the new active one [ 1616.645148][T22371] erspan1: entered promiscuous mode [ 1616.663520][T22371] bond4: (slave erspan1): Enslaving as an active interface with an up link [ 1616.709462][T22388] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12757'. [ 1616.840687][T22136] hsr_slave_0: entered promiscuous mode [ 1616.841952][T22136] hsr_slave_1: entered promiscuous mode [ 1616.842778][T22136] debugfs: 'hsr0' already exists in 'hsr' [ 1616.842798][T22136] Cannot create hsr debugfs directory [ 1616.921833][T19432] Bluetooth: hci2: command tx timeout [ 1617.244618][T22405] netlink: 424 bytes leftover after parsing attributes in process `syz.0.12761'. [ 1617.244651][T22405] netlink: 424 bytes leftover after parsing attributes in process `syz.0.12761'. [ 1617.280725][T22405] Cannot find add_set index 0 as target [ 1618.135838][T22428] netlink: 'syz.2.12763': attribute type 1 has an invalid length. [ 1618.637941][T22440] netlink: 'syz.0.12765': attribute type 1 has an invalid length. [ 1619.104082][T22456] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12767'. [ 1619.173771][T22455] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12767'. [ 1619.186500][T22455] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12767'. [ 1620.368076][T22476] gtp0: entered promiscuous mode [ 1620.368103][T22476] gtp0: entered allmulticast mode [ 1620.967876][T16673] IPVS: stop unused estimator thread 0... [ 1621.360902][T22515] x_tables: unsorted underflow at hook 3 [ 1621.553893][T22521] lo: entered allmulticast mode [ 1621.705531][T22529] netlink: 68 bytes leftover after parsing attributes in process `syz.0.12781'. [ 1621.832774][T22532] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12782'. [ 1621.854179][T22513] lo: left allmulticast mode [ 1621.986283][T22136] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1622.007903][T22136] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1622.031099][T22136] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1622.060469][T22136] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1622.061478][T22136] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1622.091409][T22136] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1622.096808][T22136] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1622.123418][T22136] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1622.406345][T22555] syzkaller0: entered promiscuous mode [ 1622.406365][T22555] syzkaller0: entered allmulticast mode [ 1622.424868][T19432] Bluetooth: hci5: connection err: -111 [ 1622.528393][T19432] Bluetooth: hci4: connection err: -111 [ 1624.838166][T19432] Bluetooth: hci3: command 0x0406 tx timeout [ 1627.425637][T22556] netlink: 'syz.3.12787': attribute type 4 has an invalid length. [ 1627.538530][T22584] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12796'. [ 1627.538592][T22584] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1627.603545][T22136] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1627.635838][T22136] 8021q: adding VLAN 0 to HW filter on device team0 [ 1627.662046][T17522] bridge0: port 1(bridge_slave_0) entered blocking state [ 1627.662159][T17522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1627.693725][T17522] bridge0: port 2(bridge_slave_1) entered blocking state [ 1627.693839][T17522] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1627.878339][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1627.881022][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1628.030887][T22598] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1628.063655][T22598] netlink: 56 bytes leftover after parsing attributes in process `syz.2.12801'. [ 1628.178612][T22604] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12802'. [ 1628.598040][T22609] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12803'. [ 1628.598083][T22609] netlink: 144 bytes leftover after parsing attributes in process `syz.1.12803'. [ 1628.726658][T22610] netlink: 1363 bytes leftover after parsing attributes in process `syz.1.12803'. [ 1629.105758][T22626] netlink: 'syz.1.12808': attribute type 1 has an invalid length. [ 1629.258206][T22626] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 1629.304911][T22626] veth3: entered promiscuous mode [ 1629.314399][T22626] bond3: (slave veth3): Enslaving as a backup interface with a down link [ 1629.334235][T22626] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12808'. [ 1629.369637][T22638] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1629.401907][T22626] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1629.404438][T17522] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1629.470900][T22136] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1629.548237][ T1030] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1629.702271][T22659] xt_recent: hitcount (16777216) is larger than allowed maximum (65535) [ 1629.705878][T22659] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12813'. [ 1630.306352][T22136] veth0_vlan: entered promiscuous mode [ 1630.346331][T22136] veth1_vlan: entered promiscuous mode [ 1630.433642][T22136] veth0_macvtap: entered promiscuous mode [ 1630.511212][T22136] veth1_macvtap: entered promiscuous mode [ 1630.623418][T22136] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1630.668622][T22136] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1630.737757][ T1001] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1630.738701][ T1001] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1630.738746][ T1001] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1630.738784][ T1001] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1630.979284][T22674] bond0 (unregistering): Released all slaves [ 1631.108491][T22675] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12818'. [ 1631.200010][T22674] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12817'. [ 1631.225720][T22675] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1631.277829][T22675] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1631.409834][T16698] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1631.409860][T16698] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1631.510072][T22693] ip6gretap1: entered allmulticast mode [ 1631.511562][T22693] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 1631.512233][T22693] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1631.512247][T22693] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1631.512282][T22693] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1631.593288][T22691] syzkaller0: entered promiscuous mode [ 1631.593313][T22691] syzkaller0: entered allmulticast mode [ 1631.676601][T17531] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1631.676625][T17531] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1631.729588][T22691] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 1631.730881][T22691] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1632.013642][T22706] netlink: 'syz.1.12827': attribute type 2 has an invalid length. [ 1632.658396][T22746] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12836'. [ 1632.768025][T22749] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12838'. [ 1632.768054][T22749] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12838'. [ 1633.337395][T22768] netlink: 'syz.3.12845': attribute type 1 has an invalid length. [ 1633.392922][T22774] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12846'. [ 1633.426334][T22768] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1633.437338][T22774] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12846'. [ 1633.765085][T22791] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12849'. [ 1633.765115][T22791] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12849'. [ 1634.337475][T22801] netlink: 48 bytes leftover after parsing attributes in process `syz.3.12852'. [ 1634.337502][T22801] netlink: 48 bytes leftover after parsing attributes in process `syz.3.12852'. [ 1635.126945][T22830] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12860'. [ 1635.728714][T22854] bridge0: port 3(syz_tun) entered blocking state [ 1635.728812][T22854] bridge0: port 3(syz_tun) entered disabled state [ 1635.729019][T22854] syz_tun: entered allmulticast mode [ 1635.754478][T22854] syz_tun: entered promiscuous mode [ 1635.765479][T22854] bridge0: port 3(syz_tun) entered blocking state [ 1635.765577][T22854] bridge0: port 3(syz_tun) entered forwarding state [ 1635.836076][T22859] bridge0: port 4(ip6gretap0) entered blocking state [ 1635.836177][T22859] bridge0: port 4(ip6gretap0) entered disabled state [ 1635.836356][T22859] ip6gretap0: entered allmulticast mode [ 1635.947900][T22859] ip6gretap0: entered promiscuous mode [ 1635.948608][T22859] bridge0: port 4(ip6gretap0) entered blocking state [ 1635.948702][T22859] bridge0: port 4(ip6gretap0) entered forwarding state [ 1636.776330][T22901] ip6gre1: entered promiscuous mode [ 1636.776357][T22901] ip6gre1: entered allmulticast mode [ 1636.861081][T22903] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 3040 [ 1637.278316][T22933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.283915][T22933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.313587][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.366065][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.390260][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.415196][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.439356][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.463337][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.494585][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.495620][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.522864][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.554197][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.583588][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.609690][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.626816][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.663259][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.685446][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.702405][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.726744][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.751448][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.756639][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.780061][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.784899][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.817762][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.819474][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.820910][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.822385][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.823929][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.825372][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.857647][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.903810][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.905473][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1637.927004][T22936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1638.085202][T22961] syzkaller1: entered promiscuous mode [ 1638.085222][T22961] syzkaller1: entered allmulticast mode [ 1638.213535][T22966] batadv0: entered promiscuous mode [ 1638.213891][T22965] batadv0: left promiscuous mode [ 1638.639514][T22984] __nla_validate_parse: 4 callbacks suppressed [ 1638.639537][T22984] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12898'. [ 1638.639558][T22984] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12898'. [ 1638.776284][T22987] ip_tables: iptables: counters copy to user failed while replacing table [ 1638.801111][T22987] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12899'. [ 1638.851917][T22987] bond0 (unregistering): Released all slaves [ 1638.856170][T22992] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12901'. [ 1638.914262][T22990] Bluetooth: MGMT ver 1.23 [ 1638.914317][T22990] Bluetooth: hci1: too big key_count value 29096 [ 1639.652408][T23030] ip_tables: iptables: counters copy to user failed while replacing table [ 1639.691535][T23030] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12914'. [ 1639.691562][T23030] tipc: Started in network mode [ 1639.691577][T23030] tipc: Node identity 4, cluster identity 4711 [ 1639.691590][T23030] tipc: Node number set to 4 [ 1639.845742][T23027] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1639.865523][T23027] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1639.882544][T23027] bond0 (unregistering): Released all slaves [ 1639.995538][T23036] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12917'. [ 1640.084158][T23035] syzkaller0: entered promiscuous mode [ 1640.084184][T23035] syzkaller0: entered allmulticast mode [ 1640.093013][T23039] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12917'. [ 1640.113493][T23041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12918'. [ 1640.113746][T23041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12918'. [ 1640.113939][T23041] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12918'. [ 1640.197797][T19432] Bluetooth: hci1: command 0x0406 tx timeout [ 1640.421303][T23053] batman_adv: batadv0: Adding interface: macvtap1 [ 1640.421323][T23053] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1640.421349][T23053] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 1640.546525][T23061] batman_adv: batadv0: Removing interface: macvtap1 [ 1641.031598][T23084] netlink: 'syz.2.12926': attribute type 1 has an invalid length. [ 1641.243485][T23093] ip_tables: iptables: counters copy to user failed while replacing table [ 1641.412111][T17528] tipc: Subscription rejected, illegal request [ 1641.525049][T23091] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1641.554658][T23091] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1641.579838][T23091] bond0 (unregistering): Released all slaves [ 1642.011540][T23127] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 1642.011924][ T1001] IPVS: starting estimator thread 0... [ 1642.012661][T23129] netlink: 'syz.0.12938': attribute type 1 has an invalid length. [ 1642.098986][T23131] IPVS: using max 28 ests per chain, 67200 per kthread [ 1642.186653][T23129] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1642.389298][T23142] netlink: 'syz.3.12941': attribute type 1 has an invalid length. [ 1642.424682][T23142] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1642.637292][T23159] netlink: 'syz.2.12944': attribute type 1 has an invalid length. [ 1642.680408][T23145] bond2: entered promiscuous mode [ 1642.683559][T23145] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1642.792016][T23164] bond3: entered promiscuous mode [ 1642.792420][T23164] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1643.020911][T23179] ip_tables: iptables: counters copy to user failed while replacing table [ 1643.500591][T23195] lo speed is unknown, defaulting to 1000 [ 1643.785306][T23209] __nla_validate_parse: 42 callbacks suppressed [ 1643.785330][T23209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12956'. [ 1643.785349][T23209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12956'. [ 1644.424235][T23204] bridge0: port 3(syz_tun) entered disabled state [ 1644.470931][T23204] bridge0: port 4(ip6gretap0) entered disabled state [ 1644.471695][T23204] bridge0: port 2(bridge_slave_1) entered disabled state [ 1644.472430][T23204] bridge0: port 1(bridge_slave_0) entered disabled state [ 1644.606068][T23204] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1644.629863][T23216] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12958'. [ 1644.741520][T23218] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12958'. [ 1644.978365][T23227] ip_tables: iptables: counters copy to user failed while replacing table [ 1644.980607][T17522] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1644.980746][T17522] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1644.980797][T17522] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1644.980835][T17522] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1645.085389][T23227] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12960'. [ 1645.150244][T23229] netlink: 31 bytes leftover after parsing attributes in process `syz.0.12961'. [ 1645.231050][T23233] batadv_slave_1: entered promiscuous mode [ 1645.269846][T23232] batadv_slave_1: left promiscuous mode [ 1645.399982][T23237] xt_TCPMSS: Only works on TCP SYN packets [ 1645.497555][T23240] sctp: [Deprecated]: syz.4.12966 (pid 23240) Use of int in maxseg socket option. [ 1645.497555][T23240] Use struct sctp_assoc_value instead [ 1645.581333][T23241] vlan1: entered promiscuous mode [ 1645.581352][T23241] bridge0: entered promiscuous mode [ 1645.926784][T23260] netlink: 'syz.4.12971': attribute type 1 has an invalid length. [ 1645.926811][T23260] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12971'. [ 1646.009250][T23263] vlan0: entered promiscuous mode [ 1646.432352][T23282] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12978'. [ 1646.462368][T23279] ip_tables: iptables: counters copy to user failed while replacing table [ 1646.518053][T23277] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12976'. [ 1646.651353][T23277] bond0 (unregistering): Released all slaves [ 1646.694638][T23285] sit0: entered promiscuous mode [ 1646.750309][T23285] netlink: 21 bytes leftover after parsing attributes in process `syz.2.12977'. [ 1646.779670][T23283] netlink: 'syz.2.12977': attribute type 1 has an invalid length. [ 1646.782448][T23293] bridge_slave_0: left allmulticast mode [ 1646.782478][T23293] bridge_slave_0: left promiscuous mode [ 1646.782710][T23293] bridge0: port 1(bridge_slave_0) entered disabled state [ 1646.922028][T23293] bridge_slave_1: left allmulticast mode [ 1646.922059][T23293] bridge_slave_1: left promiscuous mode [ 1646.922326][T23293] bridge0: port 2(bridge_slave_1) entered disabled state [ 1647.145955][T23293] team0: Port device team_slave_0 removed [ 1647.162569][T23293] team0: Port device team_slave_1 removed [ 1647.163784][T23293] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1647.163807][T23293] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1647.166226][T23293] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1647.166248][T23293] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1647.184298][T23293] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1647.623787][T23318] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1647.623816][T23318] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1647.646131][T23318] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1647.646159][T23318] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1647.661684][T23318] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1647.661761][T23318] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1648.084602][T23341] ip_tables: iptables: counters copy to user failed while replacing table [ 1648.441033][T23360] block nbd3: server does not support multiple connections per device. [ 1648.441429][T23360] block nbd3: shutting down sockets [ 1648.848097][T23372] __nla_validate_parse: 7 callbacks suppressed [ 1648.848205][T23372] netlink: 680 bytes leftover after parsing attributes in process `syz.1.12999'. [ 1648.848226][T23372] netlink: 788 bytes leftover after parsing attributes in process `syz.1.12999'. [ 1648.853742][T23372] netlink: 'syz.1.12999': attribute type 3 has an invalid length. [ 1649.178642][T23386] ip_tables: iptables: counters copy to user failed while replacing table [ 1649.204484][T23383] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13005'. [ 1649.274731][T23360] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1649.274759][T23360] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1649.336670][T23360] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1649.336695][T23360] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1649.453042][T23360] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1649.453069][T23360] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 1649.491220][T23360] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1649.491256][T23360] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1649.692286][T23360] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1649.692313][T23360] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1649.796615][T23411] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13012'. [ 1649.864670][T23413] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13013'. [ 1650.013642][T23428] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13015'. [ 1650.056644][T23413] veth3: entered allmulticast mode [ 1650.418914][T23438] bond4: entered allmulticast mode [ 1650.795360][T23445] netlink: 388 bytes leftover after parsing attributes in process `syz.3.13020'. [ 1651.863483][T23492] netlink: 'syz.3.13031': attribute type 3 has an invalid length. [ 1652.002544][T23500] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13034'. [ 1652.082186][T23506] netlink: 120 bytes leftover after parsing attributes in process `syz.3.13035'. [ 1652.086408][T23506] netlink: 'syz.3.13035': attribute type 1 has an invalid length. [ 1652.367414][T23511] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1652.408814][T23511] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13036'. [ 1652.952279][T23535] gtp0: entered promiscuous mode [ 1652.952306][T23535] gtp0: entered allmulticast mode [ 1653.283599][T23545] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1654.409771][T23586] __nla_validate_parse: 7 callbacks suppressed [ 1654.409795][T23586] netlink: 76 bytes leftover after parsing attributes in process `syz.2.13053'. [ 1654.410322][T23590] bridge0: port 2(bridge_slave_1) entered disabled state [ 1654.411007][T23590] bridge0: port 1(bridge_slave_0) entered disabled state [ 1654.411991][T23590] bridge0: entered allmulticast mode [ 1654.471202][T23594] bridge_slave_1: left allmulticast mode [ 1654.471232][T23594] bridge_slave_1: left promiscuous mode [ 1654.471442][T23594] bridge0: port 2(bridge_slave_1) entered disabled state [ 1654.511579][T23594] bridge_slave_0: left allmulticast mode [ 1654.511608][T23594] bridge_slave_0: left promiscuous mode [ 1654.511801][T23594] bridge0: port 1(bridge_slave_0) entered disabled state [ 1654.980692][T23605] netlink: 76 bytes leftover after parsing attributes in process `syz.4.13059'. [ 1655.555500][T23619] tipc: Enabled bearer , priority 0 [ 1655.653396][T23619] syzkaller0: entered promiscuous mode [ 1655.653422][T23619] syzkaller0: entered allmulticast mode [ 1655.655210][T23622] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 1655.733446][T23619] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 1655.747375][T23619] tipc: Resetting bearer [ 1655.765165][T23618] tipc: Resetting bearer [ 1655.825215][T23618] tipc: Disabling bearer [ 1656.046526][T23645] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13074'. [ 1656.174235][T23657] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13077'. [ 1656.174268][T23657] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13077'. [ 1656.348768][T23666] netlink: 52 bytes leftover after parsing attributes in process `syz.4.13078'. [ 1656.348801][T23666] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13078'. [ 1656.349710][T23671] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13079'. [ 1656.349939][T23671] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13079'. [ 1656.350151][T23671] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13079'. [ 1657.004556][T23696] syzkaller1: entered promiscuous mode [ 1657.004583][T23696] syzkaller1: entered allmulticast mode [ 1659.028526][T23782] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1659.360680][T23787] lo speed is unknown, defaulting to 1000 [ 1659.647794][T23794] __nla_validate_parse: 42 callbacks suppressed [ 1659.647819][T23794] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13112'. [ 1659.825223][T23799] netlink: 56 bytes leftover after parsing attributes in process `syz.2.13114'. [ 1659.864179][T23799] netlink: 40 bytes leftover after parsing attributes in process `syz.2.13114'. [ 1659.935656][T23803] netlink: 9 bytes leftover after parsing attributes in process `syz.3.13115'. [ 1659.935776][T23803] 0·: renamed from hsr0 (while UP) [ 1659.980950][T23803] 0·: entered allmulticast mode [ 1659.980979][T23803] hsr_slave_0: entered allmulticast mode [ 1659.980998][T23803] hsr_slave_1: entered allmulticast mode [ 1659.981537][T23803] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1660.307636][T23819] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13116'. [ 1660.479054][T23791] Bluetooth: MGMT ver 1.23 [ 1660.606321][T23825] bond5: entered promiscuous mode [ 1660.606347][T23825] bond5: entered allmulticast mode [ 1660.611743][T23809] syzkaller1: entered promiscuous mode [ 1660.611802][T23809] syzkaller1: entered allmulticast mode [ 1661.568306][T23866] netlink: 'syz.0.13125': attribute type 1 has an invalid length. [ 1661.568334][T23866] netlink: 'syz.0.13125': attribute type 4 has an invalid length. [ 1661.568349][T23866] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.13125'. [ 1661.569273][T23866] netlink: 'syz.0.13125': attribute type 1 has an invalid length. [ 1661.569292][T23866] netlink: 'syz.0.13125': attribute type 4 has an invalid length. [ 1661.569307][T23866] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.13125'. [ 1661.797132][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1662.224272][T23891] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1662.490949][T23909] netlink: 56 bytes leftover after parsing attributes in process `syz.2.13136'. [ 1662.506267][T23911] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13137'. [ 1662.603303][T23911] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 1662.651353][T23915] xt_policy: output policy not valid in PREROUTING and INPUT [ 1662.884126][T23926] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13141'. [ 1662.957547][T23926] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1663.081667][T23926] bond0: (slave geneve4): Enslaving as an active interface with an up link [ 1664.187718][T23979] [ 1664.190122][T23979] ====================================================== [ 1664.197315][T23979] WARNING: possible circular locking dependency detected [ 1664.204405][T23979] syzkaller #0 Not tainted [ 1664.208890][T23979] ------------------------------------------------------ [ 1664.215942][T23979] syz.3.13162/23979 is trying to acquire lock: [ 1664.222133][T23979] ffff88802729aac8 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 1664.231712][T23979] [ 1664.231712][T23979] but task is already holding lock: [ 1664.239110][T23979] ffff88802729a5a0 (&q->q_usage_counter(io)#52){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 1664.249359][T23979] [ 1664.249359][T23979] which lock already depends on the new lock. [ 1664.249359][T23979] [ 1664.259824][T23979] [ 1664.259824][T23979] the existing dependency chain (in reverse order) is: [ 1664.268871][T23979] [ 1664.268871][T23979] -> #6 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 1664.277525][T23979] blk_alloc_queue+0x544/0x690 [ 1664.282946][T23979] __blk_mq_alloc_disk+0x194/0x390 [ 1664.288701][T23979] nbd_dev_add+0x494/0xb60 [ 1664.293746][T23979] nbd_init+0x168/0x1f0 [ 1664.298580][T23979] do_one_initcall+0x250/0x870 [ 1664.303917][T23979] do_initcall_level+0x10a/0x1a0 [ 1664.309512][T23979] do_initcalls+0x59/0xa0 [ 1664.314406][T23979] kernel_init_freeable+0x29d/0x3e0 [ 1664.320177][T23979] kernel_init+0x22/0x1d0 [ 1664.325067][T23979] ret_from_fork+0x514/0xb70 [ 1664.330218][T23979] ret_from_fork_asm+0x1a/0x30 [ 1664.335541][T23979] [ 1664.335541][T23979] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 1664.342802][T23979] fs_reclaim_acquire+0x71/0x100 [ 1664.348302][T23979] __kmalloc_cache_node_noprof+0x66/0x620 [ 1664.354593][T23979] create_worker+0x112/0x7c0 [ 1664.359745][T23979] workqueue_prepare_cpu+0xe4/0x170 [ 1664.365495][T23979] cpuhp_invoke_callback+0x434/0x810 [ 1664.371363][T23979] _cpu_up+0x2ce/0x5b0 [ 1664.375995][T23979] cpu_up+0x1d2/0x220 [ 1664.380532][T23979] cpuhp_bringup_mask+0xb2/0x1a0 [ 1664.386118][T23979] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 1664.392470][T23979] bringup_nonboot_cpus+0x17/0x30 [ 1664.398086][T23979] smp_init+0x32/0x110 [ 1664.402780][T23979] kernel_init_freeable+0x27f/0x3e0 [ 1664.408532][T23979] kernel_init+0x22/0x1d0 [ 1664.413414][T23979] ret_from_fork+0x514/0xb70 [ 1664.418539][T23979] ret_from_fork_asm+0x1a/0x30 [ 1664.423851][T23979] [ 1664.423851][T23979] -> #4 (cpu_hotplug_lock){++++}-{0:0}: [ 1664.431625][T23979] cpus_read_lock+0x42/0x160 [ 1664.436766][T23979] static_key_slow_inc+0x12/0x30 [ 1664.442277][T23979] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 1664.448599][T23979] nbd_genl_foreach_sock+0x265/0x450 [ 1664.454446][T23979] nbd_genl_reconfigure+0xbbb/0x1040 [ 1664.460278][T23979] genl_family_rcv_msg_doit+0x233/0x340 [ 1664.466375][T23979] genl_rcv_msg+0x614/0x7a0 [ 1664.471432][T23979] netlink_rcv_skb+0x226/0x4a0 [ 1664.476784][T23979] genl_rcv+0x28/0x40 [ 1664.481334][T23979] netlink_unicast+0x7bd/0x940 [ 1664.486655][T23979] netlink_sendmsg+0x813/0xb40 [ 1664.491961][T23979] sock_sendmsg_nosec+0x13a/0x180 [ 1664.497527][T23979] ____sys_sendmsg+0x54e/0x850 [ 1664.502855][T23979] ___sys_sendmsg+0x2a5/0x360 [ 1664.508083][T23979] __x64_sys_sendmsg+0x1b1/0x290 [ 1664.513569][T23979] do_syscall_64+0x166/0x520 [ 1664.518710][T23979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1664.525145][T23979] [ 1664.525145][T23979] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 1664.532841][T23979] __mutex_lock+0x19d/0x1550 [ 1664.537990][T23979] nbd_queue_rq+0x373/0xff0 [ 1664.543039][T23979] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1664.549138][T23979] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1664.556103][T23979] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1664.562637][T23979] blk_mq_run_work_fn+0x16c/0x300 [ 1664.568206][T23979] process_scheduled_works+0xc3d/0x1630 [ 1664.574298][T23979] worker_thread+0xa47/0xfb0 [ 1664.579436][T23979] kthread+0x38b/0x480 [ 1664.586714][T23979] ret_from_fork+0x514/0xb70 [ 1664.591859][T23979] ret_from_fork_asm+0x1a/0x30 [ 1664.597201][T23979] [ 1664.597201][T23979] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 1664.604535][T23979] __mutex_lock+0x19d/0x1550 [ 1664.609752][T23979] nbd_queue_rq+0xc1/0xff0 [ 1664.614765][T23979] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1664.620888][T23979] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1664.627791][T23979] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1664.634321][T23979] blk_mq_run_work_fn+0x16c/0x300 [ 1664.639896][T23979] process_scheduled_works+0xc3d/0x1630 [ 1664.646002][T23979] worker_thread+0xa47/0xfb0 [ 1664.651145][T23979] kthread+0x38b/0x480 [ 1664.655756][T23979] ret_from_fork+0x514/0xb70 [ 1664.660886][T23979] ret_from_fork_asm+0x1a/0x30 [ 1664.666203][T23979] [ 1664.666203][T23979] -> #1 (set->srcu){.+.+}-{0:0}: [ 1664.673355][T23979] __synchronize_srcu+0xc9/0x2f0 [ 1664.678834][T23979] elevator_switch+0x1e8/0x7b0 [ 1664.684160][T23979] elevator_change+0x2fa/0x480 [ 1664.689520][T23979] elevator_set_default+0x375/0x440 [ 1664.695883][T23979] blk_register_queue+0x3f3/0x4e0 [ 1664.701483][T23979] __add_disk+0x6b8/0xdb0 [ 1664.706372][T23979] add_disk_fwnode+0x100/0x3a0 [ 1664.711690][T23979] nbd_dev_add+0x733/0xb60 [ 1664.716651][T23979] nbd_init+0x168/0x1f0 [ 1664.721379][T23979] do_one_initcall+0x250/0x870 [ 1664.726738][T23979] do_initcall_level+0x10a/0x1a0 [ 1664.732261][T23979] do_initcalls+0x59/0xa0 [ 1664.737168][T23979] kernel_init_freeable+0x29d/0x3e0 [ 1664.742928][T23979] kernel_init+0x22/0x1d0 [ 1664.747829][T23979] ret_from_fork+0x514/0xb70 [ 1664.753007][T23979] ret_from_fork_asm+0x1a/0x30 [ 1664.758354][T23979] [ 1664.758354][T23979] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 1664.766234][T23979] __lock_acquire+0x164c/0x2de0 [ 1664.771681][T23979] lock_acquire+0x115/0x350 [ 1664.776748][T23979] __mutex_lock+0x19d/0x1550 [ 1664.781908][T23979] elevator_change+0x1af/0x480 [ 1664.787232][T23979] elevator_set_none+0xb5/0x140 [ 1664.792645][T23979] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1664.799018][T23979] nbd_start_device+0x189/0xb30 [ 1664.804431][T23979] nbd_genl_connect+0x167d/0x1cd0 [ 1664.810009][T23979] genl_family_rcv_msg_doit+0x233/0x340 [ 1664.816121][T23979] genl_rcv_msg+0x614/0x7a0 [ 1664.821203][T23979] netlink_rcv_skb+0x226/0x4a0 [ 1664.826522][T23979] genl_rcv+0x28/0x40 [ 1664.831053][T23979] netlink_unicast+0x7bd/0x940 [ 1664.836399][T23979] netlink_sendmsg+0x813/0xb40 [ 1664.841723][T23979] sock_sendmsg_nosec+0x13a/0x180 [ 1664.847397][T23979] ____sys_sendmsg+0x54e/0x850 [ 1664.852732][T23979] ___sys_sendmsg+0x2a5/0x360 [ 1664.857981][T23979] __x64_sys_sendmsg+0x1b1/0x290 [ 1664.863484][T23979] do_syscall_64+0x166/0x520 [ 1664.868639][T23979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1664.875109][T23979] [ 1664.875109][T23979] other info that might help us debug this: [ 1664.875109][T23979] [ 1664.885358][T23979] Chain exists of: [ 1664.885358][T23979] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#52 [ 1664.885358][T23979] [ 1664.899152][T23979] Possible unsafe locking scenario: [ 1664.899152][T23979] [ 1664.906626][T23979] CPU0 CPU1 [ 1664.912030][T23979] ---- ---- [ 1664.917431][T23979] lock(&q->q_usage_counter(io)#52); [ 1664.922827][T23979] lock(fs_reclaim); [ 1664.929371][T23979] lock(&q->q_usage_counter(io)#52); [ 1664.937312][T23979] lock(&q->elevator_lock); [ 1664.941918][T23979] [ 1664.941918][T23979] *** DEADLOCK *** [ 1664.941918][T23979] [ 1664.950072][T23979] locks held by syz.3.13162/23979: 6, last CPU#0: [ 1664.956502][T23979] #0: ffffffff902c47a8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1664.964759][T23979] #1: ffffffff902c45e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1664.973780][T23979] #2: ffff8880272221c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xab/0x19f0 [ 1664.985205][T23979] #3: ffff8880272220d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbe/0x19f0 [ 1664.996216][T23979] #4: ffff88802729a5a0 (&q->q_usage_counter(io)#52){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 1665.006879][T23979] #5: ffff88802729a5d8 (&q->q_usage_counter(queue)#36){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 1665.017802][T23979] [ 1665.017802][T23979] stack backtrace: [ 1665.023719][T23979] CPU: 0 UID: 0 PID: 23979 Comm: syz.3.13162 Not tainted syzkaller #0 PREEMPT(full) [ 1665.033192][T23979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1665.043268][T23979] Call Trace: [ 1665.046567][T23979] [ 1665.049520][T23979] dump_stack_lvl+0xe8/0x150 [ 1665.054174][T23979] print_circular_bug+0x2e2/0x300 [ 1665.059234][T23979] check_noncircular+0x12f/0x150 [ 1665.064202][T23979] __lock_acquire+0x164c/0x2de0 [ 1665.069154][T23979] lock_acquire+0x115/0x350 [ 1665.073682][T23979] ? elevator_change+0x1af/0x480 [ 1665.078658][T23979] __mutex_lock+0x19d/0x1550 [ 1665.083283][T23979] ? elevator_change+0x1af/0x480 [ 1665.088255][T23979] ? rcu_is_watching+0x16/0xb0 [ 1665.093064][T23979] ? elevator_change+0x1af/0x480 [ 1665.098063][T23979] ? __pfx___mutex_lock+0x10/0x10 [ 1665.103140][T23979] ? enable_work+0x17f/0x230 [ 1665.107771][T23979] ? lockdep_hardirqs_on+0x7b/0x110 [ 1665.113004][T23979] ? __cancel_work_sync+0xf8/0x110 [ 1665.118151][T23979] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 1665.123668][T23979] elevator_change+0x1af/0x480 [ 1665.128459][T23979] elevator_set_none+0xb5/0x140 [ 1665.133344][T23979] ? __pfx_elevator_set_none+0x10/0x10 [ 1665.138831][T23979] ? xa_load+0x1db/0x210 [ 1665.143107][T23979] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1665.148955][T23979] ? kernfs_add_one+0xfc/0x6f0 [ 1665.153749][T23979] ? nbd_start_device+0x17d/0xb30 [ 1665.158795][T23979] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 1665.165089][T23979] ? sysfs_add_file_mode_ns+0x258/0x300 [ 1665.170687][T23979] nbd_start_device+0x189/0xb30 [ 1665.175997][T23979] ? device_create_file+0xf4/0x1b0 [ 1665.181136][T23979] nbd_genl_connect+0x167d/0x1cd0 [ 1665.186190][T23979] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1665.191589][T23979] ? rcu_is_watching+0x16/0xb0 [ 1665.196392][T23979] ? __nla_parse+0x40/0x60 [ 1665.200867][T23979] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1665.207235][T23979] genl_family_rcv_msg_doit+0x233/0x340 [ 1665.212810][T23979] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1665.218902][T23979] ? __lock_acquire+0x747/0x2de0 [ 1665.223863][T23979] genl_rcv_msg+0x614/0x7a0 [ 1665.228397][T23979] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1665.233447][T23979] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1665.238842][T23979] netlink_rcv_skb+0x226/0x4a0 [ 1665.243632][T23979] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1665.248676][T23979] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1665.254005][T23979] ? down_read+0x2be/0x330 [ 1665.258453][T23979] genl_rcv+0x28/0x40 [ 1665.262458][T23979] netlink_unicast+0x7bd/0x940 [ 1665.267255][T23979] netlink_sendmsg+0x813/0xb40 [ 1665.272065][T23979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1665.277378][T23979] ? apparmor_socket_sendmsg+0x98/0x360 [ 1665.282946][T23979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1665.288247][T23979] sock_sendmsg_nosec+0x13a/0x180 [ 1665.293292][T23979] ____sys_sendmsg+0x54e/0x850 [ 1665.298095][T23979] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1665.303418][T23979] ? import_iovec+0x73/0xa0 [ 1665.307953][T23979] ___sys_sendmsg+0x2a5/0x360 [ 1665.312655][T23979] ? __lock_acquire+0x747/0x2de0 [ 1665.317620][T23979] ? __pfx____sys_sendmsg+0x10/0x10 [ 1665.322882][T23979] ? futex_wait+0x2a2/0x390 [ 1665.327431][T23979] ? __fget_files+0x2a/0x420 [ 1665.332070][T23979] ? __fget_files+0x3a2/0x420 [ 1665.336808][T23979] __x64_sys_sendmsg+0x1b1/0x290 [ 1665.341777][T23979] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1665.347300][T23979] do_syscall_64+0x166/0x520 [ 1665.351930][T23979] ? trace_irq_disable+0x3b/0x140 [ 1665.356975][T23979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.363069][T23979] ? clear_bhb_loop+0x70/0xc0 [ 1665.367778][T23979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.373691][T23979] RIP: 0033:0x7f3cf0f9e159 [ 1665.378162][T23979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1665.397814][T23979] RSP: 002b:00007f3cf1eb9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1665.406271][T23979] RAX: ffffffffffffffda RBX: 00007f3cf1225fa0 RCX: 00007f3cf0f9e159 [ 1665.414266][T23979] RDX: 000000000400400c RSI: 0000200000001ac0 RDI: 0000000000000006 [ 1665.422256][T23979] RBP: 00007f3cf103506b R08: 0000000000000000 R09: 0000000000000000 [ 1665.430244][T23979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1665.438235][T23979] R13: 00007f3cf1226038 R14: 00007f3cf1225fa0 R15: 00007ffd6017a9e8 [ 1665.446243][T23979] [ 1665.479774][T23986] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1665.542043][T23988] syzkaller0: entered promiscuous mode [ 1665.542068][T23988] syzkaller0: entered allmulticast mode [ 1665.601566][T14322] block nbd3: Receive control failed (result -32) [ 1665.601699][T14322] block nbd3: Receive control failed (result -32)