last executing test programs: 12.281013852s ago: executing program 3 (id=15027): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000270600000ee60000bf2500000000000073350000000000006507000002001000070700004c0000001f75000000000000bf54000000000000070400004400f9f0ad32010000000000950000000000000005000000000000009500000000000000debfa255e44e4cc39f211fb04d7f202e6a53bd86bde99b679b4e6d24b8125690361eec3b181dcfd7c2fb2d1f8975b579a085bee32d414c1f3ab987a9de6385ae8021f4ca33b9b35fe817e98beb9cefe7f40fd6f0ea3affbdaaa897c70fb01d270a7b00d36fb5ab8fa92ac014a106e3e4decc68652503ca54fcef437d96c8a05d59ddcc8abf09cd77e93e940207b03189c5d4661e43df6f1f036c8d85a2ad7615a021f8cbe507ef94fb9f33315366e9ae080000001b532226b63b460d68808a67529637bf7f6731ad0cf1718bae3c8b9d2f89050cb496fe791381af6fab290900000000000000d640a5fde1f7d5eaa97cd25523fbd773"], 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000c000000430000004000"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000940)={0x6, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000780)=[{0x1, 0x2, 0x2, 0x7}], 0x10, 0xffff4fb5}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000540)="6a6986b20a84e1178528e475878326ac66b750282b41f00fa795c4bf3f919580bfb0dbe78f9f149b84c43f738b402b22e47bba5b47191b9181b4923bbd", 0x10ed, r0}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000000640), 0x16c5, r0, 0x0, 0x40000000}, 0x38) 11.955406762s ago: executing program 3 (id=15032): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c80)=@newqdisc={0x248, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x218, 0x2, [@TCA_GRED_LIMIT={0x8, 0x5, 0x5}, @TCA_GRED_PARMS={0x38, 0x1, {0x5, 0x9, 0xfff, 0x2, 0x4, 0x81, 0x81, 0x8000, 0x5, 0xf, 0x2, 0x18, 0x1, 0x84, 0x0, 0xcb0}}, @TCA_GRED_DPS={0x10, 0x3, {0xb, 0x5, 0x0, 0x5}}, @TCA_GRED_PARMS={0x38, 0x1, {0x6, 0x400, 0x5, 0x8, 0x7fff, 0xffffff10, 0xfffff3f5, 0x0, 0x5, 0xb, 0x14, 0x9, 0x19, 0x3, 0x2, 0x1000}}, @TCA_GRED_STAB={0x104, 0x2, "3ba496a21d628cb943fe89eab32da2c9891c52f905562b1d9a2d268a963542986df79a4f3235cca66cfe29fd048e43b6bc8daddadc5faa9ba0e28aa62a9a1a8b76811e10ef4cd77c6beed9c607e4c35f6dbda27c4080898b90a949fa972a9c593869769fc9d9237fc42dba92b349f7a7d5a627a3fde85608ab21cd83d65f8c7018f714d81b57fbc3ac3b8a55654fb8a19e0ec921c5c7c59d438de6ec0c3d911682ba9f3786798abe13711ae7c4e9ba868610a6baa2e5ce7ff238cb86081ff921eab7dc4aadcfab73de8ecdfddc1c888865f43210663357074264178ce7ea37fca6abb0918aabe5ae1c24e39e92be4fdd4bf48504cb5884bfc43a63a8cbb3b7a2"}, @TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x67, 0x15, 0x3, 0xfffffffd, 0x6, 0x8a00, 0x7fffffff, 0x1, 0xc09, 0x13, 0x1b, 0x1f, 0x2, 0x7, 0xffffff80}}, @TCA_GRED_DPS={0x10, 0x3, {0x1, 0xe, 0x0, 0x2}}, @TCA_GRED_LIMIT={0x8, 0x5, 0x1ff}, @TCA_GRED_PARMS={0x38, 0x1, {0xd7, 0x3, 0x1, 0x0, 0x5, 0x4, 0x8001, 0x93a, 0x5, 0x2, 0x11, 0x1e, 0x2, 0x1, 0xb, 0x6}}]}}]}, 0x248}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) 11.74398598s ago: executing program 3 (id=15036): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0x5}, {0x0, 0xc}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0xfffffcf0}}, 0x400) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd25, 0x25dfdc80, {0x0, 0x0, 0x0, r4, {0xfff2, 0xf}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x10000000, 0x7, 0xffeffffc}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}}, 0x4c800) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)=0x1000000) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x110c230000) close(0x3) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000780)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x50bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x5}, {0xffff, 0xffff}, {0x3, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}}, 0x0) close(r7) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r11 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r11, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r12, 0x3f}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x8004) 10.971020955s ago: executing program 4 (id=15044): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x13, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x6d}], {0x95, 0x0, 0x0, 0xffbf}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) 10.893585576s ago: executing program 2 (id=15045): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/pid\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x2bb19000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000001314000480080002400000000008000140000000030900010073797a3000"], 0xf0}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) 10.785191314s ago: executing program 4 (id=15046): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ipvlan0\x00', 0x0}) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c80)=@newqdisc={0x248, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x218, 0x2, [@TCA_GRED_LIMIT={0x8, 0x5, 0x5}, @TCA_GRED_PARMS={0x38, 0x1, {0x5, 0x9, 0xfff, 0x2, 0x4, 0x81, 0x81, 0x8000, 0x5, 0xf, 0x2, 0x18, 0x1, 0x84, 0x0, 0xcb0}}, @TCA_GRED_DPS={0x10, 0x3, {0xb, 0x5, 0x0, 0x5}}, @TCA_GRED_PARMS={0x38, 0x1, {0x6, 0x400, 0x5, 0x8, 0x7fff, 0xffffff10, 0xfffff3f5, 0x0, 0x5, 0xb, 0x14, 0x9, 0x19, 0x3, 0x2, 0x1000}}, @TCA_GRED_STAB={0x104, 0x2, "3ba496a21d628cb943fe89eab32da2c9891c52f905562b1d9a2d268a963542986df79a4f3235cca66cfe29fd048e43b6bc8daddadc5faa9ba0e28aa62a9a1a8b76811e10ef4cd77c6beed9c607e4c35f6dbda27c4080898b90a949fa972a9c593869769fc9d9237fc42dba92b349f7a7d5a627a3fde85608ab21cd83d65f8c7018f714d81b57fbc3ac3b8a55654fb8a19e0ec921c5c7c59d438de6ec0c3d911682ba9f3786798abe13711ae7c4e9ba868610a6baa2e5ce7ff238cb86081ff921eab7dc4aadcfab73de8ecdfddc1c888865f43210663357074264178ce7ea37fca6abb0918aabe5ae1c24e39e92be4fdd4bf48504cb5884bfc43a63a8cbb3b7a2"}, @TCA_GRED_PARMS={0x38, 0x1, {0x1, 0x67, 0x15, 0x3, 0xfffffffd, 0x6, 0x8a00, 0x7fffffff, 0x1, 0xc09, 0x13, 0x1b, 0x1f, 0x2, 0x7, 0xffffff80}}, @TCA_GRED_DPS={0x10, 0x3, {0x1, 0xe, 0x0, 0x2}}, @TCA_GRED_LIMIT={0x8, 0x5, 0x1ff}, @TCA_GRED_PARMS={0x38, 0x1, {0xd7, 0x3, 0x1, 0x0, 0x5, 0x4, 0x8001, 0x93a, 0x5, 0x2, 0x11, 0x1e, 0x2, 0x1, 0xb, 0x6}}]}}]}, 0x248}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) 10.174244115s ago: executing program 0 (id=15047): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0xe0b, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xffe0, 0xd064db0e491fa98f}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_INGRESS={0x8, 0xf, 0x1}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x4000080) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000500)={0x0, 0x5, 0x10}, 0xc) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x100, 0x1, 0x28}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000010000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000003c0)={r0, &(0x7f0000000300), 0x0}, 0x20) 10.052050213s ago: executing program 0 (id=15048): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x220, 0x308, 0x220, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0xffffff00, 0x1, 0x0, {@empty, {[0x0, 0x0, 0xff]}}, {@mac=@local}, 0x0, 0x7, 0x2, 0x0, 0x800, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00', {}, {}, 0x0, 0x180}, 0xc0, 0x110, 0x0, {0x0, 0x9e01}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @loopback, @broadcast, 0x6, 0xfffffffe}}}, {{@arp={@initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, 0x0, 0x0, 0x0, 0xfd, {}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00', {}, {}, 0x0, 0xc}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}, @broadcast, @dev={0xac, 0x14, 0x14, 0x12}, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000008b80)={&(0x7f0000008a40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x2, [@func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{0x1, 0x3}, {0xb}, {0x0, 0x3}, {0x7, 0x1}]}]}}, 0x0, 0x46, 0x0, 0x1, 0x3}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0xe, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fff8ffffff71a4f0ff0000000071103700000000007d400500000000002604000001ed00000f030000000000007c440000000000006b0a00fe000000007203000000000006b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c26fc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'netdevsim0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x29, 0xcdb, 0x5, 0x9, 0x6a, 0x4, 0x20, 0x7, 0x0, 0x5, 0xfffffff8, 0x3, 0x9, 0x81, 0x6, 0x8, [0xf, 0x7]}}) 9.961165883s ago: executing program 0 (id=15049): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000100001f500000000000000000000000a209cff00000a010100000000000000000a0000000900010073797a300000000048000000030a010200000000000000000a0004000900010073797a30000000000900030073797a3100000000080007006e617400140004800800014000000003080002400000000014000000020a69"], 0xa4}}, 0x0) 9.918472916s ago: executing program 2 (id=15050): recvmsg(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)}, 0x1f00) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc0100001900010025bd700000000000ac14140300000000000000000000000000000020000000000000000000000000000000030000000002000020c3000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fdffffffffffffff0100000000000000020000000000000007000000000000000000000000000000000000000000000000000000000000001d000000000000000000000000000000faffffffffffffff0000000000000000dd0200000000000000000000c06b6e00000000000000000044010500e00000020000000000000000000000000000000033000000000000007f00000100000000000000000000000000000000000001000000000000000000000000007f0000010000000000000000000000000000000032"], 0x1fc}, 0x1, 0x0, 0x0, 0x88000}, 0x0) 9.792030535s ago: executing program 0 (id=15051): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e0000000400000004"], 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x22020400) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket$inet6(0xa, 0x5, 0x0) listen(r2, 0x10000) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000080)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080040000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed51000000000000000000", 0x48}], 0x1) syz_genetlink_get_family_id$team(&(0x7f0000000000), r3) bind$bt_sco(r1, &(0x7f00000004c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xfffffffffffffd10) sendmsg$IPSET_CMD_TYPE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x64, 0xd, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x44000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd23, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x35a38, 0x4522f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040044) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000002280)="0011223344550011223344560800", 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r8, 0xc020f509, &(0x7f0000000280)={r8, 0x7, 0x104, 0x7ff}) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) connect$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r9 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r9, &(0x7f0000000300)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0x10) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000700)={r5, r5, 0xa, 0x1, &(0x7f0000000500)='\r', 0x7, 0x3, 0x7c0, 0x3, 0x8, 0x1, 0x1, 'syz0\x00'}) 9.78361706s ago: executing program 2 (id=15052): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYRESHEX, @ANYRES32=0x0, @ANYBLOB="00e300000000000400000000000000000000000003785555", @ANYRES32, @ANYRESDEC=0x0, @ANYRES8=0x0], 0x48) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001c00010000000000000000a007000000", @ANYRES32=r1, @ANYBLOB="400096040a000200aaaaaaaaaa0c000006000500"], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) (async) r2 = socket(0x18, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) (async) bind$inet(r2, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) (async) recvmmsg(r2, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=""/20, 0x14}, 0x8}], 0x1, 0x120, 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000140)={0x7, 0xfaf, 0x4, 0x10, 0x3}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r4, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x38, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x0, @private2={0xfc, 0x2, '\x00', 0xff}}, @in6={0xa, 0x4e21, 0xf, @loopback, 0x6}]}, &(0x7f0000000180)=0x10) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async) writev(r6, &(0x7f0000000100)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) (async) setsockopt$inet_mreqsrc(r5, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$inet_smc(0x2b, 0x1, 0x0) (async) r7 = socket$inet_sctp(0x2, 0x1, 0x84) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000f6816c80d8e3e70405e1813eb85c4645ec5ff54bd7c8fe5f14de8bbe630a828316c2e1d8cdf08831b9d831595d0ebfa6c73e21bd09d10c147f71fc9e61418bc48179d7b39b56310541bd9bd6404935d676b8cc3b51460adfc8d7b7747dc63727", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0400"/28], 0x50) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="050327bd7000000000000700000008000300", @ANYRES32=r8], 0x1c}}, 0x24044080) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 6.03692494s ago: executing program 4 (id=15053): syz_emit_ethernet(0x56, &(0x7f0000000000)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x20, 0x3a, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], @ndisc_ns={0x87, 0x0, 0x0, @private0, [{}, {}, {0xe, 0x1, "24fcaa8fc05a"}]}}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x703, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x64, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x38, 0x3, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x28, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe8}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x2c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 5.860001706s ago: executing program 4 (id=15054): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000002f000903feff00000000000006"], 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c0000002f0027bd70007124fddbdf250400000007000b00050000006ad21c"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x20040004) recvmsg(r0, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x2000) (async) recvmsg(r0, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x2000) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000003ffffffffffffffff0001000700"/28], 0x1c}, 0x1, 0x0, 0x0, 0x20008804}, 0x0) (async) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000003ffffffffffffffff0001000700"/28], 0x1c}, 0x1, 0x0, 0x0, 0x20008804}, 0x0) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) accept4(r4, &(0x7f0000000580)=@xdp, &(0x7f0000000600)=0x80, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket(0x26, 0x5, 0x8002) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x27, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000007f000000000000000500000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000010001007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70500000800000085000000a50000001831000002000000000000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ff0008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000084000000b70000000000000095000000000000000000000000f052f46de18ad48c899cd8e43905e3ba873ed7e1b08051c18b00d0ebbb666db78583c690b7beff82d54bc55476281401c7008b37534b8fac3cf6d5b1295440576bac097d6a81eff8112e1bf50dd65dc46a5a377d9b018b6ec0f0648a9090aa142cd574c268682523d41a5f1afee947d4df6230742ceb5f78cd4382a3dbee4e6fdf70633f782ddb841b187957134e02831aa631a61b54f2d67250e4824967803bfbebd6e42849fe36a286a2f56c9cf01349a4864b2f038af7abf63a981d674f595a43ccfd0c3617a5a8727537c0918e1aed4e3d93feb2d75efa9557c95cecf06e1f0984fd611c4d7867777a8246cf292f4a26a97a2ed8c1876267299184ef7f6475268bbe49"], 0x0, 0xf400, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff2}, 0x94) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x27, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000007f000000000000000500000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000010001007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b70500000800000085000000a50000001831000002000000000000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ff0008000000b7040000010000008500000082000000bf91000000000000b7020000010000008500000084000000b70000000000000095000000000000000000000000f052f46de18ad48c899cd8e43905e3ba873ed7e1b08051c18b00d0ebbb666db78583c690b7beff82d54bc55476281401c7008b37534b8fac3cf6d5b1295440576bac097d6a81eff8112e1bf50dd65dc46a5a377d9b018b6ec0f0648a9090aa142cd574c268682523d41a5f1afee947d4df6230742ceb5f78cd4382a3dbee4e6fdf70633f782ddb841b187957134e02831aa631a61b54f2d67250e4824967803bfbebd6e42849fe36a286a2f56c9cf01349a4864b2f038af7abf63a981d674f595a43ccfd0c3617a5a8727537c0918e1aed4e3d93feb2d75efa9557c95cecf06e1f0984fd611c4d7867777a8246cf292f4a26a97a2ed8c1876267299184ef7f6475268bbe49"], 0x0, 0xf400, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff2}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) (async) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010409000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) (async) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @multicast}) (async) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @multicast}) socket$unix(0x1, 0x2, 0x0) write$tun(r7, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a120000140000006c07010033d43afffe800000000000000000000000000010ff02000000000000000000000000000189"], 0x340a) ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) (async) r9 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r5, 0x0, 0x0) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000000480)='ns/mnt\x00') sendmsg$RDMA_NLDEV_CMD_SYS_SET(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x3c, 0x1407, 0x1, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r5}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r9}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r10}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4010}, 0x800) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x3d0, 0xffffffff, 0x250, 0x1b8, 0x250, 0xffffffff, 0xffffffff, 0x338, 0x338, 0x338, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @multicast2, 0x0, 0x0, 'geneve0\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0x190, 0x1b8, 0x0, {0x100000000000000}, [@common=@inet=@recent0={{0xf8}, {0xd06, 0x2, 0x2, 0x0, 'syz0\x00', 0x4}}, @common=@unspec=@cgroup0={{0x28}, {0x7, 0x1}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0xff}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x6b7, 0x500, 0x1}}, @common=@socket0={{0x20}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x430) 5.85319759s ago: executing program 1 (id=15055): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x18}], {0x95, 0x0, 0x0, 0xfe}}, &(0x7f0000000680)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffff8}, 0x94) 5.80423722s ago: executing program 0 (id=15056): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000003340)=[{{&(0x7f00000003c0)={0xa, 0x4e22, 0x7fff, @loopback, 0x5}, 0x1c, &(0x7f0000001b00)=[{&(0x7f0000001a80)='g', 0x1}], 0x1}}, {{&(0x7f0000001bc0)={0xa, 0x4e20, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="1b", 0x43}], 0x1}}], 0x2, 0x40) sendto$inet6(r1, &(0x7f0000000300)="8b", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x80}}, 0x1c) shutdown(r1, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x10, 0x80002, 0x0) (async) r3 = socket(0x10, 0x80002, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) (async) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003340)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xfff2, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x81, 0x7fffffff, 0x5, 0x4}, 0x7, 0xd}, [{0x4, 0xc, 0x1, 0x0, 0x8, 0xa517}, {0x9, 0x6283, 0x4, 0x7ff, 0x6, 0x5}, {0x7fff, 0x9, 0x1, 0x7, 0x680, 0x80}, {0x6, 0xe62, 0x0, 0x10, 0x7, 0x7f}, {0x1, 0x0, 0x8, 0x2, 0x0, 0x487}, {0x6235, 0x4, 0x640c, 0x7, 0x3, 0x7}, {0xa10, 0x6, 0x7, 0x7, 0x3, 0xefe3}, {0x9, 0x3, 0x400, 0xff, 0x8, 0xd}, {0x5, 0x6fb, 0x6, 0xc, 0x7, 0x8}, {0x0, 0x8001, 0x1, 0x101, 0x7}, {0x6, 0x1, 0xfa5b, 0x9, 0x78d7, 0x4}, {0x9, 0x7, 0x6, 0x6, 0x1, 0x4}, {0x8, 0x4, 0xfffffffa, 0x10000, 0xff}, {0x7, 0x1, 0xbf5, 0xd42, 0xfbe, 0x10000}, {0xffffffff, 0x1, 0xe, 0x5, 0x7, 0x2}, {0xe8d, 0x9, 0x3, 0x2, 0x2, 0x5}, {0x7fa, 0x2a, 0x1, 0x3, 0x5, 0x1}, {0x4, 0x5, 0x0, 0x1, 0x9, 0x9}, {0x81, 0x2, 0x5547, 0x7, 0x4, 0x3}, {0x5, 0x4, 0x65b97795, 0x9, 0x4, 0x4d}, {0xaea, 0x83b2, 0x7, 0xa, 0x3, 0x1}, {0xff, 0x3ff, 0x0, 0x6, 0x100, 0xc0000000}, {0x3ff, 0x9, 0xf, 0x1000}, {0x40, 0x7e23, 0x1, 0x10000, 0x9, 0x8}, {0xffffffff, 0x17, 0x9, 0x7fffffff, 0x59, 0x80000001}, {0x8, 0x8, 0x0, 0x9, 0x2, 0x9}, {0x6, 0x80000001, 0x5, 0x80000001, 0x6, 0x1}, {0x3, 0x1, 0x9, 0x8ab6, 0x7, 0xc}, {0x80, 0x9, 0x2, 0x5, 0x9, 0x1}, {0x83ae, 0xf, 0x5, 0x2, 0xffff, 0xffffffac}, {0x31, 0x5, 0x80000000, 0x80, 0xc3}, {0x7, 0x5, 0x8000, 0x7, 0x8, 0x3}, {0x1, 0xfffffff7, 0x8, 0x5, 0xffffff90, 0x101}, {0x8, 0x3, 0x4, 0x2, 0x4, 0x1ff}, {0x6, 0xd, 0x2, 0x3f, 0xfff, 0x2}, {0x8001, 0x2, 0x0, 0x5fe2, 0xb80, 0xebc2}, {0x6, 0x80, 0xb, 0x59, 0x8, 0x5}, {0x91, 0x0, 0xba, 0x8080, 0xe, 0xfffff4e2}, {0x0, 0x38e3, 0x7, 0xffffffff, 0xdf, 0x79}, {0x5, 0x80f, 0x9, 0x6, 0x80e, 0x4}, {0x200, 0x6, 0x5, 0xd3, 0x0, 0x7}, {0x3, 0x8, 0xf, 0x8, 0x5, 0xfffffff7}, {0x9, 0x0, 0x9, 0x80, 0x9, 0x3}, {0x1, 0x81, 0x401, 0x98b, 0x2, 0xe}, {0x1, 0x8, 0x3ff, 0x2, 0x200, 0x7}, {0x3, 0x5, 0xc, 0xe9f, 0x3, 0x4}, {0x6, 0x890, 0x8, 0x1ff, 0xff, 0xf579}, {0x1, 0x3, 0x6, 0x80, 0x0, 0x7ff}, {0x5, 0x7, 0x1, 0x1000, 0x4642, 0x10000}, {0x80, 0x8, 0xfffffff7, 0xfff, 0x23, 0x5ee6}, {0x7f, 0x4, 0x24, 0x9, 0x1, 0x1}, {0xbc, 0x5, 0x1, 0x1ff, 0x3, 0x5291}, {0xc, 0x4, 0x4, 0x2, 0x4, 0x2}, {0x9, 0x8, 0x3, 0x0, 0x0, 0xfffffff7}, {0x8, 0x4, 0x9, 0x7, 0x8, 0x3000000}, {0x2, 0x9, 0x3ff, 0x7f, 0xffffffff, 0x4772}, {0xa, 0x5, 0x56e, 0xd0000000, 0x60, 0x8}, {0x1, 0x0, 0x4, 0x3, 0xb56, 0x3}, {0xe, 0x3, 0xfffffff7, 0x8, 0xfffffffc, 0x401}, {0x29, 0x1, 0x3, 0x7, 0x9, 0x69}, {0xe, 0x77, 0x779, 0x2, 0x4, 0x81}, {0x6, 0x6, 0xbe, 0x1, 0x8, 0x3}, {0x9, 0x6, 0x9, 0x3, 0x10001, 0x9}, {0x5cc, 0x8000, 0x3, 0x3b55, 0x3, 0x4}, {0x9, 0x1, 0x0, 0x2, 0x4, 0x9}, {0x9, 0x4000, 0x3, 0x80000000, 0x10001, 0x2}, {0xfe, 0x4, 0x3, 0x1, 0xdd, 0x2}, {0x7, 0x7, 0x7fff, 0x8001, 0xfffffffd, 0x4}, {0xa95, 0xd, 0x1, 0x7, 0x10000, 0x3}, {0x8702, 0x81, 0x2, 0x400, 0x0, 0x5}, {0x2, 0x7f, 0x3ff, 0x2, 0x9262, 0x4}, {0xd255, 0x0, 0x1, 0x4, 0x1, 0xf}, {0x0, 0x3, 0x8, 0xffff, 0xf161, 0x2}, {0x7f, 0xd82, 0xd4d, 0x7, 0x80000001}, {0x1, 0x7, 0x9, 0x4, 0x10000, 0x7}, {0x65, 0x6, 0x4, 0x3, 0x4e7, 0xfffff952}, {0x1, 0x2b3, 0xfd, 0x10001, 0x5, 0x401}, {0x6, 0x600, 0xb9c, 0xf8b, 0x7}, {0x1, 0x3, 0x7, 0x892a4e08, 0x8b4, 0x5}, {0xffffffff, 0xfffffff8, 0x4be, 0x15, 0x80000001, 0x6}, {0x6, 0x37fc, 0x4, 0x3ff, 0x5, 0x5}, {0x5, 0x8, 0x6, 0x7fff, 0xfffffffc, 0x10}, {0x7, 0x8, 0x728, 0x3, 0x2, 0xb}, {0xfffffff7, 0x1, 0x7, 0x33a, 0x4c, 0xfc000000}, {0x3720, 0xffff0000, 0x4, 0x100, 0x7, 0x80000000}, {0xc, 0x7f, 0x0, 0x222d, 0x4, 0xa7fc}, {0x4, 0xe4bf, 0x6, 0x9, 0x2}, {0x2, 0x3, 0x6, 0x6, 0x6, 0xd}, {0xfffffffb, 0x7920, 0x4, 0x7, 0x1, 0x3}, {0xf05, 0x1, 0x1, 0x9, 0x4, 0x1}, {0x2, 0x5, 0x8000, 0xffffffff, 0xfffffff0, 0x1}, {0x3, 0x2, 0x1, 0x5, 0x7, 0x1}, {0xfffffffc, 0x5, 0x0, 0x5, 0x6, 0x6}, {0x2, 0x65, 0xf4ea, 0x7fffffff, 0x8, 0x4}, {0x8001, 0x7, 0x9, 0xfff, 0x6, 0x7f}, {0xb5b5, 0xffffffff, 0x40, 0x2, 0xfffff535, 0x9}, {0xf79, 0x0, 0x40, 0x0, 0xffff, 0x200}, {0x278424d5, 0xffffffff, 0x5, 0x7, 0x3f3b5b77, 0x9}, {0x5, 0xb, 0x1, 0x7, 0x0, 0x2}, {0x1, 0x101, 0x7f, 0x0, 0xc81, 0x3}, {0x10000, 0x9d3, 0x7, 0x6, 0x3, 0xbd}, {0x9, 0x7, 0xb33e, 0xa, 0x6, 0x6}, {0xafd6, 0x19a0, 0x2, 0xdaa, 0x401, 0x8}, {0x2, 0x9, 0x8, 0x200, 0x3, 0xa5a}, {0x5, 0x11, 0x6, 0x1, 0x4, 0xfffffff9}, {0x81, 0x4, 0x4, 0xffffb72c, 0x1, 0x2}, {0x1, 0xffff, 0xd, 0xb, 0x9, 0x5}, {0x240, 0xd3db, 0xffff8000, 0x409, 0x80000001, 0x401}, {0x8, 0x2, 0x4, 0x7ff, 0x754200, 0x2}, {0x7, 0x8, 0x2, 0x0, 0x5, 0x10001}, {0x7b7, 0x5, 0xffff, 0x0, 0x10001, 0x9}, {0x5, 0x4, 0x9, 0x10, 0x8e, 0x8e}, {0x16, 0x4, 0x4, 0x2, 0x3, 0x9}, {0x7, 0x4, 0x8, 0x10001, 0x8000, 0x1}, {0x1d62, 0x4, 0x9, 0xf3a, 0x7fffffff, 0x9ad}, {0x7, 0xe4, 0x6, 0x9e, 0x7, 0xf059}, {0x3, 0x6, 0x8, 0x1400000, 0xed9, 0x6}, {0xfffffffb, 0x6, 0x10000, 0x7, 0x0, 0x6}, {0xe06, 0x8, 0x3, 0x7, 0x10001, 0x3}, {0x101, 0x8, 0x101, 0x30, 0x4, 0x6}, {0x2, 0x7fff, 0x2d, 0x0, 0x4, 0x2}, {0x0, 0x2, 0xf, 0x1, 0x80, 0xc}, {0x0, 0x6, 0x4, 0xad, 0x40, 0x3ff}, {0x1000, 0x4, 0x1, 0x6, 0x4}, {0xe38, 0x5, 0x5, 0x3, 0x3, 0x4}, {0x1, 0xff, 0x6, 0x41fb, 0x200, 0x200}, {0x6, 0x55460a17, 0x54, 0x9, 0x6, 0x5}, {0x401, 0x10, 0x4, 0x74c8bacd, 0x5, 0x6}], [{0x2}, {0x2, 0x1}, {0x2, 0x1}, {0x5}, {}, {0x4, 0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x1}, {0x5}, {0x4}, {0x1}, {0x3}, {0x2}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x4}, {0x0, 0x1}, {0x5}, {0x6}, {0x3}, {}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x5}, {0x3}, {}, {0x1, 0x1}, {0x2}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {}, {0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {}, {0x0, 0x1}, {0x2}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5}, {0x3}, {0x3, 0x1}, {0x1}, {0x5}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x6}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x5}, {0x2}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {0x4}, {}, {0x2, 0x1}, {0x2, 0x1}, {0x2}, {}, {0x3}, {0x1}, {0x5}, {0x1, 0x83b0069cb76b49f3}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x1}, {}, {0x5, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x2}, {}, {0x1}, {0x4}, {0x1}, {0x5}, {0x1}, {0x4, 0x1}, {0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0xd779dfac818b8296, 0x1}, {0x2, 0x1}, {0x2}, {}, {0x4, 0x1}, {}, {0x4, 0x1}, {}, {0x0, 0x1}, {0x0, 0x1}]}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003340)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xfff2, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x81, 0x7fffffff, 0x5, 0x4}, 0x7, 0xd}, [{0x4, 0xc, 0x1, 0x0, 0x8, 0xa517}, {0x9, 0x6283, 0x4, 0x7ff, 0x6, 0x5}, {0x7fff, 0x9, 0x1, 0x7, 0x680, 0x80}, {0x6, 0xe62, 0x0, 0x10, 0x7, 0x7f}, {0x1, 0x0, 0x8, 0x2, 0x0, 0x487}, {0x6235, 0x4, 0x640c, 0x7, 0x3, 0x7}, {0xa10, 0x6, 0x7, 0x7, 0x3, 0xefe3}, {0x9, 0x3, 0x400, 0xff, 0x8, 0xd}, {0x5, 0x6fb, 0x6, 0xc, 0x7, 0x8}, {0x0, 0x8001, 0x1, 0x101, 0x7}, {0x6, 0x1, 0xfa5b, 0x9, 0x78d7, 0x4}, {0x9, 0x7, 0x6, 0x6, 0x1, 0x4}, {0x8, 0x4, 0xfffffffa, 0x10000, 0xff}, {0x7, 0x1, 0xbf5, 0xd42, 0xfbe, 0x10000}, {0xffffffff, 0x1, 0xe, 0x5, 0x7, 0x2}, {0xe8d, 0x9, 0x3, 0x2, 0x2, 0x5}, {0x7fa, 0x2a, 0x1, 0x3, 0x5, 0x1}, {0x4, 0x5, 0x0, 0x1, 0x9, 0x9}, {0x81, 0x2, 0x5547, 0x7, 0x4, 0x3}, {0x5, 0x4, 0x65b97795, 0x9, 0x4, 0x4d}, {0xaea, 0x83b2, 0x7, 0xa, 0x3, 0x1}, {0xff, 0x3ff, 0x0, 0x6, 0x100, 0xc0000000}, {0x3ff, 0x9, 0xf, 0x1000}, {0x40, 0x7e23, 0x1, 0x10000, 0x9, 0x8}, {0xffffffff, 0x17, 0x9, 0x7fffffff, 0x59, 0x80000001}, {0x8, 0x8, 0x0, 0x9, 0x2, 0x9}, {0x6, 0x80000001, 0x5, 0x80000001, 0x6, 0x1}, {0x3, 0x1, 0x9, 0x8ab6, 0x7, 0xc}, {0x80, 0x9, 0x2, 0x5, 0x9, 0x1}, {0x83ae, 0xf, 0x5, 0x2, 0xffff, 0xffffffac}, {0x31, 0x5, 0x80000000, 0x80, 0xc3}, {0x7, 0x5, 0x8000, 0x7, 0x8, 0x3}, {0x1, 0xfffffff7, 0x8, 0x5, 0xffffff90, 0x101}, {0x8, 0x3, 0x4, 0x2, 0x4, 0x1ff}, {0x6, 0xd, 0x2, 0x3f, 0xfff, 0x2}, {0x8001, 0x2, 0x0, 0x5fe2, 0xb80, 0xebc2}, {0x6, 0x80, 0xb, 0x59, 0x8, 0x5}, {0x91, 0x0, 0xba, 0x8080, 0xe, 0xfffff4e2}, {0x0, 0x38e3, 0x7, 0xffffffff, 0xdf, 0x79}, {0x5, 0x80f, 0x9, 0x6, 0x80e, 0x4}, {0x200, 0x6, 0x5, 0xd3, 0x0, 0x7}, {0x3, 0x8, 0xf, 0x8, 0x5, 0xfffffff7}, {0x9, 0x0, 0x9, 0x80, 0x9, 0x3}, {0x1, 0x81, 0x401, 0x98b, 0x2, 0xe}, {0x1, 0x8, 0x3ff, 0x2, 0x200, 0x7}, {0x3, 0x5, 0xc, 0xe9f, 0x3, 0x4}, {0x6, 0x890, 0x8, 0x1ff, 0xff, 0xf579}, {0x1, 0x3, 0x6, 0x80, 0x0, 0x7ff}, {0x5, 0x7, 0x1, 0x1000, 0x4642, 0x10000}, {0x80, 0x8, 0xfffffff7, 0xfff, 0x23, 0x5ee6}, {0x7f, 0x4, 0x24, 0x9, 0x1, 0x1}, {0xbc, 0x5, 0x1, 0x1ff, 0x3, 0x5291}, {0xc, 0x4, 0x4, 0x2, 0x4, 0x2}, {0x9, 0x8, 0x3, 0x0, 0x0, 0xfffffff7}, {0x8, 0x4, 0x9, 0x7, 0x8, 0x3000000}, {0x2, 0x9, 0x3ff, 0x7f, 0xffffffff, 0x4772}, {0xa, 0x5, 0x56e, 0xd0000000, 0x60, 0x8}, {0x1, 0x0, 0x4, 0x3, 0xb56, 0x3}, {0xe, 0x3, 0xfffffff7, 0x8, 0xfffffffc, 0x401}, {0x29, 0x1, 0x3, 0x7, 0x9, 0x69}, {0xe, 0x77, 0x779, 0x2, 0x4, 0x81}, {0x6, 0x6, 0xbe, 0x1, 0x8, 0x3}, {0x9, 0x6, 0x9, 0x3, 0x10001, 0x9}, {0x5cc, 0x8000, 0x3, 0x3b55, 0x3, 0x4}, {0x9, 0x1, 0x0, 0x2, 0x4, 0x9}, {0x9, 0x4000, 0x3, 0x80000000, 0x10001, 0x2}, {0xfe, 0x4, 0x3, 0x1, 0xdd, 0x2}, {0x7, 0x7, 0x7fff, 0x8001, 0xfffffffd, 0x4}, {0xa95, 0xd, 0x1, 0x7, 0x10000, 0x3}, {0x8702, 0x81, 0x2, 0x400, 0x0, 0x5}, {0x2, 0x7f, 0x3ff, 0x2, 0x9262, 0x4}, {0xd255, 0x0, 0x1, 0x4, 0x1, 0xf}, {0x0, 0x3, 0x8, 0xffff, 0xf161, 0x2}, {0x7f, 0xd82, 0xd4d, 0x7, 0x80000001}, {0x1, 0x7, 0x9, 0x4, 0x10000, 0x7}, {0x65, 0x6, 0x4, 0x3, 0x4e7, 0xfffff952}, {0x1, 0x2b3, 0xfd, 0x10001, 0x5, 0x401}, {0x6, 0x600, 0xb9c, 0xf8b, 0x7}, {0x1, 0x3, 0x7, 0x892a4e08, 0x8b4, 0x5}, {0xffffffff, 0xfffffff8, 0x4be, 0x15, 0x80000001, 0x6}, {0x6, 0x37fc, 0x4, 0x3ff, 0x5, 0x5}, {0x5, 0x8, 0x6, 0x7fff, 0xfffffffc, 0x10}, {0x7, 0x8, 0x728, 0x3, 0x2, 0xb}, {0xfffffff7, 0x1, 0x7, 0x33a, 0x4c, 0xfc000000}, {0x3720, 0xffff0000, 0x4, 0x100, 0x7, 0x80000000}, {0xc, 0x7f, 0x0, 0x222d, 0x4, 0xa7fc}, {0x4, 0xe4bf, 0x6, 0x9, 0x2}, {0x2, 0x3, 0x6, 0x6, 0x6, 0xd}, {0xfffffffb, 0x7920, 0x4, 0x7, 0x1, 0x3}, {0xf05, 0x1, 0x1, 0x9, 0x4, 0x1}, {0x2, 0x5, 0x8000, 0xffffffff, 0xfffffff0, 0x1}, {0x3, 0x2, 0x1, 0x5, 0x7, 0x1}, {0xfffffffc, 0x5, 0x0, 0x5, 0x6, 0x6}, {0x2, 0x65, 0xf4ea, 0x7fffffff, 0x8, 0x4}, {0x8001, 0x7, 0x9, 0xfff, 0x6, 0x7f}, {0xb5b5, 0xffffffff, 0x40, 0x2, 0xfffff535, 0x9}, {0xf79, 0x0, 0x40, 0x0, 0xffff, 0x200}, {0x278424d5, 0xffffffff, 0x5, 0x7, 0x3f3b5b77, 0x9}, {0x5, 0xb, 0x1, 0x7, 0x0, 0x2}, {0x1, 0x101, 0x7f, 0x0, 0xc81, 0x3}, {0x10000, 0x9d3, 0x7, 0x6, 0x3, 0xbd}, {0x9, 0x7, 0xb33e, 0xa, 0x6, 0x6}, {0xafd6, 0x19a0, 0x2, 0xdaa, 0x401, 0x8}, {0x2, 0x9, 0x8, 0x200, 0x3, 0xa5a}, {0x5, 0x11, 0x6, 0x1, 0x4, 0xfffffff9}, {0x81, 0x4, 0x4, 0xffffb72c, 0x1, 0x2}, {0x1, 0xffff, 0xd, 0xb, 0x9, 0x5}, {0x240, 0xd3db, 0xffff8000, 0x409, 0x80000001, 0x401}, {0x8, 0x2, 0x4, 0x7ff, 0x754200, 0x2}, {0x7, 0x8, 0x2, 0x0, 0x5, 0x10001}, {0x7b7, 0x5, 0xffff, 0x0, 0x10001, 0x9}, {0x5, 0x4, 0x9, 0x10, 0x8e, 0x8e}, {0x16, 0x4, 0x4, 0x2, 0x3, 0x9}, {0x7, 0x4, 0x8, 0x10001, 0x8000, 0x1}, {0x1d62, 0x4, 0x9, 0xf3a, 0x7fffffff, 0x9ad}, {0x7, 0xe4, 0x6, 0x9e, 0x7, 0xf059}, {0x3, 0x6, 0x8, 0x1400000, 0xed9, 0x6}, {0xfffffffb, 0x6, 0x10000, 0x7, 0x0, 0x6}, {0xe06, 0x8, 0x3, 0x7, 0x10001, 0x3}, {0x101, 0x8, 0x101, 0x30, 0x4, 0x6}, {0x2, 0x7fff, 0x2d, 0x0, 0x4, 0x2}, {0x0, 0x2, 0xf, 0x1, 0x80, 0xc}, {0x0, 0x6, 0x4, 0xad, 0x40, 0x3ff}, {0x1000, 0x4, 0x1, 0x6, 0x4}, {0xe38, 0x5, 0x5, 0x3, 0x3, 0x4}, {0x1, 0xff, 0x6, 0x41fb, 0x200, 0x200}, {0x6, 0x55460a17, 0x54, 0x9, 0x6, 0x5}, {0x401, 0x10, 0x4, 0x74c8bacd, 0x5, 0x6}], [{0x2}, {0x2, 0x1}, {0x2, 0x1}, {0x5}, {}, {0x4, 0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x1}, {0x5}, {0x4}, {0x1}, {0x3}, {0x2}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x4}, {0x0, 0x1}, {0x5}, {0x6}, {0x3}, {}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x3}, {0x3, 0x1}, {0x1, 0x1}, {0x5}, {0x3}, {}, {0x1, 0x1}, {0x2}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {}, {0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {}, {0x0, 0x1}, {0x2}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5}, {0x3}, {0x3, 0x1}, {0x1}, {0x5}, {0x0, 0x1}, {0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x6}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x5}, {0x2}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {0x4}, {}, {0x2, 0x1}, {0x2, 0x1}, {0x2}, {}, {0x3}, {0x1}, {0x5}, {0x1, 0x83b0069cb76b49f3}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x1}, {}, {0x5, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x2}, {}, {0x1}, {0x4}, {0x1}, {0x5}, {0x1}, {0x4, 0x1}, {0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0xd779dfac818b8296, 0x1}, {0x2, 0x1}, {0x2}, {}, {0x4, 0x1}, {}, {0x4, 0x1}, {}, {0x0, 0x1}, {0x0, 0x1}]}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r11 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r11, 0x107, 0xf, &(0x7f0000000600), 0x56) (async) setsockopt$sock_attach_bpf(r11, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r11, &(0x7f0000000280)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r10, 0x42}, 0x80, &(0x7f0000003300)=[{&(0x7f00000001c0)="27030200dc0f14000e0000000025c10200000006125ce882cbf400930bf4533f00429c65112a", 0x26}, {&(0x7f00000022c0)="02db0b9ef1cafdab", 0xa888}], 0x2}, 0x4005) (async) sendmsg$kcm(r11, &(0x7f0000000280)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r10, 0x42}, 0x80, &(0x7f0000003300)=[{&(0x7f00000001c0)="27030200dc0f14000e0000000025c10200000006125ce882cbf400930bf4533f00429c65112a", 0x26}, {&(0x7f00000022c0)="02db0b9ef1cafdab", 0xa888}], 0x2}, 0x4005) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x1) (async) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x1) r12 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r12, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000140)=@ethtool_cmd={0x3a, 0x0, 0x0, 0x200, 0x0, 0x0, 0x8, 0x0, 0x9, 0x4, 0x0, 0xbffff7fc, 0x0, 0x0, 0xb, 0x47, [0xfffffffc, 0x80]}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1b000000002000000800000000a00000000000007c590b38f20f94950dd7f170c50b8a277c431c2a51e57256d5ce7bac645434daa22a5feee817cd9f712106f3dd51e232b50f3845dbee09fd2000415eefe45d1befad3e1a0e4d860f8004124cedab6109aac45a0f0d3a8693f8df1061ef7401697af11f0a3ebf02d8da8a26a3df9d71a858eb1a025af31e004300c008b035e540031af24a76becaab70da7a757a1a40ab90179ae546cbc326ca2daccb0c06eb9c2d7a2c8b6f70acdc91793113fed2a2a7bb3fc95533ff6b2e70a4ddd1ac00be8251326468a6fd25688492d0cab2b5a658ac2e60ecd37d349c2b4ea6f20b6a0c13d5ea2a7ff0", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="1b000000002000000800000000a00000000000007c590b38f20f94950dd7f170c50b8a277c431c2a51e57256d5ce7bac645434daa22a5feee817cd9f712106f3dd51e232b50f3845dbee09fd2000415eefe45d1befad3e1a0e4d860f8004124cedab6109aac45a0f0d3a8693f8df1061ef7401697af11f0a3ebf02d8da8a26a3df9d71a858eb1a025af31e004300c008b035e540031af24a76becaab70da7a757a1a40ab90179ae546cbc326ca2daccb0c06eb9c2d7a2c8b6f70acdc91793113fed2a2a7bb3fc95533ff6b2e70a4ddd1ac00be8251326468a6fd25688492d0cab2b5a658ac2e60ecd37d349c2b4ea6f20b6a0c13d5ea2a7ff0", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1f, 0x10, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r13, @ANYBLOB="00000000000000040002000000000000850000008600000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b7080000ffff00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100000085000000820000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1f, 0x10, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r13, @ANYBLOB="00000000000000040002000000000000850000008600000018110000", @ANYRES32=r13, @ANYBLOB="0000000000000000b7080000ffff00007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000100000085000000820000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 5.677243988s ago: executing program 2 (id=15057): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) r1 = socket$kcm(0x10, 0x2, 0x10) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x40008840}, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000400)={'batadv_slave_0\x00', 0x0}) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x33e000, 0x1000}, 0x20) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00', 0x0}) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r8 = socket$inet6(0xa, 0x3, 0x401) connect$inet6(r8, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) sendmmsg$inet6(r8, &(0x7f0000001840), 0x3b, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, r10, 0x6a98047402e98331, 0x70bd2c, 0xfffffffc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x48c6) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000180)=0x100000, 0x4) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r5, &(0x7f0000000100)={0x2c, 0x14, r6, 0x37}, 0x10) bind$xdp(r2, &(0x7f0000000240)={0x2c, 0x1, r4, 0x0, r5}, 0x10) syz_80211_inject_frame(&(0x7f0000000300)=@broadcast, 0x0, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) sendmsg$nl_route_sched(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x7}}}, 0x24}}, 0x4c840) 5.646318644s ago: executing program 1 (id=15058): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001500)={0x6, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x26}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x0, 0x1, 0xffffffffffffffff}, @exit], {0x95, 0x0, 0x0, 0xfffffffe}}, &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', r2}, 0x94) 5.63255022s ago: executing program 3 (id=15059): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000080)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x19}, 0x44}, 0x1c, 0x0}, 0x20000000) 5.413715639s ago: executing program 3 (id=15060): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x19, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc0385868, &(0x7f0000000580)={r1, &(0x7f0000000180)='\x00', 0xc080, &(0x7f0000000300)={@align=0xb98, {0x8cf, 0x0, 0xb, 0x6}}, 0x6, &(0x7f0000000340)={@_ha_fsid}, &(0x7f0000000380)=0x6}) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000045300b95b323fcfbb", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="010000000300"/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcfeffff620200000000000018110000", @ANYRES32=r5, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf610000000000000701000004000000850000005d000000bfa00000000000000701000004000000850000005e000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0xc, &(0x7f00000005c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x5, 0x0, 0x0, 0x41000, 0x69, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000007c0)={'ip_vti0\x00', 0x0}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_pressure(r7, &(0x7f0000000140)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r8, &(0x7f0000000080)={'full', 0x20, 0x2, 0x20, 0x1}, 0x2f) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0700000004000000080000005a0000000000000004952a1a251f9aedcbceb911fe714a3ca36dcf5f12fffa6e3791136914f2b7fc119ea769a491b8b9a8653c49446be90864ee53e9c51c745a23ebe301a2d1d199458f794fb95edcd8336378245a11efb0fb681084b8b3647d4bd060b749ecbea07d05434d25d6300c4519f232b3dbf0e83fce32d2b8063c19732d070b1de79af5002fda5e6ac23f5832c79a10133c1d742fd473c333d526de00"/195, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r9, &(0x7f00000007c0), 0x0}, 0x20) r10 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmsg$unix(r11, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r10, 0x107, 0x12, &(0x7f00000008c0)=r12, 0x4) ioctl$NS_GET_USERNS(r12, 0xb701, 0x0) syz_emit_ethernet(0x65, &(0x7f0000000100)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x2f, 0x3a, 0xff, @empty, @mcast2, {[], @ni={0x8c, 0x0, 0x0, 0x3, 0x32, 0x0, "22259b6785c4f6b3d3f8e548e3a2e68258a39f6af4f0fe00b1b1cbb4592813"}}}}}}, 0x0) r13 = socket$inet6_sctp(0xa, 0x5, 0x84) r14 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r14, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000002c0)=0x10) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[], 0x20}], 0x1, 0x0, 0x0, 0x20040001}, 0x40040) getsockopt$inet_sctp6_SCTP_MAX_BURST(r14, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r13, 0x84, 0x75, &(0x7f00000001c0)={r15, 0x5}, 0x8) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @local, 0x5f4}, 0x1c, 0x0}, 0x0) 5.295044055s ago: executing program 1 (id=15061): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f000000c480)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x97ffffff}}, {{&(0x7f0000001bc0)=@l2tp6={0xa, 0x0, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1357, 0x4}, 0x80, 0x0}}], 0x2, 0x300) 5.067331551s ago: executing program 1 (id=15062): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="0c04000010000104000000000000000000480000", @ANYRES32=r0, @ANYBLOB="101000000000000008000d0005000000e4031680e00301800c00070000000000adff", @ANYRES32=r0], 0x40c}}, 0x0) 4.389670612s ago: executing program 3 (id=15063): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000002c0)={r1, 0x11, 0x6, @random="08d32bfb45c9"}, 0x10) socket(0x2c, 0x5, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x4}, 0x6) write(r3, &(0x7f0000000000)="4a00000011007f0314066f9a70eaa1490675bc5808", 0x15) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) sendmmsg$sock(r4, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000280)="f8", 0x1}], 0x1, &(0x7f0000000a40)=[@timestamping={{0x14, 0x1, 0x4f, 0x3ff}}], 0x18}}], 0x1, 0x40440d1) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f00000003c0)=@ccm_128={{0x303}, '\x00', "5f90d5f023d7bd5b0800", "081ca1cf", "0aa3b9dd5fe7a771"}, 0x28) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r5, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) recvfrom$inet6(r2, &(0x7f0000000640)=""/248, 0xffffff1f, 0x40010002, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "b421eba833d4b156", "56df2295bfda5c4f9fecff61beaa8bb4", "808065e3", "7f1f1c2ab4421d27"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002abf7001ffdbdf251400000018000180140002006e657464657673696d3000000100000008000200030000000800030007000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4920}, 0x44860) recvfrom(r2, &(0x7f00000022c0)=""/4080, 0xff0, 0x3, 0x0, 0x0) writev(r2, &(0x7f0000001400)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575ec3b5293fb80de85c7562804230489274831b2c17dccccc523ada66a46", 0xfe86}, {&(0x7f0000000580)="63e73686513c53aec098be4b2dfc27b5be1f5f85f54c24efb8fc94ccaac29f1378e04daa49f8dcbda8b0faff57761a0ce8a311802e5dd07a159721cac7d2250f4359e04727386cc7d1a3e8bf93339f3df1340041f71046f2b1d9a80af70fb8246258d09c310af3bef017fde1fd8ce505cd4858549192a95e512257b6c676a7ebb41230e4e4fb23e9666bfdc8bc2ca77bbd11810836df4a6f3dbe3ee75c34b07c64e1af6d62d54fccb9f281eac16eca7129aa4355fd53", 0xb6}, {&(0x7f0000000500)="de21cff472aa580c2ee9f858", 0xfc96}, {&(0x7f00000014c0)="8fa68a274cab49b9c806172798e6a829701bb4eefee6919e0a30fa83a50170b6a3b499361f95ab6ff05f9001332b3a463b64282a924b0dcf6499c8c9b23d7290ab896ed6e2c7280dcda0336864e06d9570ea2cc78330859fa73080f5ddd3fd2b943287b312357816e9cfaa9e8941dd981f837506cabc6e016e507076819ff37d790c0b868166925649c9a74f4afc322ac971832fc3f12ba4dd3931c773134441bd46d9b10095eaabcfb846ac5fa9ea76f3547884091f073880656438f4406cf2051edb37139066dcaed45a544f5f92cccb1db0e2e503de3d4216d961dea1cbd9119a3f49b8bcdfe7078a7706296712eab5bd91b189f0140892b56c46912cc16dbe9fb469502eb67f36e8531dbfbed70615a836d32b5dabcf933201c97b29209e071433edb1b92ba47b514232654a36067c9b241737eb902ede1e18f99757339d2858bbe9c48484ec608e5fae534c4580d22fcd6ad28a786e0f5e675bc264ca03cf081038cb872e039100f94d25a7b5b9f2f18815e948aa65513c63a61e68c6a4ef4888980b54e3b7332112ee424e65172b2076528cd11cf63d7f4ff88c9eabf2c388bcb02beaa7e9c33cbe26149703fd3d511283739fa9638b1d6290a53b679227ee54d0fb232befdc92e59396c5bb818926e8a30a38a0aa358e1c818dbc27646fb4dc43168540cf724358d07124937cb3baa5365970e14240d727a8111d250202b39e8e3d6ff5e250eb09fdd83b8a129015567ae0f71a6b9166cd3718e3a83e711271f2ffd2d968e1153a38a8c5995e5c46fb8f22613690852bbea407b417eff9fd86e685025cbad82174164c3529407c4a27af5c6fdd911a4a87b7365655d5275c5719151b4440752785ff416a8e3a1f83f70e1f5d2538348b839f4e965e586e8b28a8aa94b79bc4e23d97d159af010918721be419234850fbeac52bb5de10a199f6591ab4deea9670e8b3d9f9341cddef4f3fe1b08a4f1943329cfa12c3972fc50525b8ebb5923235bbecd182d486169cf51e8c69259a404c0867328943358e95ad690a9c8eea73ddde677ebfe6f0d5f2e3a03541291e09a30bcce4b66550c28c6ba6cc431bb0fa87848652fb9319577a38a8ad45a87647b523fe3e452d90306c4c690b47d3c840ebbb1d96abb0735b21f557f5de101b7fbb7618d9739fabf89b8fb34c02493d1bfc31e80b1a9fcdac8aaf0fd69a0aee6f456705420ea3e7df30b478dd12ee137a6d6747750e5d6a7e5d308276c0ebd77377f000296108954f5371a9c84a01a18a76bee8ea849ddaf492a35f943ac395b9dddbd5ee05f6d75ac40237a0690584d7afaa3e117135b1406e03c9e49223ee48feccab18a3fd0325ed281bc70fb41b4f13905744afcbb588b8daee6d635007cf96dbd9549726c4cf9e350072702058bb533a4bb598a06e5505e8393b2793cc6ac2d66a0529b2aa7991a30f8bdd2bec5ac7ca2064e7b3a2a2d510de4675a7a6ce5d1729c2b98dbb08ab4a33cbd83484092d48b9c4fac7b7b6191057a2acf109565c6d49d9be0f1f2838650cdc36ad835fd78be83c6df052659ed1e8242d45891442a54205311da1814b18ed7fcc7c5bd979434040cd2133fd35ab946ff87e807a48a4802a1e4cce7cef4f2f555029cdecadaf99c5c3bf65db4be3940bfedb87cc491ac59d027496d87a792961f1f59cb72df3280b1845722282745fa77dfa1fce5e67e09466475c0e988719e528d39815cdfe0d16a6de1d871cfc4778ed47e8a7d3b2dfeea2083a41b061848324fe15e90c2dac3303992fdc42ba1a1995b87154a618660094a942074c5e02ed1a11293c5276b06439468f99c9d184c0152c44308c64c432277fe367a7fac9c9fb08d9dc8949e8ab9740a357fdc9d69df07375d011947b43072f554d63831af4319664e735c3eb08c0afe5120bd89b4d0654b6266aa4709ea2beb3dfd0449d2c3fde3f1098c9f73d994a741bb9f3c5322743c310fd7881856e5d529f4a9eb7dc43c0be6c36653b2cda92a7f07247450d666ca88863c6880d656eb8006bfe2f96543bf683fe3126e03ccf2120878a4fc46bdf64e11e323637ae0024a3d6fa52729591758c36a5ddeff1d1c5ba3e1bfedad1ff460f05ce276f1f3c2d70f9c6c5927a8fd15e65bc9c648b7dfccde510f5bf46bab8f2c5e21cb129dbf3f4df7a5a831f198f21fee429d73646eab00b1542941108592708fe8f53613d6b7dc1e4999374317b57c1e4a974fedd089c4295682d1a03d770b7639e80d25b0f428dfd3c46be492fc80b5c4913e476845a359dbe4187fd0027bd9fc814ba6a2877b61b637878f2af7ef18a0858fe5c7e75ecf92e735452456089efae8a13d3e6ac9d28c18cb1ca54522066edbf9e67ab4cf158b63c7b4d25146bafa14163cd4d171ad97f3ef93cfabae0557e237bbbe9cb80144b03f6fdb7d357d253235ddbde503829403657fdde516d3974091c40c6b9dd245f730458e1fd594f6b694af0150cbd31b6d0fb3bc04eb5096e704e039eecf4be9e93eb2f841878538ed1c46d015b1a792b599ed9225577460f72e6b4e271e5e6eeed34f69cfd76683e21d87e3ee8ed88df79901f9354823824fa6b67a91e2626161436327fc58879085d87db5dd94e09a0d24c7c381fb8fdc7198d2c2fece49e6496a119023852fca717d2ff2f9ed5e0715ddebd267ed0b8378ad852b03a539e6d03025b4a04f2483bdb79a4bd233ce3b6bd30d736ad0784b978861badc236e7106d23f26eac50e93d8ab012dc7c5d85d4f944aaa27378efc99572f932344cddc488ffa9210dc6b8f0cc29d07110362485eaa5b4b196a49c7080633c1befe802207ed0a172fa0b61fea6305f04d7b755a6e5e162aa8047f80647ad0bae8143226ce3aa8de3b0c0fc4e7cd6baab274fba47abf95ae88584778325250063855a4b9f0c966efa43dc0196d3dec619c490181c259b341b3fd370bab0b66af3cb1e9365cf6b62e44d939d36ffcc6badb924f44e86337360efbf4e3f9bd716adbc3f0ba6055ec9790504c9f3865f47e422b1c6ba16c07d0df618cc572b36ec8e519db90a499424a7d689e6fbcc9be1abd843512ec16540c6c7c6d6e2cf50ab2014e4208c2abb0ddfd2ef9dece79389f21d7a9985903f7f01b0394d268349fa41a487bacfe8deba2ffca815ad0b1c6ffa5af2eba6d9436ad298c4e11b68451c7ff001c02ddd3ceb153a865327845349e8b817aa8ed24924f49260f8209d0ddcacf5306d9222320776162fe8396914fa22c85bc261661fa547c3063e20ca37c0862c3b9abd3da9b02e3f58d89be00003509bae9b82f60975c0687c500bb213a580f6e9f08b207d7c31748e3fda05a0cc76b1fdd563610a2bb09a57020d85026a57a178c38839b5b88cd8434d1f0308d872c7356a6445de801ff14c133bda3b42b9ca099fb3ee0d5c7a835f56ed30aa75d47cd97c329b682879290faee167334500d2fe596564f3e4064f41cf3469aaae846f1e84f3d8a7f42d98d0b6b67913c376d6bbde3027aa41b753ace165f88379981685f918ada5043800b5e0a0865dcda94df85fefa9348d6ec4e1ffbd940d023fbbd3b77d5db572981dbe40cbae9f010c1ea02718b1c4b7d0447c9d83d1afea58097a0467d6cdd47aef05f97dab63462f6ea61f4b611040b30e7cf60a499aa9d0bc50c08463f25a47d2dbc958fe1d1cf2399dcf1952987b6fcbc97bf73b12177c374c8fd56c8228fc796c958687104f4eb9d46ab80eeeeedb7096a67ee440ae92a65cbf6f81939e3d1050c67245036b5dcc13d577fbb4d9c3fbf2e2e61aa154074ae225c54e23289c4ef41a07a49a9d40f3103f4c9dfd4d750cc646adadd2e1fe24c74ce099d753d4c59d806a0b7f576ac37ac58a51a120f93162c43d16c1f7e5289c75f5f0a5b838d020040c9ce512ca35d08f42acd24cdbc2e6b1ac3c6809a5ed9e272155e9fa55349bc3ce0e3f2d1624dc60e2396b954587bbab275f38911e86b826b85730c6670a92a221cdcbf18ee0c44aec4591fcd12204b3049a1b5da1215a4cf88ecbe2d877ef975f4f661999d17d7d9ec14e0895ce25034dac4705d50ae42ca162778d0dcfc4e9180517be0daca5deb10773f93e2c61a5fe9b823218a97c35d0d7b436b2e1afb670b5a4c6dacd401afd1832c1dd96e8eba7734954070c6796cc80707441404cfe95fabf214bf03a6e4643ca559c2b8dcf1fa871114f3dc973a056c9aee7cd0ed4cbaf18298377e750869551632c1713bd8372e3f11fa02edf0a68d2c01245459d9e78597ac1eec75064024c1f3c98260d34b611ba8fa4b2022babd44b76ea70c718df8268dba447038b1539f0499603cf2d79bcc49c35a8cf38892d982d153d72253a22ae68da65e84d6399e81a14ebf89ba446630814d9dcf8914acafc8603a5396167c5aa99814af62c1c39a6ba76ad2c6c51a6d56d89fbda5334e626540ef1b1ecad53247531fcdd661a48d28a6d48bac8ef70c888b00db57edceee94425df5161e1b1a1bec9c897e01867442ed8ba000b5f75832a8ec57ef0737994b95f40eac48f3c8da5db80e965fcdf3f0bbb4439a7123b59987f0fdac96bc7ce09c013562ff7c0cb23a882828e45a51f7e748db90c5eaacfdf3657d11a348f747ddd860387de41be3376a5dabf4296bc05282cb73fcd60c4a4148d9e872ae86e30b22db1ce5452ad9fe3fea029f94a583d301e74eac1818da3f1279c63690db6e7166ddaacd1278716fa3221daaa27c98fd97b88e63208d604505ad8f31bd2b83a19f89480b71198d8a31c89cadd258ce338afe1a26b0db248c1a39fe027716e417e45bb6c9a68cab1cd6c3445e9796ee1003650e97eccdadc9bea540e2c8253652c8f1586ba7e508cd29d53467bad11eef729796dbe83d3fc0bc15762c2f1de34c6380a6725f94600a82d87ccf80948babcadec31ca654671d17de360f20aaf04f4d44951661fe8fe7731174ec3aaf330aebeaed9620f694859785a36c5f787ce35e4425ed3387710fa346f04db11255c6985fa4cdbe54d25c942264b3383d60903bd2677611850fe125b", 0xdf3}], 0x5) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) 659.445294ms ago: executing program 1 (id=15064): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="0c04000010000104000000000000000000480000", @ANYRES32=r0, @ANYBLOB="101000000000000008000d0005000000e4031680e00301800c00070000", @ANYRES32=r0], 0x40c}}, 0x0) 566.669782ms ago: executing program 0 (id=15065): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r1) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x2000000, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x5c, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x30, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}]}]}]}], {0x14, 0x10}}, 0xe4}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000003c0)={0x20, r2, 0x5, 0x0, 0x0, {0x22}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}}, 0x4000000) (async) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000040)=0x46c, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000540)={'batadv_slave_0\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000005c0)={'bridge0\x00', 0x0}) (async) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (async) r7 = socket(0xa, 0x3, 0x87) sendmsg(r7, &(0x7f0000000700)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x9, @dev={0xfe, 0x80, '\x00', 0x43}, 0x7, 0x4}, 0x18, &(0x7f0000000680)=[{0x0, 0x51}, {&(0x7f00000005c0)='r', 0x1}], 0x10}, 0x0) (async) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f00000002c0)=@ethtool_pauseparam={0x12, 0x8008000, 0x7d, 0x8}}) sendto$packet(r4, &(0x7f0000000240)="09000000e70014000000d97bfbf788a83baa88a8000088a800a8880000990000", 0x20, 0x0, &(0x7f0000000100)={0x11, 0x8100, r5, 0x1, 0xc, 0x6, @random="fa728e2c0cf3"}, 0x14) (async) ioctl$XFS_IOC_DIOINFO(0xffffffffffffffff, 0x800c581e, &(0x7f0000000000)) (async) ioctl$XFS_IOC_SWAPEXT(0xffffffffffffffff, 0xc0c0586d, &(0x7f0000000400)={0x0, r4, r0, 0x7, 0x4, '\x00', {0x9, 0xde, 0x992, 0xfffffffe, 0x90b, 0x7f, 0x2, 0xfffffffffffffff7, {0x7}, {0x45c, 0x9}, {0xffffffffffffff2f, 0x7}, 0xc5, 0xb, 0x4, 0x6, 0x7f, 0x1, 0xa12a, 0x9, 0x3, 0xfff6, '\x00', 0x80000000, 0x2, 0x5, 0x6}}) 561.952713ms ago: executing program 2 (id=15066): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) (fail_nth: 5) 332.979886ms ago: executing program 2 (id=15067): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="18"], 0x40) r2 = socket(0x840000000002, 0x3, 0xff) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e24, @private=0xa010100}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000640)={r4}, &(0x7f0000000740)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000002c0)={r4, 0x1}, &(0x7f0000000340)=0x8) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000240)={0xffff, 0x1, 0x1, 0x1, r6}, 0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000040)={r6, 0xc2f}, &(0x7f00000000c0)=0x8) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x55, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) sendmsg$rds(r2, &(0x7f0000003a80)={&(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/41, 0x29}, {0x0}], 0x2, 0x0, 0x0, 0x20000000}, 0x48004) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="7b06f8ff00000000850000008a00000079a1f8ff0000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r9 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r10, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x81]}}]}}]}, 0x8c}}, 0x0) ioctl$SIOCSIFHWADDR(r8, 0xff02, 0x0) 298.43543ms ago: executing program 4 (id=15068): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r0, &(0x7f0000000080)={&(0x7f00000001c0)={0xa, 0x4e21, 0x80000, @dev={0xfe, 0x80, '\x00', 0x19}, 0x44}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=[@rthdr={{0x18, 0x29, 0x39, {0x21, 0x0, 0x2, 0x1}}}], 0x18}, 0x20000000) 131.141874ms ago: executing program 4 (id=15069): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0x5}, {0x0, 0xc}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x8}]}, 0xfffffcf0}}, 0x400) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd25, 0x25dfdc80, {0x0, 0x0, 0x0, r4, {0xfff2, 0xf}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x10000000, 0x7, 0xffeffffc}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}}, 0x4c800) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000000c0)=0x1000000) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r6, 0xc004743e, 0x110c230000) close(0x3) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000780)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x50bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0x5}, {0xffff, 0xffff}, {0x3, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x5, 0x9}}}]}, 0x38}}, 0x0) close(r7) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r11 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r11, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r12, 0x3f}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x8004) 0s ago: executing program 1 (id=15070): listen(0xffffffffffffffff, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @local}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000008000000180100002520732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000020000f98500000006000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r1, 0x0, 0x8, 0x22, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000600)=""/34, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) epoll_create1(0x80000) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='devices.list\x00', 0x26e1, 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000140)={0x84, @dev={0xac, 0x14, 0x14, 0x3a}, 0x4e21, 0x3, 'lblc\x00', 0x1d, 0x80002, 0x64}, 0x2c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000410000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f01400ffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b7030000ffffff1f850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc}, 0x94) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x5, 0x77}, {@dev={0xac, 0x14, 0x14, 0x50}, 0x4e23, 0x1, 0xcd, 0x4}}, 0x44) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000180)={'filter\x00', 0x4}, 0x68) sendmsg$sock(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x40}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) close(r2) r6 = socket$kcm(0x1e, 0x1, 0x0) sendmsg$kcm(r6, &(0x7f00000014c0)={&(0x7f0000001540)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, 0x0}, 0x0) write$cgroup_devices(r2, &(0x7f00000005c0)=ANY=[], 0xfffffeff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), r2) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000500), 0xffffffffffffffff) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r8, 0x1f2f, 0x24, 0x0, &(0x7f0000000000)="1e749f447f700400684010a40800297a5d41726bb1d331200ce375083a37c86b7fd9d7da", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_NODE_GET(r9, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002300)={&(0x7f00000022c0)=ANY=[@ANYBLOB="14800000", @ANYRES16=r7, @ANYBLOB="61072cbd7000fedbdf250d000000"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x10) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x22020400) r11 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x12, 0x3a, 0x8, 0x2}, 0x48) bpf$BPF_PROG_ATTACH(0x1c, &(0x7f00000010c0)={@map=r11, 0xffffffffffffffff, 0x2c}, 0x20) sendmsg$nl_xfrm(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=@updsa={0x164, 0x1a, 0x1, 0x0, 0x0, {{@in=@loopback, @in6=@empty}, {@in=@local, 0x0, 0x33}, @in6=@rand_addr=' \x01\x00', {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_auth_trunc={0x71, 0x14, {{'xcbc(aes)\x00'}, 0x128, 0x0, "000000000000000000000000000000003fe380589cc8d6d2287e1ad94098733cb609bf729c"}}]}, 0x164}, 0x1, 0x0, 0x0, 0x4004014}, 0x0) kernel console output (not intermixed with test programs): eased all slaves [ 1579.254320][ T9434] bond5 (unregistering): (slave veth13): Releasing backup interface [ 1579.267031][ T9434] bond5 (unregistering): Released all slaves [ 1579.315880][ T9434] bond6 (unregistering): Released all slaves [ 1579.339492][ T9434] bond7 (unregistering): Released all slaves [ 1579.371244][ T9434] bond8 (unregistering): (slave veth21): Releasing backup interface [ 1579.372149][ T9434] bond8 (unregistering): Released all slaves [ 1579.414056][ T9434] bond9 (unregistering): Released all slaves [ 1579.442533][ T9434] bond10 (unregistering): Released all slaves [ 1579.508441][T19997] 0·: renamed from hsr0 [ 1579.536202][T19997] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1579.536230][T19997] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1579.536308][T19997] 0·: entered allmulticast mode [ 1579.536323][T19997] hsr_slave_0: entered allmulticast mode [ 1579.536339][T19997] hsr_slave_1: entered allmulticast mode [ 1579.544825][T19997] net_ratelimit: 17 callbacks suppressed [ 1579.544844][T19997] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1580.002788][ T9434] tipc: Disabling bearer [ 1580.002920][ T9434] tipc: Left network mode [ 1580.022522][T20008] netlink: 'syz.2.14144': attribute type 10 has an invalid length. [ 1580.103600][T20008] geneve3: entered promiscuous mode [ 1580.103623][T20008] geneve3: entered allmulticast mode [ 1580.499029][T20025] ipt_ECN: cannot use operation on non-tcp rule [ 1580.681670][T20034] __nla_validate_parse: 7 callbacks suppressed [ 1580.681692][T20034] netlink: 12 bytes leftover after parsing attributes in process `syz.4.14151'. [ 1580.753614][T20041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14152'. [ 1580.753710][T20041] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14152'. [ 1581.177121][T20045] netlink: 9 bytes leftover after parsing attributes in process `syz.2.14154'. [ 1581.177236][T20045] 1·: renamed from c0· (while UP) [ 1581.196273][T20045] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1581.382159][T20050] netlink: 'syz.1.14156': attribute type 1 has an invalid length. [ 1581.453310][T20050] bond7: option mode: invalid value (7) [ 1581.495127][T20050] bond7 (unregistering): Released all slaves [ 1581.640387][T20071] netlink: 'syz.1.14156': attribute type 10 has an invalid length. [ 1581.640426][T20071] netlink: 40 bytes leftover after parsing attributes in process `syz.1.14156'. [ 1581.961805][T20061] dummy0: left promiscuous mode [ 1582.013783][T20064] syzkaller0: entered promiscuous mode [ 1582.013807][T20064] syzkaller0: entered allmulticast mode [ 1582.028057][T20069] tipc: Started in network mode [ 1582.028183][T20069] tipc: Node identity 7e272da41997, cluster identity 4711 [ 1582.028331][T20069] tipc: Enabled bearer , priority 0 [ 1582.030308][T20071] dummy0: entered promiscuous mode [ 1582.102783][T20032] tipc: Resetting bearer [ 1582.232930][T20032] tipc: Disabling bearer [ 1582.552677][T20092] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14166'. [ 1582.620497][T20093] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14166'. [ 1582.733617][T20091] macsec0: entered promiscuous mode [ 1582.781979][T20092] macsec0 (unregistering): left promiscuous mode [ 1583.008891][T20099] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14168'. [ 1583.082943][T20103] netlink: 9 bytes leftover after parsing attributes in process `syz.3.14169'. [ 1583.083081][T20103] 0·: renamed from c1· [ 1583.155035][T20103] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1583.155061][T20103] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1583.170160][T20103] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1583.356014][T20110] openvswitch: netlink: Tunnel attr 10 has unexpected len 0 expected 2 [ 1583.935805][T20130] netlink: zone id is out of range [ 1583.935823][T20130] netlink: zone id is out of range [ 1583.935829][T20130] netlink: zone id is out of range [ 1583.935835][T20130] netlink: zone id is out of range [ 1583.935842][T20130] netlink: zone id is out of range [ 1583.935849][T20130] netlink: zone id is out of range [ 1583.996852][ T9434] hsr_slave_0: left promiscuous mode [ 1584.004999][ T9434] hsr_slave_1: left promiscuous mode [ 1584.005859][ T9434] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1584.024497][ T9434] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1584.304109][T20145] FAULT_INJECTION: forcing a failure. [ 1584.304109][T20145] name failslab, interval 1, probability 0, space 0, times 0 [ 1584.304141][T20145] CPU: 0 UID: 0 PID: 20145 Comm: syz.1.14182 Not tainted syzkaller #0 PREEMPT(full) [ 1584.304162][T20145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1584.304174][T20145] Call Trace: [ 1584.304183][T20145] [ 1584.304191][T20145] dump_stack_lvl+0xe8/0x150 [ 1584.304224][T20145] should_fail_ex+0x410/0x560 [ 1584.304260][T20145] should_failslab+0xa8/0x100 [ 1584.304287][T20145] __kmalloc_noprof+0xfe/0x720 [ 1584.304304][T20145] ? __kasan_kmalloc+0x93/0xb0 [ 1584.304326][T20145] ? nla_strdup+0x9d/0x140 [ 1584.304348][T20145] ? nla_strdup+0x9d/0x140 [ 1584.304375][T20145] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1584.304398][T20145] nla_strdup+0x9d/0x140 [ 1584.304425][T20145] nf_tables_newchain+0x1aba/0x28b0 [ 1584.304469][T20145] ? __pfx_nf_tables_newchain+0x10/0x10 [ 1584.304525][T20145] ? lock_acquire+0x115/0x350 [ 1584.304546][T20145] ? nfnl_pernet+0x23/0x240 [ 1584.304583][T20145] ? __nla_parse+0x40/0x60 [ 1584.304612][T20145] nfnetlink_rcv+0x1288/0x28c0 [ 1584.304674][T20145] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1584.304741][T20145] ? skb_clone+0x246/0x3a0 [ 1584.304783][T20145] ? netlink_deliver_tap+0x2e/0x1b0 [ 1584.304802][T20145] ? netlink_deliver_tap+0x2e/0x1b0 [ 1584.304827][T20145] netlink_unicast+0x7bd/0x940 [ 1584.304866][T20145] netlink_sendmsg+0x813/0xb40 [ 1584.304895][T20145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1584.304923][T20145] ? apparmor_socket_sendmsg+0x98/0x360 [ 1584.304947][T20145] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1584.304965][T20145] sock_sendmsg_nosec+0x13a/0x180 [ 1584.304988][T20145] ____sys_sendmsg+0x54e/0x850 [ 1584.305017][T20145] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1584.305053][T20145] ? import_iovec+0x73/0xa0 [ 1584.305082][T20145] ___sys_sendmsg+0x2a5/0x360 [ 1584.305107][T20145] ? __lock_acquire+0x747/0x2de0 [ 1584.305131][T20145] ? __pfx____sys_sendmsg+0x10/0x10 [ 1584.305195][T20145] ? __fget_files+0x2a/0x420 [ 1584.305220][T20145] ? __fget_files+0x3a2/0x420 [ 1584.305263][T20145] __x64_sys_sendmsg+0x1b1/0x290 [ 1584.305293][T20145] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1584.305342][T20145] do_syscall_64+0x166/0x520 [ 1584.305368][T20145] ? trace_irq_disable+0x3b/0x140 [ 1584.305387][T20145] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1584.305407][T20145] ? clear_bhb_loop+0x70/0xc0 [ 1584.305431][T20145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1584.305451][T20145] RIP: 0033:0x7f336cd9e159 [ 1584.305469][T20145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1584.305485][T20145] RSP: 002b:00007f336db96028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1584.305505][T20145] RAX: ffffffffffffffda RBX: 00007f336d025fa0 RCX: 00007f336cd9e159 [ 1584.305519][T20145] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1584.305532][T20145] RBP: 00007f336db96090 R08: 0000000000000000 R09: 0000000000000000 [ 1584.305544][T20145] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1584.305556][T20145] R13: 00007f336d026038 R14: 00007f336d025fa0 R15: 00007fff2a9622b8 [ 1584.305588][T20145] [ 1584.606246][T20150] net_ratelimit: 4 callbacks suppressed [ 1584.606268][T20150] netlink: zone id is out of range [ 1584.606276][T20150] netlink: zone id is out of range [ 1584.606284][T20150] netlink: zone id is out of range [ 1584.606292][T20150] netlink: zone id is out of range [ 1584.606299][T20150] netlink: zone id is out of range [ 1584.606307][T20150] netlink: zone id is out of range [ 1584.606314][T20150] netlink: zone id is out of range [ 1584.606322][T20150] netlink: zone id is out of range [ 1584.606329][T20150] netlink: zone id is out of range [ 1584.606336][T20150] netlink: set zone limit has 4 unknown bytes [ 1584.678625][T20159] netlink: 9 bytes leftover after parsing attributes in process `syz.4.14183'. [ 1585.019250][ T9434] team0 (unregistering): Port device team_slave_1 removed [ 1585.039605][ T9434] team0 (unregistering): Port device team_slave_0 removed [ 1585.259973][T20159] 0·: renamed from c1· (while UP) [ 1585.365732][T20165] netlink: 'syz.4.14188': attribute type 10 has an invalid length. [ 1585.389236][T20165] geneve4: entered promiscuous mode [ 1585.389259][T20165] geneve4: entered allmulticast mode [ 1585.849546][ T9434] IPVS: stop unused estimator thread 0... [ 1585.900699][T20178] xt_CT: No such helper "snmp" [ 1586.603311][T20210] __nla_validate_parse: 7 callbacks suppressed [ 1586.603331][T20210] netlink: 9 bytes leftover after parsing attributes in process `syz.0.14198'. [ 1586.814928][T20193] bridge0: port 2(bridge_slave_1) entered disabled state [ 1586.818150][T20193] bridge0: port 1(bridge_slave_0) entered disabled state [ 1587.319711][T20193] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1587.350910][T20193] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1587.552327][T20193] ip6gretap0: left allmulticast mode [ 1587.573786][T20210] 1·: renamed from c0· (while UP) [ 1588.065735][T20228] netlink: 'syz.0.14206': attribute type 3 has an invalid length. [ 1588.294945][T20240] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14210'. [ 1588.500041][T20244] netlink: 36 bytes leftover after parsing attributes in process `syz.2.14212'. [ 1588.554628][T20247] netlink: 9 bytes leftover after parsing attributes in process `syz.0.14213'. [ 1588.554741][T20247] 0·: renamed from c1· (while UP) [ 1588.713964][T20259] FAULT_INJECTION: forcing a failure. [ 1588.713964][T20259] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1588.713995][T20259] CPU: 1 UID: 0 PID: 20259 Comm: syz.2.14216 Not tainted syzkaller #0 PREEMPT(full) [ 1588.714013][T20259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1588.714024][T20259] Call Trace: [ 1588.714031][T20259] [ 1588.714039][T20259] dump_stack_lvl+0xe8/0x150 [ 1588.714069][T20259] should_fail_ex+0x410/0x560 [ 1588.714095][T20259] copy_folio_from_iter_atomic+0x45a/0x1a30 [ 1588.714118][T20259] ? shmem_allowable_huge_orders+0x325/0x6c0 [ 1588.714158][T20259] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 1588.714187][T20259] ? shmem_write_begin+0x1d8/0x330 [ 1588.714213][T20259] generic_perform_write+0x5c7/0x8f0 [ 1588.714250][T20259] ? __pfx_generic_perform_write+0x10/0x10 [ 1588.714272][T20259] ? down_write+0x16b/0x200 [ 1588.714296][T20259] ? generic_write_checks_count+0x41a/0x520 [ 1588.714322][T20259] ? file_update_time_flags+0x2d5/0x440 [ 1588.714344][T20259] shmem_file_write_iter+0xf8/0x120 [ 1588.714369][T20259] vfs_write+0x612/0xba0 [ 1588.714401][T20259] ? __pfx_vfs_write+0x10/0x10 [ 1588.714428][T20259] ? do_sys_openat2+0x14e/0x200 [ 1588.714446][T20259] ? kmem_cache_free+0x182/0x650 [ 1588.714480][T20259] ksys_write+0x150/0x270 [ 1588.714506][T20259] ? __pfx_ksys_write+0x10/0x10 [ 1588.714542][T20259] do_syscall_64+0x166/0x520 [ 1588.714563][T20259] ? trace_irq_disable+0x3b/0x140 [ 1588.714579][T20259] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.714597][T20259] ? clear_bhb_loop+0x70/0xc0 [ 1588.714617][T20259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.714634][T20259] RIP: 0033:0x7fa11259e159 [ 1588.714650][T20259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1588.714663][T20259] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1588.714682][T20259] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1588.714694][T20259] RDX: 0000000000032600 RSI: 0000200000000000 RDI: 0000000000000003 [ 1588.714705][T20259] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1588.714715][T20259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1588.714725][T20259] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1588.714755][T20259] [ 1589.234239][T20269] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1589.335989][T20269] bond7 (unregistering): Released all slaves [ 1589.560947][T20297] netlink: 9 bytes leftover after parsing attributes in process `syz.4.14227'. [ 1589.623081][T20297] 1·: renamed from c0· (while UP) [ 1589.646138][T20297] net_ratelimit: 5 callbacks suppressed [ 1589.646172][T20297] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1589.903379][T20306] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14230'. [ 1589.981742][T20311] FAULT_INJECTION: forcing a failure. [ 1589.981742][T20311] name failslab, interval 1, probability 0, space 0, times 0 [ 1589.981773][T20311] CPU: 1 UID: 0 PID: 20311 Comm: syz.2.14232 Not tainted syzkaller #0 PREEMPT(full) [ 1589.981795][T20311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1589.981804][T20311] Call Trace: [ 1589.981811][T20311] [ 1589.981820][T20311] dump_stack_lvl+0xe8/0x150 [ 1589.981850][T20311] should_fail_ex+0x410/0x560 [ 1589.981877][T20311] should_failslab+0xa8/0x100 [ 1589.981899][T20311] __kvmalloc_node_noprof+0x176/0x820 [ 1589.981921][T20311] ? __kvmalloc_node_noprof+0x345/0x820 [ 1589.981940][T20311] ? bpf_compute_scc+0xd2/0xb10 [ 1589.981958][T20311] ? bpf_compute_scc+0xd2/0xb10 [ 1589.981983][T20311] bpf_compute_scc+0xd2/0xb10 [ 1589.982018][T20311] bpf_check+0x2720/0x2ef0 [ 1589.982056][T20311] ? __pfx_bpf_check+0x10/0x10 [ 1589.982079][T20311] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1589.982108][T20311] bpf_prog_load+0x14d6/0x1c20 [ 1589.982142][T20311] ? __pfx_bpf_prog_load+0x10/0x10 [ 1589.982197][T20311] __sys_bpf+0xd0d/0xd90 [ 1589.982226][T20311] ? __pfx___sys_bpf+0x10/0x10 [ 1589.982258][T20311] ? __fget_files+0x2a/0x420 [ 1589.982297][T20311] ? ksys_write+0x242/0x270 [ 1589.982326][T20311] ? __pfx_ksys_write+0x10/0x10 [ 1589.982357][T20311] __x64_sys_bpf+0xba/0xd0 [ 1589.982380][T20311] do_syscall_64+0x166/0x520 [ 1589.982407][T20311] ? trace_irq_disable+0x3b/0x140 [ 1589.982424][T20311] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1589.982444][T20311] ? clear_bhb_loop+0x70/0xc0 [ 1589.982465][T20311] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1589.982483][T20311] RIP: 0033:0x7fa11259e159 [ 1589.982500][T20311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1589.982514][T20311] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1589.982534][T20311] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1589.982548][T20311] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1589.982559][T20311] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1589.982571][T20311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1589.982582][T20311] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1589.982612][T20311] [ 1590.300674][T20322] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14237'. [ 1590.428924][T20326] netlink: 'syz.4.14236': attribute type 1 has an invalid length. [ 1590.431763][T20322] FAULT_INJECTION: forcing a failure. [ 1590.431763][T20322] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1590.431794][T20322] CPU: 0 UID: 0 PID: 20322 Comm: syz.1.14237 Not tainted syzkaller #0 PREEMPT(full) [ 1590.431814][T20322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1590.431826][T20322] Call Trace: [ 1590.431834][T20322] [ 1590.431843][T20322] dump_stack_lvl+0xe8/0x150 [ 1590.431875][T20322] should_fail_ex+0x410/0x560 [ 1590.431902][T20322] _copy_from_user+0x2d/0xb0 [ 1590.431927][T20322] ___sys_recvmsg+0x173/0x5a0 [ 1590.431958][T20322] ? __pfx____sys_recvmsg+0x10/0x10 [ 1590.431992][T20322] ? lock_acquire+0x115/0x350 [ 1590.432041][T20322] do_recvmmsg+0x31a/0x7f0 [ 1590.432076][T20322] ? __pfx_do_recvmmsg+0x10/0x10 [ 1590.432112][T20322] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1590.432140][T20322] ? __fget_files+0x3a2/0x420 [ 1590.432175][T20322] __x64_sys_recvmmsg+0x198/0x250 [ 1590.432205][T20322] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1590.432243][T20322] do_syscall_64+0x166/0x520 [ 1590.432266][T20322] ? trace_irq_disable+0x3b/0x140 [ 1590.432285][T20322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1590.432304][T20322] ? clear_bhb_loop+0x70/0xc0 [ 1590.432328][T20322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1590.432346][T20322] RIP: 0033:0x7f336cd9e159 [ 1590.432364][T20322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1590.432380][T20322] RSP: 002b:00007f336db96028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1590.432400][T20322] RAX: ffffffffffffffda RBX: 00007f336d025fa0 RCX: 00007f336cd9e159 [ 1590.432414][T20322] RDX: 0000000000001003 RSI: 00002000000048c0 RDI: 0000000000000003 [ 1590.432427][T20322] RBP: 00007f336db96090 R08: 0000000000000000 R09: 0000000000000000 [ 1590.432439][T20322] R10: 0000000000010122 R11: 0000000000000246 R12: 0000000000000002 [ 1590.432450][T20322] R13: 00007f336d026038 R14: 00007f336d025fa0 R15: 00007fff2a9622b8 [ 1590.432482][T20322] [ 1590.652030][T20321] netlink: 40 bytes leftover after parsing attributes in process `syz.4.14236'. [ 1590.659254][T20326] bond7: option mode: invalid value (7) [ 1590.664323][T20326] bond7 (unregistering): Released all slaves [ 1590.719535][T20332] netlink: 'syz.4.14236': attribute type 10 has an invalid length. [ 1590.719558][T20332] netlink: 40 bytes leftover after parsing attributes in process `syz.4.14236'. [ 1591.195938][T20335] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1591.212959][T20351] netlink: 9 bytes leftover after parsing attributes in process `syz.0.14240'. [ 1591.314478][T20335] bond7 (unregistering): Released all slaves [ 1591.413601][T20351] 1·: renamed from c0· (while UP) [ 1591.423610][T20351] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1591.900417][T20381] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14250'. [ 1591.900452][T20381] netlink: 'syz.2.14250': attribute type 10 has an invalid length. [ 1591.900467][T20381] netlink: 12 bytes leftover after parsing attributes in process `syz.2.14250'. [ 1591.955160][T20381] geneve3: entered promiscuous mode [ 1591.955183][T20381] geneve3: entered allmulticast mode [ 1592.750485][T20406] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1592.943111][T20406] bond7 (unregistering): Released all slaves [ 1593.062259][T20410] netlink: 9 bytes leftover after parsing attributes in process `syz.2.14258'. [ 1593.062377][T20410] 0·: renamed from c1· (while UP) [ 1593.073141][T20410] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1593.363215][T20423] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14261'. [ 1593.363245][T20423] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14261'. [ 1593.463447][T20426] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14263'. [ 1593.466946][T20426] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14263'. [ 1593.651905][T20434] FAULT_INJECTION: forcing a failure. [ 1593.651905][T20434] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1593.651935][T20434] CPU: 1 UID: 0 PID: 20434 Comm: syz.3.14265 Not tainted syzkaller #0 PREEMPT(full) [ 1593.651956][T20434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1593.651967][T20434] Call Trace: [ 1593.651975][T20434] [ 1593.651984][T20434] dump_stack_lvl+0xe8/0x150 [ 1593.652018][T20434] should_fail_ex+0x410/0x560 [ 1593.652047][T20434] _copy_from_iter+0x1d3/0x1660 [ 1593.652078][T20434] ? _copy_from_iter+0x21b/0x1660 [ 1593.652102][T20434] ? __pfx__copy_from_iter+0x10/0x10 [ 1593.652130][T20434] ? __pfx__copy_from_iter+0x10/0x10 [ 1593.652160][T20434] copy_page_from_iter+0x219/0x2d0 [ 1593.652187][T20434] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1593.652230][T20434] tun_get_user+0xc7f/0x44d0 [ 1593.652269][T20434] ? aa_file_perm+0x18b/0x15f0 [ 1593.652299][T20434] ? aa_file_perm+0x4ed/0x15f0 [ 1593.652323][T20434] ? __pfx_tun_get_user+0x10/0x10 [ 1593.652346][T20434] ? __lock_acquire+0x747/0x2de0 [ 1593.652370][T20434] ? kstrtoull+0x137/0x1d0 [ 1593.652398][T20434] ? ref_tracker_alloc+0x341/0x4b0 [ 1593.652420][T20434] ? lock_acquire+0x115/0x350 [ 1593.652441][T20434] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1593.652466][T20434] ? lock_acquire+0x115/0x350 [ 1593.652486][T20434] ? tun_get+0x1c/0x2f0 [ 1593.652512][T20434] ? tun_get+0x1c/0x2f0 [ 1593.652531][T20434] ? tun_get+0x1c/0x2f0 [ 1593.652557][T20434] tun_chr_write_iter+0x113/0x200 [ 1593.652581][T20434] vfs_write+0x612/0xba0 [ 1593.652618][T20434] ? __pfx_vfs_write+0x10/0x10 [ 1593.652659][T20434] ? __fget_files+0x2a/0x420 [ 1593.652694][T20434] ksys_write+0x150/0x270 [ 1593.652723][T20434] ? __pfx_ksys_write+0x10/0x10 [ 1593.652760][T20434] do_syscall_64+0x166/0x520 [ 1593.652809][T20434] ? trace_irq_disable+0x3b/0x140 [ 1593.652829][T20434] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1593.652850][T20434] ? clear_bhb_loop+0x70/0xc0 [ 1593.652874][T20434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1593.652893][T20434] RIP: 0033:0x7ff413d9e159 [ 1593.652911][T20434] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1593.652927][T20434] RSP: 002b:00007ff411ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1593.652947][T20434] RAX: ffffffffffffffda RBX: 00007ff414025fa0 RCX: 00007ff413d9e159 [ 1593.652962][T20434] RDX: 000000000000340a RSI: 0000200000000300 RDI: 0000000000000004 [ 1593.652975][T20434] RBP: 00007ff411ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1593.652987][T20434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1593.652999][T20434] R13: 00007ff414026038 R14: 00007ff414025fa0 R15: 00007fff0942d268 [ 1593.653030][T20434] [ 1593.796407][T20444] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14266'. [ 1594.800768][T20460] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1595.009842][T20460] bond7 (unregistering): Released all slaves [ 1595.141487][T20466] netlink: 9 bytes leftover after parsing attributes in process `syz.0.14273'. [ 1595.141601][T20466] 0·: renamed from c1· (while UP) [ 1595.180426][T20466] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1595.183634][T20470] syzkaller0: entered promiscuous mode [ 1595.183654][T20470] syzkaller0: entered allmulticast mode [ 1595.900711][T20506] netlink: 'syz.1.14285': attribute type 1 has an invalid length. [ 1595.900734][T20506] netlink: 244 bytes leftover after parsing attributes in process `syz.1.14285'. [ 1596.358276][T20513] FAULT_INJECTION: forcing a failure. [ 1596.358276][T20513] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1596.358375][T20513] CPU: 1 UID: 0 PID: 20513 Comm: syz.2.14287 Not tainted syzkaller #0 PREEMPT(full) [ 1596.358397][T20513] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1596.358408][T20513] Call Trace: [ 1596.358416][T20513] [ 1596.358425][T20513] dump_stack_lvl+0xe8/0x150 [ 1596.358456][T20513] should_fail_ex+0x410/0x560 [ 1596.358483][T20513] _copy_from_user+0x2d/0xb0 [ 1596.358508][T20513] ___sys_recvmsg+0x173/0x5a0 [ 1596.358542][T20513] ? __pfx____sys_recvmsg+0x10/0x10 [ 1596.358571][T20513] ? lock_acquire+0x115/0x350 [ 1596.358626][T20513] do_recvmmsg+0x31a/0x7f0 [ 1596.358659][T20513] ? __pfx_do_recvmmsg+0x10/0x10 [ 1596.358702][T20513] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1596.358729][T20513] ? __fget_files+0x3a2/0x420 [ 1596.358765][T20513] __x64_sys_recvmmsg+0x198/0x250 [ 1596.358795][T20513] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1596.358834][T20513] do_syscall_64+0x166/0x520 [ 1596.358858][T20513] ? trace_irq_disable+0x3b/0x140 [ 1596.358878][T20513] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1596.358897][T20513] ? clear_bhb_loop+0x70/0xc0 [ 1596.358920][T20513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1596.358938][T20513] RIP: 0033:0x7fa11259e159 [ 1596.358956][T20513] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1596.358972][T20513] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1596.358993][T20513] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1596.359007][T20513] RDX: 0000000000001003 RSI: 00002000000048c0 RDI: 0000000000000003 [ 1596.359020][T20513] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1596.359032][T20513] R10: 0000000000010122 R11: 0000000000000246 R12: 0000000000000002 [ 1596.359044][T20513] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1596.359073][T20513] [ 1596.420385][T20485] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1596.571371][T20485] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1596.674356][T20522] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1596.800377][T20522] bond7 (unregistering): Released all slaves [ 1596.874461][T20524] 1·: renamed from c0· (while UP) [ 1596.884878][T20524] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1596.996834][T20529] __nla_validate_parse: 7 callbacks suppressed [ 1596.996847][T20529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14291'. [ 1597.248220][T20531] netlink: 'syz.2.14292': attribute type 1 has an invalid length. [ 1597.363230][T20531] bond5: option mode: invalid value (7) [ 1597.376608][T20531] bond5 (unregistering): Released all slaves [ 1597.445762][T20545] netlink: 'syz.2.14292': attribute type 10 has an invalid length. [ 1597.445782][T20545] netlink: 40 bytes leftover after parsing attributes in process `syz.2.14292'. [ 1597.479367][T20543] netlink: 48 bytes leftover after parsing attributes in process `syz.1.14296'. [ 1597.585840][T20542] dummy0: left promiscuous mode [ 1597.811062][T20557] netlink: 9 bytes leftover after parsing attributes in process `syz.0.14302'. [ 1597.811173][T20557] 1·: renamed from c0· (while UP) [ 1597.813917][T20557] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1598.179801][T20566] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1598.280595][T20574] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14307'. [ 1598.363962][T20566] bond5 (unregistering): Released all slaves [ 1598.571844][T20579] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14309'. [ 1599.291730][T20597] netlink: 9 bytes leftover after parsing attributes in process `syz.4.14315'. [ 1599.291864][T20597] 0·: renamed from c1· (while UP) [ 1599.296598][T20597] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1599.518756][T20604] netlink: 20 bytes leftover after parsing attributes in process `syz.4.14319'. [ 1599.518905][T20604] FAULT_INJECTION: forcing a failure. [ 1599.518905][T20604] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1599.518938][T20604] CPU: 1 UID: 0 PID: 20604 Comm: syz.4.14319 Not tainted syzkaller #0 PREEMPT(full) [ 1599.518958][T20604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1599.518970][T20604] Call Trace: [ 1599.518978][T20604] [ 1599.518987][T20604] dump_stack_lvl+0xe8/0x150 [ 1599.519020][T20604] should_fail_ex+0x410/0x560 [ 1599.519048][T20604] _copy_from_user+0x2d/0xb0 [ 1599.519073][T20604] kstrtouint_from_user+0xd6/0x180 [ 1599.519097][T20604] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1599.519127][T20604] ? lock_acquire+0x115/0x350 [ 1599.519152][T20604] proc_fail_nth_write+0x8e/0x210 [ 1599.519172][T20604] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1599.519204][T20604] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1599.519223][T20604] vfs_write+0x296/0xba0 [ 1599.519262][T20604] ? __pfx_vfs_write+0x10/0x10 [ 1599.519291][T20604] ? __fget_files+0x2a/0x420 [ 1599.519321][T20604] ? __fget_files+0x3a2/0x420 [ 1599.519345][T20604] ? __fget_files+0x2a/0x420 [ 1599.519379][T20604] ksys_write+0x150/0x270 [ 1599.519408][T20604] ? __pfx_ksys_write+0x10/0x10 [ 1599.519447][T20604] do_syscall_64+0x166/0x520 [ 1599.519471][T20604] ? trace_irq_disable+0x3b/0x140 [ 1599.519490][T20604] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.519510][T20604] ? clear_bhb_loop+0x70/0xc0 [ 1599.519533][T20604] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1599.519552][T20604] RIP: 0033:0x7fa5b9d5e98e [ 1599.519569][T20604] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1599.519584][T20604] RSP: 002b:00007fa5b7ff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1599.519605][T20604] RAX: ffffffffffffffda RBX: 00007fa5b7ff66c0 RCX: 00007fa5b9d5e98e [ 1599.519619][T20604] RDX: 0000000000000001 RSI: 00007fa5b7ff60a0 RDI: 0000000000000003 [ 1599.519631][T20604] RBP: 00007fa5b7ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1599.519642][T20604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1599.519654][T20604] R13: 00007fa5ba026038 R14: 00007fa5ba025fa0 R15: 00007ffdcbb4a878 [ 1599.519686][T20604] [ 1599.545632][T20603] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14318'. [ 1599.804590][T20607] tls_set_device_offload_rx: netdev not found [ 1599.882873][T20609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14321'. [ 1600.066519][T20616] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1600.143963][T20616] bond7 (unregistering): Released all slaves [ 1600.678993][T20636] 1·: renamed from c0· [ 1600.694119][T20636] 1·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1600.694144][T20636] 1·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1600.701015][T20636] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1600.816134][T20642] netlink: 'syz.2.14332': attribute type 1 has an invalid length. [ 1600.936287][T20642] bond5: entered promiscuous mode [ 1600.939272][T20642] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1600.975208][T20650] FAULT_INJECTION: forcing a failure. [ 1600.975208][T20650] name failslab, interval 1, probability 0, space 0, times 0 [ 1600.975240][T20650] CPU: 0 UID: 0 PID: 20650 Comm: syz.3.14335 Not tainted syzkaller #0 PREEMPT(full) [ 1600.975260][T20650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1600.975272][T20650] Call Trace: [ 1600.975279][T20650] [ 1600.975288][T20650] dump_stack_lvl+0xe8/0x150 [ 1600.975320][T20650] should_fail_ex+0x410/0x560 [ 1600.975347][T20650] should_failslab+0xa8/0x100 [ 1600.975373][T20650] __kvmalloc_node_noprof+0x176/0x820 [ 1600.975398][T20650] ? __kvmalloc_node_noprof+0x345/0x820 [ 1600.975418][T20650] ? bpf_compute_scc+0x106/0xb10 [ 1600.975437][T20650] ? bpf_compute_scc+0x106/0xb10 [ 1600.975462][T20650] bpf_compute_scc+0x106/0xb10 [ 1600.975501][T20650] bpf_check+0x2720/0x2ef0 [ 1600.975541][T20650] ? __pfx_bpf_check+0x10/0x10 [ 1600.975564][T20650] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1600.975596][T20650] bpf_prog_load+0x14d6/0x1c20 [ 1600.975630][T20650] ? __pfx_bpf_prog_load+0x10/0x10 [ 1600.975677][T20650] __sys_bpf+0xd0d/0xd90 [ 1600.975706][T20650] ? __pfx___sys_bpf+0x10/0x10 [ 1600.975738][T20650] ? __fget_files+0x2a/0x420 [ 1600.975781][T20650] ? ksys_write+0x242/0x270 [ 1600.975810][T20650] ? __pfx_ksys_write+0x10/0x10 [ 1600.975842][T20650] __x64_sys_bpf+0xba/0xd0 [ 1600.975864][T20650] do_syscall_64+0x166/0x520 [ 1600.975889][T20650] ? trace_irq_disable+0x3b/0x140 [ 1600.975908][T20650] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1600.975927][T20650] ? clear_bhb_loop+0x70/0xc0 [ 1600.975949][T20650] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1600.975970][T20650] RIP: 0033:0x7ff413d9e159 [ 1600.975986][T20650] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1600.976002][T20650] RSP: 002b:00007ff411ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1600.976022][T20650] RAX: ffffffffffffffda RBX: 00007ff414025fa0 RCX: 00007ff413d9e159 [ 1600.976035][T20650] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1600.976047][T20650] RBP: 00007ff411ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1600.976059][T20650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1600.976070][T20650] R13: 00007ff414026038 R14: 00007ff414025fa0 R15: 00007fff0942d268 [ 1600.976100][T20650] [ 1601.070869][T20644] vlan3: entered allmulticast mode [ 1601.070889][T20644] bond5: entered allmulticast mode [ 1601.192128][T20642] bond5: (slave bridge5): making interface the new active one [ 1601.192152][T20642] bridge5: entered promiscuous mode [ 1601.192352][T20642] bridge5: entered allmulticast mode [ 1601.255164][T20642] bond5: (slave bridge5): Enslaving as an active interface with an up link [ 1601.565168][T20663] xt_hashlimit: size too large, truncated to 1048576 [ 1601.676551][T20673] xt_hashlimit: size too large, truncated to 1048576 [ 1601.844973][T20659] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1602.015899][T20659] bond5 (unregistering): Released all slaves [ 1602.473327][T20685] __nla_validate_parse: 2 callbacks suppressed [ 1602.473348][T20685] netlink: 9 bytes leftover after parsing attributes in process `syz.2.14344'. [ 1602.473458][T20685] 0·: renamed from c1· (while UP) [ 1602.536172][T20685] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1602.685802][T20697] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1602.801892][T20701] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14353'. [ 1602.935040][T20709] netlink: 224 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1602.961445][T20711] FAULT_INJECTION: forcing a failure. [ 1602.961445][T20711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1602.961486][T20711] CPU: 1 UID: 0 PID: 20711 Comm: syz.2.14356 Not tainted syzkaller #0 PREEMPT(full) [ 1602.961507][T20711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1602.961519][T20711] Call Trace: [ 1602.961527][T20711] [ 1602.961535][T20711] dump_stack_lvl+0xe8/0x150 [ 1602.961567][T20711] should_fail_ex+0x410/0x560 [ 1602.961595][T20711] _copy_to_user+0x31/0xb0 [ 1602.961622][T20711] __htab_map_lookup_and_delete_batch+0x14f9/0x1a00 [ 1602.961680][T20711] ? __pfx___htab_map_lookup_and_delete_batch+0x10/0x10 [ 1602.961710][T20711] ? __pfx_htab_percpu_map_lookup_batch+0x10/0x10 [ 1602.961739][T20711] bpf_map_do_batch+0x27f/0x630 [ 1602.961761][T20711] ? bpf_lsm_bpf+0x9/0x20 [ 1602.961787][T20711] ? security_bpf+0x7e/0x2d0 [ 1602.961812][T20711] __sys_bpf+0xa9f/0xd90 [ 1602.961840][T20711] ? __pfx___sys_bpf+0x10/0x10 [ 1602.961873][T20711] ? __fget_files+0x2a/0x420 [ 1602.961915][T20711] ? ksys_write+0x242/0x270 [ 1602.961945][T20711] ? __pfx_ksys_write+0x10/0x10 [ 1602.961977][T20711] __x64_sys_bpf+0xba/0xd0 [ 1602.962000][T20711] do_syscall_64+0x166/0x520 [ 1602.962025][T20711] ? trace_irq_disable+0x3b/0x140 [ 1602.962044][T20711] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1602.962063][T20711] ? clear_bhb_loop+0x70/0xc0 [ 1602.962086][T20711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1602.962105][T20711] RIP: 0033:0x7fa11259e159 [ 1602.962122][T20711] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1602.962137][T20711] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1602.962157][T20711] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1602.962172][T20711] RDX: 0000000000000038 RSI: 00002000000003c0 RDI: 0000000000000018 [ 1602.962184][T20711] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1602.962195][T20711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1602.962207][T20711] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1602.962234][T20711] [ 1603.220246][T20719] netlink: 'syz.3.14357': attribute type 2 has an invalid length. [ 1603.220268][T20719] netlink: 232 bytes leftover after parsing attributes in process `syz.3.14357'. [ 1603.245862][T20721] netlink: 44 bytes leftover after parsing attributes in process `syz.2.14358'. [ 1603.254873][T20715] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1603.333851][T20722] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1603.399215][T20715] bond7 (unregistering): Released all slaves [ 1603.466495][T20719] C: renamed from veth1_to_team [ 1603.478515][T20719] netlink: 'syz.3.14357': attribute type 4 has an invalid length. [ 1603.478535][T20719] netlink: 116 bytes leftover after parsing attributes in process `syz.3.14357'. [ 1603.478551][T20719] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1603.742565][T20729] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14360'. [ 1604.074847][T20740] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14364'. [ 1604.074914][T20740] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14364'. [ 1604.111467][T20741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14365'. [ 1604.358183][T20752] syz_tun: entered allmulticast mode [ 1604.698238][T20750] syz_tun: left allmulticast mode [ 1604.789538][T20765] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1604.825114][T20777] openvswitch: netlink: Key type 7696 is out of range max 32 [ 1604.965702][T20765] bond5 (unregistering): Released all slaves [ 1605.466399][T20793] netlink: 'syz.2.14381': attribute type 15 has an invalid length. [ 1605.546836][T20797] x_tables: duplicate underflow at hook 3 [ 1606.918389][T20846] syz_tun: entered allmulticast mode [ 1607.043538][T20845] syz_tun: left allmulticast mode [ 1607.231125][T20850] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1607.526855][T20863] __nla_validate_parse: 6 callbacks suppressed [ 1607.526875][T20863] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14404'. [ 1607.548039][T20867] xt_bpf: check failed: parse error [ 1607.581599][T20868] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14408'. [ 1607.766663][T20880] syz_tun: entered allmulticast mode [ 1607.776409][T20881] netlink: 34 bytes leftover after parsing attributes in process `syz.4.14413'. [ 1607.833377][T20878] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14411'. [ 1607.941364][T20877] syz_tun: left allmulticast mode [ 1608.871282][T20907] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14423'. [ 1608.901246][T20910] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14424'. [ 1609.203975][T20922] syz_tun: entered allmulticast mode [ 1609.375963][T20928] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14428'. [ 1609.375998][T20928] netlink: 'syz.0.14428': attribute type 10 has an invalid length. [ 1609.376013][T20928] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14428'. [ 1609.457627][T20928] geneve4: entered promiscuous mode [ 1609.457651][T20928] geneve4: entered allmulticast mode [ 1609.634195][T20920] syz_tun: left allmulticast mode [ 1609.851708][T20939] ipt_ECN: cannot use operation on non-tcp rule [ 1609.915903][T20943] netlink: 72 bytes leftover after parsing attributes in process `syz.3.14434'. [ 1610.123234][T20949] FAULT_INJECTION: forcing a failure. [ 1610.123234][T20949] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1610.123268][T20949] CPU: 0 UID: 0 PID: 20949 Comm: syz.2.14436 Not tainted syzkaller #0 PREEMPT(full) [ 1610.123305][T20949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1610.123326][T20949] Call Trace: [ 1610.123343][T20949] [ 1610.123353][T20949] dump_stack_lvl+0xe8/0x150 [ 1610.123385][T20949] should_fail_ex+0x410/0x560 [ 1610.123414][T20949] copy_folio_from_iter_atomic+0x45a/0x1a30 [ 1610.123440][T20949] ? trace_irq_disable+0x3b/0x140 [ 1610.123475][T20949] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 1610.123502][T20949] ? shmem_write_begin+0x1d8/0x330 [ 1610.123535][T20949] generic_perform_write+0x5c7/0x8f0 [ 1610.123575][T20949] ? __pfx_generic_perform_write+0x10/0x10 [ 1610.123601][T20949] ? do_raw_spin_unlock+0xf5/0x200 [ 1610.123627][T20949] ? mnt_put_write_access_file+0xc3/0x100 [ 1610.123648][T20949] ? file_update_time_flags+0x3ab/0x440 [ 1610.123670][T20949] shmem_file_write_iter+0xf8/0x120 [ 1610.123698][T20949] vfs_write+0x612/0xba0 [ 1610.123734][T20949] ? __pfx_vfs_write+0x10/0x10 [ 1610.123763][T20949] ? do_sys_openat2+0x14e/0x200 [ 1610.123784][T20949] ? kmem_cache_free+0x182/0x650 [ 1610.123822][T20949] ksys_write+0x150/0x270 [ 1610.123860][T20949] ? __pfx_ksys_write+0x10/0x10 [ 1610.123898][T20949] do_syscall_64+0x166/0x520 [ 1610.123922][T20949] ? trace_irq_disable+0x3b/0x140 [ 1610.123940][T20949] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1610.123958][T20949] ? clear_bhb_loop+0x70/0xc0 [ 1610.123981][T20949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1610.124000][T20949] RIP: 0033:0x7fa11259e159 [ 1610.124018][T20949] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1610.124033][T20949] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1610.124053][T20949] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1610.124066][T20949] RDX: 0000000000032600 RSI: 0000200000000000 RDI: 0000000000000003 [ 1610.124078][T20949] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1610.124090][T20949] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1610.124102][T20949] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1610.124134][T20949] [ 1610.985914][T20963] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1611.132304][T20963] bond7 (unregistering): Released all slaves [ 1611.189953][T20969] syz_tun: entered allmulticast mode [ 1611.532955][T20979] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14447'. [ 1611.573887][T20967] syz_tun: left allmulticast mode [ 1611.662048][T20988] FAULT_INJECTION: forcing a failure. [ 1611.662048][T20988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1611.662079][T20988] CPU: 1 UID: 0 PID: 20988 Comm: syz.3.14450 Not tainted syzkaller #0 PREEMPT(full) [ 1611.662101][T20988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1611.662112][T20988] Call Trace: [ 1611.662120][T20988] [ 1611.662129][T20988] dump_stack_lvl+0xe8/0x150 [ 1611.662159][T20988] should_fail_ex+0x410/0x560 [ 1611.662186][T20988] _copy_from_user+0x2d/0xb0 [ 1611.662212][T20988] ___sys_sendmsg+0x1c6/0x360 [ 1611.662238][T20988] ? __lock_acquire+0x747/0x2de0 [ 1611.662263][T20988] ? __pfx____sys_sendmsg+0x10/0x10 [ 1611.662322][T20988] ? __fget_files+0x2a/0x420 [ 1611.662347][T20988] ? __fget_files+0x3a2/0x420 [ 1611.662382][T20988] __x64_sys_sendmsg+0x1b1/0x290 [ 1611.662412][T20988] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1611.662458][T20988] do_syscall_64+0x166/0x520 [ 1611.662484][T20988] ? trace_irq_disable+0x3b/0x140 [ 1611.662503][T20988] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1611.662523][T20988] ? clear_bhb_loop+0x70/0xc0 [ 1611.662547][T20988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1611.662566][T20988] RIP: 0033:0x7ff413d9e159 [ 1611.662583][T20988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1611.662599][T20988] RSP: 002b:00007ff411ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1611.662618][T20988] RAX: ffffffffffffffda RBX: 00007ff414025fa0 RCX: 00007ff413d9e159 [ 1611.662630][T20988] RDX: 0000000000004000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1611.662643][T20988] RBP: 00007ff411ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1611.662661][T20988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1611.662671][T20988] R13: 00007ff414026038 R14: 00007ff414025fa0 R15: 00007fff0942d268 [ 1611.662700][T20988] [ 1612.115067][T21006] bridge_slave_0: left allmulticast mode [ 1612.115093][T21006] bridge_slave_0: left promiscuous mode [ 1612.115331][T21006] bridge0: port 1(bridge_slave_0) entered disabled state [ 1612.155031][T21006] bridge_slave_1: left allmulticast mode [ 1612.155056][T21006] bridge_slave_1: left promiscuous mode [ 1612.158381][T21006] bridge0: port 2(bridge_slave_1) entered disabled state [ 1612.199966][T21006] bond0: (slave bond_slave_0): Releasing backup interface [ 1612.266120][T21006] bond0: (slave bond_slave_1): Releasing backup interface [ 1612.309491][T21006] team0: Port device team_slave_0 removed [ 1612.341782][T21006] team0: Port device team_slave_1 removed [ 1612.342221][T21006] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1613.350650][T21029] __nla_validate_parse: 2 callbacks suppressed [ 1613.350670][T21029] netlink: 64 bytes leftover after parsing attributes in process `syz.3.14459'. [ 1613.350687][T21029] netlink: 64 bytes leftover after parsing attributes in process `syz.3.14459'. [ 1613.355884][T21029] netlink: 32 bytes leftover after parsing attributes in process `syz.3.14459'. [ 1613.435726][T21029] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1613.504620][T21033] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14462'. [ 1613.504647][T21033] openvswitch: netlink: Flow key attr not present in new flow. [ 1614.502755][T21062] dummy0: left promiscuous mode [ 1614.575454][T21080] FAULT_INJECTION: forcing a failure. [ 1614.575454][T21080] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1614.575487][T21080] CPU: 0 UID: 0 PID: 21080 Comm: syz.1.14477 Not tainted syzkaller #0 PREEMPT(full) [ 1614.575508][T21080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1614.575519][T21080] Call Trace: [ 1614.575528][T21080] [ 1614.575536][T21080] dump_stack_lvl+0xe8/0x150 [ 1614.575569][T21080] should_fail_ex+0x410/0x560 [ 1614.575597][T21080] prepare_alloc_pages+0x223/0x600 [ 1614.575626][T21080] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1614.575652][T21080] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1614.575678][T21080] ? __pfx_policy_nodemask+0x10/0x10 [ 1614.575713][T21080] alloc_pages_mpol+0x21e/0x390 [ 1614.575744][T21080] folio_alloc_mpol_noprof+0x39/0x160 [ 1614.575769][T21080] shmem_alloc_and_add_folio+0x43e/0xf60 [ 1614.575794][T21080] ? filemap_get_entry+0xcd/0x3f0 [ 1614.575826][T21080] ? folio_mark_accessed+0x425/0x8b0 [ 1614.575860][T21080] ? __pfx_filemap_get_entry+0x10/0x10 [ 1614.575885][T21080] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 1614.575916][T21080] ? shmem_allowable_huge_orders+0x325/0x6c0 [ 1614.575948][T21080] shmem_get_folio_gfp+0x5da/0x16d0 [ 1614.575992][T21080] shmem_write_begin+0x16c/0x330 [ 1614.576025][T21080] generic_perform_write+0x2d5/0x8f0 [ 1614.576067][T21080] ? __pfx_generic_perform_write+0x10/0x10 [ 1614.576096][T21080] ? do_raw_spin_unlock+0xf5/0x200 [ 1614.576123][T21080] ? mnt_put_write_access_file+0xc3/0x100 [ 1614.576147][T21080] ? file_update_time_flags+0x3ab/0x440 [ 1614.576172][T21080] shmem_file_write_iter+0xf8/0x120 [ 1614.576201][T21080] vfs_write+0x612/0xba0 [ 1614.576237][T21080] ? __pfx_vfs_write+0x10/0x10 [ 1614.576268][T21080] ? do_sys_openat2+0x14e/0x200 [ 1614.576290][T21080] ? kmem_cache_free+0x182/0x650 [ 1614.576329][T21080] ksys_write+0x150/0x270 [ 1614.576359][T21080] ? __pfx_ksys_write+0x10/0x10 [ 1614.576399][T21080] do_syscall_64+0x166/0x520 [ 1614.576425][T21080] ? trace_irq_disable+0x3b/0x140 [ 1614.576445][T21080] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1614.576466][T21080] ? clear_bhb_loop+0x70/0xc0 [ 1614.576490][T21080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1614.576509][T21080] RIP: 0033:0x7f336cd9e159 [ 1614.576531][T21080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1614.576548][T21080] RSP: 002b:00007f336db96028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1614.576569][T21080] RAX: ffffffffffffffda RBX: 00007f336d025fa0 RCX: 00007f336cd9e159 [ 1614.576583][T21080] RDX: 0000000000032600 RSI: 0000200000000000 RDI: 0000000000000003 [ 1614.576596][T21080] RBP: 00007f336db96090 R08: 0000000000000000 R09: 0000000000000000 [ 1614.576608][T21080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1614.576619][T21080] R13: 00007f336d026038 R14: 00007f336d025fa0 R15: 00007fff2a9622b8 [ 1614.576653][T21080] [ 1614.837143][T21062] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1615.227223][T21100] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14485'. [ 1615.268162][T21100] netlink: 'syz.0.14485': attribute type 83 has an invalid length. [ 1615.319088][T21109] netlink: 'syz.0.14485': attribute type 83 has an invalid length. [ 1615.341148][T21116] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14488'. [ 1615.576826][T21123] netlink: 80 bytes leftover after parsing attributes in process `syz.2.14489'. [ 1615.576913][T21123] netlink: 80 bytes leftover after parsing attributes in process `syz.2.14489'. [ 1615.952640][T21131] sock: sock_set_timeout: `syz.4.14493' (pid 21131) tries to set negative timeout [ 1616.082038][T21139] netlink: 112 bytes leftover after parsing attributes in process `syz.0.14498'. [ 1616.279182][T21147] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1616.546101][T21153] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14501'. [ 1616.698439][T21159] syz_tun: entered allmulticast mode [ 1616.919635][T21171] netlink: 'syz.0.14506': attribute type 6 has an invalid length. [ 1617.064498][ T5629] block nbd0: Receive control failed (result -22) [ 1617.065373][T21171] nbd0: detected capacity change from 0 to 32 [ 1617.101898][T21181] netlink: 'syz.4.14509': attribute type 11 has an invalid length. [ 1617.479670][T21158] syz_tun: left allmulticast mode [ 1617.503089][T21192] FAULT_INJECTION: forcing a failure. [ 1617.503089][T21192] name failslab, interval 1, probability 0, space 0, times 0 [ 1617.503122][T21192] CPU: 0 UID: 0 PID: 21192 Comm: syz.0.14515 Not tainted syzkaller #0 PREEMPT(full) [ 1617.503151][T21192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1617.503162][T21192] Call Trace: [ 1617.503170][T21192] [ 1617.503179][T21192] dump_stack_lvl+0xe8/0x150 [ 1617.503211][T21192] should_fail_ex+0x410/0x560 [ 1617.503239][T21192] should_failslab+0xa8/0x100 [ 1617.503264][T21192] __kvmalloc_node_noprof+0x176/0x820 [ 1617.503284][T21192] ? kasan_save_track+0x3e/0x80 [ 1617.503305][T21192] ? __kvmalloc_node_noprof+0x50f/0x820 [ 1617.503324][T21192] ? bpf_stack_liveness_init+0x29/0x90 [ 1617.503345][T21192] ? bpf_check+0x2641/0x2ef0 [ 1617.503363][T21192] ? bpf_compute_const_regs+0x18f/0x3450 [ 1617.503383][T21192] ? bpf_compute_const_regs+0x18f/0x3450 [ 1617.503410][T21192] bpf_compute_const_regs+0x18f/0x3450 [ 1617.503453][T21192] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 1617.503474][T21192] ? check_attach_btf_id+0x325/0x1a30 [ 1617.503502][T21192] ? rcu_is_watching+0x16/0xb0 [ 1617.503525][T21192] ? bpf_stack_liveness_init+0x29/0x90 [ 1617.503544][T21192] ? trace_kmalloc+0x2a/0xf0 [ 1617.503560][T21192] ? __pfx_check_attach_btf_id+0x10/0x10 [ 1617.503577][T21192] ? bpf_stack_liveness_init+0x29/0x90 [ 1617.503593][T21192] ? __kvmalloc_node_noprof+0x52f/0x820 [ 1617.503616][T21192] ? __asan_memset+0x22/0x50 [ 1617.503632][T21192] bpf_check+0x26ae/0x2ef0 [ 1617.503662][T21192] ? __pfx_bpf_check+0x10/0x10 [ 1617.503680][T21192] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1617.503704][T21192] bpf_prog_load+0x14d6/0x1c20 [ 1617.503730][T21192] ? __pfx_bpf_prog_load+0x10/0x10 [ 1617.503768][T21192] __sys_bpf+0xd0d/0xd90 [ 1617.503790][T21192] ? __pfx___sys_bpf+0x10/0x10 [ 1617.503815][T21192] ? __fget_files+0x2a/0x420 [ 1617.503847][T21192] ? ksys_write+0x242/0x270 [ 1617.503870][T21192] ? __pfx_ksys_write+0x10/0x10 [ 1617.503894][T21192] __x64_sys_bpf+0xba/0xd0 [ 1617.503912][T21192] do_syscall_64+0x166/0x520 [ 1617.503932][T21192] ? trace_irq_disable+0x3b/0x140 [ 1617.503946][T21192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1617.503961][T21192] ? clear_bhb_loop+0x70/0xc0 [ 1617.503979][T21192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1617.503994][T21192] RIP: 0033:0x7f04def9e159 [ 1617.504008][T21192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1617.504020][T21192] RSP: 002b:00007f04dfddf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1617.504037][T21192] RAX: ffffffffffffffda RBX: 00007f04df225fa0 RCX: 00007f04def9e159 [ 1617.504048][T21192] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1617.504058][T21192] RBP: 00007f04dfddf090 R08: 0000000000000000 R09: 0000000000000000 [ 1617.504067][T21192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1617.504075][T21192] R13: 00007f04df226038 R14: 00007f04df225fa0 R15: 00007fff04334698 [ 1617.504098][T21192] [ 1617.583227][ T30] audit: type=1800 audit(1790467282.456:22): pid=21194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.14514" name=FFFFFFFF dev="tmpfs" ino=2351 res=0 errno=0 [ 1617.584486][ T30] audit: type=1804 audit(1790467282.456:23): pid=21194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.14514" name=2F6E6577726F6F742F3435362FFFFFFFFF dev="tmpfs" ino=2351 res=1 errno=0 [ 1617.759892][ T30] audit: type=1804 audit(1790467282.636:24): pid=21204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.14514" name=2F6E6577726F6F742F3435362FFFFFFFFF dev="tmpfs" ino=2351 res=1 errno=0 [ 1617.773277][ T30] audit: type=1800 audit(1790467282.646:25): pid=21204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.14514" name=FFFFFFFF dev="tmpfs" ino=2351 res=0 errno=0 [ 1617.773512][T21198] netlink: zone id is out of range [ 1617.773521][T21198] netlink: zone id is out of range [ 1617.773529][T21198] netlink: zone id is out of range [ 1617.773537][T21198] netlink: zone id is out of range [ 1617.773544][T21198] netlink: zone id is out of range [ 1617.773551][T21198] netlink: zone id is out of range [ 1617.773559][T21198] netlink: zone id is out of range [ 1617.773566][T21198] netlink: zone id is out of range [ 1617.773573][T21198] netlink: zone id is out of range [ 1617.773582][T21198] netlink: set zone limit has 4 unknown bytes [ 1617.776639][ T30] audit: type=1804 audit(1790467282.646:26): pid=21197 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.14514" name=2F6E6577726F6F742F3435362FFFFFFFFF dev="tmpfs" ino=2351 res=1 errno=0 [ 1618.184798][T21212] netlink: 'syz.4.14519': attribute type 1 has an invalid length. [ 1618.383123][T21213] __nla_validate_parse: 2 callbacks suppressed [ 1618.383143][T21213] netlink: 16 bytes leftover after parsing attributes in process `syz.4.14519'. [ 1618.488493][T21226] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14519'. [ 1618.511424][T21212] bond7: entered promiscuous mode [ 1618.511937][T21212] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1618.513792][T21221] veth0: entered promiscuous mode [ 1618.514470][T21226] bond7: entered allmulticast mode [ 1618.517121][T21216] veth0: left promiscuous mode [ 1618.665038][T21212] bond7: (slave bridge6): making interface the new active one [ 1618.665064][T21212] bridge6: entered promiscuous mode [ 1618.665279][T21212] bridge6: entered allmulticast mode [ 1618.666275][T21212] bond7: (slave bridge6): Enslaving as an active interface with an up link [ 1618.941620][T21230] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14526'. [ 1619.354916][T21262] x_tables: ip6_tables: SNAT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING [ 1619.681272][T21278] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14538'. [ 1624.052915][T21303] netlink: 36 bytes leftover after parsing attributes in process `syz.3.14545'. [ 1624.639326][T21330] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14557'. [ 1624.737977][T21330] vlan3: entered allmulticast mode [ 1625.146691][T21342] net_ratelimit: 1 callbacks suppressed [ 1625.146710][T21342] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 1625.525176][T21351] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14563'. [ 1625.553580][T21351] FAULT_INJECTION: forcing a failure. [ 1625.553580][T21351] name failslab, interval 1, probability 0, space 0, times 0 [ 1625.553612][T21351] CPU: 0 UID: 0 PID: 21351 Comm: syz.0.14563 Not tainted syzkaller #0 PREEMPT(full) [ 1625.553633][T21351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1625.553645][T21351] Call Trace: [ 1625.553655][T21351] [ 1625.553665][T21351] dump_stack_lvl+0xe8/0x150 [ 1625.553697][T21351] should_fail_ex+0x410/0x560 [ 1625.553727][T21351] should_failslab+0xa8/0x100 [ 1625.553750][T21351] ? skb_clone+0x212/0x3a0 [ 1625.553777][T21351] kmem_cache_alloc_noprof+0xa1/0x600 [ 1625.553808][T21351] ? skb_clone+0x212/0x3a0 [ 1625.553841][T21351] skb_clone+0x212/0x3a0 [ 1625.553872][T21351] __netlink_deliver_tap+0x355/0x6e0 [ 1625.553905][T21351] ? netlink_deliver_tap+0x2e/0x1b0 [ 1625.553926][T21351] netlink_deliver_tap+0x19c/0x1b0 [ 1625.553947][T21351] netlink_unicast+0x781/0x940 [ 1625.553987][T21351] netlink_sendmsg+0x813/0xb40 [ 1625.554016][T21351] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1625.554045][T21351] ? apparmor_socket_sendmsg+0x98/0x360 [ 1625.554070][T21351] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1625.554088][T21351] sock_sendmsg_nosec+0x13a/0x180 [ 1625.554113][T21351] __sys_sendto+0x408/0x5a0 [ 1625.554143][T21351] ? __pfx___sys_sendto+0x10/0x10 [ 1625.554198][T21351] ? do_user_addr_fault+0xc4c/0x1340 [ 1625.554225][T21351] __x64_sys_sendto+0xde/0x100 [ 1625.554253][T21351] do_syscall_64+0x166/0x520 [ 1625.554278][T21351] ? trace_irq_disable+0x3b/0x140 [ 1625.554298][T21351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1625.554324][T21351] ? clear_bhb_loop+0x70/0xc0 [ 1625.554348][T21351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1625.554368][T21351] RIP: 0033:0x7f04def5e98e [ 1625.554385][T21351] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1625.554401][T21351] RSP: 002b:00007f04dfddde88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1625.554422][T21351] RAX: ffffffffffffffda RBX: 00007f04dfddf6c0 RCX: 00007f04def5e98e [ 1625.554438][T21351] RDX: 0000000000000020 RSI: 00007f04dfdde000 RDI: 0000000000000003 [ 1625.554449][T21351] RBP: 0000000000000000 R08: 00007f04dfdddf04 R09: 000000000000000c [ 1625.554461][T21351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1625.554472][T21351] R13: 00007f04dfdddf58 R14: 00007f04dfdde000 R15: 0000000000000000 [ 1625.554502][T21351] [ 1625.741521][T21354] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14564'. [ 1625.797511][T21354] ipvlan2: entered allmulticast mode [ 1625.797531][T21354] syz_tun: entered allmulticast mode [ 1626.131948][T21360] netlink: 56 bytes leftover after parsing attributes in process `syz.4.14566'. [ 1626.770708][T21387] syzkaller0: entered promiscuous mode [ 1626.770731][T21387] syzkaller0: entered allmulticast mode [ 1626.922038][T21398] netlink: 164 bytes leftover after parsing attributes in process `syz.3.14577'. [ 1626.968563][T21400] netlink: 'syz.2.14578': attribute type 1 has an invalid length. [ 1627.012970][T21404] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14577'. [ 1627.373076][T21407] veth9: entered allmulticast mode [ 1627.395012][T21407] bond6: (slave veth9): Enslaving as an active interface with a down link [ 1627.424767][T21400] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1627.712559][T21422] netlink: 56 bytes leftover after parsing attributes in process `syz.4.14584'. [ 1627.921743][T21429] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14587'. [ 1628.105421][T21437] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14590'. [ 1628.302339][T21446] bond6: (slave veth0_to_bond): Releasing active interface [ 1628.334129][T21446] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1629.286791][T21484] __nla_validate_parse: 4 callbacks suppressed [ 1629.286811][T21484] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14611'. [ 1629.402092][T21490] netlink: 56 bytes leftover after parsing attributes in process `syz.2.14613'. [ 1629.501280][T21494] xt_hashlimit: size too large, truncated to 1048576 [ 1629.631006][T21505] xt_hashlimit: size too large, truncated to 1048576 [ 1629.662928][T21502] ipt_ECN: cannot use operation on non-tcp rule [ 1630.040427][T21514] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 1630.052218][T21514] netlink: 'syz.0.14619': attribute type 10 has an invalid length. [ 1630.570014][T21514] team0 (unregistering): Port device team_slave_1 removed [ 1630.630504][T21514] team0 (unregistering): Port device dummy0 removed [ 1630.984829][T21532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14625'. [ 1631.216854][T21537] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14627'. [ 1631.232695][T21537] FAULT_INJECTION: forcing a failure. [ 1631.232695][T21537] name failslab, interval 1, probability 0, space 0, times 0 [ 1631.232725][T21537] CPU: 1 UID: 0 PID: 21537 Comm: syz.2.14627 Not tainted syzkaller #0 PREEMPT(full) [ 1631.232750][T21537] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1631.232762][T21537] Call Trace: [ 1631.232770][T21537] [ 1631.232778][T21537] dump_stack_lvl+0xe8/0x150 [ 1631.232808][T21537] should_fail_ex+0x410/0x560 [ 1631.232839][T21537] should_failslab+0xa8/0x100 [ 1631.232864][T21537] __kmalloc_cache_noprof+0xa3/0x600 [ 1631.232883][T21537] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1631.232906][T21537] ? __request_module+0x2d0/0x630 [ 1631.232926][T21537] ? __request_module+0x2d0/0x630 [ 1631.232950][T21537] __request_module+0x2d0/0x630 [ 1631.232972][T21537] ? nfnetlink_rcv+0x6da/0x28c0 [ 1631.233002][T21537] ? __pfx___request_module+0x10/0x10 [ 1631.233023][T21537] ? __mutex_unlock_slowpath+0x731/0x900 [ 1631.233067][T21537] nfnetlink_rcv+0x6ef/0x28c0 [ 1631.233097][T21537] ? __kernel_text_address+0xd/0x30 [ 1631.233120][T21537] ? arch_stack_walk+0xfb/0x150 [ 1631.233150][T21537] ? stack_trace_save+0xa9/0x100 [ 1631.233168][T21537] ? __lock_acquire+0x747/0x2de0 [ 1631.233187][T21537] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1631.233229][T21537] ? __lock_acquire+0x747/0x2de0 [ 1631.233259][T21537] ? __netlink_lookup+0xc6/0x8b0 [ 1631.233286][T21537] ? lock_acquire+0x115/0x350 [ 1631.233305][T21537] ? netlink_deliver_tap+0x2e/0x1b0 [ 1631.233330][T21537] ? netlink_deliver_tap+0x2e/0x1b0 [ 1631.233347][T21537] ? netlink_deliver_tap+0x2e/0x1b0 [ 1631.233380][T21537] netlink_unicast+0x7bd/0x940 [ 1631.233416][T21537] netlink_sendmsg+0x813/0xb40 [ 1631.233445][T21537] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1631.233472][T21537] ? apparmor_socket_sendmsg+0x98/0x360 [ 1631.233497][T21537] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1631.233514][T21537] sock_sendmsg_nosec+0x13a/0x180 [ 1631.233537][T21537] __sys_sendto+0x408/0x5a0 [ 1631.233565][T21537] ? __pfx___sys_sendto+0x10/0x10 [ 1631.233617][T21537] ? do_user_addr_fault+0xc4c/0x1340 [ 1631.233645][T21537] __x64_sys_sendto+0xde/0x100 [ 1631.233671][T21537] do_syscall_64+0x166/0x520 [ 1631.233695][T21537] ? trace_irq_disable+0x3b/0x140 [ 1631.233714][T21537] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1631.233734][T21537] ? clear_bhb_loop+0x70/0xc0 [ 1631.233757][T21537] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1631.233776][T21537] RIP: 0033:0x7fa11255e98e [ 1631.233795][T21537] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1631.233811][T21537] RSP: 002b:00007fa11342de88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1631.233833][T21537] RAX: ffffffffffffffda RBX: 00007fa11342f6c0 RCX: 00007fa11255e98e [ 1631.233847][T21537] RDX: 0000000000000020 RSI: 00007fa11342e000 RDI: 0000000000000003 [ 1631.233860][T21537] RBP: 0000000000000000 R08: 00007fa11342df04 R09: 000000000000000c [ 1631.233872][T21537] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 1631.233883][T21537] R13: 00007fa11342df58 R14: 00007fa11342e000 R15: 0000000000000000 [ 1631.233912][T21537] [ 1631.867016][T21557] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14636'. [ 1632.071548][T21563] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1632.860003][T21588] netlink: 72 bytes leftover after parsing attributes in process `syz.4.14647'. [ 1632.894809][T21588] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14647'. [ 1633.028818][T21596] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14648'. [ 1633.028882][T21596] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14648'. [ 1633.028897][T21596] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14648'. [ 1633.240411][T21602] FAULT_INJECTION: forcing a failure. [ 1633.240411][T21602] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1633.240444][T21602] CPU: 0 UID: 0 PID: 21602 Comm: syz.0.14652 Not tainted syzkaller #0 PREEMPT(full) [ 1633.240465][T21602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1633.240476][T21602] Call Trace: [ 1633.240483][T21602] [ 1633.240491][T21602] dump_stack_lvl+0xe8/0x150 [ 1633.240522][T21602] should_fail_ex+0x410/0x560 [ 1633.240550][T21602] _copy_to_user+0x31/0xb0 [ 1633.240576][T21602] __htab_map_lookup_and_delete_batch+0x14f9/0x1a00 [ 1633.240631][T21602] ? __pfx___htab_map_lookup_and_delete_batch+0x10/0x10 [ 1633.240660][T21602] ? __pfx_htab_percpu_map_lookup_batch+0x10/0x10 [ 1633.240688][T21602] bpf_map_do_batch+0x27f/0x630 [ 1633.240711][T21602] ? bpf_lsm_bpf+0x9/0x20 [ 1633.240736][T21602] ? security_bpf+0x7e/0x2d0 [ 1633.240760][T21602] __sys_bpf+0xa9f/0xd90 [ 1633.240788][T21602] ? __pfx___sys_bpf+0x10/0x10 [ 1633.240820][T21602] ? __fget_files+0x2a/0x420 [ 1633.240862][T21602] ? ksys_write+0x242/0x270 [ 1633.240891][T21602] ? __pfx_ksys_write+0x10/0x10 [ 1633.240927][T21602] __x64_sys_bpf+0xba/0xd0 [ 1633.240949][T21602] do_syscall_64+0x166/0x520 [ 1633.240980][T21602] ? trace_irq_disable+0x3b/0x140 [ 1633.240999][T21602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1633.241019][T21602] ? clear_bhb_loop+0x70/0xc0 [ 1633.241042][T21602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1633.241061][T21602] RIP: 0033:0x7f04def9e159 [ 1633.241085][T21602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1633.241101][T21602] RSP: 002b:00007f04dfddf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1633.241122][T21602] RAX: ffffffffffffffda RBX: 00007f04df225fa0 RCX: 00007f04def9e159 [ 1633.241135][T21602] RDX: 0000000000000038 RSI: 00002000000003c0 RDI: 0000000000000018 [ 1633.241147][T21602] RBP: 00007f04dfddf090 R08: 0000000000000000 R09: 0000000000000000 [ 1633.241159][T21602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1633.241171][T21602] R13: 00007f04df226038 R14: 00007f04df225fa0 R15: 00007fff04334698 [ 1633.241203][T21602] [ 1634.129842][T21642] FAULT_INJECTION: forcing a failure. [ 1634.129842][T21642] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1634.129875][T21642] CPU: 1 UID: 0 PID: 21642 Comm: syz.2.14667 Not tainted syzkaller #0 PREEMPT(full) [ 1634.129896][T21642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1634.129908][T21642] Call Trace: [ 1634.129915][T21642] [ 1634.129924][T21642] dump_stack_lvl+0xe8/0x150 [ 1634.129957][T21642] should_fail_ex+0x410/0x560 [ 1634.129984][T21642] _copy_from_user+0x2d/0xb0 [ 1634.130010][T21642] ___sys_sendmsg+0x1c6/0x360 [ 1634.130036][T21642] ? __lock_acquire+0x747/0x2de0 [ 1634.130060][T21642] ? __pfx____sys_sendmsg+0x10/0x10 [ 1634.130121][T21642] ? __fget_files+0x2a/0x420 [ 1634.130156][T21642] ? __fget_files+0x3a2/0x420 [ 1634.130191][T21642] __x64_sys_sendmsg+0x1b1/0x290 [ 1634.130219][T21642] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1634.130268][T21642] do_syscall_64+0x166/0x520 [ 1634.130294][T21642] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1634.130313][T21642] ? clear_bhb_loop+0x70/0xc0 [ 1634.130337][T21642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1634.130355][T21642] RIP: 0033:0x7fa11259e159 [ 1634.130372][T21642] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1634.130388][T21642] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1634.130409][T21642] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1634.130423][T21642] RDX: 00000000040c0080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1634.130436][T21642] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1634.130448][T21642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1634.130459][T21642] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1634.130490][T21642] [ 1634.563595][T21661] __nla_validate_parse: 5 callbacks suppressed [ 1634.563614][T21661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14673'. [ 1634.599739][T21665] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14677'. [ 1634.603688][T21661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14673'. [ 1634.670391][T21669] openvswitch: netlink: Message has 8 unknown bytes. [ 1634.764999][T21676] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14677'. [ 1634.875297][T21663] ip6gretap0: left promiscuous mode [ 1634.892199][T21663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1634.894644][T21663] 8021q: adding VLAN 0 to HW filter on device team0 [ 1634.895385][T21663] dummy0: left promiscuous mode [ 1634.921127][T21663] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1634.988867][T21663] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1634.991554][T21663] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1635.006090][T21663] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1635.019150][T21683] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14679'. [ 1635.058480][ T9434] bridge0: port 1(bridge_slave_0) entered blocking state [ 1635.058615][ T9434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1635.077983][ T9434] bridge0: port 2(bridge_slave_1) entered blocking state [ 1635.078085][ T9434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1635.325850][T21689] netlink: zone id is out of range [ 1635.325865][T21689] netlink: zone id is out of range [ 1635.328098][T21689] netlink: zone id is out of range [ 1635.328110][T21689] netlink: zone id is out of range [ 1635.328118][T21689] netlink: zone id is out of range [ 1635.328126][T21689] netlink: zone id is out of range [ 1635.328134][T21689] netlink: zone id is out of range [ 1635.373367][T21690] netlink: 964 bytes leftover after parsing attributes in process `syz.3.14682'. [ 1635.493485][ C0] vcan0: j1939_tp_rxtimer: 0xffff888031c94400: rx timeout, send abort [ 1635.497834][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888031c94400: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 1635.604429][T21698] bridge_slave_0: left allmulticast mode [ 1635.604454][T21698] bridge_slave_0: left promiscuous mode [ 1635.604694][T21698] bridge0: port 1(bridge_slave_0) entered disabled state [ 1635.661917][T21698] bridge_slave_1: left allmulticast mode [ 1635.661943][T21698] bridge_slave_1: left promiscuous mode [ 1635.662131][T21698] bridge0: port 2(bridge_slave_1) entered disabled state [ 1635.700805][T21698] vlan3: left promiscuous mode [ 1635.700826][T21698] geneve0: left promiscuous mode [ 1635.725919][T21698] bond0: (slave bond_slave_0): Releasing backup interface [ 1635.729625][T21698] bond_slave_0: left allmulticast mode [ 1635.767162][T21698] bond0: (slave bond_slave_1): Releasing backup interface [ 1635.798330][T21698] bond_slave_1: left allmulticast mode [ 1635.816399][T21698] team_slave_0: left allmulticast mode [ 1635.838030][T21698] team0: Port device team_slave_0 removed [ 1635.840223][T21698] team_slave_1: left allmulticast mode [ 1635.873603][T21710] set match dimension is over the limit! [ 1635.890813][T21698] team0: Port device team_slave_1 removed [ 1635.893998][T21698] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1635.894019][T21698] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1635.903501][T21698] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1635.903520][T21698] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1635.964711][T21699] team0: Mode changed to "loadbalance" [ 1635.968139][T21701] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14684'. [ 1635.968159][T21701] netlink: 64 bytes leftover after parsing attributes in process `syz.1.14684'. [ 1635.968172][T21701] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14684'. [ 1636.279299][T21719] netlink: 964 bytes leftover after parsing attributes in process `syz.3.14693'. [ 1637.164655][T21751] net_ratelimit: 17 callbacks suppressed [ 1637.164674][T21751] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1637.199550][T21753] openvswitch: netlink: Tunnel attr 10 has unexpected len 0 expected 2 [ 1637.234527][T21750] pim6reg: entered allmulticast mode [ 1637.694713][T21776] netlink: 'syz.0.14712': attribute type 11 has an invalid length. [ 1638.164626][T21793] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1638.334831][T21804] block nbd0: reconnected socket [ 1638.334850][T21804] nbd: socks must be embedded in a SOCK_ITEM attr [ 1638.341970][ T5629] block nbd0: Receive control failed (result -32) [ 1639.308275][T21838] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1639.736864][T21858] __nla_validate_parse: 12 callbacks suppressed [ 1639.736886][T21858] netlink: 48 bytes leftover after parsing attributes in process `syz.3.14741'. [ 1639.901715][T21861] netlink: 12 bytes leftover after parsing attributes in process `syz.4.14742'. [ 1639.993482][T21865] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14743'. [ 1640.054617][T21869] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14744'. [ 1640.500628][T21882] netlink: 964 bytes leftover after parsing attributes in process `syz.4.14749'. [ 1640.500652][T21882] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1640.709627][T21886] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14750'. [ 1640.714737][T21886] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14750'. [ 1640.739755][T21886] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14750'. [ 1640.744655][T21886] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14750'. [ 1640.751336][T21886] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14750'. [ 1641.298921][T21917] netlink: 'syz.1.14760': attribute type 16 has an invalid length. [ 1641.298944][T21917] netlink: 'syz.1.14760': attribute type 3 has an invalid length. [ 1641.312370][T21917] xt_socket: unknown flags 0x8 [ 1641.314108][T21920] FAULT_INJECTION: forcing a failure. [ 1641.314108][T21920] name failslab, interval 1, probability 0, space 0, times 0 [ 1641.314136][T21920] CPU: 1 UID: 0 PID: 21920 Comm: syz.0.14761 Not tainted syzkaller #0 PREEMPT(full) [ 1641.314157][T21920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1641.314169][T21920] Call Trace: [ 1641.314176][T21920] [ 1641.314184][T21920] dump_stack_lvl+0xe8/0x150 [ 1641.314215][T21920] should_fail_ex+0x410/0x560 [ 1641.314241][T21920] should_failslab+0xa8/0x100 [ 1641.314270][T21920] __kvmalloc_node_noprof+0x176/0x820 [ 1641.314292][T21920] ? __kvmalloc_node_noprof+0x345/0x820 [ 1641.314312][T21920] ? bpf_compute_scc+0xec/0xb10 [ 1641.314329][T21920] ? bpf_compute_scc+0xec/0xb10 [ 1641.314353][T21920] bpf_compute_scc+0xec/0xb10 [ 1641.314383][T21920] bpf_check+0x2720/0x2ef0 [ 1641.314420][T21920] ? __pfx_bpf_check+0x10/0x10 [ 1641.314443][T21920] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1641.314472][T21920] bpf_prog_load+0x14d6/0x1c20 [ 1641.314504][T21920] ? __pfx_bpf_prog_load+0x10/0x10 [ 1641.314549][T21920] __sys_bpf+0xd0d/0xd90 [ 1641.314577][T21920] ? __pfx___sys_bpf+0x10/0x10 [ 1641.314607][T21920] ? __fget_files+0x2a/0x420 [ 1641.314648][T21920] ? ksys_write+0x242/0x270 [ 1641.314678][T21920] ? __pfx_ksys_write+0x10/0x10 [ 1641.314708][T21920] __x64_sys_bpf+0xba/0xd0 [ 1641.314730][T21920] do_syscall_64+0x166/0x520 [ 1641.314754][T21920] ? trace_irq_disable+0x3b/0x140 [ 1641.314773][T21920] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1641.314791][T21920] ? clear_bhb_loop+0x70/0xc0 [ 1641.314813][T21920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1641.314831][T21920] RIP: 0033:0x7f04def9e159 [ 1641.314849][T21920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1641.314870][T21920] RSP: 002b:00007f04dfddf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1641.314891][T21920] RAX: ffffffffffffffda RBX: 00007f04df225fa0 RCX: 00007f04def9e159 [ 1641.314905][T21920] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1641.314917][T21920] RBP: 00007f04dfddf090 R08: 0000000000000000 R09: 0000000000000000 [ 1641.314928][T21920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1641.314940][T21920] R13: 00007f04df226038 R14: 00007f04df225fa0 R15: 00007fff04334698 [ 1641.314970][T21920] [ 1641.746014][T21926] ipt_ECN: cannot use operation on non-tcp rule [ 1643.501427][T22004] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1643.792369][T22015] ip_tables: iptables: counters copy to user failed while replacing table [ 1643.955097][T22017] netlink: 'syz.0.14797': attribute type 1 has an invalid length. [ 1644.044283][T22017] bond5: option mode: invalid value (7) [ 1644.058729][T22017] bond5 (unregistering): Released all slaves [ 1644.140906][T22037] netlink: 'syz.0.14797': attribute type 10 has an invalid length. [ 1644.333117][T22037] dummy0: entered promiscuous mode [ 1644.344379][T22039] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1644.365340][T22045] gre2: entered promiscuous mode [ 1644.365361][T22045] gre2: entered allmulticast mode [ 1644.752851][T22063] __nla_validate_parse: 45 callbacks suppressed [ 1644.752865][T22063] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14810'. [ 1645.224203][T22077] openvswitch: netlink: Message has 12 unknown bytes. [ 1645.259215][T22074] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14815'. [ 1645.357016][T22084] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14819'. [ 1645.357038][T22084] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14819'. [ 1645.379118][T22084] netlink: 20 bytes leftover after parsing attributes in process `syz.0.14819'. [ 1645.394355][T22071] wg2 speed is unknown, defaulting to 1000 [ 1645.451147][T22088] FAULT_INJECTION: forcing a failure. [ 1645.451147][T22088] name failslab, interval 1, probability 0, space 0, times 0 [ 1645.451179][T22088] CPU: 1 UID: 0 PID: 22088 Comm: syz.0.14821 Not tainted syzkaller #0 PREEMPT(full) [ 1645.451200][T22088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1645.451212][T22088] Call Trace: [ 1645.451219][T22088] [ 1645.451228][T22088] dump_stack_lvl+0xe8/0x150 [ 1645.451261][T22088] should_fail_ex+0x410/0x560 [ 1645.451288][T22088] should_failslab+0xa8/0x100 [ 1645.451313][T22088] __kvmalloc_node_noprof+0x176/0x820 [ 1645.451339][T22088] ? bpf_compute_scc+0xb8/0xb10 [ 1645.451357][T22088] ? bpf_compute_scc+0xb8/0xb10 [ 1645.451381][T22088] bpf_compute_scc+0xb8/0xb10 [ 1645.451421][T22088] bpf_check+0x2720/0x2ef0 [ 1645.451459][T22088] ? __pfx_bpf_check+0x10/0x10 [ 1645.451482][T22088] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1645.451511][T22088] bpf_prog_load+0x14d6/0x1c20 [ 1645.451543][T22088] ? __pfx_bpf_prog_load+0x10/0x10 [ 1645.451592][T22088] __sys_bpf+0xd0d/0xd90 [ 1645.451621][T22088] ? __pfx___sys_bpf+0x10/0x10 [ 1645.451654][T22088] ? __fget_files+0x2a/0x420 [ 1645.451699][T22088] ? ksys_write+0x242/0x270 [ 1645.451729][T22088] ? __pfx_ksys_write+0x10/0x10 [ 1645.451762][T22088] __x64_sys_bpf+0xba/0xd0 [ 1645.451784][T22088] do_syscall_64+0x166/0x520 [ 1645.451809][T22088] ? trace_irq_disable+0x3b/0x140 [ 1645.451827][T22088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1645.451846][T22088] ? clear_bhb_loop+0x70/0xc0 [ 1645.451870][T22088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1645.451889][T22088] RIP: 0033:0x7f04def9e159 [ 1645.451907][T22088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1645.451923][T22088] RSP: 002b:00007f04dfddf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1645.451943][T22088] RAX: ffffffffffffffda RBX: 00007f04df225fa0 RCX: 00007f04def9e159 [ 1645.451963][T22088] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1645.451975][T22088] RBP: 00007f04dfddf090 R08: 0000000000000000 R09: 0000000000000000 [ 1645.451986][T22088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1645.451996][T22088] R13: 00007f04df226038 R14: 00007f04df225fa0 R15: 00007fff04334698 [ 1645.452025][T22088] [ 1645.945537][T22106] netlink: 9 bytes leftover after parsing attributes in process `syz.4.14826'. [ 1645.950494][T22106] 1·: renamed from c0· (while UP) [ 1645.970568][T22106] A link change request failed with some changes committed already. Interface c1· may have been left with an inconsistent configuration, please check. [ 1646.010226][T22110] x_tables: duplicate underflow at hook 3 [ 1646.232745][T22121] FAULT_INJECTION: forcing a failure. [ 1646.232745][T22121] name failslab, interval 1, probability 0, space 0, times 0 [ 1646.232777][T22121] CPU: 0 UID: 0 PID: 22121 Comm: syz.4.14833 Not tainted syzkaller #0 PREEMPT(full) [ 1646.232799][T22121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1646.232811][T22121] Call Trace: [ 1646.232819][T22121] [ 1646.232828][T22121] dump_stack_lvl+0xe8/0x150 [ 1646.232860][T22121] should_fail_ex+0x410/0x560 [ 1646.232887][T22121] should_failslab+0xa8/0x100 [ 1646.232920][T22121] __kmalloc_cache_noprof+0xa3/0x600 [ 1646.232941][T22121] ? do_check_common+0x26e/0x55c0 [ 1646.232964][T22121] ? do_check_common+0x26e/0x55c0 [ 1646.232995][T22121] do_check_common+0x26e/0x55c0 [ 1646.233037][T22121] ? bpf_compute_live_registers+0x1f40/0x1ff0 [ 1646.233059][T22121] ? bpf_insn_def32+0x1ae/0x650 [ 1646.233098][T22121] ? mark_fastcall_patterns+0xf32/0xf90 [ 1646.233123][T22121] ? __pfx_do_check_common+0x10/0x10 [ 1646.233161][T22121] do_check_main+0xa2/0x1f0 [ 1646.233185][T22121] bpf_check+0x2777/0x2ef0 [ 1646.233223][T22121] ? __pfx_bpf_check+0x10/0x10 [ 1646.233247][T22121] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1646.233278][T22121] bpf_prog_load+0x14d6/0x1c20 [ 1646.233313][T22121] ? __pfx_bpf_prog_load+0x10/0x10 [ 1646.233361][T22121] __sys_bpf+0xd0d/0xd90 [ 1646.233391][T22121] ? __pfx___sys_bpf+0x10/0x10 [ 1646.233425][T22121] ? __fget_files+0x2a/0x420 [ 1646.233469][T22121] ? ksys_write+0x242/0x270 [ 1646.233499][T22121] ? __pfx_ksys_write+0x10/0x10 [ 1646.233532][T22121] __x64_sys_bpf+0xba/0xd0 [ 1646.233555][T22121] do_syscall_64+0x166/0x520 [ 1646.233581][T22121] ? trace_irq_disable+0x3b/0x140 [ 1646.233600][T22121] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.233620][T22121] ? clear_bhb_loop+0x70/0xc0 [ 1646.233643][T22121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.233663][T22121] RIP: 0033:0x7fa5b9d9e159 [ 1646.233681][T22121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1646.233697][T22121] RSP: 002b:00007fa5b7ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1646.233718][T22121] RAX: ffffffffffffffda RBX: 00007fa5ba025fa0 RCX: 00007fa5b9d9e159 [ 1646.233732][T22121] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1646.233745][T22121] RBP: 00007fa5b7ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1646.233756][T22121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1646.233767][T22121] R13: 00007fa5ba026038 R14: 00007fa5ba025fa0 R15: 00007ffdcbb4a878 [ 1646.233799][T22121] [ 1646.279491][T22122] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14831'. [ 1646.279648][T22120] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14831'. [ 1647.025666][T22144] syz_tun: entered allmulticast mode [ 1647.110115][T22143] syz_tun: left allmulticast mode [ 1647.130642][T22149] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1647.691912][T22165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1647.693506][T22165] 8021q: adding VLAN 0 to HW filter on device team0 [ 1647.725124][T22174] sctp: [Deprecated]: syz.1.14850 (pid 22174) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1647.725124][T22174] Use struct sctp_sack_info instead [ 1647.726873][T22174] sctp: [Deprecated]: syz.1.14850 (pid 22174) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1647.726873][T22174] Use struct sctp_sack_info instead [ 1647.840251][T22165] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1648.103979][T22165] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1648.610826][T22204] syz_tun: entered allmulticast mode [ 1648.655267][T22208] FAULT_INJECTION: forcing a failure. [ 1648.655267][T22208] name failslab, interval 1, probability 0, space 0, times 0 [ 1648.655300][T22208] CPU: 1 UID: 0 PID: 22208 Comm: syz.1.14859 Not tainted syzkaller #0 PREEMPT(full) [ 1648.655321][T22208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1648.655333][T22208] Call Trace: [ 1648.655341][T22208] [ 1648.655350][T22208] dump_stack_lvl+0xe8/0x150 [ 1648.655383][T22208] should_fail_ex+0x410/0x560 [ 1648.655411][T22208] should_failslab+0xa8/0x100 [ 1648.655434][T22208] ? skb_clone+0x212/0x3a0 [ 1648.655462][T22208] kmem_cache_alloc_noprof+0xa1/0x600 [ 1648.655493][T22208] ? skb_clone+0x212/0x3a0 [ 1648.655526][T22208] skb_clone+0x212/0x3a0 [ 1648.655556][T22208] __netlink_deliver_tap+0x355/0x6e0 [ 1648.655586][T22208] ? netlink_deliver_tap+0x2e/0x1b0 [ 1648.655606][T22208] netlink_deliver_tap+0x19c/0x1b0 [ 1648.655626][T22208] netlink_sendskb+0x68/0x140 [ 1648.655655][T22208] netlink_rcv_skb+0x2a4/0x4a0 [ 1648.655675][T22208] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1648.655703][T22208] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1648.655736][T22208] ? netlink_deliver_tap+0x2e/0x1b0 [ 1648.655754][T22208] ? netlink_deliver_tap+0x2e/0x1b0 [ 1648.655786][T22208] netlink_unicast+0x7bd/0x940 [ 1648.655824][T22208] netlink_sendmsg+0x813/0xb40 [ 1648.655853][T22208] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1648.655881][T22208] ? apparmor_socket_sendmsg+0x98/0x360 [ 1648.655905][T22208] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1648.655924][T22208] sock_sendmsg_nosec+0x13a/0x180 [ 1648.655948][T22208] ____sys_sendmsg+0x54e/0x850 [ 1648.655980][T22208] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1648.656015][T22208] ? import_iovec+0x73/0xa0 [ 1648.656043][T22208] ___sys_sendmsg+0x2a5/0x360 [ 1648.656068][T22208] ? __lock_acquire+0x747/0x2de0 [ 1648.656092][T22208] ? __pfx____sys_sendmsg+0x10/0x10 [ 1648.656157][T22208] ? __fget_files+0x2a/0x420 [ 1648.656181][T22208] ? __fget_files+0x3a2/0x420 [ 1648.656217][T22208] __x64_sys_sendmsg+0x1b1/0x290 [ 1648.656247][T22208] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1648.656294][T22208] do_syscall_64+0x166/0x520 [ 1648.656320][T22208] ? trace_irq_disable+0x3b/0x140 [ 1648.656339][T22208] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1648.656358][T22208] ? clear_bhb_loop+0x70/0xc0 [ 1648.656382][T22208] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1648.656401][T22208] RIP: 0033:0x7f336cd9e159 [ 1648.656419][T22208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1648.656434][T22208] RSP: 002b:00007f336db96028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1648.656454][T22208] RAX: ffffffffffffffda RBX: 00007f336d025fa0 RCX: 00007f336cd9e159 [ 1648.656469][T22208] RDX: 0000000000004000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1648.656481][T22208] RBP: 00007f336db96090 R08: 0000000000000000 R09: 0000000000000000 [ 1648.656493][T22208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1648.656504][T22208] R13: 00007f336d026038 R14: 00007f336d025fa0 R15: 00007fff2a9622b8 [ 1648.656536][T22208] [ 1649.150621][T22203] syz_tun: left allmulticast mode [ 1653.969487][T22245] mac80211_hwsim hwsim139 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1654.335096][T22281] ipt_ECN: cannot use operation on non-tcp rule [ 1654.476070][T22287] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14884'. [ 1654.533310][T22292] FAULT_INJECTION: forcing a failure. [ 1654.533310][T22292] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1654.533341][T22292] CPU: 1 UID: 0 PID: 22292 Comm: syz.3.14882 Not tainted syzkaller #0 PREEMPT(full) [ 1654.533363][T22292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1654.533374][T22292] Call Trace: [ 1654.533383][T22292] [ 1654.533392][T22292] dump_stack_lvl+0xe8/0x150 [ 1654.533424][T22292] should_fail_ex+0x410/0x560 [ 1654.533452][T22292] _copy_to_user+0x31/0xb0 [ 1654.533480][T22292] simple_read_from_buffer+0xe1/0x170 [ 1654.533511][T22292] proc_fail_nth_read+0x1bb/0x230 [ 1654.533529][T22292] ? common_file_perm+0x20e/0x2b0 [ 1654.533554][T22292] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1654.533576][T22292] ? rw_verify_area+0x24a/0x4c0 [ 1654.533604][T22292] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1654.533622][T22292] vfs_read+0x213/0xa80 [ 1654.533653][T22292] ? __pfx___mutex_lock+0x10/0x10 [ 1654.533681][T22292] ? __pfx_vfs_read+0x10/0x10 [ 1654.533708][T22292] ? __fget_files+0x2a/0x420 [ 1654.533739][T22292] ? __fget_files+0x3a2/0x420 [ 1654.533763][T22292] ? __fget_files+0x2a/0x420 [ 1654.533795][T22292] ksys_read+0x150/0x270 [ 1654.533824][T22292] ? __pfx_ksys_read+0x10/0x10 [ 1654.533849][T22292] ? __pfx_sock_ioctl+0x10/0x10 [ 1654.533879][T22292] do_syscall_64+0x166/0x520 [ 1654.533902][T22292] ? trace_irq_disable+0x3b/0x140 [ 1654.533921][T22292] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1654.533940][T22292] ? clear_bhb_loop+0x70/0xc0 [ 1654.533962][T22292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1654.533981][T22292] RIP: 0033:0x7ff413d5e98e [ 1654.533998][T22292] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1654.534015][T22292] RSP: 002b:00007ff411ff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1654.534035][T22292] RAX: ffffffffffffffda RBX: 00007ff411ff66c0 RCX: 00007ff413d5e98e [ 1654.534049][T22292] RDX: 000000000000000f RSI: 00007ff411ff60a0 RDI: 0000000000000003 [ 1654.534062][T22292] RBP: 00007ff411ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1654.534073][T22292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1654.534085][T22292] R13: 00007ff414026038 R14: 00007ff414025fa0 R15: 00007fff0942d268 [ 1654.534116][T22292] [ 1655.131115][T22314] FAULT_INJECTION: forcing a failure. [ 1655.131115][T22314] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1655.131146][T22314] CPU: 1 UID: 0 PID: 22314 Comm: syz.4.14889 Not tainted syzkaller #0 PREEMPT(full) [ 1655.131166][T22314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1655.131177][T22314] Call Trace: [ 1655.131185][T22314] [ 1655.131193][T22314] dump_stack_lvl+0xe8/0x150 [ 1655.131225][T22314] should_fail_ex+0x410/0x560 [ 1655.131253][T22314] _copy_to_user+0x31/0xb0 [ 1655.131281][T22314] __htab_map_lookup_and_delete_batch+0x14f9/0x1a00 [ 1655.131344][T22314] ? __pfx___htab_map_lookup_and_delete_batch+0x10/0x10 [ 1655.131374][T22314] ? __pfx_htab_percpu_map_lookup_batch+0x10/0x10 [ 1655.131403][T22314] bpf_map_do_batch+0x27f/0x630 [ 1655.131427][T22314] ? bpf_lsm_bpf+0x9/0x20 [ 1655.131452][T22314] ? security_bpf+0x7e/0x2d0 [ 1655.131477][T22314] __sys_bpf+0xa9f/0xd90 [ 1655.131508][T22314] ? __pfx___sys_bpf+0x10/0x10 [ 1655.131541][T22314] ? __fget_files+0x2a/0x420 [ 1655.131585][T22314] ? ksys_write+0x242/0x270 [ 1655.131615][T22314] ? __pfx_ksys_write+0x10/0x10 [ 1655.131648][T22314] __x64_sys_bpf+0xba/0xd0 [ 1655.131670][T22314] do_syscall_64+0x166/0x520 [ 1655.131695][T22314] ? trace_irq_disable+0x3b/0x140 [ 1655.131720][T22314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1655.131740][T22314] ? clear_bhb_loop+0x70/0xc0 [ 1655.131764][T22314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1655.131783][T22314] RIP: 0033:0x7fa5b9d9e159 [ 1655.131801][T22314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1655.131817][T22314] RSP: 002b:00007fa5b7fd5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1655.131838][T22314] RAX: ffffffffffffffda RBX: 00007fa5ba026090 RCX: 00007fa5b9d9e159 [ 1655.131853][T22314] RDX: 0000000000000038 RSI: 00002000000003c0 RDI: 0000000000000018 [ 1655.131865][T22314] RBP: 00007fa5b7fd5090 R08: 0000000000000000 R09: 0000000000000000 [ 1655.131878][T22314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1655.131889][T22314] R13: 00007fa5ba026128 R14: 00007fa5ba026090 R15: 00007ffdcbb4a878 [ 1655.131922][T22314] [ 1655.501117][T22324] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14893'. [ 1655.519076][T22326] netlink: 20 bytes leftover after parsing attributes in process `syz.0.14895'. [ 1655.519102][T22326] openvswitch: netlink: Invalid VLAN frame [ 1655.616156][T22329] Unsupported ieee802154 address type: 0 [ 1655.619042][T22329] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14896'. [ 1659.506289][T22340] netlink: 'syz.3.14900': attribute type 10 has an invalid length. [ 1659.615584][T22340] team0 (unregistering): Port device team_slave_0 removed [ 1659.629004][T22340] team0 (unregistering): Port device team_slave_1 removed [ 1659.979415][T22359] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14906'. [ 1660.029535][T22346] bridge0: port 3(team0) entered disabled state [ 1660.030351][T22346] bridge0: port 2(bridge_slave_1) entered disabled state [ 1660.030810][T22346] bridge0: port 1(bridge_slave_0) entered disabled state [ 1660.222218][T22374] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14907'. [ 1660.222242][T22374] openvswitch: netlink: Flow key attribute not present in set flow. [ 1660.458862][T22383] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14911'. [ 1660.640852][T22346] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1660.683392][T22346] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1661.078325][T26099] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 1661.078359][T26099] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1661.078398][T26099] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 1661.078421][T26099] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1661.078455][T26099] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 1661.078478][T26099] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 1661.423926][T22398] netlink: 'syz.2.14916': attribute type 1 has an invalid length. [ 1661.573265][T22398] bond7: option mode: invalid value (7) [ 1661.575823][T22398] bond7 (unregistering): Released all slaves [ 1661.610679][T22408] netlink: 'syz.2.14916': attribute type 10 has an invalid length. [ 1661.610700][T22408] netlink: 40 bytes leftover after parsing attributes in process `syz.2.14916'. [ 1662.526652][T22420] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14921'. [ 1662.726593][T22428] netlink: 9 bytes leftover after parsing attributes in process `syz.0.14920'. [ 1666.234449][T22408] dummy0: entered promiscuous mode [ 1666.239090][T22428] 0·: renamed from c1· (while UP) [ 1666.263117][T22428] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1666.599264][T22435] syzkaller0: entered promiscuous mode [ 1666.599285][T22435] syzkaller0: entered allmulticast mode [ 1666.636270][T22448] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14926'. [ 1666.636333][T22448] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14926'. [ 1666.856651][T22453] netlink: 128 bytes leftover after parsing attributes in process `syz.3.14928'. [ 1666.873753][T22455] netlink: 16 bytes leftover after parsing attributes in process `syz.4.14927'. [ 1666.873815][T22455] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14927'. [ 1666.873830][T22455] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14927'. [ 1666.873893][T22455] netlink: 108 bytes leftover after parsing attributes in process `syz.4.14927'. [ 1666.873907][T22455] netlink: 16 bytes leftover after parsing attributes in process `syz.4.14927'. [ 1667.167914][T22461] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14931'. [ 1667.198938][T22462] netlink: 'syz.2.14929': attribute type 2 has an invalid length. [ 1667.358632][T22466] macvtap0: entered promiscuous mode [ 1667.358813][T22466] macvtap0: entered allmulticast mode [ 1667.358827][T22466] veth0_macvtap: entered allmulticast mode [ 1667.386568][T22466] netlink: 108 bytes leftover after parsing attributes in process `syz.3.14932'. [ 1667.800646][T22478] netlink: 'syz.1.14938': attribute type 23 has an invalid length. [ 1667.800674][T22478] netlink: 'syz.1.14938': attribute type 11 has an invalid length. [ 1667.803860][T22475] bond8: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1667.876274][T22475] bond8 (unregistering): Released all slaves [ 1667.943630][T22481] xt_recent: hitcount (268435462) is larger than allowed maximum (65535) [ 1672.382933][T22490] __nla_validate_parse: 1 callbacks suppressed [ 1672.382951][T22490] netlink: 148 bytes leftover after parsing attributes in process `syz.4.14940'. [ 1672.638715][T22508] FAULT_INJECTION: forcing a failure. [ 1672.638715][T22508] name failslab, interval 1, probability 0, space 0, times 0 [ 1672.638747][T22508] CPU: 0 UID: 0 PID: 22508 Comm: syz.2.14946 Not tainted syzkaller #0 PREEMPT(full) [ 1672.638768][T22508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1672.638779][T22508] Call Trace: [ 1672.638787][T22508] [ 1672.638796][T22508] dump_stack_lvl+0xe8/0x150 [ 1672.638828][T22508] should_fail_ex+0x410/0x560 [ 1672.638858][T22508] should_failslab+0xa8/0x100 [ 1672.638885][T22508] __kvmalloc_node_noprof+0x176/0x820 [ 1672.638909][T22508] ? __kvmalloc_node_noprof+0x345/0x820 [ 1672.638928][T22508] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 1672.638950][T22508] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 1672.638986][T22508] bpf_compute_subprog_arg_access+0x187/0x14d0 [ 1672.639008][T22508] ? bpf_base_func_proto+0x67c/0xb00 [ 1672.639031][T22508] ? __pfx_tc_cls_act_func_proto+0x10/0x10 [ 1672.639075][T22508] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1672.639101][T22508] ? __kvmalloc_node_noprof+0x345/0x820 [ 1672.639119][T22508] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1672.639138][T22508] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1672.639166][T22508] bpf_compute_live_registers+0x8d3/0x1ff0 [ 1672.639208][T22508] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1672.639238][T22508] bpf_check+0x2746/0x2ef0 [ 1672.639273][T22508] ? __pfx_bpf_check+0x10/0x10 [ 1672.639295][T22508] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1672.639325][T22508] bpf_prog_load+0x14d6/0x1c20 [ 1672.639360][T22508] ? __pfx_bpf_prog_load+0x10/0x10 [ 1672.639408][T22508] __sys_bpf+0xd0d/0xd90 [ 1672.639437][T22508] ? __pfx___sys_bpf+0x10/0x10 [ 1672.639469][T22508] ? __fget_files+0x2a/0x420 [ 1672.639516][T22508] ? rcu_is_watching+0x16/0xb0 [ 1672.639544][T22508] __x64_sys_bpf+0xba/0xd0 [ 1672.639566][T22508] do_syscall_64+0x166/0x520 [ 1672.639591][T22508] ? trace_irq_disable+0x3b/0x140 [ 1672.639610][T22508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.639629][T22508] ? clear_bhb_loop+0x70/0xc0 [ 1672.639651][T22508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.639670][T22508] RIP: 0033:0x7fa11259e159 [ 1672.639689][T22508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1672.639705][T22508] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1672.639726][T22508] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1672.639740][T22508] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 1672.639752][T22508] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1672.639764][T22508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1672.639775][T22508] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1672.639806][T22508] [ 1672.808622][T22513] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1672.808691][T22513] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1673.160352][T22521] netlink: 52 bytes leftover after parsing attributes in process `syz.2.14953'. [ 1673.195131][T22530] netlink: 52 bytes leftover after parsing attributes in process `syz.4.14955'. [ 1673.274795][T22531] netlink: 52 bytes leftover after parsing attributes in process `syz.4.14955'. [ 1673.294177][T22532] syzkaller0: create flow: hash 3507406202 index 2 [ 1673.576285][T22538] netlink: 1004 bytes leftover after parsing attributes in process `syz.0.14957'. [ 1673.915302][T22532] syzkaller0: delete flow: hash 3507406202 index 2 [ 1673.936098][ T9434] syzkaller0: tun_net_xmit 76 [ 1673.936455][ T9434] syzkaller0: tun_net_xmit 48 [ 1674.172551][T22546] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14960'. [ 1674.583467][T22559] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1678.392339][T22544] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1678.401189][T22544] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1678.502101][T22544] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1678.507912][T22544] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1678.538466][T22544] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1678.538490][T22544] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1678.541348][T22544] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1678.639398][T26099] bridge0: port 1(bridge_slave_0) entered blocking state [ 1678.639498][T26099] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1678.641573][T26099] bridge0: port 2(bridge_slave_1) entered blocking state [ 1678.641671][T26099] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1678.762140][T22567] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1678.816540][T22567] bond7 (unregistering): Released all slaves [ 1679.003868][T22576] bond7 (unregistering): Released all slaves [ 1679.188069][T22587] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14967'. [ 1680.106216][T22602] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14973'. [ 1680.106279][T22602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14973'. [ 1680.106294][T22602] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14973'. [ 1680.106355][T22602] netlink: 108 bytes leftover after parsing attributes in process `syz.1.14973'. [ 1680.106368][T22602] netlink: 16 bytes leftover after parsing attributes in process `syz.1.14973'. [ 1683.917741][T22587] ipvlan2: entered allmulticast mode [ 1684.180659][T22612] netlink: 80 bytes leftover after parsing attributes in process `syz.3.14976'. [ 1684.180760][T22612] netlink: 80 bytes leftover after parsing attributes in process `syz.3.14976'. [ 1684.206462][T22614] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14975'. [ 1684.542681][T22621] bond7: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1684.635129][T22621] bond7 (unregistering): Released all slaves [ 1685.436149][T22643] FAULT_INJECTION: forcing a failure. [ 1685.436149][T22643] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1685.436180][T22643] CPU: 1 UID: 0 PID: 22643 Comm: syz.4.14983 Not tainted syzkaller #0 PREEMPT(full) [ 1685.436201][T22643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1685.436212][T22643] Call Trace: [ 1685.436220][T22643] [ 1685.436229][T22643] dump_stack_lvl+0xe8/0x150 [ 1685.436262][T22643] should_fail_ex+0x410/0x560 [ 1685.436290][T22643] _copy_from_iter+0x1d3/0x1660 [ 1685.436313][T22643] ? __alloc_skb+0x27a/0x7a0 [ 1685.436340][T22643] ? __alloc_skb+0x27a/0x7a0 [ 1685.436365][T22643] ? __alloc_skb+0x27a/0x7a0 [ 1685.436388][T22643] ? __pfx__copy_from_iter+0x10/0x10 [ 1685.436409][T22643] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1685.436437][T22643] ? __alloc_skb+0x27a/0x7a0 [ 1685.436458][T22643] ? __alloc_skb+0x27a/0x7a0 [ 1685.436488][T22643] ? netlink_sendmsg+0x650/0xb40 [ 1685.436507][T22643] ? skb_put+0x112/0x210 [ 1685.436535][T22643] netlink_sendmsg+0x6c0/0xb40 [ 1685.436564][T22643] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1685.436592][T22643] ? apparmor_socket_sendmsg+0x98/0x360 [ 1685.436617][T22643] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1685.436635][T22643] sock_sendmsg_nosec+0x13a/0x180 [ 1685.436660][T22643] ____sys_sendmsg+0x54e/0x850 [ 1685.436699][T22643] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1685.436735][T22643] ? import_iovec+0x73/0xa0 [ 1685.436763][T22643] ___sys_sendmsg+0x2a5/0x360 [ 1685.436788][T22643] ? __lock_acquire+0x747/0x2de0 [ 1685.436813][T22643] ? __pfx____sys_sendmsg+0x10/0x10 [ 1685.436875][T22643] ? __fget_files+0x2a/0x420 [ 1685.436900][T22643] ? __fget_files+0x3a2/0x420 [ 1685.436936][T22643] __x64_sys_sendmsg+0x1b1/0x290 [ 1685.436966][T22643] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1685.437014][T22643] do_syscall_64+0x166/0x520 [ 1685.437040][T22643] ? trace_irq_disable+0x3b/0x140 [ 1685.437059][T22643] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.437079][T22643] ? clear_bhb_loop+0x70/0xc0 [ 1685.437105][T22643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1685.437125][T22643] RIP: 0033:0x7fa5b9d9e159 [ 1685.437142][T22643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1685.437158][T22643] RSP: 002b:00007fa5b7ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1685.437177][T22643] RAX: ffffffffffffffda RBX: 00007fa5ba025fa0 RCX: 00007fa5b9d9e159 [ 1685.437188][T22643] RDX: 00000000040c0080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1685.437198][T22643] RBP: 00007fa5b7ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1685.437207][T22643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1685.437217][T22643] R13: 00007fa5ba026038 R14: 00007fa5ba025fa0 R15: 00007ffdcbb4a878 [ 1685.437248][T22643] [ 1686.288926][T22663] netlink: 'syz.2.14986': attribute type 10 has an invalid length. [ 1686.293562][T22663] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1686.308480][T22663] team0: Port device netdevsim1 added [ 1686.313304][T22663] netlink: 'syz.2.14986': attribute type 10 has an invalid length. [ 1686.432420][T22667] netlink: 'syz.1.14987': attribute type 12 has an invalid length. [ 1686.433418][T22665] wg2 speed is unknown, defaulting to 1000 [ 1686.531881][T22671] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14990'. [ 1686.658217][T22674] netlink: 20 bytes leftover after parsing attributes in process `syz.3.14991'. [ 1686.826329][T22674] FAULT_INJECTION: forcing a failure. [ 1686.826329][T22674] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1686.826360][T22674] CPU: 1 UID: 0 PID: 22674 Comm: syz.3.14991 Not tainted syzkaller #0 PREEMPT(full) [ 1686.826381][T22674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1686.826392][T22674] Call Trace: [ 1686.826400][T22674] [ 1686.826409][T22674] dump_stack_lvl+0xe8/0x150 [ 1686.826441][T22674] should_fail_ex+0x410/0x560 [ 1686.826469][T22674] _copy_from_user+0x2d/0xb0 [ 1686.826495][T22674] ___sys_recvmsg+0x173/0x5a0 [ 1686.826529][T22674] ? __pfx____sys_recvmsg+0x10/0x10 [ 1686.826561][T22674] ? lock_acquire+0x115/0x350 [ 1686.826609][T22674] do_recvmmsg+0x31a/0x7f0 [ 1686.826646][T22674] ? __pfx_do_recvmmsg+0x10/0x10 [ 1686.826685][T22674] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1686.826713][T22674] ? __fget_files+0x3a2/0x420 [ 1686.826749][T22674] __x64_sys_recvmmsg+0x198/0x250 [ 1686.826778][T22674] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1686.826818][T22674] do_syscall_64+0x166/0x520 [ 1686.826842][T22674] ? trace_irq_disable+0x3b/0x140 [ 1686.826861][T22674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1686.826880][T22674] ? clear_bhb_loop+0x70/0xc0 [ 1686.826903][T22674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1686.826921][T22674] RIP: 0033:0x7ff413d9e159 [ 1686.826937][T22674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1686.826951][T22674] RSP: 002b:00007ff411ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1686.826971][T22674] RAX: ffffffffffffffda RBX: 00007ff414025fa0 RCX: 00007ff413d9e159 [ 1686.826984][T22674] RDX: 0000000000001003 RSI: 00002000000048c0 RDI: 0000000000000003 [ 1686.826996][T22674] RBP: 00007ff411ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1686.827008][T22674] R10: 0000000000010122 R11: 0000000000000246 R12: 0000000000000002 [ 1686.827019][T22674] R13: 00007ff414026038 R14: 00007ff414025fa0 R15: 00007fff0942d268 [ 1686.827049][T22674] [ 1686.923207][T22684] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1686.933682][T22684] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1686.966537][T22690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1686.986439][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1686.996648][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.005191][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.030232][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.039982][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.065226][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.086171][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.104476][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.113079][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.130954][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.136889][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.148949][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.164889][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.176987][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.195633][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.205457][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.219286][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.239669][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.262097][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.280185][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.285710][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.306204][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.314050][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.320947][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.327763][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.378550][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.393601][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.402007][T22686] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1687.466464][T22701] netlink: 20 bytes leftover after parsing attributes in process `syz.4.14996'. [ 1687.805518][T22708] netlink: 964 bytes leftover after parsing attributes in process `syz.3.14998'. [ 1687.805544][T22708] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 1688.790681][T22739] netlink: 44 bytes leftover after parsing attributes in process `syz.2.15006'. [ 1688.841165][T22742] gre0: entered promiscuous mode [ 1688.841189][T22742] gre0: entered allmulticast mode [ 1689.025603][T22750] netlink: 'syz.2.15011': attribute type 10 has an invalid length. [ 1689.135200][T22751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15013'. [ 1689.176223][T22750] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1689.186339][T22751] netlink: 'syz.1.15013': attribute type 10 has an invalid length. [ 1689.198394][T22751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1689.201102][T22751] netdevsim netdevsim1 netdevsim1: entered allmulticast mode [ 1689.207213][T22751] team0: Port device netdevsim1 added [ 1689.236889][T22751] netlink: 'syz.1.15013': attribute type 10 has an invalid length. [ 1689.681385][T22769] netlink: 'syz.3.15019': attribute type 1 has an invalid length. [ 1689.738204][T22769] bond5: option mode: invalid value (7) [ 1689.740507][T22769] bond5 (unregistering): Released all slaves [ 1689.910350][T22777] netlink: 'syz.3.15019': attribute type 10 has an invalid length. [ 1689.910372][T22777] netlink: 40 bytes leftover after parsing attributes in process `syz.3.15019'. [ 1689.980799][T22775] bond4: (slave dummy0): Releasing active interface [ 1689.997404][T22777] dummy0: entered promiscuous mode [ 1690.021309][T22780] netlink: 24 bytes leftover after parsing attributes in process `syz.1.15022'. [ 1690.125710][T22787] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15022'. [ 1690.166458][T22790] netlink: 976 bytes leftover after parsing attributes in process `syz.3.15025'. [ 1690.166480][T22790] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1690.363227][T22797] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15026'. [ 1690.402545][T22799] netlink: 80 bytes leftover after parsing attributes in process `syz.1.15028'. [ 1690.783052][T22809] netlink: 'syz.4.15033': attribute type 1 has an invalid length. [ 1690.940892][T22809] bond8: entered promiscuous mode [ 1690.941322][T22809] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1691.032561][T22817] vlan6: entered allmulticast mode [ 1691.032580][T22817] bond8: entered allmulticast mode [ 1691.176227][T22809] bond8: (slave bridge7): making interface the new active one [ 1691.176254][T22809] bridge7: entered promiscuous mode [ 1691.176485][T22809] bridge7: entered allmulticast mode [ 1691.199260][T22809] bond8: (slave bridge7): Enslaving as an active interface with an up link [ 1691.554359][T22845] batman_adv: batadv0: Adding interface: macvtap0 [ 1691.554378][T22845] batman_adv: batadv0: The MTU of interface macvtap0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1691.554402][T22845] batman_adv: batadv0: Not using interface macvtap0 (retrying later): interface not active [ 1691.709186][T22848] batman_adv: batadv0: Removing interface: macvtap0 [ 1692.906116][T22874] netlink: 'syz.2.15052': attribute type 4 has an invalid length. [ 1692.906223][T22876] netlink: 'syz.2.15052': attribute type 4 has an invalid length. [ 1696.416244][T22853] batman_adv: batadv0: Adding interface: syzkaller0 [ 1696.416262][T22853] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1696.416552][T22853] batman_adv: batadv0: Interface activated: syzkaller0 [ 1696.427113][T22843] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 1696.549994][T22843] batman_adv: batadv0: Removing interface: syzkaller0 [ 1696.571520][T22870] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1696.960979][T22893] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1697.573700][T22922] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1701.785190][T22891] syzkaller1: entered promiscuous mode [ 1701.785213][T22891] syzkaller1: entered allmulticast mode [ 1701.786704][T22930] gre0: left promiscuous mode [ 1701.786724][T22930] gre0: left allmulticast mode [ 1701.802964][T22930] netlink: 976 bytes leftover after parsing attributes in process `syz.1.15062'. [ 1701.802987][T22930] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1702.068823][T22944] FAULT_INJECTION: forcing a failure. [ 1702.068823][T22944] name failslab, interval 1, probability 0, space 0, times 0 [ 1702.068851][T22944] CPU: 0 UID: 0 PID: 22944 Comm: syz.2.15066 Not tainted syzkaller #0 PREEMPT(full) [ 1702.068870][T22944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1702.068881][T22944] Call Trace: [ 1702.068888][T22944] [ 1702.068897][T22944] dump_stack_lvl+0xe8/0x150 [ 1702.068929][T22944] should_fail_ex+0x410/0x560 [ 1702.068954][T22944] should_failslab+0xa8/0x100 [ 1702.068976][T22944] ? skb_clone+0x212/0x3a0 [ 1702.069003][T22944] kmem_cache_alloc_noprof+0xa1/0x600 [ 1702.069034][T22944] ? skb_clone+0x212/0x3a0 [ 1702.069065][T22944] skb_clone+0x212/0x3a0 [ 1702.069096][T22944] __netlink_deliver_tap+0x355/0x6e0 [ 1702.069129][T22944] ? netlink_deliver_tap+0x2e/0x1b0 [ 1702.069157][T22944] netlink_deliver_tap+0x19c/0x1b0 [ 1702.069179][T22944] netlink_unicast+0x781/0x940 [ 1702.069219][T22944] netlink_sendmsg+0x813/0xb40 [ 1702.069248][T22944] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1702.069277][T22944] ? apparmor_socket_sendmsg+0x98/0x360 [ 1702.069302][T22944] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1702.069321][T22944] sock_sendmsg_nosec+0x13a/0x180 [ 1702.069345][T22944] ____sys_sendmsg+0x54e/0x850 [ 1702.069377][T22944] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1702.069411][T22944] ? import_iovec+0x73/0xa0 [ 1702.069439][T22944] ___sys_sendmsg+0x2a5/0x360 [ 1702.069464][T22944] ? __lock_acquire+0x747/0x2de0 [ 1702.069489][T22944] ? __pfx____sys_sendmsg+0x10/0x10 [ 1702.069553][T22944] ? __fget_files+0x2a/0x420 [ 1702.069578][T22944] ? __fget_files+0x3a2/0x420 [ 1702.069614][T22944] __x64_sys_sendmsg+0x1b1/0x290 [ 1702.069643][T22944] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1702.069692][T22944] do_syscall_64+0x166/0x520 [ 1702.069717][T22944] ? trace_irq_disable+0x3b/0x140 [ 1702.069737][T22944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.069757][T22944] ? clear_bhb_loop+0x70/0xc0 [ 1702.069781][T22944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.069800][T22944] RIP: 0033:0x7fa11259e159 [ 1702.069818][T22944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1702.069834][T22944] RSP: 002b:00007fa11342f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1702.069856][T22944] RAX: ffffffffffffffda RBX: 00007fa112825fa0 RCX: 00007fa11259e159 [ 1702.069870][T22944] RDX: 00000000040c0080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1702.069883][T22944] RBP: 00007fa11342f090 R08: 0000000000000000 R09: 0000000000000000 [ 1702.069895][T22944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1702.069908][T22944] R13: 00007fa112826038 R14: 00007fa112825fa0 R15: 00007ffe4a062b68 [ 1702.069939][T22944] [ 1702.372898][T22937] netlink: 976 bytes leftover after parsing attributes in process `syz.1.15064'. [ 1702.372921][T22937] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1702.452119][T22940] [ 1702.454480][T22940] ====================================================== [ 1702.461523][T22940] WARNING: possible circular locking dependency detected [ 1702.468603][T22940] syzkaller #0 Not tainted [ 1702.473026][T22940] ------------------------------------------------------ [ 1702.480106][T22940] syz.0.15065/22940 is trying to acquire lock: [ 1702.486265][T22940] ffff88801c2d4aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove+0x35/0x80 [ 1702.496213][T22940] [ 1702.496213][T22940] but task is already holding lock: [ 1702.503588][T22940] ffffffff8f803500 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 1702.512322][T22940] [ 1702.512322][T22940] which lock already depends on the new lock. [ 1702.512322][T22940] [ 1702.522726][T22940] [ 1702.522726][T22940] the existing dependency chain (in reverse order) is: [ 1702.531740][T22940] [ 1702.531740][T22940] -> #10 (gdp_mutex){+.+.}-{4:4}: [ 1702.539125][T22940] __mutex_lock+0x19d/0x1550 [ 1702.544256][T22940] get_device_parent+0x16f/0x3a0 [ 1702.549730][T22940] device_add+0x2d4/0xb80 [ 1702.554590][T22940] device_create+0x269/0x300 [ 1702.559712][T22940] msr_device_create+0x33/0x50 [ 1702.564996][T22940] cpuhp_invoke_callback+0x434/0x810 [ 1702.570812][T22940] cpuhp_thread_fun+0x362/0x780 [ 1702.576190][T22940] smpboot_thread_fn+0x565/0xa70 [ 1702.581661][T22940] kthread+0x38b/0x480 [ 1702.586256][T22940] ret_from_fork+0x514/0xb70 [ 1702.591365][T22940] ret_from_fork_asm+0x1a/0x30 [ 1702.596665][T22940] [ 1702.596665][T22940] -> #9 (cpuhp_state-up){+.+.}-{0:0}: [ 1702.604283][T22940] cpuhp_thread_fun+0x127/0x780 [ 1702.609682][T22940] smpboot_thread_fn+0x565/0xa70 [ 1702.615163][T22940] kthread+0x38b/0x480 [ 1702.619764][T22940] ret_from_fork+0x514/0xb70 [ 1702.624883][T22940] ret_from_fork_asm+0x1a/0x30 [ 1702.630171][T22940] [ 1702.630171][T22940] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 1702.637914][T22940] cpus_read_lock+0x42/0x160 [ 1702.643033][T22940] static_key_slow_inc+0x12/0x30 [ 1702.648492][T22940] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 1702.654742][T22940] nbd_genl_foreach_sock+0x265/0x450 [ 1702.660560][T22940] nbd_genl_reconfigure+0xbbb/0x1040 [ 1702.666382][T22940] genl_family_rcv_msg_doit+0x233/0x340 [ 1702.672462][T22940] genl_rcv_msg+0x614/0x7a0 [ 1702.677488][T22940] netlink_rcv_skb+0x226/0x4a0 [ 1702.682772][T22940] genl_rcv+0x28/0x40 [ 1702.687279][T22940] netlink_unicast+0x7bd/0x940 [ 1702.692576][T22940] netlink_sendmsg+0x813/0xb40 [ 1702.697876][T22940] sock_sendmsg_nosec+0x13a/0x180 [ 1702.703430][T22940] ____sys_sendmsg+0x54e/0x850 [ 1702.708722][T22940] ___sys_sendmsg+0x2a5/0x360 [ 1702.713925][T22940] __x64_sys_sendmsg+0x1b1/0x290 [ 1702.719393][T22940] do_syscall_64+0x166/0x520 [ 1702.724513][T22940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.730940][T22940] [ 1702.730940][T22940] -> #7 (&nsock->tx_lock){+.+.}-{4:4}: [ 1702.738591][T22940] __mutex_lock+0x19d/0x1550 [ 1702.743713][T22940] nbd_queue_rq+0x373/0xff0 [ 1702.748738][T22940] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1702.754900][T22940] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1702.761839][T22940] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1702.768354][T22940] blk_mq_run_work_fn+0x16c/0x300 [ 1702.773914][T22940] process_scheduled_works+0xc3d/0x1630 [ 1702.779995][T22940] worker_thread+0xa47/0xfb0 [ 1702.785117][T22940] kthread+0x38b/0x480 [ 1702.789715][T22940] ret_from_fork+0x514/0xb70 [ 1702.794832][T22940] ret_from_fork_asm+0x1a/0x30 [ 1702.800120][T22940] [ 1702.800120][T22940] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 1702.807327][T22940] __mutex_lock+0x19d/0x1550 [ 1702.812446][T22940] nbd_queue_rq+0xc1/0xff0 [ 1702.817390][T22940] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1702.823467][T22940] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1702.830334][T22940] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1702.836847][T22940] blk_mq_run_work_fn+0x16c/0x300 [ 1702.842410][T22940] process_scheduled_works+0xc3d/0x1630 [ 1702.848492][T22940] worker_thread+0xa47/0xfb0 [ 1702.853612][T22940] kthread+0x38b/0x480 [ 1702.858213][T22940] ret_from_fork+0x514/0xb70 [ 1702.863333][T22940] ret_from_fork_asm+0x1a/0x30 [ 1702.868633][T22940] [ 1702.868633][T22940] -> #5 (set->srcu){.+.+}-{0:0}: [ 1702.875758][T22940] __synchronize_srcu+0xc9/0x2f0 [ 1702.881218][T22940] elevator_switch+0x1e8/0x7b0 [ 1702.886592][T22940] elevator_change+0x2fa/0x480 [ 1702.891890][T22940] elevator_set_default+0x375/0x440 [ 1702.897619][T22940] blk_register_queue+0x3f3/0x4e0 [ 1702.903285][T22940] __add_disk+0x6b8/0xdb0 [ 1702.908150][T22940] add_disk_fwnode+0x100/0x3a0 [ 1702.913446][T22940] nbd_dev_add+0x733/0xb60 [ 1702.918397][T22940] nbd_init+0x168/0x1f0 [ 1702.923223][T22940] do_one_initcall+0x250/0x870 [ 1702.928555][T22940] do_initcall_level+0x10a/0x1a0 [ 1702.934128][T22940] do_initcalls+0x59/0xa0 [ 1702.938993][T22940] kernel_init_freeable+0x29d/0x3e0 [ 1702.944736][T22940] kernel_init+0x22/0x1d0 [ 1702.949596][T22940] ret_from_fork+0x514/0xb70 [ 1702.954725][T22940] ret_from_fork_asm+0x1a/0x30 [ 1702.960028][T22940] [ 1702.960028][T22940] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 1702.967850][T22940] __mutex_lock+0x19d/0x1550 [ 1702.972983][T22940] elevator_change+0x1af/0x480 [ 1702.978288][T22940] elevator_set_none+0xb5/0x140 [ 1702.983675][T22940] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1702.990027][T22940] nbd_start_device+0x189/0xb30 [ 1702.995414][T22940] nbd_genl_connect+0x167d/0x1cd0 [ 1703.000969][T22940] genl_family_rcv_msg_doit+0x233/0x340 [ 1703.007043][T22940] genl_rcv_msg+0x614/0x7a0 [ 1703.012089][T22940] netlink_rcv_skb+0x226/0x4a0 [ 1703.017393][T22940] genl_rcv+0x28/0x40 [ 1703.021903][T22940] netlink_unicast+0x7bd/0x940 [ 1703.027208][T22940] netlink_sendmsg+0x813/0xb40 [ 1703.032499][T22940] sock_sendmsg_nosec+0x13a/0x180 [ 1703.038056][T22940] ____sys_sendmsg+0x54e/0x850 [ 1703.043356][T22940] ___sys_sendmsg+0x2a5/0x360 [ 1703.048564][T22940] __x64_sys_sendmsg+0x1b1/0x290 [ 1703.054036][T22940] do_syscall_64+0x166/0x520 [ 1703.059161][T22940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.065581][T22940] [ 1703.065581][T22940] -> #3 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 1703.074236][T22940] blk_alloc_queue+0x544/0x690 [ 1703.079532][T22940] __blk_mq_alloc_disk+0x194/0x390 [ 1703.085174][T22940] nbd_dev_add+0x494/0xb60 [ 1703.090119][T22940] nbd_init+0x168/0x1f0 [ 1703.094804][T22940] do_one_initcall+0x250/0x870 [ 1703.100100][T22940] do_initcall_level+0x10a/0x1a0 [ 1703.105569][T22940] do_initcalls+0x59/0xa0 [ 1703.110425][T22940] kernel_init_freeable+0x29d/0x3e0 [ 1703.116153][T22940] kernel_init+0x22/0x1d0 [ 1703.121002][T22940] ret_from_fork+0x514/0xb70 [ 1703.126119][T22940] ret_from_fork_asm+0x1a/0x30 [ 1703.131419][T22940] [ 1703.131419][T22940] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 1703.138702][T22940] fs_reclaim_acquire+0x71/0x100 [ 1703.144170][T22940] kmem_cache_alloc_lru_noprof+0x65/0x5f0 [ 1703.150427][T22940] alloc_inode+0xb8/0x1b0 [ 1703.155291][T22940] iget_locked+0x131/0x6a0 [ 1703.160241][T22940] kernfs_get_inode+0x4f/0x770 [ 1703.165541][T22940] kernfs_get_tree+0x5cd/0x980 [ 1703.170828][T22940] vfs_get_tree+0x92/0x2a0 [ 1703.175770][T22940] do_new_mount+0x319/0xdc0 [ 1703.180798][T22940] __se_sys_mount+0x31d/0x420 [ 1703.186012][T22940] do_syscall_64+0x166/0x520 [ 1703.191138][T22940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.197558][T22940] [ 1703.197558][T22940] -> #1 (&root->kernfs_rwsem){++++}-{4:4}: [ 1703.205619][T22940] down_write+0x96/0x200 [ 1703.210395][T22940] kernfs_remove_by_name_ns+0x4e/0x140 [ 1703.216385][T22940] device_links_driver_bound+0x4ab/0x1440 [ 1703.222717][T22940] driver_bound+0xd8/0x2e0 [ 1703.227731][T22940] really_probe+0x774/0xae0 [ 1703.232766][T22940] __driver_probe_device+0x1e8/0x360 [ 1703.238587][T22940] driver_probe_device+0x4f/0x240 [ 1703.244142][T22940] __device_attach_driver+0x270/0x410 [ 1703.250038][T22940] bus_for_each_drv+0x258/0x2f0 [ 1703.255423][T22940] __device_attach+0x2c4/0x450 [ 1703.260712][T22940] device_initial_probe+0xa1/0xd0 [ 1703.266260][T22940] bus_probe_device+0x12a/0x220 [ 1703.271633][T22940] device_add+0x7d7/0xb80 [ 1703.276488][T22940] faux_device_create_with_groups+0x1a5/0x2b0 [ 1703.283080][T22940] regulator_dummy_init+0x19/0x40 [ 1703.288708][T22940] regulator_init+0xca/0x110 [ 1703.293818][T22940] do_one_initcall+0x250/0x870 [ 1703.299106][T22940] do_initcall_level+0x10a/0x1a0 [ 1703.304570][T22940] do_initcalls+0x59/0xa0 [ 1703.309412][T22940] kernel_init_freeable+0x29d/0x3e0 [ 1703.315126][T22940] kernel_init+0x22/0x1d0 [ 1703.319971][T22940] ret_from_fork+0x514/0xb70 [ 1703.325084][T22940] ret_from_fork_asm+0x1a/0x30 [ 1703.330371][T22940] [ 1703.330371][T22940] -> #0 (&root->kernfs_supers_rwsem){++++}-{4:4}: [ 1703.338977][T22940] __lock_acquire+0x164c/0x2de0 [ 1703.344357][T22940] lock_acquire+0x115/0x350 [ 1703.349385][T22940] down_read+0x4a/0x330 [ 1703.354078][T22940] kernfs_remove+0x35/0x80 [ 1703.359015][T22940] __kobject_del+0xe0/0x310 [ 1703.364033][T22940] kobject_del+0x45/0x60 [ 1703.368786][T22940] cleanup_glue_dir+0x1a3/0x220 [ 1703.374159][T22940] device_del+0x77d/0x8f0 [ 1703.379004][T22940] unregister_netdevice_many_notify+0x1be1/0x2140 [ 1703.385935][T22940] unregister_netdevice_queue+0x2f5/0x340 [ 1703.392188][T22940] ieee802154_del_iface+0x2e2/0x610 [ 1703.397990][T22940] genl_family_rcv_msg_doit+0x233/0x340 [ 1703.404066][T22940] genl_rcv_msg+0x614/0x7a0 [ 1703.409096][T22940] netlink_rcv_skb+0x226/0x4a0 [ 1703.414381][T22940] genl_rcv+0x28/0x40 [ 1703.418880][T22940] netlink_unicast+0x7bd/0x940 [ 1703.424178][T22940] netlink_sendmsg+0x813/0xb40 [ 1703.429463][T22940] sock_sendmsg_nosec+0x13a/0x180 [ 1703.435002][T22940] ____sys_sendmsg+0x54e/0x850 [ 1703.440285][T22940] ___sys_sendmsg+0x2a5/0x360 [ 1703.445477][T22940] __x64_sys_sendmsg+0x1b1/0x290 [ 1703.450935][T22940] do_syscall_64+0x166/0x520 [ 1703.456045][T22940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.462462][T22940] [ 1703.462462][T22940] other info that might help us debug this: [ 1703.462462][T22940] [ 1703.472702][T22940] Chain exists of: [ 1703.472702][T22940] &root->kernfs_supers_rwsem --> cpuhp_state-up --> gdp_mutex [ 1703.472702][T22940] [ 1703.486101][T22940] Possible unsafe locking scenario: [ 1703.486101][T22940] [ 1703.493631][T22940] CPU0 CPU1 [ 1703.499018][T22940] ---- ---- [ 1703.504400][T22940] lock(gdp_mutex); [ 1703.508301][T22940] lock(cpuhp_state-up); [ 1703.515142][T22940] lock(gdp_mutex); [ 1703.521552][T22940] rlock(&root->kernfs_supers_rwsem); [ 1703.527013][T22940] [ 1703.527013][T22940] *** DEADLOCK *** [ 1703.527013][T22940] [ 1703.535217][T22940] locks held by syz.0.15065/22940: 4, last CPU#1: [ 1703.541710][T22940] #0: ffffffff902c6228 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1703.549981][T22940] #1: ffffffff902c6060 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 1703.558962][T22940] #2: ffffffff90254f20 (rtnl_mutex){+.+.}-{4:4}, at: ieee802154_del_iface+0x298/0x610 [ 1703.568619][T22940] #3: ffffffff8f803500 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 1703.577788][T22940] [ 1703.577788][T22940] stack backtrace: [ 1703.583681][T22940] CPU: 1 UID: 0 PID: 22940 Comm: syz.0.15065 Not tainted syzkaller #0 PREEMPT(full) [ 1703.593128][T22940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1703.603184][T22940] Call Trace: [ 1703.606456][T22940] [ 1703.609381][T22940] dump_stack_lvl+0xe8/0x150 [ 1703.613988][T22940] print_circular_bug+0x2e2/0x300 [ 1703.619017][T22940] check_noncircular+0x12f/0x150 [ 1703.623967][T22940] __lock_acquire+0x164c/0x2de0 [ 1703.628828][T22940] lock_acquire+0x115/0x350 [ 1703.633360][T22940] ? kernfs_remove+0x35/0x80 [ 1703.637961][T22940] down_read+0x4a/0x330 [ 1703.642117][T22940] ? kernfs_remove+0x35/0x80 [ 1703.646735][T22940] kernfs_remove+0x35/0x80 [ 1703.651149][T22940] __kobject_del+0xe0/0x310 [ 1703.655664][T22940] kobject_del+0x45/0x60 [ 1703.659918][T22940] cleanup_glue_dir+0x1a3/0x220 [ 1703.664782][T22940] device_del+0x77d/0x8f0 [ 1703.669126][T22940] ? __pfx_device_del+0x10/0x10 [ 1703.673982][T22940] ? pm_runtime_set_memalloc_noio+0x1f5/0x260 [ 1703.680139][T22940] ? netdev_unregister_kobject+0x347/0x450 [ 1703.686012][T22940] unregister_netdevice_many_notify+0x1be1/0x2140 [ 1703.692432][T22940] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1703.699211][T22940] unregister_netdevice_queue+0x2f5/0x340 [ 1703.704937][T22940] ? ieee802154_if_remove+0x1b3/0x210 [ 1703.710397][T22940] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1703.716650][T22940] ? ieee802154_if_remove+0x1b3/0x210 [ 1703.722023][T22940] ? __local_bh_enable_ip+0xd6/0x140 [ 1703.727319][T22940] ? ieee802154_if_remove+0x1b3/0x210 [ 1703.732693][T22940] ieee802154_del_iface+0x2e2/0x610 [ 1703.737888][T22940] genl_family_rcv_msg_doit+0x233/0x340 [ 1703.743446][T22940] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1703.749521][T22940] ? bpf_lsm_capable+0x9/0x20 [ 1703.754191][T22940] ? security_capable+0x7e/0x2c0 [ 1703.759129][T22940] genl_rcv_msg+0x614/0x7a0 [ 1703.763650][T22940] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1703.768683][T22940] ? __pfx_ieee802154_del_iface+0x10/0x10 [ 1703.774396][T22940] netlink_rcv_skb+0x226/0x4a0 [ 1703.779156][T22940] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1703.784191][T22940] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1703.789494][T22940] ? down_read+0x2be/0x330 [ 1703.793917][T22940] genl_rcv+0x28/0x40 [ 1703.797894][T22940] netlink_unicast+0x7bd/0x940 [ 1703.802677][T22940] netlink_sendmsg+0x813/0xb40 [ 1703.807459][T22940] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1703.812750][T22940] ? apparmor_socket_sendmsg+0x98/0x360 [ 1703.818295][T22940] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1703.823579][T22940] sock_sendmsg_nosec+0x13a/0x180 [ 1703.828602][T22940] ____sys_sendmsg+0x54e/0x850 [ 1703.833366][T22940] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1703.838660][T22940] ? import_iovec+0x73/0xa0 [ 1703.843161][T22940] ___sys_sendmsg+0x2a5/0x360 [ 1703.847850][T22940] ? __lock_acquire+0x747/0x2de0 [ 1703.852789][T22940] ? __pfx____sys_sendmsg+0x10/0x10 [ 1703.858005][T22940] ? futex_wait+0x2a2/0x390 [ 1703.862533][T22940] ? __fget_files+0x2a/0x420 [ 1703.867122][T22940] ? __fget_files+0x3a2/0x420 [ 1703.871814][T22940] __x64_sys_sendmsg+0x1b1/0x290 [ 1703.876763][T22940] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1703.882225][T22940] do_syscall_64+0x166/0x520 [ 1703.886821][T22940] ? trace_irq_disable+0x3b/0x140 [ 1703.891848][T22940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.897911][T22940] ? clear_bhb_loop+0x70/0xc0 [ 1703.902588][T22940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.908473][T22940] RIP: 0033:0x7f04def9e159 [ 1703.912880][T22940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1703.932480][T22940] RSP: 002b:00007f04dfdbe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1703.940897][T22940] RAX: ffffffffffffffda RBX: 00007f04df226090 RCX: 00007f04def9e159 [ 1703.948867][T22940] RDX: 0000000004000000 RSI: 0000200000000b00 RDI: 0000000000000005 [ 1703.956836][T22940] RBP: 00007f04df03506b R08: 0000000000000000 R09: 0000000000000000 [ 1703.964809][T22940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1703.972784][T22940] R13: 00007f04df226128 R14: 00007f04df226090 R15: 00007fff04334698 [ 1703.980770][T22940] [ 1704.095543][T22962] IPVS: Unknown mcast interface: team0 [ 1704.136372][T22966] netlink: 256 bytes leftover after parsing attributes in process `syz.3.15071'.