last executing test programs: 5.105198384s ago: executing program 0 (id=5001): socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb01001800000000002c0000002c00000002000000000000000400000d0000000001000000030000000f0000000000000010000000000000000b0000000500000000000000"], 0x0, 0x46}, 0x28) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) setsockopt$sock_timeval(r0, 0x1, 0x31, &(0x7f0000000280)={0x0, 0xea60}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) write(r2, &(0x7f0000000100)="5000000018000106010000000000000002180000fe04000100000000080001000a000300080004000100000006001500060000001c001600180001000800010004000000090002007465737400000000", 0x50) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r1, 0x215eb000) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000200)={'sit0\x00', &(0x7f00000005c0)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x1, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0xc, 0x0, 0x0, @loopback, @multicast1}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f4, &(0x7f00000001c0)={'syztnl0\x00', 0x0}) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0xfffffedd) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) r5 = accept(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="44000000d54a0015450612033b05a28ed56f7453604c5582bbdc69073ae4bf16bdb8f96af452359f0045611cb159dbd286fd13693266d940189053e85fdfe76f0506ca", @ANYRES16=r7, @ANYBLOB="01002bbd7000fcdbdf254c0000000e00a80066697273746e616d650000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x44}, 0x1, 0x0, 0x0, 0x84}, 0x40080) r8 = socket$nl_generic(0x10, 0x3, 0x10) writev(r1, &(0x7f0000001b00)=[{&(0x7f0000000ac0)="2243d0e062b52e5e97a9e7fbc658fe1573ccb9896bc1a01d74ef673858abb08283f61a4d2a297ad72e5be475d49ced1e96c584e46b21444e23b67801646d8117bba9857b05e0667dbaff02eb34e8f8f893a46b7260e05a9ac4aceb7ba874c1c497d9b17d5317b1c12d265ece79720c6d82b9ec969f607abb595cfb27c6a08f74fafc8282fc1708623508c4c721c4456d04d4b7e986a0669d7ea0714370760bc8fd75d402d8a8480084d45882cbc251749c89efad721f9c537cc4739167501a9e678182d918479c6c5dd84a0f9515f695b53cb0b51a9ab6b8d3c51b35c1ad25142f888001c10c985e10f0a6ef07d87e160906fe238e31f91824b0292b579bf494ccf9e2a9bf7c37aeb7588ab2319d038692aaa2990e09e5623cfd91b56de4f36818034b007cd43d4b620729366c0cfd2758191687a0a6a8c661c9b4b5faf56dc80b26d7cb40423e62676b3ebb9c3f88a1e4e84aeb588754bab48bc15f8efd0e095493407b8488d53333a95b84ff86bb3d8c92fce896877568b5dda45a785c9d7a51c5eede3c78441f657a23151fcc8614bf7dba5fbb8828bf846030d5a36bd2f66da0414016b0c7268f24e44b8d3b64a7b4880592a33ca34f63f701b75231f20c2643b2b70e1e641aa5c8e09bd738079f0e6bce6b02e2d5e200a069b201c3da6861f06a452ac768feab25ee9369d59987a41201cb9a7e79c4db18572f1304f332d03a20d8033f95bdd04e4ee08526230586b09bb93a975359f9b3a3513eae224892f462753b75bbcc98df174a6e4aec9696465475ba977f4e71f05544db67b452f92b67ef99bb9c43441d6e653c29da59b747fcc85f0c40f81ac5442a932943abe4b4c9aca087e5ec639c8788b88c1281d50e1dac3d24a54a229ae2b330af083f33a6df2612115fa3c39a5279f7657b333fd6a95aff81c667d5dd7c8883a1e442be45f8bf402105e3be864c65be9c63659ad913a221704a8cd27ba08cc04ffffc80660558aa55fdd176c1c67a2a5e9f75c512d9511888dabe77a0efa63c66ac019b90eecb820b450aeac5688b764631de3d19d9f1e59064e79f1c695f0a759d96fd7914d973e27ffd99339a23f2647890bcc0e793f79f92118243dfb5319fc48b870889b300d603b13143c238673543d88543aa7d0ff12d8e92b414d8f7935e1b1e1648158152f6903e17e05d1d597ebd59f74ff52092d3c1f36e49c60030bda65299f0bb4596bbf750a47875c796b0d655874ed8b686ea21e9f451f56cacf52b85210e99817a7008514cd14fbf2dd661584a2e7fcdbad7c06d78504c6f652e875a16a1e99d3ee32dd3149919c70c42c92b0930514794dbba6f80e6da62cca5b8f8db54972af6a37d362dffa0137b8c8b8e7d4f9ce01fbdb3ae1a1b3fd7c7d9f03ab4f116c95ca73f399bb60f73c37b6c7e56f0a954abcac96b1b9a0cf6493c9f7f7f59f0a1adb6f40b8368f69a6f1c511e020bb8161732e2f49aebed55e4709fd46e77f6b25cba38d962dfb7ed383fd2f756738b96d5b803519bf6c3fc429da4c9ef88d44478f0d8b381477ead901b032e1fe1e393fb17d1a89647f362108c4ef77acf5235b550a410414eceed24364456ed532a5299efb4abf3f6b723eadf42cbb8fc8a4d71538200013fbf3f59428b72d996c93100c9e1f9a790acb67480d08cc039c73b6afe1cdedcdd8c7649bee5ce56df00f6dd36fef3183e2c420bb7277ef4b6d1d82c803f56f6089f67754d7bc6168791bcd041c61819e02f4f1bbbc0326ea461ae3fc3814e009413a453fb18c7e30ef19890c47d1db52339b057053ab1771630cb598e8850b88058a85aafd77893227a60ec3a8870ac102846996b9db7245bb50d14e8a8a4bb15154bf45a36b2aec08f7e8c1b31d9c9081b1e9a39db63e521f696dbdfa3c8b9276d0a2d20dbbea3e16e65a95f8ff51de052f34b27197c43f955c513f9b00543b93958dba1480fdf0ec7f2c7c7d2e7f0f77f6eb1b0bd4ddfa15301554a21f86d2b5dec66c3648575350c7b7a00e53615da36529e7460a2baef181b279107f9d905ad063531d9c7dcb65a5a0f2bf28a27a3debd33ef107fbe112596b1d587a36c8d06c3f3e10caecdcc6c57c24d6a33a7ec754b5da1d39dd5af080c2cd99212e968a05c267c130b61ee711b85ff30f99e4d0378d3da552f68cdab2f7cbe9891b6cfea46f3213143e1c85dc5a714fe093792e3244e12a8b2cc2a4c71046a70b66f4c23a4d325fa1a07c13cd5cac797c3c0faeddd25e594eaa3c589ec26cb54cc8fd87cde9906b831548f75a261a54bbe62c51db647cda05a1893831c1b9e6b135d137bc1109c461c88fb0f6df8f6ed4af1300e1ec97a76b686d5c023ac00a035c7a7e5b8ad84a714c06b3729ba599cbdee31289f8a0b8d540e4a7a856c53b4677e9488c76ea1a380849d821432f9399e40cd68be92832954962eeb10abb33c33d9f69002f37746fed2e964be8666807a9923b1f1a235acc5ab571adeaa454e6b72672bce8ee813ac349ee109d50ed23aa2961e15dcf709d444282adb19a2dd0cd62ac34c36b8a9ab0e69c488667ab2b0cfe311f5fd1b9f26f9b3a18945e66bf411d7fa5972c9d8be3a5ee71db2ca8389979f9c3e5f935868be686f7b984c169758d39f40d83dac78f8955d1ab0a3e90aefc989d4e4d3b83047845acf30e9f6033fbb6d77661e45337d93f47056a40e1723865a142dad546a783e092355a19aa960067c0378ff2c247715544c3eded96a3ee2c57ff288e88c35b70213085e2155e45b3b56c065ca30357cb024e4fb49d148d087d3ef871ee679d963960de3ff7c577a254360db9209625d20b3d77e9b2c2b596541b2b1c526a025ebba09a75eeda6f71018b506bb22fbb8d295df907b6345a9b9ca43ee8bcd9b4dba099add07ab40509c5347b6bee58a9f8339070b2d05afb4e8f73c473867bd3400755ded1d1e3ed6a704d70aca6cf3660a64d7b01a13e0872257fa4567ae6e436b14f645dd6cf237fcc2bb739eb9572f84f57bc845b4e55b4b721b2d6c1545a3c4d9d84934a0d9da0f7cf516179af9a44a01e42ff22d9622dfbc8a0ed1125eca05f8dbc75a7e63462a2d3a27c75b2bb413d4ebec655aa34de3a1e80de9d0e901027b1893aa6842bac15f86abba3c1bab5963b8541c841b0112832361c0e2c4b899cbc2500ea6e5c392976f35a4a7e189465b8cfb2ef0ad6699efbed69219df2281cdb378b362d3101112c65ac58591d84ea513a5644d1fce969a24425ac96d753d3fe893f7faf7cd71286be66f0f6b1e61ed02d47b4879a80e2fd7710a551475af2fed433f06fc3fb7dc6f83460a5122f386dcde67b642f0c74a3a84cf75c30d45b5a9251c8d7a0c56b1400ef29b4c504c4022c9807f02104dd9bac547e3e2810b9e9758d51cdfa8a8822bc4d97b7e092c2a538afa0483ebcf0d98943c104d9a2e90e84f230405907b518563cd0b7145e7b8c35e51f21dff848ac0929086c39b2fac200184bd2e428ebcde9485e265461bb31f019d9a32cc8ea6323edb01c1767b8a4dae575b3f897978a268953d76b929f070d067312c3fd8bf45c49f1ce5ebac9cfd26a48ef6296912efebfa092f346fc0ac8de2f1459890039baee6fb3d94eb570335fb48a95b2557ffee7390461d99223a316540cb7fa160af8acde9e8ceb56ed00151d3c29fec6e0a6a7a6db3352887ad896f6b6061816a8d34a9e7303cdcfc2d3acb0ead52087c51f5a7cb2e96a224452589623634d69aa0cbdc8ee80659e71e2974c1d09f64948f78aad28365bb12aac45e85d1c7a0e5ca632b97af7e7f8a1771a938da2befa61762012f7757ff05400262048c28e87697ec113c4edc5adefea0ca432a19c240fe5f4be7b54790aa7465b669197ab4a9ea4ba9cb862a20f3fc53a17675414983bd4ad9d4a60b785fb93fdced7e1f450387737bf3077bb204b7cb4eca78576c12e60d20cbd0f8bf9889628147dcdaca511fd8bbe30a31af885357f525ab07f717af55eb02a796f7a4ab20b9164abbde48b8c0d13849dfe95c7349d84a035d1710955331af722f2a416afef1fe3a5c8eaa449c835a8f3402dcff60eb437b717348c453ba3bbf7fe2efa29288eadd44ec2cbfacbf14406cd58bb83d1f8030a75c42800fda47ad4af35bbc9a71ee6adece3b059acdbe473295a856e9cb5ac588a30f68116d7db9a2055c687f28eb28a2752a2be7d8c53dbc0ca82b5c8fdd11e2d9288489885d8c9b1d7ca77e20cd5477f37c0546432d69c1e528034a819612c1fddf6dc3c728d4b255747ef6582561454fe118fa5b266fd49c60aedd44e17efa70ca66557fec39ef33756209bd6ccafce22da57793e467ffa4df990d20b0896a97a9e6a5bb212a25e4cf89f1f128f13aae2a568a56ad7922214452037cf99fc43480b14efd47f172cf5a2dda7b0589dc1d5cd53570169a1ecb28680e8de828a46e7d963fa6b28ffef5af69e25131dc0c750ff7ab4ff7cfabd7e5249dda3146029cec1b333c0532da8f10bd1d7dea00d1080ccd4ef8c31662b9c45d0d6e348d564dd9a6800781f370ba4231c6552bbc47f3314412f89eb9959f3297348ed63e311ec620d2b2065bdfe152cdb4bfc511e87c79f461177164e5833ba61c40f06cb80b83f5b018c69324d38fed62cf525eb2a6c742995a77a7543d6ce5272f325151eb6643192ad27e6edadc6311e2d009667007b77891cec893cd31162c4de7868c3de08df05f482cf7aa19455077392a3d1381f59070414b4a19e0232b67676a3abd6b752f5ffdb9f181db842ff1fb18e4c7bcf42c4105c3a37687257ca5f35df5ee0469f501400f59b6558bea556ac3f3f68d565122b0e43f8748065f07fd39d4232464e2adf68ec7508206deb325ec244a55aced6b85e51c37025a9567814817e29d60fefd6af240a423c34f0ca8901b0192762adb97b6f64cb9a21d09d19d308fb785fe4db81d9b8541c41f1f6c1b2a5ede72dfe7f372316b9a8fed35ef6d6d2afd88cea8c4bb58403fd5170aaacf3bf4111dc26e60f928cc2a79b8bd95db02c20ed8b016131aacb0a5ec0e1358d5c77c174e1bde678f8b170639f2eef3b3e28ff59140d51d6ae51075b036f9a15f79094226d01ec80a1220ae64c6e68afb271d8045bdb845f3a0be97d77b51c9acb91bd665d055cfd2555230b8c9106ff589af2e1174187bf5f619d891e3e870f03f23937bfdd96840b4395062ab9adfd45a9cdc3211724dd6c80e113af887f837e7ff7aafbb8f2619b00ba28683d753e921a5fca3aa355df7b47664dcd59af15d6574b7d2d0159789be680c315138354dff9997d11cdd6a96aba6b69cf44ee6dd133f8662d4f61d63f481aadf9f50656eb7167911afe419ce024228b70dd736c07579f74b8191be27741c9e4d434c97001d149b92254462d0b36bfef0cfe479dcce340620d14fd0a9b9de47d97be45189f38e9ce901223a4770dde4baf9b8ffdb2f5b8356a8b13902ed21b692f026665a6bfcfef23f97b2ecdda10d113419453ca1ef601aa0346099300da4bf06aea31b98205fef8fa2d33dad32b5419b991ad6669067a6a243e00fc3282f05decb6ffd2d1fb084da45055feace7ea1dae5c41de8dc926da352be97efa9313ca15ff133f55374a90eb849189a8b90d2777eef37b1dd9928e5b0f8006e3c9ce082c9f7e74c69deacd31025f14013f3f687bbfb28438df0e9f4cdc1a91df4ac15a3f188ba0138a36910cb85e4b377888892c43d89b90cc3677d34c93505049cbd1f8f204ea213daf649eb84ffcb97dfed5aecddb302af8bc56dbd", 0x1000}, {&(0x7f0000001ac0)="6d0d1bfaa082a96c86e7ff7be703007bd0f500"/29, 0x1d}], 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r8) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x41}, 0x24044040) setsockopt$MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e20, 0x0, @empty}, 0x1, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xe3]}}, 0x5c) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000180)={0x7ff, 0x206, 0x9, 0x5228, 0x0}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000400)={r9, 0x4}, &(0x7f0000000440)=0x8) 4.699290519s ago: executing program 1 (id=5005): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000005000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.636403269s ago: executing program 2 (id=5007): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0x0, 0xbabd}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x7, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="620ac4ff000000007110b70000000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000a523ffff850000000400000095"], &(0x7f0000000480)='GPL\x00'}, 0x94) write$tun(r1, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0x0, 0xb00}, @generic={0x0, 0x2, "d58838000391"}]}}}}}}, 0xfd6c) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000140)=@generic={&(0x7f0000000100)='./file0\x00', 0x0, 0x18}, 0x18) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000002c0)={0x1b, 0x0, 0x0, 0xf0, 0x0, r4, 0xdb4, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x3}, 0x50) r5 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) ioctl$FS_IOC_GETFSMAP(r6, 0xc0c0583b, &(0x7f0000000400)={0x0, 0x0, 0x2, 0x0, '\x00', [{0x0, 0xfff, 0x3174a9a2, 0x7fff, 0x3, 0x4}, {0x3e9, 0x1f, 0x4, 0xa, 0x5, 0x5}], ['\x00', '\x00']}) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r6, 0x114, 0x1d, &(0x7f0000000080)=ANY=[@ANYRES32], 0x4) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r7, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0000010000000000"], 0x3c}}, 0x4040000) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r7, @ANYBLOB="00000200ac14e699"], 0x20}}, 0x40000c0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x58, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_OKEY={0x8, 0x5, 0x8c}, @IFLA_GRE_LOCAL={0x14, 0x6, @private1}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x58}}, 0x0) 4.340424456s ago: executing program 1 (id=5008): r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, &(0x7f0000000040)={0x2ca, 0x100000001, 0x1, 0xe9, 0x0, [0xfffff001, 0x1000, 0xf7, 0x2]}) (async) ioctl$BTRFS_IOC_DEFRAG_RANGE(r0, 0x40309410, &(0x7f0000000040)={0x2ca, 0x100000001, 0x1, 0xe9, 0x0, [0xfffff001, 0x1000, 0xf7, 0x2]}) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) (async) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000080)=r1, 0x4) r2 = socket$l2tp(0x2, 0x2, 0x73) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x8, 0x0, 0x0}}, 0x10) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x4001, @multicast, 'veth1_to_hsr\x00'}}, 0x1e) (async) connect$pppoe(r3, &(0x7f0000000040)={0x18, 0x0, {0x4001, @multicast, 'veth1_to_hsr\x00'}}, 0x1e) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000ac0)={r4, &(0x7f0000000900), &(0x7f0000000a00)=""/182}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0x3, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x88}}, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f00000000c0)={'netpci0\x00'}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x4e1c, @broadcast}, {0x304, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x43}}, 0x7e, {0x2, 0x4e22, @empty}}) 3.698223478s ago: executing program 1 (id=5012): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a0104000000ff00000000010000070900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a3200000000b4000000060a010400000000000000000100000008000b40000000008c000480340001800b000100657874686472000024000280080001400000000c080003400000007a08000440000000220500020089000000540001800c0001006269747769736500440002800800034000000002080001400000001408000240000000041c0005809500010099d69793f6e6fbf8bd31e25ae3b5ccd7a30000000c000480060001008a9500000900010073797a30"], 0x128}}, 0x0) 3.65012935s ago: executing program 2 (id=5013): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0xfffffffffffffff5, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2, 0x2000000}, @TCA_FQ_PLIMIT={0x1300, 0x1, 0x5}]}}]}, 0x48}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000280)={'vxcan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r3, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x78, r4, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}]}, @HEADER={0x4}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x2000c050) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x16, 0x0, 0x104, 0xff, 0x0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xb, 0x8, &(0x7f0000000d40)=ANY=[@ANYBLOB="b4000000000000001e1000000000000018120000", @ANYRES16=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f0000000040)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 3.452761532s ago: executing program 0 (id=5014): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="2300000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x79, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00700000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000000f"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000005c0)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x3, 0x80000001, 0x2e, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @empty, 0x20, 0x8, 0x100, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000240)={'syztnl2\x00', 0x0}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="340000004100070128bd7000f6ffffff017c0000050042800c000180060006000a000000100002800c00080000000180"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000000000000000000f9000065e35ab9375fb14406000000fca8d71a5b0691cd41384d639b174fd8277ce541946fc8bdcd03c1b38216926d9a0076789cbe", @ANYRES16=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b704000000000000850000005700000095"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x13, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x14, &(0x7f00000009c0)=ANY=[@ANYRESHEX=r6, @ANYRESHEX=r3, @ANYRES8=r5], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5e, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, 0x0, 0x0) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000cc0)=[{0x0, 0x0, &(0x7f00000003c0)}], 0x1, 0x600008d0) recvmmsg(r9, 0x0, 0x0, 0x40000140, 0x0) sendmsg$MPTCP_PM_CMD_REMOVE(r9, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x110}, 0x240400d4) write$cgroup_int(r4, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[], 0x0, 0xfffffffffffffe1b}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="020000000400000008000000800100e10080004000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r10, @ANYBLOB="000000000100"/28], 0x48) mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r4, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xba0c29e690d41d4b, 0x20000000ec071, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) 3.452620767s ago: executing program 1 (id=5015): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000100)={0x1d, r2}, 0x10) sendmmsg$sock(r1, &(0x7f0000005880)=[{{0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000003000)="0100000003000000640000000000000000000000000000000000000000000000000000000000000002000000000000000100000001000000010000000100"/72, 0x48}], 0x1}}, {{0x0, 0x0, &(0x7f0000004180)=[{&(0x7f0000003100)="01000000030000006400000000000000000000000000000000000000000000020f5800000000000001000000000000000100000002000000020000000100"/72, 0x48}], 0x1}}], 0x2, 0x0) 2.948819858s ago: executing program 1 (id=5018): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x1c, 0x2, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x42}}}, 0xffffffffffffff49) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, 0x0, &(0x7f0000000040)) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x37853779e4840b59, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f0000000280)="1a0000000200", 0x6) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="0380c2000000bbbb300000000000019078ac1e0001ac1414aa030490781200183f2500000000000000000100007f0000017f000001acb1cd297c58d931a1057245e13f96ca0bed3ab9947d003c16021ab6d4176937016b82c241"], 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x401, @loopback, 0x2}], 0x1c) sendto$inet6(r5, &(0x7f0000000540)="b8f8ba943adadfb8bd4a2dc86bb7a878c04f6f5167bd87a166bb1fdfaa79ab55656e8b2eeb6d4a42f2035af6307766c1dc4018b4be71a5be3faf699b82a33ceaba30399a3d11550246ab5f12a63369f3f55dff397d4619794bcdea9fab367421e8e84ed11479ca97042d1b41c4cae885bc28a606a98227bd2fd91ba9af112e96fcda5bec40733d4c369e50ec9db82ec42e5bdb69a8ce05b1c2cff121de880615be13f374eea8907b490d24df937f457397654e680cd996a839fcc34cb3a4fe3ac18f0000a5749c1d9b8d2d78491549b0b910bf70117423bd83e3c1a838a88fcd48d48ee0e8327da472a9e97c55dcded207fd2635782f40411edf81553288d49182daf0b97c345b4a6e2adca3dd0728faa324c70aaa099df2bec678d8137c1b178d6f1e40bece7629ffa8e0f626284ae3af2f238e9db0806321fcc9f9a7eed89c0790cee9f98e7b93ba56a39411df673a3d88a58b0b452335fe389e58327895d7ab9fb0d83678caa4a7945dc335", 0x1, 0x4040084, &(0x7f0000000180)={0xa, 0x4e23, 0x6, @loopback, 0xffffffff}, 0x4f) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000000)=ANY=[], 0xffc9) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r7, 0x0, 0xf3a, 0x4e27350c765b9e30) write$cgroup_pid(r7, &(0x7f0000000000), 0xffffff98) r8 = socket(0x6, 0x5, 0x20002) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r9, &(0x7f0000005b40)={0x0, 0x0, &(0x7f0000005b00)={&(0x7f0000005ac0)={0x14, 0x1, 0x6, 0x3, 0x70bd28, 0x25dfdbfd, {0x1, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x40804) splice(r8, 0x0, r7, 0x0, 0x6, 0xa) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r10, 0x84, 0xb, &(0x7f0000000080)={0x2, 0x15, 0x4, 0x20, 0x80, 0x3, 0xd, 0x3, 0x2c, 0x31, 0xa2, 0xa, 0x10, 0x84}, 0xe) sendto$inet6(r10, &(0x7f0000000500)="a4", 0x1, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @mcast2, 0xffffffff}, 0x1c) close(r10) vmsplice(r6, &(0x7f0000008ac0)=[{&(0x7f0000007a80)='u', 0x1}], 0x1, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r11) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x43d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0x3, 0x8}, {0xffff, 0x6}, {0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x40480c0}, 0x0) 2.859535037s ago: executing program 0 (id=5019): setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002d00), 0x0, 0x8005) shutdown(r0, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f0000000040)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x20000149) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) r2 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000180)={'veth1_to_team\x00', &(0x7f0000000300)=@ethtool_gfeatures={0x3a, 0x1, [{}]}}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) write(0xffffffffffffffff, &(0x7f0000000d80)="fc0000001c000704ab5b2509b868030002eb087a0100004542dcbbc929a44032938193210001c0f00305840500601000000007000000000000009c41c2864800f0ff7f0000b400600033d44000040560916a13e273fc83ab82", 0x59) r4 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @loopback={0xff00000000000000}, 0x4}}, {{0xa, 0x4e00, 0xa3, @local, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000cc0)=ANY=[@ANYBLOB="03000000000000000a004e2300000049ff0000000000000000000000000000010800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a"], 0x590) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002000000000000", @ANYRES32], 0x50) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(0xffffffffffffffff, 0x0, 0x4008000) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) close(r5) socket$kcm(0x10, 0x7, 0x4) ioctl$SIOCSIFHWADDR(r5, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeb}, 0x94) 2.564469759s ago: executing program 2 (id=5021): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f00000000c0)=@srh={0x2c, 0x2, 0x4, 0x1, 0x0, 0x48, 0x4, [@private2={0xfc, 0x2, '\x00', 0x1}]}, 0x18) r1 = socket$kcm(0xa, 0x922000000003, 0x11) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, 0x0, 0x0) 2.368835804s ago: executing program 2 (id=5023): socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1200000004000000040000001100000000000000a3cf91dca63a6cd49dd0cf349a5b16def1297a8b8d6fc3fffebd9452e2a41b905bf45f376388fa786131196555f9cd45498e75cdd093c3174e9d924cf4a4f43cfa7fb40a", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r4}, &(0x7f0000000140), &(0x7f0000000280)=r3}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r4}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000520000000b702000014000000b7030000000000008500000008000000bf092000000000003509010000000a009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf980000000000000d08000000000000850000001b300000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 2.148163407s ago: executing program 4 (id=5024): bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) r2 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000440)={r2, r0, 0xfff, 0x60, &(0x7f0000000240)="717f41beb198724aae10f5c1da24eea565a02b989d78b514dc9fc04fdbb4b8dc89eba88532b57c858db5ac0e98c882d964fa53bbcca8d1575e6e08af7aee788f17f6bbd4513606acb28f69e4f70ae25c69d9de96da6e8e8ff5b7e3e8fed94342", 0x2, 0x2, 0xc3e, 0x5, 0x3, 0x2, 0xfac, 'syz0\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={0xffffffffffffffff, r1, 0x25, 0x0, @void}, 0x10) 2.0738372s ago: executing program 2 (id=5026): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000643200007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="00e341b2f8007eb22200000018000000b7050000080000008500002b97000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) (async, rerun: 32) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) (rerun: 32) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f00000000c0)) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000740)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./cgroup/cgroup.procs\x00', &(0x7f00000006c0)=[0x1], &(0x7f0000000700), 0x4, 0x100000}}, 0x40) (async) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), r4) (async) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0xf0b, 0x70bd26, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xc}, {0xffff, 0xffff}, {0xd, 0xc}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_EVICT_TIMEOUT={0x8, 0x6, 0xfffffff5}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44004}, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x10, 0x10012, r6, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r8) (async) r9 = socket(0x28, 0x5, 0x0) r10 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r10, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) (async) listen(r10, 0x4) connect$vsock_stream(r9, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB="00000000000000e6ff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r11}, &(0x7f0000000000), &(0x7f0000000080)=r8}, 0x20) recvmsg$kcm(r9, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2000) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) (async) sendmsg$NFT_MSG_GETGEN(r9, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x4006054}, 0x6068800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r7], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r12, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.049161076s ago: executing program 4 (id=5027): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x2, 0x1a}) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x20, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x80000) (async) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, 0x0, 0x4, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x2400c000) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$tipc(r4, &(0x7f0000000300)=@name={0x1e, 0x2, 0x2, {{0x42, 0x1}, 0x4}}, 0x10) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r0, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x18, 0x140d, 0x2, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x30000880) (async) ioctl$sock_x25_SIOCDELRT(r0, 0x890c, &(0x7f0000000440)={@null, 0x2, 'bond_slave_1\x00'}) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000540)=0x0) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@dev, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@dev}}, &(0x7f0000000680)=0xe8) (async) r7 = getgid() setsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000006c0)={r5, r6, r7}, 0xc) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r4, 0xc0385869, &(0x7f0000000800)={r4, &(0x7f0000000700)='\x00', 0xfbba317b67f4fda9, &(0x7f0000000740)={@_ha_fsid={[0x7]}, {0x7, 0x6, 0x80, 0x101}}, 0x2b, &(0x7f0000000780)={@_ha_fsid}, &(0x7f00000007c0)=0x8}) setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000840)={0x43, 0x3, 0x3}, 0x10) (async) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000880)={0x0, @in6={{0xa, 0x4e22, 0x80000001, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, &(0x7f0000000940)=0x84) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000980)={r9, 0x4}, 0x8) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x410000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a00)={0xf8, 0x464, 0x200, 0x70bd28, 0x25dfdbfe, "7f441a78d4f10ddfdd1b2a571f2705ebe606bd4544f7c297497c925835541e69a1dcb86754643d351770816df2a59f1801bb5d17d150f7b67b6d0382479b30789fc81d0f1c767010a60c59a4ec9093ed8404fdeae7c1aa2c9c70c7299346ce992047c005d5b189fa93641f0b8e7ae75b0d81b66603e7e7c2283c86adb4d7cf593a24cf005a1a67cbc2bae81666eadf09ee29e390389286cb3ad9632b4d1980dc114f778f8988dc109fe3b4400568c858d9cf7fe1f17a13b044266fb1d01b830510cc65bae21c2bb0b6c66fbd14a4050926c5ff822f01a8b12bab2b6214825694834f87d33b", ["", "", ""]}, 0xf8}, 0x1, 0x0, 0x0, 0x24000800}, 0x1) (async) ioctl$INCFS_IOC_PERMIT_FILL(0xffffffffffffffff, 0x40046721, &(0x7f0000000b80)={r3}) sendmsg$nl_generic(r8, &(0x7f0000001dc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x400008}, 0xc, &(0x7f0000001d80)={&(0x7f0000000c00)={0x1148, 0x30, 0x200, 0x70bd26, 0x25dfdbfc, {0x20}, [@nested={0x10b, 0x28, 0x0, 0x1, [@typed={0x8, 0x70, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @generic="dc9313009e5992f0ca425803c673a3f315796df436dfbd8b4137", @nested={0x4, 0x10f}, @nested={0x4, 0x10d}, @generic="d2ac414df15f54164ded3da041b1cfb3f427351b1cdb20669a240534e42a776af881f8d5e17463607175eaeecd4a38d9a5985ca87f62d4488d4dfd11789cbc78b0afce048c4b4be65f8fc02beaa378badfb0807f603347c1944ae10f343df1e7675f530038d9eb3db40d83325dbf64297d8a57c8caf9a054513106dd34a1b7fd5f92358aa34e5ba7d7679afdd2c99cacae096b0b06c95f6917e5fd59f79202ea08d15c7a7c3748d38b38a2aad52e03b440124ec0a5c8e61dc15ed29da91192813370b386e80bec05ad954b99407c2a725776a170fc5965da2c", @nested={0x4, 0x8b}]}, @nested={0x14, 0x0, 0x0, 0x1, [@typed={0x4, 0x99}, @typed={0x8, 0xd9, 0x0, 0x0, @uid=r6}, @typed={0x4, 0xa9}]}, @typed={0x14, 0xfe, 0x0, 0x0, @str=' \x00'}, @generic="220833e0bd2ba9da7d3b144f07e627de869b819ed8b295c5ddd1b29a69235738bcf997f000f80ee9bc23d2342d964f3aa6ba40402fd2e12a54feedf834f2e42ddbe82f8e57bc82ac15cc0508f8759b4945bc078658350cd24f04580313c560e74bf2403158f2de412e66b791f83b16e64f4e13d5936dc94bcf22f2a01317920bbe4746ffd7e28ee3f960a5977415e1085090f2218c523370b81dfacd628c342e8e0b8e1824cf4ed619afe768a23c3ea44dffedc9d6a2be4e45523d714c49bf0550c7233af16f2ee7c557ad7ceed92ba3f95bcb479f5b1ac29438465dc08cbd50402c5b7a0dc6ad506cdf16b5fd78e15de8f83da5a75ec062499171d4d27c39b9e09a95a5c28df074d1e5a06aa3163fc8e4b164359c66354fb7ad5e748eeff054b85848c3ecc911e9dc2abfef3baad527ebb120cc0b1cd42f4f5648d76812c1c7a49e3b38161047448ac674d8e7013d1c0781818b36d61f56f5a319021a711257c1f66bd68ae58058b9ae93192ffe68d8a12aa3c1b1b9262603c3b099a02d7907cdb6ae66d6cc47b488833075d370d7f7353bd29dc7a2dc2f374b92ab75a8b79905af2328ab30a08f18908594ca3556d0db3d14f9232a98ad403194e4c299cf408f56d04a4452d90722d08be01c2278c3ba91d971fa9738150487b67f1997eabd252dcb7ecd876706c842cd92f70009e7c398a2fcea0a1f132a98e8a9ba69c8120f659ab9b6a2a3f0e3d7aca7c9e362f4d2669086e297ea83a376e964b530c1a926bfe08954672db566a5858f2f71c38c147faff90224a132e81f151ef4057fccc538c58fc22c0d61dab085d1fba88566266aa43de752f4a38fae60264883825f253a613eb6dfb09c9209f221e8424f98f3439543881faa5d2a6b48fc3d863625d2391aa3b9bfa2e349d5f7de2ff0671fc20df6dd39b8f69cb3767c6468b89eb2df64ca295a4a4ef2fb3c538a2110f2fc550d367b5db802f0937193985a2b1ca1c31b6f6cec026cc714f7c28d20d87f1e8fa32b64b70d9ea92a14719ef8ae2e360b0090b054887a3175aa1e2a95fb9f3a4e184e58d101f82024c20f301f2b2f98f252b0c6cc39e139c212008ae6f90e1612fd2f705b75f0e9422149f9f188e8b3bbf5a181f6117eafdb51f2d73de0d3bb04f2077fe56f29c1edac03451cecc203b870f9bdc0af740e12fed41297d66368c502dd6dee838f57f24b84574d35626600bb1066cbd8c7c6883018043d874c67118970fda5eb2f684af17e8010d99608f13c06810d9a098688e95b83a712ad22d6f30626bf8eeff23a92ad60f0f1b80bbdfd460dee81fd8062274e6365a5d5a53460ef000079a14395153f6dfb3368b4f3c1e3c160dd10bb9e278ac396c304becb66dd202513296f8ac59163ba99e04dd43d090230ffc2262c5b8a450ecfa56372dd9e585230b7b27c075593d34c94a5ea7140fa88729011b0a957da6575fc0ad5064cd4f165e6216a57f7c324b5399d6ce34773c3357d12bacd01651b6a4ca34594679b182f27833691d10b6e289ef9e8d070d5074d75f203ba3ffa4625d3869b5b6ce3c7dfc29fa6fba78f7c5fe873cd5fbb940f9273722e9ff34e3bb02a34cd9042f2feb65c6a3c7195ce34fe307227f113c565d2a1950ecf80adf2d365ab87a03608a5aeccf1a59d08508926df735a9c82c952cdefc9a3bf63a9097657de76623b2e5fe2258c2fc34e96e7e805fae0959ea6e0b115334d873627b04bcc5cf788046be10b3a3a27e724c849cce8d6f7e60997e0c8f6724581a3c15321b8a25bcb1b43ba269c759ca8bff2fdac8285c83d07f9a2a122b3eed09277a4c549eab220ec9db28b6224824441b2058116bf26447339d75d2cfb192ce4179ba4d4c8409847ff8161dfa8272b6bf91449a057a4d645bb2493609c2d55bb66060e62ec11372842d6ff6d99b413ea5e2675bdc5d84b21391ca91885b1a7868e898a75fb70fdd0170a007bb5937898e5d72463e52a6e1139047c6637bc2e49d3af08ba35642e70f9348e938e4212149c99b5d71d1c815ef6b81abcdff07ab09f26ed8ea4763809714ce125e2152817b0de6bdc579a86c8070727a9aebd48c78b1e334f1684509343920f195f24cb0847014753bd98fe0a1106ea91c324826bcbdaf7efbfc9fd0cc925cfbb3004f2e294b20b2c769fa1d809c4b7a7fe9deb0c2597d252b6e6b83d077243e5b8c82e3e8dab0c793cab96e14c7ac347014c0d07d8750a3fe2250365994d00ccb7c0aa8f9eb07bf1a9064a9a77fe43880b03b1707ac9b9ad1334432e98ecdb45dda483e98fb29bb34d5d5131b1b567111d430cee50d4228093cc2520139e03ca82dca86aaa43c227e1deb870934d8713358295ddb34f23c7a97a920a2a682b009dc88d3ab7fb4d01a205d5047746a9819749810c5bc16c3b7279896526d57bb963da980a2cff0f605c0331cd1903bf5454810976526108a0aae7dd79c6bd6391e5205216fb894fa677079715f81634a4282fa579fa1a66f2db5ece06afc0d2dc37602dd2f5f2b96b495c4cc75e9714985ef0679beb0a09eaa2d8dacf38ecea43d6c1eb81f30e9dcc324c855f1eb98877323ffe56eed9776871c4b002c258b5fe6ee970d551a55ee037c82f9a456243731239646be3bf691d4c75218d549e9bb925b3c3a46e264b3f76503c3cd13a0f8f34ad36fa8d54fb85666e4aeee43c178c936185bef4d2eae2a6d8405ef770cbffe3aec0bf064f188b687a25b7f2f52c2f3a61ee8ff1fdf07a6c7fc04e2ebec8c82ef284f440c55e3a12d92e18da77b34336aa34e033d07f3214be9ac281cfee006a0b602693b7740ad159d349d7197f75e7cc1aee4e76c4eecb18f9167d43239b4e146926c50344840aa678914987a9c2e73a434112aff1840f5cbcc4bfc97db1cdb110ccf9e2815ee18265be1340bcf7ae8708187a56e7618528a1e1d75f9698011e8876a0275eb35083e0c9f12dd3e89cfe484557352c34016fcec108ade97822f1543cb049941eaa35d4f9bf141d7477041bf81defebe0bdee4e2b520b46995610c0e83b407801252e8e44af151fc75762ebc4a599ce3830fc4f9769a88419d8a0695d34fe12cd08a93dd9abf73d82c08e3e5e708140c191b2149db6367e3833ecd26858abab04afafad593a0a03a66cb1dc13a6dc78ac98630bdfcd4288d187429884b4555113fe39deae61859a70dd13760a6a56df56e889ca67975f2cb4f77caacd3d723e6e695d23247ea944c064db4e20211304e68ae0aaf0d7f309400c69479e037feb64fd98c1e39a3a83e08b65bc3dcb0842dd61134f7fc2d3941179b7fe5a7983f6914862a2689f3bf17cb854358400efcdd5bbe898d9df26d2fb1741774260be280793cf767e82db8a21d950c4492f69b4de7af7fc3290d4ad7c65dfa0060327d98eb898be87183c4f1c5b4292b3f6d90dab4eaa8dacfd388c520656b8da9d1d023ffce0ff12ef1fa6f3024976ba0292de49953844833cef6a4fbb24f9211dda9f8d37b340683c51efa4ebf690408fa3eb2155ebeb7e9349993753a3ac6968a261df1ae252f01ce5cf1c330c018c569f38f7eb3f98d61e2c857d1f9dd37c5a82e147d00e40bc5dc48f6715e60b9bcb2eecaaed29ab51e2477172b3e8cf8fe5804d17c0b8f885688a373feb40497a6f82b1ff23985a43b2883aedecec8b4ff440131437355c279841487bdd93a54cd13e72c1aa42781facc2d64090217afa874474d87b3479e26188e8ba355b828af25242376350943548ff8d57d3e91cbd2cb0c89560e0b510724dcc5b046df81b5ceb885eb7597a95e6aed4513be4b833da548c5e2e2e737fdad02029514e9c100fca5203aecba207c0d998c9e45786260397b1897f693104985a64e254d61d171009ba5c7c85de937482eb46b4abdecc8108a51050e32f9a93b310f19a3f68520336da91dc697abc99a0fea7bd9c69358a696c40a1291944ce5baf450c5dfc44fe9a4473fae5acf6f2dbfcc253e84e644777329c599b83e55ce5edde238ffc766b5e2ce57acb98c5c7f05cbe8283c5fed0c196b0390146bcc84df9170062f7f5a5d396fb9d029df487c5f540f88761e3be0facdb1fcd66f7c8f0833a1cdf419c0d8c2bffb8252450d66ac9f5237dfa8609deb640cf24332f6fcbe019bc8f26e7c56f8e29a8b05f77e3065e451302c8719f537dd1c159c219d0d82a8da57068b922a8294846c70852a5adcc386ac991fdce37d1e5d3254a24e34afa7119a8a1b590b8752b807b9cc1d846d7c9c2f5dc213eea9872f43a0cf6cfc49f4688475fd5a58eb3f3bbde902cd3200617475319056f0676d772db7c69dc3f9301f133576cc869b20278e6ad553339ab6a6a057f191e9d287b263a4ee848e27fe8b8e428dd0732998787451a172ff61d4181cff96518cd3e46c8cdbcb5aa960d8fcb83101c9d08b982efd1d865e84eca19b5d4df5178871b670adebffab8162c0b2604232d11abba9a05cb1f483e3a623623ec6f271c5aa3ebb8b0ab8ddb0daab4356cf76a08bbddd9d92a67e6b7a9b9cc0548df1a28d883c65f05d7f7b82b823cd8b84f99b01115271339796edca618bbae1f6bf0fe9780a57cc0a969db8e670194ed53844f116f3535675a922370a1cd5a3666cd65584ed50b358c0f0fa4a1db37ba11390cc7484fcc6ed0f3a4a415da2a417a3a2932ece2222e5d6bfdf4495866e36329cfc10925a214e33d437409785977595b0379f2316ca9ea45af971b0041881d8f23d8f9a40104cdc26b3328349496b0a9e6ac43e96bb6e0aecb3fe7b881e922fd9cf35f1ab0428a5555a93eca2c34b89a850a495aab0915a6c19894d777b118ddecbdfa154db6d5b2d6b4d880f475686ba44447133588b07c2e2c1886c62062db8649401eb75075727e38cc2c38fb6ac72b9f6c17db1fe63033b1c1ba2efc3e85eebed421c8fcf95ebdae6c7bc33a9c0da95dec34f57a31415e5fe1349af0bb787d299638cba11180d4a4838a7f8f735c6206513e596897c95e04895e5d811d2c3df482f6866aac6f166eeab4ddff2cb08c899809a98f88a0ccce31ba4b93fa9de2537a33a92b810318c92db421f8e13260a1a6dc4aec39c6873de62321fb2ce91378a472ad096bc38b8661def51ea95b79bc4beedf0dfb9d870a79b17cf36b55389aa0fec8fbe3b3ced2572f0b9aef910312cad1f62dac6695e9ab2ffd83a18004380cc141595e49df6c03fedcf6cb367a143820509b9f1d94569d91641c53709d3ecccf594fa0e0724c6e9956bf857ba8c59009ec740520098bc797af481808cfe5215be8b485cf7ffeca768e0e4db70c0a26df0088f7b275e9ba927fe767aeb963f7f1ff15c3707bc19604210a17d8d320154fe8762eed8d7e59b9f776fa7c1840e02a69c14e4f7317d08fa73c9c4605c0bae1fc5e62659b99aac26d2c98ddc1a1b1ac4322fd6447e48adfd9b683f93563f9f7f353945d9280cbc1a1747c3043cfd6dc44a47f5c37290b415987c99242614eb0a839187b672d6298990657b623c20c185caf009f429ce5a4f2f62e9588257cc32d2567e0a7182abd136fc3bf530c386ce5d96af0db9e6105a757dea4faf66a796b2b9f0ee0fb6c4487f986ef0e74b93a251e5e0a51bd8b312714c6391ce028378639fd6b1f5a04ef8378bc216e08df404b76c95bca4855f3cc68e29d13183fcd64fe5a466713d54128a6eb397406207396d53acd674d69ae07e8520cf201772c7ab091f19c94475d2583e69e21143fcc9f5ee9ac255aaa91b5623d261b8457bc4a4ff2820034d1ff8be5c18a04d9e283de"]}, 0x1148}, 0x1, 0x0, 0x0, 0x1}, 0x8004) (async) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r8, 0x84, 0x74, &(0x7f0000001e00)=""/4096, &(0x7f0000002e00)=0x1000) (async) connect(r3, &(0x7f0000002e40)=@l2={0x1f, 0x5, @none, 0x80}, 0x80) (async) getsockopt$inet_sctp_SCTP_MAXSEG(r8, 0x84, 0xd, &(0x7f0000002ec0)=@assoc_id=r9, &(0x7f0000002f00)=0x4) (async) bind$802154_raw(r0, &(0x7f0000002f40)={0x24, @short={0x2, 0x1}}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r10, 0x8933, &(0x7f0000002f80)={'batadv_slave_0\x00'}) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000002fc0)={0x43, 0x4, 0x2}, 0x10) (async) r11 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r11, 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r8, 0x0, 0x489, &(0x7f0000003000)={{0x87, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x2, 'lblcr\x00', 0x34, 0xfffffffb, 0x78}, {@multicast2, 0x4e20, 0x1, 0x8, 0x81, 0x8}}, 0x44) 2.04718607s ago: executing program 0 (id=5028): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r4 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_TDLS_OPER(r4, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000006900010028bd7000ffdbdf250000000000000000080001000000000058d5b97c0beb3820aec9da56bd760965b643efabdd4aa9f8c1b3b7"], 0x20}, 0x1, 0x0, 0x0, 0x40c00}, 0x800) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="480000001400090528bd7080faffffff02186d00", @ANYRES32, @ANYBLOB="08000100a21414280800040064010100120002007f00000108000400ffffffff08000a000400000008000200ffffffff"], 0x48}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[], 0x70}}, 0x20008084) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000019200)=@ipv6_newnexthop={0x24, 0x68, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x0, 0x2}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x6, 0xf2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4044cc2}, 0x0) connect$inet6(r3, &(0x7f0000000080)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac7108e004000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) r10 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd68c8afe300642f01f0128bfe8000000000000000000000000000bb00000000000000000000ffff640101012f02000000000000000100e02934070708000000020009af0e000000000000000421880b000000080088be000000041102850e010000000000000a080022eb000000022e7f2f09020000000000000300080c1b0800655800000002"], 0x0) bind$inet(r10, &(0x7f0000000140)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) connect$inet(r10, &(0x7f0000000080)={0x2, 0x0, @multicast2}, 0x10) sendmmsg$inet(r10, &(0x7f0000004d00), 0x3fffffffffffe8f, 0x4000f50) 1.820350942s ago: executing program 4 (id=5029): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="2300000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x79, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ffff900000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000000f"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000005c0)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x3, 0x80000001, 0x2e, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @empty, 0x20, 0x8, 0x100, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000240)={'syztnl2\x00', 0x0}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="340000004100070128bd7000f6ffffff017c0000050042800c000180060006000a000000100002800c00080000000180"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000000000000000000f9000065e35ab9375fb14406000000fca8d71a5b0691cd41384d639b174fd8277ce541946fc8bdcd03c1b38216926d9a0076789cbe", @ANYRES16=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b704000000000000850000005700000095"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x13, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x14, &(0x7f00000009c0)=ANY=[@ANYRESHEX=r6, @ANYRESHEX=r3, @ANYRES8=r5], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5e, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, 0x0, 0x0) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000cc0)=[{0x0, 0x0, &(0x7f00000003c0)}], 0x1, 0x600008d0) recvmmsg(r9, 0x0, 0x0, 0x40000140, 0x0) sendmsg$MPTCP_PM_CMD_REMOVE(r9, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x110}, 0x240400d4) write$cgroup_int(r4, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[], 0x0, 0xfffffffffffffe1b}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="020000000400000008000000800100e10080004000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r10, @ANYBLOB="000000000100"/28], 0x48) mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r4, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xba0c29e690d41d4b, 0x20000000ec071, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) 1.732210357s ago: executing program 3 (id=5030): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/11, 0xb, 0x1, 0x0}, &(0x7f0000000380)=0x40) r0 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000500)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000540)='blkio.bfq.io_queued_recursive\x00', 0x0, 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, 0x0, 0x20040008) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000340)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020080ffffff18000000fffffffe00000000000000009500040000000000360a020000001000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff00000000850000000600000095"], &(0x7f0000000280)='GPL\x00', 0x2, 0xda, &(0x7f00000005c0)=""/218}, 0x94) 1.653798433s ago: executing program 1 (id=5031): socket(0x21, 0x80000, 0x9d) socket(0x1d, 0x2, 0x6) unshare(0x20000400) r0 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$inet_mreqn(r0, 0x6a, 0x24, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3b8, 0x0, 0x98, 0x130, 0x1c8, 0x288, 0x0, 0x98, 0x130, 0x288, 0x320, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@ecn={{0x28}, {0x1}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32, @ANYBLOB="e0ff8b0a"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000047000701feffffffffffffff017c0020380004804e2d30"], 0x4c}, 0x1, 0x0, 0x0, 0x4048011}, 0x2000c000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x1b, &(0x7f0000000940)=@framed={{0x18, 0x0, 0x0, 0x0, 0x804, 0x0, 0x0, 0x0, 0xe0000000}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xb}}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x80000003}}]}, &(0x7f0000000040)='GPL\x00', 0xa, 0x1000, &(0x7f0000000cc0)=""/4096, 0x40f00, 0xc}, 0x94) 1.21594342s ago: executing program 4 (id=5032): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'veth0_macvtap\x00'}) socket(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) syz_emit_ethernet(0x46, &(0x7f0000000400)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x4, 0x38, 0x80, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x6, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x67, 0x0, 0x0, 0x89, 0x0, @rand_addr=0x64010100, @remote}, "00186371ae9b1c03"}}}}}, 0x0) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f00000003c0)={0x2, &(0x7f0000000180)=[{0x26, 0x0, 0x3, 0xfffff033}, {0x36, 0x4, 0x2b, 0x7}]}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0) close(r3) socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x4, 0x5, 0x3, 0x0, {0xa, 0x4e23, 0x9, @mcast1, 0x97}}}, 0x80, 0x0}, 0x2000f765) ioctl$SIOCSIFHWADDR(r3, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="0100"}) write(r2, &(0x7f0000000000)="240000005800410f9c00f4f90085b3a85c91fddf080001000501f97305ef7f66845a009f", 0x24) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SPLIT(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r6, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x1}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40080b1}, 0x8000) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00'}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) mmap(&(0x7f000074b000/0x1000)=nil, 0x1000, 0x1, 0x8010, r7, 0x2000) read$alg(r7, &(0x7f0000000280)=""/33, 0x21) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2b}, @void, {@ipv4={0x800, @dccp={{0x7, 0x4, 0x1, 0x8, 0x2c, 0x68, 0x0, 0x5, 0x21, 0x0, @rand_addr=0x64010102, @multicast1, {[@rr={0x7, 0x3, 0x62}, @rr={0x7, 0x3, 0x65}]}}, {{0x4e20, 0x4e21, 0x4, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6, ':S+', 0x2, "81b549"}}}}}}, 0x0) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r8, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r9, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) getsockopt$IP6T_SO_GET_INFO(r9, 0x29, 0x40, &(0x7f00000001c0)={'raw\x00', 0x0, [0xfffffffd, 0xe04cbfd0, 0x2, 0x8, 0x6]}, &(0x7f0000000240)=0x54) socket$nl_generic(0x10, 0x3, 0x10) 1.215615609s ago: executing program 3 (id=5033): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4000000000000007910900000000000c3000000000000009500000000e10000a45c8b106d45385a1964b904e462de529745a4cd61a7a0d25ddfd38b8b9a36c14ae1ee5ae29051b28b53a4182deb5ae03bc2644f3f168925abb901765f30c1d039e73af80f39ba982e44fe40c17211db9c82e6da61712f41775115599d65c29cfcd0bffd10d2c62aebfbf41dd375c71938ddfaa1df3117a99ecbddbfee7f7abeba22c29a9cb001001079a87ed58d2cbaf30b8fc3b5fd11e6ca750a6dc5dba2cd1d9fed1fb63bafef7d7bdd5bad81e40379623de9000000000054395605e46e00ded1acb26f8fa9c2702a8aac94fcbbdd2fbbba184bc337d5cb0c04a788fd76b402d5229125c274b171290fdfb32d00504a2a4f797a0103b19a04911e2ab1f208858be1873ee684e45ce2dd5de070f1aabdaa2de7edcbd27f403caffe57995b4e2d914a3c5b9bcf7ba242d1ed391d564b18b3de9c1db2b9232c5e"], &(0x7f0000000080)='syzkaller\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x36c}, 0x48) 1.041324543s ago: executing program 3 (id=5034): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d0301000000000007020000ffb00000bc26100000000000bf67200000000000160200000fff07006702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb0}, 0x48) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {&(0x7f0000000300)='l3', 0x2}], 0x2}], 0x1, 0x0) r2 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r2, &(0x7f0000000080)={0x18, 0x2, {0x2, @dev={0xac, 0x14, 0x14, 0x2a}}}, 0x1e) r3 = socket$xdp(0x2c, 0x3, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)=@migrate={0xa0, 0x21, 0x1, 0x70bd25, 0x25dfdbfb, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@loopback, 0x4e22, 0x7, 0x4e20, 0x0, 0x2, 0x40, 0x80, 0xff}, 0x0, 0x1}, [@migrate={0x50, 0x11, [{@in6=@private1, @in6=@private0, @in6=@loopback, @in=@local, 0x3c, 0x1, 0x0, 0x3500, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4040010}, 0x8000) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x800, 0x0, 0x1}, 0x20) 871.100443ms ago: executing program 0 (id=5035): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet(0x2, 0xa, 0x265) r3 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r3, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000600)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x10}, @local}}}, @ip_retopts={{0x14, 0x0, 0x7, {[@ra={0x94, 0x4}]}}}], 0x38}, 0x0) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="80000000"], 0x80}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e003000028008000100100000001000", @ANYRES32=r7], 0x68}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r5, &(0x7f0000002ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0xfffd, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x22, 0x1c, 0x69, 0x0, 0x60, 0x2, 0x0, @empty, @broadcast}, "14f3305280f125e6"}}, 0xfdef) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r9) sendmsg$NLBL_CALIPSO_C_REMOVE(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r10, 0x4, 0x70bd25, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) sendmsg$NLBL_CALIPSO_C_ADD(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r10, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x4000010) socket$netlink(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="540000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000fe0f00001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r10], 0x54}, 0x1, 0xba01, 0x0, 0x4004}, 0x4000000) 730.759963ms ago: executing program 3 (id=5036): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000760000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c00028008000140000000ffffffff800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006c6173740000000004b6028008000340000001"], 0xe4}}, 0x8000) 374.635232ms ago: executing program 3 (id=5037): bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) r2 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000440)={r2, r0, 0xfff, 0x60, &(0x7f0000000240)="717f41beb198724aae10f5c1da24eea565a02b989d78b514dc9fc04fdbb4b8dc89eba88532b57c858db5ac0e98c882d964fa53bbcca8d1575e6e08af7aee788f17f6bbd4513606acb28f69e4f70ae25c69d9de96da6e8e8ff5b7e3e8fed94342", 0x2, 0x2, 0xc3e, 0x5, 0x3, 0x2, 0xfac, 'syz0\x00'}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={0xffffffffffffffff, r1, 0x25, 0x0, @void}, 0x10) 372.013296ms ago: executing program 4 (id=5038): socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f00000014c0)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1200000004000000040000001100000000000000a3cf91dca63a6cd49dd0cf349a5b16def1297a8b8d6fc3fffebd9452e2a41b905bf45f376388fa786131196555f9cd45498e75cdd093c3174e9d924cf4a4f43cfa7fb40a", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="220000000400000010"], 0x48) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r4}, &(0x7f0000000140), &(0x7f0000000280)=r3}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r4}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000030000000b702000014000000b7030000000000008500000008000000bf092000000000003509010000000a009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r2, @ANYBLOB="0000000001000000b7050000080000001c00000000000000bf980000000000000d08000000000000850000001b300000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 276.216882ms ago: executing program 4 (id=5039): r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r6, 0x1, 0x4, 0x1, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0xa0, r6, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x800}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffffff78}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e23}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x40fc}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7190}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xfc00}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xf9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xdf}]}, 0xa0}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000010) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f0000000440)={0x0, 0xa1ff, &(0x7f0000000400)={&(0x7f0000000280)={0x34, r2, 0x1, 0x0, 0x25dfdbff, {{}, {}, {0x18, 0x17, {0x0, 0x0, @l2={'eth', 0x3a, 'team0\x00'}}}}}, 0x34}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a300000000048000000030a01040000000000000000020000000900010073797a30000000000900030073797a30000000001400048008000140000000030800024000000000080005400000000198000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000006c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c0003006c6f"], 0x128}, 0x1, 0x0, 0x0, 0x20040004}, 0x40000) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_HARDIF(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r8, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x0) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000040)={0x28, 0x0, 0x0, @host}, 0x10) 161.261407ms ago: executing program 3 (id=5040): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x3, 0x4, 0x8}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000780)={{r0, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000740)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000013c0)={r1, &(0x7f0000000800), &(0x7f0000001400)=@buf="04e25ba54a5058e2ae56545561eda003cfe1c818493b4c79fc7b", 0x2}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000001240)=ANY=[@ANYRESOCT, @ANYRES8=0x0, @ANYRESHEX=r1], 0x50) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000000240)=""/4072, 0xfe8, 0x0, 0x0}, &(0x7f0000000040)=0x43) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newsa={0x14c, 0x10, 0x713, 0x70bd26, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x33}, @in=@dev={0xac, 0x14, 0x14, 0x11}, 0x4e22, 0x0, 0x4e23, 0x3, 0x2, 0x0, 0x0, 0x3a}, {@in6=@remote, 0x0, 0x32}, @in=@multicast1, {0x0, 0x0, 0x8, 0xa, 0x6, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x2, 0xfffffffffffffff8}, {0xc, 0x0, 0x20000002}, 0x70bd29, 0x0, 0xa, 0x1, 0x0, 0x28}, [@algo_aead={0x4c, 0x12, {{'rfc4543(gcm(aes))\x00'}, 0x0, 0x80}}, @tfcpad={0x8, 0x16, 0x2}, @iptfs_drop_time={0x8, 0x24, 0x10}]}, 0x14c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r7, r3, 0x25, 0x0, @void}, 0x10) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000300)='0', 0x1}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x4}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xb6) r8 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r8, &(0x7f0000000040)={0x18, 0x0, {0x4, @remote, 'gre0\x00'}}, 0x1e) ioctl$PPPIOCSMRU(r8, 0x40047452, 0x0) r9 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000001280), &(0x7f0000001300)=0x60) ioctl$XFS_IOC_SCRUB_METADATA(r9, 0xc040583c, &(0x7f0000001340)={0x21, 0x4e, 0x0, 0xe, 0x4}) syz_emit_ethernet(0x11, &(0x7f00000005c0)={@random="cd25bedc5420", @empty, @void, {@x25={0x805, {0x0, 0x9e, 0x1}}}}, 0x0) 88.233442ms ago: executing program 2 (id=5041): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000840)={&(0x7f0000000140)=@in={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000740)=[{&(0x7f00000001c0)="31ba98f8776bb1783e53", 0xa}, {&(0x7f0000000200)="c1e8a79dd94a348cea6cbbd07705c5ade4902b3274c264f16cabb3eb1f83ada47503e0d2c4b2ad5bb963bf2c80bb9622ab6b29b70eebbed35d", 0x39}, {&(0x7f00000002c0)="22a2e49f59f5063146a1050538158e371041dc84b4e55225a5478d50faa78ce5f2d9e40492083c455909d88266aa895b1037fdee3942dd6a517fa232448357dafca9d614ade140cfaccde71e8d6351a7b67e", 0x52}, {&(0x7f0000000340)="6807cb1d0dc3c6ac6ebd2510234f602177191c3026812d776a53182eb7dca079383940714b2d140660c73e5ed9110b8d27430349281211b2221db7cdc3f676f2b363bac8b5f4a344c42243aa918a3abd4ab5eb6720beb2854cb926220feb191fd9b39b9892b9157f010cc1ad7ddd304ebd9dc17fc3a2c4c660780eda5323c5dbc855ff35c0ba6ef9ebfd7e84671a5b3d9c15416a0e8b7c9b2a655527e1a6958bb8a5184857dec6f7770f5a0ed11553389155fa50e7aa26971d90d3092491bc2da0d2ca37a6beeb0c9c5666c4f254ce352b3cb2", 0xd3}, {&(0x7f00000004c0)="919740b5a58bf82bd1deb8494965224f06b391f264ba2ec9a0c281ba7849aa6c1c4230a4c730355861f493a9bbde64fbb5e39d02f41390e941e2b132a2280181019e0c0da31bb6d2860ce5ea4b97f3cfeaf6616b0aea988161e652310a786268c514427b3d16e254a5b5d6d2b0", 0x6d}, {&(0x7f0000000540)="25b639c455583d135851192d1c3682c8a4c748c55520a95c7b1e52ee389e364023931a551b76b9452785a025bccf661b22da7f8220e9b84be04b5356da75a9cf602b3039a46a70640a2f023e57da18c7c8dedf243477def2d97006c15646b577bfe378591adfbced814a50488a9da2ccb18f32bafdc99aff387b42c30f92485f16d7105ce470715e53a5d53dac146c33a957c86dce6b8a9f395f605db075eb12da3c4a2cd428389da0d5bf8b0dfc137d096972bd72205150750bec38c964087dca4fc282c76a15d5b157fac4ef5ce46a33ca72d41336ef159e2635d7d7eab5517ca92bf2", 0xe4}, {&(0x7f0000000640)="bb648f492a44556f7636957fbc7b42e887bba3c4bc828a1b94ad496b1c77e7edf70186f5a67e7da225728908e07bd4af51e7c058e44a29f9487413846ed5796f0a7ef3376f1f5e2063b88ee63383d35359be60bee09707fd7a2183a2bee1fafbc4d8088f569f0287ba828249e8066860e657bd93bd060ccebb0b8c0122cfc60218b02426f228760567fc0b9c9f7c2acad60c5bfeece11c57b74cb29bf3677ba6cb4ef6190442d3350c2577501e363794363a1cfad5736cceda2c945447f23685e6ddd674a2c7bf0067ad04a29f54b6cfce28597bd7d365dad9758079cdcb4335a4890761e789b10f2f14e8e0968cecfcd2035229c5fc961bcf77d021d99905", 0xff}], 0x7, &(0x7f00000007c0)=[@init={0x18, 0x84, 0x0, {0x0, 0x800, 0x1, 0x1}}, @sndrcv={0x30, 0x84, 0x1, {0x4, 0x7, 0x20c, 0x10000, 0x5, 0x53e7, 0x10001, 0x7}}, @prinfo={0x18, 0x84, 0x5, {0x10, 0x4}}], 0x60, 0x8080}, 0x20000014) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'vlan1\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x3951d, 0x4b7bc}, [@IFLA_MASTER={0x8, 0xa, r4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004854}, 0x8000002) bind$xdp(r0, &(0x7f0000000000)={0x2c, 0xe, r4, 0xd, r1}, 0x10) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4000014}, 0x4000054) ioctl$AUTOFS_IOC_ASKUMOUNT(r2, 0x80049370, &(0x7f00000000c0)) 0s ago: executing program 0 (id=5042): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="2300000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x79, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ffffb00000bfa100000000000007010000f8ffffffb702000008000000b703000000000780850000000f"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000005c0)={'syztnl2\x00', 0x0, 0x29, 0x4, 0x3, 0x80000001, 0x2e, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @empty, 0x20, 0x8, 0x100, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000240)={'syztnl2\x00', 0x0}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="340000004100070128bd7000f6ffffff017c0000050042800c000180060006000a000000100002800c00080000000180"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000000000000000000f9000065e35ab9375fb14406000000fca8d71a5b0691cd41384d639b174fd8277ce541946fc8bdcd03c1b38216926d9a0076789cbe", @ANYRES16=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b704000000000000850000005700000095"], 0x0, 0x100, 0x0, 0x0, 0x41000, 0x13, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x14, &(0x7f00000009c0)=ANY=[@ANYRESHEX=r6, @ANYRESHEX=r3, @ANYRES8=r5], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5e, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, 0x0, 0x0) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000cc0)=[{0x0, 0x0, &(0x7f00000003c0)}], 0x1, 0x600008d0) recvmmsg(r9, 0x0, 0x0, 0x40000140, 0x0) sendmsg$MPTCP_PM_CMD_REMOVE(r9, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x110}, 0x240400d4) write$cgroup_int(r4, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r4, 0x0) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000780)=ANY=[], 0x0, 0xfffffffffffffe1b}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="020000000400000008000000800100e10080004000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r10, @ANYBLOB="000000000100"/28], 0x48) mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r4, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xba0c29e690d41d4b, 0x20000000ec071, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) kernel console output (not intermixed with test programs): peed/duplex [ 587.942812][ T1145] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.943006][ T1145] netdevsim netdevsim0 netdevsim3: unset [0, 1] type 1 family 0 port 4352 - 0 [ 587.943028][ T1145] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.943059][ T1145] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.943081][ T1145] netdevsim netdevsim0 netdevsim0: unset [0, 1] type 1 family 0 port 4352 - 0 [ 587.943103][ T1145] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.943140][ T1145] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 587.943161][ T1145] netdevsim netdevsim0 netdevsim1: unset [0, 1] type 1 family 0 port 4352 - 0 [ 587.943181][ T1145] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.964910][T20189] FAULT_INJECTION: forcing a failure. [ 587.964910][T20189] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 587.964941][T20189] CPU: 1 UID: 0 PID: 20189 Comm: syz.0.4140 Not tainted syzkaller #0 PREEMPT(full) [ 587.964962][T20189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 587.964974][T20189] Call Trace: [ 587.964982][T20189] [ 587.964990][T20189] dump_stack_lvl+0xe8/0x150 [ 587.965024][T20189] should_fail_ex+0x410/0x560 [ 587.965050][T20189] _copy_to_user+0x31/0xb0 [ 587.965082][T20189] simple_read_from_buffer+0xe1/0x170 [ 587.965114][T20189] proc_fail_nth_read+0x1bb/0x230 [ 587.965144][T20189] ? common_file_perm+0x20e/0x2b0 [ 587.965169][T20189] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 587.965200][T20189] ? rw_verify_area+0x24a/0x4c0 [ 587.965228][T20189] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 587.965255][T20189] vfs_read+0x213/0xa80 [ 587.965285][T20189] ? __pfx___mutex_lock+0x10/0x10 [ 587.965310][T20189] ? __pfx_vfs_read+0x10/0x10 [ 587.965338][T20189] ? __fget_files+0x2a/0x420 [ 587.965366][T20189] ? __fget_files+0x3a2/0x420 [ 587.965389][T20189] ? __fget_files+0x2a/0x420 [ 587.965425][T20189] ksys_read+0x150/0x270 [ 587.965454][T20189] ? __pfx_ksys_read+0x10/0x10 [ 587.965490][T20189] do_syscall_64+0x166/0x520 [ 587.965511][T20189] ? trace_irq_disable+0x3b/0x140 [ 587.965530][T20189] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.965549][T20189] ? clear_bhb_loop+0x70/0xc0 [ 587.965571][T20189] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.965589][T20189] RIP: 0033:0x7faed4d5e98e [ 587.965607][T20189] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 587.965621][T20189] RSP: 002b:00007faed5c1ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 587.965641][T20189] RAX: ffffffffffffffda RBX: 00007faed5c206c0 RCX: 00007faed4d5e98e [ 587.965655][T20189] RDX: 000000000000000f RSI: 00007faed5c200a0 RDI: 0000000000000008 [ 587.965666][T20189] RBP: 00007faed5c20090 R08: 0000000000000000 R09: 0000000000000000 [ 587.965678][T20189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 587.965688][T20189] R13: 00007faed5026038 R14: 00007faed5025fa0 R15: 00007ffe41764cf8 [ 587.965718][T20189] [ 588.069676][ T1145] bond1: (slave bridge3): failed to get link speed/duplex [ 589.011001][T20219] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4146'. [ 589.253999][T20228] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4153'. [ 589.329730][T20230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4154'. [ 589.329759][T20230] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4154'. [ 589.356052][T20232] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4155'. [ 589.359052][T20230] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4154'. [ 589.440128][T20230] team0: Port device team_slave_0 removed [ 589.499879][T20240] netlink: 'syz.3.4158': attribute type 3 has an invalid length. [ 589.521110][T20235] syzkaller1: entered promiscuous mode [ 589.521133][T20235] syzkaller1: entered allmulticast mode [ 589.545981][T20230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4154'. [ 589.561913][T20230] vlan3: entered allmulticast mode [ 589.900569][T20251] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4162'. [ 590.122171][T20255] netlink: 'syz.3.4165': attribute type 30 has an invalid length. [ 590.233239][T20264] bridge_slave_0: left promiscuous mode [ 590.236286][T20264] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.309219][T20272] netlink: 'syz.4.4168': attribute type 2 has an invalid length. [ 590.462944][ C0] net_ratelimit: 13 callbacks suppressed [ 590.462969][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.601753][T20275] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 591.302831][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 591.455517][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 591.562702][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 591.634618][T20307] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4173'. [ 591.644454][T20266] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4167'. [ 591.673406][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 591.785028][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 591.893801][T20313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4171'. [ 591.894180][ T4933] Bluetooth: hci2: link tx timeout [ 591.894380][ T4933] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 591.903789][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 592.012798][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 592.126962][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 592.232746][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 592.688909][T20345] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4181'. [ 592.791368][T20353] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4187'. [ 592.927610][T20357] gretap2: entered allmulticast mode [ 592.931903][ T899] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.931925][ T899] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.990845][ T899] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.990866][ T899] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 593.319991][T20369] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4192'. [ 593.549761][T20381] bond2: option min_links: invalid value (18446744073709551612) [ 593.549790][T20381] bond2: option min_links: allowed values 0 - 2147483647 [ 593.575741][T20381] bond2 (unregistering): Released all slaves [ 593.983174][T19738] Bluetooth: hci2: command 0x0406 tx timeout [ 594.188092][T20397] netlink: 80 bytes leftover after parsing attributes in process `syz.0.4202'. [ 594.323332][T20405] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4206'. [ 594.323354][T20405] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4206'. [ 594.323379][T20405] netlink: 'syz.1.4206': attribute type 6 has an invalid length. [ 594.324338][T20405] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4206'. [ 594.324356][T20405] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4206'. [ 594.324388][T20405] netlink: 'syz.1.4206': attribute type 6 has an invalid length. [ 595.203047][T20425] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 595.278921][T20425] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 595.469521][T20438] netlink: 'syz.1.4216': attribute type 4 has an invalid length. [ 595.513781][ T899] net_ratelimit: 26 callbacks suppressed [ 595.513803][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 595.556623][ T899] IPVS: starting estimator thread 0... [ 595.557916][T20437] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20001 [ 595.629432][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 595.644129][T20439] IPVS: using max 31 ests per chain, 74400 per kthread [ 595.823131][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 595.936727][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 596.044262][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 596.222844][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.375417][T20458] bond5: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 596.415545][T20458] bond5 (unregistering): Released all slaves [ 596.572814][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 596.682986][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 596.793412][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 596.908958][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 597.203537][T20489] __nla_validate_parse: 6 callbacks suppressed [ 597.203558][T20489] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4239'. [ 597.470550][ T31] audit: type=1804 audit(1789810958.226:11): pid=20500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4240" name="/newroot/233/cgroup.controllers" dev="tmpfs" ino=1207 res=1 errno=0 [ 597.471357][ T31] audit: type=1800 audit(1789810958.226:12): pid=20500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4240" name="cgroup.controllers" dev="tmpfs" ino=1207 res=0 errno=0 [ 597.666479][T20511] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4244'. [ 598.796575][T20536] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4255'. [ 598.897138][T20542] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4260'. [ 599.148655][T20545] netlink: 'syz.1.4259': attribute type 1 has an invalid length. [ 599.553430][T20545] 8021q: adding VLAN 0 to HW filter on device bond8 [ 599.654489][T20572] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20001 [ 600.095153][T20577] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4266'. [ 600.483176][T20593] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4272'. [ 600.483202][T20593] netlink: 2 bytes leftover after parsing attributes in process `syz.0.4272'. [ 600.657510][T20602] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20001 [ 600.715719][T20596] veth2: entered promiscuous mode [ 600.733566][T18671] net_ratelimit: 28 callbacks suppressed [ 600.733585][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 600.797631][T20605] syzkaller0: entered promiscuous mode [ 600.797655][T20605] syzkaller0: entered allmulticast mode [ 600.842967][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 601.092635][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 601.293113][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 601.311587][ T31] audit: type=1804 audit(1789810962.066:13): pid=20618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4280" name="/newroot/173/cgroup.controllers" dev="tmpfs" ino=890 res=1 errno=0 [ 601.311638][ T31] audit: type=1800 audit(1789810962.066:14): pid=20618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4280" name="cgroup.controllers" dev="tmpfs" ino=890 res=0 errno=0 [ 601.330104][ T31] audit: type=1800 audit(1789810962.086:15): pid=20618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4280" name="cgroup.controllers" dev="tmpfs" ino=890 res=0 errno=0 [ 601.493146][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 601.519978][T20627] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4285'. [ 601.520004][T20627] openvswitch: netlink: Flow key attr not present in new flow. [ 601.606935][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 601.652975][T20621] syzkaller0: entered promiscuous mode [ 601.652999][T20621] syzkaller0: entered allmulticast mode [ 601.712701][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 601.923590][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 601.982853][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.054271][T18671] IPVS: starting estimator thread 0... [ 602.054819][T20639] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20001 [ 602.145421][T20640] IPVS: using max 35 ests per chain, 84000 per kthread [ 602.229342][T20646] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4291'. [ 602.335701][T20650] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 602.398464][T20652] IPVS: stopping master sync thread 20650 ... [ 602.640094][T20669] netlink: 208 bytes leftover after parsing attributes in process `syz.2.4296'. [ 602.640143][T20669] netlink: 208 bytes leftover after parsing attributes in process `syz.2.4296'. [ 602.708587][T20669] netlink: 'syz.2.4296': attribute type 11 has an invalid length. [ 603.376848][T20692] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4303'. [ 603.383225][T20694] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4301'. [ 603.383253][T20694] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4301'. [ 603.433898][T20697] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4301'. [ 603.579120][T20700] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4301'. [ 603.604680][T20696] syzkaller0: entered promiscuous mode [ 603.604868][T20696] syzkaller0: entered allmulticast mode [ 603.641519][T20698] syzkaller1: entered promiscuous mode [ 603.641710][T20698] syzkaller1: entered allmulticast mode [ 603.801340][T20700] vlan2: entered allmulticast mode [ 603.919021][T20704] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4304'. [ 604.129161][T20711] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4307'. [ 605.420393][T20756] vlan2: entered allmulticast mode [ 605.525412][T20761] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 605.676051][T20761] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 605.809174][T18655] net_ratelimit: 24 callbacks suppressed [ 605.809196][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 605.913027][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 605.976038][T20773] netlink: 'syz.4.4326': attribute type 1 has an invalid length. [ 606.102800][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 606.223060][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 606.288496][T20771] netlink: 'syz.2.4325': attribute type 4 has an invalid length. [ 606.367290][T20783] netlink: 'syz.2.4325': attribute type 4 has an invalid length. [ 606.434316][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 607.102852][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.274596][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 607.384844][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 607.493980][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 607.632154][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 607.705076][T20826] __nla_validate_parse: 7 callbacks suppressed [ 607.705097][T20826] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4343'. [ 607.724204][T20824] netlink: 'syz.0.4342': attribute type 16 has an invalid length. [ 607.724229][T20824] netlink: 'syz.0.4342': attribute type 17 has an invalid length. [ 607.835836][T20824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 607.837703][T20824] 8021q: adding VLAN 0 to HW filter on device team0 [ 607.841976][T20824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 607.940829][T20835] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4345'. [ 607.962738][T20824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 607.971372][T20824] veth1_vlan: left promiscuous mode [ 607.988076][T20824] veth0_vlan: left promiscuous mode [ 607.989672][T20824] veth0_vlan: entered promiscuous mode [ 607.992214][T20824] veth1_vlan: entered promiscuous mode [ 608.029455][T20824] veth1_macvtap: left promiscuous mode [ 608.040616][T20824] veth0_macvtap: left promiscuous mode [ 608.051432][T20824] veth0_macvtap: entered promiscuous mode [ 608.060726][T20824] veth1_macvtap: entered promiscuous mode [ 608.100256][T20824] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 608.111765][T20824] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 608.125537][T20824] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 608.129904][T20824] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 608.157468][T20835] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4345'. [ 608.271519][T20824] gretap2: left allmulticast mode [ 608.333920][T18671] bridge0: port 1(bridge_slave_0) entered blocking state [ 608.334059][T18671] bridge0: port 1(bridge_slave_0) entered forwarding state [ 608.339339][T20824] xt_bpf: check failed: parse error [ 608.357148][T18671] bridge0: port 2(bridge_slave_1) entered blocking state [ 608.357249][T18671] bridge0: port 2(bridge_slave_1) entered forwarding state [ 608.552682][T18658] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.552723][T18658] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 4352 - 0 [ 608.552747][T18658] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.796369][T18668] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.796405][T18668] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 4352 - 0 [ 608.796429][T18668] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.796970][T18658] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.796996][T18658] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 4352 - 0 [ 608.797019][T18658] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 608.797052][T18658] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 608.797074][T18658] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 4352 - 0 [ 608.797097][T18658] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 609.819930][T20900] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4359'. [ 609.838253][T20883] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4355'. [ 609.842994][T20900] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4359'. [ 610.380110][T20914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4362'. [ 610.380138][T20914] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4362'. [ 610.477554][T20914] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4362'. [ 610.501961][T20913] syzkaller0: entered promiscuous mode [ 610.501983][T20913] syzkaller0: entered allmulticast mode [ 610.606535][T20914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4362'. [ 610.696346][T20914] vlan2: entered allmulticast mode [ 610.912923][T18655] net_ratelimit: 12 callbacks suppressed [ 610.912946][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 610.983814][T20922] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 611.060935][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 611.162785][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 611.294691][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 611.514322][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 611.816526][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 611.882958][T20939] tipc: Enabled bearer , priority 0 [ 611.922913][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 612.153629][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 612.265989][T20946] syzkaller0: entered promiscuous mode [ 612.266013][T20946] syzkaller0: entered allmulticast mode [ 612.268852][T20946] tipc: Resetting bearer [ 612.269149][T20965] tipc: Enabled bearer , priority 0 [ 612.270408][T20970] syzkaller0: entered promiscuous mode [ 612.270585][T20970] syzkaller0: entered allmulticast mode [ 612.284796][ T1145] bond1: (slave bridge3): failed to get link speed/duplex [ 612.336393][T20928] tipc: Resetting bearer [ 616.539329][T20928] tipc: Disabling bearer [ 616.664741][T18672] net_ratelimit: 398 callbacks suppressed [ 616.664764][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 616.666914][T20975] tipc: Enabling of bearer rejected, failed to enable media [ 616.737441][T20979] tipc: Resetting bearer [ 616.772342][ T7353] tipc: Node number set to 651593515 [ 616.797444][T20964] tipc: Resetting bearer [ 616.837496][T20964] tipc: Disabling bearer [ 616.863164][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 616.979183][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 617.114152][T21010] netlink: 'syz.3.4388': attribute type 16 has an invalid length. [ 617.114172][T21010] netlink: 'syz.3.4388': attribute type 17 has an invalid length. [ 617.197133][T21013] __nla_validate_parse: 3 callbacks suppressed [ 617.197155][T21013] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4390'. [ 617.331509][T21013] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4390'. [ 617.602109][T21010] mac80211_hwsim hwsim34 wlan0: left promiscuous mode [ 617.602187][T21010] mac80211_hwsim hwsim34 wlan0: left allmulticast mode [ 617.683366][T18672] bond1: (slave bridge3): link status up again after 0 ms [ 617.689342][T21010] 8021q: adding VLAN 0 to HW filter on device bond4 [ 617.707477][T18655] bond1: (slave bridge3): link status up again after 0 ms [ 617.723641][T18672] bond1: (slave bridge3): link status up again after 0 ms [ 617.746304][T18655] bond1: (slave bridge3): link status up again after 0 ms [ 617.746336][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 617.782452][T21010] xt_bpf: check failed: parse error [ 618.032720][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 618.083752][T21034] tipc: Enabled bearer , priority 0 [ 618.086140][T21034] syzkaller0: entered promiscuous mode [ 618.086161][T21034] syzkaller0: entered allmulticast mode [ 618.121779][T21034] tipc: Resetting bearer [ 618.149360][T21033] tipc: Resetting bearer [ 618.222294][T21033] tipc: Disabling bearer [ 618.255925][T21022] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 618.422733][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 618.490096][T21043] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4401'. [ 618.490120][T21043] IPv6: NLM_F_CREATE should be specified when creating new route [ 618.490222][T21043] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 618.490232][T21043] IPv6: NLM_F_CREATE should be set when creating new route [ 618.490257][T21043] IPv6: NLM_F_CREATE should be set when creating new route [ 618.694272][T21046] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4402'. [ 619.410985][T21070] tipc: Enabled bearer , priority 0 [ 619.411880][T21070] syzkaller0: entered promiscuous mode [ 619.411898][T21070] syzkaller0: entered allmulticast mode [ 619.460157][T21070] tipc: Resetting bearer [ 619.585462][T21069] tipc: Resetting bearer [ 619.828659][T21069] tipc: Disabling bearer [ 620.759896][T21105] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4416'. [ 621.035853][T21096] gre2: entered promiscuous mode [ 624.052995][ T6943] net_ratelimit: 12 callbacks suppressed [ 624.053015][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 624.163829][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 624.272930][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 624.277336][T21122] netlink: 'syz.3.4424': attribute type 11 has an invalid length. [ 624.323194][T21120] netlink: 332 bytes leftover after parsing attributes in process `syz.0.4423'. [ 624.323247][T21120] netlink: 'syz.0.4423': attribute type 9 has an invalid length. [ 624.323260][T21120] netlink: 108 bytes leftover after parsing attributes in process `syz.0.4423'. [ 624.323274][T21120] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4423'. [ 624.403040][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 624.514753][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 624.750529][T21128] Bluetooth: hci0: invalid length 0, exp 2 for type 15 [ 624.784338][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 624.821339][T21130] tipc: Enabled bearer , priority 0 [ 624.842454][T21130] syzkaller0: entered promiscuous mode [ 624.842561][T21130] syzkaller0: entered allmulticast mode [ 624.900334][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 624.957780][T21140] xt_LOG: level 125 >= 8 [ 625.003684][T21130] tipc: Resetting bearer [ 625.026927][T21129] tipc: Resetting bearer [ 625.268378][T21129] tipc: Disabling bearer [ 625.314884][T21138] netlink: 3784 bytes leftover after parsing attributes in process `syz.2.4431'. [ 625.337282][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 625.416026][T21147] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4430'. [ 625.416060][T21147] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4430'. [ 625.445149][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 625.480856][T21147] syzkaller1: entered promiscuous mode [ 625.480882][T21147] syzkaller1: entered allmulticast mode [ 625.598348][T21147] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4430'. [ 625.662859][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.704536][T21147] vlan2: entered allmulticast mode [ 626.299865][T21166] netlink: 19 bytes leftover after parsing attributes in process `syz.0.4439'. [ 626.329277][T21166] netlink: 19 bytes leftover after parsing attributes in process `syz.0.4439'. [ 626.818597][T21171] netlink: 'syz.1.4442': attribute type 3 has an invalid length. [ 626.818758][T21171] netlink: 'syz.1.4442': attribute type 3 has an invalid length. [ 626.851336][T21171] IPVS: Error connecting to the multicast addr [ 626.975965][T21183] tipc: Enabled bearer , priority 0 [ 626.976471][T21188] syzkaller0: entered promiscuous mode [ 626.976490][T21188] syzkaller0: entered allmulticast mode [ 627.120992][T21183] tipc: Resetting bearer [ 627.159750][T21182] tipc: Resetting bearer [ 627.223474][T21182] tipc: Disabling bearer [ 627.345533][T21192] syzkaller0: entered promiscuous mode [ 627.345555][T21192] syzkaller0: entered allmulticast mode [ 627.511455][T21204] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4452'. [ 627.674253][ T7353] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 628.475166][ T7351] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 628.718206][T21236] tipc: Enabled bearer , priority 0 [ 628.724537][T21236] syzkaller0: entered promiscuous mode [ 628.724560][T21236] syzkaller0: entered allmulticast mode [ 628.781085][T21236] tipc: Resetting bearer [ 628.792932][T21234] tipc: Resetting bearer [ 628.853889][T21234] tipc: Disabling bearer [ 629.143197][T18672] net_ratelimit: 20 callbacks suppressed [ 629.143224][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 629.336023][T21245] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 629.343500][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 629.359148][T21255] netlink: 'syz.4.4469': attribute type 16 has an invalid length. [ 629.359171][T21255] netlink: 'syz.4.4469': attribute type 17 has an invalid length. [ 629.411596][T21243] netlink: 'syz.2.4465': attribute type 16 has an invalid length. [ 629.605366][T21255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 629.616620][T21255] 8021q: adding VLAN 0 to HW filter on device team0 [ 629.694272][T21255] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 629.996271][T21255] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 629.996300][T21255] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 630.054173][T21255] veth1_vlan: left promiscuous mode [ 630.059573][T21255] veth0_vlan: left promiscuous mode [ 630.081201][T21255] veth0_vlan: entered promiscuous mode [ 630.105296][T21255] veth1_vlan: entered promiscuous mode [ 630.123983][T21275] xt_bpf: check failed: parse error [ 630.140687][T21255] veth1_macvtap: left promiscuous mode [ 630.156146][T21255] veth0_macvtap: left promiscuous mode [ 630.182334][T21255] veth0_macvtap: entered promiscuous mode [ 630.227599][T21255] veth1_macvtap: entered promiscuous mode [ 630.360595][T21255] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 630.368397][T21255] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 630.374308][T21255] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 630.377119][T21255] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 630.391559][T21255] mac80211_hwsim hwsim27 wlan0: left promiscuous mode [ 630.391617][T21255] mac80211_hwsim hwsim27 wlan0: left allmulticast mode [ 630.458750][T21255] ip6gretap1: left allmulticast mode [ 630.467236][T21255] batman_adv: batadv0: Interface activated: ip6gretap1 [ 630.489223][T21255] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 630.782857][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.811877][T21264] __nla_validate_parse: 3 callbacks suppressed [ 630.811901][T21264] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4469'. [ 630.813814][T21302] netlink: 2 bytes leftover after parsing attributes in process `syz.3.4473'. [ 631.015696][T18672] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.015729][T18672] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.015764][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 631.382034][T21305] syzkaller0: entered promiscuous mode [ 631.382061][T21305] syzkaller0: entered allmulticast mode [ 631.384259][ T6943] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.384292][ T6943] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.384360][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 631.384394][ T6943] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.384417][ T6943] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.384450][ T6943] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.384473][ T6943] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.634646][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 631.746422][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 631.852628][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 632.248875][T21319] raw_sendmsg: syz.3.4478 forgot to set AF_INET. Fix it! [ 632.569810][T21349] FAULT_INJECTION: forcing a failure. [ 632.569810][T21349] name failslab, interval 1, probability 0, space 0, times 0 [ 632.569849][T21349] CPU: 0 UID: 0 PID: 21349 Comm: syz.3.4486 Not tainted syzkaller #0 PREEMPT(full) [ 632.569871][T21349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 632.569883][T21349] Call Trace: [ 632.569892][T21349] [ 632.569901][T21349] dump_stack_lvl+0xe8/0x150 [ 632.569937][T21349] should_fail_ex+0x410/0x560 [ 632.569966][T21349] should_failslab+0xa8/0x100 [ 632.569993][T21349] __kmalloc_cache_node_noprof+0xaa/0x620 [ 632.570014][T21349] ? kasan_save_track+0x4f/0x80 [ 632.570033][T21349] ? kasan_save_track+0x3e/0x80 [ 632.570051][T21349] ? __kasan_kmalloc+0x93/0xb0 [ 632.570071][T21349] ? __get_vm_area_node+0x155/0x2f0 [ 632.570095][T21349] ? __get_vm_area_node+0x155/0x2f0 [ 632.570121][T21349] ? __x64_sys_bpf+0xba/0xd0 [ 632.570143][T21349] __get_vm_area_node+0x155/0x2f0 [ 632.570176][T21349] __vmalloc_node_range_noprof+0x343/0x1540 [ 632.570204][T21349] ? bpf_check+0x10ee/0x2e10 [ 632.570250][T21349] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 632.570285][T21349] ? __kasan_kmalloc+0x93/0xb0 [ 632.570307][T21349] ? __kmalloc_cache_noprof+0x321/0x600 [ 632.570327][T21349] ? __kmalloc_cache_noprof+0x14d/0x600 [ 632.570345][T21349] ? bpf_diag_init+0x87/0x140 [ 632.570366][T21349] ? bpf_diag_init+0x87/0x140 [ 632.570389][T21349] ? bpf_check+0x10ee/0x2e10 [ 632.570408][T21349] __vmalloc_noprof+0xd2/0x120 [ 632.570435][T21349] ? bpf_check+0x10ee/0x2e10 [ 632.570458][T21349] bpf_check+0x10ee/0x2e10 [ 632.570486][T21349] ? ktime_get_with_offset+0x93/0x2d0 [ 632.570557][T21349] ? __pfx_bpf_check+0x10/0x10 [ 632.570580][T21349] ? bpf_obj_name_cpy+0x194/0x1e0 [ 632.570613][T21349] bpf_prog_load+0x14d6/0x1c20 [ 632.570645][T21349] ? __pfx_bpf_prog_load+0x10/0x10 [ 632.570691][T21349] __sys_bpf+0xd0d/0xd90 [ 632.570721][T21349] ? __pfx___sys_bpf+0x10/0x10 [ 632.570751][T21349] ? __fget_files+0x2a/0x420 [ 632.570794][T21349] ? ksys_write+0x242/0x270 [ 632.570824][T21349] ? __pfx_ksys_write+0x10/0x10 [ 632.570857][T21349] __x64_sys_bpf+0xba/0xd0 [ 632.570880][T21349] do_syscall_64+0x166/0x520 [ 632.570904][T21349] ? trace_irq_disable+0x3b/0x140 [ 632.570923][T21349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.570943][T21349] ? clear_bhb_loop+0x70/0xc0 [ 632.570964][T21349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.570983][T21349] RIP: 0033:0x7f404839e159 [ 632.571001][T21349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.571015][T21349] RSP: 002b:00007f404927f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 632.571036][T21349] RAX: ffffffffffffffda RBX: 00007f4048625fa0 RCX: 00007f404839e159 [ 632.571050][T21349] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 632.571063][T21349] RBP: 00007f404927f090 R08: 0000000000000000 R09: 0000000000000000 [ 632.571075][T21349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 632.571086][T21349] R13: 00007f4048626038 R14: 00007f4048625fa0 R15: 00007ffeb7602ff8 [ 632.571117][T21349] [ 632.576838][T21349] syz.3.4486: vmalloc error: size 408, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 632.576929][T21349] CPU: 0 UID: 0 PID: 21349 Comm: syz.3.4486 Not tainted syzkaller #0 PREEMPT(full) [ 632.576950][T21349] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 632.576961][T21349] Call Trace: [ 632.576969][T21349] [ 632.576977][T21349] dump_stack_lvl+0xe8/0x150 [ 632.577011][T21349] warn_alloc+0x24d/0x270 [ 632.577031][T21349] ? __kasan_kmalloc+0x22/0xb0 [ 632.577057][T21349] ? __pfx_warn_alloc+0x10/0x10 [ 632.577073][T21349] ? __kasan_kmalloc+0x93/0xb0 [ 632.577093][T21349] ? __get_vm_area_node+0x155/0x2f0 [ 632.577119][T21349] ? __x64_sys_bpf+0xba/0xd0 [ 632.577150][T21349] ? __get_vm_area_node+0x2a9/0x2f0 [ 632.577184][T21349] __vmalloc_node_range_noprof+0x36b/0x1540 [ 632.577240][T21349] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 632.577267][T21349] ? __kasan_kmalloc+0x93/0xb0 [ 632.577289][T21349] ? __kmalloc_cache_noprof+0x321/0x600 [ 632.577309][T21349] ? __kmalloc_cache_noprof+0x14d/0x600 [ 632.577327][T21349] ? bpf_diag_init+0x87/0x140 [ 632.577348][T21349] ? bpf_diag_init+0x87/0x140 [ 632.577372][T21349] ? bpf_check+0x10ee/0x2e10 [ 632.577390][T21349] __vmalloc_noprof+0xd2/0x120 [ 632.577417][T21349] ? bpf_check+0x10ee/0x2e10 [ 632.577440][T21349] bpf_check+0x10ee/0x2e10 [ 632.577471][T21349] ? ktime_get_with_offset+0x93/0x2d0 [ 632.577496][T21349] ? __pfx_bpf_check+0x10/0x10 [ 632.577519][T21349] ? bpf_obj_name_cpy+0x194/0x1e0 [ 632.577549][T21349] bpf_prog_load+0x14d6/0x1c20 [ 632.577586][T21349] ? __pfx_bpf_prog_load+0x10/0x10 [ 632.577631][T21349] __sys_bpf+0xd0d/0xd90 [ 632.577660][T21349] ? __pfx___sys_bpf+0x10/0x10 [ 632.577693][T21349] ? __fget_files+0x2a/0x420 [ 632.577735][T21349] ? ksys_write+0x242/0x270 [ 632.577765][T21349] ? __pfx_ksys_write+0x10/0x10 [ 632.577797][T21349] __x64_sys_bpf+0xba/0xd0 [ 632.577817][T21349] do_syscall_64+0x166/0x520 [ 632.577840][T21349] ? trace_irq_disable+0x3b/0x140 [ 632.577857][T21349] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.577877][T21349] ? clear_bhb_loop+0x70/0xc0 [ 632.577900][T21349] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.577920][T21349] RIP: 0033:0x7f404839e159 [ 632.577938][T21349] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.577954][T21349] RSP: 002b:00007f404927f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 632.577973][T21349] RAX: ffffffffffffffda RBX: 00007f4048625fa0 RCX: 00007f404839e159 [ 632.577987][T21349] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 632.577999][T21349] RBP: 00007f404927f090 R08: 0000000000000000 R09: 0000000000000000 [ 632.578011][T21349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 632.578022][T21349] R13: 00007f4048626038 R14: 00007f4048625fa0 R15: 00007ffeb7602ff8 [ 632.578053][T21349] [ 632.581520][T21349] Mem-Info: [ 632.581534][T21349] active_anon:6771 inactive_anon:0 isolated_anon:0 [ 632.581534][T21349] active_file:0 inactive_file:43767 isolated_file:0 [ 632.581534][T21349] unevictable:0 dirty:268 writeback:0 [ 632.581534][T21349] slab_reclaimable:11479 slab_unreclaimable:119142 [ 632.581534][T21349] mapped:30488 shmem:1415 pagetables:1264 [ 632.581534][T21349] sec_pagetables:0 bounce:0 [ 632.581534][T21349] kernel_misc_reclaimable:0 [ 632.581534][T21349] free:1293028 free_pcp:11286 free_cma:0 [ 632.581587][T21349] Node 0 active_anon:27084kB inactive_anon:0kB active_file:0kB inactive_file:174860kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121952kB dirty:1068kB writeback:0kB shmem:5660kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15156kB pagetables:4912kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 632.581634][T21349] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 632.585068][T21349] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 632.585130][T21349] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 632.585164][T21349] Node 0 DMA32 free:1208376kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:27084kB inactive_anon:0kB active_file:0kB inactive_file:174860kB unevictable:0kB writepending:1068kB zspages:0kB present:3129332kB managed:2546940kB mlocked:0kB bounce:0kB free_pcp:45144kB local_pcp:24228kB free_cma:0kB [ 632.585216][T21349] lowmem_reserve[]: 0 0 0 0 0 [ 632.585246][T21349] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 632.585294][T21349] lowmem_reserve[]: 0 0 0 0 0 [ 632.585326][T21349] Node 1 Normal free:3948376kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 632.585385][T21349] lowmem_reserve[]: 0 0 0 0 0 [ 632.585414][T21349] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 632.585516][T21349] Node 0 DMA32: 1417*4kB (UME) 267*8kB (UM) 317*16kB (UME) 527*32kB (UME) 136*64kB (UM) 74*128kB (UME) 73*256kB (UME) 24*512kB (UME) 13*1024kB (UM) 7*2048kB (UM) 269*4096kB (UM) = 1208364kB [ 632.585655][T21349] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 632.585741][T21349] Node 1 Normal: 2*4kB (UM) 2*8kB (UM) 6*16kB (UM) 7*32kB (UM) 2*64kB (UM) 5*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3948376kB [ 632.586479][T21349] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 632.586497][T21349] Node 0 hugepages_total=3 hugepages_free=0 hugepages_surp=1 hugepages_size=2048kB [ 632.586520][T21349] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 632.586534][T21349] Node 1 hugepages_total=2 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 632.586548][T21349] 45178 total pagecache pages [ 632.586560][T21349] 0 pages in swap cache [ 632.586567][T21349] Free swap = 124996kB [ 632.586574][T21349] Total swap = 124996kB [ 632.586583][T21349] 2097051 pages RAM [ 632.586590][T21349] 0 pages HighMem/MovableOnly [ 632.586596][T21349] 428700 pages reserved [ 632.586603][T21349] 0 pages cma reserved [ 632.682565][T21351] Bluetooth: MGMT ver 1.23 [ 633.623160][T21350] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4485'. [ 633.827127][T21367] tipc: Enabled bearer , priority 0 [ 633.827889][T21367] syzkaller0: entered promiscuous mode [ 633.827908][T21367] syzkaller0: entered allmulticast mode [ 633.856921][T21367] tipc: Resetting bearer [ 633.901840][T21366] tipc: Resetting bearer [ 634.125957][T21366] tipc: Disabling bearer [ 634.188016][T21371] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4493'. [ 634.203056][T18655] net_ratelimit: 7 callbacks suppressed [ 634.203078][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 634.213329][T21371] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4493'. [ 634.317288][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 634.423441][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 634.533765][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 634.710453][ T4933] Bluetooth: hci2: command 0x0406 tx timeout [ 634.710617][T19738] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 634.831483][T21395] netlink: 'syz.3.4501': attribute type 16 has an invalid length. [ 634.831508][T21395] netlink: 'syz.3.4501': attribute type 17 has an invalid length. [ 634.883031][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 635.202470][T21403] openvswitch: netlink: Message has 8 unknown bytes. [ 635.202957][T21403] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 635.347158][T18655] bond1: (slave bridge3): link status up again after 0 ms [ 635.363013][T18658] bond1: (slave bridge3): link status up again after 0 ms [ 635.374479][T21410] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4502'. [ 635.382892][T18655] bond1: (slave bridge3): link status up again after 0 ms [ 635.502082][T21414] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4503'. [ 635.643556][T21395] xt_bpf: check failed: parse error [ 635.780711][T21412] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4501'. [ 636.210164][T21429] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4508'. [ 636.233479][T21429] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4508'. [ 636.980705][T21455] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4519'. [ 637.089224][T21459] tipc: Enabled bearer , priority 10 [ 637.137972][T21458] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4520'. [ 637.277971][T21466] udevd[21466]: setting owner of /dev/rfcomm2 to uid=0, gid=18 failed: No such file or directory [ 637.639830][T21476] veth0_to_batadv: entered allmulticast mode [ 637.976864][T21496] netlink: 'syz.2.4530': attribute type 10 has an invalid length. [ 638.000413][T21495] netlink: 'syz.3.4529': attribute type 10 has an invalid length. [ 638.102825][T21498] netlink: 'syz.1.4531': attribute type 16 has an invalid length. [ 638.103579][T21498] netlink: 'syz.1.4531': attribute type 17 has an invalid length. [ 638.312341][T21505] ip6t_ah: unknown flags 4 [ 638.406326][ T7351] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 638.433599][T21498] 8021q: adding VLAN 0 to HW filter on device bond7 [ 638.478635][T21510] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4531'. [ 638.519738][T21498] xt_bpf: check failed: parse error [ 639.187558][ T7357] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 639.223301][ T899] net_ratelimit: 39 callbacks suppressed [ 639.223498][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 639.333037][ T6943] bond1: (slave bridge3): failed to get link speed/duplex [ 639.443507][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 639.553132][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 639.615602][T21543] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4545'. [ 639.664164][ T1145] bond1: (slave bridge3): failed to get link speed/duplex [ 639.774790][T18668] bond1: (slave bridge3): failed to get link speed/duplex [ 639.781875][T21549] FAULT_INJECTION: forcing a failure. [ 639.781875][T21549] name failslab, interval 1, probability 0, space 0, times 0 [ 639.781909][T21549] CPU: 0 UID: 0 PID: 21549 Comm: syz.3.4551 Not tainted syzkaller #0 PREEMPT(full) [ 639.781931][T21549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 639.781943][T21549] Call Trace: [ 639.781952][T21549] [ 639.781960][T21549] dump_stack_lvl+0xe8/0x150 [ 639.781994][T21549] should_fail_ex+0x410/0x560 [ 639.782022][T21549] should_failslab+0xa8/0x100 [ 639.782048][T21549] __kvmalloc_node_noprof+0x176/0x820 [ 639.782069][T21549] ? __kmalloc_cache_noprof+0x14d/0x600 [ 639.782087][T21549] ? bpf_diag_init+0x87/0x140 [ 639.782110][T21549] ? bpf_check+0x15a9/0x2e10 [ 639.782129][T21549] ? bpf_check+0x15a9/0x2e10 [ 639.782156][T21549] bpf_check+0x15a9/0x2e10 [ 639.782187][T21549] ? ktime_get_with_offset+0x93/0x2d0 [ 639.782212][T21549] ? __pfx_bpf_check+0x10/0x10 [ 639.782235][T21549] ? bpf_obj_name_cpy+0x194/0x1e0 [ 639.782267][T21549] bpf_prog_load+0x14d6/0x1c20 [ 639.782301][T21549] ? __pfx_bpf_prog_load+0x10/0x10 [ 639.782348][T21549] __sys_bpf+0xd0d/0xd90 [ 639.782377][T21549] ? __pfx___sys_bpf+0x10/0x10 [ 639.782410][T21549] ? __fget_files+0x2a/0x420 [ 639.782455][T21549] ? ksys_write+0x242/0x270 [ 639.782483][T21549] ? __pfx_ksys_write+0x10/0x10 [ 639.782509][T21549] __x64_sys_bpf+0xba/0xd0 [ 639.782528][T21549] do_syscall_64+0x166/0x520 [ 639.782548][T21549] ? trace_irq_disable+0x3b/0x140 [ 639.782566][T21549] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.782583][T21549] ? clear_bhb_loop+0x70/0xc0 [ 639.782611][T21549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.782629][T21549] RIP: 0033:0x7f404839e159 [ 639.782647][T21549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 639.782662][T21549] RSP: 002b:00007f404927f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 639.782683][T21549] RAX: ffffffffffffffda RBX: 00007f4048625fa0 RCX: 00007f404839e159 [ 639.782696][T21549] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 639.782709][T21549] RBP: 00007f404927f090 R08: 0000000000000000 R09: 0000000000000000 [ 639.782721][T21549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 639.782732][T21549] R13: 00007f4048626038 R14: 00007f4048625fa0 R15: 00007ffeb7602ff8 [ 639.782759][T21549] [ 639.904665][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 640.017552][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 640.081324][T21552] netlink: 'syz.1.4550': attribute type 11 has an invalid length. [ 640.081347][T21552] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4550'. [ 640.122817][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 640.165143][T21550] tipc: Enabled bearer , priority 0 [ 640.168730][T21550] syzkaller0: entered promiscuous mode [ 640.168911][T21550] syzkaller0: entered allmulticast mode [ 640.237535][ T899] bond1: (slave bridge3): failed to get link speed/duplex [ 640.348422][T21550] tipc: Resetting bearer [ 640.431648][T21547] tipc: Resetting bearer [ 640.535412][T21547] tipc: Disabling bearer [ 640.820009][T21582] FAULT_INJECTION: forcing a failure. [ 640.820009][T21582] name failslab, interval 1, probability 0, space 0, times 0 [ 640.820043][T21582] CPU: 0 UID: 0 PID: 21582 Comm: syz.2.4564 Not tainted syzkaller #0 PREEMPT(full) [ 640.820065][T21582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 640.820077][T21582] Call Trace: [ 640.820085][T21582] [ 640.820095][T21582] dump_stack_lvl+0xe8/0x150 [ 640.820129][T21582] should_fail_ex+0x410/0x560 [ 640.820157][T21582] should_failslab+0xa8/0x100 [ 640.820183][T21582] __kmalloc_cache_node_noprof+0xaa/0x620 [ 640.820203][T21582] ? unwind_get_return_address+0x4d/0x90 [ 640.820228][T21582] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 640.820249][T21582] ? __get_vm_area_node+0x155/0x2f0 [ 640.820274][T21582] ? __get_vm_area_node+0x155/0x2f0 [ 640.820306][T21582] __get_vm_area_node+0x155/0x2f0 [ 640.820345][T21582] __vmalloc_node_range_noprof+0x343/0x1540 [ 640.820374][T21582] ? bpf_prog_calc_tag+0x51/0x370 [ 640.820398][T21582] ? __x64_sys_bpf+0xba/0xd0 [ 640.820416][T21582] ? do_syscall_64+0x166/0x520 [ 640.820445][T21582] ? __kasan_kmalloc+0x93/0xb0 [ 640.820467][T21582] ? bpf_prog_load+0x14d6/0x1c20 [ 640.820487][T21582] ? __sys_bpf+0xd0d/0xd90 [ 640.820505][T21582] ? __x64_sys_bpf+0xba/0xd0 [ 640.820536][T21582] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 640.820577][T21582] ? bpf_prog_calc_tag+0x51/0x370 [ 640.820597][T21582] __vmalloc_noprof+0xd2/0x120 [ 640.820624][T21582] ? bpf_prog_calc_tag+0x51/0x370 [ 640.820649][T21582] bpf_prog_calc_tag+0x51/0x370 [ 640.820669][T21582] ? __pfx_cmp_subprogs+0x10/0x10 [ 640.820696][T21582] check_and_resolve_insns+0xbb/0x21d0 [ 640.820721][T21582] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 640.820743][T21582] ? add_subprog+0x2e2/0x3f0 [ 640.820768][T21582] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 640.820801][T21582] bpf_check+0x180a/0x2e10 [ 640.820833][T21582] ? ktime_get_with_offset+0x93/0x2d0 [ 640.820858][T21582] ? __pfx_bpf_check+0x10/0x10 [ 640.820881][T21582] ? bpf_obj_name_cpy+0x194/0x1e0 [ 640.820912][T21582] bpf_prog_load+0x14d6/0x1c20 [ 640.820945][T21582] ? __pfx_bpf_prog_load+0x10/0x10 [ 640.820992][T21582] __sys_bpf+0xd0d/0xd90 [ 640.821021][T21582] ? __pfx___sys_bpf+0x10/0x10 [ 640.821054][T21582] ? __fget_files+0x2a/0x420 [ 640.821097][T21582] ? ksys_write+0x242/0x270 [ 640.821126][T21582] ? __pfx_ksys_write+0x10/0x10 [ 640.821158][T21582] __x64_sys_bpf+0xba/0xd0 [ 640.821180][T21582] do_syscall_64+0x166/0x520 [ 640.821202][T21582] ? trace_irq_disable+0x3b/0x140 [ 640.821221][T21582] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.821241][T21582] ? clear_bhb_loop+0x70/0xc0 [ 640.821264][T21582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 640.821284][T21582] RIP: 0033:0x7fbad699e159 [ 640.821302][T21582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 640.821319][T21582] RSP: 002b:00007fbad7875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 640.821347][T21582] RAX: ffffffffffffffda RBX: 00007fbad6c25fa0 RCX: 00007fbad699e159 [ 640.821362][T21582] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 640.821374][T21582] RBP: 00007fbad7875090 R08: 0000000000000000 R09: 0000000000000000 [ 640.821387][T21582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 640.821398][T21582] R13: 00007fbad6c26038 R14: 00007fbad6c25fa0 R15: 00007fff1ad5a068 [ 640.821429][T21582] [ 641.766116][T21599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4568'. [ 641.766155][T21599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4568'. [ 642.706627][T21611] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4571'. [ 643.173426][T21624] FAULT_INJECTION: forcing a failure. [ 643.173426][T21624] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 643.173461][T21624] CPU: 1 UID: 0 PID: 21624 Comm: syz.3.4578 Not tainted syzkaller #0 PREEMPT(full) [ 643.173482][T21624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 643.173495][T21624] Call Trace: [ 643.173502][T21624] [ 643.173511][T21624] dump_stack_lvl+0xe8/0x150 [ 643.173545][T21624] should_fail_ex+0x410/0x560 [ 643.173572][T21624] prepare_alloc_pages+0x223/0x600 [ 643.173599][T21624] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 643.173625][T21624] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 643.173650][T21624] ? __pfx_policy_nodemask+0x10/0x10 [ 643.173672][T21624] ? __get_vm_area_node+0x155/0x2f0 [ 643.173697][T21624] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 643.173723][T21624] ? __vmalloc_noprof+0xd2/0x120 [ 643.173747][T21624] ? bpf_prog_calc_tag+0x51/0x370 [ 643.173777][T21624] ? check_and_resolve_insns+0xbb/0x21d0 [ 643.173798][T21624] ? bpf_prog_load+0x14d6/0x1c20 [ 643.173817][T21624] ? __sys_bpf+0xd0d/0xd90 [ 643.173835][T21624] ? __x64_sys_bpf+0xba/0xd0 [ 643.173851][T21624] ? do_syscall_64+0x166/0x520 [ 643.173873][T21624] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.173897][T21624] alloc_pages_mpol+0x21e/0x390 [ 643.173925][T21624] alloc_pages_noprof+0xb1/0x2b0 [ 643.173952][T21624] get_free_pages_noprof+0xf/0x80 [ 643.173971][T21624] __kasan_populate_vmalloc+0x38/0x1c0 [ 643.173990][T21624] ? do_raw_spin_unlock+0xf5/0x200 [ 643.174020][T21624] alloc_vmap_area+0xd1a/0x1420 [ 643.174059][T21624] ? __pfx_alloc_vmap_area+0x10/0x10 [ 643.174082][T21624] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 643.174103][T21624] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 643.174120][T21624] ? __get_vm_area_node+0x155/0x2f0 [ 643.174149][T21624] __get_vm_area_node+0x200/0x2f0 [ 643.174182][T21624] __vmalloc_node_range_noprof+0x343/0x1540 [ 643.174210][T21624] ? bpf_prog_calc_tag+0x51/0x370 [ 643.174232][T21624] ? __x64_sys_bpf+0xba/0xd0 [ 643.174248][T21624] ? do_syscall_64+0x166/0x520 [ 643.174274][T21624] ? __kasan_kmalloc+0x93/0xb0 [ 643.174294][T21624] ? bpf_prog_load+0x14d6/0x1c20 [ 643.174314][T21624] ? __sys_bpf+0xd0d/0xd90 [ 643.174332][T21624] ? __x64_sys_bpf+0xba/0xd0 [ 643.174362][T21624] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 643.174401][T21624] ? bpf_prog_calc_tag+0x51/0x370 [ 643.174421][T21624] __vmalloc_noprof+0xd2/0x120 [ 643.174445][T21624] ? bpf_prog_calc_tag+0x51/0x370 [ 643.174467][T21624] bpf_prog_calc_tag+0x51/0x370 [ 643.174486][T21624] ? __pfx_cmp_subprogs+0x10/0x10 [ 643.174509][T21624] check_and_resolve_insns+0xbb/0x21d0 [ 643.174534][T21624] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 643.174555][T21624] ? add_subprog+0x2e2/0x3f0 [ 643.174578][T21624] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 643.174609][T21624] bpf_check+0x180a/0x2e10 [ 643.174638][T21624] ? ktime_get_with_offset+0x93/0x2d0 [ 643.174659][T21624] ? __pfx_bpf_check+0x10/0x10 [ 643.174678][T21624] ? bpf_obj_name_cpy+0x194/0x1e0 [ 643.174709][T21624] bpf_prog_load+0x14d6/0x1c20 [ 643.174739][T21624] ? __pfx_bpf_prog_load+0x10/0x10 [ 643.174787][T21624] __sys_bpf+0xd0d/0xd90 [ 643.174810][T21624] ? __pfx___sys_bpf+0x10/0x10 [ 643.174835][T21624] ? __fget_files+0x2a/0x420 [ 643.174873][T21624] ? ksys_write+0x242/0x270 [ 643.174897][T21624] ? __pfx_ksys_write+0x10/0x10 [ 643.174921][T21624] __x64_sys_bpf+0xba/0xd0 [ 643.174939][T21624] do_syscall_64+0x166/0x520 [ 643.174956][T21624] ? trace_irq_disable+0x3b/0x140 [ 643.174971][T21624] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.174986][T21624] ? clear_bhb_loop+0x70/0xc0 [ 643.175004][T21624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.175019][T21624] RIP: 0033:0x7f404839e159 [ 643.175035][T21624] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 643.175047][T21624] RSP: 002b:00007f404927f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 643.175064][T21624] RAX: ffffffffffffffda RBX: 00007f4048625fa0 RCX: 00007f404839e159 [ 643.175075][T21624] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 643.175085][T21624] RBP: 00007f404927f090 R08: 0000000000000000 R09: 0000000000000000 [ 643.175094][T21624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 643.175103][T21624] R13: 00007f4048626038 R14: 00007f4048625fa0 R15: 00007ffeb7602ff8 [ 643.175127][T21624] [ 643.186913][T21624] warn_alloc: 1 callbacks suppressed [ 643.186931][T21624] syz.3.4578: vmalloc error: size 24, align 0x1, vm_struct allocation failed, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 643.186985][T21624] CPU: 1 UID: 0 PID: 21624 Comm: syz.3.4578 Not tainted syzkaller #0 PREEMPT(full) [ 643.187000][T21624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 643.187009][T21624] Call Trace: [ 643.187017][T21624] [ 643.187024][T21624] dump_stack_lvl+0xe8/0x150 [ 643.187055][T21624] warn_alloc+0x24d/0x270 [ 643.187076][T21624] ? lockdep_hardirqs_on+0x7b/0x110 [ 643.187103][T21624] ? __pfx_warn_alloc+0x10/0x10 [ 643.187120][T21624] ? kfree+0x1c5/0x650 [ 643.187149][T21624] ? __get_vm_area_node+0x219/0x2f0 [ 643.187181][T21624] __vmalloc_node_range_noprof+0x36b/0x1540 [ 643.187209][T21624] ? __x64_sys_bpf+0xba/0xd0 [ 643.187226][T21624] ? do_syscall_64+0x166/0x520 [ 643.187252][T21624] ? __kasan_kmalloc+0x93/0xb0 [ 643.187273][T21624] ? bpf_prog_load+0x14d6/0x1c20 [ 643.187291][T21624] ? __sys_bpf+0xd0d/0xd90 [ 643.187309][T21624] ? __x64_sys_bpf+0xba/0xd0 [ 643.187337][T21624] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 643.187373][T21624] ? bpf_prog_calc_tag+0x51/0x370 [ 643.187394][T21624] __vmalloc_noprof+0xd2/0x120 [ 643.187419][T21624] ? bpf_prog_calc_tag+0x51/0x370 [ 643.187442][T21624] bpf_prog_calc_tag+0x51/0x370 [ 643.187462][T21624] ? __pfx_cmp_subprogs+0x10/0x10 [ 643.187487][T21624] check_and_resolve_insns+0xbb/0x21d0 [ 643.187511][T21624] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 643.187530][T21624] ? add_subprog+0x2e2/0x3f0 [ 643.187553][T21624] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 643.187584][T21624] bpf_check+0x180a/0x2e10 [ 643.187614][T21624] ? ktime_get_with_offset+0x93/0x2d0 [ 643.187637][T21624] ? __pfx_bpf_check+0x10/0x10 [ 643.187658][T21624] ? bpf_obj_name_cpy+0x194/0x1e0 [ 643.187686][T21624] bpf_prog_load+0x14d6/0x1c20 [ 643.187718][T21624] ? __pfx_bpf_prog_load+0x10/0x10 [ 643.187761][T21624] __sys_bpf+0xd0d/0xd90 [ 643.187797][T21624] ? __pfx___sys_bpf+0x10/0x10 [ 643.187828][T21624] ? __fget_files+0x2a/0x420 [ 643.187867][T21624] ? ksys_write+0x242/0x270 [ 643.187894][T21624] ? __pfx_ksys_write+0x10/0x10 [ 643.187925][T21624] __x64_sys_bpf+0xba/0xd0 [ 643.187945][T21624] do_syscall_64+0x166/0x520 [ 643.187966][T21624] ? trace_irq_disable+0x3b/0x140 [ 643.187983][T21624] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.188002][T21624] ? clear_bhb_loop+0x70/0xc0 [ 643.188024][T21624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 643.188043][T21624] RIP: 0033:0x7f404839e159 [ 643.188060][T21624] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 643.188075][T21624] RSP: 002b:00007f404927f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 643.188093][T21624] RAX: ffffffffffffffda RBX: 00007f4048625fa0 RCX: 00007f404839e159 [ 643.188107][T21624] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 643.188118][T21624] RBP: 00007f404927f090 R08: 0000000000000000 R09: 0000000000000000 [ 643.188130][T21624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 643.188140][T21624] R13: 00007f4048626038 R14: 00007f4048625fa0 R15: 00007ffeb7602ff8 [ 643.188169][T21624] [ 643.188177][T21624] Mem-Info: [ 643.188186][T21624] active_anon:5991 inactive_anon:0 isolated_anon:0 [ 643.188186][T21624] active_file:0 inactive_file:43771 isolated_file:0 [ 643.188186][T21624] unevictable:0 dirty:250 writeback:0 [ 643.188186][T21624] slab_reclaimable:11639 slab_unreclaimable:118648 [ 643.188186][T21624] mapped:29713 shmem:658 pagetables:1253 [ 643.188186][T21624] sec_pagetables:0 bounce:0 [ 643.188186][T21624] kernel_misc_reclaimable:0 [ 643.188186][T21624] free:1293368 free_pcp:11896 free_cma:0 [ 643.188231][T21624] Node 0 active_anon:23964kB inactive_anon:0kB active_file:0kB inactive_file:174876kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118852kB dirty:996kB writeback:0kB shmem:2632kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14956kB pagetables:4868kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 643.188278][T21624] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 643.188323][T21624] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 643.188373][T21624] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 643.188406][T21624] Node 0 DMA32 free:1209736kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:23964kB inactive_anon:0kB active_file:0kB inactive_file:174876kB unevictable:0kB writepending:996kB zspages:0kB present:3129332kB managed:2546940kB mlocked:0kB bounce:0kB free_pcp:47584kB local_pcp:20792kB free_cma:0kB [ 643.188459][T21624] lowmem_reserve[]: 0 0 0 0 0 [ 643.188489][T21624] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 643.188537][T21624] lowmem_reserve[]: 0 0 0 0 0 [ 643.188567][T21624] Node 1 Normal free:3948376kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 643.188617][T21624] lowmem_reserve[]: 0 0 0 0 0 [ 643.188648][T21624] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 643.188751][T21624] Node 0 DMA32: 2078*4kB (UME) 1135*8kB (UME) 933*16kB (UME) 369*32kB (UM) 165*64kB (UM) 67*128kB (UM) 72*256kB (UM) 23*512kB (UM) 14*1024kB (UME) 4*2048kB (UM) 267*4096kB (UM) = 1209632kB [ 643.188896][T21624] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 643.191147][T21624] Node 1 Normal: 2*4kB (UM) 2*8kB (UM) 6*16kB (UM) 7*32kB (UM) 2*64kB (UM) 5*128kB (UM) 3*256kB (UM) 2*512kB (M) 1*1024kB (M) 2*2048kB (U) 962*4096kB (M) = 3948376kB [ 643.191283][T21624] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 643.191298][T21624] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 643.191312][T21624] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 643.191327][T21624] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 643.191341][T21624] 44425 total pagecache pages [ 643.191348][T21624] 0 pages in swap cache [ 643.191355][T21624] Free swap = 124996kB [ 643.191362][T21624] Total swap = 124996kB [ 643.191369][T21624] 2097051 pages RAM [ 643.191376][T21624] 0 pages HighMem/MovableOnly [ 643.191382][T21624] 428700 pages reserved [ 643.191390][T21624] 0 pages cma reserved [ 644.354026][T18669] net_ratelimit: 26 callbacks suppressed [ 644.354046][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 644.522668][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 644.624906][T21640] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4583'. [ 644.633599][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 644.746360][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 644.854253][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 645.115672][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 645.243397][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 645.354159][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 645.455980][T21678] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4587'. [ 645.462959][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 645.583300][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 645.670409][T21683] FAULT_INJECTION: forcing a failure. [ 645.670409][T21683] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 645.670443][T21683] CPU: 0 UID: 0 PID: 21683 Comm: syz.0.4591 Not tainted syzkaller #0 PREEMPT(full) [ 645.670465][T21683] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 645.670477][T21683] Call Trace: [ 645.670485][T21683] [ 645.670493][T21683] dump_stack_lvl+0xe8/0x150 [ 645.670527][T21683] should_fail_ex+0x410/0x560 [ 645.670554][T21683] prepare_alloc_pages+0x223/0x600 [ 645.670580][T21683] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 645.670602][T21683] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 645.670624][T21683] ? __pfx_policy_nodemask+0x10/0x10 [ 645.670644][T21683] ? __get_vm_area_node+0x155/0x2f0 [ 645.670665][T21683] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 645.670691][T21683] ? __vmalloc_noprof+0xd2/0x120 [ 645.670715][T21683] ? bpf_prog_calc_tag+0x51/0x370 [ 645.670735][T21683] ? check_and_resolve_insns+0xbb/0x21d0 [ 645.670755][T21683] ? bpf_prog_load+0x14d6/0x1c20 [ 645.670774][T21683] ? __sys_bpf+0xd0d/0xd90 [ 645.670791][T21683] ? __x64_sys_bpf+0xba/0xd0 [ 645.670807][T21683] ? do_syscall_64+0x166/0x520 [ 645.670839][T21683] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 645.670861][T21683] alloc_pages_mpol+0x21e/0x390 [ 645.670890][T21683] alloc_pages_noprof+0xb1/0x2b0 [ 645.670915][T21683] get_free_pages_noprof+0xf/0x80 [ 645.670935][T21683] __kasan_populate_vmalloc+0x38/0x1c0 [ 645.670954][T21683] ? do_raw_spin_unlock+0xf5/0x200 [ 645.670983][T21683] alloc_vmap_area+0xd1a/0x1420 [ 645.671023][T21683] ? __pfx_alloc_vmap_area+0x10/0x10 [ 645.671045][T21683] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 645.671069][T21683] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 645.671088][T21683] ? __get_vm_area_node+0x155/0x2f0 [ 645.671119][T21683] __get_vm_area_node+0x200/0x2f0 [ 645.671152][T21683] __vmalloc_node_range_noprof+0x343/0x1540 [ 645.671180][T21683] ? bpf_prog_calc_tag+0x51/0x370 [ 645.671202][T21683] ? __x64_sys_bpf+0xba/0xd0 [ 645.671217][T21683] ? do_syscall_64+0x166/0x520 [ 645.671244][T21683] ? __kasan_kmalloc+0x93/0xb0 [ 645.671264][T21683] ? bpf_prog_load+0x14d6/0x1c20 [ 645.671283][T21683] ? __sys_bpf+0xd0d/0xd90 [ 645.671301][T21683] ? __x64_sys_bpf+0xba/0xd0 [ 645.671329][T21683] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 645.671364][T21683] ? bpf_prog_calc_tag+0x51/0x370 [ 645.671383][T21683] __vmalloc_noprof+0xd2/0x120 [ 645.671409][T21683] ? bpf_prog_calc_tag+0x51/0x370 [ 645.671433][T21683] bpf_prog_calc_tag+0x51/0x370 [ 645.671454][T21683] ? __pfx_cmp_subprogs+0x10/0x10 [ 645.671479][T21683] check_and_resolve_insns+0xbb/0x21d0 [ 645.671504][T21683] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 645.671525][T21683] ? add_subprog+0x2e2/0x3f0 [ 645.671549][T21683] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 645.671580][T21683] bpf_check+0x180a/0x2e10 [ 645.671612][T21683] ? ktime_get_with_offset+0x93/0x2d0 [ 645.671637][T21683] ? __pfx_bpf_check+0x10/0x10 [ 645.671660][T21683] ? bpf_obj_name_cpy+0x194/0x1e0 [ 645.671690][T21683] bpf_prog_load+0x14d6/0x1c20 [ 645.671724][T21683] ? __pfx_bpf_prog_load+0x10/0x10 [ 645.671768][T21683] __sys_bpf+0xd0d/0xd90 [ 645.671797][T21683] ? __pfx___sys_bpf+0x10/0x10 [ 645.671836][T21683] ? __fget_files+0x2a/0x420 [ 645.671878][T21683] ? ksys_write+0x242/0x270 [ 645.671907][T21683] ? __pfx_ksys_write+0x10/0x10 [ 645.671938][T21683] __x64_sys_bpf+0xba/0xd0 [ 645.671959][T21683] do_syscall_64+0x166/0x520 [ 645.671980][T21683] ? trace_irq_disable+0x3b/0x140 [ 645.671998][T21683] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 645.672017][T21683] ? clear_bhb_loop+0x70/0xc0 [ 645.672040][T21683] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 645.672056][T21683] RIP: 0033:0x7faed4d9e159 [ 645.672075][T21683] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 645.672090][T21683] RSP: 002b:00007faed5c20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 645.672110][T21683] RAX: ffffffffffffffda RBX: 00007faed5025fa0 RCX: 00007faed4d9e159 [ 645.672124][T21683] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 645.672137][T21683] RBP: 00007faed5c20090 R08: 0000000000000000 R09: 0000000000000000 [ 645.672149][T21683] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 645.672159][T21683] R13: 00007faed5026038 R14: 00007faed5025fa0 R15: 00007ffe41764cf8 [ 645.672185][T21683] [ 646.513238][T21693] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4595'. [ 646.533704][T21693] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4595'. [ 646.538701][T21693] workqueue: name exceeds WQ_NAME_LEN. Truncating to: .´\¸Z îÅî•QŒ…¥`£OK54ê0µò [ 646.657791][T21694] netlink: 'syz.1.4594': attribute type 1 has an invalid length. [ 646.787106][T21698] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4594'. [ 646.882329][T21694] 8021q: adding VLAN 0 to HW filter on device bond9 [ 646.963429][T21692] bond9: (slave veth5): Enslaving as an active interface with a down link [ 647.013945][T21695] netlink: 'syz.3.4595': attribute type 10 has an invalid length. [ 647.273261][T21695] bond0: (slave bond_slave_0): Releasing backup interface [ 647.326194][T21695] team0: Port device bond_slave_0 added [ 647.780016][T21694] bond9 (unregistering): (slave veth5): Releasing active interface [ 647.838892][T21694] bond9 (unregistering): Released all slaves [ 649.120686][T21764] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4617'. [ 649.472157][T21776] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4616'. [ 650.024184][T21760] gretap1: left promiscuous mode [ 650.031967][T21760] gretap2: left promiscuous mode [ 650.063976][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 650.099662][T21760] veth2: left promiscuous mode [ 650.144604][T21760] gre2: left promiscuous mode [ 650.283782][T18673] net_ratelimit: 14 callbacks suppressed [ 650.283809][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 650.393069][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 650.502682][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 650.614529][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 650.637104][T21793] tipc: Enabling of bearer rejected, failed to enable media [ 650.679859][T21793] netlink: 160 bytes leftover after parsing attributes in process `syz.3.4625'. [ 650.679893][T21793] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 650.748625][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 650.853114][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 650.952479][T21796] netlink: 2044 bytes leftover after parsing attributes in process `syz.3.4628'. [ 650.959950][T21796] netlink: 2044 bytes leftover after parsing attributes in process `syz.3.4628'. [ 650.973343][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 650.996008][T21803] tipc: New replicast peer: 127.0.0.1 [ 650.996419][T21803] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 651.019429][T21803] tipc: Enabled bearer , priority 10 [ 651.096972][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 651.498329][T21812] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4630'. [ 651.668935][T21818] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4629'. [ 651.700764][T21818] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 651.756123][T21818] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 651.838424][T21837] tipc: Enabled bearer , priority 0 [ 651.969608][T21839] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4635'. [ 652.170445][T21831] syzkaller0: entered promiscuous mode [ 652.170471][T21831] syzkaller0: entered allmulticast mode [ 652.251010][T21837] tipc: Resetting bearer [ 652.638734][T21826] tipc: Resetting bearer [ 652.737164][T21844] FAULT_INJECTION: forcing a failure. [ 652.737164][T21844] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 652.737197][T21844] CPU: 0 UID: 0 PID: 21844 Comm: syz.2.4639 Not tainted syzkaller #0 PREEMPT(full) [ 652.737218][T21844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 652.737230][T21844] Call Trace: [ 652.737239][T21844] [ 652.737248][T21844] dump_stack_lvl+0xe8/0x150 [ 652.737282][T21844] should_fail_ex+0x410/0x560 [ 652.737312][T21844] _copy_to_user+0x31/0xb0 [ 652.737339][T21844] bpf_log_attr_finalize+0x124/0x1e0 [ 652.737362][T21844] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 652.737384][T21844] ? ktime_get+0x45/0x220 [ 652.737404][T21844] ? ktime_get+0x1f5/0x220 [ 652.737426][T21844] bpf_check+0x1c55/0x2e10 [ 652.737455][T21844] ? ktime_get_with_offset+0x93/0x2d0 [ 652.737477][T21844] ? __pfx_bpf_check+0x10/0x10 [ 652.737500][T21844] ? bpf_obj_name_cpy+0x194/0x1e0 [ 652.737531][T21844] bpf_prog_load+0x14d6/0x1c20 [ 652.737561][T21844] ? __pfx_bpf_prog_load+0x10/0x10 [ 652.737605][T21844] __sys_bpf+0xd0d/0xd90 [ 652.737633][T21844] ? __pfx___sys_bpf+0x10/0x10 [ 652.737662][T21844] ? __fget_files+0x2a/0x420 [ 652.737704][T21844] ? ksys_write+0x242/0x270 [ 652.737731][T21844] ? __pfx_ksys_write+0x10/0x10 [ 652.737762][T21844] __x64_sys_bpf+0xba/0xd0 [ 652.737782][T21844] do_syscall_64+0x166/0x520 [ 652.737803][T21844] ? trace_irq_disable+0x3b/0x140 [ 652.737828][T21844] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.737848][T21844] ? clear_bhb_loop+0x70/0xc0 [ 652.737870][T21844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.737889][T21844] RIP: 0033:0x7fbad699e159 [ 652.737907][T21844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 652.737922][T21844] RSP: 002b:00007fbad7875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 652.737942][T21844] RAX: ffffffffffffffda RBX: 00007fbad6c25fa0 RCX: 00007fbad699e159 [ 652.737956][T21844] RDX: 0000000000000094 RSI: 0000200000000cc0 RDI: 0000000000000005 [ 652.737968][T21844] RBP: 00007fbad7875090 R08: 0000000000000000 R09: 0000000000000000 [ 652.737980][T21844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 652.737990][T21844] R13: 00007fbad6c26038 R14: 00007fbad6c25fa0 R15: 00007fff1ad5a068 [ 652.738020][T21844] [ 652.898108][T21826] tipc: Disabling bearer [ 653.074690][T21852] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4641'. [ 653.086549][T21852] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4641'. [ 653.256346][T21862] netlink: 'syz.4.4645': attribute type 16 has an invalid length. [ 653.256369][T21862] netlink: 'syz.4.4645': attribute type 17 has an invalid length. [ 653.598533][T21862] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4645'. [ 653.638861][T21862] xt_bpf: check failed: parse error [ 653.896819][T21877] netlink: 'syz.4.4648': attribute type 10 has an invalid length. [ 653.927765][T21877] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 653.957965][T21880] netlink: 'syz.4.4648': attribute type 10 has an invalid length. [ 653.961515][T21877] team0: Port device netdevsim1 added [ 653.962212][T21879] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4646'. [ 654.023917][T21880] team0: Port device netdevsim1 removed [ 654.051351][T21880] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 654.069868][T21880] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 654.164955][T21884] netlink: 'syz.4.4650': attribute type 1 has an invalid length. [ 654.205004][T21857] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4644'. [ 654.205028][T21857] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4644'. [ 654.205045][T21857] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4644'. [ 654.281157][T21887] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4649'. [ 654.417447][T21891] netlink: 'syz.1.4651': attribute type 1 has an invalid length. [ 654.449968][T21888] bond2: (slave bridge2): Enslaving as a backup interface with an up link [ 654.516034][T21884] macvlan2: entered promiscuous mode [ 654.516057][T21884] macvlan2: entered allmulticast mode [ 654.521815][T21884] bond2: entered promiscuous mode [ 654.521838][T21884] bridge2: entered promiscuous mode [ 654.546830][T21884] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 654.661963][T21884] bond2: left promiscuous mode [ 654.661995][T21884] bridge2: left promiscuous mode [ 654.781517][T21897] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4651'. [ 654.901741][T21891] 8021q: adding VLAN 0 to HW filter on device bond9 [ 655.266633][T21911] siw: device registration error -23 [ 655.357612][T18655] net_ratelimit: 32 callbacks suppressed [ 655.357634][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 655.361821][T21912] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 655.462904][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 655.573021][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 655.644488][T21918] syzkaller1: entered promiscuous mode [ 655.644679][T21918] syzkaller1: entered allmulticast mode [ 655.683205][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 655.793397][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 655.906805][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 656.015815][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 656.129651][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 656.144655][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 656.526390][T21945] tipc: Can't bind to reserved service type 1 [ 657.056880][T21960] netlink: 'syz.4.4670': attribute type 10 has an invalid length. [ 657.589050][T21974] netlink: 'syz.3.4677': attribute type 3 has an invalid length. [ 657.589079][T21974] __nla_validate_parse: 6 callbacks suppressed [ 657.589090][T21974] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4677'. [ 658.250702][T21989] syzkaller0: entered promiscuous mode [ 658.250724][T21989] syzkaller0: entered allmulticast mode [ 658.251721][T21995] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4682'. [ 658.259268][T21995] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4682'. [ 658.441048][T21996] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4680'. [ 659.385996][T22021] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4690'. [ 659.770751][T22032] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4692'. [ 659.884682][T22015] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4685'. [ 659.884705][T22015] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4685'. [ 659.884721][T22015] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4685'. [ 660.089668][T22042] netlink: 'syz.1.4696': attribute type 10 has an invalid length. [ 660.413847][T18658] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 660.413870][T18658] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 660.462935][T18655] net_ratelimit: 43 callbacks suppressed [ 660.462958][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 660.485416][T18658] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 660.485437][T18658] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 660.561234][T22053] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4697'. [ 660.582937][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 660.701631][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 660.802728][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 660.916424][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 661.026337][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 661.132851][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 661.248591][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 661.342713][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 661.352755][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 662.228137][T22091] netlink: 'syz.0.4710': attribute type 10 has an invalid length. [ 662.541653][T22101] IPv6: NLM_F_REPLACE set, but no existing node found! [ 663.227833][T22121] __nla_validate_parse: 7 callbacks suppressed [ 663.227853][T22121] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4719'. [ 663.356419][T22121] bond1: option active_slave: mode dependency failed, not supported in mode broadcast(3) [ 663.383415][T22121] bond1 (unregistering): Released all slaves [ 663.461890][T22124] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4719'. [ 664.821161][T22165] netlink: 'syz.1.4729': attribute type 10 has an invalid length. [ 665.166023][T22174] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4732'. [ 665.170346][T22174] tipc: Enabled bearer , priority 0 [ 665.192218][T22173] tipc: Disabling bearer [ 665.324295][T22178] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4734'. [ 665.372061][T22176] nbd4: detected capacity change from 0 to 63 [ 665.383545][T22181] nbd5: detected capacity change from 0 to 63 [ 665.472627][T18671] net_ratelimit: 38 callbacks suppressed [ 665.472648][T18671] bond1: (slave bridge3): failed to get link speed/duplex [ 665.512699][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 665.540658][T19738] block nbd4: Receive control failed (result -104) [ 665.541426][ T4933] block nbd5: Receive control failed (result -32) [ 665.583094][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 665.697422][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 665.803525][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 665.914771][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 665.983661][T22209] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4741'. [ 665.990915][T22211] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4741'. [ 666.022900][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 666.239784][T22225] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 666.257326][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 666.328536][T22213] syzkaller0: entered promiscuous mode [ 666.328715][T22213] syzkaller0: entered allmulticast mode [ 666.363487][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 666.535581][T22205] vlan2: entered allmulticast mode [ 666.535605][T22205] bond0: entered allmulticast mode [ 666.535624][T22205] netdevsim netdevsim4 netdevsim1: entered allmulticast mode [ 666.542451][T22213] tipc: Enabled bearer , priority 0 [ 666.958723][T22213] tipc: Resetting bearer [ 667.054261][T22208] tipc: Resetting bearer [ 667.086776][T22208] tipc: Disabling bearer [ 667.093638][T22246] netlink: 'syz.1.4748': attribute type 10 has an invalid length. [ 667.134856][T22243] macsec1: entered promiscuous mode [ 667.817916][T22259] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4753'. [ 667.818908][T22259] netlink: 172 bytes leftover after parsing attributes in process `syz.3.4753'. [ 667.889670][T22259] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4753'. [ 668.033793][T22264] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4752'. [ 668.210685][T22267] netlink: 'syz.1.4755': attribute type 3 has an invalid length. [ 668.210711][T22267] netlink: 'syz.1.4755': attribute type 16 has an invalid length. [ 668.261987][T22275] __nla_validate_parse: 1 callbacks suppressed [ 668.262012][T22275] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4756'. [ 668.312374][T22275] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4756'. [ 670.702670][ C0] net_ratelimit: 12 callbacks suppressed [ 670.702695][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 670.922722][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 671.112786][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 671.224063][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 671.251996][T22301] tipc: Invalid UDP bearer configuration [ 671.252046][T22301] tipc: Enabling of bearer rejected, failed to enable media [ 671.281945][T22303] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4762'. [ 671.281980][T22303] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4762'. [ 671.317868][T22303] gretap0: entered promiscuous mode [ 671.354257][T22303] gretap0: left promiscuous mode [ 671.360008][T22307] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4762'. [ 671.360044][T22307] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4762'. [ 671.580299][T22307] gretap0: entered promiscuous mode [ 671.634587][T22326] netlink: 'syz.2.4765': attribute type 10 has an invalid length. [ 671.668441][T22307] gretap0: left promiscuous mode [ 671.742635][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 671.954717][T22333] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4768'. [ 672.136723][T22329] syzkaller0: entered promiscuous mode [ 672.136899][T22329] syzkaller0: entered allmulticast mode [ 672.234514][T22333] bond3: option lacp_active: invalid value (5) [ 672.237144][T22333] bond3 (unregistering): Released all slaves [ 672.239435][T22320] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4767'. [ 672.239454][T22320] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4767'. [ 672.239487][T22320] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4767'. [ 672.782835][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 673.675155][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 673.830865][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 674.863002][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 675.907170][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 676.942897][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 676.992821][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 677.185269][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 677.312932][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 677.324747][T22367] __nla_validate_parse: 1 callbacks suppressed [ 677.324764][T22367] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4777'. [ 677.425981][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 677.534451][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 677.542985][T22379] netlink: 'syz.1.4781': attribute type 10 has an invalid length. [ 677.653476][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 677.764299][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 677.831107][T22380] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4783'. [ 677.831129][T22380] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4783'. [ 677.831144][T22380] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4783'. [ 677.898107][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 678.041611][T22400] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4787'. [ 678.165728][T22402] bond1: option min_links: invalid value (18446744073709551612) [ 678.165755][T22402] bond1: option min_links: allowed values 0 - 2147483647 [ 678.181136][T22402] bond1 (unregistering): Released all slaves [ 678.302099][T22406] warn_alloc: 1 callbacks suppressed [ 678.302121][T22406] syz.0.4789: vmalloc error: size 34359742464, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 678.302182][T22406] CPU: 1 UID: 0 PID: 22406 Comm: syz.0.4789 Not tainted syzkaller #0 PREEMPT(full) [ 678.302204][T22406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 678.302216][T22406] Call Trace: [ 678.302224][T22406] [ 678.302233][T22406] dump_stack_lvl+0xe8/0x150 [ 678.302268][T22406] warn_alloc+0x24d/0x270 [ 678.302298][T22406] ? kasan_save_track+0x4f/0x80 [ 678.302320][T22406] ? kasan_save_track+0x3e/0x80 [ 678.302343][T22406] ? __pfx_warn_alloc+0x10/0x10 [ 678.302359][T22406] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 678.302386][T22406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.302425][T22406] __vmalloc_node_range_noprof+0x127/0x1540 [ 678.302476][T22406] ? rcu_is_watching+0x16/0xb0 [ 678.302506][T22406] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 678.302534][T22406] ? __kmalloc_cache_noprof+0x321/0x600 [ 678.302554][T22406] ? __kmalloc_cache_noprof+0x14d/0x600 [ 678.302573][T22406] ? xskq_create+0x56/0x220 [ 678.302689][T22406] xskq_create+0x148/0x220 [ 678.302711][T22406] ? xsk_init_queue+0x8a/0xe0 [ 678.302734][T22406] xsk_init_queue+0x8a/0xe0 [ 678.302758][T22406] xsk_setsockopt+0x5e0/0x960 [ 678.302781][T22406] ? __pfx_xsk_setsockopt+0x10/0x10 [ 678.302799][T22406] ? __pfx_aa_sk_perm+0x10/0x10 [ 678.302826][T22406] ? aa_sock_opt_perm+0x142/0x1e0 [ 678.302855][T22406] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 678.302881][T22406] ? __pfx_xsk_setsockopt+0x10/0x10 [ 678.302903][T22406] do_sock_setsockopt+0x17c/0x1b0 [ 678.302933][T22406] __x64_sys_setsockopt+0x13d/0x1b0 [ 678.302969][T22406] do_syscall_64+0x166/0x520 [ 678.302993][T22406] ? trace_irq_disable+0x3b/0x140 [ 678.303013][T22406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.303033][T22406] ? clear_bhb_loop+0x70/0xc0 [ 678.303057][T22406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.303076][T22406] RIP: 0033:0x7faed4d9e159 [ 678.303095][T22406] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.303112][T22406] RSP: 002b:00007faed5bff028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 678.303132][T22406] RAX: ffffffffffffffda RBX: 00007faed5026090 RCX: 00007faed4d9e159 [ 678.303147][T22406] RDX: 0000000000000003 RSI: 000000000000011b RDI: 000000000000000b [ 678.303159][T22406] RBP: 00007faed4e3506b R08: 0000000000000004 R09: 0000000000000000 [ 678.303171][T22406] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 678.303184][T22406] R13: 00007faed5026128 R14: 00007faed5026090 R15: 00007ffe41764cf8 [ 678.303216][T22406] [ 678.303958][T22406] Mem-Info: [ 678.303971][T22406] active_anon:6367 inactive_anon:0 isolated_anon:0 [ 678.303971][T22406] active_file:0 inactive_file:43785 isolated_file:0 [ 678.303971][T22406] unevictable:0 dirty:277 writeback:0 [ 678.303971][T22406] slab_reclaimable:11633 slab_unreclaimable:121518 [ 678.303971][T22406] mapped:29742 shmem:678 pagetables:1379 [ 678.303971][T22406] sec_pagetables:0 bounce:0 [ 678.303971][T22406] kernel_misc_reclaimable:0 [ 678.303971][T22406] free:1289685 free_pcp:11436 free_cma:0 [ 678.304020][T22406] Node 0 active_anon:25468kB inactive_anon:0kB active_file:0kB inactive_file:174932kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118968kB dirty:1108kB writeback:0kB shmem:2712kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15376kB pagetables:5372kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 678.304073][T22406] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 678.304120][T22406] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 678.343164][T22406] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 678.343209][T22406] Node 0 DMA32 free:1202332kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:25468kB inactive_anon:0kB active_file:0kB inactive_file:174932kB unevictable:0kB writepending:1108kB zspages:0kB present:3129332kB managed:2546940kB mlocked:0kB bounce:0kB free_pcp:38488kB local_pcp:18220kB free_cma:0kB [ 678.343267][T22406] lowmem_reserve[]: 0 0 0 0 0 [ 678.343308][T22406] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 678.343360][T22406] lowmem_reserve[]: 0 0 0 0 0 [ 678.343392][T22406] Node 1 Normal free:3940816kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:7556kB local_pcp:7556kB free_cma:0kB [ 678.343446][T22406] lowmem_reserve[]: 0 0 0 0 0 [ 678.343477][T22406] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 678.343587][T22406] Node 0 DMA32: 1993*4kB (UME) 501*8kB (UME) 739*16kB (UME) 267*32kB (UME) 132*64kB (UME) 54*128kB (UM) 72*256kB (UM) 21*512kB (UM) 13*1024kB (UME) 5*2048kB (UM) 269*4096kB (UM) = 1202268kB [ 678.343734][T22406] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 678.343823][T22406] Node 1 Normal: 2*4kB (UM) 1*8kB (M) 2*16kB (UM) 1*32kB (M) 2*64kB (UM) 2*128kB (UM) 2*256kB (M) 3*512kB (UM) 2*1024kB (UM) 0*2048kB 961*4096kB (M) = 3940816kB [ 678.343958][T22406] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 678.343974][T22406] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 678.343989][T22406] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 678.344004][T22406] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 678.344019][T22406] 44459 total pagecache pages [ 678.344026][T22406] 0 pages in swap cache [ 678.344033][T22406] Free swap = 124996kB [ 678.344041][T22406] Total swap = 124996kB [ 678.344049][T22406] 2097051 pages RAM [ 678.344056][T22406] 0 pages HighMem/MovableOnly [ 678.344063][T22406] 428700 pages reserved [ 678.344070][T22406] 0 pages cma reserved [ 678.391694][T22409] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4790'. [ 678.533492][T22408] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.4790'. [ 678.594447][T22408] Bluetooth: hci0: unsupported parameter 5161 [ 678.594468][T22408] Bluetooth: hci0: unsupported parameter 8192 [ 678.594479][T22408] Bluetooth: hci0: unsupported parameter 5161 [ 678.594490][T22408] Bluetooth: hci0: unsupported parameter 8192 [ 679.084805][T22414] IPVS: set_ctl: invalid protocol: 58 172.30.0.2:20004 [ 679.552720][T22437] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4798'. [ 680.184656][T22443] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4801'. [ 680.248278][T22444] netlink: 'syz.3.4802': attribute type 10 has an invalid length. [ 680.960923][T18665] net_ratelimit: 28 callbacks suppressed [ 680.960944][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 681.065199][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 681.102662][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 681.180873][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 681.283915][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 681.395051][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 681.504926][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 681.617688][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 681.620460][T22484] syzkaller0: entered promiscuous mode [ 681.620481][T22484] syzkaller0: entered allmulticast mode [ 681.726115][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 681.837592][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 681.923363][T22493] FAULT_INJECTION: forcing a failure. [ 681.923363][T22493] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 681.923397][T22493] CPU: 0 UID: 0 PID: 22493 Comm: syz.0.4820 Not tainted syzkaller #0 PREEMPT(full) [ 681.923418][T22493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 681.923430][T22493] Call Trace: [ 681.923438][T22493] [ 681.923447][T22493] dump_stack_lvl+0xe8/0x150 [ 681.923480][T22493] should_fail_ex+0x410/0x560 [ 681.923509][T22493] _copy_from_user+0x2d/0xb0 [ 681.923535][T22493] __sys_bpf+0x2e7/0xd90 [ 681.923566][T22493] ? __pfx___sys_bpf+0x10/0x10 [ 681.923598][T22493] ? __fget_files+0x2a/0x420 [ 681.923642][T22493] ? ksys_write+0x242/0x270 [ 681.923673][T22493] ? __pfx_ksys_write+0x10/0x10 [ 681.923705][T22493] __x64_sys_bpf+0xba/0xd0 [ 681.923728][T22493] do_syscall_64+0x166/0x520 [ 681.923751][T22493] ? trace_irq_disable+0x3b/0x140 [ 681.923774][T22493] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.923794][T22493] ? clear_bhb_loop+0x70/0xc0 [ 681.923818][T22493] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.923837][T22493] RIP: 0033:0x7faed4d9e159 [ 681.923856][T22493] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 681.923873][T22493] RSP: 002b:00007faed5c20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 681.923894][T22493] RAX: ffffffffffffffda RBX: 00007faed5025fa0 RCX: 00007faed4d9e159 [ 681.923908][T22493] RDX: 0000000000000050 RSI: 0000200000000840 RDI: 000000000000000a [ 681.923921][T22493] RBP: 00007faed5c20090 R08: 0000000000000000 R09: 0000000000000000 [ 681.923940][T22493] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 681.923951][T22493] R13: 00007faed5026038 R14: 00007faed5025fa0 R15: 00007ffe41764cf8 [ 681.923982][T22493] [ 682.173959][T22503] netlink: 'syz.0.4824': attribute type 16 has an invalid length. [ 682.173983][T22503] netlink: 'syz.0.4824': attribute type 17 has an invalid length. [ 682.179707][T22504] netlink: 'syz.4.4822': attribute type 10 has an invalid length. [ 682.254715][T22508] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4823'. [ 682.339826][T22503] veth0_to_batadv: left allmulticast mode [ 682.540210][T22509] lo speed is unknown, defaulting to 1000 [ 682.557730][T22503] xt_bpf: check failed: parse error [ 683.289407][T22528] Cannot find add_set index 0 as target [ 683.397241][T22529] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4830'. [ 683.522930][T22528] syzkaller1: entered promiscuous mode [ 683.523107][T22528] syzkaller1: entered allmulticast mode [ 683.558427][T22509] wg2 speed is unknown, defaulting to 1000 [ 683.706373][T22537] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4834'. [ 684.638440][T22574] netlink: 'syz.3.4838': attribute type 10 has an invalid length. [ 685.423623][T22593] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4847'. [ 685.425989][T22594] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4847'. [ 686.302617][ C0] net_ratelimit: 25 callbacks suppressed [ 686.302642][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 686.492455][T22601] netlink: 19 bytes leftover after parsing attributes in process `syz.3.4849'. [ 687.342824][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 687.686139][T22605] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4851'. [ 687.695540][T22604] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.231580][T22612] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4854'. [ 688.231619][T22612] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4854'. [ 688.382629][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 688.424800][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 688.553220][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 688.665009][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 688.852865][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 688.964664][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 688.965240][T22630] netlink: 'syz.4.4859': attribute type 10 has an invalid length. [ 689.072742][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 689.152391][T22634] siw: device registration error -23 [ 689.164837][T22634] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4862'. [ 689.187933][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 689.207560][T22640] x_tables: duplicate underflow at hook 3 [ 689.391858][T22639] bond10: option lp_interval: invalid value (0) [ 689.391884][T22639] bond10: option lp_interval: allowed values 1 - 2147483647 [ 689.402246][T22639] bond10 (unregistering): Released all slaves [ 689.536668][T22644] netlink: 'syz.0.4867': attribute type 30 has an invalid length. [ 689.536691][T22644] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4867'. [ 689.536717][T22644] bond0: option arp_missed_max: invalid value (0) [ 689.536734][T22644] bond0: option arp_missed_max: allowed values 1 - 255 [ 690.398311][T22672] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4875'. [ 691.333995][T18669] net_ratelimit: 19 callbacks suppressed [ 691.334022][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 691.454900][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 691.530564][T22692] tipc: Enabling of bearer rejected, failed to enable media [ 691.571618][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 691.640208][T22696] FAULT_INJECTION: forcing a failure. [ 691.640208][T22696] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 691.640246][T22696] CPU: 0 UID: 0 PID: 22696 Comm: syz.2.4883 Not tainted syzkaller #0 PREEMPT(full) [ 691.640269][T22696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 691.640281][T22696] Call Trace: [ 691.640289][T22696] [ 691.640299][T22696] dump_stack_lvl+0xe8/0x150 [ 691.640332][T22696] should_fail_ex+0x410/0x560 [ 691.640361][T22696] _copy_from_user+0x2d/0xb0 [ 691.640385][T22696] ___sys_sendmsg+0x1c6/0x360 [ 691.640408][T22696] ? __lock_acquire+0x747/0x2de0 [ 691.640432][T22696] ? __pfx____sys_sendmsg+0x10/0x10 [ 691.640490][T22696] ? __fget_files+0x2a/0x420 [ 691.640515][T22696] ? __fget_files+0x3a2/0x420 [ 691.640550][T22696] __x64_sys_sendmsg+0x1b1/0x290 [ 691.640579][T22696] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 691.640624][T22696] do_syscall_64+0x166/0x520 [ 691.640648][T22696] ? trace_irq_disable+0x3b/0x140 [ 691.640668][T22696] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.640687][T22696] ? clear_bhb_loop+0x70/0xc0 [ 691.640710][T22696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.640730][T22696] RIP: 0033:0x7fbad699e159 [ 691.640748][T22696] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 691.640764][T22696] RSP: 002b:00007fbad7875028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 691.640784][T22696] RAX: ffffffffffffffda RBX: 00007fbad6c25fa0 RCX: 00007fbad699e159 [ 691.640799][T22696] RDX: 0000000000040000 RSI: 0000200000000000 RDI: 0000000000000003 [ 691.640810][T22696] RBP: 00007fbad7875090 R08: 0000000000000000 R09: 0000000000000000 [ 691.640822][T22696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 691.640834][T22696] R13: 00007fbad6c26038 R14: 00007fbad6c25fa0 R15: 00007fff1ad5a068 [ 691.640865][T22696] [ 691.673114][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 691.842915][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 691.914733][T22697] netlink: 'syz.1.4882': attribute type 10 has an invalid length. [ 691.952813][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 692.232831][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 692.345263][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 692.458351][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 692.542697][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 692.828362][T22730] netlink: 'syz.1.4891': attribute type 1 has an invalid length. [ 692.926633][T22738] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 693.214797][T22755] netlink: 'syz.0.4893': attribute type 1 has an invalid length. [ 693.480928][T22757] netlink: 'syz.4.4898': attribute type 4 has an invalid length. [ 693.532088][T22765] netlink: 'syz.4.4898': attribute type 4 has an invalid length. [ 693.694881][T22738] bond1 (unregistering): Released all slaves [ 694.292014][T22793] netlink: 'syz.0.4901': attribute type 10 has an invalid length. [ 694.795914][T22803] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4904'. [ 695.393929][T22821] FAULT_INJECTION: forcing a failure. [ 695.393929][T22821] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 695.393960][T22821] CPU: 1 UID: 0 PID: 22821 Comm: syz.0.4907 Not tainted syzkaller #0 PREEMPT(full) [ 695.393980][T22821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 695.393990][T22821] Call Trace: [ 695.393997][T22821] [ 695.394005][T22821] dump_stack_lvl+0xe8/0x150 [ 695.394036][T22821] should_fail_ex+0x410/0x560 [ 695.394063][T22821] _copy_to_user+0x31/0xb0 [ 695.394088][T22821] bpf_test_finish+0x1cf/0x690 [ 695.394252][T22821] ? __pfx_bpf_test_finish+0x10/0x10 [ 695.394283][T22821] ? _copy_from_user+0x94/0xb0 [ 695.394306][T22821] ? bpf_test_init+0x113/0x150 [ 695.394333][T22821] bpf_prog_test_run_xdp+0x8bc/0x11d0 [ 695.394377][T22821] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 695.394410][T22821] ? __fget_files+0x2a/0x420 [ 695.394440][T22821] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 695.394468][T22821] bpf_prog_test_run+0x2c5/0x340 [ 695.394503][T22821] __sys_bpf+0xa22/0xd90 [ 695.394530][T22821] ? __pfx___sys_bpf+0x10/0x10 [ 695.394560][T22821] ? __fget_files+0x2a/0x420 [ 695.394602][T22821] ? ksys_write+0x242/0x270 [ 695.394631][T22821] ? __pfx_ksys_write+0x10/0x10 [ 695.394663][T22821] __x64_sys_bpf+0xba/0xd0 [ 695.394686][T22821] do_syscall_64+0x166/0x520 [ 695.394707][T22821] ? trace_irq_disable+0x3b/0x140 [ 695.394727][T22821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.394747][T22821] ? clear_bhb_loop+0x70/0xc0 [ 695.394770][T22821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 695.394789][T22821] RIP: 0033:0x7faed4d9e159 [ 695.394807][T22821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 695.394822][T22821] RSP: 002b:00007faed5c20028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 695.394941][T22821] RAX: ffffffffffffffda RBX: 00007faed5025fa0 RCX: 00007faed4d9e159 [ 695.394955][T22821] RDX: 0000000000000050 RSI: 0000200000000840 RDI: 000000000000000a [ 695.394965][T22821] RBP: 00007faed5c20090 R08: 0000000000000000 R09: 0000000000000000 [ 695.394974][T22821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 695.394984][T22821] R13: 00007faed5026038 R14: 00007faed5025fa0 R15: 00007ffe41764cf8 [ 695.395014][T22821] [ 695.656643][ T2458] block nbd4: Possible stuck request ffff888027fa7000: control (read@0,1024B). Runtime 30 seconds [ 695.657744][ T2458] block nbd4: Possible stuck request ffff888027fa71c0: control (read@1024,1024B). Runtime 30 seconds [ 695.657777][ T2458] block nbd4: Possible stuck request ffff888027fa7380: control (read@2048,1024B). Runtime 30 seconds [ 695.657811][ T2458] block nbd4: Possible stuck request ffff888027fa7540: control (read@3072,1024B). Runtime 30 seconds [ 695.657881][ T41] block nbd5: Possible stuck request ffff888028017000: control (read@0,1024B). Runtime 30 seconds [ 695.657911][ T41] block nbd5: Possible stuck request ffff8880280171c0: control (read@1024,1024B). Runtime 30 seconds [ 695.657935][ T41] block nbd5: Possible stuck request ffff888028017380: control (read@2048,2048B). Runtime 30 seconds [ 696.383585][T18658] net_ratelimit: 28 callbacks suppressed [ 696.383609][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 696.495086][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 696.604278][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 696.704027][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 696.714449][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 696.825388][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 696.932867][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 697.043383][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 697.152945][T18655] bond1: (slave bridge3): failed to get link speed/duplex [ 697.284788][T22860] netlink: 'syz.1.4917': attribute type 10 has an invalid length. [ 697.615742][T18658] bond1: (slave bridge3): failed to get link speed/duplex [ 698.058174][T22878] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4923'. [ 698.591323][T22898] netlink: 'syz.3.4929': attribute type 1 has an invalid length. [ 698.645614][T22892] netlink: 'syz.2.4928': attribute type 4 has an invalid length. [ 698.645647][T22892] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4928'. [ 698.746739][T22893] syzkaller0: entered promiscuous mode [ 698.746763][T22893] syzkaller0: entered allmulticast mode [ 698.862333][T22898] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4929'. [ 698.985096][T22910] 8021q: adding VLAN 0 to HW filter on device bond6 [ 698.988394][T22910] bond5: (slave bond6): making interface the new active one [ 698.989487][T22910] bond5: (slave bond6): Enslaving as an active interface with an up link [ 698.996864][T22914] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4930'. [ 699.080207][T22911] bond5: (slave gretap1): Enslaving as a backup interface with an up link [ 699.156353][T22921] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4932'. [ 699.156404][T22921] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4932'. [ 699.188310][T22898] 8021q: adding VLAN 0 to HW filter on device bond5 [ 699.394747][T22914] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 699.394772][T22914] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 699.397164][T22914] tipc: Resetting bearer [ 699.430716][T22914] tipc: Disabling bearer [ 699.441136][T22931] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4935'. [ 699.445794][T22932] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4934'. [ 700.344754][T22946] 8021q: VLANs not supported on ip6_vti0 [ 700.643118][T22960] sctp: [Deprecated]: syz.0.4944 (pid 22960) Use of struct sctp_assoc_value in delayed_ack socket option. [ 700.643118][T22960] Use struct sctp_sack_info instead [ 701.205141][T22992] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4947'. [ 701.256124][T22993] FAULT_INJECTION: forcing a failure. [ 701.256124][T22993] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 701.256159][T22993] CPU: 0 UID: 0 PID: 22993 Comm: syz.0.4951 Not tainted syzkaller #0 PREEMPT(full) [ 701.256181][T22993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 701.256193][T22993] Call Trace: [ 701.256201][T22993] [ 701.256210][T22993] dump_stack_lvl+0xe8/0x150 [ 701.256245][T22993] should_fail_ex+0x410/0x560 [ 701.256272][T22993] _copy_to_user+0x31/0xb0 [ 701.256301][T22993] simple_read_from_buffer+0xe1/0x170 [ 701.256336][T22993] proc_fail_nth_read+0x1bb/0x230 [ 701.256366][T22993] ? common_file_perm+0x20e/0x2b0 [ 701.256393][T22993] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 701.256424][T22993] ? rw_verify_area+0x24a/0x4c0 [ 701.256453][T22993] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 701.256481][T22993] vfs_read+0x213/0xa80 [ 701.256514][T22993] ? __pfx___mutex_lock+0x10/0x10 [ 701.256540][T22993] ? __pfx_vfs_read+0x10/0x10 [ 701.256568][T22993] ? __fget_files+0x2a/0x420 [ 701.256598][T22993] ? __fget_files+0x3a2/0x420 [ 701.256622][T22993] ? __fget_files+0x2a/0x420 [ 701.256656][T22993] ksys_read+0x150/0x270 [ 701.256686][T22993] ? __pfx_ksys_read+0x10/0x10 [ 701.256725][T22993] do_syscall_64+0x166/0x520 [ 701.256748][T22993] ? trace_irq_disable+0x3b/0x140 [ 701.256768][T22993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.256788][T22993] ? clear_bhb_loop+0x70/0xc0 [ 701.256811][T22993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.256831][T22993] RIP: 0033:0x7faed4d5e98e [ 701.256850][T22993] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 701.256865][T22993] RSP: 002b:00007faed5c1ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 701.256886][T22993] RAX: ffffffffffffffda RBX: 00007faed5c206c0 RCX: 00007faed4d5e98e [ 701.256900][T22993] RDX: 000000000000000f RSI: 00007faed5c200a0 RDI: 0000000000000004 [ 701.256920][T22993] RBP: 00007faed5c20090 R08: 0000000000000000 R09: 0000000000000000 [ 701.256932][T22993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 701.256944][T22993] R13: 00007faed5026038 R14: 00007faed5025fa0 R15: 00007ffe41764cf8 [ 701.256975][T22993] [ 701.454203][T18669] net_ratelimit: 34 callbacks suppressed [ 701.454225][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 701.563661][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 701.614806][T23001] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4952'. [ 701.824789][ T6941] bond1: (slave bridge3): failed to get link speed/duplex [ 701.903519][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 701.921152][T23003] bridge_slave_0: left promiscuous mode [ 701.921409][T23003] bridge0: port 1(bridge_slave_0) entered disabled state [ 701.953920][T23003] bridge_slave_1: left allmulticast mode [ 701.953947][T23003] bridge_slave_1: left promiscuous mode [ 701.954164][T23003] bridge0: port 2(bridge_slave_1) entered disabled state [ 702.025740][T23003] team0: Port device bond_slave_0 removed [ 702.052104][T23003] bond0: (slave bond_slave_1): Releasing backup interface [ 702.153357][T23003] team0: Port device team_slave_1 removed [ 702.154249][T23003] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 702.154276][T23003] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 702.165842][T23003] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 702.252743][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 702.403643][T23019] netlink: 'syz.4.4956': attribute type 11 has an invalid length. [ 702.634896][T23018] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4958'. [ 702.834940][T23018] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4958'. [ 702.889030][T23042] netlink: 19 bytes leftover after parsing attributes in process `syz.3.4963'. [ 702.921913][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 702.927729][T23042] netlink: 19 bytes leftover after parsing attributes in process `syz.3.4963'. [ 702.943238][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 703.043093][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 703.152690][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 703.351071][T23051] netlink: 'syz.2.4967': attribute type 16 has an invalid length. [ 703.351095][T23051] netlink: 'syz.2.4967': attribute type 17 has an invalid length. [ 703.424522][T23053] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4968'. [ 703.579082][T23060] xt_socket: unknown flags 0x4 [ 703.681970][T23051] xt_bpf: check failed: parse error [ 703.725371][T23066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4972'. [ 703.725401][T23066] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4972'. [ 703.739969][T23066] syzkaller1: entered promiscuous mode [ 703.739991][T23066] syzkaller1: entered allmulticast mode [ 703.808749][T23066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4972'. [ 703.869409][T23066] vlan3: entered allmulticast mode [ 704.643353][T23087] veth3: entered allmulticast mode [ 706.191997][T23140] ip6gre1: entered promiscuous mode [ 706.192021][T23140] ip6gre1: entered allmulticast mode [ 706.203529][T18669] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.203747][T18669] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.223345][ T5735] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.510391][T23155] netlink: 'syz.4.4994': attribute type 10 has an invalid length. [ 706.522755][T18669] net_ratelimit: 24 callbacks suppressed [ 706.522775][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 706.635130][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 706.742882][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 706.822814][ T5720] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.826165][T23160] __nla_validate_parse: 7 callbacks suppressed [ 706.826198][T23160] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4997'. [ 706.852345][T23160] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4997'. [ 706.855543][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 706.901687][T23162] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 706.966035][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 707.028644][ T5720] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 707.102620][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 707.108963][T23168] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 707.112120][T23168] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4998'. [ 707.124088][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 707.234497][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 707.725127][T23185] syzkaller1: entered promiscuous mode [ 707.725152][T23185] syzkaller1: entered allmulticast mode [ 707.808006][T23185] af_packet: tpacket_rcv: packet too big, clamped from 64862 to 3952. macoff=96 [ 707.888325][T23188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5007'. [ 707.954495][T23185] bond3: entered promiscuous mode [ 707.955125][T23185] 8021q: adding VLAN 0 to HW filter on device bond3 [ 708.009209][T23193] netlink: 'syz.3.5009': attribute type 10 has an invalid length. [ 708.077382][T23188] 8021q: adding VLAN 0 to HW filter on device bond3 [ 708.077791][T23188] bond3: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 708.087432][T23188] bond3: (slave ip6gre1): Error -95 calling set_mac_address [ 708.135864][T23193] bridge0: port 2(bridge_slave_1) entered disabled state [ 708.136524][T23193] bridge0: port 1(bridge_slave_0) entered disabled state [ 708.185351][T23193] bridge0: port 2(bridge_slave_1) entered blocking state [ 708.185524][T23193] bridge0: port 2(bridge_slave_1) entered forwarding state [ 708.185931][T23193] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.186056][T23193] bridge0: port 1(bridge_slave_0) entered forwarding state [ 708.247183][T23193] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 708.622072][T23206] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5012'. [ 709.338465][T23228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5017'. [ 709.338497][T23228] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5017'. [ 709.371529][T23228] syzkaller1: entered promiscuous mode [ 709.371564][T23228] syzkaller1: entered allmulticast mode [ 709.438468][T23228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5017'. [ 709.477668][T23228] vlan3: entered allmulticast mode [ 709.805209][T23237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5018'. [ 709.902717][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 710.240335][T23262] syzkaller1: entered promiscuous mode [ 710.240358][T23262] syzkaller1: entered allmulticast mode [ 710.264672][T23262] netlink: 'syz.0.5028': attribute type 2 has an invalid length. [ 710.266213][T23262] netlink: 'syz.0.5028': attribute type 2 has an invalid length. [ 710.266233][T23262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5028'. [ 711.500219][T23291] syzkaller1: entered promiscuous mode [ 711.500415][T23291] syzkaller1: entered allmulticast mode [ 711.565961][T18673] net_ratelimit: 32 callbacks suppressed [ 711.565984][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 711.570040][T23279] ip_tables: iptables: counters copy to user failed while replacing table [ 711.590624][T23291] vlan3: entered allmulticast mode [ 711.753538][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 712.043077][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 712.043307][T23299] IPVS: Unknown mcast interface: vcan0 [ 712.066049][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.138115][T23299] team0: Port device xfrm0 added [ 712.167318][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 712.178328][T23304] tipc: Enabled bearer , priority 0 [ 712.270216][T23305] [ 712.272594][T23305] ====================================================== [ 712.275565][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 712.286711][T23305] WARNING: possible circular locking dependency detected [ 712.293744][T23305] syzkaller #0 Not tainted [ 712.298154][T23305] ------------------------------------------------------ [ 712.305158][T23305] syz.3.5040/23305 is trying to acquire lock: [ 712.311211][T23305] ffffffff8ee90160 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x149/0x600 [ 712.320339][T23305] [ 712.320339][T23305] but task is already holding lock: [ 712.327693][T23305] ffff888078779078 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 712.337183][T23305] [ 712.337183][T23305] which lock already depends on the new lock. [ 712.337183][T23305] [ 712.347571][T23305] [ 712.347571][T23305] the existing dependency chain (in reverse order) is: [ 712.356573][T23305] [ 712.356573][T23305] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 712.364125][T23305] __might_fault+0xcb/0x130 [ 712.369162][T23305] _copy_from_user+0x28/0xb0 [ 712.374270][T23305] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 712.380842][T23305] ip_generic_getfrag+0x149/0x2d0 [ 712.386440][T23305] __ip6_append_data+0x3b26/0x40c0 [ 712.392181][T23305] ip6_append_data+0x108/0x270 [ 712.397459][T23305] rawv6_sendmsg+0x1298/0x18c0 [ 712.402787][T23305] sock_sendmsg_nosec+0x10e/0x180 [ 712.408321][T23305] ____sys_sendmsg+0x54e/0x850 [ 712.413601][T23305] ___sys_sendmsg+0x2a5/0x360 [ 712.419413][T23305] __x64_sys_sendmsg+0x1b1/0x290 [ 712.424896][T23305] do_syscall_64+0x166/0x520 [ 712.430011][T23305] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.436428][T23305] [ 712.436428][T23305] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 712.444155][T23305] lock_sock_nested+0x41/0x100 [ 712.449433][T23305] inet_shutdown+0x6a/0x390 [ 712.454531][T23305] nbd_mark_nsock_dead+0x2cb/0x550 [ 712.460233][T23305] recv_work+0x1cee/0x1e10 [ 712.465158][T23305] process_scheduled_works+0xc3d/0x1630 [ 712.471219][T23305] worker_thread+0xa47/0xfb0 [ 712.476321][T23305] kthread+0x38b/0x480 [ 712.480905][T23305] ret_from_fork+0x514/0xb70 [ 712.486027][T23305] ret_from_fork_asm+0x1a/0x30 [ 712.491312][T23305] [ 712.491312][T23305] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 712.499060][T23305] __mutex_lock+0x19d/0x1550 [ 712.504640][T23305] nbd_queue_rq+0x373/0xff0 [ 712.509671][T23305] blk_mq_dispatch_rq_list+0x499/0x1990 [ 712.515853][T23305] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 712.522743][T23305] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 712.529241][T23305] blk_mq_run_work_fn+0x16c/0x300 [ 712.534784][T23305] process_scheduled_works+0xc3d/0x1630 [ 712.540858][T23305] worker_thread+0xa47/0xfb0 [ 712.545984][T23305] kthread+0x38b/0x480 [ 712.550571][T23305] ret_from_fork+0x514/0xb70 [ 712.555678][T23305] ret_from_fork_asm+0x1a/0x30 [ 712.560966][T23305] [ 712.560966][T23305] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 712.568194][T23305] __mutex_lock+0x19d/0x1550 [ 712.573300][T23305] nbd_queue_rq+0xc1/0xff0 [ 712.578230][T23305] blk_mq_dispatch_rq_list+0x499/0x1990 [ 712.584376][T23305] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 712.591231][T23305] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 712.597762][T23305] blk_mq_run_work_fn+0x16c/0x300 [ 712.603493][T23305] process_scheduled_works+0xc3d/0x1630 [ 712.609821][T23305] worker_thread+0xa47/0xfb0 [ 712.614950][T23305] kthread+0x38b/0x480 [ 712.619537][T23305] ret_from_fork+0x514/0xb70 [ 712.624643][T23305] ret_from_fork_asm+0x1a/0x30 [ 712.629942][T23305] [ 712.629942][T23305] -> #3 (set->srcu){.+.+}-{0:0}: [ 712.637415][T23305] __synchronize_srcu+0xc9/0x2f0 [ 712.642926][T23305] elevator_switch+0x1e8/0x7b0 [ 712.648303][T23305] elevator_change+0x2fa/0x480 [ 712.653582][T23305] elevator_set_default+0x375/0x440 [ 712.659292][T23305] blk_register_queue+0x3f3/0x4e0 [ 712.664903][T23305] __add_disk+0x6b8/0xdb0 [ 712.669746][T23305] add_disk_fwnode+0x100/0x3a0 [ 712.675031][T23305] nbd_dev_add+0x733/0xb60 [ 712.679957][T23305] nbd_init+0x168/0x1f0 [ 712.684725][T23305] do_one_initcall+0x250/0x870 [ 712.690014][T23305] do_initcall_level+0x10a/0x1a0 [ 712.695500][T23305] do_initcalls+0x59/0xa0 [ 712.700367][T23305] kernel_init_freeable+0x29d/0x3e0 [ 712.706102][T23305] kernel_init+0x22/0x1d0 [ 712.710961][T23305] ret_from_fork+0x514/0xb70 [ 712.716065][T23305] ret_from_fork_asm+0x1a/0x30 [ 712.721348][T23305] [ 712.721348][T23305] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 712.729176][T23305] __mutex_lock+0x19d/0x1550 [ 712.734285][T23305] elevator_change+0x1af/0x480 [ 712.739568][T23305] elevator_set_none+0xb5/0x140 [ 712.744928][T23305] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 712.751267][T23305] nbd_start_device+0x189/0xb30 [ 712.756629][T23305] nbd_genl_connect+0x167d/0x1cd0 [ 712.762193][T23305] genl_family_rcv_msg_doit+0x233/0x340 [ 712.768251][T23305] genl_rcv_msg+0x614/0x7a0 [ 712.773265][T23305] netlink_rcv_skb+0x226/0x4a0 [ 712.778546][T23305] genl_rcv+0x28/0x40 [ 712.783040][T23305] netlink_unicast+0x7bd/0x940 [ 712.788358][T23305] netlink_sendmsg+0x813/0xb40 [ 712.793648][T23305] sock_sendmsg_nosec+0x13a/0x180 [ 712.799210][T23305] ____sys_sendmsg+0x54e/0x850 [ 712.804504][T23305] ___sys_sendmsg+0x2a5/0x360 [ 712.809717][T23305] __x64_sys_sendmsg+0x1b1/0x290 [ 712.815176][T23305] do_syscall_64+0x166/0x520 [ 712.820284][T23305] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.826690][T23305] [ 712.826690][T23305] -> #1 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 712.835293][T23305] blk_alloc_queue+0x544/0x690 [ 712.840573][T23305] __blk_mq_alloc_disk+0x194/0x390 [ 712.846213][T23305] nbd_dev_add+0x494/0xb60 [ 712.851140][T23305] nbd_init+0x168/0x1f0 [ 712.855815][T23305] do_one_initcall+0x250/0x870 [ 712.861121][T23305] do_initcall_level+0x10a/0x1a0 [ 712.866595][T23305] do_initcalls+0x59/0xa0 [ 712.871451][T23305] kernel_init_freeable+0x29d/0x3e0 [ 712.877190][T23305] kernel_init+0x22/0x1d0 [ 712.882060][T23305] ret_from_fork+0x514/0xb70 [ 712.887181][T23305] ret_from_fork_asm+0x1a/0x30 [ 712.892485][T23305] [ 712.892485][T23305] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 712.899794][T23305] __lock_acquire+0x164c/0x2de0 [ 712.905187][T23305] lock_acquire+0x115/0x350 [ 712.910310][T23305] fs_reclaim_acquire+0x71/0x100 [ 712.915779][T23305] prepare_alloc_pages+0x149/0x600 [ 712.921429][T23305] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 712.927777][T23305] alloc_pages_mpol+0x21e/0x390 [ 712.933152][T23305] alloc_pages_noprof+0xb1/0x2b0 [ 712.938612][T23305] __pmd_alloc+0x3a/0x5c0 [ 712.943474][T23305] handle_mm_fault+0xe9d/0x3750 [ 712.948858][T23305] do_user_addr_fault+0x746/0x1340 [ 712.954571][T23305] exc_page_fault+0x6a/0xc0 [ 712.959588][T23305] asm_exc_page_fault+0x26/0x30 [ 712.964948][T23305] __get_user_4+0x14/0x30 [ 712.969784][T23305] pppoe_ioctl+0x147/0x2d0 [ 712.974863][T23305] pppox_ioctl+0x1ae/0x3f0 [ 712.979850][T23305] sock_do_ioctl+0x101/0x320 [ 712.984968][T23305] sock_ioctl+0x57a/0x7e0 [ 712.989823][T23305] __se_sys_ioctl+0xfc/0x170 [ 712.994937][T23305] do_syscall_64+0x166/0x520 [ 713.000043][T23305] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.006446][T23305] [ 713.006446][T23305] other info that might help us debug this: [ 713.006446][T23305] [ 713.016661][T23305] Chain exists of: [ 713.016661][T23305] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 713.016661][T23305] [ 713.029251][T23305] Possible unsafe locking scenario: [ 713.029251][T23305] [ 713.036686][T23305] CPU0 CPU1 [ 713.042038][T23305] ---- ---- [ 713.047432][T23305] rlock(&mm->mmap_lock); [ 713.051842][T23305] lock(sk_lock-AF_INET6); [ 713.058866][T23305] lock(&mm->mmap_lock); [ 713.065730][T23305] lock(fs_reclaim); [ 713.069713][T23305] [ 713.069713][T23305] *** DEADLOCK *** [ 713.069713][T23305] [ 713.077845][T23305] locks held by syz.3.5040/23305: 2, last CPU#0: [ 713.084161][T23305] #0: ffff88803393e260 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppox_ioctl+0x4d/0x3f0 [ 713.093469][T23305] #1: ffff888078779078 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 713.103382][T23305] [ 713.103382][T23305] stack backtrace: [ 713.109258][T23305] CPU: 0 UID: 0 PID: 23305 Comm: syz.3.5040 Not tainted syzkaller #0 PREEMPT(full) [ 713.118615][T23305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 713.128663][T23305] Call Trace: [ 713.131939][T23305] [ 713.134861][T23305] dump_stack_lvl+0xe8/0x150 [ 713.139451][T23305] print_circular_bug+0x2e2/0x300 [ 713.144474][T23305] check_noncircular+0x12f/0x150 [ 713.149413][T23305] __lock_acquire+0x164c/0x2de0 [ 713.154262][T23305] ? __lock_acquire+0x747/0x2de0 [ 713.159201][T23305] lock_acquire+0x115/0x350 [ 713.163708][T23305] ? prepare_alloc_pages+0x149/0x600 [ 713.168997][T23305] fs_reclaim_acquire+0x71/0x100 [ 713.173933][T23305] ? prepare_alloc_pages+0x149/0x600 [ 713.179395][T23305] prepare_alloc_pages+0x149/0x600 [ 713.184532][T23305] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 713.190357][T23305] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 713.196685][T23305] ? __pfx_policy_nodemask+0x10/0x10 [ 713.201973][T23305] ? is_bpf_text_address+0x292/0x2b0 [ 713.207254][T23305] ? is_bpf_text_address+0x26/0x2b0 [ 713.212455][T23305] alloc_pages_mpol+0x21e/0x390 [ 713.217306][T23305] alloc_pages_noprof+0xb1/0x2b0 [ 713.222242][T23305] __pmd_alloc+0x3a/0x5c0 [ 713.226567][T23305] handle_mm_fault+0xe9d/0x3750 [ 713.231415][T23305] ? handle_mm_fault+0xf1/0x3750 [ 713.236351][T23305] ? __pfx_handle_mm_fault+0x10/0x10 [ 713.241639][T23305] ? lock_mm_and_find_vma+0xa7/0x340 [ 713.246922][T23305] do_user_addr_fault+0x746/0x1340 [ 713.252031][T23305] exc_page_fault+0x6a/0xc0 [ 713.256530][T23305] asm_exc_page_fault+0x26/0x30 [ 713.261370][T23305] RIP: 0010:__get_user_4+0x14/0x30 [ 713.266475][T23305] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 713.286083][T23305] RSP: 0018:ffffc9000204fc40 EFLAGS: 00050287 [ 713.292163][T23305] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000046 [ 713.300165][T23305] RDX: 00007ffffffff000 RSI: ffffffff8e69baf3 RDI: ffffffff8c6da080 [ 713.308129][T23305] RBP: 0000000000000001 R08: ffffffff821ebc3f R09: 0000000000000000 [ 713.316097][T23305] R10: 0000000080047453 R11: 0000000000000002 R12: dffffc0000000000 [ 713.324058][T23305] R13: 0000000000000000 R14: ffff88803393e000 R15: ffff88803393e012 [ 713.332026][T23305] ? __might_fault+0xaf/0x130 [ 713.336708][T23305] pppoe_ioctl+0x147/0x2d0 [ 713.341123][T23305] pppox_ioctl+0x1ae/0x3f0 [ 713.345540][T23305] sock_do_ioctl+0x101/0x320 [ 713.350132][T23305] ? __pfx_sock_do_ioctl+0x10/0x10 [ 713.355245][T23305] ? hook_file_ioctl+0x1f2/0x600 [ 713.360182][T23305] sock_ioctl+0x57a/0x7e0 [ 713.364508][T23305] ? __pfx_sock_ioctl+0x10/0x10 [ 713.369357][T23305] ? __fget_files+0x2a/0x420 [ 713.373942][T23305] ? __fget_files+0x3a2/0x420 [ 713.378613][T23305] ? __fget_files+0x2a/0x420 [ 713.383289][T23305] ? bpf_lsm_file_ioctl+0x9/0x20 [ 713.388224][T23305] ? __pfx_sock_ioctl+0x10/0x10 [ 713.393072][T23305] __se_sys_ioctl+0xfc/0x170 [ 713.397667][T23305] do_syscall_64+0x166/0x520 [ 713.402270][T23305] ? trace_irq_disable+0x3b/0x140 [ 713.407310][T23305] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.413382][T23305] ? clear_bhb_loop+0x70/0xc0 [ 713.418053][T23305] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 713.423940][T23305] RIP: 0033:0x7f404839e159 [ 713.428353][T23305] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 713.447956][T23305] RSP: 002b:00007f404927f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 713.456367][T23305] RAX: ffffffffffffffda RBX: 00007f4048625fa0 RCX: 00007f404839e159 [ 713.464329][T23305] RDX: 0000000000000000 RSI: 0000000040047452 RDI: 0000000000000007 [ 713.472498][T23305] RBP: 00007f404843506b R08: 0000000000000000 R09: 0000000000000000 [ 713.480480][T23305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 713.488447][T23305] R13: 00007f4048626038 R14: 00007f4048625fa0 R15: 00007ffeb7602ff8 [ 713.496419][T23305] [ 713.500151][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 713.526911][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 713.571620][T23307] ipvlan2: entered promiscuous mode [ 713.574293][T23307] team0: Device ipvlan2 failed to register rx_handler [ 713.652679][T18670] bond1: (slave bridge3): failed to get link speed/duplex [ 716.624896][ C0] net_ratelimit: 29 callbacks suppressed [ 716.624922][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 716.628966][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 716.732712][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 716.842601][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 716.952894][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 717.062836][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 717.172623][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 717.283016][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 717.392588][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 717.502762][T18672] bond1: (slave bridge3): failed to get link speed/duplex [ 717.902690][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 721.683001][T18665] net_ratelimit: 42 callbacks suppressed [ 721.683028][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 721.792950][T18665] bond1: (slave bridge3): failed to get link speed/duplex [ 721.822979][ C0] IPVS: mh: UDP 127.0.0.1:20000 - no destination available [ 721.902843][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 722.012700][T18669] bond1: (slave bridge3): failed to get link speed/duplex [ 722.122982][T18673] bond1: (slave bridge3): failed to get link speed/duplex [ 722.232623][T18672] bond1: (slave bridge3): failed to get link speed/duplex