last executing test programs: 9.739364014s ago: executing program 4 (id=3915): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000400)=@getspdinfo={0x14, 0x25, 0x1, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x100}, 0x4) r2 = socket$pppoe(0x18, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x1, @mcast2, 0xffffffff}, 0x1c) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaa2986dd6d002008006411ff20010000000000000000000000000002ff0500000000000000000000000000014f194e20"], 0x9e) getpeername(r2, 0x0, &(0x7f0000004b40)) socket$inet(0x2, 0x8000c, 0x5) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) close(0xffffffffffffffff) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, 0x0, 0x4050) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x4000, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) connect$inet(r5, &(0x7f0000000280)={0x2, 0x4, @broadcast}, 0x10) sendmmsg$inet(r5, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x0) 7.108182302s ago: executing program 1 (id=3922): bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x5c}}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000a40)={0x50, r2, 0x1, 0x470bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @assoc_req={{{0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x6}, @device_a, @device_a, @initial, {0x2, 0xfff}}, 0x600, 0x8b1, {0x0, 0x6, @default_ibss_ssid}, @val, @void}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}]]}, 0x50}, 0x1, 0x0, 0x0, 0x20040040}, 0x8800) 6.848370118s ago: executing program 1 (id=3926): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000000c0)={0x3, &(0x7f0000000200)=[{0x48, 0x3, 0xfc}, {0x20, 0x10, 0x6, 0x8}, {0x6, 0x0, 0x7, 0x7}]}, 0x10) sendmmsg$inet(r1, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000580)="04f8", 0x2}], 0x1}}], 0x1, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000400)='ns/pid_for_children\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r3 = socket(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000000)="7800000018002507b9409b14ffff00000220be040205fe050e020409430009003f000c200a0000000d0085a168d0bf46d32345653600648d0a0012000a000a0006005ade4a460cc1d8f9800b718e5177f6afd93fa4d789b6ec0cff3959547f509058ba86c902e738acfae1000000404a3200040016000500", 0x78, 0x20004814, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000080)={0x0, r0, 0x8d, 0x2eb, 0xfffffffffffffc01, 0x131787fe}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendmmsg$inet(r4, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x64010300}, 0x10, 0x0}}], 0x1, 0x24004800) 6.773040329s ago: executing program 4 (id=3928): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a9000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000008900000095"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40e00, 0xc, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80cc85}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2481, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xffff, 0x7}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b40)=ANY=[@ANYRES16=r0, @ANYRESHEX=r5, @ANYRESHEX=r2, @ANYBLOB="fe8000000000000000000000000000aafffffffc33000000ac1414aa0000000000000000000000000000000000000000040000000000000000000000000000000000000000000900000000000000000000000000000000000000000000000000ffffffffffffffff0000008056000000ffffffffffffffff0000000000000000000001008000000001040000090000000b07000000000000000000000a0001009000000000000002"], 0xf0}}, 0x24004058) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r8 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r9 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r8, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r10, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r7, r10, 0x25, 0x0, @val=@netkit={@void, @value=r7}}, 0x1c) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYRES64=r6, @ANYRES32=0x0, @ANYBLOB="46ff0f00000000001c00128009000100626f6e64000000000c000280050001"], 0x3c}, 0x1, 0x0, 0x0, 0x4c6d4}, 0x20048040) r12 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r12) sendmsg$TIPC_CMD_ENABLE_BEARER(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYRESHEX=r11, @ANYRES64, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4c081}, 0x0) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r13) r14 = socket$unix(0x1, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 6.427005192s ago: executing program 1 (id=3930): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000982001f000000fe0000000000000008000f00fd000000", 0x24) recvmsg$kcm(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000a00)}, 0x2) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)='%pI4 \x00'}, 0x20) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000280)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4, 0x4}, 0x50) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000300)={0xffffffffffffffff, 0xdc, 0x8}, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x2, 0x4, 0x4, 0xa, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000000)=r4, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x9, &(0x7f0000000600)=@raw=[@map_fd={0x18, 0x1, 0x1, 0x0, r4}, @alu={0x7, 0x1, 0xb, 0x2, 0xa}, @alu={0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc}, @call={0x85, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0x5, 0x0, 0x0, 0x1}, @exit, @ldst={0x1, 0x0, 0x3, 0x1}, @exit], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x29, 0x5, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0xe, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xbb}, [@generic={0x80, 0x4, 0xa, 0x8, 0x7}, @jmp={0x5, 0x0, 0xc, 0xb, 0x1, 0x8, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x5}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffe}, @tail_call, @generic={0x15, 0x1, 0xa, 0x5, 0x40}]}, &(0x7f00000000c0)='GPL\x00', 0x8, 0x1c, &(0x7f0000000140)=""/28, 0x41100, 0xe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000180)={0x4, 0x1, 0x4, 0x7}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000340)=[r1, r2, r3, r4], &(0x7f0000000380)=[{0x5, 0x3, 0x1, 0x9}, {0x4, 0x2, 0x1, 0xb}], 0x10, 0x6}, 0x94) 6.25851921s ago: executing program 2 (id=3932): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x4e22, @remote}, 0xa) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x44000000, 0x0) 6.1448135s ago: executing program 3 (id=3933): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x64, 0x6, 0x500, 0xd0, 0x270, 0xd0, 0x340, 0x340, 0x430, 0x1a0, 0x430, 0x430, 0x430, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x44}, @private1, [], [], 'ipvlan1\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x3a010000}}, @HL={0x28}}, {{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0xffffffff], 'tunl0\x00', 'bond_slave_1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x340}}, {{@ipv6={@private0, @remote, [], [], 'veth0_to_team\x00', 'tunl0\x00', {}, {}, 0x11, 0x0, 0x3, 0x44}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @loopback}, @private1, [0xffffffff, 0xffffffff, 0xffffffff, 0xff000000], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'wg1\x00', 'team_slave_1\x00', {0xff}, {}, 0x2f, 0x6b, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28}}, {{@ipv6={@loopback, @private2, [], [], 'syzkaller1\x00', 'veth0_to_batadv\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, 'vlan0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) 6.081096232s ago: executing program 1 (id=3934): socket$nl_rdma(0x10, 0x3, 0x14) socket$packet(0x11, 0x2, 0x300) socket$inet(0x2, 0x1, 0x0) socket$inet(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) pipe(0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r1, r3}, 0x14) syz_emit_ethernet(0xd81, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x0) 6.031455986s ago: executing program 2 (id=3935): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) sendto$packet(r1, &(0x7f00000004c0)='q', 0x5e0, 0x881, &(0x7f0000000200)={0x11, 0x8100, r2, 0x1, 0x87, 0x6, @broadcast}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0x600, 0x1}}, 0x20) (async) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) (async) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00'}) (async) sendto$packet(r1, &(0x7f00000004c0)='q', 0x5e0, 0x881, &(0x7f0000000200)={0x11, 0x8100, r2, 0x1, 0x87, 0x6, @broadcast}, 0x14) (async) 6.01473178s ago: executing program 4 (id=3936): r0 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000002880)) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@ipv6_newnexthop={0x58, 0x68, 0x1, 0x70bd28, 0x25dfdbfb, {0xa, 0x0, 0x0, 0x0, 0x10}, [@NHA_ENCAP={0x18, 0x8, 0x0, 0x1, @SEG6_LOCAL_NH6={0x14, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}}}, @NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_FLAGS={0x6, 0x6, 0x8}}, @NHA_FDB={0x4}, @NHA_GATEWAY={0x14, 0x6, @ip4=@rand_addr=0x64010102}, @NHA_BLACKHOLE={0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000001080)={&(0x7f00000002c0)={0x3c, r2, 0x1, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x28, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x17, 0x1, @l2={'eth', 0x3a, 'batadv_slave_0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc}]}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)={0x14, 0x2, 0x6, 0x3, 0x0, 0x0, {0x6, 0x0, 0x2}}, 0x14}}, 0x4000000) 5.945209415s ago: executing program 3 (id=3937): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x15, 0xb, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0x0, 0x10002}, [@printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x83000200}, {0x85, 0x0, 0x0, 0xcb}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.84220337s ago: executing program 3 (id=3938): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000400)=@getspdinfo={0x14, 0x25, 0x1, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000140)={0x100}, 0x4) r2 = socket$pppoe(0x18, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaa2986dd6d002008006411ff20010000000000000000000000000002ff0500000000000000000000000000014f194e20"], 0x9e) getpeername(r2, 0x0, &(0x7f0000004b40)) socket$inet(0x2, 0x8000c, 0x5) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) close(0xffffffffffffffff) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, 0x0, 0x4050) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x4000, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) connect$inet(r6, &(0x7f0000000280)={0x2, 0x4, @broadcast}, 0x10) sendmmsg$inet(r6, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x300, 0xf1c) sendmsg$NL80211_CMD_GET_STATION(0xffffffffffffffff, 0x0, 0x0) 5.766818631s ago: executing program 2 (id=3939): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x189001, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x15, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a81bff88caffff40", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @broadcast}) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x13) 5.674470154s ago: executing program 4 (id=3940): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000120005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="2482000000000000180012800e0001", @ANYRESOCT=r0], 0x38}}, 0x0) 5.630867204s ago: executing program 0 (id=3941): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x30, 0x2, {{0x6, 0x29, 0x80, 0x3, 0xffffffff, 0x91b1}, [@TCA_NETEM_RATE={0x14, 0x6, {0x2, 0x7, 0x7fffffff}}]}}}]}, 0x60}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0xffffffffffffc0fe) 5.606342398s ago: executing program 1 (id=3942): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000010c0)=@bpf_tracing={0x1a, 0xf, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1001}, 0x94) r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412", 0xe00}, {&(0x7f0000001040)="9d7fcf3efc63f4a6a555ba8b4726d7ccaf8a207100e69cfac4377876021d7131b838059f96bd206d4776368ed2a92432e5af71", 0x33}], 0x2, &(0x7f00000011c0)=ANY=[@ANYBLOB="1400000000000000010000002500000002010000000000004800000000000000080000000700000010000034366567f2219787566400007300000000000000000000000008000000ef3820f3439cb150a3651e799e1459c9c9a7521737a8879e3ef4dca1e3c32158996e4b2abde5342e22f2ba8b679121ac0b0ad62ade31fb2c47f0bbf781eb8bd1e3064141e90e9eac25b189c0da98b676571bbeefba392c3e15a10e03dee4ae1dfe99793e51ec0c6bb5fa6d7b357d249502f5919ef251e5d0e5bed378265b8bd55fde4689cb509b14fa754813a27e72d175e8d677420e10d651833e6e2ab8168b1d633b1bb9a7d4d59ebdc7083d93d35cd469de", @ANYRES32=0x0, @ANYBLOB="e1212f0409000000e70bcf35ac837225dd355ad309a5ec6096633ba38e1ef5baf006020e5f45c993cb5680017c6720bea9b7c451516a8cff7f00000000000019f20b784b2336d43c8a0f7347801a596dfb0b078a967980ccec1d115c7a0000000000000000000000fed6260fdf140498f1274bc569d0d87656d0d18d903580f0ec0915e89bd286b2c25165043f6a001d53f84eaabf01cc310ff28c7c76867ce1a2c9c91b1db7295614e2a4f8711ec37ae999180cb5bbb9c5382120076e117539d423a2ec0f468db35960831f5f884c1fa9f46b3472327697495b8e8ba8e2f3defbe93e1fc733b06dfc74890a3f63b154e9681d69cdd9894c914ee45c286462888ff84e401a6d8895ffda88a171b7359f815d7b6f7562fba1bbff4cba08f7a39a8e88b66a4717b3c318f85aecbe8b5f3485f8d31bf5a57b9dd53b382ec017a33d1fabe09daf76b3b0"], 0x6b}, 0x0) 5.38836822s ago: executing program 1 (id=3943): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0x1e, 0x800, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42914}, 0x20044014) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x26}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x20, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000090000000000000000000800791000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0xffb5, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x5, @mcast2, 0x100}]}, &(0x7f0000000180)=0x10) connect$bt_rfcomm(r6, &(0x7f00000000c0)={0x1f, @none, 0x7}, 0xa) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={@map=r5, 0x26, 0x0, 0xf51, &(0x7f0000001440)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000900)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfd, {{@in=@multicast1, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x200, 0x16, 0x0, 0x7f}, {0x0, 0x3, 0xfffffffffffffffe}, 0x4, 0x6e6bb2, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x37a5fce0bcf595dd}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000900090073"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r0, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) 5.386996528s ago: executing program 0 (id=3944): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x9, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0xb0ff}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0x15, 0x1, 0x0, 0x2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x3}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.386635446s ago: executing program 4 (id=3945): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c040894) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x2, 0x100000000, 0x1}) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x20b7ee}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c40)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@struct={0x3, 0x1, 0x0, 0xf, 0x0, 0x7, [{0x3, 0x801, 0x5}]}]}, {0x0, [0x4f, 0x0, 0x30]}}, &(0x7f00000006c0)=""/262, 0x35, 0x106, 0x9}, 0x28) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32844, 0xc1}}, 0x20}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r4, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000040)={0x1c, r2, 0xb97534d5fe9704cf, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8141ba5ccf7ef84}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="b80000001500010025bd709aa9000000e00000020000000000000000000000940000000000000000000000000000000000000000000000000a0000008700f9995756f8f4f4c9b4e5bff15a4230d7e23e3dedfef7bec3060907e76e4e304484cecde76f7be0164e299dc96e1052d3aa19ecff26f100a0000e2c7ccb8d12b022d4f451b16ee1c92f16a124ba20e0a3fab9d318fab011a8ca403dd0ea87c3fd845108b8d6a95b3e23c6abd988bc29c5a1cde0119e518bda"], 0xb8}, 0x1, 0x0, 0x0, 0x4040015}, 0x2c000010) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x46, &(0x7f00000000c0)={&(0x7f0000000300)={0x5c, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}, @IPSET_ATTR_CIDR={0x0, 0x3, 0x6}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) setsockopt$sock_int(r6, 0x1, 0x3, &(0x7f0000000040)=0x10000, 0x4) 5.331143607s ago: executing program 0 (id=3946): sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2c040894) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x2, 0x100000000, 0x1}) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x20b7ee}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c40)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@struct={0x3, 0x1, 0x0, 0xf, 0x0, 0x7, [{0x3, 0x801, 0x5}]}]}, {0x0, [0x4f, 0x0, 0x30]}}, &(0x7f00000006c0)=""/262, 0x35, 0x106, 0x9}, 0x28) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32844, 0xc1}}, 0x20}}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r4, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000040)={0x1c, r2, 0xb97534d5fe9704cf, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8141ba5ccf7ef84}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="b80000001500010025bd709aa9000000e00000020000000000000000000000940000000000000000000000000000000000000000000000000a0000008700f9995756f8f4f4c9b4e5bff15a4230d7e23e3dedfef7bec3060907e76e4e304484cecde76f7be0164e299dc96e1052d3aa19ecff26f100a0000e2c7ccb8d12b022d4f451b16ee1c92f16a124ba20e0a3fab9d318fab011a8ca403dd0ea87c3fd845108b8d6a95b3e23c6abd988bc29c5a1cde0119e518bda"], 0xb8}, 0x1, 0x0, 0x0, 0x4040015}, 0x2c000010) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x46, &(0x7f00000000c0)={&(0x7f0000000300)={0x5c, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}, @IPSET_ATTR_CIDR={0x0, 0x3, 0x6}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) setsockopt$sock_int(r6, 0x1, 0x3, &(0x7f0000000040)=0x10000, 0x4) 2.849463151s ago: executing program 2 (id=3947): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ffffffe}, [@jmp={0x7, 0x1, 0x3, 0x0, 0x0, 0x1}]}, &(0x7f00000003c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x13}, 0x94) r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@empty, @in=@remote, 0x4e20, 0x0, 0x4e22, 0x48, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffc, 0xffffffffffffffff, 0xfff, 0x10001, 0x5, 0x5, 0x5, 0xfffffffffffffffd}, {0xffffffffffffffff, 0xffffffffffff90df, 0x0, 0x20000000000000}, 0x40, 0x0, 0x1, 0x0, 0x1}, {{@in=@remote, 0x4d4, 0x6c}, 0xa, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3502, 0x4, 0x3, 0x0, 0x0, 0x0, 0x200000}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}}, 0x1c) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000100)=""/220, &(0x7f0000000200)=0xdc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ffffffe}, [@jmp={0x7, 0x1, 0x3, 0x0, 0x0, 0x1}]}, &(0x7f00000003c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x13}, 0x94) (async) socket$inet6(0xa, 0x3, 0x1) (async) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@empty, @in=@remote, 0x4e20, 0x0, 0x4e22, 0x48, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffc, 0xffffffffffffffff, 0xfff, 0x10001, 0x5, 0x5, 0x5, 0xfffffffffffffffd}, {0xffffffffffffffff, 0xffffffffffff90df, 0x0, 0x20000000000000}, 0x40, 0x0, 0x1, 0x0, 0x1}, {{@in=@remote, 0x4d4, 0x6c}, 0xa, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x3502, 0x4, 0x3, 0x0, 0x0, 0x0, 0x200000}}, 0xe8) (async) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}}, 0x1c) (async) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r0, 0x84, 0x74, &(0x7f0000000100)=""/220, &(0x7f0000000200)=0xdc) (async) 2.813838593s ago: executing program 0 (id=3948): socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0x1, 0x18}, 0xc) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000012c0)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)={0x54, 0x7, 0x6, 0x101, 0x0, 0x0, {0x7}, [@IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x9}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0xffffffff}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x7}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x1b6351b}]}, 0x54}, 0x1, 0x0, 0x0, 0x20008001}, 0x40) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000900000000000000feff"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r0, 0x27, 0x56, 0x0, &(0x7f0000000240)="f8ad48cc02cb29dcc8007f5b86dd", 0x0, 0xed, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x22020600) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB="26ea00"/12, @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg$unix(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001780)=""/4071, 0xfe7}, {&(0x7f0000000300)=""/78, 0x4e}, {&(0x7f0000000400)=""/133, 0xe8b}], 0x9}, 0x40020000) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0xfffe}], 0x1}, 0x0) r6 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/pid\x00') ioctl$NS_GET_PARENT(r6, 0xb702, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r7, 0x0) setsockopt$inet6_int(r7, 0x29, 0x4, &(0x7f0000000000)=0x8, 0x4) syz_emit_ethernet(0x84, &(0x7f0000000040)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x4e, 0x6, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0xfffc, 0x0, 0xff6b}, {"1f06cd9e50f16df55100b4bc6d7c467409f673bf01bf86b3e1ab5b3862f323e8d7836b453ea69e7f02430483fd8feae6e0e6f517d6ef97bbfc5e"}}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0xf0, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@broadcast, 0x4e20, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in=@broadcast, 0x4d3, 0x2b}, @in6=@local, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x100000000000001, 0x10000000000000}, {0x1, 0x200000, 0x1}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}}, 0xf0}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) close(0x4) 2.810022916s ago: executing program 4 (id=3949): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x17, 0x8, &(0x7f0000002fc0)=ANY=[@ANYRES64=r0], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r1, 0x4) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010400000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a54000000060a0b0400000000000000000200000928000480240001800b000100657874686472000014000280080006400000000105000200000000000900010073797a30000000000900020073797a3200000000140000001100010000000000c708000000000000734e8815a274df31c50441689340d9621cca93de4b597d924c1cb95981a0b941623c66d5187d9a95a021a62335c511865b2fbfc72a203baad7ed3608c80f787e3866f78d9c30a798ac8988541b85b427912e1ce7874be3e3906d40271df2b326f556ea3b2e7cecc915f1b15960586991e3f156c4e6f747fea1ac515cee57fc32e6b10caaf02280407e1d4c355c6c1c55c4b2d2e66ee5a41d1f7deab3d2567724c92d1d8daa33b13da6ab9e50b8cf6cfb4bc826400e8b7eeff5c4a9c0068b8884a739e46249716335ce5286990000006736"], 0x7c}, 0x1, 0x0, 0x0, 0x24000056}, 0x0) connect$inet(r3, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="9b630817a15d5370bb7638100ec3ed54a51ae4e9dceed35e332625b1e9fc657abc37c01679704e17eedb964ac269d3b3a01734875d050927e6e744b7b7ac7618632f40d6f30a35305a2e5c73fa397917dca7734c27c466831554a294a92a4917d42b98f8ae86d53e49546ac904f3b98231f9ce456edd736a2bf717d1c8967ae3846c10fd76cbebbe9964b4ee70265e6bc0fd416be284f3aef5ea897e3bf047aeddf6bd12bcdb9b1cc63647e763e75d3539df1347eab0ec89e6c04d47e2f89e28fad9e9d1b31b", @ANYRES16=r5], 0x20}, 0x1, 0x0, 0x0, 0x20000010}, 0x844) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x24}}, 0x2) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001800dd8d00000000000000000200000000000006000000000d4e17007f4a20c6b2020e73f176b9ffd7e1b0af3685c6239e3c1da4fc839d470d8cf89f00ff9f84725370dbf8210ed015ef094c4b0f4d3b40193aaa83629b9523120fdd8b28373b1e8ee2002751b248f80bbfa0048c052af2a5a7b8d7d125924337c2b7db2e4ac6ae3dc9861f58c3a0abe87d594a86cfe81ce4b43781048ca119fad44600"/170], 0x24}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000001000010001000000000000", @ANYRES32=0x0, @ANYBLOB="adb320040000001d000008001b000000"], 0x28}, 0x1, 0xc3ffffffffffffff}, 0x0) shutdown(r3, 0x1) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{0xffffffffffffffff, 0xffffffffffffffff}, 0x0, &(0x7f0000000040)='%pS \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r8}, 0x4) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x29, 0x80, 0xb, 0x4c, 0x2, @rand_addr=' \x01\x00', @mcast2, 0x80, 0x80, 0x2, 0x8}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 2.799744723s ago: executing program 3 (id=3950): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x3, 0x400, @remote, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4) 2.581535799s ago: executing program 2 (id=3951): syz_emit_ethernet(0xd81, &(0x7f00000014c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd600000000d4b2b00fc020000000000000000000000000000fe8000000000000000000000000000aa210000000d4b9078e2060001800000006df79342a9984f6868f47218a5f4500cc3beff6184277dc0935af46ae405b0f24d04b0e93b3edcd14a688b54df418e157fd95c90c70f834ac0bea2479d3ba800bf76b39c8e5b7ad9666f38c1c2631c5727830869c660580f79dad694531ade4367d1106fc0ad8213e615f1a38ae677d7db6b2ba14d3aef04b8133710c146fc41593d398c05333d81eb48dbcbf20946ad8d8f26d30f0a1c31c3d088a11ba975b1c76b70e42312ec79128c7c24b98d98b59d165a8fb9dc005e3f937fcc6842ac6a7a1ee142bb5de997a59244e0137af359a9581add0d7daa2782386fa7ccaeae36aacac738c2571919136e508ed7b1e83e19b4a5fe9b928106f5aea4280a6326f0c45c3de2e56676f83f3248fa49ead371c16f50d1b944161c2941e9d15243a0fe5252156844f0c6a48d1949c1f1d937dd064f3a7bb0c8a3b35733d3bee6ea088ddf96676abe784fbcb2b5e04a4d927de9ed53ca625219b5a4e987bfe3e6e571bad65dab4d081fa472c825b6e7a75b86fad5cc0e1ddf15b3ae6710e79e3de2e98c131b3b936f3aca6692c843b06120f06cf36abca6908a4726d63c94823dc4d0767ce7d07c99e06f7fa98f6134976552cfeb3562da5044c3e3593f354cabf5cdd7a5ca7c00546988e1874af4bede37bc5cb0ed6a28f765184c70ee5ab813363df7771682075ae265f8f34846d1008b59eb25bb50070880c608e673c3679324b8d917f4c151f353233b1bfedb66041212067146fc3fa1fa36d547608f16fd8d61c643e9851adcc8f82cbf45c2b69bbf935f7514e2a4082ef3cec0e23622f450d156c7d0c63a7377a9f822bfdf1d26c15379aa46741da7cbc659c51f727b49c10b13d401122392b1910f29634de116710bebe0809573faa1811d985b9f65d736f13578d6bf307486df37ccbd909aec584ed3ff86b64a5cbbe7fd16f265c6dfcbf8696670ab02a2f2849e243510e1eb0a21b0e3a6064a010b63ad960ffe56e5591cf8fa845197ddf1efe9598024b44e76a8baa0fca52388d257aaf94ae3c03323cca842d16bca3a446e41f4be5ab504db78159ae979705c35e603954cb94dc259e3cb879de99212771428c97bea627a753d205696a07419f5f9d99463987cf52cda56ef71847b2ef3b262ce9acb43a8b17d8d255389b79d8a91dc688b41a291f0e60b1e5dc7929787f07a642eec8e644af63e293c4da4fb2248bd66734db7ce0e006c2e4f4510b029d2bc0769487cde6fb2cf6f11e4f78a09a9d041725d96cce9e3cd5a31524eb811beab5e822cf2a8773444878e3f04213b2a6c51157f8174243554223a016613ff6e3e30eab14bb1e859d700cdda697af2ae375304805e7369f30f03ad085864b6af4c3555f2e43b5714f356a6d259b68164b80e0f68cb10d4717d87af1a84383b81bfbae0e821a21cb0dfc47d64da0418aa0009386fbcd6f5476b80578f09faa35bbd3f29cef1072ee1911d1a8bbdd49cceccf71292d05fb2581a837282f6beb82ab081c7cd452856b971f0b8dcd95218cab04471c2037f206b71d9e4b6d439adc259a97a640e2d7a907b801db5d702cbc34354d9cfe85d21a1652175fc7fe3c3ab00ed1abe361cf97a445525c22a2f3029dae1dc87e71761f0a13863d364edbae2d04c8ff17624166b5186f2c1def031d1885b242daf26b7df4b2f16b03d7ef02139c8b23bd7aa5869324733ca334d2c3033a543c79ee09b9758a932da58345ea265fb0dbdfc2dd912f16c1b0b02d89aa0e696d07e54d48f982003fae6d448a7d4bac91b2d8c8dc915d647df96b930769eaa54245fa870043dfa7640203897b21fa7c8ec9a861650708007cd89b7ce361a195bc6f8a52a1187a190155e51f2cc3d80b4512e8bcae403eff774626b4f3fdcdefef76f87e625fcddf9c21087d39cfc8ae3673e6b45508c35ac1d53f7c8f708785e84f37aa816f400d7b503b96d4f851005aebc9a6ffbf23378998a25485fad0d7b6357df8db299ee5d4b1e9cbe93c9a6cf0db6ded788e56bcf2b16363388862679fd0c7e9c779f23ee11849e477c73741a4c0a39ce847e72e2b6062aa2adddb09d12a97a01e7a50e2d697c879ac079e801b34334cd30e0a808d30597609ea61e436abf8d6b3fbe097b75c4dc444af837b37fb34caf05e2e6d814b99133cad4c763415071141b081af7820a020a46f5201f795ab4cbaa06a40e76af5f6981646a59b1467286e42adafafa7cc00ad3b6788cc4ba07a8d81ae00547c4ab8648be22bc0c6621e170b75da679d81b795fa7a7efd368ed0e954081153544cf41b3851d2d00171e30c3b56739c5c853010167c44f53cb5ffb00a5fdfb7a11c1f8961e7c23987e1c4dc7168ea5fa8f49dd72102fd448a8803546238aa63a2571b489430d18921136fe42fabf5086004fe3f6e22fa1dd0b39f92cf22040a4e887690ac0c74de934685b6fe9a0e8df36eaee4dadcaca5c48c5737b2bfb33f094abb8c49b5bc4899b5a95bdd1180cdb37f252436ef3ae35e1e3a3d79144fc3c54b50e15d3535be02fda038f5011fd8951388154039c799b18fac97e4d504dc1b5582e3b799a63e7173a4f6202afd7e8cfe4bd0be65f7816ad744c98d597f506fc545aabba4c480b198e9741f91edbeb1c0c525b02883de998f4eaf646fe3d3c320991180afccc4e7cd9f14c90b6c1366edb82615b4e0ac8862e6ea043bd34c27c978a1c1ac28b47f8f67082a1361359070000000000000023490151b70e030865df89b9510e2643d08ea531231c4db7c1f80eb113267556fe56868b78a6dda37ec946eb6e40b49458b450ed2dcad5445d56d6ee1bc6750a84a36466a2623973047f4a9b5a282d213bd5770d698946528c533f826a6b697a6772e37b28a14422126b7bd869e7f1bab47e5a43fb7f5580db9b318189ed9f661afd5e820132c803b4f4e55e05a1ae22191ae16f8c7bb9c9494f18a8237b4ea61be46b2f0a0a82dc802f82632a2aca37a319b40aa2510db9e3409e52e36dccfc57c8937927d132947d4fd7272266c98d5bad0ff3113e80483f3c508739297626034783f7f09e2c7195d75de6ccb4ff503b0d12987a3db7b183876b4094a687454ea1cf8b62a77ed705524c4d58d3df347204b9b8af5e87db23df3e306141e28f30df24e5b33952918603ab94ce41268d742e1a3cf2b16ca5f77fcaadb0bd9380f353b4f6eb2945e70655edf46b3e5ef427d26a7bf4485cc9bce1f25aca2f70d6a1711c9a9810c36bc441dc829082fd7ab066b4dd3a78274571f5615d070bc5fdf4adaa4d633c233e0744a6f149d6d7d4cf756d4822ea12feeea2419229cffef6e78d950d6ac06b4e750114b304e704e901b1a23d4817e6baced272f157d860ab1b47f1454e9e8d616ef15571a63f4efcd65a57e38b255b84ccffa4dbc39b05e288252b5d435e0035a06e78ca229c108d6152aa86a7c787fb5552e3444544cbadc587a5e8306f44b405dd33258dddb2a0d4e5e2c8a93d939ae357ae4fd595bc78285dfb00b6ed9abae5b5f8492d2d905e68222bb59c7570c06c096407e2d80aadbbe3ce5df92774e83d819be4703b058c7664d6562cfe8311eb948b04c7398f823d28242289f750c2a8459b4469f172416447a340b7e5c78563d3f2f0a905d9fcd137f12c84181ca50eb8e1cf9dbc9f1eb1449bd81739818094dd32c1b7bee15c7734db0faa5c5d167e383e9cba56f039cc5e9bff96b013f7a1b4837e1e6d626c5ce42ccade8d39f9254aaadcd848931429768aecc4a41e69fd9f73df5f46a668f934dc591653280f78b15ea97d71bd1efc6a94b8d9fd284985b9179b4670432b72cc82b59029a3072bd8b60e6f0f7b6ec7799248393d2927f4a330179259d90969675f0a9adcd210e9bb7fd0b59f23172538500c3f3735daf7363c3172a35493a5ec191b54c9e60597caef31bce22945bace7c499bb1d8f770a8c2308bf781532d46f038feaad6886437e1e4d7a66e0286f7e1d38011d373a1e776fd854b81a320892d567a09764e880f67c031cf934d2aeb74e4def0bd1325d866928d303c9371663b87015c2087d681d19dff15b2082ee2afd057062519f8709209cb2b2c92aae8f93310591cd7387d3713011ce713d210c1674306d2aaee87a7b2e79e4588c2d4c3ed28e8e226ada391bcb6371a76de677cff44285217b2ba4487797b68a5ab9277fe78444b9d4b996d1b834a5a44dd140acbcc77e472d99ec90de7cfbb97b5b8bfe1e6c79f97184a15d656e155af64c14bea2ff5609e0f8e96426bba82ab3d5196946b3f6cd5486f005ece8331b6e65072c0e3dbc53c577b0e3475878feecd60b6acb9df65ded5a3cd4f0d3d985539100e99769145bae01286b67a941e976082f798c01acbb9289a30a32a15aaeac54b3fcacbeac9e357ed1749993b7c4f31f9486e0b53d8fb94c1bdd6ce93bcb3f848bd6786846e0c1b628599d78f97ef30520438c7a8c8ce5f94b4fbfb3e6c91da4e28b018d8df80aa2b6de019da19b84bc33d457f5face162d057446e87bcf7cd5eacdb27a9697603e065487b979391aab976265ca13fd04ff056fedd69b5340446920daf8c3cec52ce188c88e6b6b62909dfe85805700abc847aa2567ae3e50d40a5848505309c378c2a751cfd494fe4411b623d5804d9506d3813b429d87e15d1096f919388f28f600b46cf12afa482680503ea86e3f0150e897d44f1f556685fa8efe9e2065a8205ba60a9e74702bd981aa87648a22e755fe23b569dac43cfb08e36cff5f5c2ef65cca2477fa950d6df669393b2ef61ad471fd32cc281371dad43e41fe44b48a356f148ce4fe6eaf9e880bb125c0cd243fd465c3f45"], 0x0) 2.579774813s ago: executing program 3 (id=3952): r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000001000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b7543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8f23e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae0000c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910ab193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b884057aeb68f3d675a79907a72ace70902459f6950a06a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68fe6b7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f8ce659e340c714809ec4d060bb1c9cfcde57b79625e2979fe689a5a246cbbd488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546308a0004be94dfab28c2a51dc816df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d044fa492aa38717481455e86dcd7816ad8940bd192595369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d4f17a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9570d730a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b94952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d830e1431ed6d646d13e8e7230300ef0a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000000000000000000002000000000044ff72f96f084f4b6cdcb1b4a9d8e9f9021b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded5027a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b092b70f77f0f428d2000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634009aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3f19f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f9863800f127d6b4518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c104fe52837a19006952fe2724c0105ab158a54a6a73000000000000000000000000b0d135da438cbe303f3ae070def97d6649b5a693ff5c788e5a406e1d06942ed51bff073011f6e6c29d3ea22e5fc26c7fbe37656229a6a12857ae9ed131ccdd513066bc9422ec38a1dc5212986d9bc330a23eb3b200af1a3678c2bfbe4b4ba6e8471495f6e82c5ee425973c590253e875352a3acaee044868f9b80f8fdc9d402007bb4c8df1b69d3d2b364ec9e4ed2f554118684eff1adf5b49b6b29232198e682dfa45dced8b332c404c8f292f36730845dc37dfe7a59e252ddc33ea9072dcd697a700cfac90b487660795f564ddb61fa3e4835f936984200000000000000000008e9f7bc3a00cd72ced7684e264e45398f7087734fcf2023a7a4c880f562f46f14cdc1bf472d74bc0c777b1021ff75de086c08f72a41399d3a3065b2f50a531cc90edbf88370ff50ba1aa6cc59076165a3ab90a3c90527b7c9711cf85bbb0cb0aebc47ab5c65458c40020f2cfb10e5f0a1594ae491e8756446e6873a8b222ae7e58dd7640666e359fc583e17ed6bcb30c0fafbba761e756ca80286d38bb92dd9ba17c1bb628e5b8d52c9a02a67f788ab88dca817cb4886942a279e06f45c8c936f5c46e1a008097471ca0ee26bcfabf7adb9c90a10539d960dec5c84464f6bc68318e7e899acf20ea41b071132d7a5945e941334855ce6149deaae1b5b83045e83bfc208079e6e58ebb4176b126c743111c5a712f465a3007d665ac21c43a544947c9d13e5206a21025f6acd47c2d333e648dcbf2e4989a1d4a176fe8f7a8cf0aeaf9736118b036639cb35810ea88213ff2a0842d420d418d026a101222a4ebd18fc89f04b5a9056ca6c00308936679474fa83bdf6eac126c9be33c551bccd42d8000736ed9a64ff7cb87d44c9bcf821c96dcd34aadfcc42fabd5976cedc9a4eef24764168056d0645c7aa007d69df4fa8de1224a56f0799ad59ee5c84418a1faae590b6c896cdd808376b6b51b217fcad5fbd7e3208d009e37484378df3ee5969f817d715d60fdd02c04e3fdd62a29285ac92f6836cbeb4d04d84c396150b2e17828d924013978173c48635e0b1ad4a0c5956717629794b39cf18d599e723d3c24689a5fea6cc1f59d1ba1fccfba88e02f9907"], &(0x7f0000000140)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) syz_emit_ethernet(0xef, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd60122d9200b93afffe8000000000000000000000000000bbff02000000"], 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x0, 0x44f14}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0xfff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004854}, 0x8000002) 2.423093999s ago: executing program 2 (id=3953): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x5071}, 0x10) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b00000000000800"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448cc, &(0x7f0000009300)) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'veth1\x00'}) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) write(r0, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) 1.710750085s ago: executing program 0 (id=3954): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x18, 0x1411, 0x8, 0x70bd2d, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}]}, 0x18}, 0x1, 0x0, 0x0, 0x2}, 0x40000) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000280)="6800000000090504000000000000000002000000090001007379003000000000140002800600010000020000050002002000000008000500000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e", 0x68}], 0x1}, 0x4080) 1.580533265s ago: executing program 0 (id=3955): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4}, 0x94) r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) close(0x3) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x1}}]}, 0x34}}, 0x2000400c) sendmsg$nl_route_sched(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x40000000, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x60}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0xfffffffe}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x0, 0x0, 0xfffffffd}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4894}, 0x0) setsockopt(r2, 0x84, 0x80, &(0x7f00000002c0)="1a0000", 0x3) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000140)={@loopback={0x0, 0xffff64010100}, 0x80, r8}) 0s ago: executing program 3 (id=3956): r0 = socket$can_raw(0x1d, 0x3, 0x1) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="050300000000000000000a", @ANYRES32], 0x1c}}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0}, &(0x7f0000000180)=0x14) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8c400082}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r3, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x8002}, 0x800) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="0bd7834a3067fedc7022d642806f58da434a533b1dd6ff60bbf5152a8decdeee714d57329796ba3adce711bc0a085316a2ac31fb5ae0db4fc4693aebe7eba2f71d25d7fbc44dd86dfdcf21d409acfee963f30a81eb960d", 0x57}], 0x1) r5 = socket(0x2d, 0x2, 0x0) bind$rxrpc(r5, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e22, @rand_addr=0x64010102}}, 0x24) getsockopt$CAN_RAW_JOIN_FILTERS(r0, 0x65, 0x6, 0x0, &(0x7f0000000440)) kernel console output (not intermixed with test programs): LT_INJECTION: forcing a failure. [ 588.094022][T17142] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 588.094059][T17142] CPU: 1 UID: 0 PID: 17142 Comm: syz.0.3085 Not tainted syzkaller #0 PREEMPT(full) [ 588.094084][T17142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 588.094098][T17142] Call Trace: [ 588.094108][T17142] [ 588.094118][T17142] dump_stack_lvl+0xe8/0x150 [ 588.094157][T17142] should_fail_ex+0x410/0x560 [ 588.094187][T17142] _copy_to_user+0x31/0xb0 [ 588.094219][T17142] simple_read_from_buffer+0xe1/0x170 [ 588.094258][T17142] proc_fail_nth_read+0x1bb/0x230 [ 588.094292][T17142] ? common_file_perm+0x20e/0x2b0 [ 588.094322][T17142] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 588.094362][T17142] ? rw_verify_area+0x24a/0x4c0 [ 588.094398][T17142] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 588.094437][T17142] vfs_read+0x213/0xa80 [ 588.094477][T17142] ? __pfx___mutex_lock+0x10/0x10 [ 588.094503][T17142] ? __pfx_vfs_read+0x10/0x10 [ 588.094549][T17142] ? __fget_files+0x2a/0x420 [ 588.094585][T17142] ? __fget_files+0x3a2/0x420 [ 588.094615][T17142] ? __fget_files+0x2a/0x420 [ 588.094655][T17142] ksys_read+0x150/0x270 [ 588.094691][T17142] ? __pfx_ksys_read+0x10/0x10 [ 588.094738][T17142] do_syscall_64+0x166/0x520 [ 588.094763][T17142] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.094787][T17142] ? clear_bhb_loop+0x70/0xc0 [ 588.094816][T17142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.094840][T17142] RIP: 0033:0x7f10f935e98e [ 588.094860][T17142] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 588.094881][T17142] RSP: 002b:00007f10fa2fdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 588.094923][T17142] RAX: ffffffffffffffda RBX: 00007f10fa2fe6c0 RCX: 00007f10f935e98e [ 588.094941][T17142] RDX: 000000000000000f RSI: 00007f10fa2fe0a0 RDI: 0000000000000004 [ 588.094956][T17142] RBP: 00007f10fa2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 588.094972][T17142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 588.094986][T17142] R13: 00007f10f9626038 R14: 00007f10f9625fa0 R15: 00007ffed6e87548 [ 588.095023][T17142] [ 588.553061][T17151] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3084'. [ 588.716073][ T12] IPVS: starting estimator thread 0... [ 588.806190][T17156] IPVS: using max 27 ests per chain, 64800 per kthread [ 589.042095][T17167] bridge_slave_0: left allmulticast mode [ 589.042129][T17167] bridge_slave_0: left promiscuous mode [ 589.052607][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 589.056694][T17167] bridge0: port 1(bridge_slave_0) entered disabled state [ 589.267045][T17174] netlink: 'syz.0.3092': attribute type 9 has an invalid length. [ 589.292512][T17172] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3091'. [ 589.292540][T17172] openvswitch: netlink: Invalid VLAN frame [ 589.388343][T17177] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3093'. [ 589.837818][T17167] bridge_slave_1: left allmulticast mode [ 589.837838][T17167] bridge_slave_1: left promiscuous mode [ 589.837996][T17167] bridge0: port 2(bridge_slave_1) entered disabled state [ 589.863833][T17167] vlan2: left promiscuous mode [ 589.876702][T17167] bond0: (slave bond_slave_0): Releasing backup interface [ 589.885024][T17167] bond0: (slave bond_slave_1): Releasing backup interface [ 589.912782][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 589.944147][T17167] team0: Port device team_slave_0 removed [ 589.967597][T17167] team0: Port device team_slave_1 removed [ 589.973767][T17167] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 590.019251][T17175] netlink: 43 bytes leftover after parsing attributes in process `syz.0.3092'. [ 590.056102][T15397] Bluetooth: hci0: command tx timeout [ 590.370843][T17137] lo speed is unknown, defaulting to 1000 [ 590.563051][T17211] x_tables: duplicate entry at hook 1 [ 590.637237][T17195] syzkaller0: entered promiscuous mode [ 590.637265][T17195] syzkaller0: entered allmulticast mode [ 591.356153][T17232] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3103'. [ 592.143981][T15397] Bluetooth: hci0: command tx timeout [ 592.841727][T17237] FAULT_INJECTION: forcing a failure. [ 592.841727][T17237] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 592.841767][T17237] CPU: 0 UID: 0 PID: 17237 Comm: syz.1.3105 Not tainted syzkaller #0 PREEMPT(full) [ 592.841793][T17237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 592.841807][T17237] Call Trace: [ 592.841815][T17237] [ 592.841826][T17237] dump_stack_lvl+0xe8/0x150 [ 592.841863][T17237] should_fail_ex+0x410/0x560 [ 592.841894][T17237] _copy_from_iter+0x1d3/0x1660 [ 592.841918][T17237] ? rcu_is_watching+0x16/0xb0 [ 592.841953][T17237] ? __kmalloc_node_track_caller_noprof+0x4d2/0x720 [ 592.841979][T17237] ? __pfx__copy_from_iter+0x10/0x10 [ 592.842105][T17237] ? __alloc_skb+0x530/0x7a0 [ 592.842130][T17237] ? skb_put+0x112/0x210 [ 592.842154][T17237] ? tipc_msg_build+0xb29/0xf50 [ 592.842183][T17237] tipc_msg_build+0x8b6/0xf50 [ 592.842219][T17237] ? __pfx_tipc_msg_build+0x10/0x10 [ 592.842247][T17237] ? net_generic+0x1e/0x240 [ 592.842276][T17237] ? net_generic+0x1e/0x240 [ 592.842309][T17237] ? tipc_group_bc_cong+0x15f/0x210 [ 592.842340][T17237] tipc_send_group_bcast+0x7db/0xad0 [ 592.842396][T17237] ? __pfx_tipc_send_group_bcast+0x10/0x10 [ 592.842440][T17237] ? unwind_get_return_address+0x4d/0x90 [ 592.842466][T17237] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 592.842503][T17237] ? __pfx_woken_wake_function+0x10/0x10 [ 592.842536][T17237] ? look_up_lock_class+0x57/0x110 [ 592.842560][T17237] ? register_lock_class+0x31/0x2e0 [ 592.842581][T17237] ? lock_acquire+0x115/0x350 [ 592.842610][T17237] __tipc_sendmsg+0x313/0x2b60 [ 592.842645][T17237] ? __lock_acquire+0x747/0x2de0 [ 592.842683][T17237] ? __pfx___tipc_sendmsg+0x10/0x10 [ 592.842726][T17237] ? lock_acquire+0x115/0x350 [ 592.842758][T17237] ? ktime_get+0x45/0x220 [ 592.842784][T17237] ? __lock_acquire+0x747/0x2de0 [ 592.842813][T17237] ? lapic_next_event+0x11/0x20 [ 592.842841][T17237] ? __pfx_clockevents_program_event+0x10/0x10 [ 592.842893][T17237] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 592.842928][T17237] ? tipc_sendmsg+0x47/0x70 [ 592.842953][T17237] ? __local_bh_enable_ip+0xd6/0x140 [ 592.842987][T17237] tipc_sendmsg+0x55/0x70 [ 592.843012][T17237] ? __pfx_tipc_sendmsg+0x10/0x10 [ 592.843032][T17237] sock_sendmsg_nosec+0x13a/0x180 [ 592.843071][T17237] ____sys_sendmsg+0x54e/0x850 [ 592.843105][T17237] ? __pfx_____sys_sendmsg+0x10/0x10 [ 592.843143][T17237] ? import_iovec+0x73/0xa0 [ 592.843174][T17237] ___sys_sendmsg+0x2a5/0x360 [ 592.843202][T17237] ? __lock_acquire+0x747/0x2de0 [ 592.843229][T17237] ? __pfx____sys_sendmsg+0x10/0x10 [ 592.843264][T17237] ? kstrtouint+0x6e/0xe0 [ 592.843337][T17237] ? __fget_files+0x2a/0x420 [ 592.843365][T17237] ? __fget_files+0x3a2/0x420 [ 592.843405][T17237] __sys_sendmmsg+0x273/0x4d0 [ 592.843438][T17237] ? __pfx___sys_sendmmsg+0x10/0x10 [ 592.843476][T17237] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 592.843527][T17237] ? ksys_write+0x242/0x270 [ 592.843563][T17237] ? __pfx_ksys_write+0x10/0x10 [ 592.843602][T17237] __x64_sys_sendmmsg+0xa0/0xc0 [ 592.843632][T17237] do_syscall_64+0x166/0x520 [ 592.843656][T17237] ? trace_irq_disable+0x3b/0x140 [ 592.843677][T17237] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.843700][T17237] ? clear_bhb_loop+0x70/0xc0 [ 592.843726][T17237] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 592.843748][T17237] RIP: 0033:0x7fd46199e159 [ 592.843770][T17237] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 592.843790][T17237] RSP: 002b:00007fd462929028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 592.843814][T17237] RAX: ffffffffffffffda RBX: 00007fd461c26090 RCX: 00007fd46199e159 [ 592.843830][T17237] RDX: 0400000000000181 RSI: 00002000000030c0 RDI: 0000000000000003 [ 592.843846][T17237] RBP: 00007fd462929090 R08: 0000000000000000 R09: 0000000000000000 [ 592.843860][T17237] R10: 9200000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 592.843874][T17237] R13: 00007fd461c26128 R14: 00007fd461c26090 R15: 00007fff446dbbb8 [ 592.843908][T17237] [ 594.217313][T15397] Bluetooth: hci0: command tx timeout [ 594.318140][T17247] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3107'. [ 594.425611][T17256] openvswitch: netlink: Message has 8 unknown bytes. [ 594.458775][T17247] erspan0: left promiscuous mode [ 594.479490][T17257] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3108'. [ 594.532854][T17247] 8021q: adding VLAN 0 to HW filter on device bond0 [ 594.534535][T17247] 8021q: adding VLAN 0 to HW filter on device team0 [ 594.563529][T17247] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 594.629670][T17247] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 594.631772][T17247] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 594.650906][T17260] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3110'. [ 594.651484][T17247] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 594.651501][T17247] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 594.677642][T17247] veth1_vlan: left promiscuous mode [ 594.692147][T17247] vlan0: left promiscuous mode [ 594.693205][T17247] veth1_vlan: entered promiscuous mode [ 594.713245][T17247] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 594.714164][T17247] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 594.715015][T17247] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 594.729531][T17247] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 594.732177][T17271] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3110'. [ 594.770387][T17254] veth1_to_bond: entered allmulticast mode [ 594.770465][T17258] veth1_to_bond: entered promiscuous mode [ 594.816131][T17257] veth1_to_bond (unregistering): left allmulticast mode [ 594.816172][T17257] veth1_to_bond (unregistering): left promiscuous mode [ 594.823522][T17257] bond0: (slave bond_slave_1): Releasing backup interface [ 594.848089][ T174] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.851298][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.851344][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.851384][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.897980][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.898095][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 594.914251][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 594.914386][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.045146][T17274] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3111'. [ 595.061169][T17274] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3111'. [ 595.217466][T17137] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.217582][T17137] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.217740][T17137] bridge_slave_0: entered allmulticast mode [ 595.235044][T17137] bridge_slave_0: entered promiscuous mode [ 595.259487][T17137] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.259598][T17137] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.259758][T17137] bridge_slave_1: entered allmulticast mode [ 595.288597][T17137] bridge_slave_1: entered promiscuous mode [ 595.362821][T17137] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 595.389218][T17137] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 595.465187][T17289] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3114'. [ 595.471778][T17137] team0: Port device team_slave_0 added [ 595.494581][T17137] team0: Port device team_slave_1 added [ 595.563554][T17137] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 595.563575][T17137] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 595.563605][T17137] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 595.604244][T17137] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 595.604284][T17137] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 595.604345][T17137] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 595.741233][T17297] netlink: 'syz.0.3119': attribute type 22 has an invalid length. [ 595.741257][T17297] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3119'. [ 595.789491][T17297] netlink: 'syz.0.3119': attribute type 22 has an invalid length. [ 595.789515][T17297] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3119'. [ 595.860399][T17299] ip_tables: iptables: counters copy to user failed while replacing table [ 595.864260][T17137] hsr_slave_0: entered promiscuous mode [ 595.880943][T17137] hsr_slave_1: entered promiscuous mode [ 595.881804][T17137] debugfs: 'hsr0' already exists in 'hsr' [ 595.881826][T17137] Cannot create hsr debugfs directory [ 595.898274][ T1127] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 595.902402][ T50] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 595.902613][ T50] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 595.902727][ T50] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 596.295610][T15397] Bluetooth: hci0: command tx timeout [ 596.751577][T17137] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 596.751619][T17137] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.788691][T17319] netlink: 'syz.1.3125': attribute type 1 has an invalid length. [ 596.861813][T17318] netlink: 'syz.1.3125': attribute type 1 has an invalid length. [ 597.045885][T17326] netlink: 'syz.4.3128': attribute type 6 has an invalid length. [ 597.129627][T17137] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.129668][T17137] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.334177][T17137] bond0: (slave netdevsim1): Releasing backup interface [ 597.344803][T17137] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.344839][T17137] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.376777][T17338] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3130'. [ 597.376941][T17330] tc_dump_action: action bad kind [ 597.555189][T17137] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.574912][T17137] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.036934][T17137] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 598.064830][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 598.077202][T17137] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 598.104712][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 598.116989][T17137] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 598.147092][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 598.151460][T17137] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 598.187242][T17137] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 598.649002][T17137] 8021q: adding VLAN 0 to HW filter on device bond0 [ 598.712171][T17364] syzkaller0: entered promiscuous mode [ 598.712198][T17364] syzkaller0: entered allmulticast mode [ 598.729876][T17364] tipc: Started in network mode [ 598.729906][T17364] tipc: Node identity da35b8a43eb5, cluster identity 4711 [ 598.732477][T17364] tipc: Enabled bearer , priority 0 [ 598.762178][T17364] syzkaller0: mtu less than device minimum [ 598.794207][T17363] tipc: Resetting bearer [ 598.857003][T17363] tipc: Disabling bearer [ 598.890574][T17137] 8021q: adding VLAN 0 to HW filter on device team0 [ 598.918722][ T269] bridge0: port 1(bridge_slave_0) entered blocking state [ 598.918829][ T269] bridge0: port 1(bridge_slave_0) entered forwarding state [ 598.968090][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 598.968202][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 599.532647][T17388] netlink: 'syz.3.3143': attribute type 1 has an invalid length. [ 599.632266][T17394] netlink: 'syz.1.3145': attribute type 9 has an invalid length. [ 599.651191][T17388] 8021q: adding VLAN 0 to HW filter on device bond2 [ 599.652410][T17378] veth0_to_bond: left allmulticast mode [ 599.671955][T17378] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 599.743592][T17394] __nla_validate_parse: 3 callbacks suppressed [ 599.743612][T17394] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3145'. [ 599.901599][T17399] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3146'. [ 599.975530][ C1] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 600.126635][ T269] IPVS: starting estimator thread 0... [ 600.214492][T17137] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 600.235436][T17409] IPVS: using max 30 ests per chain, 72000 per kthread [ 600.350797][T17137] veth0_vlan: entered promiscuous mode [ 600.391017][T17137] veth1_vlan: entered promiscuous mode [ 600.526326][T17137] veth0_macvtap: entered promiscuous mode [ 600.543597][T17137] veth1_macvtap: entered promiscuous mode [ 600.624444][T17137] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 600.667156][T17137] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 600.717625][ T269] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.731749][ T59] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.732051][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.732094][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.905655][T17418] netlink: 'syz.4.3151': attribute type 25 has an invalid length. [ 600.905679][T17418] netlink: 'syz.4.3151': attribute type 3 has an invalid length. [ 600.905694][T17418] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3151'. [ 600.970698][T17418] netlink: 'syz.4.3151': attribute type 1 has an invalid length. [ 601.164165][T17423] erspan0: entered promiscuous mode [ 601.174097][T17423] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3153'. [ 601.214846][ T269] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 601.214870][ T269] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 601.274741][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 601.274765][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 601.450638][T17430] FAULT_INJECTION: forcing a failure. [ 601.450638][T17430] name failslab, interval 1, probability 0, space 0, times 0 [ 601.450676][T17430] CPU: 0 UID: 0 PID: 17430 Comm: syz.0.3155 Not tainted syzkaller #0 PREEMPT(full) [ 601.450702][T17430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 601.450717][T17430] Call Trace: [ 601.450726][T17430] [ 601.450736][T17430] dump_stack_lvl+0xe8/0x150 [ 601.450773][T17430] should_fail_ex+0x410/0x560 [ 601.450804][T17430] should_failslab+0xa8/0x100 [ 601.450833][T17430] __kvmalloc_node_noprof+0x176/0x820 [ 601.450858][T17430] ? kasan_save_track+0x3e/0x80 [ 601.450881][T17430] ? __kvmalloc_node_noprof+0x50f/0x820 [ 601.450904][T17430] ? bpf_stack_liveness_init+0x29/0x90 [ 601.450928][T17430] ? bpf_check+0x24f6/0x2e10 [ 601.450951][T17430] ? bpf_compute_const_regs+0x18f/0x3450 [ 601.450982][T17430] ? bpf_compute_const_regs+0x18f/0x3450 [ 601.451024][T17430] bpf_compute_const_regs+0x18f/0x3450 [ 601.451076][T17430] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 601.451102][T17430] ? check_attach_btf_id+0x325/0x1a30 [ 601.451136][T17430] ? rcu_is_watching+0x16/0xb0 [ 601.451163][T17430] ? bpf_stack_liveness_init+0x29/0x90 [ 601.451186][T17430] ? trace_kmalloc+0x2a/0xf0 [ 601.451220][T17430] ? __pfx_check_attach_btf_id+0x10/0x10 [ 601.451246][T17430] ? bpf_stack_liveness_init+0x29/0x90 [ 601.451270][T17430] ? __kvmalloc_node_noprof+0x52f/0x820 [ 601.451305][T17430] ? __asan_memset+0x22/0x50 [ 601.451342][T17430] bpf_check+0x255d/0x2e10 [ 601.451378][T17430] ? ktime_get_with_offset+0x93/0x2d0 [ 601.451407][T17430] ? __pfx_bpf_check+0x10/0x10 [ 601.451434][T17430] ? bpf_obj_name_cpy+0x194/0x1e0 [ 601.451469][T17430] bpf_prog_load+0x14d6/0x1c20 [ 601.451508][T17430] ? __pfx_bpf_prog_load+0x10/0x10 [ 601.451561][T17430] __sys_bpf+0xd0d/0xd90 [ 601.451595][T17430] ? __pfx___sys_bpf+0x10/0x10 [ 601.451632][T17430] ? __fget_files+0x2a/0x420 [ 601.451681][T17430] ? ksys_write+0x242/0x270 [ 601.451717][T17430] ? __pfx_ksys_write+0x10/0x10 [ 601.451756][T17430] __x64_sys_bpf+0xba/0xd0 [ 601.451781][T17430] do_syscall_64+0x166/0x520 [ 601.451806][T17430] ? trace_irq_disable+0x3b/0x140 [ 601.451828][T17430] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.451851][T17430] ? clear_bhb_loop+0x70/0xc0 [ 601.451879][T17430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.451902][T17430] RIP: 0033:0x7f10f939e159 [ 601.451922][T17430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 601.451942][T17430] RSP: 002b:00007f10fa2fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 601.451967][T17430] RAX: ffffffffffffffda RBX: 00007f10f9625fa0 RCX: 00007f10f939e159 [ 601.451984][T17430] RDX: 0000000000000094 RSI: 0000200000000680 RDI: 0000000000000005 [ 601.451999][T17430] RBP: 00007f10fa2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 601.452021][T17430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 601.452035][T17430] R13: 00007f10f9626038 R14: 00007f10f9625fa0 R15: 00007ffed6e87548 [ 601.452069][T17430] [ 601.851065][T17441] FAULT_INJECTION: forcing a failure. [ 601.851065][T17441] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 601.851102][T17441] CPU: 0 UID: 0 PID: 17441 Comm: syz.4.3158 Not tainted syzkaller #0 PREEMPT(full) [ 601.851130][T17441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 601.851145][T17441] Call Trace: [ 601.851155][T17441] [ 601.851165][T17441] dump_stack_lvl+0xe8/0x150 [ 601.851204][T17441] should_fail_ex+0x410/0x560 [ 601.851235][T17441] _copy_from_user+0x2d/0xb0 [ 601.851266][T17441] do_ipv6_setsockopt+0x245/0x2960 [ 601.851302][T17441] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 601.851329][T17441] ? begin_current_label_crit_section+0x2a3/0x830 [ 601.851369][T17441] ? __pfx_begin_current_label_crit_section+0x10/0x10 [ 601.851400][T17441] ? get_pid_task+0x20/0x1f0 [ 601.851431][T17441] ? aa_inet_opt_perm+0xae4/0xcf0 [ 601.851459][T17441] ? get_pid_task+0x20/0x1f0 [ 601.851479][T17441] ? get_pid_task+0x20/0x1f0 [ 601.851509][T17441] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 601.851557][T17441] ? ksys_write+0x1e6/0x270 [ 601.851603][T17441] ipv6_setsockopt+0x59/0x170 [ 601.851637][T17441] rawv6_setsockopt+0x276/0x5e0 [ 601.851669][T17441] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 601.851701][T17441] ? sock_common_setsockopt+0x36/0xc0 [ 601.851725][T17441] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 601.851752][T17441] do_sock_setsockopt+0x17c/0x1b0 [ 601.851786][T17441] __x64_sys_setsockopt+0x13d/0x1b0 [ 601.851821][T17441] do_syscall_64+0x166/0x520 [ 601.851847][T17441] ? trace_irq_disable+0x3b/0x140 [ 601.851869][T17441] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.851893][T17441] ? clear_bhb_loop+0x70/0xc0 [ 601.851922][T17441] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.851946][T17441] RIP: 0033:0x7fd7c079e159 [ 601.851967][T17441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 601.851995][T17441] RSP: 002b:00007fd7c1623028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 601.852021][T17441] RAX: ffffffffffffffda RBX: 00007fd7c0a25fa0 RCX: 00007fd7c079e159 [ 601.852039][T17441] RDX: 00000000000000d0 RSI: 0000000000000029 RDI: 0000000000000003 [ 601.852054][T17441] RBP: 00007fd7c1623090 R08: 0000000000000004 R09: 0000000000000000 [ 601.852069][T17441] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 601.852084][T17441] R13: 00007fd7c0a26038 R14: 00007fd7c0a25fa0 R15: 00007fff633ba048 [ 601.852120][T17441] [ 602.056727][T17442] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3157'. [ 602.265161][T17449] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3160'. [ 602.760780][T17465] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3163'. [ 603.098309][T17477] netlink: 928 bytes leftover after parsing attributes in process `syz.1.3171'. [ 603.179482][T17477] hsr_slave_1 (unregistering): left promiscuous mode [ 603.183115][T17479] netlink: 'syz.4.3172': attribute type 9 has an invalid length. [ 603.212327][T17479] netlink: 43 bytes leftover after parsing attributes in process `syz.4.3172'. [ 603.748551][T17504] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3174'. [ 604.806275][T17523] syzkaller0: entered promiscuous mode [ 604.806303][T17523] syzkaller0: entered allmulticast mode [ 604.809932][T17525] syzkaller0: entered promiscuous mode [ 604.809953][T17525] syzkaller0: entered allmulticast mode [ 607.239527][T17569] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3184'. [ 607.264887][T17562] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3184'. [ 607.296934][T17570] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3187'. [ 607.296969][T17570] netlink: 'syz.1.3187': attribute type 20 has an invalid length. [ 607.296984][T17570] netlink: 'syz.1.3187': attribute type 21 has an invalid length. [ 607.723245][T17592] netlink: 'syz.2.3194': attribute type 9 has an invalid length. [ 607.850914][T17592] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3194'. [ 607.967348][T17602] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3193'. [ 608.476920][T17604] gretap1: entered promiscuous mode [ 608.547894][T17608] ovs-s!: entered promiscuous mode [ 608.716740][T17600] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3195'. [ 608.899192][T17630] No such timeout policy "s " [ 608.899214][T17630] netlink: Failed to associated timeout policy 's ' [ 609.083768][T17630] bridge0: port 3(wlan1) entered disabled state [ 609.297437][T17644] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3204'. [ 609.635842][T17662] netlink: 'syz.0.3208': attribute type 9 has an invalid length. [ 609.718728][T17662] netlink: 43 bytes leftover after parsing attributes in process `syz.0.3208'. [ 609.757044][T17666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3211'. [ 609.760332][T17666] C: renamed from veth1_to_team (while UP) [ 609.788481][T17668] ip_tables: iptables: counters copy to user failed while replacing table [ 609.818670][T17671] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3211'. [ 609.860114][T17666] netlink: 'syz.3.3211': attribute type 3 has an invalid length. [ 609.863913][T17666] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 611.500238][T17737] vlan0: entered promiscuous mode [ 611.568235][T17741] xt_hashlimit: size too large, truncated to 1048576 [ 611.958817][T17751] openvswitch: ovs-s!: Dropping previously announced user features [ 612.076062][T17742] sctp: [Deprecated]: syz.1.3230 (pid 17742) Use of struct sctp_assoc_value in delayed_ack socket option. [ 612.076062][T17742] Use struct sctp_sack_info instead [ 612.565478][T17770] __nla_validate_parse: 5 callbacks suppressed [ 612.565502][T17770] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3235'. [ 612.806162][T17777] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3239'. [ 613.113563][T17786] netlink: 'syz.4.3240': attribute type 8 has an invalid length. [ 613.334293][T17793] netlink: 'syz.1.3243': attribute type 39 has an invalid length. [ 613.558012][ T174] IPVS: starting estimator thread 0... [ 613.645617][T17800] IPVS: using max 26 ests per chain, 62400 per kthread [ 614.432446][T17831] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3251'. [ 614.553018][T17835] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3257'. [ 614.608423][T17843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3257'. [ 614.917914][T17856] netlink: 92 bytes leftover after parsing attributes in process `syz.3.3260'. [ 615.151061][T17867] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3265'. [ 615.241949][T17867] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3265'. [ 615.831110][T17900] tipc: Enabling of bearer rejected, failed to enable media [ 616.097507][T17911] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3275'. [ 616.370664][T17915] netlink: 'syz.2.3278': attribute type 9 has an invalid length. [ 616.417735][T17915] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3278'. [ 616.520990][ T5630] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 616.538138][ T5630] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 616.538960][ T5630] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 616.540545][ T5630] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 616.542077][ T5630] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 616.744005][T17925] netlink: 'syz.2.3281': attribute type 10 has an invalid length. [ 616.819517][T17926] netlink: 'syz.2.3281': attribute type 10 has an invalid length. [ 616.886131][T17925] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 616.890507][T17925] team0: Port device netdevsim1 added [ 616.924886][T17926] team0: Port device netdevsim1 removed [ 616.968382][T17926] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 616.992230][T17926] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 617.091404][T17933] ip6tnl1: entered allmulticast mode [ 617.093232][ T3379] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 617.093474][ T3379] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 617.118350][ T5740] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 617.227735][ T5740] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 617.409353][ T44] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 617.438118][T17948] Bluetooth: MGMT ver 1.23 [ 617.534059][T17950] netlink: 'syz.0.3289': attribute type 9 has an invalid length. [ 617.813522][T17968] __nla_validate_parse: 4 callbacks suppressed [ 617.813545][T17968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3294'. [ 618.013001][T17968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3294'. [ 618.026726][T17916] lo speed is unknown, defaulting to 1000 [ 618.442729][T17990] ip_tables: iptables: counters copy to user failed while replacing table [ 618.499078][T17982] netlink: 92 bytes leftover after parsing attributes in process `syz.2.3297'. [ 618.569227][T17986] bridge0: port 2(bridge_slave_1) entered disabled state [ 618.569900][T17986] bridge0: port 1(bridge_slave_0) entered disabled state [ 618.614554][T17997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3299'. [ 618.625409][ T5630] Bluetooth: hci4: command tx timeout [ 618.636499][T17997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3299'. [ 618.636523][T17997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3299'. [ 618.722086][T17986] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 618.739678][T17986] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 618.769904][T18001] netlink: 'syz.3.3301': attribute type 10 has an invalid length. [ 618.838585][T18003] netlink: 'syz.3.3301': attribute type 10 has an invalid length. [ 618.898994][T17988] bridge0: entered promiscuous mode [ 618.899181][T17988] macvlan2: entered promiscuous mode [ 618.936952][T18001] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 618.949612][T18001] team0: Port device netdevsim1 added [ 619.064896][T18003] team0: Port device netdevsim1 removed [ 619.078380][T18003] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 619.091876][T18003] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 619.133615][T18010] netlink: 'syz.2.3303': attribute type 9 has an invalid length. [ 619.149853][T18010] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3303'. [ 619.217210][ T269] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.217262][ T269] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.217303][ T269] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.217342][ T269] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 619.498263][ T5630] Bluetooth: hci0: command tx timeout [ 619.912732][T18034] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3311'. [ 619.931841][T17916] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.933595][T17916] bridge0: port 1(bridge_slave_0) entered disabled state [ 619.934107][T17916] bridge_slave_0: entered allmulticast mode [ 619.940977][T17916] bridge_slave_0: entered promiscuous mode [ 619.968443][T17916] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.968541][T17916] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.968683][T17916] bridge_slave_1: entered allmulticast mode [ 619.970733][T17916] bridge_slave_1: entered promiscuous mode [ 620.096433][T18034] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3311'. [ 620.123696][T17916] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 620.148209][T17916] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 620.283150][T17916] team0: Port device team_slave_0 added [ 620.294763][T17916] team0: Port device team_slave_1 added [ 620.346242][T18038] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3312'. [ 620.695326][ T5630] Bluetooth: hci4: command tx timeout [ 620.774000][T17916] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 620.774021][T17916] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 620.774049][T17916] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 621.095740][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 621.203138][T18061] FAULT_INJECTION: forcing a failure. [ 621.203138][T18061] name failslab, interval 1, probability 0, space 0, times 0 [ 621.206981][T18061] CPU: 1 UID: 0 PID: 18061 Comm: syz.3.3315 Not tainted syzkaller #0 PREEMPT(full) [ 621.207011][T18061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 621.207026][T18061] Call Trace: [ 621.207036][T18061] [ 621.207047][T18061] dump_stack_lvl+0xe8/0x150 [ 621.207087][T18061] should_fail_ex+0x410/0x560 [ 621.207119][T18061] should_failslab+0xa8/0x100 [ 621.207150][T18061] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 621.207175][T18061] ? __kasan_kmalloc+0x93/0xb0 [ 621.207202][T18061] ? __request_module+0x2ec/0x630 [ 621.207230][T18061] ? __request_module+0x2ec/0x630 [ 621.207260][T18061] ? __kmalloc_cache_noprof+0x14d/0x600 [ 621.207288][T18061] kstrdup+0x42/0x100 [ 621.207316][T18061] __request_module+0x2ec/0x630 [ 621.207352][T18061] ? __pfx___request_module+0x10/0x10 [ 621.207379][T18061] ? kasan_quarantine_put+0xbb/0x1f0 [ 621.207419][T18061] ? security_capable+0x7e/0x2c0 [ 621.207451][T18061] ? dev_load+0x21/0x1f0 [ 621.207476][T18061] dev_load+0x190/0x1f0 [ 621.207502][T18061] dev_ioctl+0x79f/0x1150 [ 621.207533][T18061] sock_do_ioctl+0x23e/0x320 [ 621.207572][T18061] ? __pfx_sock_do_ioctl+0x10/0x10 [ 621.207604][T18061] ? hook_file_ioctl+0x1f2/0x600 [ 621.207646][T18061] sock_ioctl+0x57a/0x7e0 [ 621.207681][T18061] ? __pfx_sock_ioctl+0x10/0x10 [ 621.207715][T18061] ? __fget_files+0x2a/0x420 [ 621.207745][T18061] ? __fget_files+0x3a2/0x420 [ 621.207776][T18061] ? __fget_files+0x2a/0x420 [ 621.207812][T18061] ? bpf_lsm_file_ioctl+0x9/0x20 [ 621.207845][T18061] ? __pfx_sock_ioctl+0x10/0x10 [ 621.207878][T18061] __se_sys_ioctl+0xfc/0x170 [ 621.207905][T18061] do_syscall_64+0x166/0x520 [ 621.207938][T18061] ? trace_irq_disable+0x3b/0x140 [ 621.207960][T18061] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.207985][T18061] ? clear_bhb_loop+0x70/0xc0 [ 621.208013][T18061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.208035][T18061] RIP: 0033:0x7f2a3c39e159 [ 621.208054][T18061] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 621.208075][T18061] RSP: 002b:00007f2a3a593028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 621.208101][T18061] RAX: ffffffffffffffda RBX: 00007f2a3c626720 RCX: 00007f2a3c39e159 [ 621.208118][T18061] RDX: 0000200000002280 RSI: 0000000000008922 RDI: 0000000000000006 [ 621.208133][T18061] RBP: 00007f2a3a593090 R08: 0000000000000000 R09: 0000000000000000 [ 621.208148][T18061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 621.208162][T18061] R13: 00007f2a3c6267b8 R14: 00007f2a3c626720 R15: 00007fff4e6b3128 [ 621.208197][T18061] [ 621.584498][T17916] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 621.584518][T17916] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 621.584549][T17916] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 621.657251][T18054] tipc: Enabling of bearer rejected, failed to enable media [ 621.832629][T17916] hsr_slave_0: entered promiscuous mode [ 621.833707][T17916] hsr_slave_1: entered promiscuous mode [ 621.840409][T17916] debugfs: 'hsr0' already exists in 'hsr' [ 621.840470][T17916] Cannot create hsr debugfs directory [ 622.105164][T18086] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 622.458982][T17916] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 622.459010][T17916] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 622.648331][T17916] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 622.648383][T17916] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 622.777329][ T5630] Bluetooth: hci4: command tx timeout [ 622.899266][T17916] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 622.899308][T17916] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.028456][T18109] __nla_validate_parse: 5 callbacks suppressed [ 623.028481][T18109] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3331'. [ 623.077141][T17916] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 623.077182][T17916] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 623.118282][T18110] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3331'. [ 623.464884][T18124] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3336'. [ 623.484959][T18124] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3336'. [ 623.600920][T18125] bridge_slave_0: left allmulticast mode [ 623.600958][T18125] bridge_slave_0: left promiscuous mode [ 623.601211][T18125] bridge0: port 1(bridge_slave_0) entered disabled state [ 623.624593][T18125] bridge_slave_1: left allmulticast mode [ 623.624618][T18125] bridge_slave_1: left promiscuous mode [ 623.624851][T18125] bridge0: port 2(bridge_slave_1) entered disabled state [ 623.679828][T18125] bond0: (slave bond_slave_0): Releasing backup interface [ 623.719014][T18125] bond0: (slave bond_slave_1): Releasing backup interface [ 623.749782][T18125] team0: Port device team_slave_0 removed [ 623.751632][T18136] netlink: 'syz.3.3339': attribute type 9 has an invalid length. [ 623.754040][T18125] team0: Port device team_slave_1 removed [ 623.754427][T18125] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 623.759753][T18125] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 623.779675][T18125] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 623.850536][T18141] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3339'. [ 623.882585][T17916] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 623.905172][T17916] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 623.907314][T17916] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 623.933788][T17916] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 623.935085][T17916] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 623.978534][T17916] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 623.979213][T17916] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 624.006662][T17916] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 624.231136][T17916] 8021q: adding VLAN 0 to HW filter on device bond0 [ 624.275354][T17916] 8021q: adding VLAN 0 to HW filter on device team0 [ 624.285425][ T269] bridge0: port 1(bridge_slave_0) entered blocking state [ 624.285549][ T269] bridge0: port 1(bridge_slave_0) entered forwarding state [ 624.313889][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.348319][ T269] bridge0: port 2(bridge_slave_1) entered blocking state [ 624.348394][ T269] bridge0: port 2(bridge_slave_1) entered forwarding state [ 624.558490][T18162] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3346'. [ 624.558812][T18162] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3346'. [ 624.642544][T18164] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3347'. [ 624.656823][T18164] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3347'. [ 624.856618][ T5630] Bluetooth: hci4: command tx timeout [ 624.907577][T18175] netlink: 'syz.0.3351': attribute type 9 has an invalid length. [ 624.932757][T18178] netlink: 'syz.1.3350': attribute type 10 has an invalid length. [ 624.949078][T18179] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3352'. [ 624.976482][T18178] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 624.978248][T18178] team0: Port device netdevsim1 added [ 625.029438][T18178] netlink: 'syz.1.3350': attribute type 10 has an invalid length. [ 625.069153][T18178] team0: Port device netdevsim1 removed [ 625.071129][T18179] netlink: 'syz.3.3352': attribute type 1 has an invalid length. [ 625.103152][T18178] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 625.115922][T18178] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 625.158636][ T1127] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.158703][ T1127] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.158746][ T1127] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.158785][ T1127] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 625.233535][T18179] veth3: entered allmulticast mode [ 625.366011][T18190] netlink: 'syz.1.3353': attribute type 29 has an invalid length. [ 625.662790][T18204] vlan2: entered promiscuous mode [ 625.662816][T18204] erspan0: entered promiscuous mode [ 625.895811][T18213] tipc: Started in network mode [ 625.895844][T18213] tipc: Node identity feffffff000000000000ffffffffffff, cluster identity 4711 [ 625.895892][T18213] tipc: Enabling of bearer rejected, failed to enable media [ 625.991181][T18218] netlink: 'syz.2.3361': attribute type 1 has an invalid length. [ 626.084847][T18218] 8021q: adding VLAN 0 to HW filter on device bond1 [ 626.102564][T17916] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 626.130213][T18227] netlink: 'syz.0.3363': attribute type 9 has an invalid length. [ 626.164763][T18224] bond1: (slave veth0_to_bond): making interface the new active one [ 626.175992][T18224] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 626.184226][T18218] netlink: 'syz.2.3361': attribute type 1 has an invalid length. [ 626.278535][T18218] bond1: (slave bridge1): Enslaving as an active interface with a down link [ 626.352765][T18218] macvlan2: entered promiscuous mode [ 626.352793][T18218] macvlan2: entered allmulticast mode [ 626.353465][T18218] bond1: entered promiscuous mode [ 626.353486][T18218] veth0_to_bond: entered promiscuous mode [ 626.397301][T18218] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 626.398108][T18218] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 626.398249][T18218] bond1: left promiscuous mode [ 626.398266][T18218] veth0_to_bond: left promiscuous mode [ 626.636349][T18238] x_tables: duplicate underflow at hook 2 [ 626.840418][T18248] netlink: 'syz.1.3370': attribute type 1 has an invalid length. [ 626.877818][T18252] netlink: 'syz.2.3371': attribute type 1 has an invalid length. [ 627.008426][T18248] veth3: entered allmulticast mode [ 627.046967][T18248] bond1: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 627.130400][ T3379] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.130457][ T3379] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.130543][ T3379] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.289660][T17916] veth0_vlan: entered promiscuous mode [ 627.303932][T17916] veth1_vlan: entered promiscuous mode [ 627.346321][ T12] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 627.388905][T17916] veth0_macvtap: entered promiscuous mode [ 627.405597][T17916] veth1_macvtap: entered promiscuous mode [ 627.447424][T17916] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 627.480842][T17916] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 627.497397][ C1] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 627.681371][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 627.681396][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 627.697131][ T174] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.700149][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.704610][ T269] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.704807][ T269] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.855806][T18283] ip_tables: iptables: counters copy to user failed while replacing table [ 627.900454][ T174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 627.900478][ T174] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 628.181776][T18294] __nla_validate_parse: 17 callbacks suppressed [ 628.181800][T18294] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3385'. [ 628.248090][T18295] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3386'. [ 628.279214][T18295] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3386'. [ 628.358434][T18298] tc_dump_action: action bad kind [ 628.481301][T18305] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3388'. [ 629.008069][T18314] syzkaller0: entered promiscuous mode [ 629.008095][T18314] syzkaller0: entered allmulticast mode [ 629.016062][T18317] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3391'. [ 629.037474][T18314] tipc: Enabled bearer , priority 0 [ 629.330719][T18322] xt_hashlimit: size too large, truncated to 1048576 [ 629.383852][T18326] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3395'. [ 629.420228][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 629.660795][T18313] tipc: Resetting bearer [ 629.801399][T18313] tipc: Disabling bearer [ 630.095874][T18335] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3400'. [ 630.339533][T18332] x_tables: duplicate underflow at hook 1 [ 630.363663][T18331] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3399'. [ 630.491734][T18338] syzkaller1: entered promiscuous mode [ 630.491762][T18338] syzkaller1: entered allmulticast mode [ 630.621572][T18346] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3402'. [ 630.723207][T18354] FAULT_INJECTION: forcing a failure. [ 630.723207][T18354] name failslab, interval 1, probability 0, space 0, times 0 [ 630.723242][T18354] CPU: 1 UID: 0 PID: 18354 Comm: syz.3.3405 Not tainted syzkaller #0 PREEMPT(full) [ 630.723267][T18354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 630.723284][T18354] Call Trace: [ 630.723294][T18354] [ 630.723305][T18354] dump_stack_lvl+0xe8/0x150 [ 630.723342][T18354] should_fail_ex+0x410/0x560 [ 630.723372][T18354] should_failslab+0xa8/0x100 [ 630.723401][T18354] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 630.723475][T18354] ? copy_array+0x71/0x100 [ 630.723507][T18354] ? copy_array+0x71/0x100 [ 630.723542][T18354] ? copy_array+0x71/0x100 [ 630.723576][T18354] krealloc_node_align_noprof+0x19a/0x390 [ 630.723603][T18354] ? rcu_is_watching+0x16/0xb0 [ 630.723634][T18354] copy_array+0x71/0x100 [ 630.723668][T18354] bpf_copy_verifier_state+0xad/0x1170 [ 630.723703][T18354] ? bpf_is_state_visited+0x2d6b/0x47d0 [ 630.723726][T18354] ? bpf_is_state_visited+0x2d6b/0x47d0 [ 630.723757][T18354] bpf_is_state_visited+0x377d/0x47d0 [ 630.723791][T18354] ? diag_append_history+0x136/0x520 [ 630.723829][T18354] ? bpf_diag_record_branch+0x58/0x90 [ 630.723878][T18354] do_check_common+0x2848/0x5d30 [ 630.723950][T18354] ? __pfx_do_check_common+0x10/0x10 [ 630.723995][T18354] bpf_check+0x2639/0x2e10 [ 630.724034][T18354] ? ktime_get_with_offset+0x93/0x2d0 [ 630.724064][T18354] ? __pfx_bpf_check+0x10/0x10 [ 630.724093][T18354] ? bpf_obj_name_cpy+0x194/0x1e0 [ 630.724131][T18354] bpf_prog_load+0x14d6/0x1c20 [ 630.724173][T18354] ? __pfx_bpf_prog_load+0x10/0x10 [ 630.724228][T18354] __sys_bpf+0xd0d/0xd90 [ 630.724265][T18354] ? __pfx___sys_bpf+0x10/0x10 [ 630.724303][T18354] ? __fget_files+0x2a/0x420 [ 630.724355][T18354] ? ksys_write+0x242/0x270 [ 630.724393][T18354] ? __pfx_ksys_write+0x10/0x10 [ 630.724441][T18354] __x64_sys_bpf+0xba/0xd0 [ 630.724469][T18354] do_syscall_64+0x166/0x520 [ 630.724496][T18354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 630.724520][T18354] ? clear_bhb_loop+0x70/0xc0 [ 630.724550][T18354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 630.724574][T18354] RIP: 0033:0x7f2a3c39e159 [ 630.724596][T18354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 630.724617][T18354] RSP: 002b:00007f2a3d216028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 630.724655][T18354] RAX: ffffffffffffffda RBX: 00007f2a3c625fa0 RCX: 00007f2a3c39e159 [ 630.724673][T18354] RDX: 0000000000000094 RSI: 0000200000000840 RDI: 0000000000000005 [ 630.724688][T18354] RBP: 00007f2a3d216090 R08: 0000000000000000 R09: 0000000000000000 [ 630.724703][T18354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 630.724717][T18354] R13: 00007f2a3c626038 R14: 00007f2a3c625fa0 R15: 00007fff4e6b3128 [ 630.724752][T18354] [ 631.148382][T18359] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3408'. [ 631.185856][T18364] validate_nla: 3 callbacks suppressed [ 631.185879][T18364] netlink: 'syz.3.3410': attribute type 1 has an invalid length. [ 631.439103][T18362] 8021q: adding VLAN 0 to HW filter on device bond0 [ 631.466829][T18373] netlink: Conntrack attr has 8 unknown bytes [ 631.466867][T18373] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 631.468897][T18362] 8021q: adding VLAN 0 to HW filter on device team0 [ 631.514269][T18362] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 631.561304][T18362] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 631.583698][T18362] veth1_vlan: left promiscuous mode [ 631.601763][T18362] veth1_vlan: entered promiscuous mode [ 631.621214][T18362] veth1_macvtap: left promiscuous mode [ 631.624616][T18362] veth0_macvtap: left promiscuous mode [ 631.639931][T18362] veth0_macvtap: entered promiscuous mode [ 631.653579][T18362] veth1_macvtap: entered promiscuous mode [ 631.669304][T18362] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 631.671196][T18362] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 631.672461][T18362] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 631.704176][T18362] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 631.710950][ T1127] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.716080][ T269] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.716669][ T269] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 631.718708][ T269] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.022564][T18395] netlink: 'syz.2.3416': attribute type 9 has an invalid length. [ 633.109837][T18437] FAULT_INJECTION: forcing a failure. [ 633.109837][T18437] name failslab, interval 1, probability 0, space 0, times 0 [ 633.109876][T18437] CPU: 1 UID: 0 PID: 18437 Comm: syz.3.3424 Not tainted syzkaller #0 PREEMPT(full) [ 633.109903][T18437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 633.109917][T18437] Call Trace: [ 633.109927][T18437] [ 633.109938][T18437] dump_stack_lvl+0xe8/0x150 [ 633.109977][T18437] should_fail_ex+0x410/0x560 [ 633.110009][T18437] should_failslab+0xa8/0x100 [ 633.110041][T18437] __kmalloc_cache_noprof+0xa3/0x600 [ 633.110064][T18437] ? lock_acquire+0x115/0x350 [ 633.110087][T18437] ? xfrm_policy_inexact_insert_node+0xa86/0xb90 [ 633.110115][T18437] ? xfrm_policy_inexact_insert_node+0xa86/0xb90 [ 633.110150][T18437] ? xfrm_policy_inexact_insert+0xc9/0x180 [ 633.110186][T18437] xfrm_policy_inexact_insert_node+0xa86/0xb90 [ 633.110215][T18437] ? lock_acquire+0x115/0x350 [ 633.110257][T18437] ? xfrm_policy_inexact_insert+0xc9/0x180 [ 633.110291][T18437] xfrm_policy_inexact_alloc_chain+0x6c3/0xe80 [ 633.110344][T18437] xfrm_policy_inexact_insert+0xc9/0x180 [ 633.110383][T18437] xfrm_policy_insert+0x113/0x960 [ 633.110428][T18437] xfrm_add_policy+0x2ea/0x690 [ 633.110460][T18437] ? __pfx_xfrm_add_policy+0x10/0x10 [ 633.110482][T18437] ? apparmor_capable+0x126/0x170 [ 633.110523][T18437] ? __nla_parse+0x40/0x60 [ 633.110558][T18437] xfrm_user_rcv_msg+0x7a8/0xf30 [ 633.110588][T18437] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 633.110649][T18437] ? __mutex_trylock_common+0x15f/0x270 [ 633.110683][T18437] ? __pfx___mutex_trylock_common+0x10/0x10 [ 633.110717][T18437] ? rcu_is_watching+0x16/0xb0 [ 633.110746][T18437] ? trace_contention_end+0x3d/0x140 [ 633.110786][T18437] netlink_rcv_skb+0x226/0x4a0 [ 633.110822][T18437] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 633.110849][T18437] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 633.110901][T18437] ? netlink_deliver_tap+0x2e/0x1b0 [ 633.110934][T18437] ? netlink_deliver_tap+0x2e/0x1b0 [ 633.110971][T18437] xfrm_netlink_rcv+0x79/0x90 [ 633.110995][T18437] netlink_unicast+0x7bd/0x940 [ 633.111039][T18437] netlink_sendmsg+0x813/0xb40 [ 633.111084][T18437] ? __pfx_netlink_sendmsg+0x10/0x10 [ 633.111129][T18437] ? apparmor_socket_sendmsg+0x98/0x360 [ 633.111157][T18437] ? __pfx_netlink_sendmsg+0x10/0x10 [ 633.111191][T18437] sock_sendmsg_nosec+0x13a/0x180 [ 633.111232][T18437] ____sys_sendmsg+0x54e/0x850 [ 633.111270][T18437] ? __pfx_____sys_sendmsg+0x10/0x10 [ 633.111311][T18437] ? import_iovec+0x73/0xa0 [ 633.111350][T18437] ___sys_sendmsg+0x2a5/0x360 [ 633.111379][T18437] ? __lock_acquire+0x747/0x2de0 [ 633.111408][T18437] ? __pfx____sys_sendmsg+0x10/0x10 [ 633.111479][T18437] ? __fget_files+0x2a/0x420 [ 633.111512][T18437] ? __fget_files+0x3a2/0x420 [ 633.111556][T18437] __x64_sys_sendmsg+0x1b1/0x290 [ 633.111591][T18437] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 633.111647][T18437] do_syscall_64+0x166/0x520 [ 633.111672][T18437] ? trace_irq_disable+0x3b/0x140 [ 633.111696][T18437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.111721][T18437] ? clear_bhb_loop+0x70/0xc0 [ 633.111751][T18437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.111775][T18437] RIP: 0033:0x7f2a3c39e159 [ 633.111798][T18437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 633.111820][T18437] RSP: 002b:00007f2a3d216028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 633.111845][T18437] RAX: ffffffffffffffda RBX: 00007f2a3c625fa0 RCX: 00007f2a3c39e159 [ 633.111863][T18437] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 633.111879][T18437] RBP: 00007f2a3d216090 R08: 0000000000000000 R09: 0000000000000000 [ 633.111894][T18437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 633.111909][T18437] R13: 00007f2a3c626038 R14: 00007f2a3c625fa0 R15: 00007fff4e6b3128 [ 633.111946][T18437] [ 633.771538][T18449] __nla_validate_parse: 6 callbacks suppressed [ 633.771562][T18449] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3428'. [ 633.858928][ T5630] block nbd2: Receive control failed (result -32) [ 633.858928][T15397] block nbd2: Receive control failed (result -32) [ 634.789594][T18480] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3439'. [ 634.899031][T18482] netlink: 92 bytes leftover after parsing attributes in process `syz.0.3441'. [ 635.081458][T18486] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3444'. [ 635.081494][T18486] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 635.084554][T18486] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3444'. [ 635.268365][T18488] TC_ACT_REPEAT abuse ? [ 635.552158][T18503] netlink: 'syz.3.3451': attribute type 62 has an invalid length. [ 635.797688][T18515] FAULT_INJECTION: forcing a failure. [ 635.797688][T18515] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 635.797727][T18515] CPU: 1 UID: 0 PID: 18515 Comm: syz.2.3456 Not tainted syzkaller #0 PREEMPT(full) [ 635.797753][T18515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 635.797768][T18515] Call Trace: [ 635.797778][T18515] [ 635.797789][T18515] dump_stack_lvl+0xe8/0x150 [ 635.797828][T18515] should_fail_ex+0x410/0x560 [ 635.797860][T18515] _copy_from_user+0x2d/0xb0 [ 635.797891][T18515] ___sys_recvmsg+0x173/0x5a0 [ 635.797933][T18515] ? __pfx____sys_recvmsg+0x10/0x10 [ 635.797970][T18515] ? lock_acquire+0x115/0x350 [ 635.798025][T18515] do_recvmmsg+0x31a/0x7f0 [ 635.798066][T18515] ? __pfx_do_recvmmsg+0x10/0x10 [ 635.798110][T18515] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 635.798138][T18515] ? __fget_files+0x3a2/0x420 [ 635.798181][T18515] __x64_sys_recvmmsg+0x198/0x250 [ 635.798217][T18515] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 635.798261][T18515] do_syscall_64+0x166/0x520 [ 635.798286][T18515] ? trace_irq_disable+0x3b/0x140 [ 635.798308][T18515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.798333][T18515] ? clear_bhb_loop+0x70/0xc0 [ 635.798362][T18515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.798386][T18515] RIP: 0033:0x7fceabd9e159 [ 635.798407][T18515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.798428][T18515] RSP: 002b:00007fceacc05028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 635.798454][T18515] RAX: ffffffffffffffda RBX: 00007fceac025fa0 RCX: 00007fceabd9e159 [ 635.798472][T18515] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000006 [ 635.798487][T18515] RBP: 00007fceacc05090 R08: 0000000000000000 R09: 0000000000000000 [ 635.798510][T18515] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 635.798525][T18515] R13: 00007fceac026038 R14: 00007fceac025fa0 R15: 00007ffd4b522098 [ 635.798561][T18515] [ 636.511834][T18534] No such timeout policy "s " [ 636.511854][T18534] netlink: Failed to associated timeout policy 's ' [ 636.644360][T18543] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3462'. [ 636.718640][T18542] 8021q: adding VLAN 0 to HW filter on device bond2 [ 636.988576][T18554] FAULT_INJECTION: forcing a failure. [ 636.988576][T18554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 636.988616][T18554] CPU: 1 UID: 0 PID: 18554 Comm: syz.3.3468 Not tainted syzkaller #0 PREEMPT(full) [ 636.988643][T18554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 636.988658][T18554] Call Trace: [ 636.988668][T18554] [ 636.988678][T18554] dump_stack_lvl+0xe8/0x150 [ 636.988718][T18554] should_fail_ex+0x410/0x560 [ 636.988754][T18554] _copy_from_user+0x2d/0xb0 [ 636.988784][T18554] generic_map_update_batch+0x668/0xae0 [ 636.988832][T18554] ? __pfx_generic_map_update_batch+0x10/0x10 [ 636.988876][T18554] ? __fget_files+0x2a/0x420 [ 636.988915][T18554] ? __pfx_generic_map_update_batch+0x10/0x10 [ 636.988950][T18554] bpf_map_do_batch+0x391/0x630 [ 636.988985][T18554] __sys_bpf+0xbe5/0xd90 [ 636.989020][T18554] ? __pfx___sys_bpf+0x10/0x10 [ 636.989059][T18554] ? __fget_files+0x2a/0x420 [ 636.989110][T18554] ? ksys_write+0x242/0x270 [ 636.989148][T18554] ? __pfx_ksys_write+0x10/0x10 [ 636.989190][T18554] __x64_sys_bpf+0xba/0xd0 [ 636.989217][T18554] do_syscall_64+0x166/0x520 [ 636.989242][T18554] ? trace_irq_disable+0x3b/0x140 [ 636.989266][T18554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.989290][T18554] ? clear_bhb_loop+0x70/0xc0 [ 636.989320][T18554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.989344][T18554] RIP: 0033:0x7f2a3c39e159 [ 636.989366][T18554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.989387][T18554] RSP: 002b:00007f2a3d216028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 636.989413][T18554] RAX: ffffffffffffffda RBX: 00007f2a3c625fa0 RCX: 00007f2a3c39e159 [ 636.989430][T18554] RDX: 0000000000000038 RSI: 0000200000001880 RDI: 000000000000001a [ 636.989445][T18554] RBP: 00007f2a3d216090 R08: 0000000000000000 R09: 0000000000000000 [ 636.989461][T18554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 636.989475][T18554] R13: 00007f2a3c626038 R14: 00007f2a3c625fa0 R15: 00007fff4e6b3128 [ 636.989512][T18554] [ 637.549095][T18568] FAULT_INJECTION: forcing a failure. [ 637.549095][T18568] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 637.549132][T18568] CPU: 1 UID: 0 PID: 18568 Comm: syz.1.3475 Not tainted syzkaller #0 PREEMPT(full) [ 637.549158][T18568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 637.549173][T18568] Call Trace: [ 637.549182][T18568] [ 637.549192][T18568] dump_stack_lvl+0xe8/0x150 [ 637.549230][T18568] should_fail_ex+0x410/0x560 [ 637.549262][T18568] _copy_to_user+0x31/0xb0 [ 637.549296][T18568] simple_read_from_buffer+0xe1/0x170 [ 637.549335][T18568] proc_fail_nth_read+0x1bb/0x230 [ 637.549370][T18568] ? common_file_perm+0x20e/0x2b0 [ 637.549401][T18568] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 637.549442][T18568] ? rw_verify_area+0x24a/0x4c0 [ 637.549478][T18568] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 637.549514][T18568] vfs_read+0x213/0xa80 [ 637.549555][T18568] ? __pfx___mutex_lock+0x10/0x10 [ 637.549583][T18568] ? __pfx_vfs_read+0x10/0x10 [ 637.549619][T18568] ? __fget_files+0x2a/0x420 [ 637.549656][T18568] ? __fget_files+0x3a2/0x420 [ 637.549687][T18568] ? __fget_files+0x2a/0x420 [ 637.549730][T18568] ksys_read+0x150/0x270 [ 637.549767][T18568] ? __pfx_ksys_read+0x10/0x10 [ 637.549824][T18568] do_syscall_64+0x166/0x520 [ 637.549849][T18568] ? trace_irq_disable+0x3b/0x140 [ 637.549873][T18568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.549898][T18568] ? clear_bhb_loop+0x70/0xc0 [ 637.549928][T18568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.549952][T18568] RIP: 0033:0x7fd46195e98e [ 637.549974][T18568] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 637.549999][T18568] RSP: 002b:00007fd462949fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 637.550024][T18568] RAX: ffffffffffffffda RBX: 00007fd46294a6c0 RCX: 00007fd46195e98e [ 637.550042][T18568] RDX: 000000000000000f RSI: 00007fd46294a0a0 RDI: 0000000000000004 [ 637.550057][T18568] RBP: 00007fd46294a090 R08: 0000000000000000 R09: 0000000000000000 [ 637.550073][T18568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 637.550088][T18568] R13: 00007fd461c26038 R14: 00007fd461c25fa0 R15: 00007fff446dbbb8 [ 637.550125][T18568] [ 638.030641][T18581] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3477'. [ 638.192328][T18588] openvswitch: netlink: Message has 8 unknown bytes. [ 638.293629][T18593] FAULT_INJECTION: forcing a failure. [ 638.293629][T18593] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 638.293666][T18593] CPU: 0 UID: 0 PID: 18593 Comm: syz.3.3480 Not tainted syzkaller #0 PREEMPT(full) [ 638.293693][T18593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 638.293708][T18593] Call Trace: [ 638.293717][T18593] [ 638.293727][T18593] dump_stack_lvl+0xe8/0x150 [ 638.293765][T18593] should_fail_ex+0x410/0x560 [ 638.293797][T18593] _copy_from_user+0x2d/0xb0 [ 638.293829][T18593] generic_map_update_batch+0x668/0xae0 [ 638.293879][T18593] ? __pfx_generic_map_update_batch+0x10/0x10 [ 638.293916][T18593] ? __fget_files+0x2a/0x420 [ 638.293956][T18593] ? __pfx_generic_map_update_batch+0x10/0x10 [ 638.293991][T18593] bpf_map_do_batch+0x391/0x630 [ 638.294026][T18593] __sys_bpf+0xbe5/0xd90 [ 638.294062][T18593] ? __pfx___sys_bpf+0x10/0x10 [ 638.294102][T18593] ? __fget_files+0x2a/0x420 [ 638.294158][T18593] ? ksys_write+0x242/0x270 [ 638.294196][T18593] ? __pfx_ksys_write+0x10/0x10 [ 638.294245][T18593] __x64_sys_bpf+0xba/0xd0 [ 638.294273][T18593] do_syscall_64+0x166/0x520 [ 638.294299][T18593] ? trace_irq_disable+0x3b/0x140 [ 638.294322][T18593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.294347][T18593] ? clear_bhb_loop+0x70/0xc0 [ 638.294376][T18593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.294400][T18593] RIP: 0033:0x7f2a3c39e159 [ 638.294422][T18593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 638.294442][T18593] RSP: 002b:00007f2a3d1f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 638.294468][T18593] RAX: ffffffffffffffda RBX: 00007f2a3c626090 RCX: 00007f2a3c39e159 [ 638.294486][T18593] RDX: 0000000000000038 RSI: 0000200000000500 RDI: 000000000000001a [ 638.294502][T18593] RBP: 00007f2a3d1f5090 R08: 0000000000000000 R09: 0000000000000000 [ 638.294518][T18593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 638.294533][T18593] R13: 00007f2a3c626128 R14: 00007f2a3c626090 R15: 00007fff4e6b3128 [ 638.294570][T18593] [ 638.391750][T18592] ip_tables: iptables: counters copy to user failed while replacing table [ 638.920429][T18585] vlan0: left promiscuous mode [ 638.931194][T18585] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 638.968294][T18600] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3482'. [ 639.628573][T18623] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3489'. [ 639.628671][T18623] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3489'. [ 639.628705][T18623] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3489'. [ 639.691471][T18622] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3484'. [ 639.756221][T18626] FAULT_INJECTION: forcing a failure. [ 639.756221][T18626] name failslab, interval 1, probability 0, space 0, times 0 [ 639.756259][T18626] CPU: 0 UID: 0 PID: 18626 Comm: syz.0.3491 Not tainted syzkaller #0 PREEMPT(full) [ 639.756287][T18626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 639.756301][T18626] Call Trace: [ 639.756311][T18626] [ 639.756322][T18626] dump_stack_lvl+0xe8/0x150 [ 639.756362][T18626] should_fail_ex+0x410/0x560 [ 639.756395][T18626] should_failslab+0xa8/0x100 [ 639.756427][T18626] __kmalloc_noprof+0xfe/0x720 [ 639.756450][T18626] ? kasan_save_track+0x4f/0x80 [ 639.756473][T18626] ? dev_prep_valid_name+0x1bc/0x640 [ 639.756494][T18626] ? dev_prep_valid_name+0x1bc/0x640 [ 639.756532][T18626] dev_prep_valid_name+0x1bc/0x640 [ 639.756554][T18626] ? __x64_sys_sendmsg+0x1b1/0x290 [ 639.756584][T18626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.756614][T18626] ? __pfx_dev_prep_valid_name+0x10/0x10 [ 639.756665][T18626] ? __raw_spin_lock_init+0x45/0x100 [ 639.756701][T18626] register_netdevice+0x530/0x1eb0 [ 639.756747][T18626] ? lock_acquire+0x115/0x350 [ 639.756774][T18626] ? __pfx_register_netdevice+0x10/0x10 [ 639.756811][T18626] ? net_generic+0x1e/0x240 [ 639.756843][T18626] ? net_generic+0x1e/0x240 [ 639.756881][T18626] xfrmi_newlink+0x49d/0x7c0 [ 639.756909][T18626] ? validate_linkmsg+0x765/0x950 [ 639.756948][T18626] ? __pfx_xfrmi_newlink+0x10/0x10 [ 639.756981][T18626] ? rtnl_create_link+0xa04/0xd70 [ 639.757018][T18626] ? __pfx_xfrmi_newlink+0x10/0x10 [ 639.757050][T18626] rtnl_newlink_create+0x305/0x7b0 [ 639.757089][T18626] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 639.757124][T18626] ? __pfx___mutex_lock+0x10/0x10 [ 639.757162][T18626] ? ns_capable+0x89/0xe0 [ 639.757199][T18626] rtnl_newlink+0x166d/0x1c30 [ 639.757244][T18626] ? __pfx_rtnl_newlink+0x10/0x10 [ 639.757269][T18626] ? do_syscall_64+0x166/0x520 [ 639.757294][T18626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.757360][T18626] ? kasan_quarantine_put+0xbb/0x1f0 [ 639.757384][T18626] ? lockdep_hardirqs_on+0x7b/0x110 [ 639.757414][T18626] ? nlmon_xmit+0xb0/0x100 [ 639.757439][T18626] ? kmem_cache_free+0x182/0x650 [ 639.757476][T18626] ? __lock_acquire+0x747/0x2de0 [ 639.757519][T18626] ? __local_bh_enable_ip+0xd6/0x140 [ 639.757551][T18626] ? lockdep_hardirqs_on+0x7b/0x110 [ 639.757575][T18626] ? __dev_queue_xmit+0x29b/0x3820 [ 639.757606][T18626] ? __local_bh_enable_ip+0xd6/0x140 [ 639.757634][T18626] ? __dev_queue_xmit+0x29b/0x3820 [ 639.757676][T18626] ? lock_acquire+0x115/0x350 [ 639.757718][T18626] ? __pfx_rtnl_newlink+0x10/0x10 [ 639.757744][T18626] rtnetlink_rcv_msg+0x802/0xc00 [ 639.757775][T18626] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 639.757802][T18626] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 639.757827][T18626] ? ref_tracker_free+0x689/0x830 [ 639.757859][T18626] ? __pfx_ref_tracker_free+0x10/0x10 [ 639.757897][T18626] netlink_rcv_skb+0x226/0x4a0 [ 639.757933][T18626] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 639.757963][T18626] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 639.758011][T18626] ? netlink_deliver_tap+0x2e/0x1b0 [ 639.758045][T18626] ? netlink_deliver_tap+0x2e/0x1b0 [ 639.758084][T18626] netlink_unicast+0x7bd/0x940 [ 639.758127][T18626] netlink_sendmsg+0x813/0xb40 [ 639.758172][T18626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 639.758216][T18626] ? apparmor_socket_sendmsg+0x98/0x360 [ 639.758244][T18626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 639.758277][T18626] sock_sendmsg_nosec+0x13a/0x180 [ 639.758317][T18626] ____sys_sendmsg+0x54e/0x850 [ 639.758354][T18626] ? __pfx_____sys_sendmsg+0x10/0x10 [ 639.758395][T18626] ? import_iovec+0x73/0xa0 [ 639.758428][T18626] ___sys_sendmsg+0x2a5/0x360 [ 639.758457][T18626] ? __lock_acquire+0x747/0x2de0 [ 639.758485][T18626] ? __pfx____sys_sendmsg+0x10/0x10 [ 639.758564][T18626] ? __fget_files+0x2a/0x420 [ 639.758595][T18626] ? __fget_files+0x3a2/0x420 [ 639.758639][T18626] __x64_sys_sendmsg+0x1b1/0x290 [ 639.758674][T18626] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 639.758729][T18626] do_syscall_64+0x166/0x520 [ 639.758753][T18626] ? trace_irq_disable+0x3b/0x140 [ 639.758776][T18626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.758800][T18626] ? clear_bhb_loop+0x70/0xc0 [ 639.758829][T18626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.758853][T18626] RIP: 0033:0x7f10f939e159 [ 639.758875][T18626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 639.758894][T18626] RSP: 002b:00007f10fa2fe028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 639.758920][T18626] RAX: ffffffffffffffda RBX: 00007f10f9625fa0 RCX: 00007f10f939e159 [ 639.758937][T18626] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 639.758953][T18626] RBP: 00007f10fa2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 639.758968][T18626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 639.758982][T18626] R13: 00007f10f9626038 R14: 00007f10f9625fa0 R15: 00007ffed6e87548 [ 639.759021][T18626] [ 640.556012][T18637] netlink: 136 bytes leftover after parsing attributes in process `syz.0.3494'. [ 640.850824][ T13] IPVS: starting estimator thread 0... [ 640.945417][T18648] IPVS: using max 29 ests per chain, 69600 per kthread [ 641.064683][T18656] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3501'. [ 641.158458][T18661] ip_tables: iptables: counters copy to user failed while replacing table [ 641.530282][T18672] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3507'. [ 644.394535][T18700] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3517'. [ 644.394563][T18700] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3517'. [ 644.474013][T18704] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3518'. [ 645.591606][T18744] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3535'. [ 645.702362][T18748] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3535'. [ 646.007529][T18755] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3538'. [ 646.695554][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 646.740426][T18778] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3545'. [ 646.968900][T18765] netlink: 596 bytes leftover after parsing attributes in process `syz.2.3542'. [ 647.043103][T18786] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3547'. [ 647.204069][T18769] lo speed is unknown, defaulting to 1000 [ 647.310238][T18798] xt_hashlimit: size too large, truncated to 1048576 [ 647.375121][T18800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3551'. [ 647.499344][T18795] syzkaller0: entered promiscuous mode [ 647.499376][T18795] syzkaller0: entered allmulticast mode [ 648.284185][T18831] tc_dump_action: action bad kind [ 648.931707][T18856] ip_tables: iptables: counters copy to user failed while replacing table [ 649.116353][T18863] FAULT_INJECTION: forcing a failure. [ 649.116353][T18863] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 649.116394][T18863] CPU: 0 UID: 0 PID: 18863 Comm: syz.1.3570 Not tainted syzkaller #0 PREEMPT(full) [ 649.116435][T18863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 649.116452][T18863] Call Trace: [ 649.116462][T18863] [ 649.116473][T18863] dump_stack_lvl+0xe8/0x150 [ 649.116514][T18863] should_fail_ex+0x410/0x560 [ 649.116547][T18863] _copy_from_iter+0x1d3/0x1660 [ 649.116573][T18863] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 649.116618][T18863] ? __pfx_policy_nodemask+0x10/0x10 [ 649.116646][T18863] ? trace_kmalloc+0x2a/0xf0 [ 649.116686][T18863] ? __pfx__copy_from_iter+0x10/0x10 [ 649.116709][T18863] ? __kmalloc_noprof+0x38c/0x720 [ 649.116735][T18863] ? alloc_pages_mpol+0x256/0x390 [ 649.116781][T18863] af_alg_sendmsg+0x14c3/0x2250 [ 649.116840][T18863] ? __pfx_af_alg_sendmsg+0x10/0x10 [ 649.116878][T18863] ? aa_sock_msg_perm+0x144/0x210 [ 649.116913][T18863] ? apparmor_socket_sendmsg+0x98/0x360 [ 649.116937][T18863] ? skcipher_sendmsg+0x26/0xf0 [ 649.116962][T18863] ? __pfx_skcipher_sendmsg+0x10/0x10 [ 649.116985][T18863] sock_sendmsg_nosec+0x13a/0x180 [ 649.117025][T18863] ____sys_sendmsg+0x54e/0x850 [ 649.117062][T18863] ? __pfx_____sys_sendmsg+0x10/0x10 [ 649.117104][T18863] ? import_iovec+0x73/0xa0 [ 649.117137][T18863] ___sys_sendmsg+0x2a5/0x360 [ 649.117166][T18863] ? __lock_acquire+0x747/0x2de0 [ 649.117196][T18863] ? __pfx____sys_sendmsg+0x10/0x10 [ 649.117233][T18863] ? kstrtouint+0x6e/0xe0 [ 649.117298][T18863] ? __fget_files+0x2a/0x420 [ 649.117330][T18863] ? __fget_files+0x3a2/0x420 [ 649.117373][T18863] __sys_sendmmsg+0x273/0x4d0 [ 649.117410][T18863] ? __pfx___sys_sendmmsg+0x10/0x10 [ 649.117452][T18863] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 649.117496][T18863] ? ksys_write+0x242/0x270 [ 649.117533][T18863] ? __pfx_ksys_write+0x10/0x10 [ 649.117583][T18863] __x64_sys_sendmmsg+0xa0/0xc0 [ 649.117618][T18863] do_syscall_64+0x166/0x520 [ 649.117643][T18863] ? trace_irq_disable+0x3b/0x140 [ 649.117666][T18863] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.117691][T18863] ? clear_bhb_loop+0x70/0xc0 [ 649.117720][T18863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.117743][T18863] RIP: 0033:0x7fd46199e159 [ 649.117765][T18863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 649.117787][T18863] RSP: 002b:00007fd46294a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 649.117813][T18863] RAX: ffffffffffffffda RBX: 00007fd461c25fa0 RCX: 00007fd46199e159 [ 649.117831][T18863] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000004 [ 649.117846][T18863] RBP: 00007fd46294a090 R08: 0000000000000000 R09: 0000000000000000 [ 649.117861][T18863] R10: 0000000000040800 R11: 0000000000000246 R12: 0000000000000001 [ 649.117876][T18863] R13: 00007fd461c26038 R14: 00007fd461c25fa0 R15: 00007fff446dbbb8 [ 649.117912][T18863] [ 649.900316][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 650.003405][T18891] __nla_validate_parse: 3 callbacks suppressed [ 650.003428][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.066764][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.139574][ T44] hid-generic 0005:0B57:05DF.0001: item fetching failed at offset 0/1 [ 650.170712][ T44] hid-generic 0005:0B57:05DF.0001: probe with driver hid-generic failed with error -22 [ 650.317021][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.317278][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.317519][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.317740][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.317960][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.318183][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.320153][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 650.320398][T18891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3576'. [ 651.211959][T18917] batman_adv: batadv0: Adding interface: syzkaller0 [ 651.211980][T18917] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 651.212015][T18917] batman_adv: batadv0: Interface activated: syzkaller0 [ 651.537431][T18916] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 654.080043][T18916] batman_adv: batadv0: Removing interface: syzkaller0 [ 654.096191][T18930] kthread_run failed with err -4 [ 654.288881][T18971] FAULT_INJECTION: forcing a failure. [ 654.288881][T18971] name failslab, interval 1, probability 0, space 0, times 0 [ 654.288921][T18971] CPU: 0 UID: 0 PID: 18971 Comm: syz.2.3595 Not tainted syzkaller #0 PREEMPT(full) [ 654.288947][T18971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 654.288962][T18971] Call Trace: [ 654.288971][T18971] [ 654.288982][T18971] dump_stack_lvl+0xe8/0x150 [ 654.289023][T18971] should_fail_ex+0x410/0x560 [ 654.289054][T18971] should_failslab+0xa8/0x100 [ 654.289085][T18971] __kmalloc_cache_noprof+0xa3/0x600 [ 654.289108][T18971] ? copy_array+0xab/0x100 [ 654.289142][T18971] ? bpf_copy_verifier_state+0xb1f/0x1170 [ 654.289177][T18971] ? bpf_copy_verifier_state+0xb1f/0x1170 [ 654.289220][T18971] bpf_copy_verifier_state+0xb1f/0x1170 [ 654.289267][T18971] bpf_is_state_visited+0x377d/0x47d0 [ 654.289308][T18971] ? kasan_populate_vmalloc_pte+0x150/0x180 [ 654.289342][T18971] ? do_check_common+0x3eea/0x5d30 [ 654.289378][T18971] do_check_common+0x2848/0x5d30 [ 654.289448][T18971] ? __pfx_do_check_common+0x10/0x10 [ 654.289492][T18971] bpf_check+0x2639/0x2e10 [ 654.289537][T18971] ? ktime_get_with_offset+0x93/0x2d0 [ 654.289567][T18971] ? __pfx_bpf_check+0x10/0x10 [ 654.289596][T18971] ? bpf_obj_name_cpy+0x194/0x1e0 [ 654.289634][T18971] bpf_prog_load+0x14d6/0x1c20 [ 654.289674][T18971] ? __pfx_bpf_prog_load+0x10/0x10 [ 654.289727][T18971] __sys_bpf+0xd0d/0xd90 [ 654.289762][T18971] ? __pfx___sys_bpf+0x10/0x10 [ 654.289795][T18971] ? __fget_files+0x2a/0x420 [ 654.289835][T18971] ? ksys_write+0x242/0x270 [ 654.289864][T18971] ? __pfx_ksys_write+0x10/0x10 [ 654.289896][T18971] __x64_sys_bpf+0xba/0xd0 [ 654.289917][T18971] do_syscall_64+0x166/0x520 [ 654.289937][T18971] ? trace_irq_disable+0x3b/0x140 [ 654.289955][T18971] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.289974][T18971] ? clear_bhb_loop+0x70/0xc0 [ 654.289996][T18971] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.290016][T18971] RIP: 0033:0x7fceabd9e159 [ 654.290034][T18971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.290050][T18971] RSP: 002b:00007fceacc05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 654.290071][T18971] RAX: ffffffffffffffda RBX: 00007fceac025fa0 RCX: 00007fceabd9e159 [ 654.290085][T18971] RDX: 0000000000000048 RSI: 0000200000000080 RDI: 0000000000000005 [ 654.290097][T18971] RBP: 00007fceacc05090 R08: 0000000000000000 R09: 0000000000000000 [ 654.290109][T18971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 654.290120][T18971] R13: 00007fceac026038 R14: 00007fceac025fa0 R15: 00007ffd4b522098 [ 654.290148][T18971] [ 654.468827][T18974] ip_tables: iptables: counters copy to user failed while replacing table [ 654.724763][T18978] nbd: must specify a size in bytes for the device [ 654.748724][T18983] netlink: 'syz.0.3600': attribute type 10 has an invalid length. [ 654.778485][T18983] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 654.782298][T18983] team0: Port device netdevsim1 added [ 654.804533][T18983] netlink: 'syz.0.3600': attribute type 10 has an invalid length. [ 654.856928][T18983] team0: Port device netdevsim1 removed [ 654.864580][T18983] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 654.889133][T18983] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 655.041126][T18991] __nla_validate_parse: 9 callbacks suppressed [ 655.041150][T18991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3604'. [ 655.041174][T18991] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3604'. [ 655.240978][T18999] FAULT_INJECTION: forcing a failure. [ 655.240978][T18999] name failslab, interval 1, probability 0, space 0, times 0 [ 655.241016][T18999] CPU: 1 UID: 0 PID: 18999 Comm: syz.0.3610 Not tainted syzkaller #0 PREEMPT(full) [ 655.241043][T18999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 655.241064][T18999] Call Trace: [ 655.241073][T18999] [ 655.241083][T18999] dump_stack_lvl+0xe8/0x150 [ 655.241124][T18999] should_fail_ex+0x410/0x560 [ 655.241156][T18999] should_failslab+0xa8/0x100 [ 655.241187][T18999] __kmalloc_cache_noprof+0xa3/0x600 [ 655.241213][T18999] ? do_check_common+0x20e/0x5d30 [ 655.241242][T18999] ? do_check_common+0x20e/0x5d30 [ 655.241278][T18999] do_check_common+0x20e/0x5d30 [ 655.241309][T18999] ? kasan_quarantine_put+0xbb/0x1f0 [ 655.241334][T18999] ? lockdep_hardirqs_on+0x7b/0x110 [ 655.241364][T18999] ? kfree+0x1c5/0x650 [ 655.241395][T18999] ? bpf_compute_live_registers+0x1f40/0x1ff0 [ 655.241436][T18999] ? mark_fastcall_patterns+0xf32/0xf90 [ 655.241474][T18999] ? __pfx_do_check_common+0x10/0x10 [ 655.241519][T18999] bpf_check+0x2639/0x2e10 [ 655.241557][T18999] ? ktime_get_with_offset+0x93/0x2d0 [ 655.241588][T18999] ? __pfx_bpf_check+0x10/0x10 [ 655.241616][T18999] ? bpf_obj_name_cpy+0x194/0x1e0 [ 655.241654][T18999] bpf_prog_load+0x14d6/0x1c20 [ 655.241693][T18999] ? __pfx_bpf_prog_load+0x10/0x10 [ 655.241754][T18999] __sys_bpf+0xd0d/0xd90 [ 655.241789][T18999] ? __pfx___sys_bpf+0x10/0x10 [ 655.241827][T18999] ? __fget_files+0x2a/0x420 [ 655.241885][T18999] ? ksys_write+0x242/0x270 [ 655.241922][T18999] ? __pfx_ksys_write+0x10/0x10 [ 655.241962][T18999] __x64_sys_bpf+0xba/0xd0 [ 655.241988][T18999] do_syscall_64+0x166/0x520 [ 655.242012][T18999] ? trace_irq_disable+0x3b/0x140 [ 655.242035][T18999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.242059][T18999] ? clear_bhb_loop+0x70/0xc0 [ 655.242088][T18999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.242111][T18999] RIP: 0033:0x7f10f939e159 [ 655.242132][T18999] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 655.242153][T18999] RSP: 002b:00007f10fa2fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 655.242179][T18999] RAX: ffffffffffffffda RBX: 00007f10f9625fa0 RCX: 00007f10f939e159 [ 655.242197][T18999] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005 [ 655.242212][T18999] RBP: 00007f10fa2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 655.242227][T18999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 655.242242][T18999] R13: 00007f10f9626038 R14: 00007f10f9625fa0 R15: 00007ffed6e87548 [ 655.242278][T18999] [ 655.715030][T19010] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3612'. [ 655.742282][T19010] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3612'. [ 655.944871][T19017] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3614'. [ 656.139454][T19034] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3618'. [ 656.211106][T19034] erspan0: left promiscuous mode [ 656.266961][T19027] openvswitch: netlink: Message has 8 unknown bytes. [ 656.380019][T19034] gretap1: left promiscuous mode [ 656.436660][ T5749] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 656.547842][T19052] ip_tables: iptables: counters copy to user failed while replacing table [ 657.095441][ T5630] Bluetooth: hci3: command 0x0406 tx timeout [ 657.255928][ T5749] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 660.417215][T19108] bond0: (slave macvlan2): Error -98 calling set_mac_address [ 660.424394][T19101] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3643'. [ 661.125156][T19119] lo speed is unknown, defaulting to 1000 [ 661.152060][T19128] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3650'. [ 661.368516][T19131] tc_dump_action: action bad kind [ 661.601879][T19142] ip_tables: iptables: counters copy to user failed while replacing table [ 661.829671][T19153] bond3: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 661.862242][T19153] bond3 (unregistering): Released all slaves [ 661.940607][T19157] macsec1: entered promiscuous mode [ 661.940635][T19157] macsec1: entered allmulticast mode [ 662.183064][T19168] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3657'. [ 662.233955][T19169] FAULT_INJECTION: forcing a failure. [ 662.233955][T19169] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 662.233994][T19169] CPU: 0 UID: 0 PID: 19169 Comm: syz.4.3658 Not tainted syzkaller #0 PREEMPT(full) [ 662.234021][T19169] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 662.234036][T19169] Call Trace: [ 662.234046][T19169] [ 662.234057][T19169] dump_stack_lvl+0xe8/0x150 [ 662.234097][T19169] should_fail_ex+0x410/0x560 [ 662.234130][T19169] _copy_to_user+0x31/0xb0 [ 662.234162][T19169] bpf_test_finish+0x1cf/0x690 [ 662.234209][T19169] ? __pfx_bpf_test_finish+0x10/0x10 [ 662.234254][T19169] ? _copy_from_user+0x94/0xb0 [ 662.234284][T19169] ? bpf_test_init+0x113/0x150 [ 662.234319][T19169] bpf_prog_test_run_xdp+0x8bc/0x11d0 [ 662.234374][T19169] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 662.234415][T19169] ? __fget_files+0x2a/0x420 [ 662.234455][T19169] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 662.234492][T19169] bpf_prog_test_run+0x2c5/0x340 [ 662.234526][T19169] __sys_bpf+0xa22/0xd90 [ 662.234562][T19169] ? __pfx___sys_bpf+0x10/0x10 [ 662.234602][T19169] ? __fget_files+0x2a/0x420 [ 662.234654][T19169] ? ksys_write+0x242/0x270 [ 662.234693][T19169] ? __pfx_ksys_write+0x10/0x10 [ 662.234735][T19169] __x64_sys_bpf+0xba/0xd0 [ 662.234763][T19169] do_syscall_64+0x166/0x520 [ 662.234789][T19169] ? trace_irq_disable+0x3b/0x140 [ 662.234813][T19169] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.234846][T19169] ? clear_bhb_loop+0x70/0xc0 [ 662.234876][T19169] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.234901][T19169] RIP: 0033:0x7ff52ed9e159 [ 662.234923][T19169] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 662.234943][T19169] RSP: 002b:00007ff52fd4c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 662.234969][T19169] RAX: ffffffffffffffda RBX: 00007ff52f025fa0 RCX: 00007ff52ed9e159 [ 662.234987][T19169] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 662.235004][T19169] RBP: 00007ff52fd4c090 R08: 0000000000000000 R09: 0000000000000000 [ 662.235019][T19169] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 662.235034][T19169] R13: 00007ff52f026038 R14: 00007ff52f025fa0 R15: 00007fff5b477228 [ 662.235071][T19169] [ 663.043411][T19189] netlink: 264 bytes leftover after parsing attributes in process `syz.4.3665'. [ 663.250486][T19195] FAULT_INJECTION: forcing a failure. [ 663.250486][T19195] name failslab, interval 1, probability 0, space 0, times 0 [ 663.250529][T19195] CPU: 0 UID: 0 PID: 19195 Comm: syz.2.3668 Not tainted syzkaller #0 PREEMPT(full) [ 663.250556][T19195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 663.250572][T19195] Call Trace: [ 663.250582][T19195] [ 663.250591][T19195] dump_stack_lvl+0xe8/0x150 [ 663.250630][T19195] should_fail_ex+0x410/0x560 [ 663.250661][T19195] should_failslab+0xa8/0x100 [ 663.250691][T19195] __kvmalloc_node_noprof+0x176/0x820 [ 663.250721][T19195] ? record_stack_access+0x8ac/0x1110 [ 663.250748][T19195] ? record_stack_access+0x8ac/0x1110 [ 663.250782][T19195] record_stack_access+0x8ac/0x1110 [ 663.250823][T19195] ? __pfx_record_stack_access+0x10/0x10 [ 663.250863][T19195] analyze_subprog+0x479b/0x9e00 [ 663.250889][T19195] ? probe_event_enable+0x6df/0xae0 [ 663.250965][T19195] ? __pfx_analyze_subprog+0x10/0x10 [ 663.250992][T19195] ? __x64_sys_bpf+0xba/0xd0 [ 663.251013][T19195] ? rsc_put+0x1b2/0x1d0 [ 663.251040][T19195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 663.251104][T19195] ? call_instance+0x263/0x560 [ 663.251139][T19195] ? rcu_is_watching+0x16/0xb0 [ 663.251167][T19195] ? call_instance+0x263/0x560 [ 663.251190][T19195] ? trace_kmalloc+0x2a/0xf0 [ 663.251227][T19195] ? call_instance+0x263/0x560 [ 663.251252][T19195] ? __kvmalloc_node_noprof+0x52f/0x820 [ 663.251279][T19195] ? __kvmalloc_node_noprof+0x345/0x820 [ 663.251304][T19195] ? call_instance+0x263/0x560 [ 663.251328][T19195] ? call_instance+0x263/0x560 [ 663.251371][T19195] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 663.251400][T19195] ? bpf_base_func_proto+0xaa/0xb00 [ 663.251430][T19195] ? __pfx_sk_filter_func_proto+0x10/0x10 [ 663.251483][T19195] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 663.251515][T19195] ? __kvmalloc_node_noprof+0x345/0x820 [ 663.251539][T19195] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 663.251565][T19195] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 663.251600][T19195] bpf_compute_live_registers+0x8d3/0x1ff0 [ 663.251648][T19195] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 663.251687][T19195] bpf_check+0x25ed/0x2e10 [ 663.251725][T19195] ? ktime_get_with_offset+0x93/0x2d0 [ 663.251752][T19195] ? __pfx_bpf_check+0x10/0x10 [ 663.251780][T19195] ? bpf_obj_name_cpy+0x194/0x1e0 [ 663.251816][T19195] bpf_prog_load+0x14d6/0x1c20 [ 663.251856][T19195] ? __pfx_bpf_prog_load+0x10/0x10 [ 663.251909][T19195] __sys_bpf+0xd0d/0xd90 [ 663.251945][T19195] ? __pfx___sys_bpf+0x10/0x10 [ 663.251983][T19195] ? __fget_files+0x2a/0x420 [ 663.252034][T19195] ? ksys_write+0x242/0x270 [ 663.252071][T19195] ? __pfx_ksys_write+0x10/0x10 [ 663.252112][T19195] __x64_sys_bpf+0xba/0xd0 [ 663.252148][T19195] do_syscall_64+0x166/0x520 [ 663.252173][T19195] ? trace_irq_disable+0x3b/0x140 [ 663.252197][T19195] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 663.252221][T19195] ? clear_bhb_loop+0x70/0xc0 [ 663.252249][T19195] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 663.252272][T19195] RIP: 0033:0x7fceabd9e159 [ 663.252293][T19195] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 663.252313][T19195] RSP: 002b:00007fceacc05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 663.252339][T19195] RAX: ffffffffffffffda RBX: 00007fceac025fa0 RCX: 00007fceabd9e159 [ 663.252356][T19195] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005 [ 663.252372][T19195] RBP: 00007fceacc05090 R08: 0000000000000000 R09: 0000000000000000 [ 663.252388][T19195] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 663.252402][T19195] R13: 00007fceac026038 R14: 00007fceac025fa0 R15: 00007ffd4b522098 [ 663.252436][T19195] [ 663.806145][T19212] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3671'. [ 663.826792][T19208] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3669'. [ 663.840559][T19208] netlink: 'syz.3.3669': attribute type 1 has an invalid length. [ 663.840639][T19208] netlink: 'syz.3.3669': attribute type 1 has an invalid length. [ 665.311324][T19249] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3681'. [ 665.428979][T19257] syzkaller0: entered promiscuous mode [ 665.429007][T19257] syzkaller0: entered allmulticast mode [ 665.442588][T19256] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3682'. [ 665.458780][T19256] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3682'. [ 665.804590][T19266] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3688'. [ 665.804755][T19266] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3688'. [ 665.804784][T19266] netlink: 'syz.1.3688': attribute type 1 has an invalid length. [ 665.839229][T19266] Bluetooth: hci0: invalid length 0, exp 2 for type 5 [ 666.056346][T19280] ip_tables: iptables: counters copy to user failed while replacing table [ 666.442627][T19299] FAULT_INJECTION: forcing a failure. [ 666.442627][T19299] name failslab, interval 1, probability 0, space 0, times 0 [ 666.442666][T19299] CPU: 1 UID: 0 PID: 19299 Comm: syz.0.3698 Not tainted syzkaller #0 PREEMPT(full) [ 666.442693][T19299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 666.442708][T19299] Call Trace: [ 666.442717][T19299] [ 666.442727][T19299] dump_stack_lvl+0xe8/0x150 [ 666.442766][T19299] should_fail_ex+0x410/0x560 [ 666.442798][T19299] should_failslab+0xa8/0x100 [ 666.442829][T19299] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 666.442856][T19299] ? bpf_push_jmp_history+0x26c/0x6d0 [ 666.442884][T19299] ? bpf_push_jmp_history+0x26c/0x6d0 [ 666.442912][T19299] ? bpf_push_jmp_history+0x26c/0x6d0 [ 666.442937][T19299] krealloc_node_align_noprof+0x19a/0x390 [ 666.442962][T19299] ? bpf_diag_record_branch+0x58/0x90 [ 666.443000][T19299] bpf_push_jmp_history+0x26c/0x6d0 [ 666.443035][T19299] do_check_common+0x2a0a/0x5d30 [ 666.443106][T19299] ? __pfx_do_check_common+0x10/0x10 [ 666.443150][T19299] bpf_check+0x2639/0x2e10 [ 666.443188][T19299] ? ktime_get_with_offset+0x93/0x2d0 [ 666.443226][T19299] ? __pfx_bpf_check+0x10/0x10 [ 666.443255][T19299] ? bpf_obj_name_cpy+0x194/0x1e0 [ 666.443293][T19299] bpf_prog_load+0x14d6/0x1c20 [ 666.443334][T19299] ? __pfx_bpf_prog_load+0x10/0x10 [ 666.443389][T19299] __sys_bpf+0xd0d/0xd90 [ 666.443424][T19299] ? __pfx___sys_bpf+0x10/0x10 [ 666.443463][T19299] ? __fget_files+0x2a/0x420 [ 666.443513][T19299] ? ksys_write+0x242/0x270 [ 666.443551][T19299] ? __pfx_ksys_write+0x10/0x10 [ 666.443590][T19299] __x64_sys_bpf+0xba/0xd0 [ 666.443616][T19299] do_syscall_64+0x166/0x520 [ 666.443641][T19299] ? trace_irq_disable+0x3b/0x140 [ 666.443664][T19299] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.443689][T19299] ? clear_bhb_loop+0x70/0xc0 [ 666.443717][T19299] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.443741][T19299] RIP: 0033:0x7f10f939e159 [ 666.443763][T19299] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 666.443782][T19299] RSP: 002b:00007f10fa2fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 666.443808][T19299] RAX: ffffffffffffffda RBX: 00007f10f9625fa0 RCX: 00007f10f939e159 [ 666.443827][T19299] RDX: 0000000000000094 RSI: 0000200000000840 RDI: 0000000000000005 [ 666.443842][T19299] RBP: 00007f10fa2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 666.443857][T19299] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 666.443872][T19299] R13: 00007f10f9626038 R14: 00007f10f9625fa0 R15: 00007ffed6e87548 [ 666.443908][T19299] [ 666.761803][T19302] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3700'. [ 666.876881][T19310] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3702'. [ 666.901835][T19310] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3702'. [ 668.192916][T19349] ip_tables: iptables: counters copy to user failed while replacing table [ 668.459535][T19357] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3722'. [ 669.666167][T19397] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3732'. [ 669.840507][T19407] syzkaller0: entered promiscuous mode [ 669.840533][T19407] syzkaller0: entered allmulticast mode [ 669.851510][T19407] tipc: Enabled bearer , priority 0 [ 669.857080][T19407] syzkaller0: mtu less than device minimum [ 669.874452][T19405] tipc: Resetting bearer [ 669.946996][T19405] tipc: Disabling bearer [ 670.098402][T19421] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3744'. [ 670.460977][T19441] xt_SECMARK: invalid mode: 9 [ 670.760637][T19455] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3749'. [ 670.878179][T19462] FAULT_INJECTION: forcing a failure. [ 670.878179][T19462] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 670.878217][T19462] CPU: 1 UID: 0 PID: 19462 Comm: syz.1.3753 Not tainted syzkaller #0 PREEMPT(full) [ 670.878248][T19462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 670.878263][T19462] Call Trace: [ 670.878281][T19462] [ 670.878292][T19462] dump_stack_lvl+0xe8/0x150 [ 670.878332][T19462] should_fail_ex+0x410/0x560 [ 670.878364][T19462] _copy_from_user+0x2d/0xb0 [ 670.878394][T19462] generic_map_update_batch+0x6ba/0xae0 [ 670.878443][T19462] ? __pfx_generic_map_update_batch+0x10/0x10 [ 670.878478][T19462] ? __fget_files+0x2a/0x420 [ 670.878518][T19462] ? __pfx_generic_map_update_batch+0x10/0x10 [ 670.878553][T19462] bpf_map_do_batch+0x391/0x630 [ 670.878588][T19462] __sys_bpf+0xbe5/0xd90 [ 670.878624][T19462] ? __pfx___sys_bpf+0x10/0x10 [ 670.878662][T19462] ? __fget_files+0x2a/0x420 [ 670.878714][T19462] ? ksys_write+0x242/0x270 [ 670.878752][T19462] ? __pfx_ksys_write+0x10/0x10 [ 670.878792][T19462] __x64_sys_bpf+0xba/0xd0 [ 670.878817][T19462] do_syscall_64+0x166/0x520 [ 670.878841][T19462] ? trace_irq_disable+0x3b/0x140 [ 670.878864][T19462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.878889][T19462] ? clear_bhb_loop+0x70/0xc0 [ 670.878918][T19462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 670.878942][T19462] RIP: 0033:0x7fd46199e159 [ 670.878963][T19462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 670.878984][T19462] RSP: 002b:00007fd46294a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 670.879009][T19462] RAX: ffffffffffffffda RBX: 00007fd461c25fa0 RCX: 00007fd46199e159 [ 670.879025][T19462] RDX: 0000000000000038 RSI: 0000200000000500 RDI: 000000000000001a [ 670.879040][T19462] RBP: 00007fd46294a090 R08: 0000000000000000 R09: 0000000000000000 [ 670.879056][T19462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 670.879071][T19462] R13: 00007fd461c26038 R14: 00007fd461c25fa0 R15: 00007fff446dbbb8 [ 670.879105][T19462] [ 671.254556][T19464] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3755'. [ 671.390778][T19469] FAULT_INJECTION: forcing a failure. [ 671.390778][T19469] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 671.390816][T19469] CPU: 0 UID: 0 PID: 19469 Comm: syz.2.3757 Not tainted syzkaller #0 PREEMPT(full) [ 671.390843][T19469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 671.390857][T19469] Call Trace: [ 671.390867][T19469] [ 671.390878][T19469] dump_stack_lvl+0xe8/0x150 [ 671.390916][T19469] should_fail_ex+0x410/0x560 [ 671.390948][T19469] _copy_from_user+0x2d/0xb0 [ 671.390978][T19469] ___sys_recvmsg+0x173/0x5a0 [ 671.391009][T19469] ? __pfx___schedule+0x10/0x10 [ 671.391050][T19469] ? __pfx____sys_recvmsg+0x10/0x10 [ 671.391121][T19469] do_recvmmsg+0x31a/0x7f0 [ 671.391163][T19469] ? __pfx_do_recvmmsg+0x10/0x10 [ 671.391207][T19469] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 671.391235][T19469] ? __fget_files+0x3a2/0x420 [ 671.391278][T19469] __x64_sys_recvmmsg+0x198/0x250 [ 671.391313][T19469] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 671.391358][T19469] do_syscall_64+0x166/0x520 [ 671.391381][T19469] ? trace_irq_disable+0x3b/0x140 [ 671.391404][T19469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.391428][T19469] ? clear_bhb_loop+0x70/0xc0 [ 671.391456][T19469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 671.391479][T19469] RIP: 0033:0x7fceabd9e159 [ 671.391502][T19469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 671.391522][T19469] RSP: 002b:00007fceacc05028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 671.391552][T19469] RAX: ffffffffffffffda RBX: 00007fceac025fa0 RCX: 00007fceabd9e159 [ 671.391570][T19469] RDX: 00000000040001af RSI: 0000200000000a40 RDI: 0000000000000006 [ 671.391585][T19469] RBP: 00007fceacc05090 R08: 0000000000000000 R09: 0000000000000000 [ 671.391600][T19469] R10: 0000000000012122 R11: 0000000000000246 R12: 0000000000000002 [ 671.391615][T19469] R13: 00007fceac026038 R14: 00007fceac025fa0 R15: 00007ffd4b522098 [ 671.391651][T19469] [ 671.813192][T19473] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3758'. [ 672.456634][T19510] FAULT_INJECTION: forcing a failure. [ 672.456634][T19510] name failslab, interval 1, probability 0, space 0, times 0 [ 672.456672][T19510] CPU: 0 UID: 0 PID: 19510 Comm: syz.4.3768 Not tainted syzkaller #0 PREEMPT(full) [ 672.456699][T19510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 672.456714][T19510] Call Trace: [ 672.456723][T19510] [ 672.456734][T19510] dump_stack_lvl+0xe8/0x150 [ 672.456774][T19510] should_fail_ex+0x410/0x560 [ 672.456810][T19510] ? __alloc_skb+0x1db/0x7a0 [ 672.456836][T19510] should_failslab+0xa8/0x100 [ 672.456867][T19510] ? __alloc_skb+0x1db/0x7a0 [ 672.456891][T19510] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 672.456927][T19510] ? __alloc_skb+0x18d/0x7a0 [ 672.456958][T19510] ? __alloc_skb+0x1db/0x7a0 [ 672.456991][T19510] __alloc_skb+0x1db/0x7a0 [ 672.457026][T19510] alloc_skb_with_frags+0xc6/0x760 [ 672.457079][T19510] sock_alloc_send_pskb+0x878/0x990 [ 672.457140][T19510] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 672.457177][T19510] ? llc_ui_sendmsg+0x433/0xe30 [ 672.457210][T19510] ? llc_ui_sendmsg+0x433/0xe30 [ 672.457242][T19510] ? __local_bh_enable_ip+0xd6/0x140 [ 672.457278][T19510] llc_ui_sendmsg+0x459/0xe30 [ 672.457330][T19510] ? __pfx_llc_ui_sendmsg+0x10/0x10 [ 672.457369][T19510] ? apparmor_socket_sendmsg+0x98/0x360 [ 672.457397][T19510] ? __pfx_llc_ui_sendmsg+0x10/0x10 [ 672.457429][T19510] sock_sendmsg_nosec+0x13a/0x180 [ 672.457469][T19510] ____sys_sendmsg+0x54e/0x850 [ 672.457505][T19510] ? __pfx_____sys_sendmsg+0x10/0x10 [ 672.457546][T19510] ? import_iovec+0x73/0xa0 [ 672.457579][T19510] ___sys_sendmsg+0x2a5/0x360 [ 672.457616][T19510] ? __pfx____sys_sendmsg+0x10/0x10 [ 672.457645][T19510] ? __lock_acquire+0x747/0x2de0 [ 672.457722][T19510] __sys_sendmmsg+0x273/0x4d0 [ 672.457760][T19510] ? __pfx___sys_sendmmsg+0x10/0x10 [ 672.457802][T19510] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 672.457843][T19510] ? ksys_write+0x242/0x270 [ 672.457882][T19510] ? __pfx_ksys_write+0x10/0x10 [ 672.457925][T19510] __x64_sys_sendmmsg+0xa0/0xc0 [ 672.457958][T19510] do_syscall_64+0x166/0x520 [ 672.457982][T19510] ? trace_irq_disable+0x3b/0x140 [ 672.458012][T19510] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.458037][T19510] ? clear_bhb_loop+0x70/0xc0 [ 672.458066][T19510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.458099][T19510] RIP: 0033:0x7ff52ed9e159 [ 672.458120][T19510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 672.458140][T19510] RSP: 002b:00007ff52fd4c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 672.458166][T19510] RAX: ffffffffffffffda RBX: 00007ff52f025fa0 RCX: 00007ff52ed9e159 [ 672.458184][T19510] RDX: 1e1730a30afb6559 RSI: 0000200000000c40 RDI: 0000000000000004 [ 672.458200][T19510] RBP: 00007ff52fd4c090 R08: 0000000000000000 R09: 0000000000000000 [ 672.458216][T19510] R10: 0000000000008014 R11: 0000000000000246 R12: 0000000000000002 [ 672.458232][T19510] R13: 00007ff52f026038 R14: 00007ff52f025fa0 R15: 00007fff5b477228 [ 672.458269][T19510] [ 673.079789][T19527] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3773'. [ 674.024941][T19547] FAULT_INJECTION: forcing a failure. [ 674.024941][T19547] name failslab, interval 1, probability 0, space 0, times 0 [ 674.030357][T19547] CPU: 0 UID: 0 PID: 19547 Comm: syz.0.3778 Not tainted syzkaller #0 PREEMPT(full) [ 674.030391][T19547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 674.030406][T19547] Call Trace: [ 674.030416][T19547] [ 674.030427][T19547] dump_stack_lvl+0xe8/0x150 [ 674.030467][T19547] should_fail_ex+0x410/0x560 [ 674.030506][T19547] should_failslab+0xa8/0x100 [ 674.030537][T19547] __kvmalloc_node_noprof+0x176/0x820 [ 674.030567][T19547] ? bpf_compute_subprog_arg_access+0x138/0x14d0 [ 674.030595][T19547] ? bpf_compute_subprog_arg_access+0x138/0x14d0 [ 674.030631][T19547] bpf_compute_subprog_arg_access+0x138/0x14d0 [ 674.030660][T19547] ? bpf_sk_base_func_proto+0x7a/0x180 [ 674.030686][T19547] ? bpf_get_call_summary+0x9e0/0xfa0 [ 674.030715][T19547] ? __pfx_bpf_get_call_summary+0x10/0x10 [ 674.030757][T19547] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 674.030792][T19547] ? __kvmalloc_node_noprof+0x345/0x820 [ 674.030817][T19547] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 674.030844][T19547] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 674.030877][T19547] bpf_compute_live_registers+0x8d3/0x1ff0 [ 674.030924][T19547] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 674.030964][T19547] bpf_check+0x25ed/0x2e10 [ 674.031002][T19547] ? ktime_get_with_offset+0x93/0x2d0 [ 674.031032][T19547] ? __pfx_bpf_check+0x10/0x10 [ 674.031061][T19547] ? bpf_obj_name_cpy+0x194/0x1e0 [ 674.031098][T19547] bpf_prog_load+0x14d6/0x1c20 [ 674.031139][T19547] ? __pfx_bpf_prog_load+0x10/0x10 [ 674.031192][T19547] __sys_bpf+0xd0d/0xd90 [ 674.031227][T19547] ? __pfx___sys_bpf+0x10/0x10 [ 674.031263][T19547] ? __fget_files+0x2a/0x420 [ 674.031314][T19547] ? ksys_write+0x242/0x270 [ 674.031350][T19547] ? __pfx_ksys_write+0x10/0x10 [ 674.031390][T19547] __x64_sys_bpf+0xba/0xd0 [ 674.031417][T19547] do_syscall_64+0x166/0x520 [ 674.031443][T19547] ? trace_irq_disable+0x3b/0x140 [ 674.031465][T19547] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.031500][T19547] ? clear_bhb_loop+0x70/0xc0 [ 674.031529][T19547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.031552][T19547] RIP: 0033:0x7f10f939e159 [ 674.031574][T19547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.031594][T19547] RSP: 002b:00007f10fa2fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 674.031620][T19547] RAX: ffffffffffffffda RBX: 00007f10f9625fa0 RCX: 00007f10f939e159 [ 674.031638][T19547] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 674.031654][T19547] RBP: 00007f10fa2fe090 R08: 0000000000000000 R09: 0000000000000000 [ 674.031670][T19547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 674.031684][T19547] R13: 00007f10f9626038 R14: 00007f10f9625fa0 R15: 00007ffed6e87548 [ 674.031720][T19547] [ 674.772961][T19564] smbdirect: ib_dev[syz_device_name_32_chars_1234567] removed [ 675.042899][T19577] netlink: 'syz.4.3784': attribute type 1 has an invalid length. [ 675.097509][T19580] netlink: 'syz.3.3787': attribute type 1 has an invalid length. [ 675.258789][T15397] Bluetooth: hci4: link tx timeout [ 675.259012][T15397] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 675.291039][T19587] macvtap1: entered allmulticast mode [ 675.337000][T19580] macvtap2: entered allmulticast mode [ 675.439942][T19587] bond3: (slave bridge3): making interface the new active one [ 675.441786][T19587] bond3: (slave bridge3): Enslaving as an active interface with an up link [ 675.464127][T19595] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3789'. [ 675.554468][T19591] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3789'. [ 675.939195][T19608] netlink: 'syz.0.3793': attribute type 1 has an invalid length. [ 675.939223][T19608] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3793'. [ 676.636115][T19634] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3797'. [ 677.153770][T19651] netlink: 124 bytes leftover after parsing attributes in process `syz.0.3802'. [ 677.190434][T19656] netlink: 124 bytes leftover after parsing attributes in process `syz.2.3803'. [ 677.249060][T19657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3805'. [ 677.267274][T19657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3805'. [ 677.335392][ T5630] Bluetooth: hci4: command 0x0406 tx timeout [ 678.088092][T19695] netlink: 'syz.0.3814': attribute type 1 has an invalid length. [ 678.088121][T19695] netlink: 'syz.0.3814': attribute type 1 has an invalid length. [ 678.296319][T19705] FAULT_INJECTION: forcing a failure. [ 678.296319][T19705] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 678.296355][T19705] CPU: 1 UID: 0 PID: 19705 Comm: syz.1.3818 Not tainted syzkaller #0 PREEMPT(full) [ 678.296382][T19705] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 678.296397][T19705] Call Trace: [ 678.296407][T19705] [ 678.296418][T19705] dump_stack_lvl+0xe8/0x150 [ 678.296461][T19705] should_fail_ex+0x410/0x560 [ 678.296493][T19705] _copy_to_user+0x31/0xb0 [ 678.296525][T19705] bpf_verifier_vlog+0x496/0x900 [ 678.296575][T19705] bpf_verifier_log_write+0x11d/0x1a0 [ 678.296599][T19705] ? __pfx_reg_type_str+0x10/0x10 [ 678.296626][T19705] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 678.296665][T19705] print_reg_state+0x147/0x1a30 [ 678.296700][T19705] ? __pfx_print_reg_state+0x10/0x10 [ 678.296722][T19705] ? _copy_to_user+0x8a/0xb0 [ 678.296752][T19705] ? bpf_verifier_vlog+0x58d/0x900 [ 678.296800][T19705] ? bpf_verifier_log_write+0x11d/0x1a0 [ 678.296830][T19705] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 678.296862][T19705] ? bpf_verifier_log_write+0x11d/0x1a0 [ 678.296890][T19705] print_verifier_state+0x205/0x1a40 [ 678.296915][T19705] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 678.296946][T19705] ? __pfx_print_verifier_state+0x10/0x10 [ 678.296984][T19705] ? print_insn_state+0x135/0x170 [ 678.297011][T19705] do_check_common+0x2d55/0x5d30 [ 678.297082][T19705] ? __pfx_do_check_common+0x10/0x10 [ 678.297126][T19705] bpf_check+0x2639/0x2e10 [ 678.297165][T19705] ? ktime_get_with_offset+0x93/0x2d0 [ 678.297195][T19705] ? __pfx_bpf_check+0x10/0x10 [ 678.297224][T19705] ? bpf_obj_name_cpy+0x194/0x1e0 [ 678.297262][T19705] bpf_prog_load+0x14d6/0x1c20 [ 678.297303][T19705] ? __pfx_bpf_prog_load+0x10/0x10 [ 678.297359][T19705] __sys_bpf+0xd0d/0xd90 [ 678.297394][T19705] ? __pfx___sys_bpf+0x10/0x10 [ 678.297433][T19705] ? __fget_files+0x2a/0x420 [ 678.297485][T19705] ? ksys_write+0x242/0x270 [ 678.297524][T19705] ? __pfx_ksys_write+0x10/0x10 [ 678.297565][T19705] __x64_sys_bpf+0xba/0xd0 [ 678.297592][T19705] do_syscall_64+0x166/0x520 [ 678.297617][T19705] ? trace_irq_disable+0x3b/0x140 [ 678.297641][T19705] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.297666][T19705] ? clear_bhb_loop+0x70/0xc0 [ 678.297695][T19705] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.297718][T19705] RIP: 0033:0x7fd46199e159 [ 678.297740][T19705] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.297761][T19705] RSP: 002b:00007fd46294a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 678.297788][T19705] RAX: ffffffffffffffda RBX: 00007fd461c25fa0 RCX: 00007fd46199e159 [ 678.297805][T19705] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 678.297821][T19705] RBP: 00007fd46294a090 R08: 0000000000000000 R09: 0000000000000000 [ 678.297837][T19705] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 678.297852][T19705] R13: 00007fd461c26038 R14: 00007fd461c25fa0 R15: 00007fff446dbbb8 [ 678.297888][T19705] [ 678.727130][T19714] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3816'. [ 678.755133][T19715] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3820'. [ 679.663511][T19751] netlink: 'syz.0.3827': attribute type 22 has an invalid length. [ 679.663541][T19751] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3827'. [ 679.663791][T19751] netlink: 'syz.0.3827': attribute type 22 has an invalid length. [ 679.663810][T19751] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3827'. [ 680.189362][T19768] netlink: 'syz.1.3835': attribute type 1 has an invalid length. [ 680.615405][ C1] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 680.617459][ C0] ip6_tunnel: syztnl0 xmit: Local address not yet configured! [ 680.621144][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 681.476087][T19815] FAULT_INJECTION: forcing a failure. [ 681.476087][T19815] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 681.476124][T19815] CPU: 1 UID: 0 PID: 19815 Comm: syz.3.3848 Not tainted syzkaller #0 PREEMPT(full) [ 681.476151][T19815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 681.476166][T19815] Call Trace: [ 681.476179][T19815] [ 681.476190][T19815] dump_stack_lvl+0xe8/0x150 [ 681.476230][T19815] should_fail_ex+0x410/0x560 [ 681.476261][T19815] _copy_from_user+0x2d/0xb0 [ 681.476292][T19815] ___sys_sendmsg+0x1c6/0x360 [ 681.476323][T19815] ? __lock_acquire+0x747/0x2de0 [ 681.476352][T19815] ? __pfx____sys_sendmsg+0x10/0x10 [ 681.476421][T19815] ? __fget_files+0x2a/0x420 [ 681.476453][T19815] ? __fget_files+0x3a2/0x420 [ 681.476497][T19815] __x64_sys_sendmsg+0x1b1/0x290 [ 681.476531][T19815] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 681.476586][T19815] do_syscall_64+0x166/0x520 [ 681.476611][T19815] ? trace_irq_disable+0x3b/0x140 [ 681.476635][T19815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.476660][T19815] ? clear_bhb_loop+0x70/0xc0 [ 681.476690][T19815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.476714][T19815] RIP: 0033:0x7f2a3c39e159 [ 681.476742][T19815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 681.476764][T19815] RSP: 002b:00007f2a3d216028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 681.476790][T19815] RAX: ffffffffffffffda RBX: 00007f2a3c625fa0 RCX: 00007f2a3c39e159 [ 681.476808][T19815] RDX: 0000000000000080 RSI: 0000200000002040 RDI: 0000000000000003 [ 681.476823][T19815] RBP: 00007f2a3d216090 R08: 0000000000000000 R09: 0000000000000000 [ 681.476838][T19815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 681.476852][T19815] R13: 00007f2a3c626038 R14: 00007f2a3c625fa0 R15: 00007fff4e6b3128 [ 681.476887][T19815] [ 681.478614][T19813] xt_hashlimit: size too large, truncated to 1048576 [ 681.790551][T19819] xt_addrtype: ipv6 does not support BROADCAST matching [ 681.821506][T19819] __nla_validate_parse: 4 callbacks suppressed [ 681.821529][T19819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3849'. [ 681.821559][T19819] netlink: 'syz.4.3849': attribute type 30 has an invalid length. [ 681.896094][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 681.904050][T19819] vxlan0: entered promiscuous mode [ 681.904075][T19819] vxlan0: entered allmulticast mode [ 681.964494][T19819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3849'. [ 681.964537][T19819] netlink: 'syz.4.3849': attribute type 30 has an invalid length. [ 682.158184][ T174] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.159865][ T59] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.159914][ T59] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.159957][ T59] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.703244][T19858] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3855'. [ 682.723626][T19859] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3857'. [ 682.724557][T19860] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3856'. [ 683.319769][T19888] ip_tables: iptables: counters copy to user failed while replacing table [ 683.746772][T19901] x_tables: duplicate underflow at hook 1 [ 683.810142][T19906] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3871'. [ 684.064211][T19918] netlink: 'syz.3.3875': attribute type 2 has an invalid length. [ 684.081368][T19918] tipc: Enabling of bearer rejected, failed to enable media [ 685.088942][T19955] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 685.206832][T19953] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 685.224374][T19950] ip6erspan0: entered allmulticast mode [ 685.483933][T19962] Cannot find add_set index 0 as target [ 685.483953][T19965] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3891'. [ 685.531614][T19965] bond4: entered promiscuous mode [ 685.532074][T19965] 8021q: adding VLAN 0 to HW filter on device bond4 [ 685.574518][T19965] 8021q: adding VLAN 0 to HW filter on device bond4 [ 685.576849][T19965] bond4: (slave sit1): The slave device specified does not support setting the MAC address [ 685.579071][T19965] bond4: (slave sit1): Error -95 calling set_mac_address [ 685.682983][T19974] ip_tables: iptables: counters copy to user failed while replacing table [ 685.748675][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.032524][T19985] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3898'. [ 686.556289][T20004] netlink: 'syz.2.3908': attribute type 10 has an invalid length. [ 686.795356][T20007] openvswitch: netlink: IP tunnel dst address not specified [ 686.864568][T20004] bond0: (slave netdevsim1): Releasing backup interface [ 687.054433][T20004] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 687.069791][T20004] team0: Port device netdevsim1 added [ 687.816341][T15397] Bluetooth: hci2: command 0x0406 tx timeout [ 689.651024][T20027] syzkaller0: entered promiscuous mode [ 689.651054][T20027] syzkaller0: entered allmulticast mode [ 689.822230][T20049] netlink: 'syz.0.3916': attribute type 12 has an invalid length. [ 692.661051][T20091] Bluetooth: hci0: invalid length 0, exp 2 for type 5 [ 692.841790][T20090] syzkaller0: entered promiscuous mode [ 692.841817][T20090] syzkaller0: entered allmulticast mode [ 692.882326][T20090] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3928'. [ 693.738597][T20140] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3940'. [ 693.854273][T20138] syzkaller0: entered promiscuous mode [ 693.854301][T20138] syzkaller0: entered allmulticast mode [ 694.042151][T20151] No such timeout policy "s " [ 694.042170][T20151] netlink: Failed to associated timeout policy 's ' [ 694.342552][T20153] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3945'. [ 694.422389][T20165] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3946'. [ 696.590169][T20151] bridge0: port 3(wlan1) entered disabled state [ 696.780437][T20178] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3949'. [ 696.849152][T20178] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3949'. [ 696.951269][T20189] netlink: 67 bytes leftover after parsing attributes in process `syz.2.3953'. [ 699.332564][T20189] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 699.335031][T20195] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3955'. [ 699.408329][T20151] ------------[ cut here ]------------ [ 699.408348][T20151] !chanctx_conf [ 699.408364][T20151] WARNING: net/mac80211/tx.c:6509 at ieee80211_tx_skb_tid+0x3b8/0x480, CPU#1: syz.1.3943/20151 [ 699.429294][T20151] Modules linked in: [ 699.433241][T20151] CPU: 1 UID: 0 PID: 20151 Comm: syz.1.3943 Not tainted syzkaller #0 PREEMPT(full) [ 699.442702][T20151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 699.452857][T20151] RIP: 0010:ieee80211_tx_skb_tid+0x3b8/0x480 [ 699.458943][T20151] Code: 1b 43 f6 e9 b1 fe ff ff e8 85 70 67 f6 90 0f 0b 90 e9 e2 fe ff ff e8 77 70 67 f6 90 0f 0b 90 e9 2a fe ff ff e8 69 70 67 f6 90 <0f> 0b 90 e8 10 b2 fd ff 31 ff 48 8b 34 24 ba 02 00 00 00 48 83 c4 [ 699.478667][T20151] RSP: 0018:ffffc90002fef318 EFLAGS: 00010283 [ 699.484785][T20151] RAX: ffffffff8b605a47 RBX: ffffffff8b6056bf RCX: 0000000000080000 [ 699.492839][T20151] RDX: ffffc90005b2a000 RSI: 000000000002a00c RDI: 000000000002a00d [ 699.500887][T20151] RBP: 00000000ffffffff R08: ffffffff8b6056bf R09: 0000000000000000 [ 699.508946][T20151] R10: dffffc0000000000 R11: ffffed100ee8068e R12: ffff88807ad1cec0 [ 699.517002][T20151] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 699.525012][T20151] FS: 00007fd46294a6c0(0000) GS:ffff888124dd1000(0000) knlGS:0000000000000000 [ 699.534033][T20151] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 699.540694][T20151] CR2: 00007f67ab49b1e5 CR3: 0000000077f44000 CR4: 00000000003526f0 [ 699.548744][T20151] Call Trace: [ 699.552062][T20151] [ 699.555028][T20151] mesh_plink_frame_tx+0x73d/0xc30 [ 699.560241][T20151] ? __pfx_mesh_plink_frame_tx+0x10/0x10 [ 699.565954][T20151] ? mesh_rx_plink_frame+0x690/0x26a0 [ 699.571387][T20151] mesh_plink_deactivate+0x18b/0x2f0 [ 699.576757][T20151] mesh_sta_cleanup+0x42/0x150 [ 699.581582][T20151] cleanup_single_sta+0x3ff/0x660 [ 699.586716][T20151] __sta_info_flush+0x5bb/0x700 [ 699.591641][T20151] ? __pfx___sta_info_flush+0x10/0x10 [ 699.597114][T20151] ieee80211_do_stop+0x3cd/0x2410 [ 699.602213][T20151] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 699.607788][T20151] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 699.613656][T20151] ieee80211_stop+0x1ab/0x200 [ 699.618426][T20151] ? __pfx_ieee80211_stop+0x10/0x10 [ 699.623686][T20151] __dev_close_many+0x366/0x6e0 [ 699.628617][T20151] ? kasan_save_track+0x4f/0x80 [ 699.633517][T20151] ? kasan_save_track+0x3e/0x80 [ 699.638467][T20151] ? __pfx___dev_close_many+0x10/0x10 [ 699.643882][T20151] ? __mutex_trylock_common+0x15f/0x270 [ 699.649532][T20151] netif_close_many+0x249/0x660 [ 699.654428][T20151] ? rcu_is_watching+0x16/0xb0 [ 699.659295][T20151] ? __pfx_netif_close_many+0x10/0x10 [ 699.664712][T20151] ? __mutex_lock+0x30b/0x1550 [ 699.669576][T20151] ? rfkill_fill_event+0x29c/0x3f0 [ 699.674742][T20151] netif_close+0x160/0x220 [ 699.679257][T20151] ? __pfx_netif_close+0x10/0x10 [ 699.684253][T20151] ? __pfx___mutex_lock+0x10/0x10 [ 699.689435][T20151] ? do_raw_spin_lock+0x12b/0x2f0 [ 699.694519][T20151] dev_close+0xf7/0x210 [ 699.698776][T20151] cfg80211_shutdown_all_interfaces+0xb0/0x220 [ 699.704993][T20151] ? __pfx_cfg80211_rfkill_set_block+0x10/0x10 [ 699.711264][T20151] cfg80211_rfkill_set_block+0x2d/0x50 [ 699.716830][T20151] rfkill_set_block+0x19f/0x4d0 [ 699.721748][T20151] rfkill_fop_write+0x43b/0x560 [ 699.726698][T20151] ? common_file_perm+0x20e/0x2b0 [ 699.731806][T20151] ? __pfx_rfkill_fop_write+0x10/0x10 [ 699.737274][T20151] ? security_file_permission+0x10/0x260 [ 699.742974][T20151] ? rw_verify_area+0x203/0x4c0 [ 699.747935][T20151] ? __pfx_rfkill_fop_write+0x10/0x10 [ 699.753357][T20151] vfs_write+0x296/0xba0 [ 699.757708][T20151] ? __pfx_vfs_write+0x10/0x10 [ 699.762531][T20151] ? __fget_files+0x2a/0x420 [ 699.767223][T20151] ? __fget_files+0x2a/0x420 [ 699.771864][T20151] ? __fget_files+0x3a2/0x420 [ 699.776629][T20151] ? __fget_files+0x2a/0x420 [ 699.781281][T20151] ksys_write+0x150/0x270 [ 699.785708][T20151] ? __pfx_ksys_write+0x10/0x10 [ 699.790675][T20151] do_syscall_64+0x166/0x520 [ 699.795358][T20151] ? trace_irq_disable+0x3b/0x140 [ 699.800421][T20151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.806573][T20151] ? clear_bhb_loop+0x70/0xc0 [ 699.811303][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.817289][T20151] RIP: 0033:0x7fd46199e159 [ 699.821766][T20151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 699.841454][T20151] RSP: 002b:00007fd46294a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 699.849963][T20151] RAX: ffffffffffffffda RBX: 00007fd461c25fa0 RCX: 00007fd46199e159 [ 699.858031][T20151] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000003 [ 699.866107][T20151] RBP: 00007fd461a3503b R08: 0000000000000000 R09: 0000000000000000 [ 699.874142][T20151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 699.882205][T20151] R13: 00007fd461c26038 R14: 00007fd461c25fa0 R15: 00007fff446dbbb8 [ 699.890289][T20151] [ 699.893366][T20151] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 699.900682][T20151] CPU: 1 UID: 0 PID: 20151 Comm: syz.1.3943 Not tainted syzkaller #0 PREEMPT(full) [ 699.910089][T20151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 699.920175][T20151] Call Trace: [ 699.923476][T20151] [ 699.926437][T20151] vpanic+0x56d/0xa60 [ 699.930462][T20151] ? __pfx__printk+0x10/0x10 [ 699.935077][T20151] ? __pfx_vpanic+0x10/0x10 [ 699.939614][T20151] ? is_bpf_text_address+0x292/0x2b0 [ 699.944936][T20151] ? is_bpf_text_address+0x26/0x2b0 [ 699.950172][T20151] panic+0xc5/0xd0 [ 699.953931][T20151] ? __pfx_panic+0x10/0x10 [ 699.958398][T20151] __warn+0x315/0x4c0 [ 699.962414][T20151] ? ieee80211_tx_skb_tid+0x3b8/0x480 [ 699.967816][T20151] ? ieee80211_tx_skb_tid+0x3b8/0x480 [ 699.973220][T20151] __report_bug+0x276/0x570 [ 699.977759][T20151] ? ieee80211_tx_skb_tid+0x3b8/0x480 [ 699.983163][T20151] ? __pfx___report_bug+0x10/0x10 [ 699.988217][T20151] ? __lock_acquire+0x747/0x2de0 [ 699.993198][T20151] ? ieee80211_tx_skb_tid+0x3b8/0x480 [ 699.998610][T20151] report_bug+0x16b/0x220 [ 700.002969][T20151] ? ieee80211_tx_skb_tid+0x3b8/0x480 [ 700.008364][T20151] ? ieee80211_tx_skb_tid+0x3ba/0x480 [ 700.013763][T20151] handle_bug+0x9c/0x200 [ 700.018039][T20151] exc_invalid_op+0x1a/0x50 [ 700.022571][T20151] asm_exc_invalid_op+0x1a/0x20 [ 700.027445][T20151] RIP: 0010:ieee80211_tx_skb_tid+0x3b8/0x480 [ 700.033454][T20151] Code: 1b 43 f6 e9 b1 fe ff ff e8 85 70 67 f6 90 0f 0b 90 e9 e2 fe ff ff e8 77 70 67 f6 90 0f 0b 90 e9 2a fe ff ff e8 69 70 67 f6 90 <0f> 0b 90 e8 10 b2 fd ff 31 ff 48 8b 34 24 ba 02 00 00 00 48 83 c4 [ 700.053085][T20151] RSP: 0018:ffffc90002fef318 EFLAGS: 00010283 [ 700.059186][T20151] RAX: ffffffff8b605a47 RBX: ffffffff8b6056bf RCX: 0000000000080000 [ 700.067180][T20151] RDX: ffffc90005b2a000 RSI: 000000000002a00c RDI: 000000000002a00d [ 700.075177][T20151] RBP: 00000000ffffffff R08: ffffffff8b6056bf R09: 0000000000000000 [ 700.083181][T20151] R10: dffffc0000000000 R11: ffffed100ee8068e R12: ffff88807ad1cec0 [ 700.091181][T20151] R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000 [ 700.099186][T20151] ? ieee80211_tx_skb_tid+0x2f/0x480 [ 700.104503][T20151] ? ieee80211_tx_skb_tid+0x2f/0x480 [ 700.109813][T20151] ? ieee80211_tx_skb_tid+0x3b7/0x480 [ 700.115223][T20151] ? ieee80211_tx_skb_tid+0x3b7/0x480 [ 700.120628][T20151] mesh_plink_frame_tx+0x73d/0xc30 [ 700.125787][T20151] ? __pfx_mesh_plink_frame_tx+0x10/0x10 [ 700.131449][T20151] ? mesh_rx_plink_frame+0x690/0x26a0 [ 700.136853][T20151] mesh_plink_deactivate+0x18b/0x2f0 [ 700.142169][T20151] mesh_sta_cleanup+0x42/0x150 [ 700.146961][T20151] cleanup_single_sta+0x3ff/0x660 [ 700.152034][T20151] __sta_info_flush+0x5bb/0x700 [ 700.156920][T20151] ? __pfx___sta_info_flush+0x10/0x10 [ 700.162337][T20151] ieee80211_do_stop+0x3cd/0x2410 [ 700.167405][T20151] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 700.172912][T20151] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 700.178761][T20151] ieee80211_stop+0x1ab/0x200 [ 700.183463][T20151] ? __pfx_ieee80211_stop+0x10/0x10 [ 700.188690][T20151] __dev_close_many+0x366/0x6e0 [ 700.193567][T20151] ? kasan_save_track+0x4f/0x80 [ 700.198435][T20151] ? kasan_save_track+0x3e/0x80 [ 700.203313][T20151] ? __pfx___dev_close_many+0x10/0x10 [ 700.208706][T20151] ? __mutex_trylock_common+0x15f/0x270 [ 700.214280][T20151] netif_close_many+0x249/0x660 [ 700.219151][T20151] ? rcu_is_watching+0x16/0xb0 [ 700.223946][T20151] ? __pfx_netif_close_many+0x10/0x10 [ 700.229343][T20151] ? __mutex_lock+0x30b/0x1550 [ 700.234132][T20151] ? rfkill_fill_event+0x29c/0x3f0 [ 700.239275][T20151] netif_close+0x160/0x220 [ 700.243714][T20151] ? __pfx_netif_close+0x10/0x10 [ 700.248682][T20151] ? __pfx___mutex_lock+0x10/0x10 [ 700.253760][T20151] ? do_raw_spin_lock+0x12b/0x2f0 [ 700.258820][T20151] dev_close+0xf7/0x210 [ 700.263011][T20151] cfg80211_shutdown_all_interfaces+0xb0/0x220 [ 700.269192][T20151] ? __pfx_cfg80211_rfkill_set_block+0x10/0x10 [ 700.275381][T20151] cfg80211_rfkill_set_block+0x2d/0x50 [ 700.280875][T20151] rfkill_set_block+0x19f/0x4d0 [ 700.285761][T20151] rfkill_fop_write+0x43b/0x560 [ 700.290641][T20151] ? common_file_perm+0x20e/0x2b0 [ 700.295703][T20151] ? __pfx_rfkill_fop_write+0x10/0x10 [ 700.301112][T20151] ? security_file_permission+0x10/0x260 [ 700.306781][T20151] ? rw_verify_area+0x203/0x4c0 [ 700.311673][T20151] ? __pfx_rfkill_fop_write+0x10/0x10 [ 700.317071][T20151] vfs_write+0x296/0xba0 [ 700.321355][T20151] ? __pfx_vfs_write+0x10/0x10 [ 700.326152][T20151] ? __fget_files+0x2a/0x420 [ 700.330792][T20151] ? __fget_files+0x2a/0x420 [ 700.335409][T20151] ? __fget_files+0x3a2/0x420 [ 700.340118][T20151] ? __fget_files+0x2a/0x420 [ 700.344753][T20151] ksys_write+0x150/0x270 [ 700.349121][T20151] ? __pfx_ksys_write+0x10/0x10 [ 700.354015][T20151] do_syscall_64+0x166/0x520 [ 700.358631][T20151] ? trace_irq_disable+0x3b/0x140 [ 700.363688][T20151] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.369786][T20151] ? clear_bhb_loop+0x70/0xc0 [ 700.374494][T20151] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.380410][T20151] RIP: 0033:0x7fd46199e159 [ 700.384849][T20151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 700.404475][T20151] RSP: 002b:00007fd46294a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 700.412914][T20151] RAX: ffffffffffffffda RBX: 00007fd461c25fa0 RCX: 00007fd46199e159 [ 700.420909][T20151] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000003 [ 700.429003][T20151] RBP: 00007fd461a3503b R08: 0000000000000000 R09: 0000000000000000 [ 700.437002][T20151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 700.445013][T20151] R13: 00007fd461c26038 R14: 00007fd461c25fa0 R15: 00007fff446dbbb8 [ 700.453041][T20151] [ 700.456280][T20151] Kernel Offset: disabled [ 700.460624][T20151] Rebooting in 86400 seconds..