last executing test programs: 3.761717314s ago: executing program 2 (id=14098): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000280)={@link_local, @random="1704b45adbde", @val={@void}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x6, 0x4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @rand_addr, {[@lsrr={0x83, 0x3, 0x9a}]}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xf, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r5, 0x0, 0x6, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x4000010, r6, 0x0) write$cgroup_devices(r5, &(0x7f00000000c0)=ANY=[], 0x6) write(r4, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r5, 0x0) select(0x40, &(0x7f0000000000)={0x2, 0xd, 0x401, 0x60000000000000, 0x1, 0xfffffffffffffffd, 0x3}, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0xea60}) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x304}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "db0127ff", "16dea6d67a8426bd"}, 0x28) setsockopt$sock_int(r3, 0x1, 0xa, &(0x7f0000000140)=0x10001, 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000340)=@gcm_128={{0x304}, "b7a41f2305009201", "d21b0e8a0e000000000000000600", '\x00', "ec9300"}, 0x28) recvfrom(r3, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) setsockopt$sock_int(r3, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x24}}, 0x0) 3.723357526s ago: executing program 4 (id=14101): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x5010c0, 0x0) ioctl$PPPIOCGIDLE32(r0, 0x8008743f, &(0x7f0000000080)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r3, 0x0, 0xc084) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0x10, 0x3, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8169, 0x2000, 0x800, 0x0, 0x2}, 0x20) setsockopt$XDP_TX_RING(r5, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r5, &(0x7f00000003c0)={0x2c, 0x2, r7, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r5, 0x80000000) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f0000000040)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0x8, 0x70bd28, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x18017, 0xb}, {0xa, 0x7}, {0x3, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x34}}, 0x0) r8 = socket$inet6(0xa, 0x3, 0x3a) readv(r8, &(0x7f0000000440)=[{&(0x7f0000000280)=""/230, 0xee}, {&(0x7f00000001c0)=""/63, 0x3f}, {&(0x7f0000000380)=""/143, 0x8f}], 0x3) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r9, 0xff, 0x24, &(0x7f0000002d80)="f0c46000", 0x4) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb86dd6000000000103afffe8000000000000000000000000000bbff020000000000000000000000000001"], 0x0) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) 3.538651197s ago: executing program 3 (id=14103): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000dc020078000000000000000000000000ff02000000000000e26ea7250000000100000000000000000a"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="6501000012"], 0x188}}, 0x0) 3.243262067s ago: executing program 3 (id=14104): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xb, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1c000000}, [@printk={@lx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.053704757s ago: executing program 3 (id=14105): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0xfffffffffffffe23}, {&(0x7f0000000880)='\x00\x00~', 0xffffffffffffff91}, {&(0x7f0000000380)="746b9120a32a1bda64519c07000000000000003c44", 0x15}], 0x3}, 0x2000c054) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendfile(r3, r4, 0x0, 0xffffffff000) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x0, 0x70bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r7, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000000040)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="440000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000008001b00000000000400"], 0x44}}, 0x0) syz_genetlink_get_family_id$team(&(0x7f00000003c0), r1) 2.806375325s ago: executing program 0 (id=14106): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000c40)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_GET_REG(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x14, 0x0, 0x2, 0x70bd26, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) accept4$inet(r2, 0x0, 0x0, 0x80000) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000300)=0x3, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "dbdc27ff", "16de86d67a8426bd"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x24, r4, 0x605, 0x70bd2d, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_4ADDR={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000801}, 0xc0c4) 2.639325181s ago: executing program 2 (id=14107): r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x90, r0, 0x10, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r2}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x840}, 0x4004) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x9, 0x40}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000340)={r5, 0x1000}, &(0x7f0000000380)=0x8) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000440)={'vxcan1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000500)={'ip6_vti0\x00', &(0x7f0000000480)={'syztnl2\x00', r3, 0x0, 0x6, 0x2, 0x2, 0x34, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x14}, 0x7800, 0x1, 0x4, 0x6}}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r7, &(0x7f00000006c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x120, r8, 0x300, 0x70bd2d, 0x25dfdbfb, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000814) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(r11, 0x11a, 0x1, &(0x7f0000000700)=@gcm_128={{0x304}, "1a052bc22ec2736d", "1ec2aec581b80f319bcf369e75aa772c", "ee9811d1", "65e4c21e20017cf7"}, 0x28) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r11, 0x8982, &(0x7f0000000740)={0x0, 'wg2\x00', {0x1}, 0x7}) r12 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r12, 0x89f7, &(0x7f00000007c0)={'sit0\x00', &(0x7f0000000780)={@empty, 0x1, 0x0, 0x10, 0x0, [{@loopback}]}}) write(r7, &(0x7f0000000800)="2cb424393ee5ea570ba60057e0206cffee3cf3808373fa18ef78052f63e2aee5e90c166af20e7dae93bf65def47685ef9983953590657dbe55e5f10da5126bbdfefebd61248a4e120dd8710a8c5026fa4f3fc384d2710fc9cfff7b05fe", 0x5d) r13 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000880), 0x4) r14 = bpf$ITER_CREATE(0x21, &(0x7f00000008c0)={r13}, 0x8) r15 = socket(0x29, 0xa, 0x0) recvfrom$inet(r15, &(0x7f0000000900)=""/170, 0xaa, 0x40000000, &(0x7f00000009c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000a00)={{{@in6}}, {{@in6=@private0}, 0x0, @in6=@dev}}, &(0x7f0000000b00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000b40)) ioctl$sock_SIOCGIFINDEX_80211(r15, 0x8933, &(0x7f0000000bc0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WOWLAN(r7, &(0x7f0000000c80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x30, 0x0, 0x10, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r16}, @val={0xc, 0x99, {0x1, 0x75}}}}, [@NL80211_ATTR_WOWLAN_TRIGGERS={0x8, 0x75, 0x0, 0x1, [@NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST={0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x10) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r15, 0x84, 0x6d, &(0x7f0000000cc0)={r6, 0xe9, "abd5eadbad538e1569b34b1688cb286fcda99b8b29c3748233e116dae00797a0a169e574537a9fafffe493d28e9a440cc8ef7546285b372f7a72078e3f8dca343d77ab5a744df1854aece291634365461a408e7365e57af5f67197d297b2505709ee549ea59a0a9248830d7ecf1bbc6aad76313b91dd6880f0deb3001615af9447ce06438b0f7bf760c904cf1ba98d783fb5a775f787f7067fdcbbcd9fe386705ec74d33503f4d200f9a2fb4d3ac2d4868356d5ddcefd50bd39b44add7f046c3a30ed77f470f2f672db678ba2e3bed653c2ae3db4b38a403ef0cce364f93713282ee645c4b43d04e16"}, &(0x7f0000000dc0)=0xf1) ioctl$sock_TIOCINQ(r14, 0x541b, &(0x7f0000000e00)) 2.380916952s ago: executing program 4 (id=14108): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x18, 0x41, 0x1, 0x70bd2c, 0x4, {0x1}, [@nested={0x4, 0x85}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) 2.306304206s ago: executing program 0 (id=14109): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) close(0x3) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0), r2) sendmsg$IPVS_CMD_DEL_SERVICE(r3, &(0x7f0000000500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="000035be", @ANYRES16=r4, @ANYBLOB="00022bbd7000fcdbdf25030000005400018014000300e0000001000000000000000000000000060004004e20000014000300fc0200000000000000000000000000000c00070020000000000000000c0007000600000010000000080009002700000008000400040000003c000280080003000200000008000400040000005a000f00010000000800030007000000080009000200000006000b000a00000008000600070000003c000380050008000600000014000600ff01000000000000000000000000000114000600ff020000000000000000000000000001060007004e2200000c00028008000900060000000c0002800800090002000000580003800600040081000000080005000a0101021400020070696d7265673000000000000000000005000800050000000500080007000000060007004e210000060007004e200000050008009800000008000300000000003c00028006000e004e22000008000600060000000800040005000000080007002e68ad50080007008100000008000900010000000800030003000000"], 0x194}}, 0x4000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x4, 0xfe, 0x53, 0x3, 0x58, @mcast1, @mcast2={0xff, 0x5}, 0x8, 0x40, 0xe3e1, 0xcff}}) r5 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r5, 0x400, 0x70bd25, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FAMILY={0x5, 0xd, 0x23}, @GTPA_FAMILY={0x5, 0xd, 0xf}, @GTPA_PEER_ADDRESS={0x8, 0x4, @empty}, @GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}]}, 0x3c}}, 0x20008000) 2.048099978s ago: executing program 4 (id=14111): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000008c0)=@raw={'raw\x00', 0x8, 0x2, 0x230, 0x0, 0x43, 0xa0, 0xe8, 0x98, 0x198, 0x178, 0x178, 0x198, 0x178, 0x2, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x3, 0x1, "7a7d0d9452200a44a3d28da04828d1768c081f126a6bb82700"}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@STANDARD={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0x0}}}}, 0x290) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x3}, 0x4) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r1, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x0, 0x0) getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000000)=""/3, &(0x7f0000000040)=0x3) unshare(0x8040480) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000001000000000000008018000095"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRESOCT], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x11, 0x4, 0x4, 0x2, 0x0, 0x1, 0xff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000001000)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb4}, 0x1, 0x0, 0x0, 0x4000854}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYRES64=r6], 0x20) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="180000002f00290027bd7000000000000400000004001200"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv6_getaddr={0x20, 0x16, 0x800, 0x70bd2d, 0x25dfdbff, {0xa, 0x38, 0x1, 0xfe}, [@IFA_FLAGS={0x8, 0x8, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x5f773ac9ea96531}, 0x10) socket(0x23, 0x80805, 0x0) 1.973265616s ago: executing program 2 (id=14113): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xd, 0x4, 0x4, 0xfffffff, 0x0, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) 1.73264181s ago: executing program 2 (id=14115): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b000000ff000000324900007f00000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r3, &(0x7f0000002940), 0x0}, 0x20) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[], 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001060100000000000000000000000000000000000000000000001000032073797a6b616c6c65723000001800128008000100767266000c0002"], 0x48}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0) close(r4) socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x4, 0x5, 0x2, 0x0, {0xa, 0x4e23, 0x9, @mcast1, 0x97}}}, 0x80, 0x0}, 0x2000f765) ioctl$SIOCSIFHWADDR(r4, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x70bd2d, 0x25dfdbfc, {0x81, 0x20, 0x80, 0x1, 0x40, 0x0, 0x0, 0x8}}, 0x1c}, 0x1, 0x0, 0x0, 0x20008004}, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000780)={'gretap0\x00', 0x0}) 1.552365198s ago: executing program 2 (id=14116): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000000)=0x2, 0x4) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=""/20, 0x14}, 0x8}], 0x1, 0x120, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000023c0)=@delchain={0x7c0, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x1, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0x794, 0x2, [@TCA_BPF_ACT={0x790, 0x1, [@m_bpf={0x130, 0x11, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_NAME={0x5, 0x6, '\x00'}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0xffffffff, 0x3, 0xffffffffffffffff, 0x10001, 0x6}}]}, {0xd1, 0x6, "a41f25d22b1bae1b6bfb4a42ad5ba9db462fca41280c331f630e2c9f0be1093117392575082305ebc27660464ef802792ce06133244235023f0f4882fc0a47f4d5e499a8857cd81b0e6fda422cbc53ad098872214190756df6bbd0e760248aa97e200702fd569bd27d4a70df1d4a123ffc42d2592c81751e15e260622f14aeaaca5dc8acab93651fdd1d5614d98f28fc76d402e1028d91028270a2722b141a9140c47e37d068e7193d463a6444e424bc792ab1295f79842a501700a5cc2f71eefaf131a98821e712b03d552c87"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x108, 0x5, 0x0, 0x0, {{0x7}, {0x30, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x2a, 0x6, {0x7, 'raw\x00', 0x7, 0x100}}]}, {0xb3, 0x6, "a5fd64840366fd7ad44f3f053221ded9ced495590e2bc8690a2765e56ded8425cb3eb0e04bbcfec50e639bf373167e617b24eccd260f28bb850873b1e2154b158987d6e585e10ffeaba32641bae47de041e1169d8e4a65b8ce3633a4469c93c5228320c572237d92a9ae6bbc2d2bd3a2d1e27de283017ecf9fca6b2cd8a119dee59702830717b694625f60f5c81f688775c5e292f76a0ffa39e1d2cabd639d1c111c01e0d2f9faa220154db3339924"}, {0xc, 0x7, {0x1, 0xeb0757422c733451}}, {0xc, 0x8, {0x3, 0x3}}}}, @m_bpf={0xe0, 0x8, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_OPS={0x24, 0x4, [{0x0, 0x0, 0x9, 0xff}, {0xb, 0xf6, 0x5, 0xfffffffc}, {0x401, 0xb0, 0x32}, {0x6092, 0x70, 0x6, 0x1ff}]}]}, {0x81, 0x6, "5d3aee85a6264cff4a2163adaec321e008985cfa435b8922eeb16f1932265618158a3fe72c442a68b182e8f673f9251a03dc831c5947be17ca906c3dcb99adb55bc5f0ad8886f235f45d7e29bb727715f2e7a3200ac63eb79f7a023835874514b60b0177c40370157c0c21b37875e7e4a2e75b3cc54be7d719fa695469"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_police={0x448, 0x9, 0x0, 0x0, {{0xb}, {0x410, 0x2, 0x0, 0x1, [[@TCA_POLICE_RESULT={0x8, 0x5, 0x5bb5}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xe73, 0x9, 0x7, 0x3, 0x1ff, 0x7, 0x8, 0x80, 0x3, 0x1, 0x10000000, 0x401, 0x3, 0x2, 0x4, 0x6, 0x1000, 0x3, 0x5, 0x5, 0xfffffff9, 0xff, 0xc, 0x7fff, 0x5, 0x5c7000, 0x9, 0x7fffffff, 0x5, 0x6, 0x0, 0x80, 0x1f, 0x7ff, 0xfffffc84, 0x10, 0xfffffff7, 0x3, 0x8, 0x6, 0x5, 0xb, 0x8, 0xfffffffd, 0x4c, 0xe, 0xf, 0x9, 0x9, 0x3, 0xfffffff9, 0xfffffffa, 0x1, 0x2, 0x9, 0x8, 0xc6e7, 0xa000, 0x2, 0x8000, 0x17, 0x6, 0x2e52, 0x9, 0x7, 0x6, 0x414, 0x10001, 0x0, 0x5, 0xffffffff, 0xc, 0x1000, 0x4, 0x800, 0x10, 0x39, 0x5, 0x2, 0x5c3, 0x800, 0x2, 0x5, 0x6e6, 0x3, 0x7, 0x6, 0xc, 0x3, 0x14e, 0x8, 0x5, 0xad8, 0x289f, 0x3, 0x97e, 0x3, 0x80, 0x6, 0xb, 0x8, 0xe6, 0x720, 0x2, 0xa98f, 0x1, 0xffffffff, 0x0, 0x3, 0x74, 0xdd7c, 0x2, 0x0, 0xffffff7c, 0x6, 0x7f, 0x1, 0x6, 0x4, 0x7, 0x3, 0x7, 0xb, 0xfff, 0xfffffffd, 0x3, 0xc60, 0x7, 0x4, 0xf8ca, 0xb, 0x6, 0x3ff, 0x7fffffff, 0x8001, 0xd, 0x0, 0x4, 0x4, 0x0, 0x421, 0x8, 0x9, 0x2, 0x1, 0x0, 0x9, 0xffff, 0x7ff, 0x8, 0x9, 0x2, 0xb, 0xa00, 0x2, 0xfec, 0x5, 0x5, 0x5, 0x9, 0x2, 0x400, 0x3, 0x3, 0x3, 0x8, 0xe59, 0x1000, 0x101, 0x5, 0x8001, 0x9, 0x4, 0x0, 0x6155, 0xe040, 0x80000001, 0x40, 0x7f, 0x9, 0x5e59, 0x81, 0x0, 0x9, 0x0, 0x3, 0x1, 0xb571, 0xe, 0x7, 0xa, 0x80000000, 0x2797, 0x4, 0x2, 0x2, 0x2, 0x3, 0x81, 0xffffffff, 0x6f, 0xfffffffd, 0x5, 0xb, 0x1, 0x3, 0x3, 0x1, 0x2, 0x4, 0x8001, 0x7, 0x7, 0x1, 0x32d, 0x9, 0x6, 0x2, 0x6, 0x2, 0x4, 0x1, 0x4, 0x0, 0x1000, 0x80000001, 0xffffffff, 0x4, 0x7, 0x8, 0x8, 0x697, 0xe339, 0x9, 0x1, 0x6, 0xffffffff, 0x9, 0x9, 0x35, 0x7, 0x5, 0xfffffffb, 0xfffffff9, 0x965, 0x7145, 0x90b6, 0x6, 0x6, 0x2, 0x8, 0x1, 0x1, 0xd5, 0x7ff, 0x200]}]]}, {0xf, 0x6, "94cedea66d85e9b70c476e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_xt={0x2c, 0x13, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}}]}, 0x7c0}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r1 = socket(0x10, 0x803, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000180)={@rand_addr=' \x01\x00', 0x8000000, 0x0, 0x2, 0x1, 0xbfec, 0x9}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@loopback={0xfec0ffff00000000}, 0x8000000, 0x0, 0x2, 0x8, 0x0, 0x4c}, 0x20) close(r2) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x55}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb010789005e107538e486dd6317ce22000000fffe800000"], 0xfdef) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) openat$cgroup_subtree(r4, &(0x7f00000000c0), 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r5, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={0x30, r7, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x3, 0x1}}}}, 0x30}}, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r5, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x10000000) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {0x0}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.489587218s ago: executing program 1 (id=14117): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newtaction={0x14, 0x1c, 0x1, 0x0, 0x0, {0x0, 0x0, 0x1300}}, 0x14}}, 0x0) connect$netlink(r1, &(0x7f0000000180), 0xc) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) (async) r3 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000480000004800000004000000020000000000000e0400000000000000000000000000000105000000080000000000000000000001030000000300000000000000000000030000000003000000020000000b000000006161"], 0x0, 0x64, 0x0, 0x0, 0x4}, 0x28) (async) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000a40)={0x2, 0x4e23, @remote}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000001b80)="08001efbb07d586e", 0x8}], 0x1, 0x0, 0x0, 0x60000000}, 0x800) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) (async, rerun: 64) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) (async, rerun: 64) r5 = socket$nl_crypto(0x10, 0x3, 0x15) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r6, 0x84, 0x81, &(0x7f00000003c0)="1a00000002000100", 0x8) (async, rerun: 64) setsockopt(r6, 0x84, 0x80, &(0x7f00000002c0)="1a00000002000100", 0x8) (async, rerun: 64) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r8 = accept4(r7, 0x0, 0x0, 0x800) sendmmsg$alg(r8, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) r9 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="7c010000", @ANYRES16=r9, @ANYBLOB="000226bd7000fcdbdf250100000008000100ffffffff80000c803c000b8008000900a315525508000a00ec4600000800090095e4881608000a00f92c000008000900cbc4bc710800090093e6dc0808000a002f5900002c000b8008000900982cd74008000a004642000008000a001b4e000008000900357a16833f14000b8008000a000800000008000a0002000000e00008801400078008000500bffa832a08000500dc3d0d05340007800800060008000000080006004200000008000600db0000000800050087c7581308000500b377e64e08000600260000002c0007800800050033a1445708000600f200000008000500d484fd3b080005006fd0613f080006005100000054000780080005004437cd07080006008200000008000600d60000000800050072556b080800050032dac16e08000500b3c8b023080005004bdff27e0800050090eef52408000600f1000000080006007e0000001400078008000500b0f9fd6e08000600cb00"/374], 0x17c}, 0x1, 0x0, 0x0, 0xc000000}, 0x4804) (async, rerun: 64) sendmsg$netlink(r5, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000001080)={0xe0, 0x11, 0x509, 0x0, 0xfffffffd, "", [@generic="f00000000000803c00255bc4015e9b6fbec8af3c225cc4b40c649c0ceaf022c95732f4adf4140b96919b71fe0cc256f26228f9464a652d67efb6297e54709334451de3b1bea7bed647168061e24f6d19d1c4bbb10589a0ae736692eb148288c06ae7505965d7e81645188ea3fd6a8ce34ffc6bb18fcb4d5496bb33dab3d738e88c79a6477cfeabb6f2d8603f07fe1ac3d539806647374206efb255c25f93139bf8938481189439a8f58e69b9b4fc8cca04f5abf1993a1008e3b8f7a1d411e880a38dfef16d3ce80a07c0d4b95c"]}, 0xe0}], 0x1, 0x0, 0x0, 0x1}, 0x40040) (rerun: 64) 1.440356556s ago: executing program 3 (id=14118): bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, 0x0, 0x4000001) unshare(0xa020480) socket$inet_icmp(0x2, 0x2, 0x1) gettid() syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="3f9d00000000fedbdf251800000008000300", @ANYRES32=r2, @ANYBLOB="4800308014000400403a050c5baee2004ef2b6d713459a7a28000180080001"], 0x64}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r5) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r7], 0x1c}}, 0x4008054) write$nci(r4, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r4, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) write$nci(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="5001", @ANYRES8=r5, @ANYRES64=r3], 0x14) syz_genetlink_get_family_id$nl802154(0x0, r5) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={0x0, 0x0}, 0x28) socket(0xa, 0x3, 0x4) r8 = socket$inet(0x2, 0x3, 0x9) setsockopt$MRT_ADD_VIF(r8, 0x0, 0xca, 0x0, 0x0) 1.324661272s ago: executing program 1 (id=14119): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x28) (fail_nth: 5) 1.286756284s ago: executing program 4 (id=14120): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$SIOCPNENABLEPIPE(r0, 0x89ed, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r2, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r2, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x8031, 0xffffffffffffffff, 0x3f799000) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) writev(r1, 0x0, 0x0) writev(r1, &(0x7f0000000980)=[{&(0x7f0000000300)='v', 0x1}], 0x1) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000040)=0x8) 1.243229303s ago: executing program 0 (id=14121): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x18, 0x41, 0x1, 0x70bd2c, 0x4, {0x1}, [@nested={0x4, 0x85}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) 868.606584ms ago: executing program 0 (id=14122): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REQ_SET_REG(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c40)={0x24, r0, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'a\x00'}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040803}, 0x4000010) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40011) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000400)={@cgroup, 0x1d, 0x1, 0x7, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0], &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000500)={'vxcan0\x00', 0x0}) ioctl$XFS_IOC_PATH_TO_HANDLE(r3, 0xc0385869, &(0x7f0000000640)={r1, &(0x7f0000000540)='}(,*](\x00', 0x511180, &(0x7f0000000580)={@_ha_fsid={[0x79f2b0b6, 0x655c]}, {0x1a6, 0x5, 0x9, 0x8}}, 0xe, &(0x7f00000005c0), &(0x7f0000000600)=0x10001}) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000004c0)={@ifindex=r5, 0xffffffffffffffff, 0x27, 0x5c, 0x0, @void, @value=r6, @void, @void, r4}, 0x20) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket(0xa, 0xa, 0xfffffffe) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$inet6(0xa, 0x2, 0x0) close(r10) r11 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r11, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x3, 0x1, 0x8}, 0x20) setsockopt$inet6_int(r10, 0x29, 0x1000000000021, &(0x7f0000000040)=0x2005, 0x4) sendmsg$inet6(r11, &(0x7f0000000180)={&(0x7f0000000100)={0xa, 0x4e60, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3d}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000000000002900000037", @ANYRES32=r10], 0xb8}, 0x3400c8d4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd21, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0xc, 0xfff2}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r11, 0x84, 0x74, &(0x7f0000000680)=""/128, &(0x7f0000000700)=0x80) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r13, {0xb, 0xf}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) close(0x3) 866.796621ms ago: executing program 1 (id=14123): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010020000000000000000000000aec010000080a010200000000000000000000000a0c0003400000000000000005440005800800014000000033080001400000002108000140000000010800014000006007080001400000890d0800014000000029080001400000005c08000240000000030c00034000000000000000026801048020000180080001006f7366001400028008000140000000110800034000000001050001800b00010065787468647200004400028008000640000000020500020094000000080005400000000108000740000000000800054000000000080003400000004e080007400000000b0800054000000000140001800e000100627974656f72646572000000100001800b0001006e756d67656e0000100001800b00010074617267657400002c0001800a00010071756575650000001c0002800800044000000003060002400004000006000140000400005800018008000100647570004c000280080002400000000e0800024000000014080002400000001508000240000000130800024000000013080002400000000d0800024000000012080002400000000c08000240000000112400de7f0b00010074756e6e656c00001400028008000240000000020800014000000000140001800e000100627974656f726465720000000c000340000000000000000508000b4000000002940000000b0a010100000000000000000100000a0c00118008000100636d700008000a40000000023400098008000140000000071800028014000180080001400000000508000140000000b708000140000000040800014000000003080008400000000008000640000000000900010073797a300000000008000640ffffff0008000a40000000010900010073797a310000000034000000080a030000000000000000000700000416000740e06df29929d78b92d9e92de2d01bba3554b3000008000a40000000027c030000090a01030000000000000000050000040c0010400000000000000002d00212801c000180090001006d617371000000000c0002800800034000000014100001800a00010071756575650000001c00018011000100666c6f775f6f66666c6f616400000000040002803c0001800c0001007061796c6f6164002c00028008000440000000fb080001400000001d08000740000000090800054000000013080005400000000b100001800c0001007061796c6f6164002c0001800a00010071756f74610000001c0002800c00044000000000000000080c000140000000007fffffff0c00018008000100647570002c000180090001007866726d000000001c0002800800044000000002080002400000000108000440000000052000018008000100647570001400028008000140000000000800014000000012b40101800a0001006d61746368000000a401028008000100746f73000e000100737461746973746963000000080002400000000008000240000000030d00010064657667726f7570000000000b000100726563656e740000bb0003004cbfd044af9c8732d57f6cfbf8e602814713d83f30313d9edee9429f5763bb07797a634de1f93f9c585607b31a6999f3bb9ad7c8d914d72af008e4c147146142bea2e1c8bb1f15f57216424cd8e86d3e15c0753c49db0ef6f166d7db7bf3387b7cf38dd2dff0a0d83d2a44152980d81744cc05e199f1c909390160bf3a7790fea90631cff09d14820cf82a8d1f6a9d02a00c2bce24bf95b7d231167e6c2bfa975cd4e048ac8853391cec9f62e4a84e3a9cc4aed993c420009e000300bac20a15c8c4bbfe5966b8f22f8f430dfae9692e03b8423f8fccc72e2c2f9bcea401bfb02ba000e12caa6c1c5f246b9ba80a4c59066ff8f7cd521207f497be10370247291a0d732ad1763a33e05b9aae0686f0fe2f7739b951fb1ddb3c309cf7826fff1a00df5ea17ecd9f9e2b9e95c520f09e134572dee3863784a719594cc05e8a627b3cc79766e015ff682af9d506cd2ec2cfce7845d5e68a000008000340000000000900010073797a30000000000c000b4000000000000000060c0010400000000000000002400012801c0001800b00010072656a65637400000c0002800500020001000000100001800a0001006d61746368000000100001800b0001006c6f6f6b75700000080005400000003b0900020073797a31000000000900010073797a300000000060000000080a01020000000000000000010000070c00034000000000000000050900020073797a32000000000900010073797a30000000000c00064000000000000000050900020073797a320000000008000b400000000308000a400000000264000000030a010200000000000000000a0000074f000c00e239aa8c6abdc7b742a6c2ff1f941e170ee39a888d898ee6e9a8332637bc3db133374b4b33ee857b82a01227e15d185fd82d9b7920ab78ce79d3592afc8e50da7736b43d30cd6c720ad7e4002c010000000a01030000000000000000000000040c0004400000000000000005530006001306b0b90cedbc991dea4c33d6ca00a7f500aa983ada4491cc4b"], 0x848}}, 0x0) 678.778557ms ago: executing program 0 (id=14124): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtfilter={0x24, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x8, 0xf}, {}, {0x7, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) 554.655061ms ago: executing program 1 (id=14125): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xd, 0x4, 0x4, 0xfffffff, 0x0, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) 457.260434ms ago: executing program 0 (id=14126): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x4c000) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd60"], 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xffffffffffffff62, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 366.213024ms ago: executing program 1 (id=14127): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x4c000) socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0a000000050000000200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="12000000070000000400000002"], 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r2, &(0x7f00000003c0), &(0x7f0000000580)=@tcp=r3}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001f4ff00850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000008500000a20000000000a01030000000000000000070000000900010073797a300000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000002f3800128014000180090001006c6173740000000004000280200001800e000100636f6e6e6c696d69740000000c00028008000140000000060800034000000106140000001000010000000000000000000084000a00000000000021d238f0a9f0ca55d58313074f8d3e079394e7f0df2ba3788c85a6c0590821dd5d21ef731d62ec313b57833ef1eb41eb5b141e4b8d7718d462a6148568dd5b000036f38ad2af94435647631b9f0133e0d7fcd62317b1eabd9cb3925464153d3079b363f2262d049eae265a591c5b1d86d5af2cf23c4479a1974a00d14586639d585e9d41ba9756a4b8ec8bd9316030a446f5ce0c"], 0xc4}}, 0x804) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$unix(r6, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="0000000000000000000000f116cb6fd0f4de74c1ca75be92d34542270478fb7a73b30010000000000000a7af5f24c601f479943bca33062d5c7248fe945cbc489748b18a638b1547bb076f8e1bc8000000000000353239656a84706f969700"/112], 0x0) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0xb68, 0xffffffffffffff62, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r9, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x3, 0x1, 0x801, 0x0, 0x0, {0x0, 0x0, 0xa}, [@CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0xb5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000050) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000003c0)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000380)='g', 0x1, 0x8812, 0x0, 0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x3, 0x5, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1b}, [@call={0x85, 0x0, 0x0, 0x27}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f00000000c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r10, 0x0, 0xe, 0x0, &(0x7f0000000140)="5bd6bc1996ff006859a121fc0e0d", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) recvmmsg(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/133, 0x85}], 0x1}, 0x2}], 0x1, 0x162, 0x0) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="01002cbd7000fcdbdf25010000000000000009410000001c00180000000969623a76657468315f746f5f62617461647600009840d3ec92"], 0x38}, 0x1, 0x0, 0x0, 0x20000801}, 0x100) 366.039347ms ago: executing program 3 (id=14128): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)={0x30, r1, 0x1, 0x70bd25, 0x25dfdbfc, {{}, {0xffa6}, {0x14, 0x19, {0x80000000, 0x8, 0x0, 0x5}}}}, 0x30}, 0x1, 0x0, 0x0, 0x20040803}, 0x20000000) 283.861547ms ago: executing program 2 (id=14129): syz_emit_ethernet(0x5a, &(0x7f00000000c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xe, 0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x5, 0x0, @dev={0xac, 0x14, 0x14, 0x32}, @private=0xa010100, {[@timestamp_addr={0x44, 0x14, 0x5, 0x3, 0x0, [{@broadcast}, {@rand_addr=0x64010102, 0xfa9}]}, @lsrr={0x83, 0xb, 0xd3, [@initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102]}, @lsrr={0x83, 0x3, 0x4a}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x0, 0xfffd}}}}}}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) poll(0x0, 0x0, 0x400) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) write$tun(r0, &(0x7f0000000480)={@void, @void, @llc={@snap={0xaa, 0x1, "f595", "cefb6a", 0x6007, "82c73d622f6f0a855a12c6a389fbb629f2cdbcadf8e750a0bed136e1659478fca6a85263e4234e51c16b9f50e6f0a564ddf78fbed4b0ef94354ff3b55f6c894381ca91e23f0cfb5eff98b112074e0bc50a4dfa7b69abb13aa8f36a18e152e0717a65a6a0413cd0d39808ea9f6af5424e0523bc2e9f3d115545b124d4462906563fbcbb97afdb16640dc4f76822c9d69086f2ab939531270ffafcbd1ed9fcad684580210e7bc90aeebf94bcf0e8aea4fdec96c2c5e5a5abaeb0b58063e4cf9c9e4691438f4ea0c8052b375db74691"}}}, 0xd7) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r6, 0x0, 0x0, 0x40009d0) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newlink={0x5c, 0x10, 0x403, 0x70bd27, 0x3, {0x0, 0x0, 0x0, 0x0, 0x90446}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x24, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}, @IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x5f, 0x9}}]}]}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r9) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000600)={'wlan0\x00'}) 116.645029ms ago: executing program 3 (id=14130): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f00000002c0)=0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb000018000000000000002450120a8c5f8cf5ecb1f67d5900000024000000050000000000000002c1fa9dc9c9de4bce1378091a586fa5dfcc446aa5b72f157bde97b38f8e48fe2ae097af624139ca6287e2516667fb331fd01417b9daf4d6b826f8bb8f2f4bf9ed7034b3c5a4be8697dd0990e899cf194cfe07b69d158ad6f6a9464893fceee3d3757bfb1b5e40759a81e93f5474f47ba20e86c5ea8ea4cf9bb9f21dab0dfa1106b67ed03768d962331e3568c6f09c5c2d809efa074a9adf317f5e23a11d1f02a98211155c4372c05a9548461e3da835103de6eaa10f3a6ac459846db9c34b13f5231c326942818d67a3d64d39e85004d84606fad0"], &(0x7f0000000240)=""/220, 0x41, 0xdc, 0xa, 0xca6}, 0x28) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000100)={0x285}, 0x8) ppoll(&(0x7f0000000040)=[{r3, 0x5c}], 0x1, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x4}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "0000000000000000000100000e00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) sendmmsg$inet(r6, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={r5, 0x3ff}, &(0x7f00000001c0)=0x8) r10 = socket(0x40000000015, 0x5, 0x0) bind$can_raw(r10, &(0x7f0000000180), 0x10) r11 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_GET(r11, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x3f8, 0x100, 0x70bd2d, 0x25dfdbfc, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8800}, 0x24000000) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f00000008c0)={{r0, &(0x7f0000000580)='GPL\x00', 0x400, &(0x7f0000000640)={@align=0x8001, {0xfffc, 0x56d, 0x648, 0x8}}, 0x4, &(0x7f0000000680), &(0x7f00000006c0)=0x8}, {[0x0, 0x7, 0x5, 0x6]}, 0x100, 0xbb, &(0x7f0000000700)=""/187}) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$batadv(&(0x7f0000000e40), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r13, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r14, @ANYBLOB="050300000000000000000a000000040003"], 0x1c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000980)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r12, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x34, r14, 0x10, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r15}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xda}]}, 0x34}, 0x1, 0x0, 0x0, 0x40045}, 0x4801) 84.12796ms ago: executing program 1 (id=14131): socket$nl_generic(0x10, 0x3, 0x10) writev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000000)="8724866f", 0x4}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xb, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) socket$tipc(0x1e, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000940)) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x5}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc0d1}, 0x8800) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r2, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000100)={0x48, r3, 0x1, 0x0, 0x300, {}, [@ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_DEBUG_MSGMASK={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x14, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}, {0x4}]}]}]}, 0x48}}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r2, 0xc0385868, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000300), &(0x7f0000000340)=0x4) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c000200080001"], 0x3c}}, 0x40010) sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffb, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x10000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}, @IFLA_GRE_TOS={0x5, 0x9, 0x7}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x9}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) 80.564643ms ago: executing program 4 (id=14132): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x18, 0x41, 0x1, 0x70bd2c, 0x4, {0x1}, [@nested={0x4, 0x85}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x200080c4) 0s ago: executing program 4 (id=14133): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="230000000800000002000000ffff000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r0, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)='%-5lx \x00'}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x4e23, @multicast2}, 0x4, 0x0, 0x0, 0x3}}, 0x2e) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000380)='ns/ipc\x00') unshare(0x6a040000) r5 = socket(0x8, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_mreqsrc(r5, 0x0, 0x27, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)={0x34, r4, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x34}}, 0x20000034) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xb900, r1}, 0x38) kernel console output (not intermixed with test programs): ): Released all slaves [ 1535.313669][T17339] syzkaller1: entered promiscuous mode [ 1535.333268][T17339] syzkaller1: entered allmulticast mode [ 1536.252452][T17321] lo speed is unknown, defaulting to 1000 [ 1537.938827][T17447] __nla_validate_parse: 6 callbacks suppressed [ 1537.938847][T17447] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12777'. [ 1538.002361][T17448] syzkaller1: entered promiscuous mode [ 1538.040278][T17444] netlink: 'syz.0.12778': attribute type 1 has an invalid length. [ 1538.050693][T17448] syzkaller1: entered allmulticast mode [ 1538.093227][T17444] netlink: NAT attribute has 5 unknown bytes [ 1538.099849][T17444] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1538.306347][T17456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12779'. [ 1538.867219][T17490] sctp: [Deprecated]: syz.1.12790 (pid 17490) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1538.867219][T17490] Use struct sctp_sack_info instead [ 1538.917360][T17488] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12791'. [ 1539.005107][T17500] netlink: zone id is out of range [ 1539.028854][T17500] netlink: zone id is out of range [ 1539.046409][T17500] netlink: zone id is out of range [ 1539.052863][T17488] 8021q: adding VLAN 0 to HW filter on device bond69 [ 1539.069496][T17500] netlink: zone id is out of range [ 1539.097897][T17502] bond69: entered promiscuous mode [ 1539.105228][T17500] netlink: zone id is out of range [ 1539.121771][T17500] netlink: zone id is out of range [ 1539.137129][T17502] bond69: entered allmulticast mode [ 1539.146492][T17500] netlink: zone id is out of range [ 1539.196546][T17500] netlink: zone id is out of range [ 1539.496184][T17514] netlink: 'syz.4.12797': attribute type 21 has an invalid length. [ 1539.528683][T17514] netlink: 132 bytes leftover after parsing attributes in process `syz.4.12797'. [ 1539.573596][T17514] netlink: 'syz.4.12797': attribute type 1 has an invalid length. [ 1539.735812][T17522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12800'. [ 1540.352795][T17543] netlink: 'syz.4.12808': attribute type 1 has an invalid length. [ 1540.427004][T17547] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12807'. [ 1540.579971][T17551] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12809'. [ 1541.460412][T17571] bridge0: port 2(batadv0) entered blocking state [ 1541.476617][T17571] bridge0: port 2(batadv0) entered disabled state [ 1541.529421][T17571] batadv0: entered allmulticast mode [ 1541.586684][T17571] batadv0: entered promiscuous mode [ 1541.606549][T17571] vlan0: entered promiscuous mode [ 1541.624380][T17571] geneve0: entered promiscuous mode [ 1541.682440][T17576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12820'. [ 1541.890871][ T1101] batman_adv: batadv0: IGMP Querier appeared [ 1541.899476][ T1101] batman_adv: batadv0: MLD Querier appeared [ 1542.068975][T17608] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12825'. [ 1542.262380][T17616] FAULT_INJECTION: forcing a failure. [ 1542.262380][T17616] name failslab, interval 1, probability 0, space 0, times 0 [ 1542.294690][T17616] CPU: 1 UID: 0 PID: 17616 Comm: syz.4.12832 Not tainted syzkaller #0 PREEMPT(full) [ 1542.294718][T17616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1542.294731][T17616] Call Trace: [ 1542.294740][T17616] [ 1542.294750][T17616] dump_stack_lvl+0xe8/0x150 [ 1542.294785][T17616] should_fail_ex+0x40c/0x560 [ 1542.294818][T17616] should_failslab+0xa8/0x100 [ 1542.294851][T17616] __kmalloc_noprof+0xfe/0x720 [ 1542.294876][T17616] ? is_bpf_text_address+0x26/0x2b0 [ 1542.294907][T17616] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1542.294942][T17616] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1542.294972][T17616] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1542.295003][T17616] genl_family_rcv_msg_doit+0xda/0x340 [ 1542.295031][T17616] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1542.295061][T17616] ? apparmor_capable+0x126/0x170 [ 1542.295088][T17616] ? bpf_lsm_capable+0x9/0x20 [ 1542.295113][T17616] ? security_capable+0x7e/0x2c0 [ 1542.295148][T17616] genl_rcv_msg+0x614/0x7a0 [ 1542.295176][T17616] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1542.295195][T17616] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1542.295227][T17616] ? __pfx_nl80211_set_cqm+0x10/0x10 [ 1542.295256][T17616] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1542.295292][T17616] netlink_rcv_skb+0x226/0x4a0 [ 1542.295321][T17616] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1542.295344][T17616] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1542.295385][T17616] ? down_read+0x2be/0x330 [ 1542.295411][T17616] genl_rcv+0x28/0x40 [ 1542.295430][T17616] netlink_unicast+0x7bb/0x940 [ 1542.295466][T17616] netlink_sendmsg+0x813/0xb40 [ 1542.295504][T17616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1542.295554][T17616] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1542.295579][T17616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1542.295606][T17616] sock_sendmsg_nosec+0x13a/0x180 [ 1542.295642][T17616] ____sys_sendmsg+0x54e/0x850 [ 1542.295677][T17616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1542.295715][T17616] ? import_iovec+0x73/0xa0 [ 1542.295751][T17616] ___sys_sendmsg+0x2a5/0x360 [ 1542.295778][T17616] ? __lock_acquire+0x683/0x2cf0 [ 1542.295811][T17616] ? __pfx____sys_sendmsg+0x10/0x10 [ 1542.295878][T17616] ? __fget_files+0x2a/0x420 [ 1542.295904][T17616] ? __fget_files+0x3a2/0x420 [ 1542.295942][T17616] __x64_sys_sendmsg+0x1b1/0x290 [ 1542.295973][T17616] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1542.296021][T17616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1542.296045][T17616] do_syscall_64+0x174/0x580 [ 1542.296075][T17616] ? trace_irq_disable+0x3b/0x140 [ 1542.296101][T17616] ? clear_bhb_loop+0x70/0xc0 [ 1542.296128][T17616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1542.296149][T17616] RIP: 0033:0x7feebf19e0d9 [ 1542.296168][T17616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1542.296187][T17616] RSP: 002b:00007feec0010028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1542.296218][T17616] RAX: ffffffffffffffda RBX: 00007feebf425fa0 RCX: 00007feebf19e0d9 [ 1542.296234][T17616] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1542.296248][T17616] RBP: 00007feec0010090 R08: 0000000000000000 R09: 0000000000000000 [ 1542.296261][T17616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1542.296274][T17616] R13: 00007feebf426038 R14: 00007feebf425fa0 R15: 00007ffea6083168 [ 1542.296308][T17616] [ 1542.669438][T17618] netlink: 5 bytes leftover after parsing attributes in process `syz.0.12834'. [ 1542.681344][T17618] 1ªî{X¹¦: renamed from 30ªî{X¹¦ (while UP) [ 1542.703716][T17618] 1ªî{X¹¦: entered allmulticast mode [ 1543.250310][T17637] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12841'. [ 1543.291110][T17637] netlink: 28 bytes leftover after parsing attributes in process `syz.4.12841'. [ 1543.580510][T17643] net_ratelimit: 3 callbacks suppressed [ 1543.580532][T17643] openvswitch: netlink: Missing key (keys=200040, expected=80) [ 1543.746751][T17648] netlink: 'syz.1.12846': attribute type 1 has an invalid length. [ 1543.789099][T17648] netlink: 'syz.1.12846': attribute type 2 has an invalid length. [ 1544.338138][T17667] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12853'. [ 1544.746456][T17679] batadv0: entered promiscuous mode [ 1544.767112][T17679] batadv0: entered allmulticast mode [ 1544.789788][T17679] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1545.066118][T17685] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12860'. [ 1545.204806][T17691] netlink: 'syz.3.12863': attribute type 29 has an invalid length. [ 1545.439028][T17706] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12867'. [ 1546.208348][T17699] bridge5: port 1(erspan0) entered disabled state [ 1546.364295][T17699] tipc: Resetting bearer [ 1546.400825][T17699] tipc: Resetting bearer [ 1546.535256][T17731] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12871'. [ 1546.550989][T17732] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12872'. [ 1547.309326][T17699] ip6gretap1: left promiscuous mode [ 1547.727852][T17699] macvlan0: left promiscuous mode [ 1547.756434][T17699] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 1547.773118][T17699] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 1547.787710][T17699] bond47: left promiscuous mode [ 1547.793689][T17699] ipip1: left promiscuous mode [ 1547.828580][T17699] vlan2: left allmulticast mode [ 1547.844110][T17699] bridge4: left allmulticast mode [ 1547.863907][T17699] vlan3: left allmulticast mode [ 1547.879590][T17699] bridge5: left allmulticast mode [ 1547.892849][T17699] bond51: left promiscuous mode [ 1547.904213][T17699] ipip3: left promiscuous mode [ 1547.927496][T17699] bond53: left promiscuous mode [ 1547.937716][T17699] ip6gre2: left promiscuous mode [ 1547.978422][T17699] bond56: left promiscuous mode [ 1547.991568][T17699] ipip4: left promiscuous mode [ 1548.026408][T17699] macvlan1: left promiscuous mode [ 1548.039105][T17699] macvlan1: left allmulticast mode [ 1548.046028][T17699] ip6gre3: left promiscuous mode [ 1548.051764][T17699] ip6gre3: left allmulticast mode [ 1548.068729][T17699] bridge0: left promiscuous mode [ 1548.083335][T17699] vlan1: left promiscuous mode [ 1548.090269][T17699] geneve0: left promiscuous mode [ 1548.095919][T17699] macvtap1: left promiscuous mode [ 1548.115453][T17707] tipc: Resetting bearer [ 1548.123113][T17707] tipc: Resetting bearer [ 1548.136742][T17707] tipc: Resetting bearer [ 1548.144900][T17707] tipc: Resetting bearer [ 1548.171781][T17707] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1548.229372][ T1101] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1548.312566][ T1101] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1548.352316][ T1101] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1548.392576][T17742] netlink: 'syz.0.12871': attribute type 1 has an invalid length. [ 1548.439053][ T1101] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1548.641431][T17758] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12875'. [ 1548.896131][T17775] tipc: Failed to remove unknown binding: 66,0,0/231742723:2643659138/2643659140 [ 1548.914069][T17776] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12882'. [ 1548.939974][ C0] ip_tunnel_core: Dead loop on virtual device ipip10 (net 38), fix it urgently! [ 1548.950625][T17775] tipc: Failed to remove unknown binding: 66,0,0/231742723:2643659138/2643659139 [ 1548.990908][T17775] tipc: Failed to remove unknown binding: 66,0,0/231742723:2643659138/2643659140 [ 1549.027257][T17775] tipc: Failed to remove unknown binding: 66,0,0/231742723:2643659138/2643659139 [ 1549.121474][T17784] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12883'. [ 1549.139696][ C0] ip_tunnel_core: Dead loop on virtual device ipip10 (net 38), fix it urgently! [ 1549.170543][T17784] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1549.392832][T17796] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12885'. [ 1549.414696][T17798] FAULT_INJECTION: forcing a failure. [ 1549.414696][T17798] name failslab, interval 1, probability 0, space 0, times 0 [ 1549.469430][T17798] CPU: 0 UID: 0 PID: 17798 Comm: syz.2.12888 Not tainted syzkaller #0 PREEMPT(full) [ 1549.469459][T17798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1549.469472][T17798] Call Trace: [ 1549.469481][T17798] [ 1549.469491][T17798] dump_stack_lvl+0xe8/0x150 [ 1549.469526][T17798] should_fail_ex+0x40c/0x560 [ 1549.469568][T17798] should_failslab+0xa8/0x100 [ 1549.469600][T17798] __kmalloc_noprof+0xfe/0x720 [ 1549.469624][T17798] ? rcu_is_watching+0x15/0xb0 [ 1549.469653][T17798] ? tomoyo_realpath_from_path+0xef/0x640 [ 1549.469675][T17798] ? tomoyo_realpath_from_path+0xef/0x640 [ 1549.469705][T17798] tomoyo_realpath_from_path+0xef/0x640 [ 1549.469738][T17798] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1549.469769][T17798] tomoyo_path_number_perm+0x246/0x5f0 [ 1549.469801][T17798] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1549.469830][T17798] ? __lock_acquire+0x683/0x2cf0 [ 1549.469885][T17798] ? hook_file_ioctl+0x1f0/0x5f0 [ 1549.469939][T17798] ? __fget_files+0x2a/0x420 [ 1549.469969][T17798] ? __fget_files+0x2a/0x420 [ 1549.469996][T17798] ? __fget_files+0x3a2/0x420 [ 1549.470022][T17798] ? __fget_files+0x2a/0x420 [ 1549.470053][T17798] security_file_ioctl+0xc3/0x2a0 [ 1549.470085][T17798] __se_sys_ioctl+0x47/0x170 [ 1549.470105][T17798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1549.470129][T17798] do_syscall_64+0x174/0x580 [ 1549.470159][T17798] ? trace_irq_disable+0x3b/0x140 [ 1549.470185][T17798] ? clear_bhb_loop+0x70/0xc0 [ 1549.470212][T17798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1549.470234][T17798] RIP: 0033:0x7f413cd9e0d9 [ 1549.470254][T17798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1549.470273][T17798] RSP: 002b:00007f413aff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1549.470296][T17798] RAX: ffffffffffffffda RBX: 00007f413d025fa0 RCX: 00007f413cd9e0d9 [ 1549.470312][T17798] RDX: 0000200000000780 RSI: 00000000000089f2 RDI: 0000000000000003 [ 1549.470327][T17798] RBP: 00007f413aff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1549.470340][T17798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1549.470352][T17798] R13: 00007f413d026038 R14: 00007f413d025fa0 R15: 00007ffe2b8ef218 [ 1549.470386][T17798] [ 1549.470396][T17798] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1549.570558][ C0] ip_tunnel_core: Dead loop on virtual device ipip10 (net 38), fix it urgently! [ 1549.858289][T17806] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12890'. [ 1549.988847][T17811] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12892'. [ 1550.064644][T17811] netlink: 4356 bytes leftover after parsing attributes in process `syz.3.12892'. [ 1550.131128][T17811] netlink: 4356 bytes leftover after parsing attributes in process `syz.3.12892'. [ 1550.689187][T17830] netlink: 'syz.1.12898': attribute type 15 has an invalid length. [ 1550.802882][T17834] sctp: [Deprecated]: syz.4.12900 (pid 17834) Use of int in max_burst socket option. [ 1550.802882][T17834] Use struct sctp_assoc_value instead [ 1551.282636][T17849] netlink: 20 bytes leftover after parsing attributes in process `syz.1.12906'. [ 1551.309942][T17846] netlink: 'syz.0.12905': attribute type 3 has an invalid length. [ 1551.348484][T17846] netlink: 20 bytes leftover after parsing attributes in process `syz.0.12905'. [ 1551.900010][T17865] xt_hashlimit: overflow, try lower: 0/0 [ 1551.924718][T17868] netlink: 'syz.4.12910': attribute type 29 has an invalid length. [ 1552.668197][T17899] netlink: 'syz.1.12921': attribute type 4 has an invalid length. [ 1552.760941][T17906] netlink: 'syz.1.12921': attribute type 2 has an invalid length. [ 1553.768267][T17947] tipc: Failed to remove unknown binding: 66,0,0/231742723:1117745817/1117745819 [ 1553.836984][T17949] netlink: 'syz.1.12935': attribute type 2 has an invalid length. [ 1553.860016][T17947] tipc: Failed to remove unknown binding: 66,0,0/231742723:1117745817/1117745818 [ 1553.881732][T17949] FAULT_INJECTION: forcing a failure. [ 1553.881732][T17949] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1553.915768][T17947] tipc: Failed to remove unknown binding: 66,0,0/231742723:1117745817/1117745819 [ 1553.926813][T17949] CPU: 0 UID: 0 PID: 17949 Comm: syz.1.12935 Not tainted syzkaller #0 PREEMPT(full) [ 1553.926841][T17949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1553.926856][T17949] Call Trace: [ 1553.926865][T17949] [ 1553.926875][T17949] dump_stack_lvl+0xe8/0x150 [ 1553.926913][T17949] should_fail_ex+0x40c/0x560 [ 1553.926946][T17949] _copy_to_user+0x31/0xb0 [ 1553.926982][T17949] simple_read_from_buffer+0xe1/0x170 [ 1553.927018][T17949] proc_fail_nth_read+0x1bb/0x230 [ 1553.927053][T17949] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1553.927090][T17949] ? rw_verify_area+0x24a/0x4c0 [ 1553.927124][T17949] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1553.927153][T17949] vfs_read+0x213/0xa80 [ 1553.927197][T17949] ? __pfx___mutex_lock+0x10/0x10 [ 1553.927244][T17949] ? __pfx_vfs_read+0x10/0x10 [ 1553.927277][T17949] ? __fget_files+0x2a/0x420 [ 1553.927310][T17949] ? __fget_files+0x3a2/0x420 [ 1553.927336][T17949] ? __fget_files+0x2a/0x420 [ 1553.927373][T17949] ksys_read+0x150/0x270 [ 1553.927407][T17949] ? __pfx_ksys_read+0x10/0x10 [ 1553.927448][T17949] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1553.927472][T17949] do_syscall_64+0x174/0x580 [ 1553.927503][T17949] ? trace_irq_disable+0x3b/0x140 [ 1553.927529][T17949] ? clear_bhb_loop+0x70/0xc0 [ 1553.927557][T17949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1553.927579][T17949] RIP: 0033:0x7f4d60f5e90e [ 1553.927599][T17949] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1553.927617][T17949] RSP: 002b:00007f4d61e65fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1553.927640][T17949] RAX: ffffffffffffffda RBX: 00007f4d61e666c0 RCX: 00007f4d60f5e90e [ 1553.927656][T17949] RDX: 000000000000000f RSI: 00007f4d61e660a0 RDI: 0000000000000004 [ 1553.927668][T17949] RBP: 00007f4d61e66090 R08: 0000000000000000 R09: 0000000000000000 [ 1553.927682][T17949] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1553.927694][T17949] R13: 00007f4d61226038 R14: 00007f4d61225fa0 R15: 00007ffe0dacbaa8 [ 1553.927729][T17949] [ 1554.158504][T17947] tipc: Failed to remove unknown binding: 66,0,0/231742723:1117745817/1117745818 [ 1554.472986][T17963] netlink: 'syz.2.12938': attribute type 1 has an invalid length. [ 1554.863943][T17990] __nla_validate_parse: 4 callbacks suppressed [ 1554.863962][T17990] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12943'. [ 1555.191830][T17996] xt_hashlimit: overflow, try lower: 0/0 [ 1556.034897][T18017] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12951'. [ 1556.072670][T18017] batadv0 (unregistering): left allmulticast mode [ 1556.120559][T18017] batadv0 (unregistering): left promiscuous mode [ 1556.167598][T18017] bridge0: port 2(batadv0) entered disabled state [ 1556.215423][T18017] vlan0: left promiscuous mode [ 1556.242434][T18027] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.12950'. [ 1556.265205][T18017] geneve0: left promiscuous mode [ 1556.608754][T18038] netlink: 104 bytes leftover after parsing attributes in process `syz.3.12957'. [ 1556.648750][T18038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12957'. [ 1556.818736][T18046] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12959'. [ 1556.966796][T18046] bridge5: port 1(veth19) entered blocking state [ 1556.988155][T18046] bridge5: port 1(veth19) entered disabled state [ 1557.007810][T18046] veth19: entered allmulticast mode [ 1557.030288][T18046] veth19: entered promiscuous mode [ 1557.070803][T18050] bond43: (slave veth0_to_bond): Releasing active interface [ 1557.090081][T18050] bridge5: port 2(veth0_to_bond) entered blocking state [ 1557.105409][T18050] bridge5: port 2(veth0_to_bond) entered disabled state [ 1557.121507][T18050] veth0_to_bond: entered allmulticast mode [ 1557.135927][T18050] veth0_to_bond: entered promiscuous mode [ 1558.349433][T18097] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12973'. [ 1558.504736][T18106] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.12978'. [ 1558.791757][T18116] netlink: 'syz.0.12982': attribute type 2 has an invalid length. [ 1558.812232][T18116] netlink: 48 bytes leftover after parsing attributes in process `syz.0.12982'. [ 1559.399150][T18138] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12990'. [ 1560.056993][T18172] __nla_validate_parse: 1 callbacks suppressed [ 1560.057013][T18172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12998'. [ 1560.095719][T18172] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1560.265986][T18184] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13002'. [ 1560.354965][T18187] openvswitch: netlink: Flow key attr not present in new flow. [ 1560.894682][T18210] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.13009'. [ 1560.928664][T18214] netlink: 'syz.1.13008': attribute type 1 has an invalid length. [ 1560.974699][T18213] netlink: 'syz.1.13008': attribute type 1 has an invalid length. [ 1561.189835][T18213] 8021q: adding VLAN 0 to HW filter on device bond57 [ 1561.220727][T18220] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 1561.265914][T18223] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13013'. [ 1561.281048][T18220] IPVS: set_ctl: invalid protocol: 43 0.0.0.0:20004 [ 1561.315862][T18223] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1561.929651][T18244] tipc: Resetting bearer [ 1561.952862][T18244] tipc: Resetting bearer [ 1561.964082][T18244] tipc: Resetting bearer [ 1561.984782][T18244] tipc: Resetting bearer [ 1562.196885][T18243] tipc: Resetting bearer [ 1562.218775][T18243] tipc: Resetting bearer [ 1562.446485][T18243] tipc: Resetting bearer [ 1562.735997][T18263] openvswitch: netlink: Flow key attr not present in new flow. [ 1562.905447][T18268] openvswitch: netlink: Missing key (keys=200040, expected=80) [ 1563.071592][ C0] ip_tunnel_core: Dead loop on virtual device ipip10 (net 38), fix it urgently! [ 1563.178356][T18283] bridge9: the hash_elasticity option has been deprecated and is always 16 [ 1563.221473][T18283] bridge9: entered allmulticast mode [ 1563.319719][ C0] ip_tunnel_core: Dead loop on virtual device ipip10 (net 38), fix it urgently! [ 1563.349154][T18291] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13028'. [ 1563.384339][T18291] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1563.455925][T18296] tipc: Resetting bearer [ 1563.479782][ C0] ip_tunnel_core: Dead loop on virtual device ipip10 (net 38), fix it urgently! [ 1563.492043][T18296] tipc: Resetting bearer [ 1563.540832][T18302] "syz.3.13031" (18302) uses obsolete ecb(arc4) skcipher [ 1563.637423][T18296] tipc: Resetting bearer [ 1563.816112][T18306] netlink: 'syz.2.13033': attribute type 10 has an invalid length. [ 1564.039396][T18315] netlink: 76 bytes leftover after parsing attributes in process `syz.1.13035'. [ 1564.371442][T18320] IPv6: NLM_F_CREATE should be specified when creating new route [ 1564.598645][T18326] netlink: 64 bytes leftover after parsing attributes in process `syz.0.13037'. [ 1564.648950][T18326] netlink: 64 bytes leftover after parsing attributes in process `syz.0.13037'. [ 1564.758938][T18333] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13040'. [ 1564.890254][T18339] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13042'. [ 1564.908414][T18340] openvswitch: netlink: Missing key (keys=c0, expected=40300) [ 1565.204340][T18360] "syz.0.13048" (18360) uses obsolete ecb(arc4) skcipher [ 1565.383836][T18367] __nla_validate_parse: 1 callbacks suppressed [ 1565.383856][T18367] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.13052'. [ 1565.439136][T18370] gre0: Caught tx_queue_len zero misconfig [ 1565.747228][T18383] ip_tables: iptables: counters copy to user failed while replacing table [ 1565.991342][T18387] FAULT_INJECTION: forcing a failure. [ 1565.991342][T18387] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1566.039495][T18387] CPU: 0 UID: 0 PID: 18387 Comm: syz.4.13059 Not tainted syzkaller #0 PREEMPT(full) [ 1566.039527][T18387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1566.039540][T18387] Call Trace: [ 1566.039549][T18387] [ 1566.039560][T18387] dump_stack_lvl+0xe8/0x150 [ 1566.039597][T18387] should_fail_ex+0x40c/0x560 [ 1566.039630][T18387] _copy_to_user+0x31/0xb0 [ 1566.039667][T18387] simple_read_from_buffer+0xe1/0x170 [ 1566.039703][T18387] proc_fail_nth_read+0x1bb/0x230 [ 1566.039739][T18387] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1566.039774][T18387] ? rw_verify_area+0x24a/0x4c0 [ 1566.039809][T18387] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1566.039839][T18387] vfs_read+0x213/0xa80 [ 1566.039877][T18387] ? __pfx___mutex_lock+0x10/0x10 [ 1566.039912][T18387] ? __pfx_vfs_read+0x10/0x10 [ 1566.039946][T18387] ? __fget_files+0x2a/0x420 [ 1566.040077][T18387] ? __fget_files+0x3a2/0x420 [ 1566.040112][T18387] ? __fget_files+0x2a/0x420 [ 1566.040151][T18387] ksys_read+0x150/0x270 [ 1566.040189][T18387] ? __pfx_ksys_read+0x10/0x10 [ 1566.040221][T18387] ? __pfx_tun_chr_ioctl+0x10/0x10 [ 1566.040262][T18387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1566.040287][T18387] do_syscall_64+0x174/0x580 [ 1566.040320][T18387] ? trace_irq_disable+0x3b/0x140 [ 1566.040352][T18387] ? clear_bhb_loop+0x70/0xc0 [ 1566.040380][T18387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1566.040403][T18387] RIP: 0033:0x7feebf15e90e [ 1566.040424][T18387] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1566.040444][T18387] RSP: 002b:00007feec000ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1566.040468][T18387] RAX: ffffffffffffffda RBX: 00007feec00106c0 RCX: 00007feebf15e90e [ 1566.040485][T18387] RDX: 000000000000000f RSI: 00007feec00100a0 RDI: 000000000000000a [ 1566.040499][T18387] RBP: 00007feec0010090 R08: 0000000000000000 R09: 0000000000000000 [ 1566.040512][T18387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1566.040525][T18387] R13: 00007feebf426038 R14: 00007feebf425fa0 R15: 00007ffea6083168 [ 1566.040562][T18387] [ 1566.645703][T18406] lo: Caught tx_queue_len zero misconfig [ 1566.712855][T18409] netlink: 168 bytes leftover after parsing attributes in process `syz.4.13066'. [ 1566.976636][T18430] netlink: 'syz.1.13071': attribute type 15 has an invalid length. [ 1567.144396][T18434] netlink: 44 bytes leftover after parsing attributes in process `syz.3.13072'. [ 1567.188748][T18434] Bluetooth: hci0: unsupported parameter 5134 [ 1567.202881][T18436] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13073'. [ 1567.216095][T18434] Bluetooth: hci0: unsupported parameter 8192 [ 1567.228863][T18434] Bluetooth: hci0: unsupported parameter 5134 [ 1567.264092][T18434] Bluetooth: hci0: unsupported parameter 8192 [ 1567.686801][T18453] syzkaller1: entered promiscuous mode [ 1567.702689][T18453] syzkaller1: entered allmulticast mode [ 1567.761766][T18459] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13081'. [ 1567.787255][T18459] netlink: 1392 bytes leftover after parsing attributes in process `syz.1.13081'. [ 1567.797677][T18459] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1568.114669][T18474] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13085'. [ 1568.275267][T18480] netlink: 44 bytes leftover after parsing attributes in process `syz.4.13087'. [ 1568.290821][T18480] netlink: 43 bytes leftover after parsing attributes in process `syz.4.13087'. [ 1568.312528][T18480] netlink: 'syz.4.13087': attribute type 6 has an invalid length. [ 1568.340355][T18480] netlink: 'syz.4.13087': attribute type 5 has an invalid length. [ 1568.369201][T18480] netlink: 43 bytes leftover after parsing attributes in process `syz.4.13087'. [ 1568.899640][T18499] FAULT_INJECTION: forcing a failure. [ 1568.899640][T18499] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1568.957687][T18499] CPU: 0 UID: 0 PID: 18499 Comm: syz.0.13092 Not tainted syzkaller #0 PREEMPT(full) [ 1568.957718][T18499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1568.957731][T18499] Call Trace: [ 1568.957739][T18499] [ 1568.957749][T18499] dump_stack_lvl+0xe8/0x150 [ 1568.957785][T18499] should_fail_ex+0x40c/0x560 [ 1568.957817][T18499] _copy_to_user+0x31/0xb0 [ 1568.957851][T18499] simple_read_from_buffer+0xe1/0x170 [ 1568.957897][T18499] proc_fail_nth_read+0x1bb/0x230 [ 1568.957928][T18499] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1568.957960][T18499] ? rw_verify_area+0x24a/0x4c0 [ 1568.957991][T18499] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1568.958018][T18499] vfs_read+0x213/0xa80 [ 1568.958050][T18499] ? do_sock_getsockopt+0x51d/0x7e0 [ 1568.958079][T18499] ? __pfx_vfs_read+0x10/0x10 [ 1568.958107][T18499] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1568.958132][T18499] ? do_sys_openat2+0x14e/0x200 [ 1568.958164][T18499] ? kmem_cache_free+0x182/0x650 [ 1568.958187][T18499] ? fd_install+0x94/0x3d0 [ 1568.958226][T18499] ksys_read+0x150/0x270 [ 1568.958258][T18499] ? __pfx_ksys_read+0x10/0x10 [ 1568.958287][T18499] ? __x64_sys_getsockopt+0x1a4/0x240 [ 1568.958321][T18499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1568.958343][T18499] do_syscall_64+0x174/0x580 [ 1568.958372][T18499] ? trace_irq_disable+0x3b/0x140 [ 1568.958414][T18499] ? clear_bhb_loop+0x70/0xc0 [ 1568.958441][T18499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1568.958463][T18499] RIP: 0033:0x7fe3e315e90e [ 1568.958482][T18499] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1568.958500][T18499] RSP: 002b:00007fe3e401cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1568.958523][T18499] RAX: ffffffffffffffda RBX: 00007fe3e401d6c0 RCX: 00007fe3e315e90e [ 1568.958539][T18499] RDX: 000000000000000f RSI: 00007fe3e401d0a0 RDI: 0000000000000004 [ 1568.958552][T18499] RBP: 00007fe3e401d090 R08: 0000000000000000 R09: 0000000000000000 [ 1568.958565][T18499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1568.958577][T18499] R13: 00007fe3e3426038 R14: 00007fe3e3425fa0 R15: 00007ffcec9cf398 [ 1568.958611][T18499] [ 1569.639055][T18512] syzkaller1: entered promiscuous mode [ 1569.662576][T18512] syzkaller1: entered allmulticast mode [ 1574.002470][T18546] __nla_validate_parse: 5 callbacks suppressed [ 1574.002490][T18546] netlink: 64 bytes leftover after parsing attributes in process `syz.4.13109'. [ 1574.100365][T18548] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13108'. [ 1574.179972][T18552] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13111'. [ 1574.229134][T18552] openvswitch: netlink: Flow key attr not present in new flow. [ 1574.791723][T18568] netlink: 168 bytes leftover after parsing attributes in process `syz.3.13117'. [ 1574.919753][T18566] macvlan0: left promiscuous mode [ 1574.938283][T18576] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13116'. [ 1574.961647][T18566] ip6gre1: left allmulticast mode [ 1574.991376][T18579] netlink: 'syz.2.13116': attribute type 29 has an invalid length. [ 1575.000289][T18566] bond8: left allmulticast mode [ 1575.028187][T18566] erspan2: left allmulticast mode [ 1575.049528][T18566] bridge4: left allmulticast mode [ 1575.063213][T18566] bond9: left allmulticast mode [ 1575.081347][T18566] bridge5: left allmulticast mode [ 1575.105354][T18566] bond24: left allmulticast mode [ 1575.111445][T18566] bridge7: left allmulticast mode [ 1575.117352][T18566] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 1575.125275][T18566] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 1575.134562][T18566] vlan3: left allmulticast mode [ 1575.139891][T18566] bond31: left allmulticast mode [ 1575.149669][T18583] netlink: 28 bytes leftover after parsing attributes in process `syz.0.13115'. [ 1575.160993][T18566] veth11: left allmulticast mode [ 1575.174517][T18566] bridge10: left allmulticast mode [ 1575.191785][T18566] veth23: left allmulticast mode [ 1575.215784][T18566] bond61: left promiscuous mode [ 1575.222450][T18584] netlink: 28 bytes leftover after parsing attributes in process `syz.0.13115'. [ 1575.223440][T18566] ipip4: left promiscuous mode [ 1575.253791][T18566] gretap0: left allmulticast mode [ 1575.263119][T18566] macvlan2: left promiscuous mode [ 1575.268328][T18566] macvlan2: left allmulticast mode [ 1575.488639][T18590] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 1575.914702][T18602] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13126'. [ 1575.949570][T18604] netlink: 20 bytes leftover after parsing attributes in process `syz.1.13127'. [ 1575.996010][T18602] vlan4: entered promiscuous mode [ 1576.102572][T18609] netlink: 'syz.0.13128': attribute type 1 has an invalid length. [ 1576.119244][T18609] netlink: 84 bytes leftover after parsing attributes in process `syz.0.13128'. [ 1576.214275][T18617] netlink: 'syz.2.13130': attribute type 1 has an invalid length. [ 1576.242195][T18617] netlink: 'syz.2.13130': attribute type 2 has an invalid length. [ 1576.294399][T18617] netlink: 'syz.2.13130': attribute type 1 has an invalid length. [ 1576.317432][T18617] netlink: 'syz.2.13130': attribute type 2 has an invalid length. [ 1576.603700][T18634] netlink: 'syz.2.13135': attribute type 15 has an invalid length. [ 1576.892715][T18651] netlink: 'syz.2.13139': attribute type 11 has an invalid length. [ 1576.983334][T18654] tipc: Resetting bearer [ 1577.071036][T18654] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1577.090474][T18654] veth1_vlan: left promiscuous mode [ 1577.097304][T18654] veth0_vlan: entered promiscuous mode [ 1577.113997][T18654] veth1_vlan: entered promiscuous mode [ 1577.172640][T18654] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1577.210515][T18654] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1577.248324][T18654] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1577.272793][T18654] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1577.292385][T18654] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1577.540640][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1577.596925][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1577.709393][T15710] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1577.741265][T15710] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1577.957609][T18695] netlink: 'syz.2.13150': attribute type 1 has an invalid length. [ 1578.195816][T18695] 8021q: adding VLAN 0 to HW filter on device bond62 [ 1578.495681][T18695] bond62: (slave dummy0): Enslaving as an active interface with a down link [ 1578.568364][T18719] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 1578.856810][T18728] netlink: 'syz.0.13161': attribute type 6 has an invalid length. [ 1579.374845][T18750] __nla_validate_parse: 7 callbacks suppressed [ 1579.374863][T18750] netlink: 52 bytes leftover after parsing attributes in process `syz.1.13169'. [ 1579.447908][T18753] netlink: 52 bytes leftover after parsing attributes in process `syz.1.13169'. [ 1579.496786][T18755] Unknown options in mask 6 [ 1579.521410][T18755] netlink: 28 bytes leftover after parsing attributes in process `syz.0.13168'. [ 1579.567041][T18757] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13170'. [ 1579.575353][T18755] netlink: 36 bytes leftover after parsing attributes in process `syz.0.13168'. [ 1579.634279][T18746] netlink: 'syz.0.13168': attribute type 1 has an invalid length. [ 1579.669035][T18746] netlink: 224 bytes leftover after parsing attributes in process `syz.0.13168'. [ 1579.847026][T18751] tipc: Resetting bearer [ 1579.854621][ T7168] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1580.436370][T18780] xt_recent: hitcount (268435462) is larger than allowed maximum (65535) [ 1580.462071][T18782] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13176'. [ 1580.503794][T18782] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13176'. [ 1580.535079][T18785] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13180'. [ 1580.547847][T18782] netlink: 'syz.4.13176': attribute type 19 has an invalid length. [ 1580.567934][T18786] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13176'. [ 1580.598519][T18782] netlink: 'syz.4.13176': attribute type 20 has an invalid length. [ 1580.609282][T18786] netlink: 'syz.4.13176': attribute type 19 has an invalid length. [ 1580.669698][T18786] netlink: 'syz.4.13176': attribute type 20 has an invalid length. [ 1580.861310][ T7168] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1581.708664][T18819] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 1581.729889][T18819] netlink: 'syz.0.13192': attribute type 1 has an invalid length. [ 1582.010537][T18825] FAULT_INJECTION: forcing a failure. [ 1582.010537][T18825] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1582.063143][T18825] CPU: 0 UID: 0 PID: 18825 Comm: syz.2.13195 Not tainted syzkaller #0 PREEMPT(full) [ 1582.063174][T18825] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1582.063187][T18825] Call Trace: [ 1582.063197][T18825] [ 1582.063206][T18825] dump_stack_lvl+0xe8/0x150 [ 1582.063242][T18825] should_fail_ex+0x40c/0x560 [ 1582.063283][T18825] _copy_from_user+0x2d/0xb0 [ 1582.063316][T18825] do_ipv6_setsockopt+0x249/0x3180 [ 1582.063350][T18825] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1582.063383][T18825] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 1582.063406][T18825] ? get_pid_task+0x20/0x1f0 [ 1582.063445][T18825] ? __lock_acquire+0x683/0x2cf0 [ 1582.063492][T18825] ? aa_sk_perm+0x6d5/0x900 [ 1582.063523][T18825] ? __fget_files+0x2a/0x420 [ 1582.063555][T18825] ? __pfx_aa_sk_perm+0x10/0x10 [ 1582.063588][T18825] ? __fget_files+0x2a/0x420 [ 1582.063612][T18825] ? aa_sock_opt_perm+0xff/0x1a0 [ 1582.063635][T18825] ipv6_setsockopt+0x59/0x170 [ 1582.063657][T18825] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1582.063682][T18825] do_sock_setsockopt+0x17c/0x1b0 [ 1582.063712][T18825] __x64_sys_setsockopt+0x13d/0x1b0 [ 1582.063740][T18825] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1582.063762][T18825] do_syscall_64+0x174/0x580 [ 1582.063791][T18825] ? trace_irq_disable+0x3b/0x140 [ 1582.063814][T18825] ? clear_bhb_loop+0x70/0xc0 [ 1582.063840][T18825] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1582.063860][T18825] RIP: 0033:0x7f413cd9e0d9 [ 1582.063879][T18825] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1582.063896][T18825] RSP: 002b:00007f413aff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1582.063921][T18825] RAX: ffffffffffffffda RBX: 00007f413d025fa0 RCX: 00007f413cd9e0d9 [ 1582.063935][T18825] RDX: 000000000000001b RSI: 0000000000000029 RDI: 0000000000000003 [ 1582.063948][T18825] RBP: 00007f413aff6090 R08: 0000000000000014 R09: 0000000000000000 [ 1582.063961][T18825] R10: 0000200000000680 R11: 0000000000000246 R12: 0000000000000001 [ 1582.063973][T18825] R13: 00007f413d026038 R14: 00007f413d025fa0 R15: 00007ffe2b8ef218 [ 1582.064006][T18825] [ 1582.992054][T18862] FAULT_INJECTION: forcing a failure. [ 1582.992054][T18862] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1583.045134][T18862] CPU: 0 UID: 0 PID: 18862 Comm: syz.2.13207 Not tainted syzkaller #0 PREEMPT(full) [ 1583.045164][T18862] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1583.045177][T18862] Call Trace: [ 1583.045186][T18862] [ 1583.045196][T18862] dump_stack_lvl+0xe8/0x150 [ 1583.045231][T18862] should_fail_ex+0x40c/0x560 [ 1583.045263][T18862] _copy_from_iter+0x1d3/0x1660 [ 1583.045292][T18862] ? kmem_cache_alloc_node_noprof+0x101/0x610 [ 1583.045319][T18862] ? rcu_is_watching+0x15/0xb0 [ 1583.045351][T18862] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1583.045378][T18862] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1583.045403][T18862] ? __pfx__copy_from_iter+0x10/0x10 [ 1583.045430][T18862] ? __alloc_skb+0x276/0x7a0 [ 1583.045453][T18862] ? __alloc_skb+0x276/0x7a0 [ 1583.045484][T18862] ? netlink_sendmsg+0x650/0xb40 [ 1583.045512][T18862] ? skb_put+0x112/0x210 [ 1583.045540][T18862] netlink_sendmsg+0x6c0/0xb40 [ 1583.045599][T18862] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1583.045634][T18862] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1583.045663][T18862] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1583.045691][T18862] sock_sendmsg_nosec+0x13a/0x180 [ 1583.045736][T18862] ____sys_sendmsg+0x54e/0x850 [ 1583.045772][T18862] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1583.045811][T18862] ? import_iovec+0x73/0xa0 [ 1583.045847][T18862] ___sys_sendmsg+0x2a5/0x360 [ 1583.045875][T18862] ? __lock_acquire+0x683/0x2cf0 [ 1583.045909][T18862] ? __pfx____sys_sendmsg+0x10/0x10 [ 1583.045977][T18862] ? __fget_files+0x2a/0x420 [ 1583.046005][T18862] ? __fget_files+0x3a2/0x420 [ 1583.046048][T18862] __x64_sys_sendmsg+0x1b1/0x290 [ 1583.046081][T18862] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1583.046129][T18862] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1583.046154][T18862] do_syscall_64+0x174/0x580 [ 1583.046202][T18862] ? trace_irq_disable+0x3b/0x140 [ 1583.046230][T18862] ? clear_bhb_loop+0x70/0xc0 [ 1583.046258][T18862] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1583.046281][T18862] RIP: 0033:0x7f413cd9e0d9 [ 1583.046300][T18862] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1583.046319][T18862] RSP: 002b:00007f413aff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1583.046343][T18862] RAX: ffffffffffffffda RBX: 00007f413d025fa0 RCX: 00007f413cd9e0d9 [ 1583.046359][T18862] RDX: 0000000004040000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1583.046373][T18862] RBP: 00007f413aff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1583.046387][T18862] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1583.046400][T18862] R13: 00007f413d026038 R14: 00007f413d025fa0 R15: 00007ffe2b8ef218 [ 1583.046436][T18862] [ 1583.531744][T18871] Unknown options in mask 6 [ 1583.746584][T18878] tipc: Resetting bearer [ 1583.885144][T18896] FAULT_INJECTION: forcing a failure. [ 1583.885144][T18896] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1583.968575][T18896] CPU: 0 UID: 0 PID: 18896 Comm: syz.0.13214 Not tainted syzkaller #0 PREEMPT(full) [ 1583.968603][T18896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1583.968616][T18896] Call Trace: [ 1583.968624][T18896] [ 1583.968633][T18896] dump_stack_lvl+0xe8/0x150 [ 1583.968678][T18896] should_fail_ex+0x40c/0x560 [ 1583.968710][T18896] _copy_from_user+0x2d/0xb0 [ 1583.968743][T18896] ___sys_sendmsg+0x1c6/0x360 [ 1583.968769][T18896] ? __lock_acquire+0x683/0x2cf0 [ 1583.968801][T18896] ? __pfx____sys_sendmsg+0x10/0x10 [ 1583.968864][T18896] ? __fget_files+0x2a/0x420 [ 1583.968894][T18896] ? __fget_files+0x3a2/0x420 [ 1583.968931][T18896] __x64_sys_sendmsg+0x1b1/0x290 [ 1583.968960][T18896] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1583.969006][T18896] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1583.969029][T18896] do_syscall_64+0x174/0x580 [ 1583.969058][T18896] ? trace_irq_disable+0x3b/0x140 [ 1583.969083][T18896] ? clear_bhb_loop+0x70/0xc0 [ 1583.969108][T18896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1583.969129][T18896] RIP: 0033:0x7fe3e319e0d9 [ 1583.969148][T18896] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1583.969167][T18896] RSP: 002b:00007fe3e3ffc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1583.969188][T18896] RAX: ffffffffffffffda RBX: 00007fe3e3426090 RCX: 00007fe3e319e0d9 [ 1583.969204][T18896] RDX: 0000000000008000 RSI: 00002000000000c0 RDI: 0000000000000007 [ 1583.969217][T18896] RBP: 00007fe3e3ffc090 R08: 0000000000000000 R09: 0000000000000000 [ 1583.969230][T18896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1583.969242][T18896] R13: 00007fe3e3426128 R14: 00007fe3e3426090 R15: 00007ffcec9cf398 [ 1583.969275][T18896] [ 1584.503380][T18878] veth0_vlan: left promiscuous mode [ 1584.694713][ T7454] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1584.782290][T18917] __nla_validate_parse: 7 callbacks suppressed [ 1584.782307][T18917] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13221'. [ 1585.042983][T18923] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13222'. [ 1585.121866][T18917] vlan4: entered promiscuous mode [ 1585.208996][ T1117] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.260448][ T1117] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.294386][ T1117] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1585.376691][T18938] Unknown options in mask 6 [ 1585.898436][T18952] netlink: 'syz.3.13229': attribute type 15 has an invalid length. [ 1586.186804][T18964] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13233'. [ 1586.453113][T18980] Unknown options in mask 6 [ 1587.314749][T19008] syzkaller1: entered promiscuous mode [ 1587.352832][T19008] syzkaller1: entered allmulticast mode [ 1587.623495][T19031] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13249'. [ 1588.016231][T19049] netlink: 'syz.0.13254': attribute type 3 has an invalid length. [ 1588.052222][T19049] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13254'. [ 1588.478186][T19064] netlink: 36 bytes leftover after parsing attributes in process `syz.2.13259'. [ 1588.538454][T19068] Unknown options in mask 6 [ 1588.787290][T19077] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1588.830551][T19078] netlink: NAT attribute type 0 has unexpected length (1 != 0) [ 1588.860541][T19078] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1588.876245][T19083] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13264'. [ 1589.193060][T19093] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 1589.372592][T19101] netlink: 36 bytes leftover after parsing attributes in process `syz.3.13271'. [ 1589.547897][T19106] FAULT_INJECTION: forcing a failure. [ 1589.547897][T19106] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1589.640854][T19106] CPU: 0 UID: 0 PID: 19106 Comm: syz.0.13273 Not tainted syzkaller #0 PREEMPT(full) [ 1589.640884][T19106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1589.640898][T19106] Call Trace: [ 1589.640914][T19106] [ 1589.640923][T19106] dump_stack_lvl+0xe8/0x150 [ 1589.640963][T19106] should_fail_ex+0x40c/0x560 [ 1589.640994][T19106] _copy_from_user+0x2d/0xb0 [ 1589.641026][T19106] ___sys_sendmsg+0x1c6/0x360 [ 1589.641053][T19106] ? __lock_acquire+0x683/0x2cf0 [ 1589.641085][T19106] ? __pfx____sys_sendmsg+0x10/0x10 [ 1589.641150][T19106] ? __fget_files+0x2a/0x420 [ 1589.641177][T19106] ? __fget_files+0x3a2/0x420 [ 1589.641213][T19106] __x64_sys_sendmsg+0x1b1/0x290 [ 1589.641243][T19106] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1589.641285][T19106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1589.641306][T19106] do_syscall_64+0x174/0x580 [ 1589.641334][T19106] ? trace_irq_disable+0x3b/0x140 [ 1589.641357][T19106] ? clear_bhb_loop+0x70/0xc0 [ 1589.641379][T19106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1589.641399][T19106] RIP: 0033:0x7fe3e319e0d9 [ 1589.641419][T19106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1589.641435][T19106] RSP: 002b:00007fe3e401d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1589.641456][T19106] RAX: ffffffffffffffda RBX: 00007fe3e3425fa0 RCX: 00007fe3e319e0d9 [ 1589.641470][T19106] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000006 [ 1589.641482][T19106] RBP: 00007fe3e401d090 R08: 0000000000000000 R09: 0000000000000000 [ 1589.641495][T19106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1589.641507][T19106] R13: 00007fe3e3426038 R14: 00007fe3e3425fa0 R15: 00007ffcec9cf398 [ 1589.641538][T19106] [ 1589.670747][T19110] ip6gretap1: entered allmulticast mode [ 1590.033384][T19123] Unknown options in mask 6 [ 1590.389244][T19131] netlink: NAT attribute type 0 has unexpected length (1 != 0) [ 1590.399061][T19131] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1590.911336][T19152] netlink: 36 bytes leftover after parsing attributes in process `syz.1.13285'. [ 1590.937812][T19155] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13287'. [ 1591.246261][T19162] xfrm0 speed is unknown, defaulting to 1000 [ 1591.314864][T19167] netlink: 'syz.3.13290': attribute type 11 has an invalid length. [ 1591.543881][T19167] tipc: Resetting bearer [ 1591.586463][T19167] tipc: Resetting bearer [ 1591.695153][T19167] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1592.090959][T19186] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13295'. [ 1592.567572][T19201] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13299'. [ 1592.903928][T19213] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13302'. [ 1592.922925][T19173] xfrm0 speed is unknown, defaulting to 1000 [ 1592.936823][T19213] sctp: [Deprecated]: syz.3.13302 (pid 19213) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1592.936823][T19213] Use struct sctp_sack_info instead [ 1592.976360][T19162] lo speed is unknown, defaulting to 1000 [ 1593.272681][T19225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13305'. [ 1593.694822][T19173] lo speed is unknown, defaulting to 1000 [ 1593.903547][T19252] netlink: 36 bytes leftover after parsing attributes in process `syz.3.13311'. [ 1594.297745][T19264] netlink: ct family unspecified [ 1594.321320][T19264] openvswitch: netlink: Actions may not be safe on all matching packets [ 1594.997219][T19280] netlink: zone id is out of range [ 1595.033606][T19280] netlink: del zone limit has 4 unknown bytes [ 1595.668171][T19297] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13324'. [ 1595.776032][T19303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13323'. [ 1596.022038][T19308] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13326'. [ 1596.051545][T19308] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1596.811455][T19316] netlink: 'syz.1.13329': attribute type 2 has an invalid length. [ 1596.887321][T19321] FAULT_INJECTION: forcing a failure. [ 1596.887321][T19321] name failslab, interval 1, probability 0, space 0, times 0 [ 1596.936915][T19321] CPU: 0 UID: 0 PID: 19321 Comm: syz.0.13330 Not tainted syzkaller #0 PREEMPT(full) [ 1596.936946][T19321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1596.936958][T19321] Call Trace: [ 1596.936967][T19321] [ 1596.936976][T19321] dump_stack_lvl+0xe8/0x150 [ 1596.937011][T19321] should_fail_ex+0x40c/0x560 [ 1596.937044][T19321] should_failslab+0xa8/0x100 [ 1596.937080][T19321] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1596.937105][T19321] ? local_lock_release+0x9c/0x160 [ 1596.937132][T19321] ? __alloc_skb+0x1d7/0x7a0 [ 1596.937153][T19321] ? __alloc_skb+0x1d7/0x7a0 [ 1596.937183][T19321] __alloc_skb+0x1d7/0x7a0 [ 1596.937210][T19321] netlink_sendmsg+0x5d4/0xb40 [ 1596.937249][T19321] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1596.937281][T19321] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1596.937307][T19321] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1596.937333][T19321] sock_sendmsg_nosec+0x13a/0x180 [ 1596.937368][T19321] ____sys_sendmsg+0x54e/0x850 [ 1596.937401][T19321] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1596.937437][T19321] ? import_iovec+0x73/0xa0 [ 1596.937480][T19321] ___sys_sendmsg+0x2a5/0x360 [ 1596.937506][T19321] ? __lock_acquire+0x683/0x2cf0 [ 1596.937538][T19321] ? __pfx____sys_sendmsg+0x10/0x10 [ 1596.937601][T19321] ? __fget_files+0x2a/0x420 [ 1596.937626][T19321] ? __fget_files+0x3a2/0x420 [ 1596.937663][T19321] __x64_sys_sendmsg+0x1b1/0x290 [ 1596.937693][T19321] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1596.937738][T19321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1596.937761][T19321] do_syscall_64+0x174/0x580 [ 1596.937790][T19321] ? trace_irq_disable+0x3b/0x140 [ 1596.937816][T19321] ? clear_bhb_loop+0x70/0xc0 [ 1596.937841][T19321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1596.937872][T19321] RIP: 0033:0x7fe3e319e0d9 [ 1596.937890][T19321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1596.937906][T19321] RSP: 002b:00007fe3e401d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1596.937927][T19321] RAX: ffffffffffffffda RBX: 00007fe3e3425fa0 RCX: 00007fe3e319e0d9 [ 1596.937941][T19321] RDX: 0000000004008094 RSI: 0000200000000100 RDI: 0000000000000003 [ 1596.937953][T19321] RBP: 00007fe3e401d090 R08: 0000000000000000 R09: 0000000000000000 [ 1596.937965][T19321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1596.937975][T19321] R13: 00007fe3e3426038 R14: 00007fe3e3425fa0 R15: 00007ffcec9cf398 [ 1596.938007][T19321] [ 1597.657657][T19331] xfrm0 speed is unknown, defaulting to 1000 [ 1597.971051][T19338] §: left promiscuous mode [ 1598.011631][T19340] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13338'. [ 1598.054137][T19338] tipc: Resetting bearer [ 1598.237100][T19338] tipc: Resetting bearer [ 1598.544597][T19351] netlink: 'syz.4.13342': attribute type 29 has an invalid length. [ 1599.146928][T19338] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 1599.199476][T19338] mac80211_hwsim hwsim7 wlan0: left allmulticast mode [ 1599.215581][T19338] bridge1: left allmulticast mode [ 1599.223593][T19338] vlan2: left allmulticast mode [ 1599.228606][T19338] pimreg1: left allmulticast mode [ 1599.236123][T19338] vlan4: left promiscuous mode [ 1599.241839][T19338] veth0: left promiscuous mode [ 1599.250415][T19338] vlan5: left allmulticast mode [ 1599.255422][T19338] bridge2: left allmulticast mode [ 1599.261591][T19338] geneve6: left promiscuous mode [ 1599.266662][T19338] geneve6: left allmulticast mode [ 1599.275234][T19338] bond0: left promiscuous mode [ 1599.296634][T19338] bond44: left promiscuous mode [ 1599.309372][T19338] ipip1: left promiscuous mode [ 1599.318324][T19338] bond45: left promiscuous mode [ 1599.327725][T19338] ipip2: left promiscuous mode [ 1599.335228][T19338] gretap4: left promiscuous mode [ 1599.343470][T19338] bond54: left promiscuous mode [ 1599.411323][T19338] bridge9: left allmulticast mode [ 1599.490907][T19349] 8021q: adding VLAN 0 to HW filter on device ipvlan1 [ 1599.512183][T19331] lo speed is unknown, defaulting to 1000 [ 1599.902664][T19363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13344'. [ 1599.930154][ T7454] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1599.958501][T19381] Unknown options in mask 6 [ 1599.989067][T15710] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1600.009913][T15710] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1600.036906][T15710] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1600.358237][T19390] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13349'. [ 1600.943543][T19399] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13353'. [ 1600.954471][T19403] netlink: 'syz.2.13354': attribute type 5 has an invalid length. [ 1600.995113][T19404] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 40 [ 1601.317250][T19415] Unknown options in mask 6 [ 1601.639169][T19423] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13362'. [ 1601.682623][T19425] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13363'. [ 1601.889911][T19429] IPv6: NLM_F_CREATE should be specified when creating new route [ 1601.922065][T19429] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13365'. [ 1601.975716][T19441] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 1602.006821][T19441] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 1602.325457][T19447] xfrm0 speed is unknown, defaulting to 1000 [ 1603.266321][T19465] Unknown options in mask 6 [ 1603.636909][T19470] netlink: 'syz.0.13374': attribute type 1 has an invalid length. [ 1603.652617][T19469] "syz.2.13375" (19469) uses obsolete ecb(arc4) skcipher [ 1603.738705][T19470] bond71: entered promiscuous mode [ 1603.748699][T19470] 8021q: adding VLAN 0 to HW filter on device bond71 [ 1603.762592][T19447] lo speed is unknown, defaulting to 1000 [ 1603.843897][T19479] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13377'. [ 1603.867633][T19470] 8021q: adding VLAN 0 to HW filter on device bond71 [ 1603.889824][T19470] bond71: (slave ipip11): The slave device specified does not support setting the MAC address [ 1603.911978][T19470] bond71: (slave ipip11): Setting fail_over_mac to active for active-backup mode [ 1603.938046][T19470] bond71: (slave ipip11): making interface the new active one [ 1603.954420][T19470] ipip11: entered promiscuous mode [ 1603.971718][T19470] bond71: (slave ipip11): Enslaving as an active interface with an up link [ 1604.420785][T19501] netlink: 'syz.4.13381': attribute type 5 has an invalid length. [ 1604.660208][T19505] tipc: Resetting bearer [ 1604.715738][T19503] Unknown options in mask 6 [ 1604.896535][T19505] tipc: Resetting bearer [ 1604.961791][T19515] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13389'. [ 1605.111851][T19517] ip_tables: iptables: counters copy to user failed while replacing table [ 1605.192236][T19523] netlink: 184 bytes leftover after parsing attributes in process `syz.2.13392'. [ 1605.297547][T19517] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 1605.323493][T19517] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 1605.535362][T19530] "syz.0.13395" (19530) uses obsolete ecb(arc4) skcipher [ 1605.713822][T19537] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.13398'. [ 1605.902783][T19546] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13401'. [ 1605.924036][T19547] ip6_vti0: Caught tx_queue_len zero misconfig [ 1606.168357][T19554] netlink: 16 bytes leftover after parsing attributes in process `syz.4.13405'. [ 1606.214217][T19554] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13405'. [ 1606.244959][T19559] bond0: Caught tx_queue_len zero misconfig [ 1606.722731][T19587] netlink: 'syz.2.13417': attribute type 15 has an invalid length. [ 1606.749441][T19588] __nla_validate_parse: 6 callbacks suppressed [ 1606.749458][T19588] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13413'. [ 1607.350910][T19602] "syz.3.13422" (19602) uses obsolete ecb(arc4) skcipher [ 1607.752074][T19618] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13430'. [ 1607.808292][T19619] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13430'. [ 1608.042269][T19632] Unknown options in mask 6 [ 1608.289236][T21596] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1608.335974][T19628] tipc: Resetting bearer [ 1608.473124][T19642] netlink: 52 bytes leftover after parsing attributes in process `syz.4.13438'. [ 1608.830861][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1608.863466][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1608.901569][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1608.929109][T21596] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1608.934642][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1608.987420][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1609.000174][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1609.051505][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1609.091152][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1609.132489][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1609.168712][T19668] "syz.3.13447" (19668) uses obsolete ecb(arc4) skcipher [ 1609.212812][T19669] netlink: 52 bytes leftover after parsing attributes in process `syz.2.13448'. [ 1609.812545][T19689] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13452'. [ 1610.120576][T19654] net_ratelimit: 224 callbacks suppressed [ 1610.120597][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.161649][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.190378][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.234839][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.269873][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.317193][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.351355][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.388762][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.437705][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.468999][T19654] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1610.488630][T19712] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13458'. [ 1611.512388][T19736] "syz.3.13466" (19736) uses obsolete ecb(arc4) skcipher [ 1611.642881][T19741] syzkaller1: entered promiscuous mode [ 1611.664131][T19741] syzkaller1: entered allmulticast mode [ 1611.805374][T19741] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13468'. [ 1612.729533][T19774] netlink: 112 bytes leftover after parsing attributes in process `syz.2.13477'. [ 1612.765734][T19774] netlink: 56 bytes leftover after parsing attributes in process `syz.2.13477'. [ 1613.683652][T19790] "syz.1.13481" (19790) uses obsolete ecb(arc4) skcipher [ 1614.414690][T19798] xfrm0 speed is unknown, defaulting to 1000 [ 1614.841416][T19654] syz.0.13440 (19654) used greatest stack depth: 17008 bytes left [ 1616.100270][T19834] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13495'. [ 1616.156526][T19798] lo speed is unknown, defaulting to 1000 [ 1617.754354][T19861] sctp: [Deprecated]: syz.3.13503 (pid 19861) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1617.754354][T19861] Use struct sctp_sack_info instead [ 1619.238204][T19885] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13514'. [ 1619.796194][T19897] macsec0: entered allmulticast mode [ 1619.895076][T19905] veth1_macvtap: entered allmulticast mode [ 1619.921992][T19905] macsec0: left allmulticast mode [ 1619.937246][T19905] veth1_macvtap: left allmulticast mode [ 1619.984928][T19897] netlink: 352 bytes leftover after parsing attributes in process `syz.1.13520'. [ 1620.079664][T19897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13520'. [ 1620.096215][T19909] netlink: 'syz.2.13523': attribute type 6 has an invalid length. [ 1620.123859][T19909] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13523'. [ 1621.903696][T19951] netlink: 'syz.0.13536': attribute type 2 has an invalid length. [ 1622.832951][T21596] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1623.059513][T21596] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1623.106872][T19963] tipc: Resetting bearer [ 1623.647187][T19983] netlink: 'syz.4.13546': attribute type 11 has an invalid length. [ 1623.920721][T19993] tipc: Resetting bearer [ 1624.006346][T19995] Unknown options in mask 6 [ 1624.415455][T19993] tipc: Resetting bearer [ 1624.969590][T19992] veth1_vlan: left promiscuous mode [ 1625.005933][T19992] veth0_vlan: left promiscuous mode [ 1625.025012][T19992] veth0_vlan: entered promiscuous mode [ 1625.066032][T19992] veth1_vlan: entered promiscuous mode [ 1625.071910][T20027] Unknown options in mask 6 [ 1625.130189][T19992] veth1_macvtap: left promiscuous mode [ 1625.141009][T19992] veth0_macvtap: left promiscuous mode [ 1625.155925][T19992] veth0_macvtap: entered promiscuous mode [ 1625.165390][T19992] veth1_macvtap: entered promiscuous mode [ 1625.181002][T19992] net_ratelimit: 783 callbacks suppressed [ 1625.181020][T19992] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1625.350168][T16545] geneve0: entered promiscuous mode [ 1625.389518][T15710] bridge5: port 2(veth0_to_bond) entered blocking state [ 1625.397630][T15710] bridge5: port 2(veth0_to_bond) entered forwarding state [ 1625.810442][T17749] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1625.831179][T20024] tipc: Resetting bearer [ 1625.981423][T17749] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1626.509703][T20057] netlink: 44 bytes leftover after parsing attributes in process `syz.2.13562'. [ 1628.408628][T20080] netlink: 'syz.2.13568': attribute type 2 has an invalid length. [ 1628.978664][T20100] xfrm0 speed is unknown, defaulting to 1000 [ 1629.281741][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.313078][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.340220][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.355948][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.389946][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.446323][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.474659][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.484997][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1629.515268][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.191929][T20108] net_ratelimit: 78 callbacks suppressed [ 1630.191973][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.225158][T20126] tipc: Resetting bearer [ 1630.263121][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.303907][T20128] Unknown options in mask 6 [ 1630.376202][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.461191][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.533836][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.546434][T20126] tipc: Resetting bearer [ 1630.568032][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.601626][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.641609][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.672252][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.744109][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1630.801847][T20100] lo speed is unknown, defaulting to 1000 [ 1631.578107][T20145] netlink: 104 bytes leftover after parsing attributes in process `syz.2.13588'. [ 1631.642999][T20147] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13589'. [ 1633.312813][T20174] xt_hashlimit: overflow, try lower: 0/0 [ 1634.071206][T20185] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13598'. [ 1635.205623][T20108] net_ratelimit: 799 callbacks suppressed [ 1635.205645][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.245351][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.283580][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.325727][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.376278][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.416185][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.471211][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.570623][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.620848][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1635.704185][T20108] ip_tunnel_core: Dead loop on virtual device ipip11 (net 38), fix it urgently! [ 1636.138831][T20221] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 1636.171732][T20222] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13610'. [ 1636.209028][T20221] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 1636.387632][T20227] FAULT_INJECTION: forcing a failure. [ 1636.387632][T20227] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1636.464535][T20227] CPU: 0 UID: 0 PID: 20227 Comm: syz.2.13611 Not tainted syzkaller #0 PREEMPT(full) [ 1636.464561][T20227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1636.464573][T20227] Call Trace: [ 1636.464587][T20227] [ 1636.464595][T20227] dump_stack_lvl+0xe8/0x150 [ 1636.464645][T20227] should_fail_ex+0x40c/0x560 [ 1636.464678][T20227] _copy_to_user+0x31/0xb0 [ 1636.464713][T20227] simple_read_from_buffer+0xe1/0x170 [ 1636.464747][T20227] proc_fail_nth_read+0x1bb/0x230 [ 1636.464780][T20227] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1636.464814][T20227] ? rw_verify_area+0x24a/0x4c0 [ 1636.464847][T20227] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1636.464876][T20227] vfs_read+0x213/0xa80 [ 1636.464912][T20227] ? __pfx___mutex_lock+0x10/0x10 [ 1636.464947][T20227] ? __pfx_vfs_read+0x10/0x10 [ 1636.464988][T20227] ? __fget_files+0x2a/0x420 [ 1636.465020][T20227] ? __fget_files+0x3a2/0x420 [ 1636.465047][T20227] ? __fget_files+0x2a/0x420 [ 1636.465086][T20227] ksys_read+0x150/0x270 [ 1636.465123][T20227] ? __pfx_ksys_read+0x10/0x10 [ 1636.465165][T20227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1636.465190][T20227] do_syscall_64+0x174/0x580 [ 1636.465224][T20227] ? clear_bhb_loop+0x70/0xc0 [ 1636.465251][T20227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1636.465274][T20227] RIP: 0033:0x7f413cd5e90e [ 1636.465295][T20227] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1636.465315][T20227] RSP: 002b:00007f413aff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1636.465339][T20227] RAX: ffffffffffffffda RBX: 00007f413aff66c0 RCX: 00007f413cd5e90e [ 1636.465355][T20227] RDX: 000000000000000f RSI: 00007f413aff60a0 RDI: 0000000000000004 [ 1636.465369][T20227] RBP: 00007f413aff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1636.465383][T20227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1636.465396][T20227] R13: 00007f413d026038 R14: 00007f413d025fa0 R15: 00007ffe2b8ef218 [ 1636.465432][T20227] [ 1636.711893][T20222] 8021q: adding VLAN 0 to HW filter on device bond61 [ 1637.497129][T20247] tipc: Resetting bearer [ 1637.504433][T20247] tipc: Resetting bearer [ 1637.591072][T20251] Unknown options in mask 6 [ 1637.761871][T20253] tipc: Enabling of bearer rejected, already enabled [ 1637.770898][T20253] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 1637.778308][T20253] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 1638.068488][T20267] sctp: [Deprecated]: syz.2.13625 (pid 20267) Use of int in max_burst socket option. [ 1638.068488][T20267] Use struct sctp_assoc_value instead [ 1638.101645][T20267] netlink: 4 bytes leftover after parsing attributes in process `syz.2.13625'. [ 1638.391732][T20283] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13628'. [ 1638.661009][T20291] netlink: 'syz.2.13632': attribute type 11 has an invalid length. [ 1638.875611][T20293] tipc: Resetting bearer [ 1638.922283][T20293] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1639.011212][T20293] veth1_vlan: left promiscuous mode [ 1639.025101][T20293] veth0_vlan: entered promiscuous mode [ 1639.056742][T20293] veth1_vlan: entered promiscuous mode [ 1639.171085][T20293] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1639.193397][T20293] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1639.218507][T20293] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1639.244414][T20293] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1639.285177][T13172] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1639.295951][ T1101] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1639.304860][ T1101] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1639.313593][ T1101] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1639.504708][T20308] sctp: [Deprecated]: syz.3.13638 (pid 20308) Use of int in max_burst socket option. [ 1639.504708][T20308] Use struct sctp_assoc_value instead [ 1639.571981][T20310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13638'. [ 1639.712125][T20314] xfrm0 speed is unknown, defaulting to 1000 [ 1639.984182][T20327] netlink: 'syz.1.13642': attribute type 3 has an invalid length. [ 1640.035573][T20327] netlink: 'syz.1.13642': attribute type 4 has an invalid length. [ 1640.069235][T20327] netlink: 17 bytes leftover after parsing attributes in process `syz.1.13642'. [ 1640.240674][T20327] xt_CT: No such helper "snmp_trap" [ 1640.360429][T20337] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13645'. [ 1640.391975][T20337] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13645'. [ 1640.790555][T20314] lo speed is unknown, defaulting to 1000 [ 1641.056457][T20358] veth0: Caught tx_queue_len zero misconfig [ 1642.419150][T20405] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13665'. [ 1642.780793][T20421] tipc: Failed to remove unknown binding: 66,0,0/1134440221:2729121407/2729121409 [ 1642.790077][T20421] tipc: Failed to remove unknown binding: 66,0,0/1134440221:2729121407/2729121408 [ 1642.817383][T20421] tipc: Failed to remove unknown binding: 66,0,0/1134440221:2729121407/2729121409 [ 1642.826652][T20421] tipc: Failed to remove unknown binding: 66,0,0/1134440221:2729121407/2729121408 [ 1642.859285][T20417] netlink: 'syz.4.13670': attribute type 2 has an invalid length. [ 1643.160323][T20430] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13672'. [ 1643.307483][T20431] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13673'. [ 1643.316583][T20431] netlink: 35 bytes leftover after parsing attributes in process `syz.0.13673'. [ 1643.608726][T20444] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13678'. [ 1643.619833][T20444] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13678'. [ 1643.696614][T20447] FAULT_INJECTION: forcing a failure. [ 1643.696614][T20447] name failslab, interval 1, probability 0, space 0, times 0 [ 1643.709296][T20447] CPU: 0 UID: 0 PID: 20447 Comm: syz.2.13680 Not tainted syzkaller #0 PREEMPT(full) [ 1643.709325][T20447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1643.709338][T20447] Call Trace: [ 1643.709348][T20447] [ 1643.709357][T20447] dump_stack_lvl+0xe8/0x150 [ 1643.709397][T20447] should_fail_ex+0x40c/0x560 [ 1643.709432][T20447] should_failslab+0xa8/0x100 [ 1643.709466][T20447] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1643.709494][T20447] ? skb_clone+0x212/0x3a0 [ 1643.709524][T20447] ? skb_clone+0x212/0x3a0 [ 1643.709552][T20447] ? run_filter+0x23/0x270 [ 1643.709590][T20447] skb_clone+0x212/0x3a0 [ 1643.709617][T20447] ? packet_rcv+0x563/0x16f0 [ 1643.709649][T20447] packet_rcv+0x65d/0x16f0 [ 1643.709690][T20447] dev_queue_xmit_nit+0x5c9/0xac0 [ 1643.709717][T20447] ? dev_queue_xmit_nit+0x2d/0xac0 [ 1643.709751][T20447] dev_hard_start_xmit+0x1c1/0x830 [ 1643.709798][T20447] __dev_queue_xmit+0x14c0/0x3820 [ 1643.709827][T20447] ? do_syscall_64+0x174/0x580 [ 1643.709859][T20447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1643.709895][T20447] ? __dev_queue_xmit+0x29b/0x3820 [ 1643.709936][T20447] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1643.709985][T20447] ? __copy_skb_header+0xa3/0x4a0 [ 1643.710026][T20447] ? __skb_clone+0x449/0x6c0 [ 1643.710061][T20447] ? skb_clone+0x246/0x3a0 [ 1643.710093][T20447] __netlink_deliver_tap+0x5b4/0x860 [ 1643.710136][T20447] ? netlink_deliver_tap+0x2e/0x1b0 [ 1643.710179][T20447] netlink_deliver_tap+0x19c/0x1b0 [ 1643.710226][T20447] netlink_unicast+0x77f/0x940 [ 1643.710264][T20447] netlink_sendmsg+0x813/0xb40 [ 1643.710304][T20447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1643.710338][T20447] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1643.710368][T20447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1643.710396][T20447] sock_sendmsg_nosec+0x13a/0x180 [ 1643.710432][T20447] ____sys_sendmsg+0x54e/0x850 [ 1643.710465][T20447] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1643.710503][T20447] ? import_iovec+0x73/0xa0 [ 1643.710539][T20447] ___sys_sendmsg+0x2a5/0x360 [ 1643.710565][T20447] ? __lock_acquire+0x683/0x2cf0 [ 1643.710600][T20447] ? __pfx____sys_sendmsg+0x10/0x10 [ 1643.710668][T20447] ? __fget_files+0x2a/0x420 [ 1643.710695][T20447] ? __fget_files+0x3a2/0x420 [ 1643.710734][T20447] __x64_sys_sendmsg+0x1b1/0x290 [ 1643.710765][T20447] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1643.710814][T20447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1643.710837][T20447] do_syscall_64+0x174/0x580 [ 1643.710867][T20447] ? trace_irq_disable+0x3b/0x140 [ 1643.710895][T20447] ? clear_bhb_loop+0x70/0xc0 [ 1643.710922][T20447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1643.710944][T20447] RIP: 0033:0x7f413cd9e0d9 [ 1643.710965][T20447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1643.710990][T20447] RSP: 002b:00007f413aff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1643.711014][T20447] RAX: ffffffffffffffda RBX: 00007f413d025fa0 RCX: 00007f413cd9e0d9 [ 1643.711029][T20447] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000006 [ 1643.711043][T20447] RBP: 00007f413aff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1643.711057][T20447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1643.711069][T20447] R13: 00007f413d026038 R14: 00007f413d025fa0 R15: 00007ffe2b8ef218 [ 1643.711105][T20447] [ 1644.374755][T20451] xfrm0 speed is unknown, defaulting to 1000 [ 1644.469583][T20455] net_ratelimit: 121 callbacks suppressed [ 1644.469603][T20455] openvswitch: netlink: Flow key attr not present in new flow. [ 1644.612880][T20458] xt_hashlimit: overflow, try lower: 0/0 [ 1644.723476][T20463] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13686'. [ 1645.373739][T20484] netlink: 'syz.1.13690': attribute type 2 has an invalid length. [ 1645.691596][T20451] lo speed is unknown, defaulting to 1000 [ 1646.811795][T20526] netlink: 'syz.0.13705': attribute type 2 has an invalid length. [ 1646.832464][T20529] sctp: [Deprecated]: syz.1.13708 (pid 20529) Use of int in max_burst socket option. [ 1646.832464][T20529] Use struct sctp_assoc_value instead [ 1646.938160][T20529] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13708'. [ 1647.438807][T20542] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13715'. [ 1647.522592][T20549] FAULT_INJECTION: forcing a failure. [ 1647.522592][T20549] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1647.535693][T20549] CPU: 0 UID: 0 PID: 20549 Comm: syz.0.13716 Not tainted syzkaller #0 PREEMPT(full) [ 1647.535721][T20549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1647.535734][T20549] Call Trace: [ 1647.535744][T20549] [ 1647.535753][T20549] dump_stack_lvl+0xe8/0x150 [ 1647.535790][T20549] should_fail_ex+0x40c/0x560 [ 1647.535823][T20549] _copy_from_user+0x2d/0xb0 [ 1647.535858][T20549] __sys_bpf+0x2e7/0xd90 [ 1647.535896][T20549] ? __pfx___sys_bpf+0x10/0x10 [ 1647.535936][T20549] ? __fget_files+0x2a/0x420 [ 1647.535985][T20549] ? ksys_write+0x242/0x270 [ 1647.536020][T20549] ? __pfx_ksys_write+0x10/0x10 [ 1647.536057][T20549] __x64_sys_bpf+0xba/0xd0 [ 1647.536083][T20549] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1647.536108][T20549] do_syscall_64+0x174/0x580 [ 1647.536140][T20549] ? trace_irq_disable+0x3b/0x140 [ 1647.536167][T20549] ? clear_bhb_loop+0x70/0xc0 [ 1647.536194][T20549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1647.536216][T20549] RIP: 0033:0x7fe3e319e0d9 [ 1647.536236][T20549] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1647.536256][T20549] RSP: 002b:00007fe3e401d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1647.536279][T20549] RAX: ffffffffffffffda RBX: 00007fe3e3425fa0 RCX: 00007fe3e319e0d9 [ 1647.536294][T20549] RDX: 0000000000000028 RSI: 0000200000000380 RDI: 0000000000000012 [ 1647.536309][T20549] RBP: 00007fe3e401d090 R08: 0000000000000000 R09: 0000000000000000 [ 1647.536323][T20549] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1647.536336][T20549] R13: 00007fe3e3426038 R14: 00007fe3e3425fa0 R15: 00007ffcec9cf398 [ 1647.536378][T20549] [ 1647.542708][T20550] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.13714'. [ 1647.549372][T20546] sctp: [Deprecated]: syz.4.13717 (pid 20546) Use of int in max_burst socket option. [ 1647.549372][T20546] Use struct sctp_assoc_value instead [ 1647.745392][T20555] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13717'. [ 1647.923201][T20562] netlink: Conntrack attr has 12 unknown bytes [ 1647.929448][T20562] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1648.159358][T20568] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1648.262635][T20568] __nla_validate_parse: 3 callbacks suppressed [ 1648.262654][T20568] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13723'. [ 1648.642237][T20589] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13728'. [ 1648.676728][T20591] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 1648.686221][T20591] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1648.936016][T20601] sctp: [Deprecated]: syz.4.13732 (pid 20601) Use of int in max_burst socket option. [ 1648.936016][T20601] Use struct sctp_assoc_value instead [ 1649.030933][T20601] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13732'. [ 1649.275065][T20614] xfrm0 speed is unknown, defaulting to 1000 [ 1649.333784][T20617] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13734'. [ 1649.447747][T20622] openvswitch: netlink: Flow key attr not present in new flow. [ 1649.579343][T20627] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 1649.600993][T20627] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1649.638784][T20629] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13741'. [ 1650.488295][T20614] lo speed is unknown, defaulting to 1000 [ 1651.222712][T20668] netlink: 'syz.2.13753': attribute type 13 has an invalid length. [ 1651.266535][T20668] tipc: Resetting bearer [ 1651.342389][T20668] tipc: Resetting bearer [ 1651.852001][T20683] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13753'. [ 1652.112480][T20698] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13757'. [ 1652.154473][T20672] mac80211_hwsim hwsim11 syzkaller0: Caught tx_queue_len zero misconfig [ 1652.278655][T20697] bridge7: the hash_elasticity option has been deprecated and is always 16 [ 1652.287316][T20697] bridge7: entered allmulticast mode [ 1652.637784][T20709] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13759'. [ 1653.415204][T20743] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 1653.422743][T20743] mac80211_hwsim hwsim11 syzkaller0: entered allmulticast mode [ 1653.533702][T20744] xfrm0 speed is unknown, defaulting to 1000 [ 1653.600259][T20755] openvswitch: netlink: Flow key attr not present in new flow. [ 1654.148949][T20763] netlink: 168 bytes leftover after parsing attributes in process `syz.2.13770'. [ 1654.421612][T20770] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.13772'. [ 1654.813152][T20781] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13773'. [ 1654.837343][T20783] FAULT_INJECTION: forcing a failure. [ 1654.837343][T20783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1654.867122][T20783] CPU: 0 UID: 0 PID: 20783 Comm: syz.2.13776 Not tainted syzkaller #0 PREEMPT(full) [ 1654.867152][T20783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1654.867166][T20783] Call Trace: [ 1654.867175][T20783] [ 1654.867184][T20783] dump_stack_lvl+0xe8/0x150 [ 1654.867221][T20783] should_fail_ex+0x40c/0x560 [ 1654.867252][T20783] _copy_from_user+0x2d/0xb0 [ 1654.867285][T20783] ___sys_sendmsg+0x1c6/0x360 [ 1654.867323][T20783] ? __lock_acquire+0x683/0x2cf0 [ 1654.867357][T20783] ? __pfx____sys_sendmsg+0x10/0x10 [ 1654.867423][T20783] ? __fget_files+0x2a/0x420 [ 1654.867450][T20783] ? __fget_files+0x3a2/0x420 [ 1654.867488][T20783] __x64_sys_sendmsg+0x1b1/0x290 [ 1654.867519][T20783] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1654.867566][T20783] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1654.867590][T20783] do_syscall_64+0x174/0x580 [ 1654.867621][T20783] ? trace_irq_disable+0x3b/0x140 [ 1654.867647][T20783] ? clear_bhb_loop+0x70/0xc0 [ 1654.867674][T20783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1654.867696][T20783] RIP: 0033:0x7f413cd9e0d9 [ 1654.867717][T20783] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1654.867736][T20783] RSP: 002b:00007f413aff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1654.867758][T20783] RAX: ffffffffffffffda RBX: 00007f413d025fa0 RCX: 00007f413cd9e0d9 [ 1654.867774][T20783] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1654.867788][T20783] RBP: 00007f413aff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1654.867801][T20783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1654.867813][T20783] R13: 00007f413d026038 R14: 00007f413d025fa0 R15: 00007ffe2b8ef218 [ 1654.867846][T20783] [ 1655.197319][T20744] lo speed is unknown, defaulting to 1000 [ 1655.897732][T20805] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13782'. [ 1656.102757][T20817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13780'. [ 1656.385916][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.396197][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.406371][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.495116][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.505186][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.515239][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.525322][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.576285][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.586394][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.597802][T20824] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1656.838735][T20829] sctp: [Deprecated]: syz.3.13788 (pid 20829) Use of int in max_burst socket option. [ 1656.838735][T20829] Use struct sctp_assoc_value instead [ 1656.857409][T20829] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13788'. [ 1657.375760][T20837] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13790'. [ 1657.591332][T20841] sctp: [Deprecated]: syz.1.13791 (pid 20841) Use of int in max_burst socket option. [ 1657.591332][T20841] Use struct sctp_assoc_value instead [ 1657.626600][T20841] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13791'. [ 1657.905288][T20846] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 1657.912302][T20846] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 1658.009546][T20849] sctp: [Deprecated]: syz.2.13793 (pid 20849) Use of int in maxseg socket option. [ 1658.009546][T20849] Use struct sctp_assoc_value instead [ 1658.237642][T20855] netlink: 'syz.1.13797': attribute type 3 has an invalid length. [ 1658.379503][T20861] netlink: 'syz.3.13798': attribute type 11 has an invalid length. [ 1658.393236][T20855] netlink: 'syz.1.13797': attribute type 12 has an invalid length. [ 1658.925795][T20872] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13801'. [ 1659.185988][T20876] netlink: 56 bytes leftover after parsing attributes in process `syz.0.13802'. [ 1659.508498][T20882] xfrm0 speed is unknown, defaulting to 1000 [ 1660.234506][T20902] tipc: Enabling not permitted [ 1660.254700][T20902] tipc: Enabling of bearer rejected, failed to enable media [ 1660.492467][T20882] lo speed is unknown, defaulting to 1000 [ 1660.706551][T20913] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 1660.795324][T20913] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 1661.157293][T20917] netlink: 16 bytes leftover after parsing attributes in process `syz.4.13813'. [ 1661.480307][T20923] tipc: Resetting bearer [ 1661.486198][T20923] tipc: Resetting bearer [ 1661.616444][T20926] Unknown options in mask 6 [ 1661.735944][T20923] tipc: Resetting bearer [ 1661.978115][T20930] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13817'. [ 1662.389518][T20934] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13819'. [ 1662.643265][T20946] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13825'. [ 1662.652364][T20946] net_ratelimit: 1016 callbacks suppressed [ 1662.652381][T20946] openvswitch: netlink: Key 0 has unexpected len 12 expected 0 [ 1663.075044][T20956] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13826'. [ 1663.426611][T20956] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13826'. [ 1664.007123][T20969] netlink: 'syz.0.13826': attribute type 1 has an invalid length. [ 1664.287719][T20982] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1664.416522][T20975] xfrm0 speed is unknown, defaulting to 1000 [ 1664.422635][T20989] raw_sendmsg: syz.0.13832 forgot to set AF_INET. Fix it! [ 1664.791251][T20996] netlink: zone id is out of range [ 1664.796436][T20996] netlink: zone id is out of range [ 1664.801639][T20996] netlink: zone id is out of range [ 1664.806798][T20996] netlink: zone id is out of range [ 1664.811923][T20996] netlink: set zone limit has 8 unknown bytes [ 1664.996965][T20975] lo speed is unknown, defaulting to 1000 [ 1665.096201][T21004] ip_tables: iptables: counters copy to user failed while replacing table [ 1665.107735][T21004] netlink: 'syz.2.13838': attribute type 1 has an invalid length. [ 1665.146804][T21004] bond63: entered promiscuous mode [ 1665.152429][T21004] 8021q: adding VLAN 0 to HW filter on device bond63 [ 1665.218674][T21004] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13838'. [ 1665.227809][T21004] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13838'. [ 1665.324707][T21008] "syz.3.13839" (21008) uses obsolete ecb(arc4) skcipher [ 1665.469942][T21010] sctp: [Deprecated]: syz.4.13840 (pid 21010) Use of int in max_burst socket option. [ 1665.469942][T21010] Use struct sctp_assoc_value instead [ 1665.507704][T21011] FAULT_INJECTION: forcing a failure. [ 1665.507704][T21011] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1665.521005][T21011] CPU: 0 UID: 0 PID: 21011 Comm: syz.3.13839 Not tainted syzkaller #0 PREEMPT(full) [ 1665.521034][T21011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1665.521047][T21011] Call Trace: [ 1665.521056][T21011] [ 1665.521066][T21011] dump_stack_lvl+0xe8/0x150 [ 1665.521102][T21011] should_fail_ex+0x40c/0x560 [ 1665.521154][T21011] prepare_alloc_pages+0x230/0x650 [ 1665.521193][T21011] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1665.521227][T21011] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1665.521260][T21011] ? __pfx_policy_nodemask+0x10/0x10 [ 1665.521302][T21011] alloc_pages_mpol+0x212/0x380 [ 1665.521339][T21011] folio_alloc_mpol_noprof+0x39/0x160 [ 1665.521373][T21011] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1665.521408][T21011] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1665.521451][T21011] do_wp_page+0x1163/0x4c70 [ 1665.521494][T21011] ? __pfx_do_wp_page+0x10/0x10 [ 1665.521513][T21011] ? do_raw_spin_lock+0x12b/0x2f0 [ 1665.521540][T21011] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1665.521575][T21011] handle_mm_fault+0x1490/0x3080 [ 1665.521613][T21011] ? handle_mm_fault+0xec/0x3080 [ 1665.521652][T21011] ? __pfx_handle_mm_fault+0x10/0x10 [ 1665.521676][T21011] ? follow_page_pte+0xbd0/0xe70 [ 1665.521708][T21011] ? __pfx_follow_page_pte+0x10/0x10 [ 1665.521744][T21011] __get_user_pages+0x1678/0x2720 [ 1665.521816][T21011] __gup_longterm_locked+0xd52/0x15c0 [ 1665.521852][T21011] ? sanity_check_pinned_pages+0x817/0x8d0 [ 1665.521893][T21011] gup_fast_fallback+0x1d8c/0x20e0 [ 1665.521919][T21011] ? __kernel_text_address+0xd/0x30 [ 1665.521982][T21011] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1665.522002][T21011] ? do_raw_spin_lock+0x12b/0x2f0 [ 1665.522027][T21011] ? __kmalloc_noprof+0x1ad/0x720 [ 1665.522053][T21011] ? is_valid_gup_args+0x11f/0x200 [ 1665.522079][T21011] ? pin_user_pages_fast+0x4d/0xb0 [ 1665.522105][T21011] iov_iter_extract_pages+0x3a1/0x690 [ 1665.522149][T21011] extract_iter_to_sg+0xeda/0x2610 [ 1665.522196][T21011] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 1665.522234][T21011] ? rcu_is_watching+0x15/0xb0 [ 1665.522268][T21011] ? trace_kmalloc+0x2a/0xf0 [ 1665.522297][T21011] ? __asan_memset+0x22/0x50 [ 1665.522325][T21011] af_alg_get_rsgl+0x493/0x8d0 [ 1665.522367][T21011] ? af_alg_alloc_areq+0xac/0x200 [ 1665.522396][T21011] skcipher_recvmsg+0x39d/0xe10 [ 1665.522447][T21011] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1665.522474][T21011] ? __lock_acquire+0x683/0x2cf0 [ 1665.522502][T21011] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1665.522526][T21011] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1665.522548][T21011] ? security_socket_recvmsg+0x7e/0x2c0 [ 1665.522576][T21011] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1665.522606][T21011] sock_recvmsg+0x196/0x1e0 [ 1665.522640][T21011] ____sys_recvmsg+0x1e6/0x4a0 [ 1665.522680][T21011] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1665.522729][T21011] ? import_iovec+0x73/0xa0 [ 1665.522766][T21011] ___sys_recvmsg+0x213/0x5a0 [ 1665.522802][T21011] ? __pfx____sys_recvmsg+0x10/0x10 [ 1665.522838][T21011] ? __fget_files+0x2a/0x420 [ 1665.522887][T21011] ? __fget_files+0x3a2/0x420 [ 1665.522938][T21011] do_recvmmsg+0x31a/0x7f0 [ 1665.522977][T21011] ? __pfx_do_recvmmsg+0x10/0x10 [ 1665.523019][T21011] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1665.523054][T21011] ? __fget_files+0x3a2/0x420 [ 1665.523093][T21011] __x64_sys_recvmmsg+0x198/0x250 [ 1665.523126][T21011] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1665.523166][T21011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.523190][T21011] do_syscall_64+0x174/0x580 [ 1665.523222][T21011] ? trace_irq_disable+0x3b/0x140 [ 1665.523248][T21011] ? clear_bhb_loop+0x70/0xc0 [ 1665.523275][T21011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1665.523297][T21011] RIP: 0033:0x7f0a3c79e0d9 [ 1665.523317][T21011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1665.523336][T21011] RSP: 002b:00007f0a3d69e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1665.523359][T21011] RAX: ffffffffffffffda RBX: 00007f0a3ca26090 RCX: 00007f0a3c79e0d9 [ 1665.523375][T21011] RDX: 0000000000000001 RSI: 0000200000000480 RDI: 0000000000000004 [ 1665.523388][T21011] RBP: 00007f0a3d69e090 R08: 0000000000000000 R09: 0000000000000000 [ 1665.523402][T21011] R10: 0000000000010100 R11: 0000000000000246 R12: 0000000000000001 [ 1665.523415][T21011] R13: 00007f0a3ca26128 R14: 00007f0a3ca26090 R15: 00007ffdbf215f78 [ 1665.523450][T21011] [ 1665.532120][T21010] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13840'. [ 1666.027612][T21015] sctp: [Deprecated]: syz.0.13841 (pid 21015) Use of int in max_burst socket option. [ 1666.027612][T21015] Use struct sctp_assoc_value instead [ 1666.102738][T21004] bond63: (slave bridge16): making interface the new active one [ 1666.124410][T21004] bridge16: entered promiscuous mode [ 1666.134139][T21004] bond63: (slave bridge16): Enslaving as an active interface with an up link [ 1666.306166][T21015] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13841'. [ 1666.595491][T21025] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13844'. [ 1667.108476][T21035] netlink: 168 bytes leftover after parsing attributes in process `syz.2.13849'. [ 1667.908815][T21062] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.13853'. [ 1668.013706][T21065] FAULT_INJECTION: forcing a failure. [ 1668.013706][T21065] name failslab, interval 1, probability 0, space 0, times 0 [ 1668.046656][T21067] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 1668.084898][T21067] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 1668.108901][T21065] CPU: 1 UID: 0 PID: 21065 Comm: syz.1.13854 Not tainted syzkaller #0 PREEMPT(full) [ 1668.108929][T21065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1668.108942][T21065] Call Trace: [ 1668.108951][T21065] [ 1668.108960][T21065] dump_stack_lvl+0xe8/0x150 [ 1668.109012][T21065] should_fail_ex+0x40c/0x560 [ 1668.109044][T21065] should_failslab+0xa8/0x100 [ 1668.109076][T21065] __kmalloc_noprof+0xfe/0x720 [ 1668.109102][T21065] ? is_bpf_text_address+0x26/0x2b0 [ 1668.109131][T21065] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1668.109154][T21065] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1668.109185][T21065] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1668.109210][T21065] ? kernel_text_address+0xa5/0xe0 [ 1668.109245][T21065] genl_family_rcv_msg_doit+0xda/0x340 [ 1668.109275][T21065] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1668.109305][T21065] ? apparmor_capable+0x126/0x170 [ 1668.109333][T21065] ? bpf_lsm_capable+0x9/0x20 [ 1668.109358][T21065] ? security_capable+0x7e/0x2c0 [ 1668.109397][T21065] genl_rcv_msg+0x614/0x7a0 [ 1668.109426][T21065] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1668.109446][T21065] ? __pfx_psp_device_get_locked_dev_assoc+0x10/0x10 [ 1668.109469][T21065] ? __pfx_psp_nl_dev_assoc_doit+0x10/0x10 [ 1668.109492][T21065] ? __pfx_psp_device_unlock+0x10/0x10 [ 1668.109530][T21065] netlink_rcv_skb+0x226/0x4a0 [ 1668.109559][T21065] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1668.109582][T21065] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1668.109626][T21065] ? down_read+0x2be/0x330 [ 1668.109653][T21065] genl_rcv+0x28/0x40 [ 1668.109672][T21065] netlink_unicast+0x7bb/0x940 [ 1668.109709][T21065] netlink_sendmsg+0x813/0xb40 [ 1668.109748][T21065] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1668.109782][T21065] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1668.109809][T21065] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1668.109836][T21065] sock_sendmsg_nosec+0x13a/0x180 [ 1668.109871][T21065] ____sys_sendmsg+0x54e/0x850 [ 1668.109905][T21065] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1668.109942][T21065] ? import_iovec+0x73/0xa0 [ 1668.109977][T21065] ___sys_sendmsg+0x2a5/0x360 [ 1668.110009][T21065] ? __lock_acquire+0x683/0x2cf0 [ 1668.110041][T21065] ? __pfx____sys_sendmsg+0x10/0x10 [ 1668.110106][T21065] ? __fget_files+0x2a/0x420 [ 1668.110133][T21065] ? __fget_files+0x3a2/0x420 [ 1668.110188][T21065] __x64_sys_sendmsg+0x1b1/0x290 [ 1668.110218][T21065] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1668.110281][T21065] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.110304][T21065] do_syscall_64+0x174/0x580 [ 1668.110336][T21065] ? clear_bhb_loop+0x70/0xc0 [ 1668.110362][T21065] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.110383][T21065] RIP: 0033:0x7f4d60f9e0d9 [ 1668.110402][T21065] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1668.110421][T21065] RSP: 002b:00007f4d61e66028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1668.110443][T21065] RAX: ffffffffffffffda RBX: 00007f4d61225fa0 RCX: 00007f4d60f9e0d9 [ 1668.110458][T21065] RDX: 0000000000040010 RSI: 0000200000000240 RDI: 0000000000000003 [ 1668.110472][T21065] RBP: 00007f4d61e66090 R08: 0000000000000000 R09: 0000000000000000 [ 1668.110488][T21065] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1668.110501][T21065] R13: 00007f4d61226038 R14: 00007f4d61225fa0 R15: 00007ffe0dacbaa8 [ 1668.110535][T21065] [ 1668.970345][T21086] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13856'. [ 1669.317023][T21098] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1669.334931][T21095] xfrm0 speed is unknown, defaulting to 1000 [ 1670.544356][T21095] lo speed is unknown, defaulting to 1000 [ 1670.792016][T21126] netlink: 'syz.4.13869': attribute type 11 has an invalid length. [ 1670.840381][T21130] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13871'. [ 1671.341143][T21141] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13873'. [ 1671.405433][T21141] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13873'. [ 1671.902838][T21161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13877'. [ 1671.911940][T21161] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13877'. [ 1671.937309][T21161] netlink: 'syz.1.13877': attribute type 12 has an invalid length. [ 1671.951463][T21161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13877'. [ 1671.960787][T21161] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13877'. [ 1671.969770][T21161] netlink: 'syz.1.13877': attribute type 12 has an invalid length. [ 1672.053925][T21161] sctp: [Deprecated]: syz.1.13877 (pid 21161) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1672.053925][T21161] Use struct sctp_sack_info instead [ 1672.400311][T21175] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13883'. [ 1672.405387][T21174] FAULT_INJECTION: forcing a failure. [ 1672.405387][T21174] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1672.463918][T21174] CPU: 1 UID: 0 PID: 21174 Comm: syz.4.13882 Not tainted syzkaller #0 PREEMPT(full) [ 1672.463947][T21174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1672.463961][T21174] Call Trace: [ 1672.463969][T21174] [ 1672.463978][T21174] dump_stack_lvl+0xe8/0x150 [ 1672.464012][T21174] should_fail_ex+0x40c/0x560 [ 1672.464042][T21174] _copy_from_user+0x2d/0xb0 [ 1672.464084][T21174] sctp_setsockopt+0x1c4/0x12c0 [ 1672.464114][T21174] ? sock_common_setsockopt+0x36/0xc0 [ 1672.464135][T21174] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1672.464158][T21174] do_sock_setsockopt+0x17c/0x1b0 [ 1672.464193][T21174] __x64_sys_setsockopt+0x13d/0x1b0 [ 1672.464219][T21174] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.464241][T21174] do_syscall_64+0x174/0x580 [ 1672.464268][T21174] ? trace_irq_disable+0x3b/0x140 [ 1672.464292][T21174] ? clear_bhb_loop+0x70/0xc0 [ 1672.464316][T21174] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1672.464334][T21174] RIP: 0033:0x7feebf19e0d9 [ 1672.464352][T21174] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1672.464387][T21174] RSP: 002b:00007feec0010028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1672.464408][T21174] RAX: ffffffffffffffda RBX: 00007feebf425fa0 RCX: 00007feebf19e0d9 [ 1672.464424][T21174] RDX: 0000000000000071 RSI: 0000000000000084 RDI: 0000000000000003 [ 1672.464436][T21174] RBP: 00007feec0010090 R08: 0000000000000008 R09: 0000000000000000 [ 1672.464449][T21174] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 1672.464462][T21174] R13: 00007feebf426038 R14: 00007feebf425fa0 R15: 00007ffea6083168 [ 1672.464494][T21174] [ 1676.174152][T21275] netlink: NAT attribute type 0 has unexpected length (1 != 0) [ 1676.233647][T21275] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1676.720556][T21292] netlink: 20 bytes leftover after parsing attributes in process `syz.4.13916'. [ 1676.734302][T21293] netlink: 168 bytes leftover after parsing attributes in process `syz.0.13915'. [ 1676.795982][T21292] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 1677.105188][T21306] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13917'. [ 1677.114345][T21306] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 1679.590097][T21315] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13920'. [ 1679.696277][T21315] vlan3: entered promiscuous mode [ 1679.865009][T21325] netlink: zone id is out of range [ 1679.870197][T21325] netlink: del zone limit has 4 unknown bytes [ 1679.947966][T21325] FAULT_INJECTION: forcing a failure. [ 1679.947966][T21325] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1679.961137][T21325] CPU: 0 UID: 0 PID: 21325 Comm: syz.4.13926 Not tainted syzkaller #0 PREEMPT(full) [ 1679.961166][T21325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1679.961180][T21325] Call Trace: [ 1679.961190][T21325] [ 1679.961199][T21325] dump_stack_lvl+0xe8/0x150 [ 1679.961237][T21325] should_fail_ex+0x40c/0x560 [ 1679.961270][T21325] _copy_to_user+0x31/0xb0 [ 1679.961330][T21325] simple_read_from_buffer+0xe1/0x170 [ 1679.961367][T21325] proc_fail_nth_read+0x1bb/0x230 [ 1679.961404][T21325] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1679.961439][T21325] ? rw_verify_area+0x24a/0x4c0 [ 1679.961473][T21325] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1679.961515][T21325] vfs_read+0x213/0xa80 [ 1679.961552][T21325] ? __pfx___mutex_lock+0x10/0x10 [ 1679.961586][T21325] ? __pfx_vfs_read+0x10/0x10 [ 1679.961619][T21325] ? __fget_files+0x2a/0x420 [ 1679.961652][T21325] ? __fget_files+0x3a2/0x420 [ 1679.961678][T21325] ? __fget_files+0x2a/0x420 [ 1679.961714][T21325] ksys_read+0x150/0x270 [ 1679.961749][T21325] ? __pfx_ksys_read+0x10/0x10 [ 1679.961790][T21325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1679.961814][T21325] do_syscall_64+0x174/0x580 [ 1679.961843][T21325] ? trace_irq_disable+0x3b/0x140 [ 1679.961868][T21325] ? clear_bhb_loop+0x70/0xc0 [ 1679.961893][T21325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1679.961914][T21325] RIP: 0033:0x7feebf15e90e [ 1679.961934][T21325] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1679.961951][T21325] RSP: 002b:00007feec000ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1679.961973][T21325] RAX: ffffffffffffffda RBX: 00007feec00106c0 RCX: 00007feebf15e90e [ 1679.961987][T21325] RDX: 000000000000000f RSI: 00007feec00100a0 RDI: 0000000000000004 [ 1679.962000][T21325] RBP: 00007feec0010090 R08: 0000000000000000 R09: 0000000000000000 [ 1679.962013][T21325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1679.962026][T21325] R13: 00007feebf426038 R14: 00007feebf425fa0 R15: 00007ffea6083168 [ 1679.962061][T21325] [ 1680.472469][T21336] netlink: 'syz.1.13932': attribute type 11 has an invalid length. [ 1680.750109][T21346] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13934'. [ 1680.905769][T21346] netlink: 20 bytes leftover after parsing attributes in process `syz.1.13934'. [ 1680.986509][T21364] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13936'. [ 1682.141970][T21387] netlink: 32 bytes leftover after parsing attributes in process `syz.2.13942'. [ 1682.325998][T21396] netlink: 56 bytes leftover after parsing attributes in process `syz.4.13945'. [ 1682.439308][T21396] netlink: 56 bytes leftover after parsing attributes in process `syz.4.13945'. [ 1682.536266][T21406] netlink: 27 bytes leftover after parsing attributes in process `syz.0.13947'. [ 1682.695432][T21396] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13945'. [ 1682.704557][T21396] xfrm0: entered allmulticast mode [ 1682.718408][T21396] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13945'. [ 1682.741576][T21396] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 1682.757022][T21596] xfrm0 speed is unknown, defaulting to 1000 [ 1682.763037][T21596] syz2: Port: 1 Link DOWN [ 1682.767467][T21596] xfrm0 speed is unknown, defaulting to 1000 [ 1682.816610][T21416] netlink: 256 bytes leftover after parsing attributes in process `syz.1.13951'. [ 1683.229738][T21436] xt_hashlimit: overflow, try lower: 0/0 [ 1684.317098][T21457] xt_cgroup: xt_cgroup: no path or classid specified [ 1684.319388][T21456] netlink: 'syz.2.13963': attribute type 5 has an invalid length. [ 1684.496928][T21468] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.13968'. [ 1684.877610][T21482] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13973'. [ 1685.091958][T21492] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 1685.099150][T21492] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 1685.218084][T21494] netlink: 'syz.2.13978': attribute type 1 has an invalid length. [ 1685.274502][T21494] 8021q: adding VLAN 0 to HW filter on device bond64 [ 1685.281782][T21491] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13977'. [ 1685.584484][T21491] 8021q: VLANs not supported on syzkaller0 [ 1685.903641][T21507] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1685.943559][T21513] xfrm0 speed is unknown, defaulting to 1000 [ 1686.555279][T21529] FAULT_INJECTION: forcing a failure. [ 1686.555279][T21529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1686.568377][T21529] CPU: 0 UID: 0 PID: 21529 Comm: syz.1.13991 Not tainted syzkaller #0 PREEMPT(full) [ 1686.568399][T21529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1686.568410][T21529] Call Trace: [ 1686.568418][T21529] [ 1686.568425][T21529] dump_stack_lvl+0xe8/0x150 [ 1686.568455][T21529] should_fail_ex+0x40c/0x560 [ 1686.568482][T21529] _copy_from_user+0x2d/0xb0 [ 1686.568510][T21529] ___sys_sendmsg+0x1c6/0x360 [ 1686.568533][T21529] ? __lock_acquire+0x683/0x2cf0 [ 1686.568562][T21529] ? __pfx____sys_sendmsg+0x10/0x10 [ 1686.568608][T21529] ? kstrtouint+0x6e/0xe0 [ 1686.568656][T21529] ? __fget_files+0x2a/0x420 [ 1686.568680][T21529] ? __fget_files+0x3a2/0x420 [ 1686.568714][T21529] __sys_sendmmsg+0x273/0x4d0 [ 1686.568745][T21529] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1686.568779][T21529] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1686.568822][T21529] ? ksys_write+0x242/0x270 [ 1686.568853][T21529] ? __pfx_ksys_write+0x10/0x10 [ 1686.568888][T21529] __x64_sys_sendmmsg+0xa0/0xc0 [ 1686.568914][T21529] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1686.568936][T21529] do_syscall_64+0x174/0x580 [ 1686.568964][T21529] ? trace_irq_disable+0x3b/0x140 [ 1686.568989][T21529] ? clear_bhb_loop+0x70/0xc0 [ 1686.569014][T21529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1686.569035][T21529] RIP: 0033:0x7f4d60f9e0d9 [ 1686.569054][T21529] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1686.569072][T21529] RSP: 002b:00007f4d61e66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1686.569093][T21529] RAX: ffffffffffffffda RBX: 00007f4d61225fa0 RCX: 00007f4d60f9e0d9 [ 1686.569107][T21529] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000003 [ 1686.569120][T21529] RBP: 00007f4d61e66090 R08: 0000000000000000 R09: 0000000000000000 [ 1686.569132][T21529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1686.569144][T21529] R13: 00007f4d61226038 R14: 00007f4d61225fa0 R15: 00007ffe0dacbaa8 [ 1686.569176][T21529] [ 1687.199432][T21513] lo speed is unknown, defaulting to 1000 [ 1687.291100][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.301295][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.311408][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.324274][T21539] __nla_validate_parse: 4 callbacks suppressed [ 1687.324293][T21539] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13993'. [ 1687.341697][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.375063][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.420057][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.461701][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.501756][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1687.802814][T21537] net_ratelimit: 46 callbacks suppressed [ 1687.802833][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.073788][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.083926][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.094026][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.104107][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.114284][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.124379][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.134490][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.145670][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.155886][T21537] ip_tunnel_core: Dead loop on virtual device ipip5 (net 36), fix it urgently! [ 1688.549853][T21561] FAULT_INJECTION: forcing a failure. [ 1688.549853][T21561] name failslab, interval 1, probability 0, space 0, times 0 [ 1688.597814][T21560] netlink: 'syz.1.14002': attribute type 27 has an invalid length. [ 1688.615792][T21561] CPU: 1 UID: 0 PID: 21561 Comm: syz.0.14000 Not tainted syzkaller #0 PREEMPT(full) [ 1688.615821][T21561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1688.615834][T21561] Call Trace: [ 1688.615843][T21561] [ 1688.615853][T21561] dump_stack_lvl+0xe8/0x150 [ 1688.615889][T21561] should_fail_ex+0x40c/0x560 [ 1688.615921][T21561] should_failslab+0xa8/0x100 [ 1688.615953][T21561] __kmalloc_cache_noprof+0xa8/0x660 [ 1688.615982][T21561] ? cgw_create_job+0x1f9/0xc30 [ 1688.616077][T21561] ? cgw_create_job+0x1f9/0xc30 [ 1688.616113][T21561] cgw_create_job+0x1f9/0xc30 [ 1688.616152][T21561] ? __pfx_cgw_create_job+0x10/0x10 [ 1688.616190][T21561] ? __pfx_cgw_create_job+0x10/0x10 [ 1688.616219][T21561] rtnetlink_rcv_msg+0x7b9/0xc00 [ 1688.616249][T21561] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1688.616273][T21561] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1688.616296][T21561] ? ref_tracker_free+0x689/0x830 [ 1688.616329][T21561] ? __pfx_ref_tracker_free+0x10/0x10 [ 1688.616368][T21561] netlink_rcv_skb+0x226/0x4a0 [ 1688.616398][T21561] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1688.616423][T21561] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1688.616464][T21561] ? netlink_deliver_tap+0x2e/0x1b0 [ 1688.616491][T21561] ? netlink_deliver_tap+0x2e/0x1b0 [ 1688.616526][T21561] netlink_unicast+0x7bb/0x940 [ 1688.616564][T21561] netlink_sendmsg+0x813/0xb40 [ 1688.616605][T21561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1688.616638][T21561] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1688.616666][T21561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1688.616694][T21561] sock_sendmsg_nosec+0x13a/0x180 [ 1688.616738][T21561] ____sys_sendmsg+0x54e/0x850 [ 1688.616782][T21561] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1688.616819][T21561] ? import_iovec+0x73/0xa0 [ 1688.616854][T21561] ___sys_sendmsg+0x2a5/0x360 [ 1688.616879][T21561] ? __lock_acquire+0x683/0x2cf0 [ 1688.616911][T21561] ? __pfx____sys_sendmsg+0x10/0x10 [ 1688.616976][T21561] ? __fget_files+0x2a/0x420 [ 1688.617001][T21561] ? __fget_files+0x3a2/0x420 [ 1688.617038][T21561] __x64_sys_sendmsg+0x1b1/0x290 [ 1688.617064][T21561] ? fput+0xb1/0xd0 [ 1688.617090][T21561] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1688.617137][T21561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.617160][T21561] do_syscall_64+0x174/0x580 [ 1688.617189][T21561] ? trace_irq_disable+0x3b/0x140 [ 1688.617214][T21561] ? clear_bhb_loop+0x70/0xc0 [ 1688.617240][T21561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.617261][T21561] RIP: 0033:0x7fe3e319e0d9 [ 1688.617281][T21561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1688.617299][T21561] RSP: 002b:00007fe3e401d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1688.617322][T21561] RAX: ffffffffffffffda RBX: 00007fe3e3425fa0 RCX: 00007fe3e319e0d9 [ 1688.617337][T21561] RDX: 0000000000000000 RSI: 0000200000000800 RDI: 0000000000000003 [ 1688.617350][T21561] RBP: 00007fe3e401d090 R08: 0000000000000000 R09: 0000000000000000 [ 1688.617363][T21561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1688.617375][T21561] R13: 00007fe3e3426038 R14: 00007fe3e3425fa0 R15: 00007ffcec9cf398 [ 1688.617409][T21561] [ 1688.929053][T21560] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14002'. [ 1689.677639][T21580] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14007'. [ 1690.166600][T21592] xfrm0 speed is unknown, defaulting to 1000 [ 1690.955229][T21608] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 1690.962409][T21608] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 1690.970797][T21592] lo speed is unknown, defaulting to 1000 [ 1691.047656][T21608] xt_hashlimit: size too large, truncated to 1048576 [ 1691.054396][T21608] xt_hashlimit: max too large, truncated to 1048576 [ 1691.771764][T21622] tipc: Resetting bearer [ 1691.865957][T21630] Unknown options in mask 6 [ 1691.949718][T21621] xt_CT: No such helper "syz1" [ 1692.076531][T21622] tipc: Resetting bearer [ 1692.172971][T17749] lo speed is unknown, defaulting to 1000 [ 1692.429774][T21647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14026'. [ 1692.964900][T21662] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14032'. [ 1693.177513][T21657] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14031'. [ 1693.645233][T21681] IPv6: sit2: Disabled Multicast RS [ 1693.887240][T21697] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14042'. [ 1693.897564][T21697] net_ratelimit: 960 callbacks suppressed [ 1693.897584][T21697] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 1693.991932][T21701] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14045'. [ 1694.253481][T21714] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14049'. [ 1694.286684][T21714] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1694.363765][T21719] netlink: 'syz.1.14052': attribute type 1 has an invalid length. [ 1694.371670][T21719] netlink: 84 bytes leftover after parsing attributes in process `syz.1.14052'. [ 1694.422861][T21719] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14052'. [ 1694.436748][T21716] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14050'. [ 1694.485980][T21719] netlink: 'syz.1.14052': attribute type 1 has an invalid length. [ 1694.593540][T21719] bond59: entered promiscuous mode [ 1694.601691][T21719] 8021q: adding VLAN 0 to HW filter on device bond59 [ 1694.619124][T21730] netlink: 104 bytes leftover after parsing attributes in process `syz.2.14055'. [ 1694.748108][T21719] bond59: (slave bridge6): making interface the new active one [ 1694.755728][T21719] bridge6: entered promiscuous mode [ 1694.762737][T21719] bond59: (slave bridge6): Enslaving as an active interface with an up link [ 1694.779896][T21731] syzkaller0: entered promiscuous mode [ 1694.785407][T21731] syzkaller0: entered allmulticast mode [ 1694.997255][T21741] tipc: Enabling of bearer rejected, already enabled [ 1695.871339][T21770] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 1695.878788][T21770] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 1696.096874][T21782] netlink: 'syz.3.14072': attribute type 11 has an invalid length. [ 1696.451830][T21794] tipc: Resetting bearer [ 1696.457197][T21794] tipc: Resetting bearer [ 1696.555265][T21801] Unknown options in mask 6 [ 1696.604373][T21794] tipc: Resetting bearer [ 1696.707491][T21805] tipc: Resetting bearer [ 1698.931415][T21860] netlink: 'syz.0.14096': attribute type 13 has an invalid length. [ 1699.214965][T16545] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1699.602593][T16545] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 1700.223553][T21897] 8021q: VLANs not supported on wg2 [ 1700.408139][T21905] openvswitch: netlink: Flow key attr not present in new flow. [ 1700.681172][T21916] __nla_validate_parse: 7 callbacks suppressed [ 1700.681192][T21916] netlink: 404 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.696546][T21916] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.705624][T21916] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.714692][T21916] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.807393][T21916] netlink: 404 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.818594][T21916] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.853776][T21916] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1700.862845][T21916] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14114'. [ 1701.292549][T21936] FAULT_INJECTION: forcing a failure. [ 1701.292549][T21936] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1701.305649][T21936] CPU: 0 UID: 0 PID: 21936 Comm: syz.1.14119 Not tainted syzkaller #0 PREEMPT(full) [ 1701.305694][T21936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1701.305716][T21936] Call Trace: [ 1701.305731][T21936] [ 1701.305746][T21936] dump_stack_lvl+0xe8/0x150 [ 1701.305782][T21936] should_fail_ex+0x40c/0x560 [ 1701.305813][T21936] _copy_from_user+0x2d/0xb0 [ 1701.305849][T21936] btf_new_fd+0x301/0xbb0 [ 1701.305890][T21936] __sys_bpf+0xd2e/0xd90 [ 1701.305927][T21936] ? __pfx___sys_bpf+0x10/0x10 [ 1701.305967][T21936] ? __fget_files+0x2a/0x420 [ 1701.306015][T21936] ? ksys_write+0x242/0x270 [ 1701.306052][T21936] ? __pfx_ksys_write+0x10/0x10 [ 1701.306090][T21936] __x64_sys_bpf+0xba/0xd0 [ 1701.306115][T21936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1701.306142][T21936] do_syscall_64+0x174/0x580 [ 1701.306173][T21936] ? trace_irq_disable+0x3b/0x140 [ 1701.306200][T21936] ? clear_bhb_loop+0x70/0xc0 [ 1701.306227][T21936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1701.306250][T21936] RIP: 0033:0x7f4d60f9e0d9 [ 1701.306271][T21936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1701.306292][T21936] RSP: 002b:00007f4d61e66028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1701.306317][T21936] RAX: ffffffffffffffda RBX: 00007f4d61225fa0 RCX: 00007f4d60f9e0d9 [ 1701.306334][T21936] RDX: 0000000000000028 RSI: 0000200000000380 RDI: 0000000000000012 [ 1701.306349][T21936] RBP: 00007f4d61e66090 R08: 0000000000000000 R09: 0000000000000000 [ 1701.306364][T21936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1701.306378][T21936] R13: 00007f4d61226038 R14: 00007f4d61225fa0 R15: 00007ffe0dacbaa8 [ 1701.306414][T21936] [ 1701.535508][T21937] openvswitch: netlink: Flow key attr not present in new flow. [ 1702.523927][T21974] openvswitch: netlink: Flow key attr not present in new flow. [ 1702.599267][T21971] netlink: 'syz.1.14131': attribute type 1 has an invalid length. [ 1702.660987][T21971] 8021q: adding VLAN 0 to HW filter on device bond60 [ 1702.745293][T21982] BUG: using smp_processor_id() in preemptible [00000000] code: syz.4.14133/21982 [ 1702.754589][T21982] caller is bpf_mem_cache_free_rcu+0x48/0xc0 [ 1702.760622][T21982] CPU: 0 UID: 0 PID: 21982 Comm: syz.4.14133 Not tainted syzkaller #0 PREEMPT(full) [ 1702.760649][T21982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1702.760662][T21982] Call Trace: [ 1702.760671][T21982] [ 1702.760680][T21982] dump_stack_lvl+0xe8/0x150 [ 1702.760713][T21982] check_preemption_disabled+0xd3/0xe0 [ 1702.760739][T21982] bpf_mem_cache_free_rcu+0x48/0xc0 [ 1702.760773][T21982] rhtab_delete_elem+0x185a/0x1b30 [ 1702.760811][T21982] ? rhtab_delete_elem+0x15c/0x1b30 [ 1702.760842][T21982] ? check_and_init_map_value+0x57/0x410 [ 1702.760869][T21982] __rhtab_map_lookup_and_delete_batch+0x935/0xcb0 [ 1702.760920][T21982] ? __pfx_rhtab_map_lookup_and_delete_batch+0x10/0x10 [ 1702.760951][T21982] bpf_map_do_batch+0x445/0x630 [ 1702.760984][T21982] __sys_bpf+0x906/0xd90 [ 1702.761018][T21982] ? __pfx___sys_bpf+0x10/0x10 [ 1702.761047][T21982] ? do_futex+0x3e7/0x4e0 [ 1702.761107][T21982] ? rcu_is_watching+0x15/0xb0 [ 1702.761143][T21982] __x64_sys_bpf+0xba/0xd0 [ 1702.761167][T21982] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.761189][T21982] do_syscall_64+0x174/0x580 [ 1702.761218][T21982] ? trace_irq_disable+0x3b/0x140 [ 1702.761242][T21982] ? clear_bhb_loop+0x70/0xc0 [ 1702.761267][T21982] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.761287][T21982] RIP: 0033:0x7feebf19e0d9 [ 1702.761307][T21982] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1702.761325][T21982] RSP: 002b:00007feebffef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1702.761346][T21982] RAX: ffffffffffffffda RBX: 00007feebf426090 RCX: 00007feebf19e0d9 [ 1702.761362][T21982] RDX: 0000000000000038 RSI: 00002000000000c0 RDI: 0000000000000019 [ 1702.761381][T21982] RBP: 00007feebf235024 R08: 0000000000000000 R09: 0000000000000000 [ 1702.761395][T21982] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1702.761407][T21982] R13: 00007feebf426128 R14: 00007feebf426090 R15: 00007ffea6083168 [ 1702.761440][T21982] [ 1702.995980][T21988] netlink: 'syz.2.14129': attribute type 1 has an invalid length. [ 1703.105410][T21985] sctp: [Deprecated]: syz.3.14130 (pid 21985) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1703.105410][T21985] Use struct sctp_sack_info instead [ 1703.167872][T21976] xfrm0 speed is unknown, defaulting to 1000 [ 1703.247291][T21981] bond60: (slave gretap3): Enslaving as an active interface with an up link [ 1703.384029][T21988] 8021q: adding VLAN 0 to HW filter on device bond65 [ 1703.625162][T21976] lo speed is unknown, defaulting to 1000