last executing test programs: 4.185804581s ago: executing program 1 (id=4382): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) 3.507850097s ago: executing program 0 (id=4385): r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r0, &(0x7f0000000140)="ed", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000007c0), r0) 3.401206159s ago: executing program 3 (id=4387): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01040000000000000000010080000900010073797a30000000402c000000030a01010000000000000000010000030900010073797a30000000000900030073797a32000000009c000000060a010400000000000000000100000008000b400000000074000480340001800b000100657874686472000024000280080001400000000c080003400000003b080004400000002205000200070000003c0001800c00010062697477697365002c000280080003400000000408000140000000140800024000000012080006400000000508000780e2ff00000900010073797a30"], 0x110}}, 0x0) 3.35633415s ago: executing program 1 (id=4388): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x24000000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}]}}}]}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x8044) r5 = accept(r2, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x2400c840}, 0x0) connect$unix(r5, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 3.290561341s ago: executing program 3 (id=4389): r0 = socket(0x2c, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="880100001900010000000000fbdbdf251d01090054000f805000f8804c00738008008400", @ANYRES32=0x0, @ANYBLOB='\b\x00F\x00', @ANYRES32, @ANYBLOB="0c00a10009000000000000002c002b800800d200ffffffff1e0017004cb42ee3a03b5668ab4b3911ae4e379e45f284e4d167041a229e0000200106801cfb"], 0x188}, 0x1, 0x0, 0x0, 0x40081}, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x308, 0x2e8, 0x2e8, 0x308, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffffff, 0xffffff00, 0xff], [0xffffff7f, 0xfffffefe, 0xff000000, 0xff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x2f, 0xb7, 0x0, 0x1}, 0x0, 0x218, 0x238, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}, @common=@rt={{0x138}, {0x5, [0x1, 0x4], 0x1, 0x2, 0x2, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @broadcast}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @private2, @mcast1, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0x44}, @local, @loopback, @remote, @mcast2, @remote], 0x6}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0xffffffffffffffff, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x88, 0x1403, 0x200, 0x70bd2d, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_to_team\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0_to_hsr\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ipvlan0\x00'}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000000}, 0x840) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r2, 0x80047437, &(0x7f0000000040)) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f0000000080), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r4, &(0x7f00000002c0)={&(0x7f0000000000)={0x1d, r5}, 0x10, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYRES32=r4], 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r4, 0x8935, &(0x7f0000000600)={'rose0\x00'}) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r6, 0x40047438, &(0x7f0000000040)) unshare(0x28000600) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x7, 0x2, 0xa, 0x9, 0x40, 0x8000}, 0x0, &(0x7f0000000240)={0x1f, 0x112, 0x0, 0x4, 0x200000000000000, 0x0, 0x0, 0x4000000000000004}, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000010c0)="3cbd0a49517f3a089ddf66995d24df05dc990c1ec2dc10eca0b1a05d8800ace54b91a1301ec88cbee6eb10fe86684e2075da14f6bc470647b2804bfc322f8fd1eac4f000334e3f11f3f7fd401dd945c405fcb9fee827d21b1de0dc57e2357b9e6049777cb79449f411f92222d88c35c094775ca1ea7cc1f942393f30ef103a855c27fb066437249e30c4d16fb1ff6a8bfa51ad407edc38f40bd4bf97d7d1a256f00aff2c99b944a6dcf6335f65bdb06c3269322c6b116364fa37e3c8a94c8eb1672b2b507d329498e61367d12ec8b4bdcdb4383f81567a5ad9fea73adf89bbb299d41be47806dd71e17b177346313cb7e15f2054f8f39de35c8ddb527761e0d346680614632fae6b47d0f03f38dfb9322ef634d206ae64b1777df7088374f27bbd402fe78580ce48afaac06b8d24b01c3de33f99a4495fea9174c53bdfff3def2ac1f1be31a4d12147aab7e3c80d46e110142d78e5e4390a5331bd72fa364c6570fe01074f8271fe1decd290b7a7fc48c5e919a68d9697c996e03ab2ddfc7d41194998e2b45b5e9421543d30e75c26a9fb6d0e7c9fdefebe39492692bf2d27d92122af77baca8f3e9672b9820221db50e0502c8b79428ff98fd5354bd6bfecf464c7dfeca0c61380272ac7f9b50ae9060529f3109a2851137f7d8ed55627291ca757c9de087995e2c16f714c183402426f8e2927d876dedac1b2f1058f9ace32044783e09a8993fc0238a248d753ae6e7268f5404f018298e5a53a75432724bb3153938f637a5c40f8e157b7fec54d210d1d2104c2cf1e846881549aa7d2fb7632cc5852c702066c2299cec976e918348cf2f63696c30100386c43519fbba3839e1a5d7ff720edd6eabaca1b97d93b28fe7c1cc3e3606e12b0be495a91648d47da6719386e1a557eb5a7dec11b2b1df21c2d3f552abaa210156c50705f772e106eec6e41cadeeff1b63689436b04f22dd6db20989e8de5ac1f72c99cb87dc03b9958cde320c236a1f3b2f70ed70c7f816cc168c96862bf55b9675ab60af090452d00305747bfc681d750ec3fd5c0b3246e559847ba416da0b78107481dbb8af24c6ebbc3e11d1cbbd1f51257c34006009b3773eef2feee8e33e6014c946504169a9eb97273e39a69ab4c76693df8e4f170699215e6ded5353e9f1b3741ba78e7f52801990aa04000007ff49bcbe389ddd65220514664e662f9feeb452a56bc5f9c93065a66442f48d028ac7b3059edd179d3ed632d5cd16554e1c24d8f8955f9692d63a144b2a91dbd712ad77e4280ca2b1901bd81ce04e6f27be2bdc0581b48b40dec70f9fcdceabbcc50197da6583e249b64532604e8422373a9847ab76a622bd7e2701a108c0399f1038143b4c58525b2fe5a7ab88bcd812e64d50a544d99cb05a31d25c6f7e1a9f797421330998bb33c7dcf35467dffcafee3ac6dfc9ad5471ecc53124a8003137103096af90b6b4379fa34057017ac910640e817af346bc87b2314b4057e16b8fbe0b6577d6b093f8dae549ac4f719e63922cd9167158c4839479a8e7bc096a5afec346c43fce7761f50da0fe97a01b3f28584359a158d245933bbdbd960e99a9b46c399d8c52fc892d4555ce9dd15ed0b9eefa355151e240d6250de899cc946ac99c113ddaa63168b3226716337129e110bd1a97ab9b297846bc8c0873b277fc04458a6d98da73aab448234fbfc1557fe1ef0d4212af759811a5b7314dbd3fced8f405eb5e068df479bc5d088233cc2e34c94e5d1fc9fec3eea6d74cf3641745fef7f0128476ac70b5acdd8c7d70c4efa67f7ba41410777217e48ae2438343654414eb15f2971b068b66be0f8f7a076dd0dbb862a35a4c3105d1af73c110a5e891417f49731a12c30448c76745b387d13b2eaa6e7c3990a70e4f6136146cf6ad379f88e448c83e1e08102dcfb1c7818acf80aeff636495531e231f72ca54cf6c54a48c43c9ab1c4974725b9c96794cf9be7db289dee5fcd81054739f65289626475dce788468588b722482eb3bfdb6962e4da7b8bc4a08b18253cc6b263379293add7b432578f05b7d5b12ca6e934266b066eae63382a3a4106abc76444cd3e037a4f49c1f2a4ca46e548b745792fb4bf3b1ec9b3af4a9642e9df787aa6e0adecbacbd7669c28b8eefc6b3c79b528bc571db0d81c70fb78b37c54c9b4b292d99f13e59d128065a3dc75a54c97675ba8dfd8bb061bc2554992d8d17c6cfc9092795e51704bb05a56c26bd7d382099238c35e1f6c4231fda6cf4e6a536d56042f1455c51b407277d687401a3c916011cd4d7fe6f42919d3a2ae33944d5cff2fe91bb56303fa6179c34f66e7a20fd8365237ad62f8f9a8622ce8acfb2b38df1f8faf523e5994a62eed7cd5a00c301038c385310644fd148fbfd052b1c4ef4a648b5596501e78723abfdcf3352641b3162a1717e372cac07ce83972b08a8c8f84cf6d2e9f47739200bc0f966294a57932d8dcf31da45fe017b12d96c3d2540ec0dc4e804efc7317c6d5c8695a43af8c45f2b9be6346901933ac24b6bcf277a135e800afc48965c4aba7bc36b150c6ca0a91f78fe706c70ad9e7be37e9b9276a6349371f3771e784a19ce458a9599fa9bf73de0d44226ceb9d984130e0a609c37ef228436047b4acf808019d26312b7aa4ff960b10075d48ea9954cfee3f75c596660e9c30451e9aca3b581a148d44fc750cf6d73b8d399e258a206a5d23b31937c0664ea2f92a9bd4937175237086715c33419af8251d2eb09fd173e80153ff7a0b3c7dc04bd081f67040d32eade06762118360854755c1c86ca10eea61cb8daadc7460db1f0c7b85142f5f2c7af2205f20b748573c36d36081c156d059e62edc964eb8dba6ebe468ced475c577912f7822c029fbdac014a2defb052f0ca6e61ed89f9172969e1f1eea82d5e263dcabc7a1ee6f5e28c28fffecad67fd159493080d0b46d9a9f86bd51fcd06ef2e33571f238556e8eb21311be486c4d023008056ac2ea9e5aabe95a38b95ac6c5a5c3180d510d81b7cb8b024ab845567dbe4bd5343127ba92287c3ebc60efa1c85a6d06d763ecaa24b0873e35c1429978089d48eee6b4747873d93f5e8f5f83de02d4652fa1e85bbe42a2741a4e2dbc891c68ba0718907b63998940438dfecb07a6264ccc78b2271e965a323a5a4d5208aac10517dc6e6637fa9cf8517d289b0f93902dfe289d658d5c76fa76dc02b8a655912b00e72f6a1ece365c0dd57626300691ff161c855fdd8bb7aa33920853ab5c1f6baceb91148734dfbd37fd1302b70c0bd1136ef82033c561a08575d33606ff3607b34d08eb7d2bac34c0e8310fba28fc66ce40029ea38890f1d02b691d9433cf3336da3d3525c02e707e34ee1077fb04572106a91ef75c3f142c741519fe3fb921a8085d56281406357e1e135a62da5ee4f4ad3fa82712d60aaaafef7b343f00a19a595763b8ad0aa10c8b5bd83372949486cfcaf69b472db2c3618d69f46a4ab387a3d7ecd6f91222f4342090df30b6a8a377c990f1381832d5908ce2b253ff9cadb64bb6890842fdf7cc0b8626487221c475502749c1ece59a5812fad631371c246312cd082709c0319e3e39b11d6b645f1a86b1cbe1a930492503f63b600e32b2dde88a0cd59b1ebe40c4e321a1c24073e2e3f589d351567758dbc91f7fe6b998696cba210b7db2e37b789ad53905281337d27caeda61b450e655369e2d16b5cba9ddcd0d61df2def1787b086b73b516f4979fae1270a5c503e87dedae66ce1d11a1dd288d95e2dcc59d24b57b8fc23409f0e3fd241140500549df4b3ac0adfc5b91ada37add028077b1ed25e69b0f2d9efb7e615cbceb8f968d85e183b780f57616e15a27491666c1e38430fc782481485259fb861fb6ceb499a9e4f2b15eae9db225bc97d66d4a3b532454d1f5ad6f09a506077103688cf3a55839ec391511888f9c89b23013b64f9dbf0fdba9656be1ccec11fba9b241e6f4ab74619c7627cef95ea4b4531fcce47e00bac51bcdabb650507206717d578fb92cd9df2a6da2ce2492be016cba2c39ff3db6cbf9de4d235deea16a805f49ef6341ee07654060f3291e13ad5366f89c70c854d302c2cc250f9ab48b51c02bfe77b230ca612d83d006df13fb0e4424973314eeae6c77050d94a5197ea89d3a39f8fe94a8dc0bf60497a7b6b7e85e4ed3154582da002d92fd857ce62d8afa0436098a3162dace7dd0724ddb6344c4cfdd77950591c92a90600806571e198cdda81382682b8e93a4071eb4db3cea7798b0ea3fd68ae001a982973497e9f881174833076744db0f53057fe191d71b133041b1298f623681820d37f850fb8d5c4acf253d06b486e2dfa9609a5ca21dd9f583ef019f80cc27ada467087125388078d4b2a925fabee6a80f72b8e0f63550f918481c91600147b5f7d0992eddd0c560ae69aca1ca3cbc247f4f2d71110683792cd2fe52c4bdaa32095f45dd2e4158f948dcd47f54b62ef0aaadb0670e3d3ca4384daacc4def696bb10f5e7c491075bab254c40bed1a05fe9bd836b5d15ad6d5f1c3a65124fb5d3e732c62955cd32d6cb4277f2753465de830d95552032068ec7db211f5a417f1c3157020604c080ac7b85b65446c60e63c323d3094ec00f5517bccc8fef8edc29c94ea1bd9ed7c3a7ce18f36799738dd5c3a2f3baf74ec78f9c83658ed035408ae4e83e13e4dc2aaaabec792ad47e32cf899ef91209a11f31e2d5356397ed8082b32035b207c59ec8e8e2cd3f350de7ac460ca23a0489382bcccf8077b1ba72ef04e167929e35ec1449e708109ca7613cf4493594b5ff08715fe6d79874b2fa89ef16b60281bc3476a6dd84760ef3be5782c6703fa314d0d3c7749969a9a2262e540fa1fb6d98b94cb5e642689f7bb91379043ce60e9033caeb9f00a9005cb68295b8a7aa03531a4c53933b2aeb7655b5167924010e8c3cbc9dd7c7b522a161282f8ca8ee0a3c34c67642fe3dc57d29bc1c9f4831c6e902da1facc4913b0e365f4d0d756af3c8a3a2f4a7a6071da03e4c7343ca1d3c14bcb0e912611107ac4cadbe1b616693a6ef1ae025367bac8d2d2d9209c5e44821192882153cc237671748c009f46b03a26ef9b32afbc81c7127d0f49e7df980bf3f19c79cd025ed45188fd5b95610d98c9aacaefd3604c562bfb337030a85145f78f03f5c8ffe43f4cf921073de455d8bc3b563b3b732d0e2d0f52fe8bc80346f5b9ca596f77c72d16e889e035d92932b2c6e2ef216f905980cb7257f9da15ec2984ac137af5878b3e7188072a72ab31af64eb186692d4ccc1efe77989fb8ba7b9aad0983885776c619865b0ac706e5140bc14a5b2fbd0095806bd30a8329c1ddf6884b40efc30cbc13e4cd02871cc2ce44bdff6bfd7362eb6e200cd078d280912602cf2f0cc856c384158f397d1fda6efb87f35104e6556d8adfab537081989a35b6e6013480cd2b995e84a41fdaa4c8dd84ae3879738835dada6c9303333b02f786b68faaeb46f8aae11fa64c1cc15456fd22caf479a96b2aec22d9744d5f910c2730148c163a05fd949b7516ff514f0a14dca877647c76c449210995e7f66ccda68aa9174f205175941565aac445d338347f72d63c8a6a8da495404d521bcb46e92daf69c8a3887711989d123be74ad6d231c9484c0fe9e0eb51c6175d19cb8c4625891eedd04755fe053d9b2174fee2317a8df9875b251dac4ccb4a6a1bb5f7d345d3c4c96f26b3d47b7505f0b27b2abc6e9db97f3ec5cf8cf909e895ad0699305cf004fdd0196df3d8a47a8c359aed899", 0x1000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r7, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x34, r8, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfc, {{0x12}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xfffffff8, 0x7ffffff5}}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(r0, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x128, r8, 0x300, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0x3, 0x5}, {0x97}, {0x2, 0x3}, {0xff, 0x1}, {0x3, 0x7}, {0xd, 0x6}, {0x9}, {0x68}, {0x2}, {0x3, 0x1}, {0x8, 0x5}, {0x6}, {0x8, 0x6}, {0x2}, {0x9}, {0x3, 0x4}, {0x4, 0x6}], "bb611cba4a874e9a"}}, @NL80211_ATTR_QOS_MAP={0x2c, 0xc7, {[{0xa3, 0x6}, {0x2, 0x6}, {0x1, 0x5}, {0x29, 0x1}, {0x9, 0x4}, {0x5, 0x6}, {0x2}, {0x2}, {0x40}, {0xfa, 0x3}, {0x3}, {0xa9, 0x4}, {0x8, 0x7}, {0xff, 0x6}, {0x2, 0x2}, {0x2, 0x7}], "2750695ace5cc048"}}, @NL80211_ATTR_QOS_MAP={0xe, 0xc7, {[{0x3, 0x7}], "ad0307e7370b449b"}}, @NL80211_ATTR_QOS_MAP={0x20, 0xc7, {[{0x3, 0x3}, {0x81, 0x4}, {0x6, 0x5}, {0x1, 0x5}, {0x6, 0x5}, {0x9, 0x5}, {0x2, 0x5}, {0x61, 0x7}, {0x8, 0x7}, {0x6, 0x4}], "88c7ab2dded119f2"}}, @NL80211_ATTR_QOS_MAP={0x26, 0xc7, {[{0x63, 0x7}, {0xc0, 0x2}, {0x6, 0x7}, {0x9, 0x2}, {0x1, 0x6}, {0x9, 0x5}, {0xe8, 0x3}, {0x0, 0x6}, {0x7, 0x6}, {0x2e}, {0xa8, 0x4}, {0x7, 0x7}, {0x2, 0x3}], "90a1a781ff196613"}}, @NL80211_ATTR_QOS_MAP={0x34, 0xc7, {[{0x3, 0x2}, {0x8}, {0x4, 0x6}, {0x9, 0x3}, {0xc4}, {0x7, 0x1}, {0x5, 0x7}, {0x4, 0x2}, {0x76, 0x6}, {0x7a}, {0x9, 0x2}, {0x6, 0x4}, {0x8, 0x3}, {0x1, 0x5}, {0x5, 0x5}, {0x1, 0x3}, {0x7, 0x7}, {0x3, 0x49}, {0xba, 0x6}, {0xe, 0x7}], "2dba9f6c855dac1d"}}, @NL80211_ATTR_QOS_MAP={0x22, 0xc7, {[{0x6, 0x4}, {0x0, 0x7}, {0x0, 0x6}, {0xfe, 0x6}, {0xe, 0x1}, {0x1, 0x2}, {0x1, 0x4}, {0x2, 0x5}, {0x2, 0x3}, {0x1, 0x4}, {0xff, 0x3}], "09668613219d4bf2"}}]}, 0x128}, 0x1, 0x0, 0x0, 0x20000000}, 0x40c4) sendmsg$DEVLINK_CMD_GET(r7, &(0x7f00000005c0)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x30, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@pci={{0x8}, {0x11}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4001) 3.185968602s ago: executing program 2 (id=4390): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 3.016525348s ago: executing program 2 (id=4392): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x29, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r0, r2, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x8000000001000001, 0x0, 0x1}}, 0x40) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], 0x0}, 0x94) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r4, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000700000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x80) 2.912249586s ago: executing program 1 (id=4394): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="100029bd7000ffdbdf250e0000003400028008000800060000000300030000000000080006000001000005000d000100000008000600290000000800080009"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008"], 0x48}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2000000014000100000000000000000023000000", @ANYRES32=0x1, @ANYBLOB="08000200ac1414aa68a1a6243a5f7373bc3333f36edf6bc16446632c5d015c"], 0x20}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61158c000000000061134c0000000000bfa00000000000000705000008004ef02d3501000000000095000000000000006916000000000000bf67000000000000350605000fff07206706000006000000160302000ee60060bf500000000000001f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9d0cc7d3b4814261bdb94a050000a28a404be266df76965947c73c00c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b540dcfc7ad0500c4063b3b8754c0686cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e567238809000000000000000ae2fb494059bba8e3b680324a188090eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb40000000000000000000000000040007abf9c20d89cbc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d2538808"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xae, '\x00', 0x0, @sched_cls}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000002f00090073cc72e16accbe0a040000002a0011802e"], 0x40}, 0x1, 0x0, 0x0, 0x2004e884}, 0x0) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r2, &(0x7f0000000200)={0x23, 0x1, 0xac, 0x1}, 0x10) listen(r2, 0x5) r3 = socket$rxrpc(0x21, 0x2, 0x8) connect$rxrpc(r3, &(0x7f0000000540)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @empty}}, 0x24) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r4, &(0x7f0000000280)={0x23, 0x2, 0xac, 0x1}, 0x10) connect$phonet_pipe(r4, &(0x7f0000000300)={0x23, 0x1, 0xac, 0x1}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000007c0)={'ip_vti0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={r6, &(0x7f00000007c0), 0x0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000400)={{r5}, &(0x7f0000000340), &(0x7f00000003c0)='%pi6 \x00'}, 0x20) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r8, r7, 0x25, 0x0, @void}, 0x10) r9 = openat$cgroup(r0, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000000500)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0) syz_emit_ethernet(0xd41, &(0x7f0000001fc0)=ANY=[], 0x0) accept$phonet_pipe(r10, 0x0, 0x0) 2.753325201s ago: executing program 2 (id=4395): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)={0x68, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x13, 0x3, "322d73352e2e955d482ee5364c4323"}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "9ea2d328893918792a5ca222a6ad614b6f3aa3a6"}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 2.557350505s ago: executing program 0 (id=4397): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000a80)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0x100, 0x1d0, 0xffffffff, 0xffffffff, 0x100, 0x1d0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@frag={{0x30}, {[0x0, 0x3f3], 0x2}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffb}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x3d0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x42a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="331c86dd07001000000014002c0060ec97000fc83300fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) 2.550783933s ago: executing program 2 (id=4398): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg(r0, &(0x7f0000000280)=[{{&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xfffffff8, @private1, 0x17, 0xffffffff}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000002b40)="f7", 0x1}], 0x1}}], 0x1, 0x40408c1) r1 = socket$inet6(0xa, 0x5, 0x0) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @private1, 0x5}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000001340)=[{&(0x7f0000004940)="480000001400190d09004beafd0d8c560a84476080ffe006feffffff590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e000000000ec000", 0x48}], 0x1) 2.382622332s ago: executing program 4 (id=4399): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)={0x3c, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac0b}], @crypto_settings=[@NL80211_ATTR_SOCKET_OWNER={0x4}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0xc090) (fail_nth: 5) 2.286340076s ago: executing program 3 (id=4400): r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r0, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x14, 0x0, 0x2, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x20040880}, 0x8000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000240)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000180)={{{@in=@empty, @in6=@loopback, 0x4f24, 0x0, 0x4e23, 0x2, 0xa, 0x2a11bad3d5f03f24, 0x30, 0xdf, 0x0, 0xee01}, {0xfffffffe, 0x2, 0xfffffffffffffffc, 0x1, 0xfffffffffffffffb, 0x100000000000003, 0x9, 0x6}, {0x4800000, 0xfffffffffffffffe, 0x4, 0x9}, 0xd8, 0x0, 0x1, 0x0, 0x1, 0x3}, {{@in6=@loopback, 0x210000, 0x2b}, 0xa, @in=@loopback, 0x0, 0x0, 0x0, 0x17, 0x0, 0x0, 0xfffffffb}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0xffe0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f0000000180)=[{{0x0, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}, {{0x4, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}}], 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, 0x0, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x290, 0x0, 0xb, 0xd0e0011, 0x120, 0xc6, 0x1f8, 0x1d8, 0x190, 0x1f8, 0x1d8, 0x3, 0x0, {[{{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'nr0\x00', '\x00', {}, {}, 0x1}, 0x0, 0xd8, 0x120, 0x7000000, {}, [@common=@icmp={{0x28}, {0xd, "0010"}}, @common=@unspec=@connlimit={{0x40}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x33f}}}, {{@ip={@remote, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'virt_wifi0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x9, 0x0, 0x0, 0x20000, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x10}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r9, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) write$tun(r7, &(0x7f0000000340)={@val={0x0, 0x8809}, @void, @eth={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @val={@void, {0x8100, 0x0, 0x0, 0x20}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x4000, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @multicast1}, {0x0, 0x17c1, 0x8}}}}}}, 0x32) sendfile(r0, r5, 0x0, 0x9cba) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), r1) 2.178016382s ago: executing program 4 (id=4401): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)={0x68, r1, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, "322d73352e5f2d5d482ee5364c432384"}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "9ea2d328893918792a5ca222a6ad614b6f3aa3a6"}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) (fail_nth: 15) 2.042831803s ago: executing program 4 (id=4402): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 1.997452649s ago: executing program 0 (id=4403): socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socket$pppoe(0x18, 0x1, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e20, 0x440007, @ipv4={'\x00', '\xff\xff', @empty}, 0xffff8000}, 0x1c) setsockopt$inet_int(r1, 0x0, 0x33, &(0x7f0000000180)=0x80000001, 0x4) sendto$inet(r1, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$inet_int(r0, 0x0, 0x33, &(0x7f0000000180)=0x80000001, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e22, @loopback}, 0x10) 1.836475151s ago: executing program 1 (id=4404): r0 = socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, 0xffffffffffffffff, 0x4000) mmap(&(0x7f00000fc000/0x1000)=nil, 0x1000, 0x2000002, 0x4000932, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000040)={0x81, 0x0, 0x9, 0x9, 0x2, 0x81}) r2 = accept4(r0, 0x0, 0x0, 0x800) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8169, 0x2000, 0x800, 0x0, 0x2}, 0x20) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r3, &(0x7f00000003c0)={0x2c, 0x2, r5, 0x0, 0x0}, 0x10) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000340)={'syztnl1\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x8000, 0x7800, 0x1, 0x800, {{0xe, 0x4, 0x1, 0x9, 0x38, 0x64, 0x0, 0xba, 0x4, 0x0, @private=0xa010100, @empty, {[@ssrr={0x89, 0x23, 0x6f, [@broadcast, @multicast1, @rand_addr=0x64010100, @local, @multicast2, @empty, @multicast1, @dev={0xac, 0x14, 0x14, 0x11}]}]}}}}}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r2, &(0x7f0000002780)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002740)={&(0x7f0000003ec0)={0x153c, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x38, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x33, 0x5, "ad01b580353e243b7d046cdec188b441d9d4c7ee368d218972ac4bff32e6a564d605a558f73abd4ab29fa8aaff4ae4"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x124, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_BITS={0x118, 0x3, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'bond0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x8}]}, {0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7fffffff}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'skcipher\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x466}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'bond0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, 'skcipher\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'bond0\x00'}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3ff}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, 'bond0\x00'}]}, {0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x12}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x1}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, ':!\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '/-**\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x8, 0x2, '%-+\x00'}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x6}]}]}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x12a4, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x1004, 0x4, "9dc284ee3a2d3fbd67557434b4056cb16f0ec3b282acfef174d205e2f19c13a77867138280e7343a0553f690f08715a450c36f1991419bf95c39b321adf221300e7a5db444024da08971cee50e2860078a9442c652723864e8086745c5617b7db1dec7c422af5520e5dbb0afe62196e242bf7c05c2a946cddb286b572fa8f28391eb70d8615d3dad914e559c3f785ee867443d01f07d69ba00df7a40cfaaaed544a750cd2e497f5595bff343487db1bd792ddb6008cd3179c2af8b9688d58abd32f4109a0c4214ee84f4ec363f6ecc43604322b94c069d2481fbf93384e9b18c14287853e7b3fc924eeae7e5d6e908e09c822de7d3bf9fa05ef7a1e3074d8a40b639b790f4fa4237a679de7953ac74198a4f188844d6a7cb93d7cd73ad67a435f05eb17c37cd9b7fdf31c081791a99d92e62c6b3e3f204a4413500c750c6af843521fcef552e96d7daf41fec83da0ddf94e72c8b2047548f97a7362032722f6ea3ab56cecc1aed7ad359f376dadabf1ae7c250f5e7a5f9434313bdc543d41592e55f16d20e44b9114a2b16f158d6289b76ce0a53d45f4d604f65e028c5b8ce97197718ea53640cdc7c0296fd4d9b693abf06633162f60feb21ed6e19708b95c6897dd4727408b425768306822fb1cf7f3697bb4be8516c0bf36a68b7cf0dd15300d1638aeda17c56e5707667b77f7a0af4cc0c6db296c7959b005f1a136cc6778de27b8d1f7f7c6015187ce11b938cc1cb3dfb0ab16a1386c1238da9378418e2bdf1bab97c32222fcc6a142ba221c8bda9a9ebb7d2eb99683833af1fd7dc485e0c970d73179ab8c3a9de64f924445dff35800c97cc912aa4ba5c4422e3b6a5aaa119d567b96004bbe40bdceb259e239f7c665dd97aca0c624dd83be412ed823781fb44d0dd1be0fe9639a3ad4d587865555478a814aa3e154afe4dc3e47a063715d4824f552100d6d11d4bee5025bf592c5c3e6b5d8bc9f5e4e3475b5fc8181b1887cb85e0b817f4c6d29c543a066dd8860582961bbad68f4ee1db362b2135616aa7701ca826fffe594806a7302df538973ed35407575b7c3660b145126654beb2449a3ab632eb5c558f44a898c52940a46843835a50f83f10a1ae04b7a651beb5dcd7074cc558977aae5acc1703c87926e0ab07bf1957a32bc69d991454aedce521fdd26bcf7de7531f188609e0bde5e1397ee133b63a16ba4ac26c47ae841339ed1000910fc8d01e99d698cf57d030fabaa11a3d602b9893b27f8952cad414fe2ee294a61649eb930e59b4feabc7b09a48ae27c2e2c022349701f474fcddad865244ced6aa82190a69ead09df1599b1f425fa396aab0977d083e7d6180936304822a0a854a069c4ed75a22361ee300dd687db22bdafb5a078497e0284f9853379dd891dbd4cb20ba64d3330c54bcac2f75fb457cf6864e633a71cc60ffc40fb0b02826b81434d87fcd5efee07ba114c51576fc30c51d0d49c3a8b4332d8cb2bd79dbb78b0e766ec21624ddb5862588567128c059b9d14c02e36629d9e956c84a896b99a83c703c13a12d55188f5ea2a8f28eaf69326518e8b23a2cf2cf574ac75cc69d60b0174f2f362cdeffd36f505134f7c26aa5968af4ab420d1ce83a8d22b4741e4c6090f702a7de22aa1b887dbdeae6b5803f7f811e432d3191460ad348a7bcc6c17ba5690099902539d1fb132e92e9115f014f3d764e8cce86439cfab5f4aa18039b6595a259f3641c842010ca615ba5d592ac537589bb6c10b85665fb21395ace0bd89294ab32e439a1b5eea7b045ec3c1aea161f0828b8ad128cd280b1c551667ccc586caf28c1f12058f06bef1b85b2820918bcc728bdc7f997b99c909a57b447b9e4dfe618e3baa10512b84010f671629ec5509e4c4ffeebe7902fc78dd0e658b72a95098b9656cf21ee061edd73f004b8a79cc4e640bc6c4d11e6432c45e1558ebaa72c5ad2f11b10fcb30ae021ee58ef28f1dd3ae3855192252c293c4388c33c11384e785a10e461606ecdbc3337a303bbbea040f27658f76e9fbbbd5184fd27d2a137c936114e2ceb0cc688ef7dfc925fb4c205d7d4bee534003f927b2127d16dd64ce65c26567397b5560fe8792e33f84821e3462ff0981f3eadf602bc1e7d4061cf3eba18d769f0adaa49fb3c8e2e0d29959fa6e0164f3b41ec7e1c97be33f48009d8c5aa07adab15df555cfb17144a60ab2d8a4285835c7396faa1d0b81f57f016e95fdcaaf974221a43c531b0a2c16976c6413253f53db091d2ebcb3d82582924d158a4bb9716062a0c0ac66da71b6406d5eb951bded29f2f44968725dc3774fac2c6bc5d8113265d3f5d0aff62d87e50e08e007dcecd758ec16c2f64c7b23e15bbf06aaad9e99654e995fc59103ff49e77514367adacead9666470a8e0175cecf55881d5fba0602e6a2783ea160f85db63bb066999f448d364e9a0954cc195e0a005ab440e3669f701fd20b7b1c518195a034560e4954c29755c48092636a026448d61b76e560a256376423ba09c838f00d00123aab1986a700b77e1f72ea6babbd977dc2a7dcd2afdde1ee6fba9430cd85f09460262a0bff858f761adb6a4540f4a0e63954ebecf3ccf347d0b94e1ac83f918320ff5965c7511d10a43366c9b5b00e3e7429dedf67d0e05b653a16152dc7f6b308e17c8cb7b738693c513ca8dc8c70bee0c49c2bbb5f619903d98fe9cb88abf53171ea3c0b4f4a5c4e442bf96339b300690860d858533cece2a17508b64badb513b09b12425d0eeb383a6488035ce216556b4cac84d5769284f7cdb422cb2c5cfe6e2e38d734c7c12a4be3cdfad54d716654cfe28f553418fbd3d9ed0c426563e6a3b60a63b89c15dc8ea1491746ae8a6c15363085dac004bc4e4d6e119bae659250d11c776e874690e41d34cc6121e2d0eb778205aee080941abf1ac928f975d112abc60a61e06ef54d2f62a69feb67cddb7b9afa772872b59f5d8879a3f3aa782d4fbb5d1f8eeb1bd6d6320669bd08122bd9fe058b29fff176dcc0c413c17322383896c1315cc39abd3ab3917868719dba3f71d28778b9bde26bff8170b4c8f4b80dfbc5d85ae38e82eafe8fc9534b9c83a39e686e5a548864db886d866ef25434017e07151715026543b22e3097572684234be2eec3d95cee8ad1e6bcbeaff38f6e40e5fd47c4660c3779e09e80f47e30d3f23ea7e4cdfeb220e1d6eadd2a5e4dbdbc09425b80842fb525ac02ed030270190493b38e2d19cbd898be2b8d29652ab2dc96dcd55e06321d0cc3a9b90e1fa863c7ceefad28b78931c3607cd7bb721578bdd09fa8354cbd68c92b13ed4a6937b22bd5ec7d6b8b56deb502dae5e9a1229e12e0bf07cae62fa1c1c14fbf7a9fe8cf95e2c13348e4e40fc64f067be7b33bb2810eccf94972ebe2887e6b91941aff1ae864b31fcc8e2eee0839920cd897c7b62f0761fd83851827acf42266ee1dd094f1b8c9102bacdc9da32e114c744ae5e96aef858f0e97ef3e81486bb4d31c2313795ee7707c5f288a618a24f39038a300eb031b58002a9997675e577b9f749fab299057865bade5f602f28c93b276686cef31890423021aab942b89fb3632cf26161f463f3e2209387b7149b800c3ad925b5192aeb6677e53dbe5a041e294a1d747a20d6f6a45d3f64fd7f006b77c3de13b0c96b0c7649b573ca8bdfe4e104207f81304b8a40926aa651b8087c3fe1f4215e461f249ea2cafe5fbb165520ee76323edb0c3b419239db36d7fb551db710546f46a07d42d0218dc3760f95cd33abdb82fef4d9d543206aba177e162a6b6b5155a55121509ad8194a814f9dab40362b0a62fe4b322e2a09140e7dcef1b6d9be21147a43c02731ea41ceb295ea024d3fee60985807574bff29509ded71b54b9e4aabbbb1b3989ec2be9f296814a7814d3627bd505e2869928e813206047729b70f1eb3b14de88e485cc45d8203619f6d54d9bed8c87dda3192a8a8c4f7a444d2d3b365b41a365cb66bc08a0ee84f6e9754a257c0ba4e2403a98a4504561f2f2bd34e9c1c5768d4de6ee58e474e840202fe2e154af89958d2e1775d84c8bce0e114a6e854cd3ce4c466808939a440723d5d9629f1c15c2c56e1188daca7cb1b3f9f0c30ec9f62630515d168dc4fa3f38c436a192bf6d6ec589490f2c6b724bf88e57c8149a4abd0b21cf8ec24aaa68e29b01c7b0ad7bd852847f8e0eab0d5216437fadeacad2c4b471e100527cc7eaf38ea35490991002495dba98c2ec8a52a5e2bbdf52f87c57fd2e6e36ade9d6263d2ea7ba78393a179225bdf6db2e4900a71c45600f5a2e0a238d5b4f014e40ec74543a1216e7e17c3c029708ca23162f74d65adc9a857bb66eeb74df6da8729dbd9c14bbb2ba6a2dc7458bafa8e98185d1fc90a22596a54c49ae920443c4d51d1c8304cb457fbb7c804073721b5add552f61b8e70456ba3529a8b802bc0b0bb1e42d57799cb7460c39cd8020196737d66275788828f69a699eab0e536b7f7c540965f7502d549dec76084153ddf9f2db6a355ae778f75ab49b6e37374d3cbd7a440b93107c2db0e52216b24752b069ec7ec70cf411aada1bbe5e45d4d00d82607604043361f3fe607811f1a6523dedcd21f7f8bb28bd9b38de70cea3e5a617481ac5c1f96ca73a72f39ea64f9954a09b4b9783b9cf81d6cbbc3a4aa7d18f31abb15d4c2a13224cdeab7465382e1cabecde85abde4e195af01048edc0677a47fa1e6aefd06d1ffa2bb903f553b678fd3c725857cfc6ec345649a1482220e3519669447865b8082d3e7531c1b2748b37708e1e6e4fd013f89ff25c964ba25174c42a7d0d96739c346d4e54233452364f48df2f53b2bb301d0162e5d6311e9e5e215bacaaf483dde8eaa4275f5e98cd626f013e5fc92593d1ebc3546135d8b63a230b5d16bf96f28ce7d2b2e41f83d90abb8b9e6a285d4ffbfd2b9a2f45e196b78dc258399c10276d9f79dfd710af5ccf466a66c712fd582a3ec1d5387f6b5c6d168168998b7a862c50b2278feb1f57f21fd6729de693b7643594b32d688a33bd83264d5f34673b5a39502bc85952dee157ff20fb36f4f5e6f1509c74c7a4f5f79f6b81da3c675e2ba44ddad1b0acf1dcfddcda3a42d8d977e75a173a933d9c9f3a5b1a02cff90103d68bf798135069f408b2bea477cfd61250bbc070c2f0c577bbc4b8208527b18034929965606eb870f9aa8549a81bef529358b33380dcc4c40ce4e3db066d255de456fe957f1a9024301dfc4ec08b391a2289463b93237dea8ee215f99538d110622c36d67c90b60b6994b4342b165127b6909ac5a02a9f8afed8e31806dfa34c25cabbca38ad297d1a034ad05292aa910c4a882342801ba0c8ac61c6f4779b349047133906796e37d74bec500272d54ab7cef96edd17dcd2362b69930a14449c965c570a7028f4203c5a334160ef3147189795f09856e54f575c03646d3af3666f134232d6f582b31987544d02e9f2970a250c7ec756c439f7b3aed3a6ea034c6b85f056c3f7ee27dac1eed3d241dfccb000c6af69a28215a5560ee8c79a1cb4cdc52108aedf9ca2563160967e9e82b1a07d8059ccdab6a29f549a65b6b8060b1ba74e06fa09d9f146553cb391e2a18ba7859f20b6527c369d749651f6d8b8678f644af8b02e5afe78ad5065d9a9316102beb27278ce158a35d6924aa7c75abe660ac3df17d679d86a1e3ca5d336eca4bf1b90ecd8d70b4ad8c6ae3f54207b85453399e6cc1ff27ab206fc2aec98597707f4a85901ccb391332462abe6f50fbd1d7ab318f2b622985dd"}, @ETHTOOL_A_BITSET_MASK={0x8, 0x5, "1c8207b9"}, @ETHTOOL_A_BITSET_VALUE={0x2c, 0x4, "483df51984cd0c0f87eb69ff5162ba9ce231661c5552228344bc1ae236299448210efb7991653493"}, @ETHTOOL_A_BITSET_MASK={0x91, 0x5, "4106a5195676e5e38e12ea368e107a5715e2821134b1dac191cdbd910024883da04d65135ddcd811e056a49f8ada4c72c1dd81b9cfddcca270f7b5f30f6cea7a48f699edd3e802ffd5532d1e14486a9145c60680cbc92e688079f2db271205674f94c190e21dcfb09235fd50df9759606c320ddd58d9b2966039c2422e1314f0f24cb204a668729fe07294e54b"}, @ETHTOOL_A_BITSET_BITS={0x10c, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '@\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5c0}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '\'&\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\x80\x00'}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ']\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '%&/$!\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '*|*\x85\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xf}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, 'lo\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x11, 0x2, 'veth0_to_hsr\x00'}]}, {0x4}, {0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\'\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x7, 0x2, '-!\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '!-[\\\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_VALUE={0xbe, 0x4, "db10ff7690b3b68c5157eca8d3aae1e8b6f2d0a49fa816cd8008163bda8bba33ecb14f9b7d81d25e7689db2482cc65db83053338241117140ec9c518396360c73eab44a1593fa852d54d661fc39491b491bb146bb95eed81b85178dfd09f5694b6d523b0c5b39e530d213629cd3ce224290820f6ae18eff7a0d5ba9abfaf49538392381d527d1cb816991f27c54c4b0b2cc6176e797eb36084abe60c123e021579d10fe2057e0b372152e86f063c45c1bea1697cb08af682e3d4"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0xa5e}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x4d, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x153c}, 0x1, 0x0, 0x0, 0x1}, 0x20048000) setsockopt$sock_int(r2, 0x1, 0x7, &(0x7f0000001040)=0x10000b, 0x4) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x3}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r7 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r7, 0x8993, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_coalesce={0x1, 0xf0, 0x67598305, 0x9, 0x6, 0x0, 0x2, 0x80000001, 0x5, 0xfff, 0x5, 0x1, 0x2000, 0x0, 0x9, 0xa8, 0x5, 0x8000dff, 0xff, 0x452, 0x1000, 0xb, 0x4}}) 1.709926435s ago: executing program 4 (id=4405): ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x4, 0x9, 0x8, 0x4, 0x67, @empty, @mcast1, 0x20, 0x8000, 0x3fb, 0xffe}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="6c0000001000010400"/20, @ANYBLOB="5d580000000000001c001a8018000a801400070000000000000000000000000000000001140003006970766c616e310000000000000000001c0012800b0001006970766c61"], 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x84) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={0xffffffffffffffff, 0x2f, 0xe, 0x0, &(0x7f0000000100)="c0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa5c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x50) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f00000000c0)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) socket(0x400000000010, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0900000004000000040000000001000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="006715beb813b31a910000000000000000a12600"/30], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESHEX=r0, @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="06e4847e2f0b01fa3a1af5c804000000feffff0800000000000001ae"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="03090000000000000000000000000000611800000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff85000000010000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0xe, 0x0, &(0x7f00000003c0)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000200003"], 0x4c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x2, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x39, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r12, &(0x7f00000bd000), 0x318, 0x0) r13 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r12, &(0x7f0000000040)={0x90000005}) connect$unix(r11, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) splice(r8, 0x0, r10, 0x0, 0xf3a, 0x0) close(r9) write(r7, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) 1.689151088s ago: executing program 0 (id=4406): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)={0x44, r1, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_NO_PREAUTH={0x4}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac0b}], @crypto_settings=[@NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x4}]]}, 0x44}, 0x1, 0x0, 0x0, 0x24000000}, 0xc090) (fail_nth: 7) 1.538405207s ago: executing program 2 (id=4407): r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r0, &(0x7f0000000140)="ed", 0x1, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000007c0), r0) 908.492017ms ago: executing program 0 (id=4408): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@newqdisc={0x8c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x5c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x4}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}, @TCA_NETEM_RATE={0x14, 0x6, {0xfffffff8, 0x6, 0x5, 0x9}}]}}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 890.989999ms ago: executing program 3 (id=4409): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a000000080000000200000fffffffff0e000000000000000380000007000000030000ca75ffffff"], 0x0, 0x46, 0x0, 0x6}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="500100001a000100000000000200000002001c1f0000c808ffffffea0800", @ANYRES32=r0, @ANYBLOB="06001c004e21000008000100ac1414"], 0x150}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4040080) 802.248761ms ago: executing program 1 (id=4410): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@rxrpc=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e23, @private=0xa010100}}, 0x80, 0x0}, 0x54890) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a11800150006001400000000120800030043000040a800", 0x32}], 0x1}, 0x200488c4) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$packet(0x11, 0x2, 0x300) r1 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_int(r1, 0x6, 0x1, &(0x7f00000000c0)=0x9, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300ac1414aa0800060006"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r6, 0x6f6) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x20, r9, 0x1, 0x0, 0x1000000, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000002d40)=0x1, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'}) 630.112949ms ago: executing program 2 (id=4411): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x20a201, 0x0) close(r4) socket$tipc(0x1e, 0x2, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) socket(0x2, 0x80000, 0x0) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r5, 0x12, 0x3, &(0x7f0000000000), 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_DEL(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)={0x1c, r7, 0x1, 0x0, 0x0, {0x54}, [@DEVLINK_ATTR_PORT_INDEX={0x8}]}, 0x1c}}, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) getsockopt(r8, 0x7fff, 0x7, &(0x7f0000000380)=""/124, &(0x7f0000000400)=0x7c) setsockopt$inet_tcp_int(r8, 0x6, 0x1, &(0x7f00000000c0)=0x6, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x25, &(0x7f0000000200)=0x437b, 0x4) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e1d, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r8, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1) sendmsg$inet(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="9ad0c7c5ea8ded2f36d411b49aed248f010cf36989bcf6f373", 0x19}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r8, &(0x7f0000000500)="454f720cdeea10c4782116e4ce183ce66cbe0eac658aac8f5608f9b64ccf57ecc6fbd21f775a9b430afdc0dce5c226650f2a017c7a7a90f191d88b61b55e2d4585dfcfcbee0fd3920bc3aa5e7bfa3325df799ee862ae2147f798246bb2b8f886cdbdd12d980c1da97fcd872c2618d81d8a2bebd0a458ffed4ef176af10c9d28b402306b643e4734efee632f926d8321ddf46ce79d800dc22adff8cb30ebf555fbe02dc7e8fab71192a1219ee9f9f889347441444a44f8308deb8b81c893043361df8737d7c915199f9", 0xc9, 0x4085, 0x0, 0x0) 589.157286ms ago: executing program 4 (id=4412): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000f4f592c2955c19df"], 0x50) socket$rxrpc(0x21, 0x2, 0x2) (async) r0 = socket$rxrpc(0x21, 0x2, 0x2) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000041ffffff00000000080000009111b9000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e21, 0x3, @mcast1, 0xfffffffd}, 0x1c) (async) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e21, 0x3, @mcast1, 0xfffffffd}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[], 0x32600) (async) write$cgroup_subtree(r2, &(0x7f00000004c0)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) unshare(0x400) (async) unshare(0x400) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000001c0)={@cgroup=r4, 0x7, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000480)=0x0, &(0x7f0000000540)=0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r7) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010029bd7300000000003900000008000300", @ANYRES32=r9, @ANYBLOB="10005a800400008005000203"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x5}]}}, @TCA_RATE={0x6, 0x5, {0xfe, 0x1}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x68, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}, @TCA_RATE={0x6, 0x5, {0xfe, 0x1}}]}, 0x68}}, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x68, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}, @TCA_RATE={0x6, 0x5, {0xfe, 0x1}}]}, 0x68}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newtclass={0x68, 0x28, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x34, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x1000, 0x1000}}]}}, @TCA_RATE={0x6, 0x5, {0xfe, 0x2}}]}, 0x68}}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000640)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x80, 0x0, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@ETHTOOL_A_STRSET_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @ETHTOOL_A_STRSET_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x40004}, 0x0) getsockopt(r0, 0x110, 0x7, 0x0, &(0x7f0000000280)) (async) getsockopt(r0, 0x110, 0x7, 0x0, &(0x7f0000000280)) r12 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000880)=@generic={&(0x7f0000000840)='./file0\x00', 0x0, 0x8}, 0x18) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000008c0)={&(0x7f0000000680)="8f30f5b7ef9fc5ee275117b8db55f436247b1873c403adcb9bcf2dee4ec6641c6fed8a305966c253aabfa9e4efb36be03fb60b3a82810c2d6414a91df765a7", &(0x7f00000006c0)=""/32, &(0x7f0000000700)="bc978a9fc9386ff8a97fc156bcf0883249dcad39", &(0x7f0000000740)="ff7bcacd6e3b95335c9bf0d2748beab2569711e5b8d2691aa6b15b485ab94aa12b71d0a26792c8ca4fac1d9e6e54affa9706156e84eed522e867808b9d6015ac5684880a52722c41f13f30f101124ba7aae6fb374cb6eeef3c52d7c8a219c3584102b0129fc4117cdc07e6714591c7de0ce4a5e803f4b09953f6c79c5f6252b68bc06e57d287424a51534f052d8136fea4c1f34a64dec48e50388ac67694c5146c845c655f579ae0c9b092f84622752039f092c9f8b647f0972f4850fe87d66db19661ec53e7009bf75d9c90b7fe6c39c37b8cd2a871cc69925268645cd949205d66fbed3391470fba7a099eade077c3c8e6", 0x9, r12}, 0x38) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000008c0)={&(0x7f0000000680)="8f30f5b7ef9fc5ee275117b8db55f436247b1873c403adcb9bcf2dee4ec6641c6fed8a305966c253aabfa9e4efb36be03fb60b3a82810c2d6414a91df765a7", &(0x7f00000006c0)=""/32, &(0x7f0000000700)="bc978a9fc9386ff8a97fc156bcf0883249dcad39", &(0x7f0000000740)="ff7bcacd6e3b95335c9bf0d2748beab2569711e5b8d2691aa6b15b485ab94aa12b71d0a26792c8ca4fac1d9e6e54affa9706156e84eed522e867808b9d6015ac5684880a52722c41f13f30f101124ba7aae6fb374cb6eeef3c52d7c8a219c3584102b0129fc4117cdc07e6714591c7de0ce4a5e803f4b09953f6c79c5f6252b68bc06e57d287424a51534f052d8136fea4c1f34a64dec48e50388ac67694c5146c845c655f579ae0c9b092f84622752039f092c9f8b647f0972f4850fe87d66db19661ec53e7009bf75d9c90b7fe6c39c37b8cd2a871cc69925268645cd949205d66fbed3391470fba7a099eade077c3c8e6", 0x9, r12}, 0x38) unshare(0x2020400) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8982, &(0x7f0000000340)={0x6, 'gre0\x00', {0x7fffffff}, 0x3}) 584.988422ms ago: executing program 3 (id=4413): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x8001}, {0xffff, 0xffff}, {0xb, 0x2}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000600)=@newtclass={0x38, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x8001}, {0x0, 0x8001}}, [@tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x3e8}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000700)=@newtfilter={0x24, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb}, {0x1, 0x8001}, {0x3, 0x300}}}, 0x24}}, 0x0) (fail_nth: 8) 317.93797ms ago: executing program 0 (id=4414): socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000003000000000000000000000095f1000000000000"], &(0x7f00000001c0)='syzkaller\x00'}, 0x80) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ipvlan0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r0, r2, 0x25, 0x7, @void}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400000010000108000000000000000000ffff00", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000011c0)=ANY=[@ANYBLOB="0b000000080000000100010009000000010000003a86a485ffffa605a28e913b453aa3cb862bf44c7c42cd8e75aceceff1b19676c8ff19ba96b91992c5b6ce83bcb7b3c17b7be4f22a89c03942054aceea8a5efda73772187a2cc1b3f52bd54fbabdb97fb37111cd82999dac2d77fd85c50a2b4352af4a738e894006a70d5488fd6ac46756a702338674c184af503e7223257a35e1f7fba07fe654e4ad64781375c0c42ba9f48e7cbaf88fbc747ca12a55e5d7a6ce0bb4a3543ae6ec064820a3d2953368474f0f8763f02eb4ecb26470fcb2e5fd32185f44abc68ed577e20ae5d89c68", @ANYRES32, @ANYBLOB="f8ffffff00"/20, @ANYRES32=0x0, @ANYBLOB="a44be3bbd025cf75497800f40a3d4b89c712220dea962bdf8308f8a09e72", @ANYBLOB='\x00'/28], 0x50) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000000)) r4 = socket(0x1d, 0x2, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r6 = openat$cgroup_type(r5, &(0x7f0000000080), 0x2, 0x0) write$cgroup_type(r6, &(0x7f00000000c0), 0x9) r7 = openat$cgroup_procs(r5, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f0000000c40), 0x12) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r9, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x38}, 0x60) listen(r9, 0xf5f) accept(r9, 0x0, 0x0) r10 = openat$cgroup_ro(r8, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000200)=0x1, 0x12) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000e40)=ANY=[], 0xb8}}, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8922, 0x0) listen(r4, 0x5) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 127.219137ms ago: executing program 1 (id=4415): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xf}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 49.907632ms ago: executing program 3 (id=4416): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000400000000000005000018450000fdffffff000000adcc2b003e1b00000000040000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000400000000000005000018450000fdffffff000000adcc2b003e1b00000000040000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x94) bind$bt_hci(r1, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000002c0)='FROZEN\x00', 0x7) (async) write$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000002c0)='FROZEN\x00', 0x7) sendmsg$nl_generic(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001300)=ANY=[@ANYBLOB="140000000000000000dbdf250000000000000000"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) (async) sendmsg$nl_generic(r3, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000013c0)={&(0x7f0000001300)=ANY=[@ANYBLOB="140000000000000000dbdf250000000000000000"], 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20008040) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f00000000c0)=@ccm_128={{0x303}, "5db4d14e2d6e16e5", "fb7d668661b8c9ddf4abaab1ff76dc00", "eb8800", "0d000000050200"}, 0x28) setsockopt$inet6_tcp_int(r5, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000380)={0x0, 0xb1, "0a009b1400b412c6cfc82d2501b9ca2882a1552e147963249655e10339e59e355640a0cfefc7fbea70aabce6bed0631ac86a7d434a9eba09338c7a1c1be3b91707da7be058f7853185cf044bc1a1163a108af2a25687455cbef23cf60f0773f2395f52241f44bbb83eb7beb9ecba01a71d67c8d0530c4fcf66c0ec33318453073468e3d37f9282be71f85d016b910963a8061ed23b1eda3ad1274babfbc96f32e02f1ca9ee4b0f84451ed5f2afce8c8480"}, &(0x7f0000000480)=0xb9) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@loopback, @local, 0x0}, &(0x7f0000000040)=0xc) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r3, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="431f4b73465bb77d0c717b430747a2dd1a55b1661d30a82e51d31884cee2156c26f6c123bcc79a5bd483fd9f6162713a3485c06a12c225b7dfeea6aab919772deef35e64ab9ef80d8bc65f676a51c3adc090ae965fd767c66b2ed6fb45584e23d6dfecb60a6ded8e1fd4b75f52a655510d3107994df83e363e0100ff73e5daced0564a30a8659eb8bea1", @ANYBLOB="04002abd7000fbdbdf2512000c0008000600fbffffff080006000300"/38], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000c1) r7 = socket(0x840000000002, 0x3, 0x100) connect$inet(r7, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) (async) connect$inet(r7, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(r7, &(0x7f0000005240), 0x4000095, 0x0) bind$rds(r7, 0x0, 0x0) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$FOU_CMD_DEL(r3, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x2c, r8, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @loopback}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e23}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x6c}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x1000) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'syztnl2\x00', r6, 0x29, 0x3, 0x5, 0x80000000, 0x4, @rand_addr=' \x01\x00', @local, 0x20, 0x20}}) connect$inet(r7, &(0x7f0000000440)={0x2, 0x4e24, @multicast1}, 0x10) (async) connect$inet(r7, &(0x7f0000000440)={0x2, 0x4e24, @multicast1}, 0x10) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) (async) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0x9) (async) r9 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="14000000ed03014000000000000000000000000a14000000f903"], 0x28}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x15, 0xa, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018000000", @ANYRES32=r0, @ANYBLOB="0000000000000000de8000000000000018000000000000000000000000000000950000000000000095"], &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) 0s ago: executing program 4 (id=4417): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e21, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7}, @in6={0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}, @in6={0xa, 0x4e21, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}, @in6={0xa, 0x4e23, 0xfffffffb, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x80000000}, @in={0x2, 0x4e20, @local}], 0x90) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x2c, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) kernel console output (not intermixed with test programs): pfx_netlink_rcv_skb+0x10/0x10 [ 452.700469][T17578] ? down_read+0x2be/0x330 [ 452.700493][T17578] genl_rcv+0x28/0x40 [ 452.700518][T17578] netlink_unicast+0x7bd/0x940 [ 452.700551][T17578] netlink_sendmsg+0x813/0xb40 [ 452.700584][T17578] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.700617][T17578] ? apparmor_socket_sendmsg+0x98/0x360 [ 452.700654][T17578] ? __pfx_netlink_sendmsg+0x10/0x10 [ 452.700677][T17578] sock_sendmsg_nosec+0x13a/0x180 [ 452.700706][T17578] ____sys_sendmsg+0x54e/0x850 [ 452.700733][T17578] ? __pfx_____sys_sendmsg+0x10/0x10 [ 452.700762][T17578] ? import_iovec+0x73/0xa0 [ 452.700786][T17578] ___sys_sendmsg+0x2a5/0x360 [ 452.700805][T17578] ? __lock_acquire+0x6df/0x2e50 [ 452.700830][T17578] ? __pfx____sys_sendmsg+0x10/0x10 [ 452.700891][T17578] ? __fget_files+0x2a/0x420 [ 452.700914][T17578] ? __fget_files+0x3a2/0x420 [ 452.700949][T17578] __x64_sys_sendmsg+0x1b1/0x290 [ 452.700973][T17578] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 452.701018][T17578] do_syscall_64+0x166/0x520 [ 452.701044][T17578] ? trace_irq_disable+0x3b/0x140 [ 452.701062][T17578] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.701082][T17578] ? clear_bhb_loop+0x70/0xc0 [ 452.701106][T17578] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.701125][T17578] RIP: 0033:0x7fd4b0f9e159 [ 452.701144][T17578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.701161][T17578] RSP: 002b:00007fd4b1dbd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 452.701181][T17578] RAX: ffffffffffffffda RBX: 00007fd4b1225fa0 RCX: 00007fd4b0f9e159 [ 452.701196][T17578] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 452.701208][T17578] RBP: 00007fd4b1dbd090 R08: 0000000000000000 R09: 0000000000000000 [ 452.701220][T17578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.701232][T17578] R13: 00007fd4b1226038 R14: 00007fd4b1225fa0 R15: 00007ffe357f5908 [ 452.701266][T17578] [ 452.701311][T17578] tipc: Node creation failed, no memory [ 452.958617][T17581] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3686'. [ 453.088323][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 453.088410][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 453.172092][T17591] FAULT_INJECTION: forcing a failure. [ 453.172092][T17591] name failslab, interval 1, probability 0, space 0, times 0 [ 453.172147][T17591] CPU: 0 UID: 0 PID: 17591 Comm: syz.3.3687 Not tainted syzkaller #0 PREEMPT(full) [ 453.172167][T17591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 453.172178][T17591] Call Trace: [ 453.172184][T17591] [ 453.172191][T17591] dump_stack_lvl+0xe8/0x150 [ 453.172226][T17591] should_fail_ex+0x410/0x560 [ 453.172258][T17591] should_failslab+0xa8/0x100 [ 453.172283][T17591] __kmalloc_noprof+0xfe/0x720 [ 453.172308][T17591] ? __kmalloc_node_track_caller_noprof+0x4d2/0x720 [ 453.172335][T17591] ? sctp_tsnmap_init+0x9c/0x1f0 [ 453.172352][T17591] ? sctp_tsnmap_init+0x9c/0x1f0 [ 453.172368][T17591] ? kmemdup_noprof+0x55/0x70 [ 453.172388][T17591] sctp_tsnmap_init+0x9c/0x1f0 [ 453.172412][T17591] sctp_process_init+0x2592/0x2cf0 [ 453.172459][T17591] ? __pfx_sctp_process_init+0x10/0x10 [ 453.172481][T17591] ? sctp_sf_do_5_1C_ack+0x7d2/0xd70 [ 453.172512][T17591] ? kasan_save_track+0x4f/0x80 [ 453.172528][T17591] ? kasan_save_track+0x3e/0x80 [ 453.172544][T17591] ? kasan_save_free_info+0x40/0x50 [ 453.172575][T17591] sctp_do_sm+0x189b/0x5dd0 [ 453.172593][T17591] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.172627][T17591] ? __pfx_sctp_do_sm+0x10/0x10 [ 453.172682][T17591] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 453.172702][T17591] ? lockdep_hardirqs_on+0x7b/0x110 [ 453.172726][T17591] ? seqcount_lockdep_reader_access+0xea/0x100 [ 453.172749][T17591] sctp_assoc_bh_rcv+0x401/0x6f0 [ 453.172781][T17591] sctp_backlog_rcv+0x15c/0x370 [ 453.172812][T17591] ? __pfx_sctp_backlog_rcv+0x10/0x10 [ 453.172836][T17591] __release_sock+0x28b/0x390 [ 453.172868][T17591] release_sock+0x190/0x260 [ 453.172895][T17591] sctp_sendmsg+0x1c09/0x2d00 [ 453.172931][T17591] ? kstrtouint+0x6e/0xe0 [ 453.172955][T17591] ? __pfx_sctp_sendmsg+0x10/0x10 [ 453.172978][T17591] ? lock_acquire+0x115/0x350 [ 453.172997][T17591] ? get_pid_task+0x20/0x1f0 [ 453.173030][T17591] ? aa_sock_msg_perm+0xf5/0x210 [ 453.173049][T17591] ? sock_rps_record_flow+0x19/0x350 [ 453.173074][T17591] ? inet_sendmsg+0x298/0x320 [ 453.173094][T17591] ? apparmor_socket_sendmsg+0x27b/0x360 [ 453.173122][T17591] ? __pfx_inet_sendmsg+0x10/0x10 [ 453.173144][T17591] sock_sendmsg_nosec+0x10e/0x180 [ 453.173169][T17591] __sys_sendto+0x408/0x5a0 [ 453.173195][T17591] ? ksys_write+0x1e6/0x270 [ 453.173229][T17591] ? __pfx___sys_sendto+0x10/0x10 [ 453.173253][T17591] ? __mutex_unlock_slowpath+0x731/0x900 [ 453.173305][T17591] ? __pfx_ksys_write+0x10/0x10 [ 453.173335][T17591] __x64_sys_sendto+0xde/0x100 [ 453.173365][T17591] do_syscall_64+0x166/0x520 [ 453.173389][T17591] ? trace_irq_disable+0x3b/0x140 [ 453.173406][T17591] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.173425][T17591] ? clear_bhb_loop+0x70/0xc0 [ 453.173447][T17591] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.173465][T17591] RIP: 0033:0x7fd4b0f9e159 [ 453.173484][T17591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.173500][T17591] RSP: 002b:00007fd4b1dbd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 453.173519][T17591] RAX: ffffffffffffffda RBX: 00007fd4b1225fa0 RCX: 00007fd4b0f9e159 [ 453.173533][T17591] RDX: 000000000000fffd RSI: 0000200000000040 RDI: 0000000000000003 [ 453.173545][T17591] RBP: 00007fd4b1dbd090 R08: 0000200000000100 R09: 000000000000001c [ 453.173558][T17591] R10: 00000080ffffffff R11: 0000000000000246 R12: 0000000000000002 [ 453.173569][T17591] R13: 00007fd4b1226038 R14: 00007fd4b1225fa0 R15: 00007ffe357f5908 [ 453.173599][T17591] [ 453.632513][T17602] FAULT_INJECTION: forcing a failure. [ 453.632513][T17602] name failslab, interval 1, probability 0, space 0, times 0 [ 453.632575][T17602] CPU: 0 UID: 0 PID: 17602 Comm: syz.3.3691 Not tainted syzkaller #0 PREEMPT(full) [ 453.632595][T17602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 453.632605][T17602] Call Trace: [ 453.632611][T17602] [ 453.632617][T17602] dump_stack_lvl+0xe8/0x150 [ 453.632644][T17602] should_fail_ex+0x410/0x560 [ 453.632675][T17602] should_failslab+0xa8/0x100 [ 453.632697][T17602] ? skb_clone+0x212/0x3a0 [ 453.632717][T17602] kmem_cache_alloc_noprof+0xa1/0x600 [ 453.632746][T17602] ? skb_clone+0x212/0x3a0 [ 453.632770][T17602] skb_clone+0x212/0x3a0 [ 453.632794][T17602] __netlink_deliver_tap+0x413/0x860 [ 453.632827][T17602] ? netlink_deliver_tap+0x2e/0x1b0 [ 453.632849][T17602] netlink_deliver_tap+0x19c/0x1b0 [ 453.632873][T17602] netlink_unicast+0x781/0x940 [ 453.632904][T17602] netlink_sendmsg+0x813/0xb40 [ 453.632934][T17602] ? __pfx_netlink_sendmsg+0x10/0x10 [ 453.632967][T17602] ? apparmor_socket_sendmsg+0x98/0x360 [ 453.632997][T17602] ? __pfx_netlink_sendmsg+0x10/0x10 [ 453.633018][T17602] sock_sendmsg_nosec+0x13a/0x180 [ 453.633042][T17602] ____sys_sendmsg+0x54e/0x850 [ 453.633066][T17602] ? __pfx_____sys_sendmsg+0x10/0x10 [ 453.633095][T17602] ? import_iovec+0x73/0xa0 [ 453.633118][T17602] ___sys_sendmsg+0x2a5/0x360 [ 453.633137][T17602] ? __lock_acquire+0x6df/0x2e50 [ 453.633159][T17602] ? __pfx____sys_sendmsg+0x10/0x10 [ 453.633212][T17602] ? __fget_files+0x2a/0x420 [ 453.633235][T17602] ? __fget_files+0x3a2/0x420 [ 453.633267][T17602] __x64_sys_sendmsg+0x1b1/0x290 [ 453.633289][T17602] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 453.633329][T17602] do_syscall_64+0x166/0x520 [ 453.633355][T17602] ? trace_irq_disable+0x3b/0x140 [ 453.633372][T17602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.633390][T17602] ? clear_bhb_loop+0x70/0xc0 [ 453.633413][T17602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.633432][T17602] RIP: 0033:0x7fd4b0f9e159 [ 453.633449][T17602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 453.633465][T17602] RSP: 002b:00007fd4b1dbd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 453.633485][T17602] RAX: ffffffffffffffda RBX: 00007fd4b1225fa0 RCX: 00007fd4b0f9e159 [ 453.633499][T17602] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 453.633510][T17602] RBP: 00007fd4b1dbd090 R08: 0000000000000000 R09: 0000000000000000 [ 453.633522][T17602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.633538][T17602] R13: 00007fd4b1226038 R14: 00007fd4b1225fa0 R15: 00007ffe357f5908 [ 453.633568][T17602] [ 453.951258][T17611] tipc: Enabling of bearer rejected, failed to enable media [ 454.118345][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 454.118476][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 454.413409][T17639] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3698'. [ 454.423314][T17639] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3698'. [ 454.440060][T17641] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3702'. [ 454.834607][T17666] tipc: Enabling of bearer rejected, failed to enable media [ 455.158328][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 455.158474][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 455.522515][T17707] sctp: [Deprecated]: syz.2.3722 (pid 17707) Use of int in max_burst socket option deprecated. [ 455.522515][T17707] Use struct sctp_assoc_value instead [ 455.723627][T17715] syzkaller0: entered promiscuous mode [ 455.730030][T17715] syzkaller0: entered allmulticast mode [ 455.739628][T17715] tipc: Enabled bearer , priority 0 [ 455.757149][T17715] tipc: Resetting bearer [ 455.765918][T17714] tipc: Resetting bearer [ 455.793752][T17714] tipc: Disabling bearer [ 456.081667][T17725] __nla_validate_parse: 2 callbacks suppressed [ 456.081711][T17725] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3728'. [ 456.129328][T17739] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3733'. [ 456.198134][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 456.386680][T17753] FAULT_INJECTION: forcing a failure. [ 456.386680][T17753] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 456.387702][T17753] CPU: 0 UID: 0 PID: 17753 Comm: syz.1.3739 Not tainted syzkaller #0 PREEMPT(full) [ 456.387726][T17753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.387737][T17753] Call Trace: [ 456.387745][T17753] [ 456.387754][T17753] dump_stack_lvl+0xe8/0x150 [ 456.387793][T17753] should_fail_ex+0x410/0x560 [ 456.387826][T17753] _copy_from_iter+0x1d3/0x1660 [ 456.387854][T17753] ? __alloc_skb+0x27a/0x7a0 [ 456.387883][T17753] ? __alloc_skb+0x27a/0x7a0 [ 456.387910][T17753] ? __alloc_skb+0x27a/0x7a0 [ 456.387936][T17753] ? __pfx__copy_from_iter+0x10/0x10 [ 456.387962][T17753] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 456.387988][T17753] ? __alloc_skb+0x27a/0x7a0 [ 456.388013][T17753] ? __alloc_skb+0x27a/0x7a0 [ 456.388041][T17753] ? netlink_sendmsg+0x650/0xb40 [ 456.388062][T17753] ? skb_put+0x112/0x210 [ 456.388081][T17753] netlink_sendmsg+0x6c0/0xb40 [ 456.388113][T17753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.388143][T17753] ? apparmor_socket_sendmsg+0x98/0x360 [ 456.388173][T17753] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.388194][T17753] sock_sendmsg_nosec+0x13a/0x180 [ 456.388221][T17753] ____sys_sendmsg+0x54e/0x850 [ 456.388247][T17753] ? __pfx_____sys_sendmsg+0x10/0x10 [ 456.388276][T17753] ? import_iovec+0x73/0xa0 [ 456.388299][T17753] ___sys_sendmsg+0x2a5/0x360 [ 456.388317][T17753] ? __lock_acquire+0x6df/0x2e50 [ 456.388340][T17753] ? __pfx____sys_sendmsg+0x10/0x10 [ 456.388392][T17753] ? __fget_files+0x2a/0x420 [ 456.388415][T17753] ? __fget_files+0x3a2/0x420 [ 456.388447][T17753] __x64_sys_sendmsg+0x1b1/0x290 [ 456.388470][T17753] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 456.388510][T17753] do_syscall_64+0x166/0x520 [ 456.388536][T17753] ? trace_irq_disable+0x3b/0x140 [ 456.388554][T17753] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.388573][T17753] ? clear_bhb_loop+0x70/0xc0 [ 456.388596][T17753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.388615][T17753] RIP: 0033:0x7f292199e159 [ 456.388633][T17753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.388650][T17753] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 456.388671][T17753] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 456.388685][T17753] RDX: 0000000000004040 RSI: 0000200000000180 RDI: 0000000000000003 [ 456.388697][T17753] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 456.388709][T17753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.388721][T17753] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 456.388752][T17753] [ 456.550586][T17759] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3741'. [ 457.179188][T17791] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3752'. [ 457.238938][ C0] net_ratelimit: 1 callbacks suppressed [ 457.238989][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 457.239076][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 457.388367][T17797] syzkaller0: entered promiscuous mode [ 457.394024][T17797] syzkaller0: entered allmulticast mode [ 457.404252][T17800] FAULT_INJECTION: forcing a failure. [ 457.404252][T17800] name failslab, interval 1, probability 0, space 0, times 0 [ 457.404302][T17800] CPU: 0 UID: 0 PID: 17800 Comm: syz.1.3758 Not tainted syzkaller #0 PREEMPT(full) [ 457.404322][T17800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 457.404331][T17800] Call Trace: [ 457.404337][T17800] [ 457.404343][T17800] dump_stack_lvl+0xe8/0x150 [ 457.404373][T17800] should_fail_ex+0x410/0x560 [ 457.404406][T17800] should_failslab+0xa8/0x100 [ 457.404430][T17800] __kvmalloc_node_noprof+0x176/0x820 [ 457.404452][T17800] ? __rhashtable_init_noprof+0x545/0xaf0 [ 457.404477][T17800] ? __rhashtable_init_noprof+0x545/0xaf0 [ 457.404510][T17800] __rhashtable_init_noprof+0x545/0xaf0 [ 457.404541][T17800] __rhltable_init_noprof+0x26/0x70 [ 457.404560][T17800] nf_tables_newtable+0x6a7/0x1990 [ 457.404598][T17800] nfnetlink_rcv+0x1288/0x28c0 [ 457.404650][T17800] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 457.404685][T17800] ? ref_tracker_free+0x689/0x830 [ 457.404727][T17800] ? skb_clone+0x246/0x3a0 [ 457.404750][T17800] ? __netlink_deliver_tap+0x811/0x860 [ 457.404780][T17800] ? netlink_deliver_tap+0x2e/0x1b0 [ 457.404801][T17800] ? netlink_deliver_tap+0x2e/0x1b0 [ 457.404828][T17800] netlink_unicast+0x7bd/0x940 [ 457.404857][T17800] netlink_sendmsg+0x813/0xb40 [ 457.404888][T17800] ? __pfx_netlink_sendmsg+0x10/0x10 [ 457.404918][T17800] ? apparmor_socket_sendmsg+0x98/0x360 [ 457.404947][T17800] ? __pfx_netlink_sendmsg+0x10/0x10 [ 457.404967][T17800] sock_sendmsg_nosec+0x13a/0x180 [ 457.404993][T17800] ____sys_sendmsg+0x54e/0x850 [ 457.405018][T17800] ? __pfx_____sys_sendmsg+0x10/0x10 [ 457.405046][T17800] ? import_iovec+0x73/0xa0 [ 457.405069][T17800] ___sys_sendmsg+0x2a5/0x360 [ 457.405086][T17800] ? __lock_acquire+0x6df/0x2e50 [ 457.405110][T17800] ? __pfx____sys_sendmsg+0x10/0x10 [ 457.405166][T17800] ? __fget_files+0x2a/0x420 [ 457.405188][T17800] ? __fget_files+0x3a2/0x420 [ 457.405228][T17800] __x64_sys_sendmsg+0x1b1/0x290 [ 457.405250][T17800] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 457.405289][T17800] do_syscall_64+0x166/0x520 [ 457.405315][T17800] ? trace_irq_disable+0x3b/0x140 [ 457.405332][T17800] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.405350][T17800] ? clear_bhb_loop+0x70/0xc0 [ 457.405372][T17800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.405390][T17800] RIP: 0033:0x7f292199e159 [ 457.405408][T17800] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 457.405423][T17800] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 457.405443][T17800] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 457.405457][T17800] RDX: 0000000000004000 RSI: 0000200000000000 RDI: 0000000000000003 [ 457.405469][T17800] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 457.405480][T17800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 457.405491][T17800] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 457.405522][T17800] [ 457.413474][T17800] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3758'. [ 457.419795][T17797] tipc: Enabled bearer , priority 0 [ 457.811439][T17807] 8021q: adding VLAN 0 to HW filter on device bond3 [ 457.812216][T17807] bridge0: port 3(bond3) entered blocking state [ 457.812374][T17807] bridge0: port 3(bond3) entered disabled state [ 457.812489][T17807] bond3: entered allmulticast mode [ 457.814800][T17807] bond3: entered promiscuous mode [ 457.815509][T17807] bridge0: port 3(bond3) entered blocking state [ 457.815616][T17807] bridge0: port 3(bond3) entered forwarding state [ 457.838520][T17796] tipc: Resetting bearer [ 457.874304][T17815] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 457.907170][T17796] tipc: Disabling bearer [ 457.931792][T17807] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3761'. [ 457.931850][T17807] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3761'. [ 458.034693][T17821] netlink: 276 bytes leftover after parsing attributes in process `syz.2.3767'. [ 458.113988][T17825] netlink: 276 bytes leftover after parsing attributes in process `syz.2.3769'. [ 458.278179][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 458.278274][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 458.370376][T17837] FAULT_INJECTION: forcing a failure. [ 458.370376][T17837] name failslab, interval 1, probability 0, space 0, times 0 [ 458.370450][T17837] CPU: 0 UID: 0 PID: 17837 Comm: syz.3.3774 Not tainted syzkaller #0 PREEMPT(full) [ 458.370470][T17837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 458.370481][T17837] Call Trace: [ 458.370489][T17837] [ 458.370499][T17837] dump_stack_lvl+0xe8/0x150 [ 458.370531][T17837] should_fail_ex+0x410/0x560 [ 458.370563][T17837] should_failslab+0xa8/0x100 [ 458.370587][T17837] __kmalloc_cache_noprof+0xa3/0x600 [ 458.370616][T17837] ? tipc_node_create+0x365/0x1d90 [ 458.370638][T17837] ? tipc_node_create+0x365/0x1d90 [ 458.370670][T17837] tipc_node_create+0x365/0x1d90 [ 458.370701][T17837] ? crypto_has_alg+0x15c/0x190 [ 458.370728][T17837] ? tipc_nl_node_set_key+0x61f/0xa20 [ 458.370758][T17837] tipc_nl_node_set_key+0x71b/0xa20 [ 458.370782][T17837] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 458.370812][T17837] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 458.370839][T17837] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 458.370875][T17837] genl_family_rcv_msg_doit+0x233/0x340 [ 458.370908][T17837] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 458.370947][T17837] ? bpf_lsm_capable+0x9/0x20 [ 458.370972][T17837] ? security_capable+0x7e/0x2c0 [ 458.370997][T17837] genl_rcv_msg+0x614/0x7a0 [ 458.371030][T17837] ? __pfx_genl_rcv_msg+0x10/0x10 [ 458.371055][T17837] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 458.371090][T17837] ? __pfx_ref_tracker_free+0x10/0x10 [ 458.371121][T17837] netlink_rcv_skb+0x226/0x4a0 [ 458.371143][T17837] ? __pfx_genl_rcv_msg+0x10/0x10 [ 458.371171][T17837] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 458.371208][T17837] ? down_read+0x2be/0x330 [ 458.371231][T17837] genl_rcv+0x28/0x40 [ 458.371253][T17837] netlink_unicast+0x7bd/0x940 [ 458.371285][T17837] netlink_sendmsg+0x813/0xb40 [ 458.371317][T17837] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.371346][T17837] ? apparmor_socket_sendmsg+0x98/0x360 [ 458.371376][T17837] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.371397][T17837] sock_sendmsg_nosec+0x13a/0x180 [ 458.371425][T17837] ____sys_sendmsg+0x54e/0x850 [ 458.371449][T17837] ? __pfx_____sys_sendmsg+0x10/0x10 [ 458.371479][T17837] ? import_iovec+0x73/0xa0 [ 458.371503][T17837] ___sys_sendmsg+0x2a5/0x360 [ 458.371522][T17837] ? __lock_acquire+0x6df/0x2e50 [ 458.371545][T17837] ? __pfx____sys_sendmsg+0x10/0x10 [ 458.371601][T17837] ? __fget_files+0x2a/0x420 [ 458.371623][T17837] ? __fget_files+0x3a2/0x420 [ 458.371656][T17837] __x64_sys_sendmsg+0x1b1/0x290 [ 458.371678][T17837] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 458.371720][T17837] do_syscall_64+0x166/0x520 [ 458.371745][T17837] ? trace_irq_disable+0x3b/0x140 [ 458.371762][T17837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.371780][T17837] ? clear_bhb_loop+0x70/0xc0 [ 458.371803][T17837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.371822][T17837] RIP: 0033:0x7fd4b0f9e159 [ 458.371839][T17837] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 458.371854][T17837] RSP: 002b:00007fd4b1dbd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 458.371873][T17837] RAX: ffffffffffffffda RBX: 00007fd4b1225fa0 RCX: 00007fd4b0f9e159 [ 458.371887][T17837] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 458.371899][T17837] RBP: 00007fd4b1dbd090 R08: 0000000000000000 R09: 0000000000000000 [ 458.371910][T17837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 458.371922][T17837] R13: 00007fd4b1226038 R14: 00007fd4b1225fa0 R15: 00007ffe357f5908 [ 458.371954][T17837] [ 458.372007][T17837] tipc: Node creation failed, no memory [ 458.540363][ T1993] block nbd4: Possible stuck request ffff888027c7e000: control (read@0,1024B). Runtime 150 seconds [ 458.540407][ T1993] block nbd4: Possible stuck request ffff888027c7e1c0: control (read@1024,1024B). Runtime 150 seconds [ 458.540434][ T1993] block nbd4: Possible stuck request ffff888027c7e380: control (read@2048,1024B). Runtime 150 seconds [ 458.540460][ T1993] block nbd4: Possible stuck request ffff888027c7e540: control (read@3072,1024B). Runtime 150 seconds [ 458.773546][ T7204] bridge0: port 3(bond3) entered disabled state [ 458.784119][T17846] netlink: 276 bytes leftover after parsing attributes in process `syz.1.3779'. [ 458.859857][T17848] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 459.300625][T17870] syzkaller0: entered promiscuous mode [ 459.306225][T17870] syzkaller0: entered allmulticast mode [ 459.318300][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 459.318401][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 459.335485][T17870] tipc: Enabled bearer , priority 0 [ 459.354655][T17870] tipc: Resetting bearer [ 459.364436][T17869] tipc: Resetting bearer [ 459.412075][T17869] tipc: Disabling bearer [ 459.744765][T17889] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 459.956353][T17893] C: renamed from veth1_to_team (while UP) [ 460.252020][T17912] syzkaller0: entered promiscuous mode [ 460.257722][T17912] syzkaller0: entered allmulticast mode [ 460.277021][T17912] tipc: Enabled bearer , priority 0 [ 460.294966][T17912] tipc: Resetting bearer [ 460.307177][T17911] tipc: Resetting bearer [ 460.334306][T17911] tipc: Disabling bearer [ 460.353709][T17915] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.354358][T17915] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.366600][T17915] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.366723][T17915] bridge0: port 2(bridge_slave_1) entered forwarding state [ 460.367011][T17915] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.367164][T17915] bridge0: port 1(bridge_slave_0) entered forwarding state [ 460.369115][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 460.376532][T17915] bridge0: entered promiscuous mode [ 460.376591][T17915] bridge0: entered allmulticast mode [ 460.926251][T17941] syzkaller0: entered promiscuous mode [ 460.934657][T17941] syzkaller0: entered allmulticast mode [ 460.944587][T17941] tipc: Enabled bearer , priority 0 [ 460.960314][T17941] tipc: Resetting bearer [ 460.970734][T17940] tipc: Resetting bearer [ 461.005116][T17940] tipc: Disabling bearer [ 461.176006][T17950] __nla_validate_parse: 9 callbacks suppressed [ 461.182524][T17950] netlink: 276 bytes leftover after parsing attributes in process `syz.1.3821'. [ 461.246937][T17952] netlink: 'syz.4.3822': attribute type 4 has an invalid length. [ 461.274690][T17952] netlink: 'syz.4.3822': attribute type 4 has an invalid length. [ 461.430027][T17965] sctp: [Deprecated]: syz.3.3828 (pid 17965) Use of int in max_burst socket option deprecated. [ 461.430027][T17965] Use struct sctp_assoc_value instead [ 461.433229][T17966] FAULT_INJECTION: forcing a failure. [ 461.433229][T17966] name failslab, interval 1, probability 0, space 0, times 0 [ 461.433259][T17966] CPU: 0 UID: 0 PID: 17966 Comm: syz.4.3827 Not tainted syzkaller #0 PREEMPT(full) [ 461.433279][T17966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 461.433290][T17966] Call Trace: [ 461.433298][T17966] [ 461.433306][T17966] dump_stack_lvl+0xe8/0x150 [ 461.433336][T17966] should_fail_ex+0x410/0x560 [ 461.433367][T17966] ? __alloc_skb+0x1db/0x7a0 [ 461.433393][T17966] should_failslab+0xa8/0x100 [ 461.433416][T17966] ? __alloc_skb+0x1db/0x7a0 [ 461.433440][T17966] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 461.433466][T17966] ? __alloc_skb+0x18d/0x7a0 [ 461.433491][T17966] ? __alloc_skb+0x1db/0x7a0 [ 461.433523][T17966] __alloc_skb+0x1db/0x7a0 [ 461.433552][T17966] netlink_sendmsg+0x5d4/0xb40 [ 461.433584][T17966] ? __pfx_netlink_sendmsg+0x10/0x10 [ 461.433614][T17966] ? apparmor_socket_sendmsg+0x98/0x360 [ 461.433643][T17966] ? __pfx_netlink_sendmsg+0x10/0x10 [ 461.433663][T17966] sock_sendmsg_nosec+0x13a/0x180 [ 461.433689][T17966] ____sys_sendmsg+0x54e/0x850 [ 461.433725][T17966] ? __pfx_____sys_sendmsg+0x10/0x10 [ 461.433752][T17966] ? import_iovec+0x73/0xa0 [ 461.433775][T17966] ___sys_sendmsg+0x2a5/0x360 [ 461.433794][T17966] ? __lock_acquire+0x6df/0x2e50 [ 461.433816][T17966] ? __pfx____sys_sendmsg+0x10/0x10 [ 461.433868][T17966] ? __fget_files+0x2a/0x420 [ 461.433890][T17966] ? __fget_files+0x3a2/0x420 [ 461.433922][T17966] __x64_sys_sendmsg+0x1b1/0x290 [ 461.433944][T17966] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 461.433983][T17966] do_syscall_64+0x166/0x520 [ 461.434009][T17966] ? trace_irq_disable+0x3b/0x140 [ 461.434026][T17966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.434045][T17966] ? clear_bhb_loop+0x70/0xc0 [ 461.434066][T17966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.434085][T17966] RIP: 0033:0x7f20daf9e159 [ 461.434102][T17966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 461.434118][T17966] RSP: 002b:00007f20dbed5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 461.434138][T17966] RAX: ffffffffffffffda RBX: 00007f20db225fa0 RCX: 00007f20daf9e159 [ 461.434151][T17966] RDX: 0000000000000004 RSI: 0000200000000000 RDI: 0000000000000003 [ 461.434163][T17966] RBP: 00007f20dbed5090 R08: 0000000000000000 R09: 0000000000000000 [ 461.434175][T17966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 461.434186][T17966] R13: 00007f20db226038 R14: 00007f20db225fa0 R15: 00007ffd1fd16238 [ 461.434215][T17966] [ 461.616659][T17968] netlink: 'syz.0.3829': attribute type 12 has an invalid length. [ 461.616684][T17968] netlink: 'syz.0.3829': attribute type 29 has an invalid length. [ 461.616701][T17968] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3829'. [ 461.780660][T17976] netlink: 276 bytes leftover after parsing attributes in process `syz.0.3833'. [ 462.216829][T17997] netlink: 'syz.4.3840': attribute type 10 has an invalid length. [ 462.227210][T17997] netlink: 'syz.4.3840': attribute type 10 has an invalid length. [ 462.412416][T18005] sctp: [Deprecated]: syz.4.3843 (pid 18005) Use of int in max_burst socket option deprecated. [ 462.412416][T18005] Use struct sctp_assoc_value instead [ 462.438656][ C0] net_ratelimit: 5 callbacks suppressed [ 462.438710][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 462.438793][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 462.590982][T18010] netlink: 276 bytes leftover after parsing attributes in process `syz.4.3846'. [ 462.974418][T18032] netlink: 'syz.0.3853': attribute type 10 has an invalid length. [ 463.012509][T18032] team0: Port device dummy0 added [ 463.027162][T18032] netlink: 'syz.0.3853': attribute type 10 has an invalid length. [ 463.057584][T18032] team0: Port device dummy0 removed [ 463.248462][T18044] netlink: 'syz.0.3856': attribute type 1 has an invalid length. [ 463.263623][T18044] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3856'. [ 463.273533][T18044] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3856'. [ 463.317172][T18048] netlink: 276 bytes leftover after parsing attributes in process `syz.3.3859'. [ 463.478375][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 463.478475][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 463.494466][T18056] syzkaller0: entered promiscuous mode [ 463.494503][T18056] syzkaller0: entered allmulticast mode [ 463.504556][T18056] tipc: Enabled bearer , priority 0 [ 463.507915][T18056] tipc: Resetting bearer [ 463.512906][T18055] tipc: Resetting bearer [ 463.550614][T18055] tipc: Disabling bearer [ 464.083390][T18078] netlink: 276 bytes leftover after parsing attributes in process `syz.4.3870'. [ 464.164302][T18085] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3873'. [ 464.326917][T18093] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3875'. [ 464.518247][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 464.518350][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 464.624843][T18110] syzkaller0: entered promiscuous mode [ 464.624890][T18110] syzkaller0: entered allmulticast mode [ 464.695229][T18117] SET target dimension over the limit! [ 464.918499][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 465.558769][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 465.558871][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 466.598277][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 466.598377][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 467.137970][T18085] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 467.275022][T18125] __nla_validate_parse: 2 callbacks suppressed [ 467.282151][T18125] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3888'. [ 467.377264][T18130] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3889'. [ 467.474270][T18138] netlink: 276 bytes leftover after parsing attributes in process `syz.0.3895'. [ 467.638191][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 467.638294][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 467.714329][T18159] FAULT_INJECTION: forcing a failure. [ 467.714329][T18159] name failslab, interval 1, probability 0, space 0, times 0 [ 467.727414][T18159] CPU: 0 UID: 0 PID: 18159 Comm: syz.2.3901 Not tainted syzkaller #0 PREEMPT(full) [ 467.727442][T18159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 467.727454][T18159] Call Trace: [ 467.727463][T18159] [ 467.727471][T18159] dump_stack_lvl+0xe8/0x150 [ 467.727504][T18159] should_fail_ex+0x410/0x560 [ 467.727537][T18159] ? __alloc_skb+0x1db/0x7a0 [ 467.727564][T18159] should_failslab+0xa8/0x100 [ 467.727586][T18159] ? __alloc_skb+0x1db/0x7a0 [ 467.727609][T18159] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 467.727635][T18159] ? __alloc_skb+0x18d/0x7a0 [ 467.727662][T18159] ? __alloc_skb+0x1db/0x7a0 [ 467.727695][T18159] __alloc_skb+0x1db/0x7a0 [ 467.727725][T18159] netlink_sendmsg+0x5d4/0xb40 [ 467.727768][T18159] ? __pfx_netlink_sendmsg+0x10/0x10 [ 467.727797][T18159] ? apparmor_socket_sendmsg+0x98/0x360 [ 467.727825][T18159] ? __pfx_netlink_sendmsg+0x10/0x10 [ 467.727846][T18159] sock_sendmsg_nosec+0x13a/0x180 [ 467.727872][T18159] ____sys_sendmsg+0x54e/0x850 [ 467.727897][T18159] ? __pfx_____sys_sendmsg+0x10/0x10 [ 467.727926][T18159] ? import_iovec+0x73/0xa0 [ 467.727950][T18159] ___sys_sendmsg+0x2a5/0x360 [ 467.727968][T18159] ? __lock_acquire+0x6df/0x2e50 [ 467.727992][T18159] ? __pfx____sys_sendmsg+0x10/0x10 [ 467.728043][T18159] ? __fget_files+0x2a/0x420 [ 467.728065][T18159] ? __fget_files+0x3a2/0x420 [ 467.728095][T18159] __x64_sys_sendmsg+0x1b1/0x290 [ 467.728117][T18159] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 467.728156][T18159] do_syscall_64+0x166/0x520 [ 467.728181][T18159] ? trace_irq_disable+0x3b/0x140 [ 467.728198][T18159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.728217][T18159] ? clear_bhb_loop+0x70/0xc0 [ 467.728239][T18159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.728257][T18159] RIP: 0033:0x7faec419e159 [ 467.728275][T18159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.728292][T18159] RSP: 002b:00007faec4fab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 467.728312][T18159] RAX: ffffffffffffffda RBX: 00007faec4425fa0 RCX: 00007faec419e159 [ 467.728326][T18159] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000003 [ 467.728338][T18159] RBP: 00007faec4fab090 R08: 0000000000000000 R09: 0000000000000000 [ 467.728350][T18159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.728361][T18159] R13: 00007faec4426038 R14: 00007faec4425fa0 R15: 00007ffec9d290c8 [ 467.728391][T18159] [ 467.994142][T18167] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3902'. [ 468.678131][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 468.678237][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 468.943239][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 468.949016][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 468.949338][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 468.950331][T18196] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 468.991093][T18197] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3913'. [ 469.067943][T18199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 469.139301][T18204] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3918'. [ 469.148564][T18204] netlink: 'syz.3.3918': attribute type 11 has an invalid length. [ 469.158097][T18204] netlink: 'syz.3.3918': attribute type 11 has an invalid length. [ 469.718404][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 469.718497][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 470.022299][T18242] FAULT_INJECTION: forcing a failure. [ 470.022299][T18242] name failslab, interval 1, probability 0, space 0, times 0 [ 470.022353][T18242] CPU: 1 UID: 0 PID: 18242 Comm: syz.4.3931 Not tainted syzkaller #0 PREEMPT(full) [ 470.022373][T18242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 470.022383][T18242] Call Trace: [ 470.022388][T18242] [ 470.022395][T18242] dump_stack_lvl+0xe8/0x150 [ 470.022422][T18242] should_fail_ex+0x410/0x560 [ 470.022456][T18242] should_failslab+0xa8/0x100 [ 470.022479][T18242] __kmalloc_cache_noprof+0xa3/0x600 [ 470.022508][T18242] ? __kmalloc_cache_noprof+0x14d/0x600 [ 470.022532][T18242] ? sctp_add_bind_addr+0x8c/0x370 [ 470.022552][T18242] ? sctp_add_bind_addr+0x8c/0x370 [ 470.022579][T18242] sctp_add_bind_addr+0x8c/0x370 [ 470.022604][T18242] sctp_copy_local_addr_list+0x31a/0x4e0 [ 470.022629][T18242] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 470.022650][T18242] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 470.022672][T18242] ? sctp_v6_is_any+0x64/0x80 [ 470.022696][T18242] ? sctp_copy_one_addr+0x93/0x360 [ 470.022721][T18242] sctp_bind_addr_copy+0xb3/0x3c0 [ 470.022744][T18242] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 470.022766][T18242] sctp_connect_new_asoc+0x2ff/0x6b0 [ 470.022795][T18242] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 470.022827][T18242] ? __local_bh_enable_ip+0xd6/0x140 [ 470.022855][T18242] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 470.022878][T18242] ? security_sctp_bind_connect+0x7e/0x2c0 [ 470.022907][T18242] sctp_sendmsg+0x159b/0x2d00 [ 470.022943][T18242] ? kstrtouint+0x6e/0xe0 [ 470.022967][T18242] ? __pfx_sctp_sendmsg+0x10/0x10 [ 470.022991][T18242] ? lock_acquire+0x115/0x350 [ 470.023009][T18242] ? get_pid_task+0x20/0x1f0 [ 470.023044][T18242] ? aa_sock_msg_perm+0xf5/0x210 [ 470.023063][T18242] ? sock_rps_record_flow+0x19/0x350 [ 470.023088][T18242] ? inet_sendmsg+0x298/0x320 [ 470.023113][T18242] ? __pfx_inet_sendmsg+0x10/0x10 [ 470.023134][T18242] sock_sendmsg_nosec+0x10e/0x180 [ 470.023161][T18242] __sys_sendto+0x408/0x5a0 [ 470.023187][T18242] ? ksys_write+0x1e6/0x270 [ 470.023216][T18242] ? __pfx___sys_sendto+0x10/0x10 [ 470.023240][T18242] ? __mutex_unlock_slowpath+0x731/0x900 [ 470.023294][T18242] ? __pfx_ksys_write+0x10/0x10 [ 470.023323][T18242] __x64_sys_sendto+0xde/0x100 [ 470.023354][T18242] do_syscall_64+0x166/0x520 [ 470.023378][T18242] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.023397][T18242] ? clear_bhb_loop+0x70/0xc0 [ 470.023419][T18242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.023437][T18242] RIP: 0033:0x7f20daf9e159 [ 470.023455][T18242] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.023471][T18242] RSP: 002b:00007f20dbed5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 470.023489][T18242] RAX: ffffffffffffffda RBX: 00007f20db225fa0 RCX: 00007f20daf9e159 [ 470.023503][T18242] RDX: 000000000000fffd RSI: 0000200000000040 RDI: 0000000000000003 [ 470.023515][T18242] RBP: 00007f20dbed5090 R08: 0000200000000100 R09: 000000000000001c [ 470.023528][T18242] R10: 00000080ffffffff R11: 0000000000000246 R12: 0000000000000002 [ 470.023540][T18242] R13: 00007f20db226038 R14: 00007f20db225fa0 R15: 00007ffd1fd16238 [ 470.023571][T18242] [ 470.334229][T18253] netlink: 'syz.0.3932': attribute type 11 has an invalid length. [ 470.768240][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 470.768368][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 470.893533][T18278] bridge_slave_0: default FDB implementation only supports local addresses [ 471.704660][T18301] netlink: 'syz.3.3953': attribute type 10 has an invalid length. [ 471.770017][T18302] netlink: 'syz.3.3953': attribute type 10 has an invalid length. [ 471.783653][T18301] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 471.789918][T18301] team0: Port device netdevsim1 added [ 471.798175][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 471.798272][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 471.840479][T18302] team0: Port device netdevsim1 removed [ 471.848383][T18302] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 471.857518][T18302] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 472.107482][T18326] FAULT_INJECTION: forcing a failure. [ 472.107482][T18326] name failslab, interval 1, probability 0, space 0, times 0 [ 472.107535][T18326] CPU: 0 UID: 0 PID: 18326 Comm: syz.2.3960 Not tainted syzkaller #0 PREEMPT(full) [ 472.107556][T18326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 472.107569][T18326] Call Trace: [ 472.107577][T18326] [ 472.107586][T18326] dump_stack_lvl+0xe8/0x150 [ 472.107617][T18326] should_fail_ex+0x410/0x560 [ 472.107655][T18326] should_failslab+0xa8/0x100 [ 472.107676][T18326] ? skb_clone+0x212/0x3a0 [ 472.107696][T18326] kmem_cache_alloc_noprof+0xa1/0x600 [ 472.107726][T18326] ? skb_clone+0x212/0x3a0 [ 472.107751][T18326] skb_clone+0x212/0x3a0 [ 472.107774][T18326] __netlink_deliver_tap+0x413/0x860 [ 472.107805][T18326] ? netlink_deliver_tap+0x2e/0x1b0 [ 472.107829][T18326] netlink_deliver_tap+0x19c/0x1b0 [ 472.107852][T18326] netlink_unicast+0x781/0x940 [ 472.107885][T18326] netlink_sendmsg+0x813/0xb40 [ 472.107917][T18326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.107948][T18326] ? apparmor_socket_sendmsg+0x98/0x360 [ 472.107978][T18326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.108000][T18326] sock_sendmsg_nosec+0x13a/0x180 [ 472.108023][T18326] ____sys_sendmsg+0x54e/0x850 [ 472.108046][T18326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 472.108073][T18326] ? import_iovec+0x73/0xa0 [ 472.108094][T18326] ___sys_sendmsg+0x2a5/0x360 [ 472.108111][T18326] ? __lock_acquire+0x6df/0x2e50 [ 472.108134][T18326] ? __pfx____sys_sendmsg+0x10/0x10 [ 472.108187][T18326] ? __fget_files+0x2a/0x420 [ 472.108210][T18326] ? __fget_files+0x3a2/0x420 [ 472.108248][T18326] __x64_sys_sendmsg+0x1b1/0x290 [ 472.108271][T18326] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 472.108312][T18326] do_syscall_64+0x166/0x520 [ 472.108338][T18326] ? trace_irq_disable+0x3b/0x140 [ 472.108356][T18326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.108375][T18326] ? clear_bhb_loop+0x70/0xc0 [ 472.108397][T18326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.108415][T18326] RIP: 0033:0x7faec419e159 [ 472.108431][T18326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 472.108447][T18326] RSP: 002b:00007faec4fab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 472.108467][T18326] RAX: ffffffffffffffda RBX: 00007faec4425fa0 RCX: 00007faec419e159 [ 472.108482][T18326] RDX: 0000000000000004 RSI: 0000200000000000 RDI: 0000000000000003 [ 472.108493][T18326] RBP: 00007faec4fab090 R08: 0000000000000000 R09: 0000000000000000 [ 472.108505][T18326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 472.108517][T18326] R13: 00007faec4426038 R14: 00007faec4425fa0 R15: 00007ffec9d290c8 [ 472.108549][T18326] [ 472.284098][T18326] netlink: 'syz.2.3960': attribute type 12 has an invalid length. [ 472.284120][T18326] netlink: 'syz.2.3960': attribute type 29 has an invalid length. [ 472.284132][T18326] __nla_validate_parse: 12 callbacks suppressed [ 472.284142][T18326] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3960'. [ 472.838264][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 472.838393][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 473.172099][T18373] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3980'. [ 473.545125][T18389] bridge0: port 1(bridge_slave_0) entered forwarding state [ 473.634731][T18393] FAULT_INJECTION: forcing a failure. [ 473.634731][T18393] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 473.634784][T18393] CPU: 1 UID: 0 PID: 18393 Comm: syz.2.3987 Not tainted syzkaller #0 PREEMPT(full) [ 473.634803][T18393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 473.634813][T18393] Call Trace: [ 473.634819][T18393] [ 473.634826][T18393] dump_stack_lvl+0xe8/0x150 [ 473.634852][T18393] should_fail_ex+0x410/0x560 [ 473.634882][T18393] _copy_from_user+0x2d/0xb0 [ 473.634903][T18393] ___sys_sendmsg+0x1c6/0x360 [ 473.634922][T18393] ? __lock_acquire+0x6df/0x2e50 [ 473.634945][T18393] ? __pfx____sys_sendmsg+0x10/0x10 [ 473.635005][T18393] ? __fget_files+0x2a/0x420 [ 473.635026][T18393] ? __fget_files+0x3a2/0x420 [ 473.635058][T18393] __x64_sys_sendmsg+0x1b1/0x290 [ 473.635080][T18393] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 473.635119][T18393] do_syscall_64+0x166/0x520 [ 473.635144][T18393] ? trace_irq_disable+0x3b/0x140 [ 473.635162][T18393] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.635180][T18393] ? clear_bhb_loop+0x70/0xc0 [ 473.635203][T18393] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.635220][T18393] RIP: 0033:0x7faec419e159 [ 473.635237][T18393] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.635253][T18393] RSP: 002b:00007faec4fab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 473.635272][T18393] RAX: ffffffffffffffda RBX: 00007faec4425fa0 RCX: 00007faec419e159 [ 473.635286][T18393] RDX: 000000000000c090 RSI: 0000200000000500 RDI: 0000000000000004 [ 473.635299][T18393] RBP: 00007faec4fab090 R08: 0000000000000000 R09: 0000000000000000 [ 473.635310][T18393] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 473.635321][T18393] R13: 00007faec4426038 R14: 00007faec4425fa0 R15: 00007ffec9d290c8 [ 473.635350][T18393] [ 473.878928][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 473.879040][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 474.131451][T18406] bond1: entered allmulticast mode [ 474.162025][T18410] wireguard0: entered promiscuous mode [ 474.170388][T18410] wireguard0: entered allmulticast mode [ 474.180559][T18410] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 474.192431][T18410] bond1: (slave wireguard0): Error -95 calling set_mac_address [ 474.533618][T18418] syzkaller0: entered promiscuous mode [ 474.533660][T18418] syzkaller0: entered allmulticast mode [ 474.555367][T18418] tipc: Enabled bearer , priority 0 [ 474.673557][T18417] tipc: Resetting bearer [ 474.796239][T18417] tipc: Disabling bearer [ 474.918134][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 474.918245][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 474.981210][T18434] FAULT_INJECTION: forcing a failure. [ 474.981210][T18434] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 474.981293][T18434] CPU: 1 UID: 0 PID: 18434 Comm: syz.4.4004 Not tainted syzkaller #0 PREEMPT(full) [ 474.981311][T18434] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 474.981321][T18434] Call Trace: [ 474.981333][T18434] [ 474.981341][T18434] dump_stack_lvl+0xe8/0x150 [ 474.981371][T18434] should_fail_ex+0x410/0x560 [ 474.981404][T18434] _copy_from_user+0x2d/0xb0 [ 474.981425][T18434] ___sys_sendmsg+0x1c6/0x360 [ 474.981445][T18434] ? __lock_acquire+0x6df/0x2e50 [ 474.981466][T18434] ? __pfx____sys_sendmsg+0x10/0x10 [ 474.981512][T18434] ? __fget_files+0x2a/0x420 [ 474.981535][T18434] ? __fget_files+0x3a2/0x420 [ 474.981566][T18434] __x64_sys_sendmsg+0x1b1/0x290 [ 474.981588][T18434] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 474.981628][T18434] do_syscall_64+0x166/0x520 [ 474.981653][T18434] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.981671][T18434] ? clear_bhb_loop+0x70/0xc0 [ 474.981693][T18434] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 474.981712][T18434] RIP: 0033:0x7f20daf9e159 [ 474.981729][T18434] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 474.981744][T18434] RSP: 002b:00007f20dbed5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 474.981764][T18434] RAX: ffffffffffffffda RBX: 00007f20db225fa0 RCX: 00007f20daf9e159 [ 474.981777][T18434] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 474.981790][T18434] RBP: 00007f20dbed5090 R08: 0000000000000000 R09: 0000000000000000 [ 474.981802][T18434] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 474.981813][T18434] R13: 00007f20db226038 R14: 00007f20db225fa0 R15: 00007ffd1fd16238 [ 474.981839][T18434] [ 475.216500][T18441] syzkaller0: entered promiscuous mode [ 475.222374][T18441] syzkaller0: entered allmulticast mode [ 475.242075][T18441] tipc: Enabled bearer , priority 0 [ 475.259042][T18441] tipc: Resetting bearer [ 475.282062][T18440] tipc: Resetting bearer [ 475.316153][T18440] tipc: Disabling bearer [ 475.455204][T18447] tipc: Enabled bearer , priority 0 [ 475.495617][T18452] Bluetooth: hci0: unsupported parameter 5135 [ 475.495662][T18452] Bluetooth: hci0: invalid length 1, exp 2 for type 26 [ 475.656923][T18446] tipc: Disabling bearer [ 475.686307][T18459] syzkaller0: entered promiscuous mode [ 475.686360][T18459] syzkaller0: entered allmulticast mode [ 475.694272][T18459] tipc: Enabled bearer , priority 0 [ 475.701535][T18459] tipc: Resetting bearer [ 475.713661][T18458] tipc: Resetting bearer [ 475.792628][T18458] tipc: Disabling bearer [ 475.856335][T18465] syzkaller0: entered promiscuous mode [ 475.856376][T18465] syzkaller0: entered allmulticast mode [ 475.872432][T18465] tipc: Enabled bearer , priority 0 [ 475.908557][T18464] tipc: Resetting bearer [ 475.964996][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 475.965123][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 476.006029][T18464] tipc: Disabling bearer [ 476.123245][T18483] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4023'. [ 476.352139][T18483] bridge0: port 2(bridge_slave_1) entered disabled state [ 476.352731][T18483] bridge0: port 1(bridge_slave_0) entered disabled state [ 476.584730][T18483] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 476.611959][T18483] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 476.654042][T18504] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4025'. [ 476.969345][ T59] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.978786][ T59] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.978828][ T59] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 476.978861][ T59] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.006946][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 477.007032][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 477.071925][T18502] tipc: Enabled bearer , priority 0 [ 477.090451][T18515] SET target dimension over the limit! [ 477.222144][T18498] tipc: Disabling bearer [ 477.254320][T18523] netlink: 'syz.4.4035': attribute type 10 has an invalid length. [ 477.263448][T18523] netlink: 'syz.4.4035': attribute type 10 has an invalid length. [ 477.398876][T18527] netlink: 55 bytes leftover after parsing attributes in process `syz.4.4037'. [ 478.038164][ C0] net_ratelimit: 1 callbacks suppressed [ 478.038212][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 478.038297][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 478.124214][T18552] netlink: 292 bytes leftover after parsing attributes in process `syz.1.4045'. [ 478.247695][T18558] xt_hashlimit: overflow, try lower: 0/0 [ 478.302779][T18560] tipc: Enabled bearer , priority 0 [ 478.406713][T18567] SET target dimension over the limit! [ 478.467105][T18559] tipc: Disabling bearer [ 478.594410][T18576] netlink: 292 bytes leftover after parsing attributes in process `syz.4.4056'. [ 478.616758][T18574] vlan3: entered promiscuous mode [ 478.616803][T18574] macvlan0: entered promiscuous mode [ 479.078234][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 479.078347][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 479.477939][T18615] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4066'. [ 479.477992][T18615] bond0: Unable to set down delay as MII monitoring is disabled [ 479.535086][T18619] netlink: 100 bytes leftover after parsing attributes in process `syz.3.4066'. [ 479.559058][T18618] netlink: 292 bytes leftover after parsing attributes in process `syz.0.4068'. [ 480.118264][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 480.118361][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 480.884438][T18693] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4094'. [ 480.916581][T18693] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4094'. [ 480.939423][T18696] syzkaller0: entered promiscuous mode [ 480.939469][T18696] syzkaller0: entered allmulticast mode [ 481.037290][T18696] tipc: Enabled bearer , priority 0 [ 481.112406][T18704] netlink: 14975 bytes leftover after parsing attributes in process `syz.1.4098'. [ 481.151248][T18704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4098'. [ 481.168130][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 481.168247][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 481.195397][T18695] tipc: Resetting bearer [ 481.264968][T18695] tipc: Disabling bearer [ 481.957157][T18740] syzkaller0: entered promiscuous mode [ 481.957221][T18740] syzkaller0: entered allmulticast mode [ 481.966804][T18740] tipc: Enabled bearer , priority 0 [ 481.973443][T18740] tipc: Resetting bearer [ 481.980164][T18739] tipc: Resetting bearer [ 482.015128][T18739] tipc: Disabling bearer [ 482.027251][T18746] netlink: 'syz.1.4110': attribute type 4 has an invalid length. [ 482.035607][T18748] netlink: 'syz.1.4110': attribute type 4 has an invalid length. [ 482.164456][T18754] syzkaller0: entered promiscuous mode [ 482.170673][T18754] syzkaller0: entered allmulticast mode [ 482.179512][T18754] tipc: Enabled bearer , priority 0 [ 482.199091][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 482.199189][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 482.514125][T18753] tipc: Resetting bearer [ 482.571733][T18774] __nla_validate_parse: 5 callbacks suppressed [ 482.578534][T18774] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4120'. [ 482.591515][T18753] tipc: Disabling bearer [ 482.713438][T18780] netlink: 284 bytes leftover after parsing attributes in process `syz.1.4122'. [ 482.807654][T18782] syzkaller0: entered promiscuous mode [ 482.807717][T18782] syzkaller0: entered allmulticast mode [ 482.819519][T18782] tipc: Enabled bearer , priority 0 [ 482.827537][T18782] tipc: Resetting bearer [ 482.856645][T18784] netlink: 'syz.1.4124': attribute type 10 has an invalid length. [ 482.908771][T18785] netlink: 'syz.1.4124': attribute type 10 has an invalid length. [ 482.964302][T18781] tipc: Resetting bearer [ 483.021279][T18781] tipc: Disabling bearer [ 483.145188][T18792] sctp: [Deprecated]: syz.0.4127 (pid 18792) Use of int in max_burst socket option deprecated. [ 483.145188][T18792] Use struct sctp_assoc_value instead [ 483.163131][T18792] FAULT_INJECTION: forcing a failure. [ 483.163131][T18792] name failslab, interval 1, probability 0, space 0, times 0 [ 483.176585][T18792] CPU: 1 UID: 0 PID: 18792 Comm: syz.0.4127 Not tainted syzkaller #0 PREEMPT(full) [ 483.176612][T18792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 483.176624][T18792] Call Trace: [ 483.176633][T18792] [ 483.176642][T18792] dump_stack_lvl+0xe8/0x150 [ 483.176675][T18792] should_fail_ex+0x410/0x560 [ 483.176709][T18792] should_failslab+0xa8/0x100 [ 483.176734][T18792] __kmalloc_cache_noprof+0xa3/0x600 [ 483.176762][T18792] ? __kmalloc_cache_noprof+0x14d/0x600 [ 483.176786][T18792] ? sctp_add_bind_addr+0x8c/0x370 [ 483.176805][T18792] ? sctp_add_bind_addr+0x8c/0x370 [ 483.176833][T18792] sctp_add_bind_addr+0x8c/0x370 [ 483.176858][T18792] sctp_copy_local_addr_list+0x31a/0x4e0 [ 483.176883][T18792] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 483.176906][T18792] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 483.176931][T18792] ? sctp_v6_is_any+0x64/0x80 [ 483.176956][T18792] ? sctp_copy_one_addr+0x93/0x360 [ 483.176989][T18792] sctp_bind_addr_copy+0xb3/0x3c0 [ 483.177011][T18792] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 483.177034][T18792] sctp_connect_new_asoc+0x2ff/0x6b0 [ 483.177062][T18792] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 483.177093][T18792] ? __local_bh_enable_ip+0xd6/0x140 [ 483.177115][T18792] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 483.177139][T18792] ? security_sctp_bind_connect+0x7e/0x2c0 [ 483.177169][T18792] sctp_sendmsg+0x159b/0x2d00 [ 483.177204][T18792] ? kstrtouint+0x6e/0xe0 [ 483.177228][T18792] ? __pfx_sctp_sendmsg+0x10/0x10 [ 483.177251][T18792] ? lock_acquire+0x115/0x350 [ 483.177274][T18792] ? get_pid_task+0x20/0x1f0 [ 483.177310][T18792] ? aa_sock_msg_perm+0xf5/0x210 [ 483.177329][T18792] ? sock_rps_record_flow+0x19/0x350 [ 483.177355][T18792] ? inet_sendmsg+0x298/0x320 [ 483.177379][T18792] ? __pfx_inet_sendmsg+0x10/0x10 [ 483.177401][T18792] sock_sendmsg_nosec+0x10e/0x180 [ 483.177428][T18792] __sys_sendto+0x408/0x5a0 [ 483.177454][T18792] ? ksys_write+0x1e6/0x270 [ 483.177482][T18792] ? __pfx___sys_sendto+0x10/0x10 [ 483.177507][T18792] ? __mutex_unlock_slowpath+0x731/0x900 [ 483.177562][T18792] ? __pfx_ksys_write+0x10/0x10 [ 483.177593][T18792] __x64_sys_sendto+0xde/0x100 [ 483.177626][T18792] do_syscall_64+0x166/0x520 [ 483.177649][T18792] ? trace_irq_disable+0x3b/0x140 [ 483.177666][T18792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.177685][T18792] ? clear_bhb_loop+0x70/0xc0 [ 483.177708][T18792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.177726][T18792] RIP: 0033:0x7f8472f9e159 [ 483.177744][T18792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.177760][T18792] RSP: 002b:00007f8473f2e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 483.177781][T18792] RAX: ffffffffffffffda RBX: 00007f8473225fa0 RCX: 00007f8472f9e159 [ 483.177795][T18792] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000003 [ 483.177807][T18792] RBP: 00007f8473f2e090 R08: 000020000005ffe4 R09: 000000000000001c [ 483.177821][T18792] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 483.177832][T18792] R13: 00007f8473226038 R14: 00007f8473225fa0 R15: 00007ffedac20298 [ 483.177864][T18792] [ 483.248310][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 483.248403][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 483.511008][T18802] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4131'. [ 483.745531][T18807] syzkaller0: entered promiscuous mode [ 483.745575][T18807] syzkaller0: entered allmulticast mode [ 483.752525][T18807] tipc: Enabled bearer , priority 0 [ 483.759457][T18813] netlink: 'syz.2.4136': attribute type 10 has an invalid length. [ 483.760113][T18813] netlink: 'syz.2.4136': attribute type 10 has an invalid length. [ 483.892317][T18806] tipc: Resetting bearer [ 483.906490][T18818] netlink: 'syz.2.4137': attribute type 1 has an invalid length. [ 483.906531][T18818] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4137'. [ 483.927496][T18806] tipc: Disabling bearer [ 484.187219][T18830] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4143'. [ 484.193903][T18828] openvswitch: netlink: IPv4 tunnel dst address is zero [ 484.245797][T18833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4145'. [ 484.256159][T18829] FAULT_INJECTION: forcing a failure. [ 484.256159][T18829] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 484.256191][T18829] CPU: 0 UID: 0 PID: 18829 Comm: syz.1.4141 Not tainted syzkaller #0 PREEMPT(full) [ 484.256211][T18829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 484.256222][T18829] Call Trace: [ 484.256229][T18829] [ 484.256237][T18829] dump_stack_lvl+0xe8/0x150 [ 484.256269][T18829] should_fail_ex+0x410/0x560 [ 484.256302][T18829] _copy_from_iter+0x1d3/0x1660 [ 484.256330][T18829] ? __alloc_skb+0x27a/0x7a0 [ 484.256368][T18829] ? __alloc_skb+0x27a/0x7a0 [ 484.256396][T18829] ? __alloc_skb+0x27a/0x7a0 [ 484.256422][T18829] ? __pfx__copy_from_iter+0x10/0x10 [ 484.256448][T18829] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 484.256474][T18829] ? __alloc_skb+0x27a/0x7a0 [ 484.256499][T18829] ? __alloc_skb+0x27a/0x7a0 [ 484.256529][T18829] ? netlink_sendmsg+0x650/0xb40 [ 484.256551][T18829] ? skb_put+0x112/0x210 [ 484.256572][T18829] netlink_sendmsg+0x6c0/0xb40 [ 484.256601][T18829] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.256628][T18829] ? apparmor_socket_sendmsg+0x98/0x360 [ 484.256655][T18829] ? __pfx_netlink_sendmsg+0x10/0x10 [ 484.256676][T18829] sock_sendmsg_nosec+0x13a/0x180 [ 484.256703][T18829] ____sys_sendmsg+0x54e/0x850 [ 484.256727][T18829] ? __pfx_____sys_sendmsg+0x10/0x10 [ 484.256755][T18829] ? import_iovec+0x73/0xa0 [ 484.256779][T18829] ___sys_sendmsg+0x2a5/0x360 [ 484.256798][T18829] ? __lock_acquire+0x6df/0x2e50 [ 484.256821][T18829] ? __pfx____sys_sendmsg+0x10/0x10 [ 484.256873][T18829] ? __fget_files+0x2a/0x420 [ 484.256896][T18829] ? __fget_files+0x3a2/0x420 [ 484.256928][T18829] __x64_sys_sendmsg+0x1b1/0x290 [ 484.256951][T18829] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 484.256989][T18829] do_syscall_64+0x166/0x520 [ 484.257014][T18829] ? trace_irq_disable+0x3b/0x140 [ 484.257032][T18829] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.257051][T18829] ? clear_bhb_loop+0x70/0xc0 [ 484.257074][T18829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.257093][T18829] RIP: 0033:0x7f292199e159 [ 484.257113][T18829] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.257129][T18829] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 484.257150][T18829] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 484.257163][T18829] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004 [ 484.257176][T18829] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 484.257188][T18829] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 484.257200][T18829] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 484.257230][T18829] [ 484.288279][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 484.288374][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 484.441040][T18835] tipc: Enabling of bearer rejected, failed to enable media [ 484.688215][T18850] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4150'. [ 484.781092][T18851] syzkaller0: entered promiscuous mode [ 484.781143][T18851] syzkaller0: entered allmulticast mode [ 484.784237][T18851] tipc: Enabled bearer , priority 0 [ 484.860424][T18848] tipc: Resetting bearer [ 484.880665][T18848] tipc: Disabling bearer [ 484.907685][T18861] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4150'. [ 485.009576][T18868] gtp0: entered promiscuous mode [ 485.014850][T18868] gtp0: entered allmulticast mode [ 485.017066][T18868] team0: Device gtp0 is of different type [ 485.074620][T18868] gtp0: entered promiscuous mode [ 485.074657][T18868] gtp0: entered allmulticast mode [ 485.076621][T18868] team0: Device gtp0 is of different type [ 485.145683][T18868] gtp0: entered promiscuous mode [ 485.145719][T18868] gtp0: entered allmulticast mode [ 485.148268][T18868] team0: Device gtp0 is of different type [ 485.205460][T18868] gtp0: entered promiscuous mode [ 485.205491][T18868] gtp0: entered allmulticast mode [ 485.207479][T18868] team0: Device gtp0 is of different type [ 485.274585][T18868] gtp0: entered promiscuous mode [ 485.274614][T18868] gtp0: entered allmulticast mode [ 485.277285][T18868] team0: Device gtp0 is of different type [ 485.318346][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 485.318452][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 485.337192][T18868] gtp0: entered promiscuous mode [ 485.337220][T18868] gtp0: entered allmulticast mode [ 485.339751][T18868] team0: Device gtp0 is of different type [ 485.389827][T18868] gtp0: entered promiscuous mode [ 485.389866][T18868] gtp0: entered allmulticast mode [ 485.392027][T18868] team0: Device gtp0 is of different type [ 485.480328][T18868] gtp0: entered promiscuous mode [ 485.480355][T18868] gtp0: entered allmulticast mode [ 485.489083][T18868] team0: Device gtp0 is of different type [ 485.583954][T18868] gtp0: entered promiscuous mode [ 485.583996][T18868] gtp0: entered allmulticast mode [ 485.595302][T18868] team0: Device gtp0 is of different type [ 485.716778][T18868] gtp0: entered promiscuous mode [ 485.716823][T18868] gtp0: entered allmulticast mode [ 485.727716][T18868] team0: Device gtp0 is of different type [ 485.782121][T18877] syzkaller0: entered promiscuous mode [ 485.782168][T18877] syzkaller0: entered allmulticast mode [ 485.919520][T18868] gtp0: entered promiscuous mode [ 485.924786][T18868] gtp0: entered allmulticast mode [ 485.932902][T18868] team0: Device gtp0 is of different type [ 485.960856][T18879] tipc: Enabling of bearer rejected, failed to enable media [ 485.995894][T18879] sctp: [Deprecated]: syz.4.4160 (pid 18879) Use of struct sctp_assoc_value in delayed_ack socket option. [ 485.995894][T18879] Use struct sctp_sack_info instead [ 486.210181][T18905] netlink: 184 bytes leftover after parsing attributes in process `syz.0.4166'. [ 486.210432][T18905] C: entered allmulticast mode [ 486.368152][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 486.368277][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 486.592402][T18920] nbd: must specify an index to disconnect [ 487.043891][T18932] syzkaller0: entered promiscuous mode [ 487.049730][T18932] syzkaller0: entered allmulticast mode [ 487.066275][T18932] tipc: Enabled bearer , priority 0 [ 487.095518][T18932] tipc: Resetting bearer [ 487.105722][T18931] tipc: Resetting bearer [ 487.157814][T18931] tipc: Disabling bearer [ 487.330783][T18941] syzkaller1: entered promiscuous mode [ 487.330830][T18941] syzkaller1: entered allmulticast mode [ 487.398145][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 487.805731][T18968] FAULT_INJECTION: forcing a failure. [ 487.805731][T18968] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 487.806398][T18969] netlink: 184 bytes leftover after parsing attributes in process `syz.2.4185'. [ 487.806669][T18969] C: entered allmulticast mode [ 487.835460][T18968] CPU: 0 UID: 0 PID: 18968 Comm: syz.1.4186 Not tainted syzkaller #0 PREEMPT(full) [ 487.835493][T18968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 487.835506][T18968] Call Trace: [ 487.835515][T18968] [ 487.835524][T18968] dump_stack_lvl+0xe8/0x150 [ 487.835558][T18968] should_fail_ex+0x410/0x560 [ 487.835592][T18968] _copy_from_user+0x2d/0xb0 [ 487.835613][T18968] ____sys_sendmsg+0x303/0x850 [ 487.835641][T18968] ? __pfx_____sys_sendmsg+0x10/0x10 [ 487.835671][T18968] ? import_iovec+0x73/0xa0 [ 487.835696][T18968] ___sys_sendmsg+0x2a5/0x360 [ 487.835716][T18968] ? __lock_acquire+0x6df/0x2e50 [ 487.835740][T18968] ? __pfx____sys_sendmsg+0x10/0x10 [ 487.835796][T18968] ? __fget_files+0x2a/0x420 [ 487.835820][T18968] ? __fget_files+0x3a2/0x420 [ 487.835854][T18968] __x64_sys_sendmsg+0x1b1/0x290 [ 487.835878][T18968] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 487.835920][T18968] do_syscall_64+0x166/0x520 [ 487.835946][T18968] ? trace_irq_disable+0x3b/0x140 [ 487.835964][T18968] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.835983][T18968] ? clear_bhb_loop+0x70/0xc0 [ 487.836007][T18968] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.836027][T18968] RIP: 0033:0x7f292199e159 [ 487.836045][T18968] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 487.836062][T18968] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 487.836083][T18968] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 487.836098][T18968] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 487.836111][T18968] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 487.836123][T18968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 487.836135][T18968] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 487.836167][T18968] [ 487.902264][ T5628] Bluetooth: hci4: link tx timeout [ 487.902416][ T5628] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.911090][ T5624] Bluetooth: hci4: link tx timeout [ 487.911108][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.912323][ T5624] Bluetooth: hci4: link tx timeout [ 487.912339][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.917280][ T5624] Bluetooth: hci4: link tx timeout [ 487.917295][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.923264][ T5624] Bluetooth: hci4: link tx timeout [ 487.923280][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.933337][ T5624] Bluetooth: hci4: link tx timeout [ 487.933354][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.938300][ T5624] Bluetooth: hci4: link tx timeout [ 487.938316][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.965308][ T5624] Bluetooth: hci4: link tx timeout [ 487.965328][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.967358][ T5624] Bluetooth: hci4: link tx timeout [ 487.967373][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.972576][ T5624] Bluetooth: hci4: link tx timeout [ 487.972592][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.972717][ T5624] Bluetooth: hci4: link tx timeout [ 487.972728][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 487.973827][ T5624] Bluetooth: hci4: link tx timeout [ 487.973841][ T5624] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 488.026692][T18970] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4182'. [ 488.241213][T18978] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4188'. [ 488.438255][ C0] net_ratelimit: 1 callbacks suppressed [ 488.438300][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 488.438389][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 488.580545][T19002] netlink: Invalid conntrack helper [ 488.580597][T19002] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 488.609006][ T1993] block nbd4: Possible stuck request ffff888027c7e000: control (read@0,1024B). Runtime 180 seconds [ 488.609065][ T1993] block nbd4: Possible stuck request ffff888027c7e1c0: control (read@1024,1024B). Runtime 180 seconds [ 488.609087][ T1993] block nbd4: Possible stuck request ffff888027c7e380: control (read@2048,1024B). Runtime 180 seconds [ 488.609105][ T1993] block nbd4: Possible stuck request ffff888027c7e540: control (read@3072,1024B). Runtime 180 seconds [ 489.304974][T18980] 8021q: adding VLAN 0 to HW filter on device bond5 [ 489.306581][T18980] 8021q: adding VLAN 0 to HW filter on device bond6 [ 489.478171][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 489.478276][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 489.593941][T19039] FAULT_INJECTION: forcing a failure. [ 489.593941][T19039] name failslab, interval 1, probability 0, space 0, times 0 [ 489.611075][T19039] CPU: 0 UID: 0 PID: 19039 Comm: syz.1.4196 Not tainted syzkaller #0 PREEMPT(full) [ 489.611103][T19039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 489.611115][T19039] Call Trace: [ 489.611123][T19039] [ 489.611131][T19039] dump_stack_lvl+0xe8/0x150 [ 489.611164][T19039] should_fail_ex+0x410/0x560 [ 489.611195][T19039] should_failslab+0xa8/0x100 [ 489.611218][T19039] __kmalloc_cache_noprof+0xa3/0x600 [ 489.611244][T19039] ? call_usermodehelper_setup+0x8e/0x270 [ 489.611267][T19039] ? call_usermodehelper_setup+0x8e/0x270 [ 489.611289][T19039] ? __request_module+0x2ec/0x630 [ 489.611315][T19039] call_usermodehelper_setup+0x8e/0x270 [ 489.611344][T19039] ? __pfx_free_modprobe_argv+0x10/0x10 [ 489.611370][T19039] __request_module+0x3ba/0x630 [ 489.611399][T19039] ? __pfx___request_module+0x10/0x10 [ 489.611432][T19039] ? rtnl_link_ops_get+0x23/0x250 [ 489.611450][T19039] ? rtnl_link_ops_get+0x23/0x250 [ 489.611470][T19039] ? rtnl_link_ops_get+0x215/0x250 [ 489.611492][T19039] rtnl_newlink+0x662/0x1c30 [ 489.611524][T19039] ? kmem_cache_free+0x182/0x650 [ 489.611540][T19039] ? nlmon_xmit+0xb0/0x100 [ 489.611566][T19039] ? dev_hard_start_xmit+0x2cd/0x830 [ 489.611585][T19039] ? __dev_queue_xmit+0x14c0/0x3820 [ 489.611606][T19039] ? __netlink_deliver_tap+0x5b4/0x860 [ 489.611627][T19039] ? netlink_deliver_tap+0x19c/0x1b0 [ 489.611647][T19039] ? netlink_unicast+0x781/0x940 [ 489.611664][T19039] ? netlink_sendmsg+0x813/0xb40 [ 489.611688][T19039] ? __pfx_rtnl_newlink+0x10/0x10 [ 489.611713][T19039] ? do_syscall_64+0x166/0x520 [ 489.611739][T19039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.611790][T19039] ? kasan_quarantine_put+0xbb/0x1f0 [ 489.611817][T19039] ? lockdep_hardirqs_on+0x7b/0x110 [ 489.611849][T19039] ? nlmon_xmit+0xb0/0x100 [ 489.611871][T19039] ? kmem_cache_free+0x182/0x650 [ 489.611901][T19039] ? __lock_acquire+0x6df/0x2e50 [ 489.611924][T19039] ? __dev_queue_xmit+0x29b/0x3820 [ 489.611948][T19039] ? __local_bh_enable_ip+0xd6/0x140 [ 489.611972][T19039] ? lockdep_hardirqs_on+0x7b/0x110 [ 489.611997][T19039] ? __dev_queue_xmit+0x29b/0x3820 [ 489.612017][T19039] ? __local_bh_enable_ip+0xd6/0x140 [ 489.612038][T19039] ? __dev_queue_xmit+0x29b/0x3820 [ 489.612067][T19039] ? lock_acquire+0x115/0x350 [ 489.612098][T19039] ? __pfx_rtnl_newlink+0x10/0x10 [ 489.612125][T19039] rtnetlink_rcv_msg+0x802/0xc00 [ 489.612157][T19039] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 489.612182][T19039] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 489.612208][T19039] ? ref_tracker_free+0x689/0x830 [ 489.612230][T19039] ? __pfx_ref_tracker_free+0x10/0x10 [ 489.612259][T19039] netlink_rcv_skb+0x226/0x4a0 [ 489.612283][T19039] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 489.612311][T19039] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 489.612352][T19039] ? netlink_deliver_tap+0x2e/0x1b0 [ 489.612375][T19039] ? netlink_deliver_tap+0x2e/0x1b0 [ 489.612402][T19039] netlink_unicast+0x7bd/0x940 [ 489.612434][T19039] netlink_sendmsg+0x813/0xb40 [ 489.612465][T19039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 489.612496][T19039] ? apparmor_socket_sendmsg+0x98/0x360 [ 489.612524][T19039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 489.612545][T19039] sock_sendmsg_nosec+0x13a/0x180 [ 489.612573][T19039] ____sys_sendmsg+0x54e/0x850 [ 489.612599][T19039] ? __pfx_____sys_sendmsg+0x10/0x10 [ 489.612627][T19039] ? import_iovec+0x73/0xa0 [ 489.612650][T19039] ___sys_sendmsg+0x2a5/0x360 [ 489.612669][T19039] ? __lock_acquire+0x6df/0x2e50 [ 489.612691][T19039] ? __pfx____sys_sendmsg+0x10/0x10 [ 489.612745][T19039] ? __fget_files+0x2a/0x420 [ 489.612769][T19039] ? __fget_files+0x3a2/0x420 [ 489.612802][T19039] __x64_sys_sendmsg+0x1b1/0x290 [ 489.612826][T19039] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 489.612866][T19039] do_syscall_64+0x166/0x520 [ 489.612891][T19039] ? trace_irq_disable+0x3b/0x140 [ 489.612909][T19039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.612929][T19039] ? clear_bhb_loop+0x70/0xc0 [ 489.612952][T19039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 489.612972][T19039] RIP: 0033:0x7f292199e159 [ 489.612990][T19039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 489.613007][T19039] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 489.613028][T19039] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 489.613042][T19039] RDX: 0000000000004040 RSI: 0000200000000180 RDI: 0000000000000003 [ 489.613055][T19039] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 489.613067][T19039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 489.613079][T19039] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 489.613110][T19039] [ 489.729431][T19039] bridge0: port 1(bridge_slave_0) entered forwarding state [ 489.959354][ T5624] Bluetooth: hci4: command 0x0406 tx timeout [ 490.017809][T19051] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4200'. [ 490.339231][T19065] syzkaller0: entered promiscuous mode [ 490.339288][T19065] syzkaller0: entered allmulticast mode [ 490.355470][T19065] tipc: Enabled bearer , priority 0 [ 490.373522][T19065] tipc: Resetting bearer [ 490.391847][T19062] tipc: Resetting bearer [ 490.496392][T19062] tipc: Disabling bearer [ 490.518422][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 490.518541][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 490.979459][T19093] tipc: Enabling of bearer rejected, failed to enable media [ 491.427936][T19107] netlink: 88 bytes leftover after parsing attributes in process `syz.2.4213'. [ 491.459722][T19107] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.558151][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 491.586825][T19115] FAULT_INJECTION: forcing a failure. [ 491.586825][T19115] name failslab, interval 1, probability 0, space 0, times 0 [ 491.599847][T19115] CPU: 0 UID: 0 PID: 19115 Comm: syz.2.4219 Not tainted syzkaller #0 PREEMPT(full) [ 491.599874][T19115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 491.599886][T19115] Call Trace: [ 491.599894][T19115] [ 491.599902][T19115] dump_stack_lvl+0xe8/0x150 [ 491.599934][T19115] should_fail_ex+0x410/0x560 [ 491.599966][T19115] ? __alloc_skb+0x1db/0x7a0 [ 491.599992][T19115] should_failslab+0xa8/0x100 [ 491.600015][T19115] ? __alloc_skb+0x1db/0x7a0 [ 491.600039][T19115] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 491.600073][T19115] ? __alloc_skb+0x18d/0x7a0 [ 491.600099][T19115] ? __alloc_skb+0x1db/0x7a0 [ 491.600131][T19115] __alloc_skb+0x1db/0x7a0 [ 491.600161][T19115] netlink_sendmsg+0x5d4/0xb40 [ 491.600194][T19115] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.600224][T19115] ? apparmor_socket_sendmsg+0x98/0x360 [ 491.600254][T19115] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.600276][T19115] sock_sendmsg_nosec+0x13a/0x180 [ 491.600303][T19115] ____sys_sendmsg+0x54e/0x850 [ 491.600326][T19115] ? __pfx_____sys_sendmsg+0x10/0x10 [ 491.600353][T19115] ? import_iovec+0x73/0xa0 [ 491.600375][T19115] ___sys_sendmsg+0x2a5/0x360 [ 491.600393][T19115] ? __lock_acquire+0x6df/0x2e50 [ 491.600414][T19115] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.600461][T19115] ? __fget_files+0x2a/0x420 [ 491.600483][T19115] ? __fget_files+0x3a2/0x420 [ 491.600515][T19115] __x64_sys_sendmsg+0x1b1/0x290 [ 491.600536][T19115] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.600575][T19115] do_syscall_64+0x166/0x520 [ 491.600601][T19115] ? trace_irq_disable+0x3b/0x140 [ 491.600620][T19115] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.600639][T19115] ? clear_bhb_loop+0x70/0xc0 [ 491.600662][T19115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.600681][T19115] RIP: 0033:0x7faec419e159 [ 491.600699][T19115] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.600716][T19115] RSP: 002b:00007faec4fab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.600737][T19115] RAX: ffffffffffffffda RBX: 00007faec4425fa0 RCX: 00007faec419e159 [ 491.600750][T19115] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 491.600763][T19115] RBP: 00007faec4fab090 R08: 0000000000000000 R09: 0000000000000000 [ 491.600774][T19115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.600784][T19115] R13: 00007faec4426038 R14: 00007faec4425fa0 R15: 00007ffec9d290c8 [ 491.600818][T19115] [ 491.832498][T19121] netlink: 220 bytes leftover after parsing attributes in process `syz.4.4218'. [ 492.327127][T19136] syzkaller0: entered promiscuous mode [ 492.327176][T19136] syzkaller0: entered allmulticast mode [ 492.339939][T19136] tipc: Enabled bearer , priority 0 [ 492.347648][T19136] tipc: Resetting bearer [ 492.357930][T19134] tipc: Resetting bearer [ 492.395338][T19144] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4227'. [ 492.407684][T19134] tipc: Disabling bearer [ 493.245698][ T5628] Bluetooth: hci5: command 0x0406 tx timeout [ 493.638133][ C0] net_ratelimit: 3 callbacks suppressed [ 493.638196][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 493.638315][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 494.103950][T19200] syzkaller0: entered promiscuous mode [ 494.103995][T19200] syzkaller0: entered allmulticast mode [ 494.114418][T19200] tipc: Enabled bearer , priority 0 [ 494.127639][T19200] tipc: Resetting bearer [ 494.139710][T19198] tipc: Resetting bearer [ 494.167041][T19207] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4239'. [ 494.193037][T19198] tipc: Disabling bearer [ 494.263614][T19201] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4237'. [ 494.688266][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 494.688414][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 494.733163][T19229] netlink: 88 bytes leftover after parsing attributes in process `syz.0.4244'. [ 494.953032][T19234] xt_MASQUERADE: bad MAP_IPS. [ 495.023307][T19241] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4248'. [ 495.052433][T19241] netlink: 1200 bytes leftover after parsing attributes in process `syz.2.4248'. [ 495.101011][T19241] netlink: 260 bytes leftover after parsing attributes in process `syz.2.4248'. [ 495.113261][T19241] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4248'. [ 495.292618][T19248] batman_adv: batadv0: Adding interface: gretap1 [ 495.299265][T19248] batman_adv: batadv0: The MTU of interface gretap1 is too small (1242) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1312 would solve the problem. [ 495.327653][T19248] batman_adv: batadv0: Interface activated: gretap1 [ 495.362101][T19256] netlink: 'syz.1.4254': attribute type 12 has an invalid length. [ 495.370252][T19256] netlink: 'syz.1.4254': attribute type 29 has an invalid length. [ 495.378636][T19256] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4254'. [ 495.378812][T19256] FAULT_INJECTION: forcing a failure. [ 495.378812][T19256] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 495.378839][T19256] CPU: 0 UID: 0 PID: 19256 Comm: syz.1.4254 Not tainted syzkaller #0 PREEMPT(full) [ 495.378859][T19256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.378872][T19256] Call Trace: [ 495.378880][T19256] [ 495.378889][T19256] dump_stack_lvl+0xe8/0x150 [ 495.378920][T19256] should_fail_ex+0x410/0x560 [ 495.378953][T19256] _copy_to_user+0x31/0xb0 [ 495.378976][T19256] simple_read_from_buffer+0xe1/0x170 [ 495.379006][T19256] proc_fail_nth_read+0x1bb/0x230 [ 495.379032][T19256] ? common_file_perm+0x20e/0x2b0 [ 495.379053][T19256] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 495.379081][T19256] ? rw_verify_area+0x24a/0x4c0 [ 495.379106][T19256] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 495.379131][T19256] vfs_read+0x213/0xa80 [ 495.379160][T19256] ? __pfx___mutex_lock+0x10/0x10 [ 495.379188][T19256] ? __pfx_vfs_read+0x10/0x10 [ 495.379214][T19256] ? __fget_files+0x2a/0x420 [ 495.379248][T19256] ? __fget_files+0x3a2/0x420 [ 495.379270][T19256] ? __fget_files+0x2a/0x420 [ 495.379302][T19256] ksys_read+0x150/0x270 [ 495.379330][T19256] ? __pfx_ksys_read+0x10/0x10 [ 495.379366][T19256] do_syscall_64+0x166/0x520 [ 495.379391][T19256] ? trace_irq_disable+0x3b/0x140 [ 495.379409][T19256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.379427][T19256] ? clear_bhb_loop+0x70/0xc0 [ 495.379450][T19256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.379468][T19256] RIP: 0033:0x7f292195e98e [ 495.379489][T19256] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 495.379505][T19256] RSP: 002b:00007f292288bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 495.379525][T19256] RAX: ffffffffffffffda RBX: 00007f292288c6c0 RCX: 00007f292195e98e [ 495.379538][T19256] RDX: 000000000000000f RSI: 00007f292288c0a0 RDI: 0000000000000004 [ 495.379550][T19256] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 495.379562][T19256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 495.379574][T19256] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 495.379605][T19256] [ 495.384535][T19259] sctp: [Deprecated]: syz.3.4252 (pid 19259) Use of int in max_burst socket option deprecated. [ 495.384535][T19259] Use struct sctp_assoc_value instead [ 495.718143][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 495.718282][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 495.749636][T19273] FAULT_INJECTION: forcing a failure. [ 495.749636][T19273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 495.749701][T19273] CPU: 1 UID: 0 PID: 19273 Comm: syz.1.4258 Not tainted syzkaller #0 PREEMPT(full) [ 495.749721][T19273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 495.749732][T19273] Call Trace: [ 495.749740][T19273] [ 495.749747][T19273] dump_stack_lvl+0xe8/0x150 [ 495.749771][T19273] should_fail_ex+0x410/0x560 [ 495.749800][T19273] _copy_from_user+0x2d/0xb0 [ 495.749821][T19273] ___sys_sendmsg+0x1c6/0x360 [ 495.749841][T19273] ? __lock_acquire+0x6df/0x2e50 [ 495.749864][T19273] ? __pfx____sys_sendmsg+0x10/0x10 [ 495.749888][T19273] ? kstrtouint+0x6e/0xe0 [ 495.749934][T19273] ? __fget_files+0x2a/0x420 [ 495.749957][T19273] ? __fget_files+0x3a2/0x420 [ 495.749988][T19273] __sys_sendmmsg+0x273/0x4d0 [ 495.750013][T19273] ? __pfx___sys_sendmmsg+0x10/0x10 [ 495.750042][T19273] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 495.750081][T19273] ? ksys_write+0x242/0x270 [ 495.750108][T19273] ? __pfx_ksys_write+0x10/0x10 [ 495.750139][T19273] __x64_sys_sendmmsg+0xa0/0xc0 [ 495.750164][T19273] do_syscall_64+0x166/0x520 [ 495.750188][T19273] ? trace_irq_disable+0x3b/0x140 [ 495.750205][T19273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.750224][T19273] ? clear_bhb_loop+0x70/0xc0 [ 495.750245][T19273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 495.750264][T19273] RIP: 0033:0x7f292199e159 [ 495.750281][T19273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 495.750296][T19273] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 495.750317][T19273] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 495.750330][T19273] RDX: 3284b164842c97f7 RSI: 0000200000000c40 RDI: 0000000000000004 [ 495.750343][T19273] RBP: 00007f292288c090 R08: 0000000000000000 R09: 0000000000000000 [ 495.750355][T19273] R10: 0000000000008014 R11: 0000000000000246 R12: 0000000000000001 [ 495.750367][T19273] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 495.750396][T19273] [ 495.974773][T19278] lo speed is unknown, defaulting to 1000 [ 496.012338][T19283] FAULT_INJECTION: forcing a failure. [ 496.012338][T19283] name failslab, interval 1, probability 0, space 0, times 0 [ 496.012398][T19283] CPU: 1 UID: 0 PID: 19283 Comm: syz.0.4260 Not tainted syzkaller #0 PREEMPT(full) [ 496.012417][T19283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.012427][T19283] Call Trace: [ 496.012434][T19283] [ 496.012440][T19283] dump_stack_lvl+0xe8/0x150 [ 496.012467][T19283] should_fail_ex+0x410/0x560 [ 496.012496][T19283] ? __alloc_skb+0x1db/0x7a0 [ 496.012521][T19283] should_failslab+0xa8/0x100 [ 496.012543][T19283] ? __alloc_skb+0x1db/0x7a0 [ 496.012566][T19283] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 496.012591][T19283] ? __alloc_skb+0x18d/0x7a0 [ 496.012615][T19283] ? __alloc_skb+0x1db/0x7a0 [ 496.012646][T19283] __alloc_skb+0x1db/0x7a0 [ 496.012682][T19283] netlink_ack+0x136/0xb30 [ 496.012702][T19283] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 496.012731][T19283] ? ref_tracker_free+0x689/0x830 [ 496.012753][T19283] ? __pfx_ref_tracker_free+0x10/0x10 [ 496.012780][T19283] netlink_rcv_skb+0x2a4/0x4a0 [ 496.012802][T19283] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 496.012830][T19283] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 496.012863][T19283] ? netlink_deliver_tap+0x2e/0x1b0 [ 496.012882][T19283] ? netlink_deliver_tap+0x2e/0x1b0 [ 496.012909][T19283] netlink_unicast+0x7bd/0x940 [ 496.012938][T19283] netlink_sendmsg+0x813/0xb40 [ 496.012969][T19283] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.012997][T19283] ? apparmor_socket_sendmsg+0x98/0x360 [ 496.013026][T19283] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.013046][T19283] sock_sendmsg_nosec+0x13a/0x180 [ 496.013071][T19283] ____sys_sendmsg+0x54e/0x850 [ 496.013095][T19283] ? __pfx_____sys_sendmsg+0x10/0x10 [ 496.013123][T19283] ? import_iovec+0x73/0xa0 [ 496.013146][T19283] ___sys_sendmsg+0x2a5/0x360 [ 496.013164][T19283] ? __lock_acquire+0x6df/0x2e50 [ 496.013186][T19283] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.013237][T19283] ? __fget_files+0x2a/0x420 [ 496.013259][T19283] ? __fget_files+0x3a2/0x420 [ 496.013290][T19283] __x64_sys_sendmsg+0x1b1/0x290 [ 496.013311][T19283] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 496.013351][T19283] do_syscall_64+0x166/0x520 [ 496.013375][T19283] ? trace_irq_disable+0x3b/0x140 [ 496.013392][T19283] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.013410][T19283] ? clear_bhb_loop+0x70/0xc0 [ 496.013432][T19283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.013450][T19283] RIP: 0033:0x7f8472f9e159 [ 496.013467][T19283] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 496.013484][T19283] RSP: 002b:00007f8473f2e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 496.013504][T19283] RAX: ffffffffffffffda RBX: 00007f8473225fa0 RCX: 00007f8472f9e159 [ 496.013517][T19283] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004 [ 496.013529][T19283] RBP: 00007f8473f2e090 R08: 0000000000000000 R09: 0000000000000000 [ 496.013540][T19283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.013551][T19283] R13: 00007f8473226038 R14: 00007f8473225fa0 R15: 00007ffedac20298 [ 496.013580][T19283] [ 496.124998][T19289] netlink: 'syz.2.4262': attribute type 1 has an invalid length. [ 496.325934][T19289] 8021q: adding VLAN 0 to HW filter on device bond2 [ 496.406412][T19298] FAULT_INJECTION: forcing a failure. [ 496.406412][T19298] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 496.406466][T19298] CPU: 1 UID: 0 PID: 19298 Comm: syz.0.4263 Not tainted syzkaller #0 PREEMPT(full) [ 496.406486][T19298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 496.406495][T19298] Call Trace: [ 496.406502][T19298] [ 496.406509][T19298] dump_stack_lvl+0xe8/0x150 [ 496.406538][T19298] should_fail_ex+0x410/0x560 [ 496.406570][T19298] _copy_from_user+0x2d/0xb0 [ 496.406591][T19298] kstrtouint_from_user+0xd6/0x180 [ 496.406628][T19298] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 496.406661][T19298] ? lock_acquire+0x115/0x350 [ 496.406685][T19298] proc_fail_nth_write+0x8e/0x210 [ 496.406712][T19298] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 496.406746][T19298] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 496.406772][T19298] vfs_write+0x296/0xba0 [ 496.406806][T19298] ? __pfx_vfs_write+0x10/0x10 [ 496.406832][T19298] ? __fget_files+0x2a/0x420 [ 496.406860][T19298] ? __fget_files+0x3a2/0x420 [ 496.406881][T19298] ? __fget_files+0x2a/0x420 [ 496.406911][T19298] ksys_write+0x150/0x270 [ 496.406939][T19298] ? __pfx_ksys_write+0x10/0x10 [ 496.406976][T19298] do_syscall_64+0x166/0x520 [ 496.407000][T19298] ? trace_irq_disable+0x3b/0x140 [ 496.407018][T19298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.407037][T19298] ? clear_bhb_loop+0x70/0xc0 [ 496.407060][T19298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.407078][T19298] RIP: 0033:0x7f8472f5e98e [ 496.407095][T19298] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 496.407109][T19298] RSP: 002b:00007f8473f2dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 496.407129][T19298] RAX: ffffffffffffffda RBX: 00007f8473f2e6c0 RCX: 00007f8472f5e98e [ 496.407143][T19298] RDX: 0000000000000001 RSI: 00007f8473f2e0a0 RDI: 0000000000000004 [ 496.407155][T19298] RBP: 00007f8473f2e090 R08: 0000000000000000 R09: 0000000000000000 [ 496.407167][T19298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.407178][T19298] R13: 00007f8473226038 R14: 00007f8473225fa0 R15: 00007ffedac20298 [ 496.407209][T19298] [ 496.635142][T19294] bond2: (slave geneve2): making interface the new active one [ 496.677278][T19294] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 496.758150][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 496.758275][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 496.895877][T19311] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4267'. [ 496.903853][T19310] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4267'. [ 497.605001][T19330] SET target dimension over the limit! [ 497.798420][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 497.798538][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 498.838242][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 498.838339][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 498.894632][T19393] netlink: 'syz.2.4286': attribute type 10 has an invalid length. [ 499.252036][T19393] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 499.254341][T19393] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 499.311607][T19395] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 499.336355][T19395] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 499.362100][T19395] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 499.402682][T19395] bond0 (unregistering): Released all slaves [ 499.424386][T19401] sctp: [Deprecated]: syz.3.4289 (pid 19401) Use of int in max_burst socket option deprecated. [ 499.424386][T19401] Use struct sctp_assoc_value instead [ 499.686441][T19413] __nla_validate_parse: 2 callbacks suppressed [ 499.686488][T19413] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4294'. [ 499.707397][T19407] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4292'. [ 499.766427][T19414] syzkaller1: entered promiscuous mode [ 499.766477][T19414] syzkaller1: entered allmulticast mode [ 499.878162][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 499.879834][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 499.917202][T19427] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4297'. [ 500.118354][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 500.187933][T19440] FAULT_INJECTION: forcing a failure. [ 500.187933][T19440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 500.187988][T19440] CPU: 1 UID: 0 PID: 19440 Comm: syz.1.4300 Not tainted syzkaller #0 PREEMPT(full) [ 500.188010][T19440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 500.188020][T19440] Call Trace: [ 500.188025][T19440] [ 500.188032][T19440] dump_stack_lvl+0xe8/0x150 [ 500.188058][T19440] should_fail_ex+0x410/0x560 [ 500.188088][T19440] _copy_to_user+0x31/0xb0 [ 500.188112][T19440] simple_read_from_buffer+0xe1/0x170 [ 500.188140][T19440] proc_fail_nth_read+0x1bb/0x230 [ 500.188166][T19440] ? common_file_perm+0x20e/0x2b0 [ 500.188186][T19440] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 500.188210][T19440] ? rw_verify_area+0x24a/0x4c0 [ 500.188230][T19440] ? tun_chr_write_iter+0xe0/0x200 [ 500.188256][T19440] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 500.188281][T19440] vfs_read+0x213/0xa80 [ 500.188311][T19440] ? __pfx___mutex_lock+0x10/0x10 [ 500.188338][T19440] ? __pfx_vfs_read+0x10/0x10 [ 500.188364][T19440] ? __fget_files+0x2a/0x420 [ 500.188390][T19440] ? __fget_files+0x3a2/0x420 [ 500.188412][T19440] ? __fget_files+0x2a/0x420 [ 500.188443][T19440] ksys_read+0x150/0x270 [ 500.188470][T19440] ? __pfx_ksys_read+0x10/0x10 [ 500.188505][T19440] do_syscall_64+0x166/0x520 [ 500.188530][T19440] ? trace_irq_disable+0x3b/0x140 [ 500.188547][T19440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.188566][T19440] ? clear_bhb_loop+0x70/0xc0 [ 500.188587][T19440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 500.188605][T19440] RIP: 0033:0x7f292195e98e [ 500.188623][T19440] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 500.188639][T19440] RSP: 002b:00007f2922828fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 500.188659][T19440] RAX: ffffffffffffffda RBX: 00007f29228296c0 RCX: 00007f292195e98e [ 500.188673][T19440] RDX: 000000000000000f RSI: 00007f29228290a0 RDI: 0000000000000006 [ 500.188685][T19440] RBP: 00007f2922829090 R08: 0000000000000000 R09: 0000000000000000 [ 500.188696][T19440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.188707][T19440] R13: 00007f2921c26308 R14: 00007f2921c26270 R15: 00007ffc6fb94ec8 [ 500.188744][T19440] [ 500.890622][T19446] netlink: 'syz.4.4301': attribute type 1 has an invalid length. [ 500.918183][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 500.918283][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 501.187985][ T7205] IPVS: starting estimator thread 0... [ 501.278782][T19460] IPVS: using max 34 ests per chain, 81600 per kthread [ 501.406054][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.458515][T19474] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4311'. [ 501.531106][T19477] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 501.531161][T19477] bridge0: port 1(bridge_slave_0) entered forwarding state [ 501.571129][T19480] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4313'. [ 501.571198][T19480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4313'. [ 501.681311][T19489] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.4314'. [ 501.958189][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 501.958295][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 502.387698][T19503] FAULT_INJECTION: forcing a failure. [ 502.387698][T19503] name failslab, interval 1, probability 0, space 0, times 0 [ 502.387754][T19503] CPU: 1 UID: 0 PID: 19503 Comm: syz.0.4319 Not tainted syzkaller #0 PREEMPT(full) [ 502.387776][T19503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 502.387786][T19503] Call Trace: [ 502.387793][T19503] [ 502.387800][T19503] dump_stack_lvl+0xe8/0x150 [ 502.387824][T19503] should_fail_ex+0x410/0x560 [ 502.387852][T19503] should_failslab+0xa8/0x100 [ 502.387875][T19503] __kmalloc_noprof+0xfe/0x720 [ 502.387903][T19503] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 502.387930][T19503] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 502.387971][T19503] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 502.388009][T19503] genl_family_rcv_msg_doit+0xda/0x340 [ 502.388041][T19503] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 502.388074][T19503] ? apparmor_capable+0x126/0x170 [ 502.388101][T19503] ? bpf_lsm_capable+0x9/0x20 [ 502.388126][T19503] ? security_capable+0x7e/0x2c0 [ 502.388150][T19503] genl_rcv_msg+0x614/0x7a0 [ 502.388182][T19503] ? __pfx_genl_rcv_msg+0x10/0x10 [ 502.388206][T19503] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 502.388224][T19503] ? __pfx_nl80211_connect+0x10/0x10 [ 502.388246][T19503] ? __pfx_nl80211_post_doit+0x10/0x10 [ 502.388265][T19503] ? __pfx_ref_tracker_free+0x10/0x10 [ 502.388296][T19503] netlink_rcv_skb+0x226/0x4a0 [ 502.388320][T19503] ? __pfx_genl_rcv_msg+0x10/0x10 [ 502.388348][T19503] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 502.388385][T19503] ? down_read+0x2be/0x330 [ 502.388408][T19503] genl_rcv+0x28/0x40 [ 502.388432][T19503] netlink_unicast+0x7bd/0x940 [ 502.388463][T19503] netlink_sendmsg+0x813/0xb40 [ 502.388495][T19503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.388525][T19503] ? apparmor_socket_sendmsg+0x98/0x360 [ 502.388554][T19503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.388576][T19503] sock_sendmsg_nosec+0x13a/0x180 [ 502.388604][T19503] ____sys_sendmsg+0x54e/0x850 [ 502.388630][T19503] ? __pfx_____sys_sendmsg+0x10/0x10 [ 502.388659][T19503] ? import_iovec+0x73/0xa0 [ 502.388683][T19503] ___sys_sendmsg+0x2a5/0x360 [ 502.388702][T19503] ? __lock_acquire+0x6df/0x2e50 [ 502.388726][T19503] ? __pfx____sys_sendmsg+0x10/0x10 [ 502.388779][T19503] ? __fget_files+0x2a/0x420 [ 502.388802][T19503] ? __fget_files+0x3a2/0x420 [ 502.388836][T19503] __x64_sys_sendmsg+0x1b1/0x290 [ 502.388859][T19503] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 502.388900][T19503] do_syscall_64+0x166/0x520 [ 502.388925][T19503] ? trace_irq_disable+0x3b/0x140 [ 502.388948][T19503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.388968][T19503] ? clear_bhb_loop+0x70/0xc0 [ 502.388991][T19503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.389009][T19503] RIP: 0033:0x7f8472f9e159 [ 502.389027][T19503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.389043][T19503] RSP: 002b:00007f8473f2e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 502.389062][T19503] RAX: ffffffffffffffda RBX: 00007f8473225fa0 RCX: 00007f8472f9e159 [ 502.389076][T19503] RDX: 000000000000c090 RSI: 0000200000000500 RDI: 0000000000000004 [ 502.389088][T19503] RBP: 00007f8473f2e090 R08: 0000000000000000 R09: 0000000000000000 [ 502.389099][T19503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.389111][T19503] R13: 00007f8473226038 R14: 00007f8473225fa0 R15: 00007ffedac20298 [ 502.389141][T19503] [ 502.877255][T19529] syzkaller0: entered promiscuous mode [ 502.877300][T19529] syzkaller0: entered allmulticast mode [ 502.921434][T19514] syzkaller0: entered promiscuous mode [ 502.921477][T19514] syzkaller0: entered allmulticast mode [ 502.926955][T19508] tipc: Enabled bearer , priority 0 [ 502.935125][T19507] tipc: Resetting bearer [ 502.985996][T19507] tipc: Disabling bearer [ 502.998220][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 502.998329][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 503.022039][T19514] tipc: Enabled bearer , priority 0 [ 503.042781][T19512] tipc: Resetting bearer [ 503.083237][T19512] tipc: Disabling bearer [ 503.208334][T19544] x_tables: duplicate underflow at hook 2 [ 503.263637][T19542] syzkaller0: entered promiscuous mode [ 503.263678][T19542] syzkaller0: entered allmulticast mode [ 503.276327][T19542] tipc: Enabled bearer , priority 0 [ 503.283678][T19541] tipc: Resetting bearer [ 503.334905][T19541] tipc: Disabling bearer [ 503.365468][T19551] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4330'. [ 503.448339][T19556] FAULT_INJECTION: forcing a failure. [ 503.448339][T19556] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 503.448392][T19556] CPU: 1 UID: 0 PID: 19556 Comm: syz.4.4332 Not tainted syzkaller #0 PREEMPT(full) [ 503.448412][T19556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 503.448422][T19556] Call Trace: [ 503.448427][T19556] [ 503.448434][T19556] dump_stack_lvl+0xe8/0x150 [ 503.448461][T19556] should_fail_ex+0x410/0x560 [ 503.448494][T19556] _copy_to_user+0x31/0xb0 [ 503.448517][T19556] simple_read_from_buffer+0xe1/0x170 [ 503.448546][T19556] proc_fail_nth_read+0x1bb/0x230 [ 503.448571][T19556] ? common_file_perm+0x20e/0x2b0 [ 503.448593][T19556] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 503.448623][T19556] ? rw_verify_area+0x24a/0x4c0 [ 503.448650][T19556] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 503.448675][T19556] vfs_read+0x213/0xa80 [ 503.448705][T19556] ? __pfx___mutex_lock+0x10/0x10 [ 503.448732][T19556] ? __pfx_vfs_read+0x10/0x10 [ 503.448758][T19556] ? __fget_files+0x2a/0x420 [ 503.448785][T19556] ? __fget_files+0x3a2/0x420 [ 503.448807][T19556] ? __fget_files+0x2a/0x420 [ 503.448838][T19556] ksys_read+0x150/0x270 [ 503.448875][T19556] ? __pfx_ksys_read+0x10/0x10 [ 503.448911][T19556] do_syscall_64+0x166/0x520 [ 503.448936][T19556] ? trace_irq_disable+0x3b/0x140 [ 503.448953][T19556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.448972][T19556] ? clear_bhb_loop+0x70/0xc0 [ 503.448995][T19556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 503.449013][T19556] RIP: 0033:0x7f20daf5e98e [ 503.449030][T19556] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 503.449047][T19556] RSP: 002b:00007f20dbed4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 503.449067][T19556] RAX: ffffffffffffffda RBX: 00007f20dbed56c0 RCX: 00007f20daf5e98e [ 503.449080][T19556] RDX: 000000000000000f RSI: 00007f20dbed50a0 RDI: 0000000000000004 [ 503.449092][T19556] RBP: 00007f20dbed5090 R08: 0000000000000000 R09: 0000000000000000 [ 503.449104][T19556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.449116][T19556] R13: 00007f20db226038 R14: 00007f20db225fa0 R15: 00007ffd1fd16238 [ 503.449146][T19556] [ 503.781889][T19570] syzkaller0: entered promiscuous mode [ 503.787689][T19570] syzkaller0: entered allmulticast mode [ 503.797029][T19568] syzkaller0: entered promiscuous mode [ 503.797054][T19568] syzkaller0: entered allmulticast mode [ 503.819879][T19570] tipc: Enabled bearer , priority 0 [ 503.826874][T19567] tipc: Resetting bearer [ 503.862832][T19567] tipc: Disabling bearer [ 503.871564][T19568] tipc: Enabled bearer , priority 0 [ 503.876268][T19572] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4340'. [ 503.877423][T19568] tipc: Resetting bearer [ 503.902450][T19565] tipc: Resetting bearer [ 503.902600][T19572] sctp: [Deprecated]: syz.0.4340 (pid 19572) Use of int in max_burst socket option. [ 503.902600][T19572] Use struct sctp_assoc_value instead [ 503.940103][T19565] tipc: Disabling bearer [ 504.038151][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 504.038264][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 504.116728][T19578] lo speed is unknown, defaulting to 1000 [ 504.143595][T19580] syzkaller0: entered promiscuous mode [ 504.143638][T19580] syzkaller0: entered allmulticast mode [ 504.159762][T19576] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4342'. [ 504.161557][T19580] tipc: Enabled bearer , priority 0 [ 504.169222][T19579] tipc: Resetting bearer [ 504.206284][T19579] tipc: Disabling bearer [ 504.733756][T19603] syzkaller0: entered promiscuous mode [ 504.733801][T19603] syzkaller0: entered allmulticast mode [ 504.745634][T19603] tipc: Enabled bearer , priority 0 [ 504.759274][T19601] tipc: Resetting bearer [ 504.794318][T19601] tipc: Disabling bearer [ 504.823449][T19607] __nla_validate_parse: 1 callbacks suppressed [ 504.823489][T19607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4353'. [ 504.823512][T19607] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4353'. [ 505.042942][T19616] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4357'. [ 505.069962][T19609] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4354'. [ 505.088172][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 505.088266][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 505.282643][T19621] FAULT_INJECTION: forcing a failure. [ 505.282643][T19621] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 505.282700][T19621] CPU: 0 UID: 0 PID: 19621 Comm: syz.1.4359 Not tainted syzkaller #0 PREEMPT(full) [ 505.282721][T19621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 505.282731][T19621] Call Trace: [ 505.282739][T19621] [ 505.282746][T19621] dump_stack_lvl+0xe8/0x150 [ 505.282772][T19621] should_fail_ex+0x410/0x560 [ 505.282800][T19621] _copy_from_user+0x2d/0xb0 [ 505.282820][T19621] do_ipv6_setsockopt+0x245/0x2960 [ 505.282846][T19621] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 505.282864][T19621] ? aa_inet_opt_perm+0xae4/0xcf0 [ 505.282883][T19621] ? get_pid_task+0x20/0x1f0 [ 505.282907][T19621] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 505.282941][T19621] ? ksys_write+0x1e6/0x270 [ 505.282975][T19621] ? lock_acquire+0x115/0x350 [ 505.283001][T19621] ? aa_sock_opt_perm+0xe1/0x1e0 [ 505.283024][T19621] ipv6_setsockopt+0x59/0x170 [ 505.283043][T19621] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 505.283070][T19621] do_sock_setsockopt+0x17c/0x1b0 [ 505.283093][T19621] __x64_sys_setsockopt+0x13d/0x1b0 [ 505.283115][T19621] do_syscall_64+0x166/0x520 [ 505.283141][T19621] ? trace_irq_disable+0x3b/0x140 [ 505.283158][T19621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.283177][T19621] ? clear_bhb_loop+0x70/0xc0 [ 505.283200][T19621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.283218][T19621] RIP: 0033:0x7f292199e159 [ 505.283236][T19621] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 505.283253][T19621] RSP: 002b:00007f292288c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 505.283282][T19621] RAX: ffffffffffffffda RBX: 00007f2921c25fa0 RCX: 00007f292199e159 [ 505.283296][T19621] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 [ 505.283307][T19621] RBP: 00007f292288c090 R08: 00000000000003e0 R09: 0000000000000000 [ 505.283319][T19621] R10: 0000200000000a40 R11: 0000000000000246 R12: 0000000000000001 [ 505.283330][T19621] R13: 00007f2921c26038 R14: 00007f2921c25fa0 R15: 00007ffc6fb94ec8 [ 505.283360][T19621] [ 505.870286][T19644] block nbd0: reconnected socket [ 505.870393][T19644] block nbd0: reconnected socket [ 505.966321][ T5628] block nbd0: Receive control failed (result -32) [ 505.979381][ T5624] block nbd0: Receive control failed (result -32) [ 505.987019][T19651] C: renamed from veth1_to_team (while UP) [ 506.098881][T19654] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4371'. [ 506.098956][T19654] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4371'. [ 506.118938][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 506.119061][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 506.192168][T19658] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4373'. [ 506.203502][T19658] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4373'. [ 506.322074][ T7205] bridge_slave_1: left allmulticast mode [ 506.322131][ T7205] bridge_slave_1: left promiscuous mode [ 506.322350][ T7205] bridge0: port 2(bridge_slave_1) entered disabled state [ 506.346184][ T7205] bridge_slave_0: left allmulticast mode [ 506.346231][ T7205] bridge_slave_0: left promiscuous mode [ 506.346422][ T7205] bridge0: port 1(bridge_slave_0) entered disabled state [ 506.385648][T19666] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4377'. [ 506.412465][ T7205] pimreg: left allmulticast mode [ 506.871734][ T7205] bond12 (unregistering): (slave geneve1): Releasing active interface [ 507.017144][ T7205] bond1 (unregistering): Released all slaves [ 507.027797][ T7205] bond2 (unregistering): Released all slaves [ 507.045503][ T7205] bond3 (unregistering): Released all slaves [ 507.073077][ T7205] bond4 (unregistering): Released all slaves [ 507.087213][ T7205] bond5 (unregistering): Released all slaves [ 507.097463][ T7205] bond6 (unregistering): Released all slaves [ 507.114349][ T7205] bond7 (unregistering): Released all slaves [ 507.130544][ T7205] bond8 (unregistering): Released all slaves [ 507.143030][ T7205] bond9 (unregistering): Released all slaves [ 507.159084][ C0] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 507.159194][ C0] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 507.179694][ T7205] bond10 (unregistering): Released all slaves [ 507.204699][ T7205] bond0 (unregistering): Released all slaves [ 507.227196][ T7205] bond11 (unregistering): Released all slaves [ 507.241210][ T7205] bond12 (unregistering): Released all slaves [ 507.267977][T19690] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4383'. [ 507.543572][ T7205] tipc: Disabling bearer [ 507.543708][ T7205] tipc: Disabling bearer [ 507.563516][ T7205] tipc: Left network mode [ 507.684695][T19712] SET target dimension over the limit! [ 507.932756][T19722] netlink: 'syz.4.4393': attribute type 10 has an invalid length. [ 507.937274][T19722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 507.957845][T19722] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 507.965499][T19720] netlink: 'syz.2.4392': attribute type 10 has an invalid length. [ 507.965532][T19720] syz_tun: entered promiscuous mode [ 507.976712][T19722] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 508.018953][T19722] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 508.057143][T19724] netlink: 'syz.1.4394': attribute type 2 has an invalid length. [ 508.079512][T19722] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 508.092000][T19722] bond0 (unregistering): Released all slaves [ 508.290422][T19732] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 508.663268][T19746] FAULT_INJECTION: forcing a failure. [ 508.663268][T19746] name failslab, interval 1, probability 0, space 0, times 0 [ 508.663323][T19746] CPU: 1 UID: 0 PID: 19746 Comm: syz.4.4401 Not tainted syzkaller #0 PREEMPT(full) [ 508.663343][T19746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 508.663372][T19746] Call Trace: [ 508.663379][T19746] [ 508.663387][T19746] dump_stack_lvl+0xe8/0x150 [ 508.663417][T19746] should_fail_ex+0x410/0x560 [ 508.663450][T19746] should_failslab+0xa8/0x100 [ 508.663473][T19746] __kmalloc_cache_noprof+0xa3/0x600 [ 508.663502][T19746] ? tipc_crypto_key_init+0x210/0x820 [ 508.663521][T19746] ? tipc_crypto_key_init+0x210/0x820 [ 508.663541][T19746] ? crypto_aead_setkey+0x160/0x220 [ 508.663569][T19746] tipc_crypto_key_init+0x210/0x820 [ 508.663605][T19746] tipc_nl_node_set_key+0x76a/0xa20 [ 508.663640][T19746] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 508.663674][T19746] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 508.663698][T19746] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 508.663727][T19746] genl_family_rcv_msg_doit+0x233/0x340 [ 508.663761][T19746] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 508.663802][T19746] ? bpf_lsm_capable+0x9/0x20 [ 508.663828][T19746] ? security_capable+0x7e/0x2c0 [ 508.663852][T19746] genl_rcv_msg+0x614/0x7a0 [ 508.663886][T19746] ? __pfx_genl_rcv_msg+0x10/0x10 [ 508.663910][T19746] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 508.663953][T19746] netlink_rcv_skb+0x226/0x4a0 [ 508.663976][T19746] ? __pfx_genl_rcv_msg+0x10/0x10 [ 508.664003][T19746] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 508.664040][T19746] ? down_read+0x2be/0x330 [ 508.664062][T19746] genl_rcv+0x28/0x40 [ 508.664085][T19746] netlink_unicast+0x7bd/0x940 [ 508.664115][T19746] netlink_sendmsg+0x813/0xb40 [ 508.664146][T19746] ? __pfx_netlink_sendmsg+0x10/0x10 [ 508.664177][T19746] ? apparmor_socket_sendmsg+0x98/0x360 [ 508.664205][T19746] ? __pfx_netlink_sendmsg+0x10/0x10 [ 508.664227][T19746] sock_sendmsg_nosec+0x13a/0x180 [ 508.664254][T19746] ____sys_sendmsg+0x54e/0x850 [ 508.664280][T19746] ? __pfx_____sys_sendmsg+0x10/0x10 [ 508.664308][T19746] ? import_iovec+0x73/0xa0 [ 508.664332][T19746] ___sys_sendmsg+0x2a5/0x360 [ 508.664357][T19746] ? __lock_acquire+0x6df/0x2e50 [ 508.664380][T19746] ? __pfx____sys_sendmsg+0x10/0x10 [ 508.664435][T19746] ? __fget_files+0x2a/0x420 [ 508.664458][T19746] ? __fget_files+0x3a2/0x420 [ 508.664491][T19746] __x64_sys_sendmsg+0x1b1/0x290 [ 508.664514][T19746] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 508.664554][T19746] do_syscall_64+0x166/0x520 [ 508.664580][T19746] ? trace_irq_disable+0x3b/0x140 [ 508.664597][T19746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.664615][T19746] ? clear_bhb_loop+0x70/0xc0 [ 508.664637][T19746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.664655][T19746] RIP: 0033:0x7f20daf9e159 [ 508.664673][T19746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.664689][T19746] RSP: 002b:00007f20dbed5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 508.664709][T19746] RAX: ffffffffffffffda RBX: 00007f20db225fa0 RCX: 00007f20daf9e159 [ 508.664722][T19746] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 508.664734][T19746] RBP: 00007f20dbed5090 R08: 0000000000000000 R09: 0000000000000000 [ 508.664746][T19746] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 508.664758][T19746] R13: 00007f20db226038 R14: 00007f20db225fa0 R15: 00007ffd1fd16238 [ 508.664789][T19746] [ 508.995385][ T7205] hsr_slave_0: left promiscuous mode [ 509.003716][ T7205] hsr_slave_1: left promiscuous mode [ 509.031484][ T7205] veth1_macvtap: left promiscuous mode [ 509.031521][ T7205] veth0_macvtap: left promiscuous mode [ 509.031633][ T7205] veth1_vlan: left promiscuous mode [ 509.031694][ T7205] veth0_vlan: left promiscuous mode [ 509.659814][ T7205] team0 (unregistering): Port device team_slave_1 removed [ 509.670867][ T7205] team0 (unregistering): Port device team_slave_0 removed [ 509.795027][T19763] FAULT_INJECTION: forcing a failure. [ 509.795027][T19763] name failslab, interval 1, probability 0, space 0, times 0 [ 509.795080][T19763] CPU: 1 UID: 0 PID: 19763 Comm: syz.0.4406 Not tainted syzkaller #0 PREEMPT(full) [ 509.795102][T19763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 509.795113][T19763] Call Trace: [ 509.795120][T19763] [ 509.795127][T19763] dump_stack_lvl+0xe8/0x150 [ 509.795152][T19763] should_fail_ex+0x410/0x560 [ 509.795181][T19763] ? __alloc_skb+0x1db/0x7a0 [ 509.795207][T19763] should_failslab+0xa8/0x100 [ 509.795230][T19763] ? __alloc_skb+0x1db/0x7a0 [ 509.795253][T19763] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 509.795280][T19763] ? __alloc_skb+0x18d/0x7a0 [ 509.795305][T19763] ? __alloc_skb+0x1db/0x7a0 [ 509.795337][T19763] __alloc_skb+0x1db/0x7a0 [ 509.795366][T19763] netlink_ack+0x136/0xb30 [ 509.795386][T19763] ? __pfx_genl_rcv_msg+0x10/0x10 [ 509.795413][T19763] ? __pfx_nl80211_post_doit+0x10/0x10 [ 509.795434][T19763] ? __pfx_ref_tracker_free+0x10/0x10 [ 509.795463][T19763] netlink_rcv_skb+0x2a4/0x4a0 [ 509.795485][T19763] ? __pfx_genl_rcv_msg+0x10/0x10 [ 509.795513][T19763] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 509.795549][T19763] ? down_read+0x2be/0x330 [ 509.795570][T19763] genl_rcv+0x28/0x40 [ 509.795594][T19763] netlink_unicast+0x7bd/0x940 [ 509.795625][T19763] netlink_sendmsg+0x813/0xb40 [ 509.795661][T19763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 509.795691][T19763] ? apparmor_socket_sendmsg+0x98/0x360 [ 509.795721][T19763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 509.795741][T19763] sock_sendmsg_nosec+0x13a/0x180 [ 509.795767][T19763] ____sys_sendmsg+0x54e/0x850 [ 509.795793][T19763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 509.795821][T19763] ? import_iovec+0x73/0xa0 [ 509.795845][T19763] ___sys_sendmsg+0x2a5/0x360 [ 509.795862][T19763] ? __lock_acquire+0x6df/0x2e50 [ 509.795886][T19763] ? __pfx____sys_sendmsg+0x10/0x10 [ 509.795940][T19763] ? __fget_files+0x2a/0x420 [ 509.795965][T19763] ? __fget_files+0x3a2/0x420 [ 509.795997][T19763] __x64_sys_sendmsg+0x1b1/0x290 [ 509.796020][T19763] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 509.796060][T19763] do_syscall_64+0x166/0x520 [ 509.796085][T19763] ? trace_irq_disable+0x3b/0x140 [ 509.796102][T19763] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.796122][T19763] ? clear_bhb_loop+0x70/0xc0 [ 509.796143][T19763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.796161][T19763] RIP: 0033:0x7f8472f9e159 [ 509.796179][T19763] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 509.796194][T19763] RSP: 002b:00007f8473f2e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 509.796213][T19763] RAX: ffffffffffffffda RBX: 00007f8473225fa0 RCX: 00007f8472f9e159 [ 509.796227][T19763] RDX: 000000000000c090 RSI: 0000200000000500 RDI: 0000000000000004 [ 509.796239][T19763] RBP: 00007f8473f2e090 R08: 0000000000000000 R09: 0000000000000000 [ 509.796251][T19763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 509.796262][T19763] R13: 00007f8473226038 R14: 00007f8473225fa0 R15: 00007ffedac20298 [ 509.796291][T19763] [ 510.130429][T19773] __nla_validate_parse: 2 callbacks suppressed [ 510.130480][T19773] netlink: 272 bytes leftover after parsing attributes in process `syz.3.4409'. [ 510.262165][T19774] tipc: Enabled bearer , priority 0 [ 510.276427][T19774] tipc: Resetting bearer [ 510.330432][T19770] tipc: Disabling bearer [ 510.415483][T19780] FAULT_INJECTION: forcing a failure. [ 510.415483][T19780] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 510.415541][T19780] CPU: 1 UID: 0 PID: 19780 Comm: syz.3.4413 Not tainted syzkaller #0 PREEMPT(full) [ 510.415561][T19780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 510.415571][T19780] Call Trace: [ 510.415577][T19780] [ 510.415583][T19780] dump_stack_lvl+0xe8/0x150 [ 510.415609][T19780] should_fail_ex+0x410/0x560 [ 510.415651][T19780] _copy_from_user+0x2d/0xb0 [ 510.415672][T19780] kstrtouint_from_user+0xd6/0x180 [ 510.415701][T19780] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 510.415733][T19780] ? lock_acquire+0x115/0x350 [ 510.415757][T19780] proc_fail_nth_write+0x8e/0x210 [ 510.415784][T19780] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 510.415818][T19780] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 510.415844][T19780] vfs_write+0x296/0xba0 [ 510.415878][T19780] ? __pfx_vfs_write+0x10/0x10 [ 510.415905][T19780] ? __fget_files+0x2a/0x420 [ 510.415933][T19780] ? __fget_files+0x3a2/0x420 [ 510.415955][T19780] ? __fget_files+0x2a/0x420 [ 510.415985][T19780] ksys_write+0x150/0x270 [ 510.416013][T19780] ? __pfx_ksys_write+0x10/0x10 [ 510.416049][T19780] do_syscall_64+0x166/0x520 [ 510.416074][T19780] ? trace_irq_disable+0x3b/0x140 [ 510.416090][T19780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.416109][T19780] ? clear_bhb_loop+0x70/0xc0 [ 510.416131][T19780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 510.416152][T19780] RIP: 0033:0x7fd4b0f5e98e [ 510.416170][T19780] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 510.416186][T19780] RSP: 002b:00007fd4b1dbcfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 510.416205][T19780] RAX: ffffffffffffffda RBX: 00007fd4b1dbd6c0 RCX: 00007fd4b0f5e98e [ 510.416218][T19780] RDX: 0000000000000001 RSI: 00007fd4b1dbd0a0 RDI: 0000000000000006 [ 510.416230][T19780] RBP: 00007fd4b1dbd090 R08: 0000000000000000 R09: 0000000000000000 [ 510.416242][T19780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 510.416253][T19780] R13: 00007fd4b1226038 R14: 00007fd4b1225fa0 R15: 00007ffe357f5908 [ 510.416284][T19780] [ 510.736020][ T7205] IPVS: stop unused estimator thread 0... [ 510.809665][ T5721] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 510.836033][T19793] [ 510.838410][T19793] ====================================================== [ 510.845441][T19793] WARNING: possible circular locking dependency detected [ 510.852476][T19793] syzkaller #0 Not tainted [ 510.856887][T19793] ------------------------------------------------------ [ 510.863901][T19793] syz.0.4414/19793 is trying to acquire lock: [ 510.869961][T19793] ffff88801c2f7a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_permission+0x7f/0x430 [ 510.880495][T19793] [ 510.880495][T19793] but task is already holding lock: [ 510.887848][T19793] ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 510.897939][T19793] [ 510.897939][T19793] which lock already depends on the new lock. [ 510.897939][T19793] [ 510.908340][T19793] [ 510.908340][T19793] the existing dependency chain (in reverse order) is: [ 510.917348][T19793] [ 510.917348][T19793] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 510.925084][T19793] cpus_read_lock+0x42/0x160 [ 510.930203][T19793] static_key_slow_inc+0x12/0x30 [ 510.935659][T19793] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 510.941893][T19793] nbd_genl_foreach_sock+0x265/0x450 [ 510.947700][T19793] nbd_genl_reconfigure+0xbbb/0x1040 [ 510.953500][T19793] genl_family_rcv_msg_doit+0x233/0x340 [ 510.959566][T19793] genl_rcv_msg+0x614/0x7a0 [ 510.964588][T19793] netlink_rcv_skb+0x226/0x4a0 [ 510.969865][T19793] genl_rcv+0x28/0x40 [ 510.974367][T19793] netlink_unicast+0x7bd/0x940 [ 510.979643][T19793] netlink_sendmsg+0x813/0xb40 [ 510.984920][T19793] sock_sendmsg_nosec+0x13a/0x180 [ 510.990460][T19793] ____sys_sendmsg+0x54e/0x850 [ 510.995736][T19793] ___sys_sendmsg+0x2a5/0x360 [ 511.000924][T19793] __x64_sys_sendmsg+0x1b1/0x290 [ 511.006379][T19793] do_syscall_64+0x166/0x520 [ 511.011491][T19793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.017984][T19793] [ 511.017984][T19793] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 511.025629][T19793] __mutex_lock+0x19d/0x1550 [ 511.030745][T19793] nbd_queue_rq+0x373/0xff0 [ 511.035766][T19793] blk_mq_dispatch_rq_list+0x499/0x1990 [ 511.041831][T19793] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 511.048668][T19793] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 511.055158][T19793] blk_mq_run_work_fn+0x16c/0x300 [ 511.060698][T19793] process_scheduled_works+0xc3d/0x1630 [ 511.066761][T19793] worker_thread+0xa47/0xfb0 [ 511.071869][T19793] kthread+0x38b/0x480 [ 511.076452][T19793] ret_from_fork+0x514/0xb70 [ 511.081581][T19793] ret_from_fork_asm+0x1a/0x30 [ 511.086864][T19793] [ 511.086864][T19793] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 511.094065][T19793] __mutex_lock+0x19d/0x1550 [ 511.099178][T19793] nbd_queue_rq+0xc1/0xff0 [ 511.104118][T19793] blk_mq_dispatch_rq_list+0x499/0x1990 [ 511.110183][T19793] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 511.117029][T19793] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 511.123519][T19793] blk_mq_run_work_fn+0x16c/0x300 [ 511.129065][T19793] process_scheduled_works+0xc3d/0x1630 [ 511.135129][T19793] worker_thread+0xa47/0xfb0 [ 511.140232][T19793] kthread+0x38b/0x480 [ 511.144814][T19793] ret_from_fork+0x514/0xb70 [ 511.149915][T19793] ret_from_fork_asm+0x1a/0x30 [ 511.155199][T19793] [ 511.155199][T19793] -> #4 (set->srcu){.+.+}-{0:0}: [ 511.162315][T19793] __synchronize_srcu+0xc9/0x2f0 [ 511.167770][T19793] elevator_switch+0x1e8/0x7b0 [ 511.173052][T19793] elevator_change+0x2fa/0x480 [ 511.178333][T19793] elevator_set_default+0x375/0x440 [ 511.184048][T19793] blk_register_queue+0x3f3/0x4e0 [ 511.189586][T19793] __add_disk+0x6cb/0xe30 [ 511.194428][T19793] add_disk_fwnode+0x100/0x3a0 [ 511.199705][T19793] nbd_dev_add+0x733/0xb60 [ 511.204635][T19793] nbd_init+0x168/0x1f0 [ 511.209446][T19793] do_one_initcall+0x250/0x870 [ 511.214739][T19793] do_initcall_level+0x10a/0x1a0 [ 511.220225][T19793] do_initcalls+0x59/0xa0 [ 511.225068][T19793] kernel_init_freeable+0x29d/0x3e0 [ 511.230781][T19793] kernel_init+0x22/0x1d0 [ 511.235631][T19793] ret_from_fork+0x514/0xb70 [ 511.240749][T19793] ret_from_fork_asm+0x1a/0x30 [ 511.246052][T19793] [ 511.246052][T19793] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 511.253864][T19793] __mutex_lock+0x19d/0x1550 [ 511.258981][T19793] elevator_change+0x1af/0x480 [ 511.264263][T19793] elevator_set_none+0xb5/0x140 [ 511.269631][T19793] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 511.275952][T19793] nbd_start_device+0x189/0xb30 [ 511.281323][T19793] nbd_genl_connect+0x167d/0x1cd0 [ 511.286874][T19793] genl_family_rcv_msg_doit+0x233/0x340 [ 511.292937][T19793] genl_rcv_msg+0x614/0x7a0 [ 511.297958][T19793] netlink_rcv_skb+0x226/0x4a0 [ 511.303233][T19793] genl_rcv+0x28/0x40 [ 511.307731][T19793] netlink_unicast+0x7bd/0x940 [ 511.313007][T19793] netlink_sendmsg+0x813/0xb40 [ 511.318287][T19793] sock_sendmsg_nosec+0x13a/0x180 [ 511.323827][T19793] ____sys_sendmsg+0x54e/0x850 [ 511.329101][T19793] ___sys_sendmsg+0x2a5/0x360 [ 511.334288][T19793] __x64_sys_sendmsg+0x1b1/0x290 [ 511.339733][T19793] do_syscall_64+0x166/0x520 [ 511.344840][T19793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.351242][T19793] [ 511.351242][T19793] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 511.359836][T19793] blk_alloc_queue+0x544/0x690 [ 511.365122][T19793] __blk_mq_alloc_disk+0x194/0x390 [ 511.370747][T19793] nbd_dev_add+0x494/0xb60 [ 511.375680][T19793] nbd_init+0x168/0x1f0 [ 511.380350][T19793] do_one_initcall+0x250/0x870 [ 511.385628][T19793] do_initcall_level+0x10a/0x1a0 [ 511.391075][T19793] do_initcalls+0x59/0xa0 [ 511.395924][T19793] kernel_init_freeable+0x29d/0x3e0 [ 511.401637][T19793] kernel_init+0x22/0x1d0 [ 511.406478][T19793] ret_from_fork+0x514/0xb70 [ 511.411579][T19793] ret_from_fork_asm+0x1a/0x30 [ 511.416862][T19793] [ 511.416862][T19793] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 511.424064][T19793] fs_reclaim_acquire+0x71/0x100 [ 511.429523][T19793] kmem_cache_alloc_noprof+0x5f/0x600 [ 511.435413][T19793] __kernfs_iattrs+0xdd/0x380 [ 511.440608][T19793] kernfs_iop_setattr+0xe6/0x3f0 [ 511.446097][T19793] notify_change+0xbba/0xea0 [ 511.451203][T19793] do_truncate+0x1c2/0x250 [ 511.456137][T19793] path_openat+0x15b5/0x1d60 [ 511.461242][T19793] do_file_open+0x23e/0x4a0 [ 511.466262][T19793] do_sys_openat2+0x115/0x200 [ 511.471459][T19793] __x64_sys_openat+0x138/0x170 [ 511.476822][T19793] do_syscall_64+0x166/0x520 [ 511.481933][T19793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.488343][T19793] [ 511.488343][T19793] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 511.496860][T19793] __lock_acquire+0x15ff/0x2e50 [ 511.502240][T19793] lock_acquire+0x115/0x350 [ 511.507262][T19793] down_read+0x4a/0x330 [ 511.511935][T19793] kernfs_iop_permission+0x7f/0x430 [ 511.517674][T19793] inode_permission+0x3de/0x5f0 [ 511.523056][T19793] cgroup_attach_permissions+0x28e/0x9f0 [ 511.529210][T19793] __cgroup_procs_write+0x24b/0x320 [ 511.534928][T19793] cgroup_threads_write+0x24/0x50 [ 511.540480][T19793] cgroup_file_write+0x331/0x8f0 [ 511.545937][T19793] kernfs_fop_write_iter+0x3a4/0x540 [ 511.551736][T19793] vfs_write+0x612/0xba0 [ 511.556503][T19793] ksys_write+0x150/0x270 [ 511.561347][T19793] do_syscall_64+0x166/0x520 [ 511.566455][T19793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.572862][T19793] [ 511.572862][T19793] other info that might help us debug this: [ 511.572862][T19793] [ 511.583079][T19793] Chain exists of: [ 511.583079][T19793] &root->kernfs_iattr_rwsem --> &nsock->tx_lock --> cpu_hotplug_lock [ 511.583079][T19793] [ 511.597061][T19793] Possible unsafe locking scenario: [ 511.597061][T19793] [ 511.604497][T19793] CPU0 CPU1 [ 511.609850][T19793] ---- ---- [ 511.615206][T19793] rlock(cpu_hotplug_lock); [ 511.619787][T19793] lock(&nsock->tx_lock); [ 511.626717][T19793] lock(cpu_hotplug_lock); [ 511.633733][T19793] rlock(&root->kernfs_iattr_rwsem); [ 511.639112][T19793] [ 511.639112][T19793] *** DEADLOCK *** [ 511.639112][T19793] [ 511.647257][T19793] locks held by syz.0.4414/19793: 5, last CPU#0: [ 511.653582][T19793] #0: ffff8880798687f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 511.662640][T19793] #1: ffff8880357f8460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 511.671518][T19793] #2: ffff88807e56d080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 511.681257][T19793] #3: ffffffff8ed9c560 (cgroup_mutex){+.+.}-{4:4}, at: cgroup_kn_lock_live+0x13c/0x230 [ 511.691001][T19793] #4: ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 511.701518][T19793] [ 511.701518][T19793] stack backtrace: [ 511.707398][T19793] CPU: 0 UID: 0 PID: 19793 Comm: syz.0.4414 Not tainted syzkaller #0 PREEMPT(full) [ 511.716756][T19793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 511.726891][T19793] Call Trace: [ 511.730164][T19793] [ 511.733088][T19793] dump_stack_lvl+0xe8/0x150 [ 511.737677][T19793] print_circular_bug+0x2e2/0x300 [ 511.742702][T19793] check_noncircular+0x12f/0x150 [ 511.747636][T19793] __lock_acquire+0x15ff/0x2e50 [ 511.752487][T19793] ? __lock_acquire+0x6df/0x2e50 [ 511.757425][T19793] lock_acquire+0x115/0x350 [ 511.761927][T19793] ? kernfs_iop_permission+0x7f/0x430 [ 511.767300][T19793] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 511.773105][T19793] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 511.778909][T19793] down_read+0x4a/0x330 [ 511.783058][T19793] ? kernfs_iop_permission+0x7f/0x430 [ 511.788426][T19793] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 511.794236][T19793] kernfs_iop_permission+0x7f/0x430 [ 511.799436][T19793] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 511.805245][T19793] inode_permission+0x3de/0x5f0 [ 511.810094][T19793] cgroup_attach_permissions+0x28e/0x9f0 [ 511.815724][T19793] __cgroup_procs_write+0x24b/0x320 [ 511.820943][T19793] cgroup_threads_write+0x24/0x50 [ 511.825970][T19793] ? __pfx_cgroup_threads_write+0x10/0x10 [ 511.831685][T19793] cgroup_file_write+0x331/0x8f0 [ 511.836633][T19793] ? __pfx_cgroup_file_write+0x10/0x10 [ 511.842109][T19793] ? __kmalloc_noprof+0x38c/0x720 [ 511.847153][T19793] ? __pfx_cgroup_file_write+0x10/0x10 [ 511.852615][T19793] kernfs_fop_write_iter+0x3a4/0x540 [ 511.857901][T19793] vfs_write+0x612/0xba0 [ 511.862147][T19793] ? __pfx_vfs_write+0x10/0x10 [ 511.866912][T19793] ? __fget_files+0x2a/0x420 [ 511.871503][T19793] ksys_write+0x150/0x270 [ 511.875831][T19793] ? __pfx_ksys_write+0x10/0x10 [ 511.880682][T19793] do_syscall_64+0x166/0x520 [ 511.885271][T19793] ? trace_irq_disable+0x3b/0x140 [ 511.890295][T19793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.896357][T19793] ? clear_bhb_loop+0x70/0xc0 [ 511.901031][T19793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.906918][T19793] RIP: 0033:0x7f8472f9e159 [ 511.911326][T19793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 511.930927][T19793] RSP: 002b:00007f8473f2e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 511.939334][T19793] RAX: ffffffffffffffda RBX: 00007f8473225fa0 RCX: 00007f8472f9e159 [ 511.947297][T19793] RDX: 0000000000000012 RSI: 0000200000000c40 RDI: 000000000000000a [ 511.955258][T19793] RBP: 00007f847303503b R08: 0000000000000000 R09: 0000000000000000 [ 511.963219][T19793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 511.971180][T19793] R13: 00007f8473226038 R14: 00007f8473225fa0 R15: 00007ffedac20298 [ 511.979152][T19793] [ 512.098159][ T5721] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 514.118812][ T5628] Bluetooth: hci0: command 0x0406 tx timeout [ 517.129895][ T4982] udevd[4982]: worker [12103] /devices/virtual/block/nbd4 timeout; kill it [ 517.129994][ T4982] udevd[4982]: seq 18665 '/devices/virtual/block/nbd4' killed [ 518.679135][ T1993] block nbd4: Possible stuck request ffff888027c7e000: control (read@0,1024B). Runtime 210 seconds [ 518.679174][ T1993] block nbd4: Possible stuck request ffff888027c7e1c0: control (read@1024,1024B). Runtime 210 seconds [ 518.679214][ T1993] block nbd4: Possible stuck request ffff888027c7e380: control (read@2048,1024B). Runtime 210 seconds [ 518.679232][ T1993] block nbd4: Possible stuck request ffff888027c7e540: control (read@3072,1024B). Runtime 210 seconds