last executing test programs: 6.292139803s ago: executing program 3 (id=6860): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="170000000000000004000000fd0000", @ANYRES32=0x1, @ANYBLOB="000800000000a33b2bbe3749d9ba5d5a6ace780000000000000017000000009c6f01287a8b130e061e83a7f674cc606c64e566d8864cbd4bba7c2db9859997a3b29f0f57226b281fc4a5ae152bb43ddb38970a24dbf8ded8b060d118f216c1f57d65b6d9181fa24e02cade48d6", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg(r0, &(0x7f0000005d80)=[{{0x0, 0x0, &(0x7f0000000d00)=[{&(0x7f0000000000)="bf", 0x1}], 0x1, &(0x7f0000000680)=ANY=[], 0xc}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[], 0x10}}], 0x2, 0x4044044) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x645c, 0x4, 0x40, 0x0, 0x7fffffff, 0x80, 0xffffffff, 0x1}}}}]}, 0x58}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2000400c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[], 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) unshare(0x22020400) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)) writev(r3, 0x0, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet6(0xa, 0x3, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000010280)=ANY=[], 0x40}}, 0x20000840) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) r6 = socket(0x2b, 0x80801, 0x1) listen(r6, 0x9) connect$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e1f, 0x402, @private0, 0x200101}, 0x1c) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) 5.928121963s ago: executing program 3 (id=6867): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r0, 0x200000000114, 0x271e, 0x0, &(0x7f0000000000)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000200)={@rand_addr=' \x01\x00', 0x200, 0x0, 0xff, 0x0, 0x0, 0xe42}, 0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001009f"], 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) 5.4507804s ago: executing program 3 (id=6870): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1400000000000000000000000100000004000000000000001400000000000000100100000d0000"], 0x30}, 0x40) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0xa}, @NFTA_DYNSET_FLAGS={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_DYNSET_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$netlink(0x10, 0x3, 0x15) sendmsg$netlink(r3, &(0x7f0000002e00)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000880)=ANY=[@ANYBLOB="e00000001300010000000000000000004015143f4529d72384a65b0f683ca0a21fdf11440000bf3bc8d961bdc2e3267150aaca5d87ea3a2d0572f6a7882ef366b38649334f9e14aa669004dbd601f7a573479bda64e1a21a8d8224968c420b2358508e8b0e65ea507a9d564c6e29ad53eb774cd5a8114674850d36744c882033716525c99530fc100d4a5998ba6bdfed"], 0xe0}], 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x1d\x00'}]}, 0x1c}}, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000200)={'dummy0\x00', &(0x7f0000000240)=@ethtool_per_queue_op={0x4b, 0x14, [0xfb, 0x4, 0x40, 0x8000, 0x3, 0x0, 0x0, 0xe5, 0x1ff, 0x81, 0xc, 0x1b, 0xdb, 0x8, 0x6, 0x8, 0xfffeffff, 0x3ff, 0x61b9359f, 0x1, 0x10001, 0xfff, 0x8, 0xfffffffa, 0x2, 0xfffffffb, 0x100000, 0x4, 0x8000, 0xfffffffa, 0xa, 0x2, 0x10000, 0xb, 0x800, 0x1, 0x7, 0x561, 0x1, 0x7, 0xf, 0xfffffffa, 0x8001, 0x3ff, 0xaaf, 0x3, 0x8, 0x8, 0x6, 0x5, 0x2, 0x4, 0x1, 0xfffffffe, 0xa140, 0xffff, 0x0, 0xfff, 0x8, 0x9, 0x0, 0x7, 0x6, 0x7, 0x2, 0x8, 0x0, 0x4, 0x1, 0xa500000, 0x1, 0x6, 0x7, 0x3, 0x6, 0xfffffff0, 0x400, 0x5, 0x2, 0x6, 0x8630, 0x2, 0x4, 0x10000, 0x9, 0x5, 0x8f0, 0x4, 0x9, 0x5, 0x8, 0x2, 0x0, 0xfffffffe, 0x3fcf, 0x6, 0x0, 0xc, 0x3, 0xf, 0x867, 0xfffffff8, 0x42c, 0x6932, 0x6, 0x6, 0x0, 0x0, 0x8, 0x5, 0x6, 0x6, 0x0, 0x27c25e29, 0xfff, 0x80000001, 0x4, 0x5c9, 0x10000, 0x5, 0x756b2326, 0x2, 0x6, 0x4, 0x17e, 0x1, 0x8000, 0xa3bd]}}) 5.294191169s ago: executing program 3 (id=6874): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000040), 0x4) sendto$inet6(r7, &(0x7f00000002c0)="03", 0x1, 0x20008840, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x9}, 0x1c) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x3, 0x6361, 0x5, 0xfffffffd, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r8, {0x0, 0xffe0}, {0x2, 0xb}, {0xd, 0xd}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0xfffffe64, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x5, 0x6, 0x40, 0x5, 0x100, 0xfff, 0xffff9efc, 0xffff7f79}}}}]}, 0x58}}, 0x4010804) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 4.010203846s ago: executing program 3 (id=6882): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f00000000c0)={0x0, 0x4f, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x10) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x8, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x3, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x100, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0xb, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x1, 0x4, 0x100002, 0x8, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x808, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8, 0x4, 0x1fc, 0xc5c, 0xffffffff]}}) unshare(0x22020600) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r4, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 3.584794255s ago: executing program 2 (id=6886): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x700, 0x1, 0xfffffffc, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x63, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @broadcast, @multicast2, {[@timestamp={0x44, 0x4, 0x4e, 0x0, 0x4}]}}}}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xe}}, 0x57) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) read(r4, &(0x7f0000000300)=""/80, 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="01002dbd7000ffdbdf255700000008000300", @ANYRES32=r7, @ANYBLOB="122e869e4f775046218baed421d105a5963baac9594d9223ed"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000200)=0x33d7, 0x4) sendto$inet(r1, &(0x7f0000000180)='<./', 0x3, 0x4000805, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@getqdisc={0x28, 0x26, 0x10, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0x8}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20044081) r9 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ec0)=@newqdisc={0x68, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r11, {0x0, 0x8}, {0xffff, 0xffff}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x4, 0x7, 0x4, 0x2, 0x2cf, 0x8d2, 0x1}}, {0x6, 0x2, [0xffff]}}]}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x401}}]}, 0x68}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008098) socketpair(0x28, 0x2, 0x28, &(0x7f0000001400)) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.047445613s ago: executing program 3 (id=6888): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="34d81cd4a951da8dee660700dd00000314000000d47eb1bb356db886ca827def4f"], 0x22) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x32600) socket$alg(0x26, 0x5, 0x0) socket$kcm(0xa, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$xdp(0x2c, 0x3, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0x20, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x8, r4}, 0x10) ppoll(&(0x7f0000000480)=[{r1, 0x100}], 0x1, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000440)={0x50, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x20000000}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 2.281788684s ago: executing program 0 (id=6891): socket$kcm(0x11, 0x3, 0x300) r0 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x910, @loopback={0x0, 0xac14140c}, 0x2}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000100)="00c50000", 0x4}], 0x1, 0x0, 0x0, 0x900}, 0x60) 2.249315488s ago: executing program 2 (id=6893): socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES16=r0], 0x10}}, 0x4000000) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(0xffffffffffffffff, 0x100086, 0x81, &(0x7f00000003c0)="1a005e9700c93353c00bfeffffff000e00", 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r1, &(0x7f0000000540), 0x0, 0x2000c815, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000240)=ANY=[], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000300), 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000400000002000000000000070000000000000000000000020100000000002e"], 0x0, 0x34}, 0x20) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r5 = socket(0x10, 0x3, 0x9) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x17, &(0x7f0000000340)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x13, 0x200000000000003a, &(0x7f0000000280)=ANY=[@ANYRESDEC=r3, @ANYRES8=r4, @ANYBLOB="00000000000000105b080009feffffff18000000000000000000000000010000960a0200000000009500000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x58}, 0x94) r8 = socket$can_bcm(0x1d, 0x2, 0x2) syz_genetlink_get_family_id$smc(&(0x7f0000000240), r8) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r5, @ANYRES32=r7], 0x14}, 0x1, 0x0, 0x0, 0x54}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000880)=ANY=[@ANYRESHEX, @ANYRES16=0x0, @ANYBLOB="cb6202ff6e09349a355aa58201800800010000000000", @ANYRES8, @ANYBLOB="1400020067656e657665300000000000000000001400020067656e65766531000000000000000000140002006272696467655f736c617665", @ANYBLOB="a0f32051e83e66176029bea5851717ad48848db754af0a8a1f3cb67cc407ae1727dff7d4647300a330f741bead6cfacc2f33f157595987e1bfea925b5b7868edb70bfe8c94b0ec96dfd5151e0bb874eba4533a62af8de825289e57c08a0fe1f366f593fade57de49c6189ae9eee56b9e584c20562c4dadda74d8567d6a08cf6ac6a29a3c892f"], 0x8c}, 0x1, 0x0, 0x0, 0x4080}, 0x844) connect$netlink(r5, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) r9 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCINQ(r9, 0x541b, &(0x7f0000000180)) syz_genetlink_get_family_id$tipc(0x0, r5) sendmsg$BATADV_CMD_SET_VLAN(r5, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000980)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="00032cbd7000ffdbdf251200000008002b001d0000000500380003000000c2c985a629ec4d8037a2f4d3aa0cd11b8c16f884ea54ad79edc1de1f617c624cbcf3c7b22c7134dc11b8b38f9ccb7f5b7f780ac88c703b23db56540faec6d7fa748fee3a6f4fa658914bbfe01859c6e0b80805c62f1b4a7d7bd2785caf2b36061f0704e23fa571f2f812f50b17b22d34f49332a86b49ca4c3722afea117110555bffe390a566791538abb398492b8a39a085b2a7664f424733248c3534e8763e74f5393de4e43982315e65bcc94ae1e03cc5a7b1f4c4d4ef61240df167df8259ef406f03d04269b949"], 0x24}, 0x1, 0x0, 0x0, 0x890}, 0x40) 2.110756096s ago: executing program 0 (id=6895): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x0, 0xfffffffd, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r4, 0x0, 0x1, 0x1, {@ip4=@loopback, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000900)={0x1b, 0x0, 0x0, 0x10000, 0x0, 0x0}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xf, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000003000000000000000700000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000400000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @xdp=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xe, 0x0, &(0x7f0000000440)="66d4492a0a1b30e699005a6d88a8", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x9}, 0x50) 2.08261158s ago: executing program 4 (id=6896): getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000380)={0xfffffffffffffffe, {0x2, 0x4e27, @empty}, {0x2, 0x0, @remote}, {0x2, 0x4e21, @empty}, 0x107, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x7, 0x1}) 1.93252007s ago: executing program 2 (id=6898): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x3, 0xe, &(0x7f0000000f40)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c03406910927c6b0b55b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfe79578e51bc53099e90f4580d760551b5b342f7cbdb9cd38bdb2209c676b2ac2deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f132020000002cbe7bc04b82d2789cb1b2b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c41146dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a42b359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780c70014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e506d1387b63112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece08ac772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2ef0ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a3f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099bdae7ed04935c2c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adeb988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ffa3c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe4a3ced846891180604b6dd2499d16d7d9158ffffff069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a331bcc87dc3addb0814040000007874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dbae3428d2129ecfce1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296c6a298c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f050000000000000026049fe86e09623524f390bf79b441b75fc790c58e273cd905deb28c13c1ed1c0d9cae846b03008cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4e62b445c00f576b2b5cc7f819abd0f885cc48f97496079654f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b4749c28eb5167e9936ed327fb237a56224e49d9ea956d1798571b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecf743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be182724d95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd0403a099f32468f1561f058960d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b656dc0e32384f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bbe3e8ef76f57a2d0e69115d33394e86e4b83c0f3c2a34635f3eee4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cd082027c641ec4355eb4acff90756d1a1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8cc3fe28bc3586844f5fecb92aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a5906002fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128ab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0afd9ae134400f70b5e6aefb7eee403502732df858a2ea033b6c91c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80ffb8f386bb79f5589829b6b0679b5d65a00000000000000e6ff00000000000000000000faff0000bab50bc8508a9644d3e7c328b0ff22035c8073f8c1f0e3da7339fc81d4ab3ef2857ef70a81d8a1628da28c942571880e22df7cabae56d5ff5e483c9c1f5a258b8f1f34cc300312f76a374a6e9b3f9dbd7f538a80b00f97e47895b3201c5126feca0888956a7d768198d9c2109ac508a47ebb99c539ef45af7d87b308117a9e321a3861bc42cf41942c31268a4020221d7b1622585094eddd83c7f4acdd7f5c23d8b730bf03118261edada8b8487a3b1b7548a4687a91f12bf70bb1df3bfe7d4b92ad6fcbf401efd6eb004cf20016ad8d1dad136dd856ffca238b39482811f9c8524bf182f1956a3d044423927df28880bbd11c06407220df8e1d1d483d947d990dc175803d765ca14a915a0040b641959ad3e776b4bb4852fea12983dc18b7404914a6137dc4a78f1e0d331c60a9019c21698cd18753491df962f496f2395563e9c3d7b1228d0e488cf7e50a29541aa757f2e2ee9ff4433d65db0de5a123d569e39dce481156cbec584c9a32a8e3b032fa003192c891d83119bc950abac9147b9fcb0acd9a207b5ceb7e8ed1d91c000000000000000000000000000000141258373281153fa27e586ea82650f070d8851ac9e7ac07b37a6479d4017b5b5af3ff4c91235df4f657d77e386a329aec4d766369c86b62b01ceb028c6fcf206883633cb143016b9f5351a45a8cb4ea110ba700000000000000883416b6eff6a793c71deb7d780c4f51d86ece127c0714144916f397d398ad2fe72b710b932c15c2369cb5d2d2f6ae420672c4a626195a891ac51825077fbc286aa3866bbf18a4a8b836ea8c90af0d5f0aff55b50bc18c27875ed2628b91224b7fa9fd10ccd7c1b1a92bac529df981a6d30100e68555553625c0e91a51000000000000000000fe030f85b294f3ea1fce314a9dcefbe3b64e83c35c5e95734786ca78315793cc0e6e776d2ec07c55cd89541ec25e074e840287011cab538d79e1569df321282071d49a4dc5fb2d7da1d05249d0e153fd04aca2", @ANYRES8], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x16, 0x0, 0xffffffffffffffff, 0xffffffffffffffc9}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000000)="378303076844268cb89e14f04305", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (fail_nth: 30) 1.848161997s ago: executing program 4 (id=6899): socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES16=r0], 0x10}}, 0x4000000) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(0xffffffffffffffff, 0x100086, 0x81, &(0x7f00000003c0)="1a005e9700c93353c00bfeffffff000e00", 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r1, &(0x7f0000000540), 0x0, 0x2000c815, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000240)=ANY=[], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000300), 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000400000002000000000000070000000000000000000000020100000000002e"], 0x0, 0x34}, 0x20) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r5 = socket(0x10, 0x3, 0x9) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x17, &(0x7f0000000340)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x13, 0x200000000000003a, &(0x7f0000000280)=ANY=[@ANYRESDEC=r3, @ANYRES8=r4, @ANYBLOB="00000000000000105b080009feffffff18000000000000000000000000010000960a0200000000009500000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x58}, 0x94) r8 = socket$can_bcm(0x1d, 0x2, 0x2) syz_genetlink_get_family_id$smc(&(0x7f0000000240), r8) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r5, @ANYRES32=r7], 0x14}, 0x1, 0x0, 0x0, 0x54}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000880)=ANY=[@ANYRESHEX, @ANYRES16=0x0, @ANYBLOB="cb6202ff6e09349a355aa58201800800010000000000", @ANYRES8, @ANYBLOB="1400020067656e657665300000000000000000001400020067656e65766531000000000000000000140002006272696467655f736c617665", @ANYBLOB="a0f32051e83e66176029bea5851717ad48848db754af0a8a1f3cb67cc407ae1727dff7d4647300a330f741bead6cfacc2f33f157595987e1bfea925b5b7868edb70bfe8c94b0ec96dfd5151e0bb874eba4533a62af8de825289e57c08a0fe1f366f593fade57de49c6189ae9eee56b9e584c20562c4dadda74d8567d6a08cf6ac6a29a3c892f"], 0x8c}, 0x1, 0x0, 0x0, 0x4080}, 0x844) connect$netlink(r5, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) r9 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCINQ(r9, 0x541b, &(0x7f0000000180)) syz_genetlink_get_family_id$tipc(0x0, r5) sendmsg$BATADV_CMD_SET_VLAN(r5, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000980)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="00032cbd7000ffdbdf251200000008002b001d0000000500380003000000c2c985a629ec4d8037a2f4d3aa0cd11b8c16f884ea54ad79edc1de1f617c624cbcf3c7b22c7134dc11b8b38f9ccb7f5b7f780ac88c703b23db56540faec6d7fa748fee3a6f4fa658914bbfe01859c6e0b80805c62f1b4a7d7bd2785caf2b36061f0704e23fa571f2f812f50b17b22d34f49332a86b49ca4c3722afea117110555bffe390a566791538abb398492b8a39a085b2a7664f424733248c3534e8763e74f5393de4e43982315e65bcc94ae1e03cc5a7b1f4c4d4ef61240df167df8259ef406f03d04269b949"], 0x24}, 0x1, 0x0, 0x0, 0x890}, 0x40) 1.811118033s ago: executing program 0 (id=6900): socket(0x10, 0x803, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="2000000072000f0b2dbd7000ffdbdf250700", @ANYRESHEX=r0, @ANYBLOB='\b'], 0x20}, 0x1, 0x0, 0x0, 0x64040084}, 0x488d0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0xffa6}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a300000000030000000060a010400000000000000000100000008000b40000000000900010073797a3000000000050007400800000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x2004c899}, 0x0) socket$packet(0x11, 0x3, 0x300) pipe(&(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r5, 0x0, 0xf3a, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x10000000000002, 0x4, 0xffffffffffffffdd, 0x400000, 0x0, 0xffffffffffffff1b, 0x3b}, 0x0, &(0x7f0000000280)={0x3fc, 0x0, 0x0, 0x1, 0x100, 0x0, 0x80000003, 0x3ff}, 0x0, 0x0) vmsplice(r5, &(0x7f0000000380)=[{&(0x7f0000013580)='\r', 0x1}], 0x1, 0x0) write$cgroup_devices(r5, 0x0, 0x8) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94) write(r3, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket(0x15, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, 0x0) sendmsg$IPSET_CMD_GET_BYINDEX(0xffffffffffffffff, 0x0, 0x4000) sendmmsg(r4, 0x0, 0x39, 0x0) close(0xffffffffffffffff) socket$inet6(0xa, 0x80000, 0xb2) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r6, 0x1) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 1.759434375s ago: executing program 2 (id=6901): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xf, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x326}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xff}}, @ip_tos_u8={{0x11, 0x11a, 0x1, 0xce}}], 0x30}, 0x8000) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x4000801}, 0xc0c4) r2 = socket$l2tp(0x2, 0x2, 0x73) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket$can_raw(0x1d, 0x3, 0x1) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x298, 0x168, 0x0, 0x0, 0x200, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x298}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4, 0x11000000]}}}}, {{@uncond, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x0, 0xe, 0x0, &(0x7f0000000000)="052015973c1a44a8640000000000", 0x0, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) 1.672525287s ago: executing program 4 (id=6902): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001100)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000400000000000e1ff95000000000000002ba76bb3019c1341056bd8174b79603123751c4e345c652fbc1626cca2a2ad75806150ae0209e62751ee00aa19ce670d25010000020000040000009fc404000000c788b277beee1cbf9b0a4def23d410f6accd3641110bec4e90a6341965dac05c04683712a0b09ec39e9ef8f6e396ad200e011ea665c45a3449abe802f5ab3e89cf40b8580218ce740068720000074e468eea3fcfcf498278a315f5b87e1c26433a8acd715f5888b2007f00000000000000000100000000000000010015d60605000053350000000034a70c2ab40c7cf5691db43a5c00000000000000f030007ce2c6f800000000000000e75a89faff01218087560cce39bf405f1e846c1242000000000040cad326ad7add65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bef5d7d617da7a6520655a805608df4d431623c850af895abba14f6fbd7fb5e2a431ab9142f3a06d55740a43088696daaed74b9c5c29647d2f950a959cf050000008600a62e96b7cb8e52cbdc2ba9d580609e31c30879d6fce424c2208af6c3784a1975fa657de38a3a32e4fd67ce446adb431d07db79241aca1dd9ba02453bbb5ee8babe1745e645f091231b986e952afdac972f342c6f184777d05d988d6edc71df0100000013a38300cabf2b554380ad215c789bef4cc574109b8df8d9a9db669557b3809d8c396d2c0361629d1822f722ec23812770d72cd00100000078a75dea785be550dbb420287e0789b8c7044f563a1f68d4efe895fdbc463f747c08f4010586903500000000000000e800000000000000000000000000000000000000003ddf4aa4b1c8b8a0ae6fb5425f1d581961471cdb51f8940290e99ccff4123f955267fe4a75c11448741f064fc7ce7e62ee4df874e086287547d4099aeec9f1538ee25a2a5ccf4a9b604e88e12ff25184d4e3c6f7f623559435b2c505fb711300000000040000000000000000000000000000e67ccc02148a4fc43021cce9f24f4b2f9492c32e7a92a557ac2b44b84e88bbf7a49789906d923e4916f390ab7edcd3f5b9fe14446dd446a52131c464f2c08efb46d934615c8631b7c42efd029406000000433f5c899119ec0c0acef5385c5a2720caeb68f1e9c05b0591d89467ded84da092dea262e51811e2d7fa515722516bd5ef6c8c4966e5937562a5648a696ad3a042a7097ddefe0671a5767014b09ddbf69b78f977fb145890f5bf41ba92b8c4c8b14f0d4a880ef4518bb32879d326497e21e041254f06bd7f3a067e147e82e841dba3867da8bfbc101d3960e07d282f483e7b49991be06b950ccd48f4e49833f3c4a02bbd06c84680549f9eb16682ecb722e8ffaca907a3eaaebfc8e0a47c0076d7cc9d32b3cc96aa751d890881c3c33bd91f6ecf45ab3f12f816318346f9b883427b9190024edc1eddd68f34ce3bfedb5fe5d7beae4d3ca561e37570587783f9673e7ab17f5a09efc1114777d2707d2996961203aedff1c52108d9c0d51dc30209872ec602af42eb29d54a37be0fdfdcd74c2d859a566ee5c30677173a2592a4617ae08bec07422d52d2ba7271550a5c20e3a8d1c8c8fd3025ff00607b2249ae9a18391e01b21b36169790b8e96f7955754b6b01a75165d3573d1dec5cf1b08b6115b43203a5654cce2277eb4c02ef4817b4cb989ac178895810eff7b697f2dc9b308aa2460e3cb85cdc4833571a62bf310700000000000000cc7f923284230ada8c756096a66119d4b6b2f159585c3cf8e7bfdd619e294b1d21cd491b8cfd4a253856e485fe29c6ad177a9fb078ca905782b9ed3c30675b89a784bb8031cac0de95178a5acff029a0f0fe972df22b20afe95fba722056f94ab15f1cf605c33df627311f1b614684d77549"], &(0x7f0000000140)='GPL\x00'}, 0x48) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000001f80)=r0, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={0x0, 0x0, 0x1f, 0x0, 0x1, 0x2000, 0x10000}, 0x28) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100000}, 0x48) 1.56853837s ago: executing program 2 (id=6904): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f00000002c0)=0x1, 0xfffffffffffffe6e) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r1, 0x852ac000) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080), 0x10) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x5, 0xfffffffb}, 0x10) write(r3, &(0x7f0000000000)="110000001a005f0214f9f4070009010000", 0x11) getsockopt$netrom_NETROM_T1(r3, 0x103, 0x1, &(0x7f00000001c0), &(0x7f0000000280)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xfa, &(0x7f0000000f40)=""/250, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="020300090c000000ff0e0000000000000200090040000000700000000000000003000600000000000200000000000000000000000000000002000100000004d300000502000000e0030005003c00000002"], 0x60}, 0x1, 0x7}, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000440)}], 0x1, &(0x7f0000000100)=ANY=[@ANYBLOB="2000000000000000840000000200000006000400", @ANYRESHEX], 0x20, 0x6044}, 0x6) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r5, 0x84, 0x7, &(0x7f0000000140)={0x5b}, 0x4) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r6, 0x1, 0x8, &(0x7f0000000240), 0x4) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000001000010029bd7000fcdbdf2500010000", @ANYRES32=0x0, @ANYBLOB="1a8904000a00000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x6000000) socket(0x400000000010, 0x3, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x28, 0x7, 0x0, 0xa56e}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c00000010008506000000000000000000", @ANYRES32=r10, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x4c010) 1.191555014s ago: executing program 4 (id=6906): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce2200"/31], 0xfdef) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x62) listen(r0, 0x3) close(0x4) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0xd50, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.028422667s ago: executing program 4 (id=6907): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r0, 0x200000000114, 0x271e, 0x0, &(0x7f0000000000)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000200)={@rand_addr=' \x01\x00', 0x200, 0x0, 0xff, 0x0, 0x0, 0xe42}, 0x20) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001009f"], 0x30}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180203000000ffedde00"/23], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000000}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) 978.450815ms ago: executing program 2 (id=6908): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0100, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'\x00', 0x2}) ioctl$TUNSETDEBUG(r1, 0x400454c9, 0xffffffffffffffff) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @private=0xa010101}]}, &(0x7f0000000180)=0x10) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8001}, 0xc, &(0x7f0000000240)={&(0x7f00000004c0)={0x11c, 0x0, 0x1, 0x201, 0x0, 0x0, {0x7, 0x0, 0x5}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x3371fcdb66080711}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_SYNPROXY={0x34, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x725e}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0x101}, @CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xfffffffa}]}, @CTA_LABELS_MASK={0x1c, 0x17, [0x8, 0xffffff52, 0x93b, 0x7fffffff, 0xd257, 0xffff]}, @CTA_LABELS={0x10, 0x16, 0x1, 0x0, [0x0, 0x401, 0x78bfc95a]}, @CTA_TUPLE_REPLY={0x20, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TUPLE_MASTER={0x58, 0xe, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @private=0xa010100}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @remote}}}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0xfb}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x9}, @CTA_HELP={0x10, 0x5, 0x0, 0x1, {0x9, 0x1, 'syz0\x00'}}]}, 0x11c}, 0x1, 0x0, 0x0, 0x10}, 0x41) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={r4, 0xcf}, 0x8) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000180)={r4, 0x7, 0x1, 0x1}, 0x10) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001214010028bd7000fcdbdf250800", @ANYRES16=r0], 0x30}, 0x1, 0x0, 0x0, 0x4000014}, 0x4000054) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="810700000000000063119a000000000007000000000000009500000000000000f5c2e20d9f299114c2bd8edd26f601b2f3abe5e0df10392114105b013351ba39492c85906b4e94356deaca7ef49fe4a1f6f4d5277f4fdf9cd5d4f3401879863b752b8c2421e944ea3242430d56cb8b1505de0af0861c1d9ac06353ddce65bb9678865211f364f76fd73958a9b398f8597832d58769488be7d4c39a44f7"], &(0x7f0000000040)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x38}, 0x94) 924.856162ms ago: executing program 1 (id=6909): unshare(0x22020600) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) ioctl$PPPIOCGUNIT(r0, 0x80047456, &(0x7f0000000100)) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) 871.462965ms ago: executing program 1 (id=6910): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0xfffffffffffffd6f, &(0x7f0000000240)={&(0x7f0000000340)=@migrate={0xec, 0x21, 0x1, 0x70bd2d, 0x0, {{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x400, 0x0, 0xa, 0x0, 0x20, 0x0, 0x0, 0xffffffffffffffff}, 0xfffffffe}, [@migrate={0x9c, 0x11, [{@in6=@empty, @in6=@remote, @in=@loopback, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x33, 0x0, 0x0, 0x4}, {@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@private, @in6=@private2, @in6=@loopback, 0x6c, 0x0, 0x0, 0xffffffff, 0x0, 0x2}]}]}, 0xec}}, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000000)=0x3, 0x4) 862.427436ms ago: executing program 4 (id=6911): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021740000000c0a01030000000000000000070000090900020073797a31000000000900010073797a30000000004800038044000080080003400000000238000b80340001800a0001006c696d6974000000240002800c00024000000000000000050c000140fffffffffffffffc0800", @ANYRES16=r0, @ANYRESDEC=r0], 0xf8}, 0x1, 0x0, 0x0, 0xc0c5}, 0x4000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="02170502da00"}) r2 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f00000001c0), 0x12) r6 = openat$cgroup_freezer_state(r4, &(0x7f0000000080), 0x2, 0x0) write$cgroup_freezer_state(r6, &(0x7f00000000c0)='THAWED\x00', 0x7) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xc}, 0x1c) r7 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r7, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991e00000010000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) unshare(0x20000400) r8 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r8, 0x65, 0x1, 0x0, 0x0) close(r8) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_MPATH(r9, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012a007000fddbdf25150000000a000600f1561100000000000a1a000802150000000000"], 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x40040) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000380)={'caif0\x00', &(0x7f0000000280)=@ethtool_drvinfo={0x3, "d590dda343e0917e7325ade3f760d57157ca0c957be0bdddf210bf42e36ef914", "5adc1eed7c4763e5a128760a65eef3c6bad30dcf1a5189e02307a16cc019555b", "dc4960a45c7518ff2e216992efd4037dcea69e36a984872c175dac4a589b2eaf", "53ab0de5f557cc7c2d8da001146465e5fbb9c11521cc0f550adfb11a3d5b2c85", "3152c8ab4f9cc12f8e19f2661cdf95b5b02ad3bc86d6414a52130995fff619de", "608773801ad92cd21375208a", 0x8001, 0x3ae, 0x9b6, 0x1e23, 0x9}}) 823.088604ms ago: executing program 0 (id=6912): socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES16=r0], 0x10}}, 0x4000000) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(0xffffffffffffffff, 0x100086, 0x81, &(0x7f00000003c0)="1a005e9700c93353c00bfeffffff000e00", 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r1, &(0x7f0000000540), 0x0, 0x2000c815, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000240)=ANY=[], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000300), 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000400000002000000000000070000000000000000000000020100000000002e"], 0x0, 0x34}, 0x20) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r5 = socket(0x10, 0x3, 0x9) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x17, &(0x7f0000000340)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x13, 0x200000000000003a, &(0x7f0000000280)=ANY=[@ANYRESDEC=r3, @ANYRES8=r4, @ANYBLOB="00000000000000105b080009feffffff18000000000000000000000000010000960a0200000000009500000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x58}, 0x94) r8 = socket$can_bcm(0x1d, 0x2, 0x2) syz_genetlink_get_family_id$smc(&(0x7f0000000240), r8) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYRESDEC=r5, @ANYRES32=r7], 0x14}, 0x1, 0x0, 0x0, 0x54}, 0x0) sendmsg$ETHTOOL_MSG_EEE_GET(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000880)=ANY=[@ANYRESHEX, @ANYRES16=0x0, @ANYBLOB="cb6202ff6e09349a355aa58201800800010000000000", @ANYRES8, @ANYBLOB="1400020067656e657665300000000000000000001400020067656e65766531000000000000000000140002006272696467655f736c6176655f310000", @ANYBLOB="a0f32051e83e66176029bea5851717ad48848db754af0a8a1f3cb67cc407ae1727dff7d4647300a330f741bead6cfacc2f33f157595987e1bfea925b5b7868edb70bfe8c94b0ec96dfd5151e0bb874eba4533a62af8de825289e57c08a0fe1f366f593fade57de49c6189ae9eee56b9e584c20562c4dadda74d8567d6a08cf6ac6a29a3c892f"], 0x8c}, 0x1, 0x0, 0x0, 0x4080}, 0x844) connect$netlink(r5, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) r9 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCINQ(r9, 0x541b, &(0x7f0000000180)) syz_genetlink_get_family_id$tipc(0x0, r5) sendmsg$BATADV_CMD_SET_VLAN(r5, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000980)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="00032cbd7000ffdbdf251200000008002b001d0000000500380003000000c2c985a629ec4d8037a2f4d3aa0cd11b8c16f884ea54ad79edc1de1f617c624cbcf3c7b22c7134dc11b8b38f9ccb7f5b7f780ac88c703b23db56540faec6d7fa748fee3a6f4fa658914bbfe01859c6e0b80805c62f1b4a7d7bd2785caf2b36061f0704e23fa571f2f812f50b17b22d34f49332a86b49ca4c3722afea117110555bffe390a566791538abb398492b8a39a085b2a7664f424733248c3534e8763e74f5393de4e43982315e65bcc94ae1e03cc5a7b1f4c4d4ef61240df167df8259ef406f03d04269b949"], 0x24}, 0x1, 0x0, 0x0, 0x890}, 0x40) 705.893018ms ago: executing program 1 (id=6913): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000004140)=[{&(0x7f0000000240)=""/210, 0xd2}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c030000160001000000000000000000fc010000000000000000000000000000fe88000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141400000000000000000000000000000000006c000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000300000006"], 0x34c}}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{}, 0x0, 0x0}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) ioctl$int_in(r3, 0x5421, &(0x7f0000000000)=0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$llc(r5, &(0x7f00000003c0)="48fb0c69598bcdec7a8236b1634403146abe4f75c62a9e1c2d5c7e562a9e1a07000000000000ebb965e29610099688c5cedff891bc21f857410927ac9848793b804edc07f2f97af56f9612eaec8e47e65a71cfd13fcf1c3538c743e988e451f4be2da6ee396c31f8d3811e", 0x6b, 0x10040044, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), r8) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r6, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r7}, 0x20) socket$kcm(0x10, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r9, &(0x7f0000000380)="0099", &(0x7f0000000480)=@tcp6=r5, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r7, 0x5, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000040)="2e00000011008188040f80ec59acbc0413a1f8480b0000005e140602000000000e0027001000000002800000121f", 0x2e}], 0x1}, 0x0) 705.325059ms ago: executing program 0 (id=6914): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000600000004000000000000120200000000000000000000010500000180000000000000000100008502000000000000000100000000000004"], 0x0, 0x52}, 0x28) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1, 0x100001, 0x9, 0x5, 0x41}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340), &(0x7f0000000240), 0x20000402, r0}, 0x38) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r0, &(0x7f0000000340), &(0x7f0000000000)=""/27}, 0x20) syz_emit_ethernet(0x2a, &(0x7f0000000200)={@local, @multicast, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x2, 0x1c, 0x65, 0x0, 0x6, 0x2, 0x0, @private=0xa010102, @local}, {0x12, 0xfc, 0x0, @rand_addr=0x64010102}}}}}, 0x0) 432.837497ms ago: executing program 1 (id=6915): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x700, 0x1, 0xfffffffc, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x63, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @broadcast, @multicast2, {[@timestamp={0x44, 0x4, 0x4e, 0x0, 0x4}]}}}}}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xe}}, 0x57) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x20702, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) read(r4, &(0x7f0000000300)=""/80, 0x50) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r5) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_NOACK_MAP(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="01002dbd7000ffdbdf255700000008000300", @ANYRES32=r7, @ANYBLOB="122e869e4f775046218baed421d105a5963baac9594d9223ed"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x40) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000200)=0x33d7, 0x4) sendto$inet(r1, &(0x7f0000000180)='<./', 0x3, 0x4000805, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@getqdisc={0x28, 0x26, 0x10, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0x8}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000001}, 0x20044081) r9 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ec0)=@newqdisc={0x68, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r11, {0x0, 0x8}, {0xffff, 0xffff}}, [@TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x4, 0x7, 0x4, 0x2, 0x2cf, 0x8d2, 0x1}}, {0x6, 0x2, [0xffff]}}]}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x401}}]}, 0x68}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008098) socketpair(0x28, 0x2, 0x28, &(0x7f0000001400)) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) 308.274821ms ago: executing program 0 (id=6916): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket$kcm(0x29, 0x2, 0x0) close(r2) r3 = socket$kcm(0x2b, 0x1, 0x0) close(r3) socket$kcm(0xa, 0x2, 0x88) setsockopt$sock_attach_bpf(r2, 0x1, 0xd, &(0x7f0000000080), 0x2cb) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r4, 0x29, 0xb, 0x0, &(0x7f0000002a00)) close(r3) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYRESDEC=r2], 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000010400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="3f000040000000280012800b00010062726964676500001800028005002a00000000000c0023000001000000000000ffaf482ac31db8fe1e2befe8acfd134bbb8d29a0811187194f6c2a36cd39063abef70ba91cd5001c57e854f634d32f8d5bf1f73c82fec9b17fce4ba9dc32241f14c715496f40b81174a2b99f5436f7aa52672f48be5a205c844197b29db87186c5e97674d757ba678ee79d124b40948d26e95b4281ba8fbe"], 0x48}}, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r9, 0x0, 0xf3a, 0x0) close(r8) write(r6, 0x0, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_all\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) r11 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r11, 0x0, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x120, 0xffffffff, 0x1d0, 0xffffffff, 0xffffffff, 0x1d0, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private=0xa010102, 0x0, 0xffffffff, 'ip6_vti0\x00', 'caif0\x00', {}, {}, 0x2, 0x1, 0x4}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x8, 0x4000, 0x6, 0x2, 'pptp\x00', 'syz1\x00', {0x7fff}}}}, {{@ip={@multicast1, @broadcast, 0xffffffff, 0xffffffff, 'caif0\x00', 'veth0_virt_wifi\x00', {0xff}, {0xff}, 0x32, 0x1, 0x36}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "fb51f0f52069d37c378114554bc1e3e5a78752f61e0d49d5eddd143e2044"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000c71000/0x1000)=nil, 0x1000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r12 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_INITSTATE(r12, 0x113, 0x4, &(0x7f0000000000), &(0x7f0000000040)=0x4) 122.684435ms ago: executing program 1 (id=6917): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce2200"/31], 0xfdef) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x27}, 0x62) listen(r0, 0x3) close(0x4) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0xd50, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 0s ago: executing program 1 (id=6918): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r0, 0x200000000114, 0x271e, 0x0, &(0x7f0000000000)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000200)={@rand_addr=' \x01\x00', 0x200, 0x0, 0xff, 0x0, 0x0, 0xe42}, 0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001009f"], 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) kernel console output (not intermixed with test programs): 6 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 686.236703][T27156] RSP: 002b:00007fb1d5def028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 686.236725][T27156] RAX: ffffffffffffffda RBX: 00007fb1d5216090 RCX: 00007fb1d4f9aeb9 [ 686.236739][T27156] RDX: 0000000000000802 RSI: 00002000000003c0 RDI: 000000000000000c [ 686.236752][T27156] RBP: 00007fb1d5def090 R08: 0000000000000000 R09: 0000000000000000 [ 686.236765][T27156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 686.236776][T27156] R13: 00007fb1d5216128 R14: 00007fb1d5216090 R15: 00007ffcfb4049f8 [ 686.236808][T27156] [ 686.689005][T27170] tipc: Enabling of bearer rejected, failed to enable media [ 686.887166][T27182] can: request_module (can-proto-0) failed. [ 687.026108][T27196] __nla_validate_parse: 16 callbacks suppressed [ 687.026126][T27196] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6210'. [ 687.062156][T27185] syzkaller0: entered promiscuous mode [ 687.067845][T27185] syzkaller0: entered allmulticast mode [ 687.171650][T27200] netlink: 'syz.0.6212': attribute type 2 has an invalid length. [ 687.190710][T27200] netlink: 119 bytes leftover after parsing attributes in process `syz.0.6212'. [ 687.342122][T27205] nbd: must specify an index to disconnect [ 687.409950][T27208] netlink: 212304 bytes leftover after parsing attributes in process `syz.2.6215'. [ 687.431186][T27208] openvswitch: netlink: Message has 6 unknown bytes. [ 687.536236][T27209] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6210'. [ 687.729509][T27217] delete_channel: no stack [ 687.792290][T27220] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6219'. [ 687.998092][T27224] FAULT_INJECTION: forcing a failure. [ 687.998092][T27224] name failslab, interval 1, probability 0, space 0, times 0 [ 688.011377][T27224] CPU: 1 UID: 0 PID: 27224 Comm: syz.1.6220 Not tainted syzkaller #0 PREEMPT(full) [ 688.011395][T27224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 688.011402][T27224] Call Trace: [ 688.011407][T27224] [ 688.011412][T27224] dump_stack_lvl+0xe8/0x150 [ 688.011432][T27224] should_fail_ex+0x412/0x560 [ 688.011448][T27224] should_failslab+0xa8/0x100 [ 688.011461][T27224] kmem_cache_alloc_noprof+0x87/0x6e0 [ 688.011477][T27224] ? __netlink_lookup+0xc6/0x8b0 [ 688.011490][T27224] ? skb_clone+0x212/0x3a0 [ 688.011507][T27224] skb_clone+0x212/0x3a0 [ 688.011523][T27224] __netlink_deliver_tap+0x404/0x850 [ 688.011540][T27224] ? netlink_deliver_tap+0x2e/0x1b0 [ 688.011552][T27224] netlink_deliver_tap+0x19c/0x1b0 [ 688.011565][T27224] netlink_unicast+0x7e3/0x9b0 [ 688.011581][T27224] ? __pfx_netlink_unicast+0x10/0x10 [ 688.011592][T27224] ? netlink_sendmsg+0x650/0xb40 [ 688.011606][T27224] netlink_sendmsg+0x813/0xb40 [ 688.011622][T27224] ? __pfx_netlink_sendmsg+0x10/0x10 [ 688.011635][T27224] ? aa_sock_msg_perm+0xf1/0x1b0 [ 688.011649][T27224] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 688.011662][T27224] ? __pfx_netlink_sendmsg+0x10/0x10 [ 688.011673][T27224] ____sys_sendmsg+0xa68/0xad0 [ 688.011692][T27224] ? __pfx_____sys_sendmsg+0x10/0x10 [ 688.011717][T27224] ? import_iovec+0x73/0xa0 [ 688.011735][T27224] ___sys_sendmsg+0x2a5/0x360 [ 688.011748][T27224] ? __lock_acquire+0x6b5/0x2cf0 [ 688.011765][T27224] ? __pfx____sys_sendmsg+0x10/0x10 [ 688.011797][T27224] ? __fget_files+0x2a/0x420 [ 688.011808][T27224] ? __fget_files+0x3a0/0x420 [ 688.011824][T27224] __x64_sys_sendmsg+0x1bd/0x2a0 [ 688.011840][T27224] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 688.011858][T27224] ? __pfx_ksys_write+0x10/0x10 [ 688.011879][T27224] do_syscall_64+0xe2/0xf80 [ 688.011893][T27224] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.011902][T27224] ? trace_irq_disable+0x37/0x100 [ 688.011913][T27224] ? clear_bhb_loop+0x60/0xb0 [ 688.011925][T27224] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.011935][T27224] RIP: 0033:0x7ffa5879aeb9 [ 688.011946][T27224] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 688.011955][T27224] RSP: 002b:00007ffa5969c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 688.011970][T27224] RAX: ffffffffffffffda RBX: 00007ffa58a15fa0 RCX: 00007ffa5879aeb9 [ 688.011982][T27224] RDX: 0000000000004000 RSI: 0000200000003dc0 RDI: 0000000000000003 [ 688.011993][T27224] RBP: 00007ffa5969c090 R08: 0000000000000000 R09: 0000000000000000 [ 688.012004][T27224] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 688.012015][T27224] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 688.012043][T27224] [ 689.661486][T27220] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 689.700368][T27220] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 689.733201][T27226] tunl0: Caught tx_queue_len zero misconfig [ 689.743068][T27220] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 689.833034][T27229] bridge0: entered promiscuous mode [ 689.838880][T27229] vlan2: entered promiscuous mode [ 689.936123][T27236] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.6224'. [ 690.033828][T27238] wg1 speed is unknown, defaulting to 1000 [ 690.101154][T27238] xfrm0 speed is unknown, defaulting to 1000 [ 690.214511][T27257] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6230'. [ 690.257618][T27261] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6232'. [ 690.284520][T27261] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6232'. [ 690.306748][T27262] netlink: 'syz.4.6232': attribute type 1 has an invalid length. [ 690.320516][T27262] netlink: 244 bytes leftover after parsing attributes in process `syz.4.6232'. [ 690.343008][T27267] FAULT_INJECTION: forcing a failure. [ 690.343008][T27267] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 690.380605][T27267] CPU: 1 UID: 0 PID: 27267 Comm: syz.0.6233 Not tainted syzkaller #0 PREEMPT(full) [ 690.380632][T27267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 690.380644][T27267] Call Trace: [ 690.380652][T27267] [ 690.380661][T27267] dump_stack_lvl+0xe8/0x150 [ 690.380694][T27267] should_fail_ex+0x412/0x560 [ 690.380722][T27267] _copy_to_user+0x31/0xb0 [ 690.380751][T27267] simple_read_from_buffer+0xe1/0x170 [ 690.380776][T27267] proc_fail_nth_read+0x1bb/0x230 [ 690.380807][T27267] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.380835][T27267] ? rw_verify_area+0x2a6/0x4d0 [ 690.380861][T27267] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.380888][T27267] vfs_read+0x20c/0xa70 [ 690.380912][T27267] ? fdget_pos+0x246/0x320 [ 690.380937][T27267] ? __pfx___mutex_lock+0x10/0x10 [ 690.380961][T27267] ? __pfx_vfs_read+0x10/0x10 [ 690.380988][T27267] ? __fget_files+0x2a/0x420 [ 690.381012][T27267] ? __fget_files+0x3a0/0x420 [ 690.381031][T27267] ? __fget_files+0x2a/0x420 [ 690.381060][T27267] ksys_read+0x150/0x270 [ 690.381087][T27267] ? __pfx_ksys_read+0x10/0x10 [ 690.381111][T27267] ? __pfx_sock_ioctl+0x10/0x10 [ 690.381147][T27267] do_syscall_64+0xe2/0xf80 [ 690.381168][T27267] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.381187][T27267] ? trace_irq_disable+0x37/0x100 [ 690.381205][T27267] ? clear_bhb_loop+0x60/0xb0 [ 690.381227][T27267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.381244][T27267] RIP: 0033:0x7fb1d4f5b78e [ 690.381261][T27267] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 690.381276][T27267] RSP: 002b:00007fb1d5e0ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 690.381295][T27267] RAX: ffffffffffffffda RBX: 00007fb1d5e106c0 RCX: 00007fb1d4f5b78e [ 690.381308][T27267] RDX: 000000000000000f RSI: 00007fb1d5e100a0 RDI: 0000000000000003 [ 690.381320][T27267] RBP: 00007fb1d5e10090 R08: 0000000000000000 R09: 0000000000000000 [ 690.381332][T27267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 690.381343][T27267] R13: 00007fb1d5216038 R14: 00007fb1d5215fa0 R15: 00007ffcfb4049f8 [ 690.381382][T27267] [ 690.685616][T27238] lo speed is unknown, defaulting to 1000 [ 690.838204][T27271] tipc: Enabled bearer , priority 0 [ 690.891863][T27271] syzkaller0: entered promiscuous mode [ 690.907724][T27271] syzkaller0: entered allmulticast mode [ 691.053429][T27271] tipc: Resetting bearer [ 691.079352][T27270] tipc: Resetting bearer [ 691.185236][T27270] tipc: Disabling bearer [ 691.517129][T27292] netlink: 'syz.1.6240': attribute type 18 has an invalid length. [ 691.636055][T27294] netlink: 'syz.0.6241': attribute type 1 has an invalid length. [ 692.310401][T27305] bridge_slave_0: left allmulticast mode [ 692.316190][T27305] bridge_slave_0: left promiscuous mode [ 692.324325][T27305] bridge0: port 1(bridge_slave_0) entered disabled state [ 692.340165][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6130 ms [ 692.348366][ C1] lec:lec_tx_timeout: lec0 [ 692.354474][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 692.371130][T27305] bridge_slave_1: left allmulticast mode [ 692.378689][T27305] bridge_slave_1: left promiscuous mode [ 692.386088][T27305] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.432815][T27305] bond0: (slave bond_slave_0): Releasing backup interface [ 692.462343][T27305] bond0: (slave bond_slave_1): Releasing backup interface [ 692.491864][T27305] team0: Port device team_slave_0 removed [ 692.519365][T27305] team0: Port device team_slave_1 removed [ 692.537278][T27305] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 692.546122][T27314] __nla_validate_parse: 3 callbacks suppressed [ 692.546142][T27314] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6248'. [ 692.562166][T27305] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 692.571797][T27305] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 692.579794][T27305] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 692.588692][T27305] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 692.641126][T27318] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6248'. [ 692.642845][T27314] 8021q: adding VLAN 0 to HW filter on device bond1 [ 692.860713][T27330] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6250'. [ 692.944334][T27332] mac80211_hwsim hwsim45 wlan1: entered allmulticast mode [ 692.985337][T27338] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6255'. [ 692.990430][T27332] netlink: 'syz.4.6251': attribute type 10 has an invalid length. [ 693.119133][T27332] mac80211_hwsim hwsim45 wlan1: left allmulticast mode [ 693.130746][T27339] FAULT_INJECTION: forcing a failure. [ 693.130746][T27339] name failslab, interval 1, probability 0, space 0, times 0 [ 693.156515][T27339] CPU: 0 UID: 0 PID: 27339 Comm: syz.4.6251 Not tainted syzkaller #0 PREEMPT(full) [ 693.156545][T27339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 693.156557][T27339] Call Trace: [ 693.156564][T27339] [ 693.156574][T27339] dump_stack_lvl+0xe8/0x150 [ 693.156601][T27339] should_fail_ex+0x412/0x560 [ 693.156628][T27339] should_failslab+0xa8/0x100 [ 693.156648][T27339] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 693.156676][T27339] ? __alloc_skb+0x1d0/0x7d0 [ 693.156695][T27339] ? __local_bh_enable_ip+0xd0/0x130 [ 693.156717][T27339] __alloc_skb+0x1d0/0x7d0 [ 693.156737][T27339] ? cfg80211_iftype_allowed+0x159/0x300 [ 693.156767][T27339] ? nl80211_new_interface+0x4e5/0x1150 [ 693.156795][T27339] nl80211_new_interface+0x6ba/0x1150 [ 693.156827][T27339] ? __pfx_nl80211_new_interface+0x10/0x10 [ 693.156856][T27339] ? nl80211_pre_doit+0x4fb/0x930 [ 693.156886][T27339] genl_family_rcv_msg_doit+0x22a/0x330 [ 693.156920][T27339] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 693.157014][T27339] ? bpf_lsm_capable+0x9/0x20 [ 693.157037][T27339] ? security_capable+0x7e/0x2c0 [ 693.157066][T27339] genl_rcv_msg+0x61c/0x7a0 [ 693.157098][T27339] ? __pfx_genl_rcv_msg+0x10/0x10 [ 693.157122][T27339] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 693.157145][T27339] ? __pfx_nl80211_new_interface+0x10/0x10 [ 693.157171][T27339] ? __pfx_nl80211_post_doit+0x10/0x10 [ 693.157199][T27339] ? __pfx_ref_tracker_free+0x10/0x10 [ 693.157231][T27339] netlink_rcv_skb+0x232/0x4b0 [ 693.157254][T27339] ? __pfx_genl_rcv_msg+0x10/0x10 [ 693.157281][T27339] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 693.157299][T27339] ? genl_rcv+0x19/0x40 [ 693.157341][T27339] ? down_read+0x272/0x2e0 [ 693.157362][T27339] ? genl_rcv+0xd/0x40 [ 693.157393][T27339] genl_rcv+0x28/0x40 [ 693.157416][T27339] netlink_unicast+0x80f/0x9b0 [ 693.157449][T27339] ? __pfx_netlink_unicast+0x10/0x10 [ 693.157470][T27339] ? netlink_sendmsg+0x650/0xb40 [ 693.157493][T27339] ? skb_put+0x11b/0x210 [ 693.157520][T27339] netlink_sendmsg+0x813/0xb40 [ 693.157554][T27339] ? __pfx_netlink_sendmsg+0x10/0x10 [ 693.157580][T27339] ? aa_sock_msg_perm+0xf1/0x1b0 [ 693.157605][T27339] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 693.157627][T27339] ? __pfx_netlink_sendmsg+0x10/0x10 [ 693.157647][T27339] ____sys_sendmsg+0xa68/0xad0 [ 693.157675][T27339] ? __might_fault+0xaf/0x130 [ 693.157709][T27339] ? __pfx_____sys_sendmsg+0x10/0x10 [ 693.157751][T27339] ? import_iovec+0x73/0xa0 [ 693.157785][T27339] ___sys_sendmsg+0x2a5/0x360 [ 693.157811][T27339] ? __lock_acquire+0x6b5/0x2cf0 [ 693.157841][T27339] ? __pfx____sys_sendmsg+0x10/0x10 [ 693.157922][T27339] ? __fget_files+0x2a/0x420 [ 693.157953][T27339] ? __fget_files+0x3a0/0x420 [ 693.157990][T27339] __x64_sys_sendmsg+0x1bd/0x2a0 [ 693.158018][T27339] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 693.158058][T27339] ? __pfx_ksys_write+0x10/0x10 [ 693.158104][T27339] do_syscall_64+0xe2/0xf80 [ 693.158131][T27339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.158149][T27339] ? trace_irq_disable+0x37/0x100 [ 693.158170][T27339] ? clear_bhb_loop+0x60/0xb0 [ 693.158191][T27339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 693.158208][T27339] RIP: 0033:0x7f19c759aeb9 [ 693.158229][T27339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 693.158250][T27339] RSP: 002b:00007f19c843c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 693.158275][T27339] RAX: ffffffffffffffda RBX: 00007f19c7816090 RCX: 00007f19c759aeb9 [ 693.158290][T27339] RDX: 0000000024044884 RSI: 0000200000000300 RDI: 0000000000000005 [ 693.158306][T27339] RBP: 00007f19c843c090 R08: 0000000000000000 R09: 0000000000000000 [ 693.158319][T27339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 693.158332][T27339] R13: 00007f19c7816128 R14: 00007f19c7816090 R15: 00007ffed0ef82c8 [ 693.158365][T27339] [ 693.584791][T27345] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6250'. [ 693.651964][T27342] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6256'. [ 693.755489][T27350] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6257'. [ 693.770624][T27350] bridge_slave_1: left allmulticast mode [ 693.776337][T27350] bridge_slave_1: left promiscuous mode [ 693.810494][T27350] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.907189][T27350] bridge_slave_0: left allmulticast mode [ 693.922561][T27350] bridge_slave_0: left promiscuous mode [ 693.970535][T27350] bridge0: port 1(bridge_slave_0) entered disabled state [ 694.225351][T27366] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6262'. [ 694.282216][T27355] wg1 speed is unknown, defaulting to 1000 [ 694.410693][T27355] xfrm0 speed is unknown, defaulting to 1000 [ 694.941647][T27355] lo speed is unknown, defaulting to 1000 [ 694.976655][T27387] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6265'. [ 694.990892][T27387] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6265'. [ 695.024861][ T3725] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.050430][ T3725] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.065339][ T3725] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 695.100270][ T3725] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 696.005807][T27419] FAULT_INJECTION: forcing a failure. [ 696.005807][T27419] name failslab, interval 1, probability 0, space 0, times 0 [ 696.055344][T27419] CPU: 1 UID: 0 PID: 27419 Comm: syz.3.6280 Not tainted syzkaller #0 PREEMPT(full) [ 696.055372][T27419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 696.055384][T27419] Call Trace: [ 696.055392][T27419] [ 696.055400][T27419] dump_stack_lvl+0xe8/0x150 [ 696.055431][T27419] should_fail_ex+0x412/0x560 [ 696.055456][T27419] should_failslab+0xa8/0x100 [ 696.055479][T27419] __kmalloc_cache_noprof+0x83/0x6e0 [ 696.055499][T27419] ? nfnetlink_rcv+0xfe1/0x27b0 [ 696.055522][T27419] nfnetlink_rcv+0xfe1/0x27b0 [ 696.055572][T27419] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 696.055606][T27419] ? ref_tracker_free+0x693/0x840 [ 696.055656][T27419] ? __netlink_deliver_tap+0x807/0x850 [ 696.055677][T27419] ? netlink_deliver_tap+0x2e/0x1b0 [ 696.055715][T27419] netlink_unicast+0x80f/0x9b0 [ 696.055742][T27419] ? __pfx_netlink_unicast+0x10/0x10 [ 696.055761][T27419] ? netlink_sendmsg+0x650/0xb40 [ 696.055780][T27419] ? skb_put+0x11b/0x210 [ 696.055806][T27419] netlink_sendmsg+0x813/0xb40 [ 696.055837][T27419] ? __pfx_netlink_sendmsg+0x10/0x10 [ 696.055861][T27419] ? aa_sock_msg_perm+0xf1/0x1b0 [ 696.055890][T27419] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 696.055913][T27419] ? __pfx_netlink_sendmsg+0x10/0x10 [ 696.055933][T27419] ____sys_sendmsg+0xa68/0xad0 [ 696.055957][T27419] ? __might_fault+0xaf/0x130 [ 696.055994][T27419] ? __pfx_____sys_sendmsg+0x10/0x10 [ 696.056034][T27419] ? import_iovec+0x73/0xa0 [ 696.056065][T27419] ___sys_sendmsg+0x2a5/0x360 [ 696.056088][T27419] ? __lock_acquire+0x6b5/0x2cf0 [ 696.056117][T27419] ? __pfx____sys_sendmsg+0x10/0x10 [ 696.056176][T27419] ? __fget_files+0x2a/0x420 [ 696.056195][T27419] ? __fget_files+0x3a0/0x420 [ 696.056226][T27419] __x64_sys_sendmsg+0x1bd/0x2a0 [ 696.056252][T27419] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 696.056287][T27419] ? __pfx_ksys_write+0x10/0x10 [ 696.056328][T27419] do_syscall_64+0xe2/0xf80 [ 696.056349][T27419] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 696.056366][T27419] ? trace_irq_disable+0x37/0x100 [ 696.056385][T27419] ? clear_bhb_loop+0x60/0xb0 [ 696.056407][T27419] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 696.056425][T27419] RIP: 0033:0x7f324a19aeb9 [ 696.056442][T27419] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 696.056458][T27419] RSP: 002b:00007f324b06e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 696.056478][T27419] RAX: ffffffffffffffda RBX: 00007f324a415fa0 RCX: 00007f324a19aeb9 [ 696.056492][T27419] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 696.056505][T27419] RBP: 00007f324b06e090 R08: 0000000000000000 R09: 0000000000000000 [ 696.056517][T27419] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 696.056528][T27419] R13: 00007f324a416038 R14: 00007f324a415fa0 R15: 00007fffa34bcb18 [ 696.056561][T27419] [ 696.420019][T27423] netlink: 'syz.1.6281': attribute type 8 has an invalid length. [ 697.184361][T27452] FAULT_INJECTION: forcing a failure. [ 697.184361][T27452] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 697.217194][T27452] CPU: 1 UID: 0 PID: 27452 Comm: syz.1.6289 Not tainted syzkaller #0 PREEMPT(full) [ 697.217221][T27452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 697.217234][T27452] Call Trace: [ 697.217242][T27452] [ 697.217250][T27452] dump_stack_lvl+0xe8/0x150 [ 697.217281][T27452] should_fail_ex+0x412/0x560 [ 697.217309][T27452] _copy_to_user+0x31/0xb0 [ 697.217339][T27452] simple_read_from_buffer+0xe1/0x170 [ 697.217364][T27452] proc_fail_nth_read+0x1bb/0x230 [ 697.217393][T27452] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 697.217422][T27452] ? rw_verify_area+0x2a6/0x4d0 [ 697.217447][T27452] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 697.217474][T27452] vfs_read+0x20c/0xa70 [ 697.217498][T27452] ? fdget_pos+0x246/0x320 [ 697.217523][T27452] ? __pfx___mutex_lock+0x10/0x10 [ 697.217547][T27452] ? __pfx_vfs_read+0x10/0x10 [ 697.217574][T27452] ? __fget_files+0x2a/0x420 [ 697.217616][T27452] ? __fget_files+0x3a0/0x420 [ 697.217642][T27452] ? __fget_files+0x2a/0x420 [ 697.217671][T27452] ksys_read+0x150/0x270 [ 697.217699][T27452] ? __pfx_ksys_read+0x10/0x10 [ 697.217737][T27452] do_syscall_64+0xe2/0xf80 [ 697.217758][T27452] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.217777][T27452] ? trace_irq_disable+0x37/0x100 [ 697.217795][T27452] ? clear_bhb_loop+0x60/0xb0 [ 697.217817][T27452] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.217836][T27452] RIP: 0033:0x7ffa5875b78e [ 697.217853][T27452] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 697.217870][T27452] RSP: 002b:00007ffa5969bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 697.217891][T27452] RAX: ffffffffffffffda RBX: 00007ffa5969c6c0 RCX: 00007ffa5875b78e [ 697.217906][T27452] RDX: 000000000000000f RSI: 00007ffa5969c0a0 RDI: 0000000000000004 [ 697.217918][T27452] RBP: 00007ffa5969c090 R08: 0000000000000000 R09: 0000000000000000 [ 697.217931][T27452] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 697.217942][T27452] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 697.217974][T27452] [ 697.631331][T27467] IPv6: NLM_F_CREATE should be specified when creating new route [ 697.634558][T27471] IPVS: Error connecting to the multicast addr [ 697.639304][T27467] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 697.652936][T27467] IPv6: NLM_F_CREATE should be set when creating new route [ 697.660981][T27467] FAULT_INJECTION: forcing a failure. [ 697.660981][T27467] name failslab, interval 1, probability 0, space 0, times 0 [ 697.673972][T27467] CPU: 1 UID: 0 PID: 27467 Comm: syz.1.6295 Not tainted syzkaller #0 PREEMPT(full) [ 697.673998][T27467] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 697.674010][T27467] Call Trace: [ 697.674018][T27467] [ 697.674025][T27467] dump_stack_lvl+0xe8/0x150 [ 697.674054][T27467] should_fail_ex+0x412/0x560 [ 697.674079][T27467] should_failslab+0xa8/0x100 [ 697.674101][T27467] __kmalloc_cache_noprof+0x83/0x6e0 [ 697.674118][T27467] ? nsim_fib_event_nb+0x190/0x1210 [ 697.674141][T27467] nsim_fib_event_nb+0x190/0x1210 [ 697.674159][T27467] ? atomic_notifier_call_chain+0x26/0x180 [ 697.674184][T27467] notifier_call_chain+0x19d/0x3a0 [ 697.674205][T27467] ? atomic_notifier_call_chain+0x26/0x180 [ 697.674225][T27467] atomic_notifier_call_chain+0xda/0x180 [ 697.674246][T27467] call_fib_notifiers+0x31/0x60 [ 697.674269][T27467] call_fib6_multipath_entry_notifiers+0xf5/0x160 [ 697.674292][T27467] ? inet6_rtm_newroute+0xfb8/0x19e0 [ 697.674312][T27467] ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10 [ 697.674339][T27467] ? inet6_rtm_newroute+0xfb8/0x19e0 [ 697.674358][T27467] ? inet6_rtm_newroute+0xfb8/0x19e0 [ 697.674375][T27467] inet6_rtm_newroute+0x14a2/0x19e0 [ 697.674399][T27467] ? kasan_quarantine_put+0xbb/0x1f0 [ 697.674424][T27467] ? lockdep_hardirqs_on+0x7a/0x110 [ 697.674449][T27467] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 697.674469][T27467] ? kmem_cache_free+0x195/0x610 [ 697.674487][T27467] ? nlmon_xmit+0xb0/0x100 [ 697.674532][T27467] ? lockdep_hardirqs_on+0x7a/0x110 [ 697.674570][T27467] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 697.674587][T27467] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 697.674619][T27467] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 697.674638][T27467] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 697.674657][T27467] ? ref_tracker_free+0x693/0x840 [ 697.674679][T27467] ? __copy_skb_header+0xa3/0x4a0 [ 697.674705][T27467] ? __pfx_ref_tracker_free+0x10/0x10 [ 697.674738][T27467] netlink_rcv_skb+0x232/0x4b0 [ 697.674760][T27467] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 697.674782][T27467] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 697.674814][T27467] ? netlink_deliver_tap+0x2e/0x1b0 [ 697.674842][T27467] netlink_unicast+0x80f/0x9b0 [ 697.674868][T27467] ? __pfx_netlink_unicast+0x10/0x10 [ 697.674888][T27467] ? netlink_sendmsg+0x650/0xb40 [ 697.674907][T27467] ? skb_put+0x11b/0x210 [ 697.674931][T27467] netlink_sendmsg+0x813/0xb40 [ 697.674960][T27467] ? __pfx_netlink_sendmsg+0x10/0x10 [ 697.674984][T27467] ? aa_sock_msg_perm+0xf1/0x1b0 [ 697.675006][T27467] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 697.675025][T27467] ? __pfx_netlink_sendmsg+0x10/0x10 [ 697.675043][T27467] ____sys_sendmsg+0xa68/0xad0 [ 697.675063][T27467] ? __might_fault+0xaf/0x130 [ 697.675095][T27467] ? __pfx_____sys_sendmsg+0x10/0x10 [ 697.675128][T27467] ? import_iovec+0x73/0xa0 [ 697.675157][T27467] ___sys_sendmsg+0x2a5/0x360 [ 697.675179][T27467] ? __lock_acquire+0x6b5/0x2cf0 [ 697.675207][T27467] ? __pfx____sys_sendmsg+0x10/0x10 [ 697.675265][T27467] ? __fget_files+0x2a/0x420 [ 697.675284][T27467] ? __fget_files+0x3a0/0x420 [ 697.675314][T27467] __x64_sys_sendmsg+0x1bd/0x2a0 [ 697.675346][T27467] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 697.675379][T27467] ? __pfx_ksys_write+0x10/0x10 [ 697.675415][T27467] do_syscall_64+0xe2/0xf80 [ 697.675436][T27467] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.675453][T27467] ? trace_irq_disable+0x37/0x100 [ 697.675471][T27467] ? clear_bhb_loop+0x60/0xb0 [ 697.675493][T27467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.675511][T27467] RIP: 0033:0x7ffa5879aeb9 [ 697.675528][T27467] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 697.675544][T27467] RSP: 002b:00007ffa5969c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 697.675565][T27467] RAX: ffffffffffffffda RBX: 00007ffa58a15fa0 RCX: 00007ffa5879aeb9 [ 697.675579][T27467] RDX: 0000000020040844 RSI: 0000200000000340 RDI: 0000000000000003 [ 697.675592][T27467] RBP: 00007ffa5969c090 R08: 0000000000000000 R09: 0000000000000000 [ 697.675612][T27467] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 697.675623][T27467] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 697.675656][T27467] [ 697.679801][T27469] __nla_validate_parse: 10 callbacks suppressed [ 697.679820][T27469] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6296'. [ 698.110205][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 698.132416][ C1] lec:lec_tx_timeout: lec0 [ 698.137384][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 698.191703][T27483] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6301'. [ 698.320606][T27483] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6301'. [ 698.403377][T27490] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.417672][T27494] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6292'. [ 698.450971][T27495] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6305'. [ 698.472846][T27497] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 698.480333][T27497] IPv6: NLM_F_CREATE should be set when creating new route [ 698.610962][T27504] netlink: 216 bytes leftover after parsing attributes in process `syz.4.6308'. [ 698.628446][T27500] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.695290][T27500] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 698.797751][T27500] xt_CT: No such helper "pptp" [ 698.813001][T27499] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 699.130373][T27527] netlink: 'syz.4.6317': attribute type 14 has an invalid length. [ 699.329764][T27540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6323'. [ 699.521403][T27551] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6322'. [ 699.544807][T27544] nbd5: detected capacity change from 0 to 127 [ 699.883556][T27572] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6323'. [ 700.123937][T27580] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6335'. [ 700.513821][T27594] netlink: 'syz.0.6341': attribute type 1 has an invalid length. [ 700.546790][T27594] bond6: (slave gretap2): Enslaving as a backup interface with an up link [ 700.564241][T27594] macvlan2: entered promiscuous mode [ 700.570030][T27594] macvlan2: entered allmulticast mode [ 700.578771][T27594] bond6: entered promiscuous mode [ 700.585005][T27594] gretap2: entered promiscuous mode [ 700.591647][T27594] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 700.600501][T27594] bond6: left promiscuous mode [ 700.605542][T27594] gretap2: left promiscuous mode [ 700.769071][T27602] syzkaller0: entered promiscuous mode [ 700.776168][T27602] syzkaller0: entered allmulticast mode [ 701.119833][T27621] FAULT_INJECTION: forcing a failure. [ 701.119833][T27621] name failslab, interval 1, probability 0, space 0, times 0 [ 701.146480][T27621] CPU: 1 UID: 0 PID: 27621 Comm: syz.3.6350 Not tainted syzkaller #0 PREEMPT(full) [ 701.146509][T27621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 701.146520][T27621] Call Trace: [ 701.146536][T27621] [ 701.146545][T27621] dump_stack_lvl+0xe8/0x150 [ 701.146579][T27621] should_fail_ex+0x412/0x560 [ 701.146607][T27621] should_failslab+0xa8/0x100 [ 701.146629][T27621] __kmalloc_cache_noprof+0x83/0x6e0 [ 701.146649][T27621] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 701.146673][T27621] ? __xdp_reg_mem_model+0x1e3/0x5d0 [ 701.146702][T27621] __xdp_reg_mem_model+0x1e3/0x5d0 [ 701.146732][T27621] ? __pfx___xdp_reg_mem_model+0x10/0x10 [ 701.146757][T27621] ? page_pool_create_percpu+0x7f9/0xb80 [ 701.146788][T27621] xdp_reg_mem_model+0x22/0x40 [ 701.146812][T27621] bpf_test_run_xdp_live+0x295/0x1cf0 [ 701.146842][T27621] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 701.146878][T27621] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 701.146901][T27621] ? __pfx_autoremove_wake_function+0x10/0x10 [ 701.146927][T27621] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 701.146969][T27621] ? 0xffffffffa020169c [ 701.146984][T27621] ? 0xffffffffa02016ec [ 701.146999][T27621] ? 0xffffffffa02019f0 [ 701.147038][T27621] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 701.147071][T27621] ? _copy_from_user+0x94/0xb0 [ 701.147099][T27621] ? bpf_test_init+0x113/0x150 [ 701.147116][T27621] ? xdp_convert_md_to_buff+0x5b/0x330 [ 701.147139][T27621] bpf_prog_test_run_xdp+0x81c/0x1160 [ 701.147175][T27621] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 701.147201][T27621] ? __fget_files+0x2a/0x420 [ 701.147228][T27621] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 701.147250][T27621] bpf_prog_test_run+0x2c7/0x340 [ 701.147274][T27621] __sys_bpf+0x5cb/0x920 [ 701.147295][T27621] ? __pfx___sys_bpf+0x10/0x10 [ 701.147329][T27621] ? ksys_write+0x242/0x270 [ 701.147365][T27621] ? __pfx_ksys_write+0x10/0x10 [ 701.147399][T27621] __x64_sys_bpf+0x7c/0x90 [ 701.147426][T27621] do_syscall_64+0xe2/0xf80 [ 701.147451][T27621] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.147468][T27621] ? trace_irq_disable+0x37/0x100 [ 701.147486][T27621] ? clear_bhb_loop+0x60/0xb0 [ 701.147508][T27621] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.147526][T27621] RIP: 0033:0x7f324a19aeb9 [ 701.147544][T27621] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 701.147560][T27621] RSP: 002b:00007f324b06e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 701.147580][T27621] RAX: ffffffffffffffda RBX: 00007f324a415fa0 RCX: 00007f324a19aeb9 [ 701.147593][T27621] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 701.147606][T27621] RBP: 00007f324b06e090 R08: 0000000000000000 R09: 0000000000000000 [ 701.147618][T27621] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 701.147629][T27621] R13: 00007f324a416038 R14: 00007f324a415fa0 R15: 00007fffa34bcb18 [ 701.147660][T27621] [ 702.105340][T27645] syzkaller0: entered promiscuous mode [ 702.125392][T27645] syzkaller0: entered allmulticast mode [ 702.294222][T19038] block nbd5: Receive control failed (result -104) [ 702.301652][T27657] syzkaller0: entered promiscuous mode [ 702.301678][T27657] syzkaller0: entered allmulticast mode [ 702.886021][T27684] wg1 speed is unknown, defaulting to 1000 [ 702.897844][T27684] xfrm0 speed is unknown, defaulting to 1000 [ 702.912336][T27687] netlink: 'syz.4.6367': attribute type 2 has an invalid length. [ 703.020491][T27690] netlink: 'syz.4.6367': attribute type 1 has an invalid length. [ 703.043256][T27691] __nla_validate_parse: 6 callbacks suppressed [ 703.043276][T27691] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6368'. [ 703.150177][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 703.158254][ C1] lec:lec_tx_timeout: lec0 [ 703.162935][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 703.237281][T27684] lo speed is unknown, defaulting to 1000 [ 703.502596][T27696] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6368'. [ 703.854485][T27703] veth5: entered promiscuous mode [ 704.114272][T27716] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6376'. [ 704.569926][T27732] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6381'. [ 704.735376][T27738] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6384'. [ 704.776409][T27738] tipc: Started in network mode [ 704.788424][T27738] tipc: Node identity 4, cluster identity 4711 [ 704.801908][T27738] tipc: Node number set to 4 [ 704.948787][T27753] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6389'. [ 705.022300][T27757] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6391'. [ 705.337649][T27771] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6397'. [ 705.377270][T27773] netlink: 'syz.3.6398': attribute type 1 has an invalid length. [ 705.406418][T27775] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6389'. [ 705.420653][T27773] 8021q: adding VLAN 0 to HW filter on device bond1 [ 705.432037][T27776] FAULT_INJECTION: forcing a failure. [ 705.432037][T27776] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 705.449794][T27776] CPU: 1 UID: 0 PID: 27776 Comm: syz.3.6398 Not tainted syzkaller #0 PREEMPT(full) [ 705.449820][T27776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 705.449832][T27776] Call Trace: [ 705.449839][T27776] [ 705.449848][T27776] dump_stack_lvl+0xe8/0x150 [ 705.449877][T27776] should_fail_ex+0x412/0x560 [ 705.449903][T27776] _copy_from_user+0x2d/0xb0 [ 705.449934][T27776] ___sys_sendmsg+0x1c6/0x360 [ 705.449958][T27776] ? __lock_acquire+0x6b5/0x2cf0 [ 705.449985][T27776] ? __pfx____sys_sendmsg+0x10/0x10 [ 705.450038][T27776] ? __fget_files+0x2a/0x420 [ 705.450070][T27776] ? __fget_files+0x3a0/0x420 [ 705.450097][T27776] __x64_sys_sendmsg+0x1bd/0x2a0 [ 705.450121][T27776] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 705.450148][T27776] ? __pfx_ksys_write+0x10/0x10 [ 705.450181][T27776] do_syscall_64+0xe2/0xf80 [ 705.450200][T27776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.450217][T27776] ? trace_irq_disable+0x37/0x100 [ 705.450237][T27776] ? clear_bhb_loop+0x60/0xb0 [ 705.450257][T27776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.450274][T27776] RIP: 0033:0x7f324a19aeb9 [ 705.450292][T27776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 705.450307][T27776] RSP: 002b:00007f324b04d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 705.450326][T27776] RAX: ffffffffffffffda RBX: 00007f324a416090 RCX: 00007f324a19aeb9 [ 705.450340][T27776] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000005 [ 705.450353][T27776] RBP: 00007f324b04d090 R08: 0000000000000000 R09: 0000000000000000 [ 705.450364][T27776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 705.450375][T27776] R13: 00007f324a416128 R14: 00007f324a416090 R15: 00007fffa34bcb18 [ 705.450405][T27776] [ 705.807417][T27791] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6403'. [ 705.841978][T27791] hsr_slave_0: left promiscuous mode [ 705.851873][T27791] hsr_slave_1: left promiscuous mode [ 706.016311][T27801] wg1 speed is unknown, defaulting to 1000 [ 706.046225][T27801] xfrm0 speed is unknown, defaulting to 1000 [ 706.307720][T27801] lo speed is unknown, defaulting to 1000 [ 706.448971][T27815] Bluetooth: MGMT ver 1.23 [ 706.786350][ T2962] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 706.812683][ T2962] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 707.238811][T27852] IPVS: set_ctl: invalid protocol: 117 100.1.1.2:20002 [ 707.668068][T27865] syzkaller1: entered allmulticast mode [ 708.104197][T27883] __nla_validate_parse: 6 callbacks suppressed [ 708.104216][T27883] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6435'. [ 708.135266][T27883] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6435'. [ 708.148319][T27883] openvswitch: netlink: Flow key attr not present in new flow. [ 708.170265][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 708.178314][ C1] lec:lec_tx_timeout: lec0 [ 708.183151][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 708.537363][ T5835] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 708.547895][ T5835] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 708.559599][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 708.569899][ T5835] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 708.583011][ T5835] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 708.784365][T27906] netlink: 'syz.4.6443': attribute type 4 has an invalid length. [ 708.799552][T27900] syzkaller0: entered promiscuous mode [ 708.805676][T27900] syzkaller0: entered allmulticast mode [ 708.887337][T27911] FAULT_INJECTION: forcing a failure. [ 708.887337][T27911] name failslab, interval 1, probability 0, space 0, times 0 [ 708.908092][T27911] CPU: 0 UID: 0 PID: 27911 Comm: syz.4.6444 Not tainted syzkaller #0 PREEMPT(full) [ 708.908120][T27911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 708.908131][T27911] Call Trace: [ 708.908139][T27911] [ 708.908146][T27911] dump_stack_lvl+0xe8/0x150 [ 708.908174][T27911] should_fail_ex+0x412/0x560 [ 708.908199][T27911] should_failslab+0xa8/0x100 [ 708.908220][T27911] __kmalloc_cache_noprof+0x83/0x6e0 [ 708.908239][T27911] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 708.908259][T27911] ? sctp_v6_cmp_addr+0x15/0xd0 [ 708.908278][T27911] ? sctp_add_bind_addr+0x8c/0x370 [ 708.908303][T27911] sctp_add_bind_addr+0x8c/0x370 [ 708.908326][T27911] sctp_copy_local_addr_list+0x314/0x4f0 [ 708.908351][T27911] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 708.908371][T27911] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 708.908394][T27911] ? sctp_v6_is_any+0x64/0x80 [ 708.908416][T27911] ? sctp_copy_one_addr+0x93/0x360 [ 708.908438][T27911] sctp_bind_addr_copy+0xb3/0x3c0 [ 708.908456][T27911] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 708.908485][T27911] sctp_connect_new_asoc+0x2ff/0x6b0 [ 708.908510][T27911] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 708.908537][T27911] ? __local_bh_enable_ip+0xd0/0x130 [ 708.908553][T27911] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 708.908574][T27911] ? security_sctp_bind_connect+0x7e/0x2c0 [ 708.908597][T27911] sctp_sendmsg+0x1528/0x2c10 [ 708.908635][T27911] ? __pfx_sctp_sendmsg+0x10/0x10 [ 708.908673][T27911] ? aa_sk_perm+0x15a/0x960 [ 708.908697][T27911] ? aa_sk_perm+0x82d/0x960 [ 708.908715][T27911] ? __might_fault+0xaf/0x130 [ 708.908749][T27911] ? __pfx_aa_sk_perm+0x10/0x10 [ 708.908772][T27911] ? sock_rps_record_flow+0x19/0x400 [ 708.908797][T27911] ? inet_sendmsg+0x2f4/0x370 [ 708.908834][T27911] __sys_sendto+0x627/0x7a0 [ 708.908861][T27911] ? __pfx___sys_sendto+0x10/0x10 [ 708.908881][T27911] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 708.908917][T27911] ? __fget_files+0x3a0/0x420 [ 708.908948][T27911] ? ksys_write+0x242/0x270 [ 708.908976][T27911] ? __pfx_ksys_write+0x10/0x10 [ 708.909007][T27911] __x64_sys_sendto+0xde/0x100 [ 708.909037][T27911] do_syscall_64+0xe2/0xf80 [ 708.909056][T27911] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.909078][T27911] ? trace_irq_disable+0x37/0x100 [ 708.909096][T27911] ? clear_bhb_loop+0x60/0xb0 [ 708.909119][T27911] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.909137][T27911] RIP: 0033:0x7f19c759aeb9 [ 708.909155][T27911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 708.909172][T27911] RSP: 002b:00007f19c845d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 708.909192][T27911] RAX: ffffffffffffffda RBX: 00007f19c7815fa0 RCX: 00007f19c759aeb9 [ 708.909207][T27911] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000005 [ 708.909220][T27911] RBP: 00007f19c845d090 R08: 000020000005ffe4 R09: 000000000000001c [ 708.909233][T27911] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 708.909244][T27911] R13: 00007f19c7816038 R14: 00007f19c7815fa0 R15: 00007ffed0ef82c8 [ 708.909276][T27911] [ 709.417690][T27919] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6447'. [ 710.665431][T19038] Bluetooth: hci1: command tx timeout [ 711.438014][T27915] wg1 speed is unknown, defaulting to 1000 [ 711.465919][T27897] wg1 speed is unknown, defaulting to 1000 [ 711.466087][T27915] xfrm0 speed is unknown, defaulting to 1000 [ 711.615902][T27930] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6450'. [ 711.806207][T27915] lo speed is unknown, defaulting to 1000 [ 711.806216][T27897] xfrm0 speed is unknown, defaulting to 1000 [ 711.866802][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.911184][T27947] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6453'. [ 712.028408][T27950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.050698][T27950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.059101][T27950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.099129][T27950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.135889][T27950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.268434][T27897] lo speed is unknown, defaulting to 1000 [ 712.369883][T27961] wg1 speed is unknown, defaulting to 1000 [ 712.377822][T27961] xfrm0 speed is unknown, defaulting to 1000 [ 712.750304][T19038] Bluetooth: hci1: command tx timeout [ 712.840235][T27961] lo speed is unknown, defaulting to 1000 [ 712.894851][T27979] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6467'. [ 712.900714][ T5843] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.190186][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 713.198381][ C1] lec:lec_tx_timeout: lec0 [ 713.203368][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 713.256645][T27993] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6471'. [ 713.349222][T27996] ip6gre1: entered allmulticast mode [ 713.382945][T27996] team0: Device ip6gre1 is of different type [ 713.432884][T27998] netlink: 'syz.2.6471': attribute type 1 has an invalid length. [ 713.468066][T27998] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6471'. [ 713.714328][T27897] chnl_net:caif_netlink_parms(): no params data found [ 713.947975][ T5843] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.059199][T28019] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6476'. [ 714.109482][T26647] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.119027][ T5843] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.134421][T26770] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.228569][T27897] bridge0: port 1(bridge_slave_0) entered blocking state [ 714.253164][T27897] bridge0: port 1(bridge_slave_0) entered disabled state [ 714.279522][T27897] bridge_slave_0: entered allmulticast mode [ 714.305413][T27897] bridge_slave_0: entered promiscuous mode [ 714.309216][T28025] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6480'. [ 714.361355][T27897] bridge0: port 2(bridge_slave_1) entered blocking state [ 714.382870][T27897] bridge0: port 2(bridge_slave_1) entered disabled state [ 714.400735][T27897] bridge_slave_1: entered allmulticast mode [ 714.481489][T27897] bridge_slave_1: entered promiscuous mode [ 714.597799][T27897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 714.625076][T27897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 714.724542][T27897] team0: Port device team_slave_0 added [ 714.735919][T27897] team0: Port device team_slave_1 added [ 714.791007][T27897] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 714.798906][T27897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 714.829875][T19038] Bluetooth: hci1: command tx timeout [ 714.844946][T27897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 714.879450][T27897] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 714.901007][T27897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 714.929696][T27897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 714.958498][T28056] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.967395][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.977281][T28056] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.988628][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.996874][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.010329][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.056863][T28060] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6488'. [ 715.087331][T27897] hsr_slave_0: entered promiscuous mode [ 715.094382][T27897] hsr_slave_1: entered promiscuous mode [ 715.102277][T27897] debugfs: 'hsr0' already exists in 'hsr' [ 715.109045][T27897] Cannot create hsr debugfs directory [ 715.120786][T28057] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6487'. [ 715.413025][T27897] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.439426][T27897] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 715.497166][T28069] netlink: 'syz.4.6491': attribute type 12 has an invalid length. [ 715.509868][T28067] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6488'. [ 715.520231][T28069] netlink: 'syz.4.6491': attribute type 29 has an invalid length. [ 715.528257][T28069] netlink: 148 bytes leftover after parsing attributes in process `syz.4.6491'. [ 715.578664][T28069] netlink: 'syz.4.6491': attribute type 2 has an invalid length. [ 715.634989][T28069] netlink: 23 bytes leftover after parsing attributes in process `syz.4.6491'. [ 715.762783][T27897] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.774099][T27897] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 715.826360][T28079] netlink: 244 bytes leftover after parsing attributes in process `syz.4.6496'. [ 715.843907][T27897] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.854567][T27897] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 715.972951][T27897] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.990372][T28085] wg1 speed is unknown, defaulting to 1000 [ 716.006456][T27897] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 716.075639][T28085] xfrm0 speed is unknown, defaulting to 1000 [ 716.395202][T27897] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 716.426088][T27897] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 716.442277][T27897] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 716.461899][T27897] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 716.537595][T28085] lo speed is unknown, defaulting to 1000 [ 716.900248][T19038] Bluetooth: hci1: command tx timeout [ 716.928084][T28129] IPVS: set_ctl: invalid protocol: 98 100.1.1.1:20002 [ 716.955244][T27897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 717.023903][T27897] 8021q: adding VLAN 0 to HW filter on device team0 [ 717.088461][T24593] bridge0: port 1(bridge_slave_0) entered blocking state [ 717.095672][T24593] bridge0: port 1(bridge_slave_0) entered forwarding state [ 717.161764][T24593] bridge0: port 2(bridge_slave_1) entered blocking state [ 717.168944][T24593] bridge0: port 2(bridge_slave_1) entered forwarding state [ 717.224923][T28140] FAULT_INJECTION: forcing a failure. [ 717.224923][T28140] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 717.251307][T28140] CPU: 1 UID: 0 PID: 28140 Comm: syz.2.6511 Not tainted syzkaller #0 PREEMPT(full) [ 717.251333][T28140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 717.251345][T28140] Call Trace: [ 717.251352][T28140] [ 717.251361][T28140] dump_stack_lvl+0xe8/0x150 [ 717.251389][T28140] should_fail_ex+0x412/0x560 [ 717.251416][T28140] _copy_to_iter+0x1e4/0x17d0 [ 717.251442][T28140] ? _copy_to_iter+0x1f1/0x17d0 [ 717.251474][T28140] ? rep_movs_alternative+0x4a/0x90 [ 717.251499][T28140] ? _copy_to_iter+0x255/0x17d0 [ 717.251522][T28140] ? __pfx__copy_to_iter+0x10/0x10 [ 717.251556][T28140] ? aa_label_sk_perm+0x529/0x6d0 [ 717.251575][T28140] __skb_datagram_iter+0xf8/0x980 [ 717.251599][T28140] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 717.251631][T28140] __skb_datagram_iter+0x6ef/0x980 [ 717.251656][T28140] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 717.251684][T28140] skb_copy_datagram_iter+0xb5/0x210 [ 717.251708][T28140] tipc_recvmsg+0x7ce/0x1410 [ 717.251739][T28140] ? __pfx_tipc_recvmsg+0x10/0x10 [ 717.251768][T28140] ? __lock_acquire+0x6b5/0x2cf0 [ 717.251795][T28140] ? aa_sock_msg_perm+0xf1/0x1b0 [ 717.251818][T28140] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 717.251838][T28140] ? security_socket_recvmsg+0x7e/0x2c0 [ 717.251865][T28140] ? __pfx_tipc_recvmsg+0x10/0x10 [ 717.251886][T28140] sock_recvmsg+0x22c/0x270 [ 717.251911][T28140] ____sys_recvmsg+0x1e6/0x4a0 [ 717.251945][T28140] ? __pfx_____sys_recvmsg+0x10/0x10 [ 717.251986][T28140] ? import_iovec+0x73/0xa0 [ 717.252016][T28140] ___sys_recvmsg+0x215/0x590 [ 717.252039][T28140] ? get_pid_task+0x20/0x1f0 [ 717.252064][T28140] ? __pfx____sys_recvmsg+0x10/0x10 [ 717.252093][T28140] ? __fget_files+0x2a/0x420 [ 717.252132][T28140] ? __fget_files+0x3a0/0x420 [ 717.252163][T28140] __x64_sys_recvmsg+0x1ba/0x2a0 [ 717.252190][T28140] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 717.252224][T28140] ? __pfx_ksys_write+0x10/0x10 [ 717.252262][T28140] do_syscall_64+0xe2/0xf80 [ 717.252284][T28140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.252302][T28140] ? trace_irq_disable+0x37/0x100 [ 717.252319][T28140] ? clear_bhb_loop+0x60/0xb0 [ 717.252342][T28140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.252360][T28140] RIP: 0033:0x7faf9f99aeb9 [ 717.252378][T28140] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 717.252395][T28140] RSP: 002b:00007faf9dbf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 717.252415][T28140] RAX: ffffffffffffffda RBX: 00007faf9fc15fa0 RCX: 00007faf9f99aeb9 [ 717.252429][T28140] RDX: 0000000000010021 RSI: 0000200000000300 RDI: 0000000000000004 [ 717.252442][T28140] RBP: 00007faf9dbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 717.252454][T28140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 717.252473][T28140] R13: 00007faf9fc16038 R14: 00007faf9fc15fa0 R15: 00007ffe73422c98 [ 717.252505][T28140] [ 718.239942][T28156] syzkaller1: entered promiscuous mode [ 718.252240][T28156] syzkaller1: entered allmulticast mode [ 718.382916][T28170] delete_channel: no stack [ 718.407765][T27897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 718.492257][T27897] veth0_vlan: entered promiscuous mode [ 718.540821][T27897] veth1_vlan: entered promiscuous mode [ 718.573977][T28178] IPVS: set_ctl: invalid protocol: 92 127.0.0.1:20000 [ 718.645068][T27897] veth0_macvtap: entered promiscuous mode [ 718.699338][T27897] veth1_macvtap: entered promiscuous mode [ 718.755100][T27897] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 718.784942][T27897] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 718.810430][T28191] __nla_validate_parse: 1 callbacks suppressed [ 718.810449][T28191] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6520'. [ 718.832547][T14312] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.865775][T14312] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.894468][T14312] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.919574][T14312] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.980217][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 718.988858][ C1] lec:lec_tx_timeout: lec0 [ 718.993676][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 719.111134][T28200] bond2: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 719.126899][T28200] bond2 (unregistering): Released all slaves [ 719.146153][ T6526] net_ratelimit: 13 callbacks suppressed [ 719.146174][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 719.236539][ T3671] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 719.260528][ T3671] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 719.322228][ T1008] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 719.336708][ T1008] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 719.391481][T28211] bond2: entered promiscuous mode [ 719.465097][T28215] macsec1: entered promiscuous mode [ 719.471774][T28215] macsec1: entered allmulticast mode [ 719.547799][T28219] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6530'. [ 719.587846][T28221] netlink: 'syz.1.6529': attribute type 12 has an invalid length. [ 719.601304][T28221] netlink: 'syz.1.6529': attribute type 29 has an invalid length. [ 719.620331][T28221] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6529'. [ 719.629560][T28221] netlink: 'syz.1.6529': attribute type 2 has an invalid length. [ 719.662359][T28221] netlink: 23 bytes leftover after parsing attributes in process `syz.1.6529'. [ 719.720928][T28227] batman_adv: batadv0: Adding interface: dummy0 [ 719.727611][T28227] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 719.809949][T28227] batman_adv: batadv0: Interface activated: dummy0 [ 719.853882][T28238] FAULT_INJECTION: forcing a failure. [ 719.853882][T28238] name failslab, interval 1, probability 0, space 0, times 0 [ 719.854405][T28232] batadv0: mtu less than device minimum [ 719.869104][T28238] CPU: 1 UID: 0 PID: 28238 Comm: syz.0.6535 Not tainted syzkaller #0 PREEMPT(full) [ 719.869128][T28238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 719.869140][T28238] Call Trace: [ 719.869148][T28238] [ 719.869157][T28238] dump_stack_lvl+0xe8/0x150 [ 719.869187][T28238] should_fail_ex+0x412/0x560 [ 719.869216][T28238] should_failslab+0xa8/0x100 [ 719.869238][T28238] kmem_cache_alloc_noprof+0x87/0x6e0 [ 719.869266][T28238] ? skb_clone+0x212/0x3a0 [ 719.869302][T28238] skb_clone+0x212/0x3a0 [ 719.869330][T28238] __netlink_deliver_tap+0x404/0x850 [ 719.869364][T28238] ? netlink_deliver_tap+0x2e/0x1b0 [ 719.869386][T28238] netlink_deliver_tap+0x19c/0x1b0 [ 719.869407][T28238] __netlink_sendskb+0x47/0x90 [ 719.869427][T28238] netlink_dump+0xa6f/0xe80 [ 719.869458][T28238] ? __pfx_netlink_dump+0x10/0x10 [ 719.869494][T28238] ? genl_start+0x499/0x6c0 [ 719.869526][T28238] __netlink_dump_start+0x5cb/0x7e0 [ 719.869553][T28238] genl_family_rcv_msg_dumpit+0x213/0x310 [ 719.869582][T28238] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 719.869615][T28238] ? __pfx_genl_start+0x10/0x10 [ 719.869636][T28238] ? __pfx_genl_dumpit+0x10/0x10 [ 719.869658][T28238] ? __pfx_genl_done+0x10/0x10 [ 719.869685][T28238] ? bpf_lsm_capable+0x9/0x20 [ 719.869707][T28238] ? security_capable+0x7e/0x2c0 [ 719.869735][T28238] genl_rcv_msg+0x5e8/0x7a0 [ 719.869766][T28238] ? __pfx_genl_rcv_msg+0x10/0x10 [ 719.869789][T28238] ? __pfx_batadv_hardif_neigh_dump+0x10/0x10 [ 719.869817][T28238] ? __pfx_ref_tracker_free+0x10/0x10 [ 719.869848][T28238] netlink_rcv_skb+0x232/0x4b0 [ 719.869868][T28238] ? __pfx_genl_rcv_msg+0x10/0x10 [ 719.869894][T28238] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 719.869912][T28238] ? genl_rcv+0x19/0x40 [ 719.869952][T28238] ? down_read+0x272/0x2e0 [ 719.869972][T28238] ? genl_rcv+0xd/0x40 [ 719.869997][T28238] genl_rcv+0x28/0x40 [ 719.870019][T28238] netlink_unicast+0x80f/0x9b0 [ 719.870045][T28238] ? __pfx_netlink_unicast+0x10/0x10 [ 719.870065][T28238] ? netlink_sendmsg+0x650/0xb40 [ 719.870084][T28238] ? skb_put+0x11b/0x210 [ 719.870109][T28238] netlink_sendmsg+0x813/0xb40 [ 719.870144][T28238] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.870168][T28238] ? aa_sock_msg_perm+0xf1/0x1b0 [ 719.870193][T28238] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 719.870214][T28238] ? __pfx_netlink_sendmsg+0x10/0x10 [ 719.870232][T28238] ____sys_sendmsg+0xa68/0xad0 [ 719.870256][T28238] ? __might_fault+0xaf/0x130 [ 719.870293][T28238] ? __pfx_____sys_sendmsg+0x10/0x10 [ 719.870327][T28238] ? import_iovec+0x73/0xa0 [ 719.870356][T28238] ___sys_sendmsg+0x2a5/0x360 [ 719.870379][T28238] ? __lock_acquire+0x6b5/0x2cf0 [ 719.870409][T28238] ? __pfx____sys_sendmsg+0x10/0x10 [ 719.870469][T28238] ? __fget_files+0x2a/0x420 [ 719.870487][T28238] ? __fget_files+0x3a0/0x420 [ 719.870518][T28238] __x64_sys_sendmsg+0x1bd/0x2a0 [ 719.870544][T28238] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 719.870578][T28238] ? __pfx_ksys_write+0x10/0x10 [ 719.870615][T28238] do_syscall_64+0xe2/0xf80 [ 719.870636][T28238] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.870653][T28238] ? trace_irq_disable+0x37/0x100 [ 719.870671][T28238] ? clear_bhb_loop+0x60/0xb0 [ 719.870693][T28238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 719.870710][T28238] RIP: 0033:0x7f1a2479aeb9 [ 719.870728][T28238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 719.870744][T28238] RSP: 002b:00007f1a25714028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 719.870763][T28238] RAX: ffffffffffffffda RBX: 00007f1a24a15fa0 RCX: 00007f1a2479aeb9 [ 719.870777][T28238] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 719.870789][T28238] RBP: 00007f1a25714090 R08: 0000000000000000 R09: 0000000000000000 [ 719.870801][T28238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 719.870812][T28238] R13: 00007f1a24a16038 R14: 00007f1a24a15fa0 R15: 00007ffe9ff75708 [ 719.870844][T28238] [ 720.080978][ T3671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.289577][ T3671] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.304921][ T5843] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.316193][T18148] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.325720][ T6532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.327767][T28232] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 720.346794][T28232] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 720.358617][T28232] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 720.434245][T28241] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6536'. [ 720.477791][T28256] pim6reg: entered allmulticast mode [ 720.556859][T28250] pim6reg: left allmulticast mode [ 720.657496][T28264] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6541'. [ 720.760588][T28268] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6541'. [ 720.923258][T28271] syzkaller0: entered promiscuous mode [ 720.929225][T28271] syzkaller0: entered allmulticast mode [ 720.960937][T28276] wg1 speed is unknown, defaulting to 1000 [ 720.972106][T28276] xfrm0 speed is unknown, defaulting to 1000 [ 721.399589][T28300] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6550'. [ 721.425055][T28295] can: request_module (can-proto-3) failed. [ 721.470573][T28303] netlink: 'syz.3.6553': attribute type 8 has an invalid length. [ 721.479433][T28303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6553'. [ 721.489820][T28303] FAULT_INJECTION: forcing a failure. [ 721.489820][T28303] name failslab, interval 1, probability 0, space 0, times 0 [ 721.503355][T28303] CPU: 1 UID: 0 PID: 28303 Comm: syz.3.6553 Not tainted syzkaller #0 PREEMPT(full) [ 721.503380][T28303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 721.503391][T28303] Call Trace: [ 721.503399][T28303] [ 721.503407][T28303] dump_stack_lvl+0xe8/0x150 [ 721.503437][T28303] should_fail_ex+0x412/0x560 [ 721.503465][T28303] should_failslab+0xa8/0x100 [ 721.503488][T28303] __kvmalloc_node_noprof+0x166/0x8d0 [ 721.503510][T28303] ? alloc_netdev_mqs+0xa4b/0x11b0 [ 721.503544][T28303] alloc_netdev_mqs+0xa4b/0x11b0 [ 721.503578][T28303] rtnl_create_link+0x31f/0xd70 [ 721.503612][T28303] rtnl_newlink_create+0x277/0xb70 [ 721.503635][T28303] ? __pfx___nla_validate_parse+0x10/0x10 [ 721.503672][T28303] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 721.503699][T28303] ? __pfx___mutex_lock+0x10/0x10 [ 721.503732][T28303] ? ns_capable+0x89/0xe0 [ 721.503763][T28303] rtnl_newlink+0x1666/0x1be0 [ 721.503800][T28303] ? __pfx_rtnl_newlink+0x10/0x10 [ 721.503825][T28303] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.503890][T28303] ? kasan_quarantine_put+0xbb/0x1f0 [ 721.503917][T28303] ? lockdep_hardirqs_on+0x7a/0x110 [ 721.503943][T28303] ? kmem_cache_free+0x195/0x610 [ 721.503961][T28303] ? nlmon_xmit+0xb0/0x100 [ 721.503992][T28303] ? __lock_acquire+0x6b5/0x2cf0 [ 721.504027][T28303] ? __local_bh_enable_ip+0xd0/0x130 [ 721.504045][T28303] ? lockdep_hardirqs_on+0x7a/0x110 [ 721.504064][T28303] ? __dev_queue_xmit+0x274/0x3850 [ 721.504088][T28303] ? __local_bh_enable_ip+0xd0/0x130 [ 721.504104][T28303] ? __dev_queue_xmit+0x274/0x3850 [ 721.504136][T28303] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 721.504173][T28303] ? __pfx_rtnl_newlink+0x10/0x10 [ 721.504193][T28303] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 721.504217][T28303] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 721.504237][T28303] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 721.504255][T28303] ? ref_tracker_free+0x693/0x840 [ 721.504276][T28303] ? __copy_skb_header+0xa3/0x4a0 [ 721.504303][T28303] ? __pfx_ref_tracker_free+0x10/0x10 [ 721.504338][T28303] netlink_rcv_skb+0x232/0x4b0 [ 721.504360][T28303] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 721.504384][T28303] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 721.504416][T28303] ? netlink_deliver_tap+0x2e/0x1b0 [ 721.504445][T28303] netlink_unicast+0x80f/0x9b0 [ 721.504473][T28303] ? __pfx_netlink_unicast+0x10/0x10 [ 721.504493][T28303] ? netlink_sendmsg+0x650/0xb40 [ 721.504512][T28303] ? skb_put+0x11b/0x210 [ 721.504538][T28303] netlink_sendmsg+0x813/0xb40 [ 721.504570][T28303] ? __pfx_netlink_sendmsg+0x10/0x10 [ 721.504595][T28303] ? aa_sock_msg_perm+0xf1/0x1b0 [ 721.504620][T28303] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 721.504642][T28303] ? __pfx_netlink_sendmsg+0x10/0x10 [ 721.504662][T28303] ____sys_sendmsg+0xa68/0xad0 [ 721.504687][T28303] ? __might_fault+0xaf/0x130 [ 721.504720][T28303] ? __pfx_____sys_sendmsg+0x10/0x10 [ 721.504755][T28303] ? import_iovec+0x73/0xa0 [ 721.504786][T28303] ___sys_sendmsg+0x2a5/0x360 [ 721.504809][T28303] ? __lock_acquire+0x6b5/0x2cf0 [ 721.504839][T28303] ? __pfx____sys_sendmsg+0x10/0x10 [ 721.504909][T28303] ? __fget_files+0x2a/0x420 [ 721.504929][T28303] ? __fget_files+0x3a0/0x420 [ 721.504961][T28303] __x64_sys_sendmsg+0x1bd/0x2a0 [ 721.504988][T28303] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 721.505031][T28303] ? __pfx_ksys_write+0x10/0x10 [ 721.505070][T28303] do_syscall_64+0xe2/0xf80 [ 721.505091][T28303] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.505108][T28303] ? trace_irq_disable+0x37/0x100 [ 721.505126][T28303] ? clear_bhb_loop+0x60/0xb0 [ 721.505150][T28303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.505168][T28303] RIP: 0033:0x7f324a19aeb9 [ 721.505186][T28303] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 721.505202][T28303] RSP: 002b:00007f324b06e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 721.505223][T28303] RAX: ffffffffffffffda RBX: 00007f324a415fa0 RCX: 00007f324a19aeb9 [ 721.505236][T28303] RDX: 0000000000008000 RSI: 00002000000002c0 RDI: 0000000000000004 [ 721.505249][T28303] RBP: 00007f324b06e090 R08: 0000000000000000 R09: 0000000000000000 [ 721.505261][T28303] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 721.505273][T28303] R13: 00007f324a416038 R14: 00007f324a415fa0 R15: 00007fffa34bcb18 [ 721.505306][T28303] [ 721.983715][T28276] lo speed is unknown, defaulting to 1000 [ 722.062446][T28307] netlink: 'syz.0.6550': attribute type 3 has an invalid length. [ 722.125207][T28312] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6555'. [ 722.284102][T28318] syzkaller0: entered promiscuous mode [ 722.289619][T28318] syzkaller0: entered allmulticast mode [ 722.351925][T28316] syzkaller0: entered promiscuous mode [ 722.357430][T28316] syzkaller0: entered allmulticast mode [ 722.698831][T28334] wg1 speed is unknown, defaulting to 1000 [ 722.721883][T28334] xfrm0 speed is unknown, defaulting to 1000 [ 723.051156][T28334] lo speed is unknown, defaulting to 1000 [ 723.377129][T28363] xt_TPROXY: Can be used only with -p tcp or -p udp [ 724.020518][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 724.028645][ C1] lec:lec_tx_timeout: lec0 [ 724.033637][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 724.214027][T28387] __nla_validate_parse: 7 callbacks suppressed [ 724.214047][T28387] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6576'. [ 724.314074][T28391] net_ratelimit: 66 callbacks suppressed [ 724.314095][T28391] IPv6: addrconf: prefix option has invalid lifetime [ 724.415197][T28397] digital: digital_start_poll: Unknown protocol [ 724.509779][T18148] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.923571][T28419] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6585'. [ 724.932846][T28419] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6585'. [ 724.943591][T28420] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) ! [ 724.987156][ T5898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.097072][T28428] netlink: 'syz.2.6590': attribute type 2 has an invalid length. [ 725.105585][T28428] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6590'. [ 725.240787][T28438] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6592'. [ 725.538795][T28450] Cannot find set identified by id 65534 to match [ 725.547188][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.623807][ T1008] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.632825][ T6532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.641649][ T799] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.735675][T28461] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6599'. [ 725.813179][T28470] FAULT_INJECTION: forcing a failure. [ 725.813179][T28470] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 725.875455][T28470] CPU: 1 UID: 0 PID: 28470 Comm: syz.1.6604 Not tainted syzkaller #0 PREEMPT(full) [ 725.875486][T28470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 725.875498][T28470] Call Trace: [ 725.875506][T28470] [ 725.875514][T28470] dump_stack_lvl+0xe8/0x150 [ 725.875556][T28470] should_fail_ex+0x412/0x560 [ 725.875579][T28470] _copy_from_user+0x2d/0xb0 [ 725.875604][T28470] do_ipv6_setsockopt+0x264/0x31c0 [ 725.875628][T28470] ? get_pid_task+0x20/0x1f0 [ 725.875655][T28470] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 725.875677][T28470] ? get_pid_task+0x20/0x1f0 [ 725.875695][T28470] ? get_pid_task+0x20/0x1f0 [ 725.875710][T28470] ? get_pid_task+0x20/0x1f0 [ 725.875737][T28470] ? __lock_acquire+0x6b5/0x2cf0 [ 725.875775][T28470] ? aa_sk_perm+0x15a/0x960 [ 725.875798][T28470] ? aa_sk_perm+0x82d/0x960 [ 725.875818][T28470] ? __fget_files+0x2a/0x420 [ 725.875841][T28470] ? __pfx_aa_sk_perm+0x10/0x10 [ 725.875871][T28470] ? __fget_files+0x2a/0x420 [ 725.875889][T28470] ? aa_sock_opt_perm+0xff/0x1a0 [ 725.875913][T28470] ipv6_setsockopt+0x59/0x170 [ 725.875932][T28470] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 725.875953][T28470] do_sock_setsockopt+0x17c/0x1b0 [ 725.875979][T28470] __x64_sys_setsockopt+0x13d/0x1b0 [ 725.876006][T28470] do_syscall_64+0xe2/0xf80 [ 725.876026][T28470] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.876043][T28470] ? trace_irq_disable+0x37/0x100 [ 725.876060][T28470] ? clear_bhb_loop+0x60/0xb0 [ 725.876081][T28470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.876098][T28470] RIP: 0033:0x7ffa5879aeb9 [ 725.876113][T28470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.876129][T28470] RSP: 002b:00007ffa5969c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 725.876149][T28470] RAX: ffffffffffffffda RBX: 00007ffa58a15fa0 RCX: 00007ffa5879aeb9 [ 725.876161][T28470] RDX: 0000000000000030 RSI: 0000000000000029 RDI: 0000000000000009 [ 725.876172][T28470] RBP: 00007ffa5969c090 R08: 0000000000000090 R09: 0000000000000000 [ 725.876184][T28470] R10: 00002000000015c0 R11: 0000000000000246 R12: 0000000000000001 [ 725.876195][T28470] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 725.876224][T28470] [ 725.877433][T28476] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6602'. [ 726.249952][T28485] vlan2: entered promiscuous mode [ 726.398108][T28493] syzkaller0: entered promiscuous mode [ 726.433671][T28493] syzkaller0: entered allmulticast mode [ 726.581151][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.955233][T28530] wg1 speed is unknown, defaulting to 1000 [ 726.963536][T28530] xfrm0 speed is unknown, defaulting to 1000 [ 727.231047][T28538] syzkaller0: entered promiscuous mode [ 727.236695][T28538] syzkaller0: entered allmulticast mode [ 727.277053][T28530] lo speed is unknown, defaulting to 1000 [ 727.287610][T28540] bridge_slave_0: left allmulticast mode [ 727.295383][T28540] bridge_slave_0: left promiscuous mode [ 727.303142][T28540] bridge0: port 1(bridge_slave_0) entered disabled state [ 727.327776][T28540] bridge_slave_1: left allmulticast mode [ 727.333630][T28540] bridge_slave_1: left promiscuous mode [ 727.339676][T28540] bridge0: port 2(bridge_slave_1) entered disabled state [ 727.356729][T28540] bond0: (slave bond_slave_0): Releasing backup interface [ 727.375409][T28540] bond0: (slave bond_slave_1): Releasing backup interface [ 727.416971][T28540] team0: Port device team_slave_0 removed [ 727.442499][T28540] team0: Port device team_slave_1 removed [ 727.451586][T28540] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 727.460104][T28540] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 727.476985][T28540] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 727.484357][T28546] FAULT_INJECTION: forcing a failure. [ 727.484357][T28546] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 727.485929][T28540] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 727.504224][T28546] CPU: 1 UID: 0 PID: 28546 Comm: syz.1.6628 Not tainted syzkaller #0 PREEMPT(full) [ 727.504251][T28546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 727.504262][T28546] Call Trace: [ 727.504270][T28546] [ 727.504279][T28546] dump_stack_lvl+0xe8/0x150 [ 727.504308][T28546] should_fail_ex+0x412/0x560 [ 727.504335][T28546] _copy_from_iter+0x1d3/0x1670 [ 727.504369][T28546] ? rcu_is_watching+0x15/0xb0 [ 727.504388][T28546] ? __pfx__copy_from_iter+0x10/0x10 [ 727.504410][T28546] ? kmem_cache_alloc_node_noprof+0x473/0x6f0 [ 727.504445][T28546] ? netlink_sendmsg+0x650/0xb40 [ 727.504465][T28546] ? skb_put+0x11b/0x210 [ 727.504490][T28546] netlink_sendmsg+0x6c0/0xb40 [ 727.504519][T28546] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.504541][T28546] ? aa_sock_msg_perm+0xf1/0x1b0 [ 727.504565][T28546] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 727.504585][T28546] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.504604][T28546] ____sys_sendmsg+0xa68/0xad0 [ 727.504628][T28546] ? __might_fault+0xaf/0x130 [ 727.504659][T28546] ? __pfx_____sys_sendmsg+0x10/0x10 [ 727.504690][T28546] ? import_iovec+0x73/0xa0 [ 727.504719][T28546] ___sys_sendmsg+0x2a5/0x360 [ 727.504741][T28546] ? __lock_acquire+0x6b5/0x2cf0 [ 727.504776][T28546] ? __pfx____sys_sendmsg+0x10/0x10 [ 727.504831][T28546] ? __fget_files+0x2a/0x420 [ 727.504850][T28546] ? __fget_files+0x3a0/0x420 [ 727.504878][T28546] __x64_sys_sendmsg+0x1bd/0x2a0 [ 727.504904][T28546] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 727.504936][T28546] ? __pfx_ksys_write+0x10/0x10 [ 727.504973][T28546] do_syscall_64+0xe2/0xf80 [ 727.504994][T28546] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.505008][T28546] ? trace_irq_disable+0x37/0x100 [ 727.505024][T28546] ? clear_bhb_loop+0x60/0xb0 [ 727.505045][T28546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.505063][T28546] RIP: 0033:0x7ffa5879aeb9 [ 727.505080][T28546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.505095][T28546] RSP: 002b:00007ffa5969c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 727.505116][T28546] RAX: ffffffffffffffda RBX: 00007ffa58a15fa0 RCX: 00007ffa5879aeb9 [ 727.505130][T28546] RDX: 0000000004000080 RSI: 0000200000000580 RDI: 0000000000000003 [ 727.505148][T28546] RBP: 00007ffa5969c090 R08: 0000000000000000 R09: 0000000000000000 [ 727.505162][T28546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 727.505174][T28546] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 727.505204][T28546] [ 727.791436][ T5843] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.815998][T28540] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 727.925459][T28552] FAULT_INJECTION: forcing a failure. [ 727.925459][T28552] name failslab, interval 1, probability 0, space 0, times 0 [ 727.964739][T28552] CPU: 1 UID: 0 PID: 28552 Comm: syz.3.6629 Not tainted syzkaller #0 PREEMPT(full) [ 727.964766][T28552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 727.964777][T28552] Call Trace: [ 727.964786][T28552] [ 727.964794][T28552] dump_stack_lvl+0xe8/0x150 [ 727.964824][T28552] should_fail_ex+0x412/0x560 [ 727.964852][T28552] should_failslab+0xa8/0x100 [ 727.964881][T28552] kmem_cache_alloc_noprof+0x87/0x6e0 [ 727.964908][T28552] ? __netlink_lookup+0xc6/0x8b0 [ 727.964930][T28552] ? skb_clone+0x212/0x3a0 [ 727.964959][T28552] skb_clone+0x212/0x3a0 [ 727.964985][T28552] __netlink_deliver_tap+0x404/0x850 [ 727.965013][T28552] ? netlink_deliver_tap+0x2e/0x1b0 [ 727.965033][T28552] netlink_deliver_tap+0x19c/0x1b0 [ 727.965053][T28552] netlink_unicast+0x7e3/0x9b0 [ 727.965080][T28552] ? __pfx_netlink_unicast+0x10/0x10 [ 727.965100][T28552] ? netlink_sendmsg+0x650/0xb40 [ 727.965119][T28552] ? skb_put+0x11b/0x210 [ 727.965145][T28552] netlink_sendmsg+0x813/0xb40 [ 727.965175][T28552] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.965199][T28552] ? aa_sock_msg_perm+0xf1/0x1b0 [ 727.965224][T28552] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 727.965252][T28552] ? __pfx_netlink_sendmsg+0x10/0x10 [ 727.965271][T28552] ____sys_sendmsg+0xa68/0xad0 [ 727.965295][T28552] ? __might_fault+0xaf/0x130 [ 727.965327][T28552] ? __pfx_____sys_sendmsg+0x10/0x10 [ 727.965361][T28552] ? import_iovec+0x73/0xa0 [ 727.965391][T28552] ___sys_sendmsg+0x2a5/0x360 [ 727.965414][T28552] ? __lock_acquire+0x6b5/0x2cf0 [ 727.965443][T28552] ? __pfx____sys_sendmsg+0x10/0x10 [ 727.965502][T28552] ? __fget_files+0x2a/0x420 [ 727.965521][T28552] ? __fget_files+0x3a0/0x420 [ 727.965551][T28552] __x64_sys_sendmsg+0x1bd/0x2a0 [ 727.965578][T28552] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 727.965612][T28552] ? __pfx_ksys_write+0x10/0x10 [ 727.965651][T28552] do_syscall_64+0xe2/0xf80 [ 727.965672][T28552] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.965690][T28552] ? trace_irq_disable+0x37/0x100 [ 727.965713][T28552] ? clear_bhb_loop+0x60/0xb0 [ 727.965736][T28552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.965754][T28552] RIP: 0033:0x7f324a19aeb9 [ 727.965771][T28552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.965788][T28552] RSP: 002b:00007f324b04d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 727.965809][T28552] RAX: ffffffffffffffda RBX: 00007f324a416090 RCX: 00007f324a19aeb9 [ 727.965824][T28552] RDX: 9e802f8602b7f6b8 RSI: 00002000000001c0 RDI: 0000000000000003 [ 727.965838][T28552] RBP: 00007f324b04d090 R08: 0000000000000000 R09: 0000000000000000 [ 727.965850][T28552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 727.965862][T28552] R13: 00007f324a416128 R14: 00007f324a416090 R15: 00007fffa34bcb18 [ 727.965894][T28552] [ 727.966622][T28552] netlink: 'syz.3.6629': attribute type 10 has an invalid length. [ 728.316221][T28558] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6632'. [ 728.340477][T28558] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6632'. [ 728.377635][T28552] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 728.466598][T28564] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6634'. [ 728.891532][T28583] vcan0: tx drop: invalid sa for name 0x0000000000000401 [ 728.901805][T28583] netlink: 'syz.4.6639': attribute type 1 has an invalid length. [ 729.003317][T28587] sock: sock_timestamping_bind_phc: sock not bind to device [ 729.040192][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 729.048407][ C1] lec:lec_tx_timeout: lec0 [ 729.054262][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 729.237912][T28595] FAULT_INJECTION: forcing a failure. [ 729.237912][T28595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 729.260324][T28595] CPU: 1 UID: 0 PID: 28595 Comm: syz.4.6643 Not tainted syzkaller #0 PREEMPT(full) [ 729.260349][T28595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 729.260369][T28595] Call Trace: [ 729.260376][T28595] [ 729.260383][T28595] dump_stack_lvl+0xe8/0x150 [ 729.260406][T28595] should_fail_ex+0x412/0x560 [ 729.260427][T28595] _copy_to_user+0x31/0xb0 [ 729.260454][T28595] bpf_test_finish+0x53c/0x6b0 [ 729.260480][T28595] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 729.260501][T28595] ? __pfx_bpf_test_finish+0x10/0x10 [ 729.260523][T28595] ? _copy_from_user+0x94/0xb0 [ 729.260547][T28595] ? bpf_test_init+0x113/0x150 [ 729.260565][T28595] bpf_prog_test_run_xdp+0x8fa/0x1160 [ 729.260595][T28595] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 729.260614][T28595] ? __fget_files+0x2a/0x420 [ 729.260634][T28595] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 729.260651][T28595] bpf_prog_test_run+0x2c7/0x340 [ 729.260674][T28595] __sys_bpf+0x5cb/0x920 [ 729.260693][T28595] ? __pfx___sys_bpf+0x10/0x10 [ 729.260724][T28595] ? ksys_write+0x242/0x270 [ 729.260750][T28595] ? __pfx_ksys_write+0x10/0x10 [ 729.260782][T28595] __x64_sys_bpf+0x7c/0x90 [ 729.260807][T28595] do_syscall_64+0xe2/0xf80 [ 729.260828][T28595] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.260845][T28595] ? trace_irq_disable+0x37/0x100 [ 729.260862][T28595] ? clear_bhb_loop+0x60/0xb0 [ 729.260883][T28595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 729.260901][T28595] RIP: 0033:0x7f19c759aeb9 [ 729.260919][T28595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 729.260935][T28595] RSP: 002b:00007f19c845d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 729.260955][T28595] RAX: ffffffffffffffda RBX: 00007f19c7815fa0 RCX: 00007f19c759aeb9 [ 729.260970][T28595] RDX: 0000000000000050 RSI: 0000200000000640 RDI: 000000000000000a [ 729.260982][T28595] RBP: 00007f19c845d090 R08: 0000000000000000 R09: 0000000000000000 [ 729.260993][T28595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 729.261007][T28595] R13: 00007f19c7816038 R14: 00007f19c7815fa0 R15: 00007ffed0ef82c8 [ 729.261028][T28595] [ 729.490970][T28596] __nla_validate_parse: 1 callbacks suppressed [ 729.490991][T28596] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6644'. [ 729.706447][T28603] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6647'. [ 729.717693][T28611] 8021q: VLANs not supported on wlan1 [ 729.860827][ T6526] net_ratelimit: 6 callbacks suppressed [ 729.860846][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.895473][T28623] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6653'. [ 730.113560][ T25] block nbd5: Possible stuck request ffff888025950000: control (read@0,1024B). Runtime 30 seconds [ 730.127803][ T25] block nbd5: Possible stuck request ffff888025950200: control (read@1024,1024B). Runtime 30 seconds [ 730.139738][ T25] block nbd5: Possible stuck request ffff888025950400: control (read@2048,1024B). Runtime 30 seconds [ 730.151191][ T25] block nbd5: Possible stuck request ffff888025950600: control (read@3072,1024B). Runtime 30 seconds [ 730.175842][T28637] FAULT_INJECTION: forcing a failure. [ 730.175842][T28637] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 730.189389][T28637] CPU: 1 UID: 0 PID: 28637 Comm: syz.0.6658 Not tainted syzkaller #0 PREEMPT(full) [ 730.189441][T28637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 730.189466][T28637] Call Trace: [ 730.189481][T28637] [ 730.189489][T28637] dump_stack_lvl+0xe8/0x150 [ 730.189519][T28637] should_fail_ex+0x412/0x560 [ 730.189544][T28637] _copy_to_user+0x31/0xb0 [ 730.189572][T28637] simple_read_from_buffer+0xe1/0x170 [ 730.189596][T28637] proc_fail_nth_read+0x1bb/0x230 [ 730.189625][T28637] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 730.189654][T28637] ? rw_verify_area+0x2a6/0x4d0 [ 730.189678][T28637] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 730.189705][T28637] vfs_read+0x20c/0xa70 [ 730.189728][T28637] ? fdget_pos+0x246/0x320 [ 730.189754][T28637] ? __pfx___mutex_lock+0x10/0x10 [ 730.189776][T28637] ? __pfx_vfs_read+0x10/0x10 [ 730.189803][T28637] ? __fget_files+0x2a/0x420 [ 730.189827][T28637] ? __fget_files+0x3a0/0x420 [ 730.189846][T28637] ? __fget_files+0x2a/0x420 [ 730.189875][T28637] ksys_read+0x150/0x270 [ 730.189903][T28637] ? __pfx_ksys_read+0x10/0x10 [ 730.189940][T28637] do_syscall_64+0xe2/0xf80 [ 730.189960][T28637] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.189979][T28637] ? trace_irq_disable+0x37/0x100 [ 730.189997][T28637] ? clear_bhb_loop+0x60/0xb0 [ 730.190020][T28637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.190038][T28637] RIP: 0033:0x7f1a2475b78e [ 730.190055][T28637] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 730.190071][T28637] RSP: 002b:00007f1a25713fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 730.190092][T28637] RAX: ffffffffffffffda RBX: 00007f1a257146c0 RCX: 00007f1a2475b78e [ 730.190106][T28637] RDX: 000000000000000f RSI: 00007f1a257140a0 RDI: 0000000000000004 [ 730.190123][T28637] RBP: 00007f1a25714090 R08: 0000000000000000 R09: 0000000000000000 [ 730.190133][T28637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 730.190142][T28637] R13: 00007f1a24a16038 R14: 00007f1a24a15fa0 R15: 00007ffe9ff75708 [ 730.190170][T28637] [ 730.466234][T28639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6660'. [ 730.481052][T28639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6660'. [ 730.492683][T28639] FAULT_INJECTION: forcing a failure. [ 730.492683][T28639] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 730.526288][T28639] CPU: 0 UID: 0 PID: 28639 Comm: syz.0.6660 Not tainted syzkaller #0 PREEMPT(full) [ 730.526314][T28639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 730.526325][T28639] Call Trace: [ 730.526332][T28639] [ 730.526340][T28639] dump_stack_lvl+0xe8/0x150 [ 730.526368][T28639] should_fail_ex+0x412/0x560 [ 730.526395][T28639] _copy_from_user+0x2d/0xb0 [ 730.526421][T28639] kstrtouint_from_user+0xd6/0x180 [ 730.526447][T28639] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 730.526486][T28639] proc_fail_nth_write+0x8e/0x210 [ 730.526512][T28639] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 730.526542][T28639] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 730.526569][T28639] vfs_write+0x29a/0xb90 [ 730.526602][T28639] ? __pfx_vfs_write+0x10/0x10 [ 730.526626][T28639] ? __fget_files+0x2a/0x420 [ 730.526649][T28639] ? __fget_files+0x3a0/0x420 [ 730.526666][T28639] ? __fget_files+0x2a/0x420 [ 730.526692][T28639] ksys_write+0x150/0x270 [ 730.526718][T28639] ? __pfx_ksys_write+0x10/0x10 [ 730.526751][T28639] do_syscall_64+0xe2/0xf80 [ 730.526771][T28639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.526789][T28639] ? trace_irq_disable+0x37/0x100 [ 730.526805][T28639] ? clear_bhb_loop+0x60/0xb0 [ 730.526826][T28639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.526843][T28639] RIP: 0033:0x7f1a2475b78e [ 730.526859][T28639] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 730.526874][T28639] RSP: 002b:00007f1a25713fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 730.526894][T28639] RAX: ffffffffffffffda RBX: 00007f1a257146c0 RCX: 00007f1a2475b78e [ 730.526909][T28639] RDX: 0000000000000001 RSI: 00007f1a257140a0 RDI: 0000000000000004 [ 730.526919][T28639] RBP: 00007f1a25714090 R08: 0000000000000000 R09: 0000000000000000 [ 730.526930][T28639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 730.526941][T28639] R13: 00007f1a24a16038 R14: 00007f1a24a15fa0 R15: 00007ffe9ff75708 [ 730.526969][T28639] [ 730.747548][ T6532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.905014][ T6540] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.047330][T28663] netlink: 'syz.1.6667': attribute type 14 has an invalid length. [ 731.065071][T28663] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6667'. [ 731.084680][T28663] bond0: option xmit_hash_policy: invalid value (8) [ 731.172098][T28668] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6669'. [ 731.202702][T28672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.211649][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.231952][T28672] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.241163][T14312] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.251356][T28668] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6669'. [ 731.261360][T28668] netlink: 'syz.0.6669': attribute type 4 has an invalid length. [ 731.270259][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.281817][T28672] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6671'. [ 731.382676][T24591] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.391718][ T6526] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.677919][T28685] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6674'. [ 731.968901][T28694] netlink: 'syz.3.6677': attribute type 1 has an invalid length. [ 732.393437][T28711] nft_compat: unsupported protocol 0 [ 732.407359][T28712] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 732.414961][T28712] IPv6: NLM_F_CREATE should be set when creating new route [ 733.125129][T28712] bridge0: port 2(bridge_slave_1) entered disabled state [ 733.132943][T28712] bridge0: port 1(bridge_slave_0) entered disabled state [ 734.070167][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 734.080027][ C1] lec:lec_tx_timeout: lec0 [ 734.085728][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 734.171589][T28712] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 734.240694][T28712] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 734.562856][T28748] __nla_validate_parse: 4 callbacks suppressed [ 734.562883][T28748] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6693'. [ 735.171289][T14309] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.188217][T14309] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.260381][T14309] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.310869][T14309] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 735.487234][T28760] syzkaller0: entered promiscuous mode [ 735.520396][T28760] syzkaller0: entered allmulticast mode [ 735.772471][T28777] syzkaller0: entered promiscuous mode [ 735.779793][T28777] syzkaller0: entered allmulticast mode [ 735.833304][T28774] tipc: Enabled bearer , priority 0 [ 735.877225][T28771] tipc: Resetting bearer [ 735.975071][T28771] tipc: Disabling bearer [ 735.999665][T28779] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6704'. [ 736.155537][T28788] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6708'. [ 736.195140][T28788] netlink: 'syz.4.6708': attribute type 1 has an invalid length. [ 736.293734][T28794] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6711'. [ 736.417383][T28808] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6713'. [ 736.444606][T28805] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6716'. [ 736.734191][T28821] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6721'. [ 737.005399][T28829] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6713'. [ 737.352412][T28833] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6721'. [ 737.902325][T28837] netlink: 'syz.0.6726': attribute type 4 has an invalid length. [ 737.938027][T28842] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6728'. [ 737.941547][T28837] netlink: 'syz.0.6726': attribute type 4 has an invalid length. [ 738.435859][T14312] batman_adv: batadv0: Removing interface: gretap1 [ 738.461059][T14312] bond6 (unregistering): (slave gretap2): Releasing backup interface [ 738.497098][T14312] bond1 (unregistering): (slave gre1): Releasing backup interface [ 738.507176][T14312] gre1 (unregistering): left promiscuous mode [ 738.568902][T14312] dvmrp0 (unregistering): left allmulticast mode [ 738.589636][T14312] bond4 (unregistering): (slave geneve3): Releasing active interface [ 739.104294][T14312] bond1 (unregistering): Released all slaves [ 739.110229][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 739.118813][ C1] lec:lec_tx_timeout: lec0 [ 739.129101][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 739.265784][T14312] bond2 (unregistering): (slave vlan2): Releasing active interface [ 739.276004][T14312] bond2 (unregistering): Released all slaves [ 739.419512][T14312] bond3 (unregistering): Released all slaves [ 739.559262][T14312] bond0 (unregistering): Released all slaves [ 739.573132][T14312] bond4 (unregistering): Released all slaves [ 739.717760][T14312] bond5 (unregistering): Released all slaves [ 739.731728][T14312] bond6 (unregistering): Released all slaves [ 739.802709][T28858] syzkaller0: entered promiscuous mode [ 739.821262][T28858] syzkaller0: entered allmulticast mode [ 739.922537][T14312] tipc: Left network mode [ 740.021080][T14312] IPVS: stopping backup sync thread 21978 ... [ 740.329685][T28898] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6744'. [ 740.343314][T28898] block nbd0: Unsupported socket: should be TCP or UNIX. [ 740.351737][T28898] FAULT_INJECTION: forcing a failure. [ 740.351737][T28898] name failslab, interval 1, probability 0, space 0, times 0 [ 740.370717][T28898] CPU: 0 UID: 0 PID: 28898 Comm: syz.0.6744 Not tainted syzkaller #0 PREEMPT(full) [ 740.370744][T28898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 740.370755][T28898] Call Trace: [ 740.370764][T28898] [ 740.370773][T28898] dump_stack_lvl+0xe8/0x150 [ 740.370803][T28898] should_fail_ex+0x412/0x560 [ 740.370840][T28898] should_failslab+0xa8/0x100 [ 740.370862][T28898] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 740.370891][T28898] ? __alloc_skb+0x1d0/0x7d0 [ 740.370911][T28898] ? __local_bh_enable_ip+0xd0/0x130 [ 740.370934][T28898] __alloc_skb+0x1d0/0x7d0 [ 740.370955][T28898] ? netlink_ack_tlv_len+0x6c/0x210 [ 740.370983][T28898] netlink_ack+0x146/0xa50 [ 740.371001][T28898] ? __pfx_genl_rcv_msg+0x10/0x10 [ 740.371041][T28898] netlink_rcv_skb+0x2b6/0x4b0 [ 740.371063][T28898] ? __pfx_genl_rcv_msg+0x10/0x10 [ 740.371092][T28898] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 740.371123][T28898] ? genl_rcv+0x19/0x40 [ 740.371163][T28898] ? down_read+0x272/0x2e0 [ 740.371185][T28898] ? genl_rcv+0xd/0x40 [ 740.371210][T28898] genl_rcv+0x28/0x40 [ 740.371232][T28898] netlink_unicast+0x80f/0x9b0 [ 740.371259][T28898] ? __pfx_netlink_unicast+0x10/0x10 [ 740.371279][T28898] ? netlink_sendmsg+0x650/0xb40 [ 740.371298][T28898] ? skb_put+0x11b/0x210 [ 740.371324][T28898] netlink_sendmsg+0x813/0xb40 [ 740.371353][T28898] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.371378][T28898] ? aa_sock_msg_perm+0xf1/0x1b0 [ 740.371402][T28898] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 740.371424][T28898] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.371444][T28898] ____sys_sendmsg+0xa68/0xad0 [ 740.371468][T28898] ? __might_fault+0xaf/0x130 [ 740.371501][T28898] ? __pfx_____sys_sendmsg+0x10/0x10 [ 740.371534][T28898] ? import_iovec+0x73/0xa0 [ 740.371564][T28898] ___sys_sendmsg+0x2a5/0x360 [ 740.371587][T28898] ? __lock_acquire+0x6b5/0x2cf0 [ 740.371617][T28898] ? __pfx____sys_sendmsg+0x10/0x10 [ 740.371674][T28898] ? __fget_files+0x2a/0x420 [ 740.371694][T28898] ? __fget_files+0x3a0/0x420 [ 740.371724][T28898] __x64_sys_sendmsg+0x1bd/0x2a0 [ 740.371751][T28898] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 740.371784][T28898] ? __pfx_ksys_write+0x10/0x10 [ 740.371827][T28898] do_syscall_64+0xe2/0xf80 [ 740.371848][T28898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.371866][T28898] ? trace_irq_disable+0x37/0x100 [ 740.371883][T28898] ? clear_bhb_loop+0x60/0xb0 [ 740.371906][T28898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.371924][T28898] RIP: 0033:0x7f1a2479aeb9 [ 740.371942][T28898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.371960][T28898] RSP: 002b:00007f1a25714028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 740.371980][T28898] RAX: ffffffffffffffda RBX: 00007f1a24a15fa0 RCX: 00007f1a2479aeb9 [ 740.371995][T28898] RDX: 0000000000004000 RSI: 0000200000000200 RDI: 0000000000000004 [ 740.372007][T28898] RBP: 00007f1a25714090 R08: 0000000000000000 R09: 0000000000000000 [ 740.372018][T28898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.372030][T28898] R13: 00007f1a24a16038 R14: 00007f1a24a15fa0 R15: 00007ffe9ff75708 [ 740.372061][T28898] [ 740.931179][T28907] syzkaller0: entered promiscuous mode [ 740.937495][T28907] syzkaller0: entered allmulticast mode [ 741.615996][T28928] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6751'. [ 741.668222][T28925] wg1 speed is unknown, defaulting to 1000 [ 742.031209][T28941] sctp: [Deprecated]: syz.2.6756 (pid 28941) Use of int in maxseg socket option. [ 742.031209][T28941] Use struct sctp_assoc_value instead [ 742.268752][T28931] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6754'. [ 742.272012][T28925] xfrm0 speed is unknown, defaulting to 1000 [ 742.410333][T28932] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6754'. [ 742.453758][T28944] net_ratelimit: 5 callbacks suppressed [ 742.453780][T28944] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:0021 with DS=0x7 [ 742.493463][T28935] nbd6: detected capacity change from 0 to 63 [ 742.505624][T19038] block nbd6: Receive control failed (result -32) [ 742.515852][T27069] block nbd6: Dead connection, failed to find a fallback [ 742.548829][T27069] block nbd6: shutting down sockets [ 742.555202][T14312] hsr_slave_0: left promiscuous mode [ 742.570848][T27069] blk_print_req_error: 138 callbacks suppressed [ 742.570869][T27069] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 742.596084][T14312] hsr_slave_1: left promiscuous mode [ 742.610285][T27069] buffer_io_error: 138 callbacks suppressed [ 742.610305][T27069] Buffer I/O error on dev nbd6, logical block 0, async page read [ 742.665850][T14312] veth1_macvtap: left promiscuous mode [ 742.673347][T27069] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 742.686995][T14312] veth0_macvtap: left promiscuous mode [ 742.700500][T14312] veth1_vlan: left promiscuous mode [ 742.706028][T27069] Buffer I/O error on dev nbd6, logical block 1, async page read [ 742.720407][T14312] veth0_vlan: left promiscuous mode [ 742.726541][T27069] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 742.755811][T27069] Buffer I/O error on dev nbd6, logical block 2, async page read [ 742.770375][T27069] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 742.815178][T27069] Buffer I/O error on dev nbd6, logical block 3, async page read [ 742.817526][T28961] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6763'. [ 742.851825][T27069] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 742.899280][T27069] Buffer I/O error on dev nbd6, logical block 0, async page read [ 742.963734][T27069] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.023326][T27069] Buffer I/O error on dev nbd6, logical block 1, async page read [ 743.062125][T27069] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.092332][T27069] Buffer I/O error on dev nbd6, logical block 2, async page read [ 743.119527][T27069] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.133274][T27069] Buffer I/O error on dev nbd6, logical block 3, async page read [ 743.144869][T27069] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.159285][T27069] Buffer I/O error on dev nbd6, logical block 0, async page read [ 743.173901][T27069] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 743.186247][T27069] Buffer I/O error on dev nbd6, logical block 1, async page read [ 743.195185][T27069] ldm_validate_partition_table(): Disk read failed. [ 743.202859][T27069] Dev nbd6: unable to read RDB block 0 [ 743.209306][T27069] nbd6: unable to read partition table [ 743.223156][T27069] ldm_validate_partition_table(): Disk read failed. [ 743.240838][T27069] Dev nbd6: unable to read RDB block 0 [ 743.247920][T27069] nbd6: unable to read partition table [ 744.140198][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 744.148322][ C1] lec:lec_tx_timeout: lec0 [ 744.153070][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 744.392817][T28957] vlan2: entered promiscuous mode [ 744.398859][T28957] bridge0: entered promiscuous mode [ 744.419215][T28961] netlink: 'syz.4.6763': attribute type 1 has an invalid length. [ 744.444125][T28961] netlink: 'syz.4.6763': attribute type 2 has an invalid length. [ 744.454166][T28925] lo speed is unknown, defaulting to 1000 [ 744.629966][T28977] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6764'. [ 744.814965][T28983] syzkaller0: entered promiscuous mode [ 744.818377][T28987] xt_TCPMSS: Only works on TCP SYN packets [ 744.828790][T28983] syzkaller0: entered allmulticast mode [ 744.961046][T28993] sctp: [Deprecated]: syz.4.6771 (pid 28993) Use of int in maxseg socket option. [ 744.961046][T28993] Use struct sctp_assoc_value instead [ 745.009998][T14314] smc: removing ib device syû [ 745.108349][T28997] tc_dump_action: action bad kind [ 745.111657][T29000] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6774'. [ 745.236720][T29003] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6774'. [ 746.356976][T29039] netlink: 'syz.4.6788': attribute type 1 has an invalid length. [ 746.601835][T29039] 8021q: adding VLAN 0 to HW filter on device bond2 [ 746.609839][T29035] syzkaller0: entered promiscuous mode [ 746.625121][T29035] syzkaller0: entered allmulticast mode [ 746.745650][T29045] 8021q: adding VLAN 0 to HW filter on device bond2 [ 746.759848][T29045] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 746.772491][T29045] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 746.937339][T29046] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 746.951815][T29046] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 747.168790][T29057] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6791'. [ 747.183863][T29055] syzkaller0: entered promiscuous mode [ 747.189588][T29055] syzkaller0: entered allmulticast mode [ 747.212890][T29055] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 747.233271][T14312] IPVS: stop unused estimator thread 0... [ 747.250457][T29055] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 747.265451][T29055] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 747.458262][ T30] audit: type=1800 audit(1769610719.112:10): pid=29061 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.6794" name="memory.events" dev="tmpfs" ino=1074 res=0 errno=0 [ 747.501707][T29065] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6793'. [ 747.705817][T29087] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6799'. [ 747.905209][T29099] FAULT_INJECTION: forcing a failure. [ 747.905209][T29099] name failslab, interval 1, probability 0, space 0, times 0 [ 747.920097][T29099] CPU: 1 UID: 0 PID: 29099 Comm: syz.1.6802 Not tainted syzkaller #0 PREEMPT(full) [ 747.920124][T29099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 747.920134][T29099] Call Trace: [ 747.920141][T29099] [ 747.920150][T29099] dump_stack_lvl+0xe8/0x150 [ 747.920178][T29099] should_fail_ex+0x412/0x560 [ 747.920204][T29099] should_failslab+0xa8/0x100 [ 747.920227][T29099] __kmalloc_noprof+0xde/0x7e0 [ 747.920244][T29099] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 747.920270][T29099] ? rcu_is_watching+0x15/0xb0 [ 747.920302][T29099] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 747.920336][T29099] genl_family_rcv_msg_doit+0xd9/0x330 [ 747.920368][T29099] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 747.920402][T29099] ? apparmor_capable+0x137/0x1a0 [ 747.920431][T29099] ? bpf_lsm_capable+0x9/0x20 [ 747.920455][T29099] ? security_capable+0x7e/0x2c0 [ 747.920483][T29099] genl_rcv_msg+0x61c/0x7a0 [ 747.920513][T29099] ? __pfx_genl_rcv_msg+0x10/0x10 [ 747.920534][T29099] ? __pfx_fou_nl_del_doit+0x10/0x10 [ 747.920564][T29099] netlink_rcv_skb+0x232/0x4b0 [ 747.920584][T29099] ? __pfx_genl_rcv_msg+0x10/0x10 [ 747.920609][T29099] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 747.920626][T29099] ? genl_rcv+0x19/0x40 [ 747.920665][T29099] ? down_read+0x272/0x2e0 [ 747.920686][T29099] ? genl_rcv+0xd/0x40 [ 747.920709][T29099] genl_rcv+0x28/0x40 [ 747.920729][T29099] netlink_unicast+0x80f/0x9b0 [ 747.920755][T29099] ? __pfx_netlink_unicast+0x10/0x10 [ 747.920774][T29099] ? netlink_sendmsg+0x650/0xb40 [ 747.920792][T29099] ? skb_put+0x11b/0x210 [ 747.920817][T29099] netlink_sendmsg+0x813/0xb40 [ 747.920844][T29099] ? __pfx_netlink_sendmsg+0x10/0x10 [ 747.920867][T29099] ? aa_sock_msg_perm+0xf1/0x1b0 [ 747.920890][T29099] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 747.920912][T29099] ? __pfx_netlink_sendmsg+0x10/0x10 [ 747.920932][T29099] ____sys_sendmsg+0xa68/0xad0 [ 747.920954][T29099] ? __might_fault+0xaf/0x130 [ 747.920984][T29099] ? __pfx_____sys_sendmsg+0x10/0x10 [ 747.921018][T29099] ? import_iovec+0x73/0xa0 [ 747.921047][T29099] ___sys_sendmsg+0x2a5/0x360 [ 747.921068][T29099] ? __lock_acquire+0x6b5/0x2cf0 [ 747.921096][T29099] ? __pfx____sys_sendmsg+0x10/0x10 [ 747.921154][T29099] ? __fget_files+0x2a/0x420 [ 747.921173][T29099] ? __fget_files+0x3a0/0x420 [ 747.921205][T29099] __x64_sys_sendmsg+0x1bd/0x2a0 [ 747.921231][T29099] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 747.921263][T29099] ? __pfx_ksys_write+0x10/0x10 [ 747.921304][T29099] do_syscall_64+0xe2/0xf80 [ 747.921326][T29099] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.921344][T29099] ? trace_irq_disable+0x37/0x100 [ 747.921362][T29099] ? clear_bhb_loop+0x60/0xb0 [ 747.921382][T29099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.921399][T29099] RIP: 0033:0x7ffa5879aeb9 [ 747.921416][T29099] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 747.921433][T29099] RSP: 002b:00007ffa5969c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 747.921455][T29099] RAX: ffffffffffffffda RBX: 00007ffa58a15fa0 RCX: 00007ffa5879aeb9 [ 747.921468][T29099] RDX: 0000000000000014 RSI: 0000200000000240 RDI: 0000000000000003 [ 747.921479][T29099] RBP: 00007ffa5969c090 R08: 0000000000000000 R09: 0000000000000000 [ 747.921491][T29099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 747.921503][T29099] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 747.921535][T29099] [ 748.377189][T29104] IPVS: length: 35 != 24 [ 748.537155][T29113] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6808'. [ 748.772275][T29126] 8021q: adding VLAN 0 to HW filter on device bond1 [ 748.845118][T29126] bond1: (slave ip6gretap1): making interface the new active one [ 748.882100][T29126] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 748.981034][T29122] netlink: 260 bytes leftover after parsing attributes in process `syz.3.6810'. [ 748.985863][T29128] wg1 speed is unknown, defaulting to 1000 [ 749.008419][T29122] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6810'. [ 749.018678][T29128] xfrm0 speed is unknown, defaulting to 1000 [ 749.069740][T29135] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6814'. [ 749.078748][T29135] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6814'. [ 749.087969][T29135] netlink: 'syz.4.6814': attribute type 14 has an invalid length. [ 749.100258][T29135] netlink: 'syz.4.6814': attribute type 12 has an invalid length. [ 749.116425][T29136] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6808'. [ 749.160238][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 749.168429][ C1] lec:lec_tx_timeout: lec0 [ 749.173235][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 749.475783][T29140] wg1 speed is unknown, defaulting to 1000 [ 749.520693][T29133] geneve2: entered promiscuous mode [ 749.539672][T29133] geneve2: entered allmulticast mode [ 749.573809][T29133] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6813'. [ 749.605492][T29128] lo speed is unknown, defaulting to 1000 [ 749.605492][T29140] xfrm0 speed is unknown, defaulting to 1000 [ 750.043667][T27069] udevd[27069]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 750.191591][T29168] netlink: 'syz.2.6824': attribute type 10 has an invalid length. [ 750.201329][T29140] lo speed is unknown, defaulting to 1000 [ 750.201480][T29168] bond0: entered promiscuous mode [ 750.215813][T29168] bond_slave_0: entered promiscuous mode [ 750.223577][T29168] bond_slave_1: entered promiscuous mode [ 750.233143][T29168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 750.587136][T29177] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 750.680838][T29177] veth0_to_bridge: entered promiscuous mode [ 750.716142][T29177] veth0_to_bridge: left promiscuous mode [ 751.341774][T29206] syzkaller0: entered promiscuous mode [ 751.347302][T29206] syzkaller0: entered allmulticast mode [ 751.437843][T29197] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 751.529594][T29213] syzkaller0: entered promiscuous mode [ 751.536363][T29213] syzkaller0: entered allmulticast mode [ 752.182228][T29243] xt_limit: Overflow, try lower: 271964/0 [ 752.247094][T29243] tipc: Started in network mode [ 752.253077][T29243] tipc: Node identity 7e91def6a0ea, cluster identity 4711 [ 752.265054][T29247] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 752.272538][T29247] IPv6: NLM_F_CREATE should be set when creating new route [ 752.281188][T29243] tipc: Enabled bearer , priority 0 [ 752.291503][T29243] syzkaller0: entered promiscuous mode [ 752.297139][T29243] syzkaller0: entered allmulticast mode [ 752.452864][T29255] __nla_validate_parse: 5 callbacks suppressed [ 752.452882][T29255] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6850'. [ 752.614856][T29262] FAULT_INJECTION: forcing a failure. [ 752.614856][T29262] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 752.629972][T29262] CPU: 0 UID: 0 PID: 29262 Comm: syz.4.6852 Not tainted syzkaller #0 PREEMPT(full) [ 752.629998][T29262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 752.630009][T29262] Call Trace: [ 752.630016][T29262] [ 752.630025][T29262] dump_stack_lvl+0xe8/0x150 [ 752.630053][T29262] should_fail_ex+0x412/0x560 [ 752.630080][T29262] _copy_from_iter+0x1d3/0x1670 [ 752.630110][T29262] ? rcu_is_watching+0x15/0xb0 [ 752.630131][T29262] ? __pfx__copy_from_iter+0x10/0x10 [ 752.630149][T29262] ? __kmalloc_node_track_caller_noprof+0x577/0x7f0 [ 752.630176][T29262] ? netlink_sendmsg+0x650/0xb40 [ 752.630194][T29262] ? skb_put+0x11b/0x210 [ 752.630218][T29262] netlink_sendmsg+0x6c0/0xb40 [ 752.630244][T29262] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.630263][T29262] ? aa_sock_msg_perm+0xf1/0x1b0 [ 752.630286][T29262] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 752.630305][T29262] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.630323][T29262] ____sys_sendmsg+0xa68/0xad0 [ 752.630345][T29262] ? __might_fault+0xaf/0x130 [ 752.630374][T29262] ? __pfx_____sys_sendmsg+0x10/0x10 [ 752.630407][T29262] ? import_iovec+0x73/0xa0 [ 752.630436][T29262] ___sys_sendmsg+0x2a5/0x360 [ 752.630458][T29262] ? __lock_acquire+0x6b5/0x2cf0 [ 752.630487][T29262] ? __pfx____sys_sendmsg+0x10/0x10 [ 752.630545][T29262] ? __fget_files+0x2a/0x420 [ 752.630565][T29262] ? __fget_files+0x3a0/0x420 [ 752.630595][T29262] __x64_sys_sendmsg+0x1bd/0x2a0 [ 752.630622][T29262] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 752.630656][T29262] ? __pfx_ksys_write+0x10/0x10 [ 752.630692][T29262] do_syscall_64+0xe2/0xf80 [ 752.630714][T29262] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.630733][T29262] ? trace_irq_disable+0x37/0x100 [ 752.630751][T29262] ? clear_bhb_loop+0x60/0xb0 [ 752.630774][T29262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.630793][T29262] RIP: 0033:0x7f19c759aeb9 [ 752.630812][T29262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 752.630827][T29262] RSP: 002b:00007f19c845d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 752.630849][T29262] RAX: ffffffffffffffda RBX: 00007f19c7815fa0 RCX: 00007f19c759aeb9 [ 752.630863][T29262] RDX: 0000000000000800 RSI: 0000200000000180 RDI: 0000000000000003 [ 752.630876][T29262] RBP: 00007f19c845d090 R08: 0000000000000000 R09: 0000000000000000 [ 752.630888][T29262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 752.630899][T29262] R13: 00007f19c7816038 R14: 00007f19c7815fa0 R15: 00007ffed0ef82c8 [ 752.630930][T29262] [ 754.145713][T29243] tipc: Resetting bearer [ 754.180233][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 754.188370][ C1] lec:lec_tx_timeout: lec0 [ 754.193303][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 754.207574][T29242] tipc: Resetting bearer [ 754.238643][T29283] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6854'. [ 754.252706][T29242] tipc: Disabling bearer [ 754.315491][T29259] syzkaller0: entered promiscuous mode [ 754.331241][T29259] syzkaller0: entered allmulticast mode [ 754.341997][ T5911] tipc: Node number set to 3732659958 [ 754.350702][T14314] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 754.359950][T14314] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 754.487605][T29296] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6856'. [ 754.589709][T29299] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6856'. [ 754.614595][T19038] Bluetooth: hci2: command 0x0406 tx timeout [ 756.505734][T14314] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.514723][T14314] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.524019][T14314] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.534534][T14314] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.560465][T14314] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 756.569487][T14314] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 756.644171][T29309] geneve2: entered promiscuous mode [ 756.649428][T29309] geneve2: entered allmulticast mode [ 756.672679][T29314] xt_hashlimit: size too large, truncated to 1048576 [ 756.688145][T29307] wg1 speed is unknown, defaulting to 1000 [ 756.727261][T29307] xfrm0 speed is unknown, defaulting to 1000 [ 756.737743][T29316] netlink: 'syz.1.6861': attribute type 1 has an invalid length. [ 756.768712][T29316] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6861'. [ 756.793614][T29316] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6861'. [ 756.814202][T29320] bond0: Error: Cannot enslave bond to itself. [ 757.137503][T29335] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 757.156209][T29307] lo speed is unknown, defaulting to 1000 [ 757.163864][T29335] FAULT_INJECTION: forcing a failure. [ 757.163864][T29335] name failslab, interval 1, probability 0, space 0, times 0 [ 757.177081][T29335] CPU: 1 UID: 0 PID: 29335 Comm: syz.1.6869 Not tainted syzkaller #0 PREEMPT(full) [ 757.177106][T29335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 757.177118][T29335] Call Trace: [ 757.177126][T29335] [ 757.177134][T29335] dump_stack_lvl+0xe8/0x150 [ 757.177164][T29335] should_fail_ex+0x412/0x560 [ 757.177192][T29335] should_failslab+0xa8/0x100 [ 757.177213][T29335] __kmalloc_cache_noprof+0x83/0x6e0 [ 757.177232][T29335] ? sctp_add_bind_addr+0x8c/0x370 [ 757.177257][T29335] sctp_add_bind_addr+0x8c/0x370 [ 757.177279][T29335] sctp_copy_local_addr_list+0x314/0x4f0 [ 757.177302][T29335] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 757.177319][T29335] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 757.177340][T29335] ? sctp_v6_is_any+0x64/0x80 [ 757.177359][T29335] ? sctp_copy_one_addr+0x93/0x360 [ 757.177388][T29335] sctp_bind_addr_copy+0xb3/0x3c0 [ 757.177408][T29335] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 757.177436][T29335] sctp_connect_new_asoc+0x2ff/0x6b0 [ 757.177462][T29335] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 757.177491][T29335] ? sctp_get_af_specific+0x29/0x80 [ 757.177508][T29335] ? sctp_inet6_send_verify+0x80/0x300 [ 757.177525][T29335] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 757.177551][T29335] __sctp_connect+0x5cb/0xdc0 [ 757.177584][T29335] ? __pfx___sctp_connect+0x10/0x10 [ 757.177605][T29335] ? security_sctp_bind_connect+0x7e/0x2c0 [ 757.177626][T29335] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 757.177645][T29335] sctp_getsockopt_connectx3+0x227/0x360 [ 757.177663][T29335] ? lock_sock_nested+0x6a/0x100 [ 757.177683][T29335] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 757.177712][T29335] ? __local_bh_enable_ip+0xd0/0x130 [ 757.177735][T29335] sctp_getsockopt+0x984/0xb90 [ 757.177756][T29335] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 757.177778][T29335] do_sock_getsockopt+0x2d3/0x3f0 [ 757.177805][T29335] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 757.177829][T29335] ? __fget_files+0x3a0/0x420 [ 757.177847][T29335] ? __fget_files+0x2a/0x420 [ 757.177874][T29335] __x64_sys_getsockopt+0x1a4/0x240 [ 757.177906][T29335] do_syscall_64+0xe2/0xf80 [ 757.177928][T29335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.177950][T29335] ? trace_irq_disable+0x37/0x100 [ 757.177967][T29335] ? clear_bhb_loop+0x60/0xb0 [ 757.177990][T29335] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.178008][T29335] RIP: 0033:0x7ffa5879aeb9 [ 757.178026][T29335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.178043][T29335] RSP: 002b:00007ffa5969c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 757.178063][T29335] RAX: ffffffffffffffda RBX: 00007ffa58a15fa0 RCX: 00007ffa5879aeb9 [ 757.178077][T29335] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000006 [ 757.178089][T29335] RBP: 00007ffa5969c090 R08: 0000200000000440 R09: 0000000000000000 [ 757.178102][T29335] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000002 [ 757.178114][T29335] R13: 00007ffa58a16038 R14: 00007ffa58a15fa0 R15: 00007ffc9ffa5a88 [ 757.178145][T29335] [ 757.936320][T29352] tipc: Started in network mode [ 757.989480][T29352] tipc: Node identity 028ca71ae703, cluster identity 4711 [ 758.010458][T29352] tipc: Enabled bearer , priority 0 [ 758.040657][T29359] syzkaller0: entered promiscuous mode [ 758.066455][T29363] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6875'. [ 758.100520][T29359] syzkaller0: entered allmulticast mode [ 758.151435][T29367] FAULT_INJECTION: forcing a failure. [ 758.151435][T29367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 758.166087][T29352] sctp: [Deprecated]: syz.3.6874 (pid 29352) Use of int in max_burst socket option deprecated. [ 758.166087][T29352] Use struct sctp_assoc_value instead [ 758.202282][T29367] CPU: 1 UID: 0 PID: 29367 Comm: syz.4.6876 Not tainted syzkaller #0 PREEMPT(full) [ 758.202320][T29367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 758.202331][T29367] Call Trace: [ 758.202338][T29367] [ 758.202346][T29367] dump_stack_lvl+0xe8/0x150 [ 758.202375][T29367] should_fail_ex+0x412/0x560 [ 758.202401][T29367] _copy_to_user+0x31/0xb0 [ 758.202429][T29367] generic_map_lookup_batch+0x88c/0xc70 [ 758.202465][T29367] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 758.202494][T29367] ? __pfx_generic_map_lookup_batch+0x10/0x10 [ 758.202517][T29367] bpf_map_do_batch+0x285/0x630 [ 758.202535][T29367] ? security_bpf+0x7e/0x2d0 [ 758.202555][T29367] __sys_bpf+0x5a0/0x920 [ 758.202572][T29367] ? __pfx___sys_bpf+0x10/0x10 [ 758.202586][T29367] ? kmem_cache_free+0x195/0x610 [ 758.202619][T29367] ? ksys_write+0x1fc/0x270 [ 758.202645][T29367] ? __pfx_ksys_write+0x10/0x10 [ 758.202674][T29367] __x64_sys_bpf+0x7c/0x90 [ 758.202699][T29367] do_syscall_64+0xe2/0xf80 [ 758.202720][T29367] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.202738][T29367] ? trace_irq_disable+0x37/0x100 [ 758.202757][T29367] ? clear_bhb_loop+0x60/0xb0 [ 758.202779][T29367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.202797][T29367] RIP: 0033:0x7f19c759aeb9 [ 758.202814][T29367] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 758.202830][T29367] RSP: 002b:00007f19c845d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 758.202850][T29367] RAX: ffffffffffffffda RBX: 00007f19c7815fa0 RCX: 00007f19c759aeb9 [ 758.202865][T29367] RDX: 0000000000000038 RSI: 0000200000000400 RDI: 0000000000000018 [ 758.202878][T29367] RBP: 00007f19c845d090 R08: 0000000000000000 R09: 0000000000000000 [ 758.202890][T29367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 758.202902][T29367] R13: 00007f19c7816038 R14: 00007f19c7815fa0 R15: 00007ffed0ef82c8 [ 758.202933][T29367] [ 758.468726][T29371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6875'. [ 758.520586][T29365] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6875'. [ 758.623741][T29359] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6874'. [ 758.781505][T29360] tipc: Resetting bearer [ 758.789582][T29351] tipc: Resetting bearer [ 758.813757][T29351] tipc: Disabling bearer [ 758.896680][T29372] lec:lec_atm_close: lec0: Shut down! [ 759.043140][T29394] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6881'. [ 759.704649][T29431] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6881'. [ 760.214669][ T25] block nbd5: Possible stuck request ffff888025950000: control (read@0,1024B). Runtime 60 seconds [ 760.229167][ T25] block nbd5: Possible stuck request ffff888025950200: control (read@1024,1024B). Runtime 60 seconds [ 760.240530][ T25] block nbd5: Possible stuck request ffff888025950400: control (read@2048,1024B). Runtime 60 seconds [ 760.252540][ T25] block nbd5: Possible stuck request ffff888025950600: control (read@3072,1024B). Runtime 60 seconds [ 761.818926][T29509] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6904'. [ 762.096632][T29530] tap0: tun_chr_ioctl cmd 1074812118 [ 762.249068][T29539] netlink: 'syz.1.6913': attribute type 29 has an invalid length. [ 762.276067][T29539] netlink: 'syz.1.6913': attribute type 29 has an invalid length. [ 762.287420][T29539] netlink: 500 bytes leftover after parsing attributes in process `syz.1.6913'. [ 762.309600][T29539] netlink: 'syz.1.6913': attribute type 39 has an invalid length. [ 762.674535][T29548] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6916'. [ 762.685835][T29548] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6916'. [ 762.951816][T14318] ================================================================== [ 762.960376][T14318] BUG: KASAN: use-after-free in __linkwatch_run_queue+0x5be/0x7f0 [ 762.968478][T14318] Read of size 8 at addr ffff8880327e8b90 by task kworker/u8:21/14318 [ 762.976822][T14318] [ 762.979208][T14318] CPU: 0 UID: 0 PID: 14318 Comm: kworker/u8:21 Not tainted syzkaller #0 PREEMPT(full) [ 762.979233][T14318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 762.979245][T14318] Workqueue: events_unbound linkwatch_event [ 762.979274][T14318] Call Trace: [ 762.979281][T14318] [ 762.979289][T14318] dump_stack_lvl+0xe8/0x150 [ 762.979312][T14318] print_report+0xba/0x230 [ 762.979331][T14318] ? __linkwatch_run_queue+0x5be/0x7f0 [ 762.979354][T14318] kasan_report+0x117/0x150 [ 762.979375][T14318] ? __linkwatch_run_queue+0x5be/0x7f0 [ 762.979403][T14318] __linkwatch_run_queue+0x5be/0x7f0 [ 762.979431][T14318] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 762.979458][T14318] ? process_scheduled_works+0xa0f/0x17a0 [ 762.979483][T14318] ? process_scheduled_works+0xa0f/0x17a0 [ 762.979509][T14318] linkwatch_event+0x4c/0x60 [ 762.979532][T14318] process_scheduled_works+0xaec/0x17a0 [ 762.979568][T14318] ? __pfx_process_scheduled_works+0x10/0x10 [ 762.979591][T14318] ? do_raw_spin_lock+0x12b/0x2f0 [ 762.979613][T14318] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 762.979631][T14318] ? schedule+0x90/0x360 [ 762.979653][T14318] worker_thread+0xda6/0x1360 [ 762.979690][T14318] kthread+0x726/0x8b0 [ 762.979711][T14318] ? __pfx_worker_thread+0x10/0x10 [ 762.979737][T14318] ? __pfx_kthread+0x10/0x10 [ 762.979757][T14318] ? _raw_spin_unlock_irq+0x23/0x50 [ 762.979776][T14318] ? __pfx_kthread+0x10/0x10 [ 762.979795][T14318] ret_from_fork+0x51b/0xa40 [ 762.979823][T14318] ? __pfx_ret_from_fork+0x10/0x10 [ 762.979848][T14318] ? __switch_to+0xc82/0x1410 [ 762.979873][T14318] ? __pfx_kthread+0x10/0x10 [ 762.979893][T14318] ret_from_fork_asm+0x1a/0x30 [ 762.979979][T14318] [ 762.979987][T14318] [ 763.151187][T14318] The buggy address belongs to the physical page: [ 763.157633][T14318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880327ea700 pfn:0x327e8 [ 763.167776][T14318] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 763.174880][T14318] raw: 00fff00000000000 ffffea0002014108 ffff8880b8640c00 0000000000000000 [ 763.183482][T14318] raw: ffff8880327ea700 0000000000000000 00000000ffffffff 0000000000000000 [ 763.192333][T14318] page dumped because: kasan: bad access detected [ 763.198849][T14318] page_owner tracks the page as freed [ 763.204203][T14318] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x446dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 29528, tgid 29525 (syz.2.6908), ts 762015835725, free_ts 762951307074 [ 763.226433][T14318] post_alloc_hook+0x228/0x280 [ 763.231249][T14318] get_page_from_freelist+0x24dc/0x2580 [ 763.236983][T14318] __alloc_frozen_pages_noprof+0x18d/0x380 [ 763.242889][T14318] alloc_pages_mpol+0x232/0x4a0 [ 763.248458][T14318] ___kmalloc_large_node+0x4e/0x150 [ 763.253756][T14318] __kmalloc_large_node_noprof+0x18/0x90 [ 763.259420][T14318] __kvmalloc_node_noprof+0x6e/0x8d0 [ 763.264697][T14318] alloc_netdev_mqs+0xa6/0x11b0 [ 763.269571][T14318] tun_set_iff+0x532/0xf00 [ 763.274059][T14318] __tun_chr_ioctl+0x7bb/0x1e10 [ 763.278913][T14318] __se_sys_ioctl+0xfc/0x170 [ 763.283516][T14318] do_syscall_64+0xe2/0xf80 [ 763.288418][T14318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.294946][T14318] page last free pid 29525 tgid 29525 stack trace: [ 763.301528][T14318] __free_frozen_pages+0xbf8/0xd70 [ 763.306654][T14318] device_release+0x9e/0x1d0 [ 763.311350][T14318] kobject_put+0x228/0x560 [ 763.316472][T14318] netdev_run_todo+0xc75/0xde0 [ 763.321402][T14318] tun_chr_close+0x13c/0x1c0 [ 763.326269][T14318] __fput+0x44f/0xa70 [ 763.330357][T14318] task_work_run+0x1d9/0x270 [ 763.335151][T14318] exit_to_user_mode_loop+0xed/0x480 [ 763.340436][T14318] do_syscall_64+0x2b7/0xf80 [ 763.345039][T14318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.352070][T14318] [ 763.354481][T14318] Memory state around the buggy address: [ 763.360527][T14318] ffff8880327e8a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 763.368628][T14318] ffff8880327e8b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 763.376857][T14318] >ffff8880327e8b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 763.385010][T14318] ^ [ 763.389621][T14318] ffff8880327e8c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 763.397846][T14318] ffff8880327e8c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 763.405994][T14318] ================================================================== [ 763.429460][ T5202] udevd[5202]: worker [26873] /devices/virtual/block/nbd5 is taking a long time [ 763.481137][T14318] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 763.488380][T14318] CPU: 0 UID: 0 PID: 14318 Comm: kworker/u8:21 Not tainted syzkaller #0 PREEMPT(full) [ 763.498025][T14318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 763.508359][T14318] Workqueue: events_unbound linkwatch_event [ 763.514732][T14318] Call Trace: [ 763.518028][T14318] [ 763.520973][T14318] vpanic+0x1e0/0x670 [ 763.524996][T14318] panic+0xc5/0xd0 [ 763.528742][T14318] ? __pfx_panic+0x10/0x10 [ 763.533267][T14318] ? preempt_schedule_thunk+0x16/0x30 [ 763.538734][T14318] ? __linkwatch_run_queue+0x5be/0x7f0 [ 763.544226][T14318] check_panic_on_warn+0x89/0xb0 [ 763.549166][T14318] ? __linkwatch_run_queue+0x5be/0x7f0 [ 763.554617][T14318] end_report+0x6f/0x140 [ 763.559038][T14318] kasan_report+0x128/0x150 [ 763.563573][T14318] ? __linkwatch_run_queue+0x5be/0x7f0 [ 763.569041][T14318] __linkwatch_run_queue+0x5be/0x7f0 [ 763.574526][T14318] ? __pfx___linkwatch_run_queue+0x10/0x10 [ 763.580460][T14318] ? process_scheduled_works+0xa0f/0x17a0 [ 763.586238][T14318] ? process_scheduled_works+0xa0f/0x17a0 [ 763.592266][T14318] linkwatch_event+0x4c/0x60 [ 763.596888][T14318] process_scheduled_works+0xaec/0x17a0 [ 763.602976][T14318] ? __pfx_process_scheduled_works+0x10/0x10 [ 763.609143][T14318] ? do_raw_spin_lock+0x12b/0x2f0 [ 763.614357][T14318] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 763.619807][T14318] ? schedule+0x90/0x360 [ 763.624113][T14318] worker_thread+0xda6/0x1360 [ 763.628802][T14318] kthread+0x726/0x8b0 [ 763.632889][T14318] ? __pfx_worker_thread+0x10/0x10 [ 763.638002][T14318] ? __pfx_kthread+0x10/0x10 [ 763.642593][T14318] ? _raw_spin_unlock_irq+0x23/0x50 [ 763.647810][T14318] ? __pfx_kthread+0x10/0x10 [ 763.652419][T14318] ret_from_fork+0x51b/0xa40 [ 763.657059][T14318] ? __pfx_ret_from_fork+0x10/0x10 [ 763.662450][T14318] ? __switch_to+0xc82/0x1410 [ 763.667197][T14318] ? __pfx_kthread+0x10/0x10 [ 763.671886][T14318] ret_from_fork_asm+0x1a/0x30 [ 763.676667][T14318] [ 763.680368][T14318] Kernel Offset: disabled [ 763.684797][T14318] Rebooting in 86400 seconds..