last executing test programs: 1m29.620237877s ago: executing program 0 (id=14281): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x24, 0x41, 0x1, 0x80002, 0x4, {0x1}, [@nested={0x4, 0xcb}, @typed={0xc, 0x2, 0x0, 0x0, @u64=0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 1m29.44297004s ago: executing program 0 (id=14286): setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000380)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000004c0)={0x0, 0x0, 0x20}, 0xc) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0xf, &(0x7f0000000540)=[{&(0x7f0000000580)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) 1m29.37647652s ago: executing program 3 (id=14287): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000002c0), 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000380)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) 1m29.335114317s ago: executing program 2 (id=14289): close(0xffffffffffffffff) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000100)="1a00000002000000", 0x8) setsockopt(r0, 0x84, 0x80, &(0x7f0000000140)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r0, &(0x7f00000001c0)="c3", 0x1, 0x40811, &(0x7f0000000200)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) write(r0, &(0x7f0000000240)="b4dbb0", 0x3) 1m29.170801688s ago: executing program 0 (id=14293): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x6}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000034c0), 0x0, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f00000003c0), 0x4) 1m29.169285878s ago: executing program 3 (id=14294): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x28, r1, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20008080) 1m29.039416353s ago: executing program 2 (id=14296): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x2c, 0x41, 0x1, 0x80002, 0x4, {0x1}, [@nested={0x4, 0xcb}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64=0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 1m28.962565128s ago: executing program 0 (id=14298): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f0000000080), 0x10) recvfrom$l2tp(r0, 0x0, 0x0, 0x20, 0x0, 0x0) 1m28.920010991s ago: executing program 3 (id=14299): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, &(0x7f0000000100)="1a00000002000000", 0x8) setsockopt(r1, 0x84, 0x80, &(0x7f0000000140)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="c3", 0x1, 0x40811, &(0x7f0000000200)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) write(r1, &(0x7f0000000240)="b4dbb0", 0x3) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0xd, @loopback, 0xe91}}}, 0x84) 1m28.876875086s ago: executing program 1 (id=14300): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) 1m28.851173468s ago: executing program 2 (id=14301): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000140)="2803202e0500140000007ef506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67bee78895e", 0x3c, 0x400c010, &(0x7f0000000080)={0x11, 0x3, r1, 0x1, 0xe5, 0x6, @random="76caa646ae4c"}, 0x14) 1m28.778204413s ago: executing program 4 (id=14302): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newqdisc={0x5c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x2c, 0x2, {{0x1, 0x5c05, 0x8, 0x10000, 0x7a1, 0x8}, [@TCA_NETEM_CORR={0x10, 0x1, {0x6, 0x1, 0x2}}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000001240)={&(0x7f0000001280)=@xdp={0x2c, 0x8, r2, 0x109}, 0x80, &(0x7f0000001300)=[{&(0x7f0000001340)='k', 0x1}], 0x1}, 0x20000885) 1m28.76880233s ago: executing program 2 (id=14303): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, &(0x7f0000005280)=[{{0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {&(0x7f0000000180)=""/244, 0xf4}], 0x2}, 0x10009}], 0x1, 0x10000, 0x0) 1m28.701058099s ago: executing program 3 (id=14304): setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000380)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000004c0)={0x0, 0x0, 0x20}, 0xc) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0xf, &(0x7f0000000540)=[{&(0x7f0000000580)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) 1m28.686004451s ago: executing program 1 (id=14305): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) syz_emit_ethernet(0x52, &(0x7f0000000440)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x1c, 0x6, 0xff, @local, @local, {[], {{0x4e21, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}, @mptcp=@ack={0x1e, 0x4, 0x42, 0x1}]}}}}}}}}, 0x0) 1m28.599057784s ago: executing program 4 (id=14306): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x81, 0x0, 0x0) setsockopt(r1, 0x84, 0x80, &(0x7f0000000140)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000001c0)="c3", 0x1, 0x40811, &(0x7f0000000200)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) write(r1, &(0x7f0000000240)="b4dbb0", 0x3) 1m28.440818158s ago: executing program 4 (id=14307): syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001"], 0x0) syz_emit_ethernet(0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd608a27f2000f2c00fe8000000000000000000000000000bbfe8000"/51], 0x0) 1m28.44042045s ago: executing program 3 (id=14308): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) bind$inet6(r0, 0x0, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x4, 0x1001}}}}}}}, 0x0) 1m28.433586565s ago: executing program 1 (id=14309): socket$inet(0x2, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x0, 0x7}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000003c0)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) 1m28.258878537s ago: executing program 4 (id=14310): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0x4e20, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @remote}, 0x1}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendto$inet6(r0, 0x0, 0x0, 0x2404c804, 0x0, 0x0) 1m28.210049566s ago: executing program 1 (id=14311): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x2c, 0x41, 0x1, 0x80002, 0x4, {0x1}, [@nested={0x4, 0xcb}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64=0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) 1m27.9946313s ago: executing program 0 (id=14312): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x200000c0}, 0x4008070) 1m27.986110835s ago: executing program 1 (id=14313): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x80000001, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000140)="2803202e0500140000007ef506be00000000000000000000000000143baa111f1f858ce632f47042195eb3cf545a41b6d78839980700e67bee78895e", 0x3c, 0x400c010, &(0x7f0000000080)={0x11, 0x3, r1, 0x1, 0xe5, 0x6, @random="76caa646ae4c"}, 0x14) 1m27.770091102s ago: executing program 4 (id=14314): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x6, 0xa, 0x4, 0x1, 0x6, 0x0, 0x0, 0x8, 0x80, 0x8, 0x0, 0x0, 0x0, 0x4}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}]}, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000040)={0x401, 0x8009, 0x2, 0x3, r1}, &(0x7f00000000c0)=0x10) 1m27.76282407s ago: executing program 2 (id=14315): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001a00010029bd7000fcdbdf250a000000", @ANYRES32=0x0, @ANYBLOB="080000251400030007000000fe52ffbf080000ff0000000014"], 0x44}, 0x1, 0x0, 0x0, 0x1bc396b6b0f08b88}, 0x20000000) 1m27.740920752s ago: executing program 0 (id=14316): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newqdisc={0x5c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x2c, 0x2, {{0x1, 0x5c05, 0x8, 0x10000, 0x7a1, 0x8}, [@TCA_NETEM_CORR={0x10, 0x1, {0x6, 0x1, 0x2}}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000001240)={&(0x7f0000001280)=@xdp={0x2c, 0x8, r2, 0x109}, 0x80, &(0x7f0000001300)=[{&(0x7f0000001340)='k', 0x1}], 0x1}, 0x20000885) 1m27.626850324s ago: executing program 1 (id=14317): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x44, 0x0, "84f4ba9d18d04959917303b5758777b29cf7bbe1e7b68fe581abb22e3a33da2ae9bc6534624e6b6adc4e6eb25906892d8f0aa71dce32959c5860a717c10d9bb959c1cd7a5a11441fe6acb1029bbb4b01"}, 0xd8) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0xce, 0x4) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140)=0x4, 0x4) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1, 0x0, 0x2000000000000}, 0x700) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) 1m27.457499804s ago: executing program 4 (id=14318): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="98030000", @ANYRES16=r1, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r3, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c090000560333"], 0x398}}, 0x0) 1m27.455332023s ago: executing program 2 (id=14319): setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e20, @local}]}, &(0x7f0000000380)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000400)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000004c0)={0x0, 0x0, 0x20}, 0xc) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0xf, &(0x7f0000000540)=[{&(0x7f0000000580)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) 1m18.944658642s ago: executing program 3 (id=14320): syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001"], 0x0) syz_emit_ethernet(0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd608a27f2000f2c00fe8000000000000000000000000000bbfe8000"/51], 0x0) 0s ago: executing program 32 (id=14316): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newqdisc={0x5c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x2c, 0x2, {{0x1, 0x5c05, 0x8, 0x10000, 0x7a1, 0x8}, [@TCA_NETEM_CORR={0x10, 0x1, {0x6, 0x1, 0x2}}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r6, &(0x7f0000001240)={&(0x7f0000001280)=@xdp={0x2c, 0x8, r2, 0x109}, 0x80, &(0x7f0000001300)=[{&(0x7f0000001340)='k', 0x1}], 0x1}, 0x20000885) kernel console output (not intermixed with test programs): dev_mqs+0xc4a/0x1240 [ 1500.072631][T17652] netdev_alloc_config+0x4f/0xc0 [ 1500.072656][T17652] alloc_netdev_mqs+0xc84/0x1240 [ 1500.072687][T17652] rtnl_create_link+0x321/0xd70 [ 1500.072748][T17652] rtnl_newlink_create+0x258/0x7b0 [ 1500.072776][T17652] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1500.072804][T17652] ? __pfx___mutex_lock+0x10/0x10 [ 1500.072841][T17652] ? ns_capable+0x89/0xe0 [ 1500.072872][T17652] rtnl_newlink+0x167a/0x1c30 [ 1500.072908][T17652] ? __pfx_rtnl_newlink+0x10/0x10 [ 1500.072933][T17652] ? finish_task_switch+0x40e/0xc60 [ 1500.072987][T17652] ? lockdep_hardirqs_on+0x7b/0x110 [ 1500.073013][T17652] ? rcu_is_watching+0x16/0xb0 [ 1500.073038][T17652] ? trace_sched_exit_tp+0x3a/0x130 [ 1500.073063][T17652] ? __schedule+0x17f1/0x58f0 [ 1500.073106][T17652] ? kasan_quarantine_put+0xbb/0x1f0 [ 1500.073134][T17652] ? __pfx___schedule+0x10/0x10 [ 1500.073154][T17652] ? nlmon_xmit+0xb0/0x100 [ 1500.073191][T17652] ? __lock_acquire+0x747/0x2de0 [ 1500.073218][T17652] ? preempt_schedule_common+0x7f/0xd0 [ 1500.073241][T17652] ? __dev_queue_xmit+0x29b/0x3920 [ 1500.073263][T17652] ? preempt_schedule_thunk+0x16/0x40 [ 1500.073318][T17652] ? __pfx_rtnl_newlink+0x10/0x10 [ 1500.073335][T17652] rtnetlink_rcv_msg+0x802/0xc00 [ 1500.073368][T17652] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1500.073396][T17652] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1500.073428][T17652] ? __copy_skb_header+0xa3/0x4a0 [ 1500.073460][T17652] netlink_rcv_skb+0x226/0x4a0 [ 1500.073487][T17652] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1500.073518][T17652] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1500.073568][T17652] netlink_unicast+0x7bd/0x940 [ 1500.073602][T17652] netlink_sendmsg+0x813/0xb40 [ 1500.073637][T17652] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1500.073671][T17652] ? apparmor_socket_sendmsg+0x98/0x360 [ 1500.073705][T17652] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1500.073729][T17652] sock_sendmsg_nosec+0x14e/0x190 [ 1500.073757][T17652] ____sys_sendmsg+0x54e/0x850 [ 1500.073783][T17652] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1500.073814][T17652] ? import_iovec+0x73/0xa0 [ 1500.073845][T17652] ___sys_sendmsg+0x2a5/0x360 [ 1500.073863][T17652] ? __lock_acquire+0x747/0x2de0 [ 1500.073888][T17652] ? __pfx____sys_sendmsg+0x10/0x10 [ 1500.073946][T17652] ? __fget_files+0x2a/0x420 [ 1500.073973][T17652] ? __fget_files+0x3a2/0x420 [ 1500.074010][T17652] __x64_sys_sendmsg+0x1b1/0x290 [ 1500.074033][T17652] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1500.074076][T17652] do_syscall_64+0x166/0x520 [ 1500.074100][T17652] ? trace_irq_disable+0x3b/0x140 [ 1500.074120][T17652] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.074140][T17652] ? clear_bhb_loop+0x70/0xc0 [ 1500.074164][T17652] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1500.074183][T17652] RIP: 0033:0x7fdf54b9e559 [ 1500.074201][T17652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1500.074216][T17652] RSP: 002b:00007fdf559cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1500.074237][T17652] RAX: ffffffffffffffda RBX: 00007fdf54e25fa0 RCX: 00007fdf54b9e559 [ 1500.074251][T17652] RDX: 0000000000000000 RSI: 0000200000001880 RDI: 0000000000000004 [ 1500.074263][T17652] RBP: 00007fdf559cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1500.074275][T17652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1500.074287][T17652] R13: 00007fdf54e26038 R14: 00007fdf54e25fa0 R15: 00007fffdb9e3538 [ 1500.074319][T17652] [ 1500.267690][T17654] macvlan4: entered allmulticast mode [ 1500.304431][T17654] openvswitch: netlink: IP tunnel TTL not specified. [ 1500.304461][T17654] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1500.374354][T17659] openvswitch: netlink: IP tunnel dst address not specified [ 1500.581739][T17594] virt_wifi0 speed is unknown, defaulting to 1000 [ 1500.595083][T17594] dummy0 speed is unknown, defaulting to 1000 [ 1501.363229][T17680] __nla_validate_parse: 66 callbacks suppressed [ 1501.363250][T17680] netlink: 332 bytes leftover after parsing attributes in process `syz.3.12989'. [ 1501.363313][T17680] netlink: 'syz.3.12989': attribute type 9 has an invalid length. [ 1501.363327][T17680] netlink: 108 bytes leftover after parsing attributes in process `syz.3.12989'. [ 1501.363341][T17680] netlink: 32 bytes leftover after parsing attributes in process `syz.3.12989'. [ 1501.366360][T17680] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1501.624107][T17633] lo speed is unknown, defaulting to 1000 [ 1502.192641][T17633] virt_wifi0 speed is unknown, defaulting to 1000 [ 1502.195401][T17693] syzkaller1: entered promiscuous mode [ 1502.195421][T17693] syzkaller1: entered allmulticast mode [ 1502.221096][T17633] dummy0 speed is unknown, defaulting to 1000 [ 1502.221870][T17693] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1502.807645][T17699] tipc: Enabled bearer , priority 0 [ 1502.958735][T17706] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12997'. [ 1503.085894][T17699] syzkaller0: entered promiscuous mode [ 1503.085919][T17699] syzkaller0: entered allmulticast mode [ 1503.086455][T17699] tipc: Resetting bearer [ 1503.168980][ T3270] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1503.169048][ T3270] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1503.169081][ T3270] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1503.169110][ T3270] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1503.707394][T17698] tipc: Resetting bearer [ 1504.030444][T17722] FAULT_INJECTION: forcing a failure. [ 1504.030444][T17722] name failslab, interval 1, probability 0, space 0, times 0 [ 1504.030477][T17722] CPU: 0 UID: 0 PID: 17722 Comm: syz.3.13004 Not tainted syzkaller #0 PREEMPT(full) [ 1504.030499][T17722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1504.030511][T17722] Call Trace: [ 1504.030519][T17722] [ 1504.030528][T17722] dump_stack_lvl+0xe8/0x150 [ 1504.030559][T17722] should_fail_ex+0x410/0x560 [ 1504.030590][T17722] should_failslab+0xa8/0x100 [ 1504.030620][T17722] __kmalloc_noprof+0xfe/0x720 [ 1504.030640][T17722] ? rcu_is_watching+0x16/0xb0 [ 1504.030663][T17722] ? tomoyo_realpath_from_path+0xef/0x640 [ 1504.030691][T17722] ? tomoyo_realpath_from_path+0xef/0x640 [ 1504.030725][T17722] tomoyo_realpath_from_path+0xef/0x640 [ 1504.030762][T17722] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1504.030787][T17722] tomoyo_path_number_perm+0x246/0x5f0 [ 1504.030814][T17722] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1504.030837][T17722] ? __lock_acquire+0x747/0x2de0 [ 1504.030873][T17722] ? hook_file_ioctl+0x1f2/0x600 [ 1504.030919][T17722] ? __fget_files+0x2a/0x420 [ 1504.030950][T17722] ? __fget_files+0x2a/0x420 [ 1504.030975][T17722] ? __fget_files+0x3a2/0x420 [ 1504.031000][T17722] ? __fget_files+0x2a/0x420 [ 1504.031031][T17722] security_file_ioctl+0xc3/0x2a0 [ 1504.031057][T17722] __se_sys_ioctl+0x47/0x170 [ 1504.031083][T17722] do_syscall_64+0x166/0x520 [ 1504.031107][T17722] ? trace_irq_disable+0x3b/0x140 [ 1504.031127][T17722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1504.031147][T17722] ? clear_bhb_loop+0x70/0xc0 [ 1504.031171][T17722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1504.031190][T17722] RIP: 0033:0x7fdc3f39e559 [ 1504.031207][T17722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1504.031223][T17722] RSP: 002b:00007fdc401b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1504.031243][T17722] RAX: ffffffffffffffda RBX: 00007fdc3f626090 RCX: 00007fdc3f39e559 [ 1504.031258][T17722] RDX: 0000200000000100 RSI: 0000000040047451 RDI: 0000000000000003 [ 1504.031271][T17722] RBP: 00007fdc401b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1504.031283][T17722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1504.031294][T17722] R13: 00007fdc3f626128 R14: 00007fdc3f626090 R15: 00007ffe2951ab68 [ 1504.031326][T17722] [ 1504.031448][T17722] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1507.113757][T17698] tipc: Disabling bearer [ 1507.557788][T17743] SET target dimension over the limit! [ 1507.569790][T17743] netlink: 'syz.0.13008': attribute type 1 has an invalid length. [ 1507.569810][T17743] A link change request failed with some changes committed already. Interface veth0_virt_wifi may have been left with an inconsistent configuration, please check. [ 1507.788565][T17751] IPVS: Error connecting to the multicast addr [ 1507.891200][T17757] veth0: mtu less than device minimum [ 1508.073018][T17763] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13021'. [ 1508.482689][T17774] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13026'. [ 1508.741508][T17788] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13031'. [ 1508.974444][T17794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.13033'. [ 1508.974466][T17794] netlink: 580 bytes leftover after parsing attributes in process `syz.3.13033'. [ 1509.028828][T17794] netlink: 36 bytes leftover after parsing attributes in process `syz.3.13033'. [ 1509.075951][T17800] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13033'. [ 1509.158180][T17793] bond28: (slave macvlan3): Error -22 calling dev_set_mtu [ 1509.475003][T17808] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13039'. [ 1509.657861][T17817] netlink: 24 bytes leftover after parsing attributes in process `syz.2.13042'. [ 1509.685474][T17819] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13043'. [ 1510.527846][T17836] openvswitch: netlink: Key type 4128 is out of range max 32 [ 1510.752819][T17835] tc_dump_action: action bad kind [ 1511.009332][T17843] FAULT_INJECTION: forcing a failure. [ 1511.009332][T17843] name failslab, interval 1, probability 0, space 0, times 0 [ 1511.009364][T17843] CPU: 1 UID: 0 PID: 17843 Comm: syz.2.13053 Not tainted syzkaller #0 PREEMPT(full) [ 1511.009385][T17843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1511.009397][T17843] Call Trace: [ 1511.009405][T17843] [ 1511.009414][T17843] dump_stack_lvl+0xe8/0x150 [ 1511.009446][T17843] should_fail_ex+0x410/0x560 [ 1511.009478][T17843] should_failslab+0xa8/0x100 [ 1511.009505][T17843] __kmalloc_noprof+0xfe/0x720 [ 1511.009527][T17843] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1511.009545][T17843] ? ipv6_flowlabel_opt+0x104d/0x2b10 [ 1511.009709][T17843] ? ipv6_flowlabel_opt+0x104d/0x2b10 [ 1511.009739][T17843] ipv6_flowlabel_opt+0x104d/0x2b10 [ 1511.009775][T17843] ? __pfx_ipv6_flowlabel_opt+0x10/0x10 [ 1511.009821][T17843] ? do_raw_spin_lock+0x12b/0x2f0 [ 1511.009874][T17843] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1511.009905][T17843] ? do_ipv6_setsockopt+0x956/0x2960 [ 1511.009959][T17843] ? __local_bh_enable_ip+0xd6/0x140 [ 1511.009990][T17843] do_ipv6_setsockopt+0x9cb/0x2960 [ 1511.010018][T17843] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 1511.010048][T17843] ? aa_inet_opt_perm+0xae4/0xcf0 [ 1511.010073][T17843] ? get_pid_task+0x20/0x1f0 [ 1511.010099][T17843] ? __pfx_aa_inet_opt_perm+0x10/0x10 [ 1511.010142][T17843] ? ksys_write+0x1e6/0x270 [ 1511.010170][T17843] ? lock_acquire+0x115/0x350 [ 1511.010200][T17843] ? aa_sock_opt_perm+0xe1/0x1e0 [ 1511.010231][T17843] ipv6_setsockopt+0x59/0x170 [ 1511.010253][T17843] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1511.010281][T17843] do_sock_setsockopt+0x17c/0x1b0 [ 1511.010306][T17843] __x64_sys_setsockopt+0x13d/0x1b0 [ 1511.010331][T17843] do_syscall_64+0x166/0x520 [ 1511.010355][T17843] ? trace_irq_disable+0x3b/0x140 [ 1511.010375][T17843] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.010394][T17843] ? clear_bhb_loop+0x70/0xc0 [ 1511.010418][T17843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1511.010437][T17843] RIP: 0033:0x7f7bdbd9e559 [ 1511.010455][T17843] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1511.010471][T17843] RSP: 002b:00007f7bdcd43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1511.010492][T17843] RAX: ffffffffffffffda RBX: 00007f7bdc025fa0 RCX: 00007f7bdbd9e559 [ 1511.010506][T17843] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000003 [ 1511.010517][T17843] RBP: 00007f7bdcd43090 R08: 0000000000000023 R09: 0000000000000000 [ 1511.010529][T17843] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 1511.010540][T17843] R13: 00007f7bdc026038 R14: 00007f7bdc025fa0 R15: 00007ffd63e3b408 [ 1511.010573][T17843] [ 1514.866236][T17933] syzkaller0: MTU not usable for tipc bearer [ 1514.866274][T17933] tipc: Enabling of bearer rejected, failed to enable media [ 1514.866905][T17933] syzkaller0: entered promiscuous mode [ 1514.866922][T17933] syzkaller0: entered allmulticast mode [ 1514.920588][T17929] syzkaller0: mtu less than device minimum [ 1515.124874][T17946] netlink: 'syz.1.13089': attribute type 3 has an invalid length. [ 1515.124895][T17946] __nla_validate_parse: 2 callbacks suppressed [ 1515.124906][T17946] netlink: 3 bytes leftover after parsing attributes in process `syz.1.13089'. [ 1515.912872][T17962] netlink: 'syz.3.13094': attribute type 3 has an invalid length. [ 1515.912893][T17962] netlink: 3 bytes leftover after parsing attributes in process `syz.3.13094'. [ 1515.913053][T17962] FAULT_INJECTION: forcing a failure. [ 1515.913053][T17962] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1515.913078][T17962] CPU: 1 UID: 0 PID: 17962 Comm: syz.3.13094 Not tainted syzkaller #0 PREEMPT(full) [ 1515.913099][T17962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1515.913110][T17962] Call Trace: [ 1515.913118][T17962] [ 1515.913126][T17962] dump_stack_lvl+0xe8/0x150 [ 1515.913156][T17962] should_fail_ex+0x410/0x560 [ 1515.913186][T17962] _copy_from_user+0x2d/0xb0 [ 1515.913215][T17962] kstrtouint_from_user+0xd6/0x180 [ 1515.913242][T17962] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1515.913274][T17962] ? lock_acquire+0x115/0x350 [ 1515.913300][T17962] proc_fail_nth_write+0x8e/0x210 [ 1515.913326][T17962] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1515.913356][T17962] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1515.913377][T17962] vfs_write+0x296/0xba0 [ 1515.913406][T17962] ? __pfx_vfs_write+0x10/0x10 [ 1515.913428][T17962] ? __fget_files+0x2a/0x420 [ 1515.913460][T17962] ? __fget_files+0x3a2/0x420 [ 1515.913486][T17962] ? __fget_files+0x2a/0x420 [ 1515.913523][T17962] ksys_write+0x150/0x270 [ 1515.913545][T17962] ? __pfx_ksys_write+0x10/0x10 [ 1515.913586][T17962] do_syscall_64+0x166/0x520 [ 1515.913611][T17962] ? trace_irq_disable+0x3b/0x140 [ 1515.913631][T17962] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1515.913651][T17962] ? clear_bhb_loop+0x70/0xc0 [ 1515.913675][T17962] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1515.913694][T17962] RIP: 0033:0x7fdc3f35ed8e [ 1515.913713][T17962] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1515.913728][T17962] RSP: 002b:00007fdc401d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1515.913748][T17962] RAX: ffffffffffffffda RBX: 00007fdc401d56c0 RCX: 00007fdc3f35ed8e [ 1515.913763][T17962] RDX: 0000000000000001 RSI: 00007fdc401d50a0 RDI: 0000000000000004 [ 1515.913775][T17962] RBP: 00007fdc401d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1515.913787][T17962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1515.913798][T17962] R13: 00007fdc3f626038 R14: 00007fdc3f625fa0 R15: 00007ffe2951ab68 [ 1515.913847][T17962] [ 1516.525664][T17979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13102'. [ 1516.667825][T17987] ip_tables: iptables: counters copy to user failed while replacing table [ 1517.051952][T17993] rxe_eth0 speed is unknown, defaulting to 1000 [ 1517.590972][T17993] lo speed is unknown, defaulting to 1000 [ 1517.759285][T18009] netlink: 'syz.2.13109': attribute type 6 has an invalid length. [ 1517.759308][T18009] IPv6: NLM_F_CREATE should be specified when creating new route [ 1518.108804][T17993] virt_wifi0 speed is unknown, defaulting to 1000 [ 1518.112861][T17993] dummy0 speed is unknown, defaulting to 1000 [ 1518.415971][T18029] netlink: 'syz.3.13116': attribute type 1 has an invalid length. [ 1518.586731][T18029] 8021q: adding VLAN 0 to HW filter on device bond18 [ 1518.602012][T18033] tipc: Enabling of bearer rejected, already enabled [ 1519.724747][T18066] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13129'. [ 1520.041899][T18078] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13134'. [ 1520.063961][T18078] Set syz0 is full, maxelem 0 reached [ 1520.091300][T18081] netlink: 100 bytes leftover after parsing attributes in process `syz.3.13135'. [ 1520.286803][T18081] rxe_eth0 speed is unknown, defaulting to 1000 [ 1520.300860][T18088] FAULT_INJECTION: forcing a failure. [ 1520.300860][T18088] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1520.300889][T18088] CPU: 0 UID: 0 PID: 18088 Comm: syz.2.13137 Not tainted syzkaller #0 PREEMPT(full) [ 1520.300910][T18088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1520.300921][T18088] Call Trace: [ 1520.300929][T18088] [ 1520.300938][T18088] dump_stack_lvl+0xe8/0x150 [ 1520.300969][T18088] should_fail_ex+0x410/0x560 [ 1520.300999][T18088] _copy_from_user+0x2d/0xb0 [ 1520.301028][T18088] udp_lib_setsockopt+0x1f8/0x6b0 [ 1520.301135][T18088] ? __pfx_udp_lib_setsockopt+0x10/0x10 [ 1520.301161][T18088] ? aa_sock_opt_perm+0xe1/0x1e0 [ 1520.301199][T18088] udpv6_setsockopt+0x67/0xb0 [ 1520.301220][T18088] ? __pfx_udp_v6_push_pending_frames+0x10/0x10 [ 1520.301240][T18088] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1520.301270][T18088] do_sock_setsockopt+0x17c/0x1b0 [ 1520.301294][T18088] __x64_sys_setsockopt+0x13d/0x1b0 [ 1520.301319][T18088] do_syscall_64+0x166/0x520 [ 1520.301343][T18088] ? trace_irq_disable+0x3b/0x140 [ 1520.301363][T18088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1520.301382][T18088] ? clear_bhb_loop+0x70/0xc0 [ 1520.301406][T18088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1520.301424][T18088] RIP: 0033:0x7f7bdbd9e559 [ 1520.301442][T18088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1520.301457][T18088] RSP: 002b:00007f7bdcd43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1520.301477][T18088] RAX: ffffffffffffffda RBX: 00007f7bdc025fa0 RCX: 00007f7bdbd9e559 [ 1520.301491][T18088] RDX: 0000000000000067 RSI: 0000000000000011 RDI: 0000000000000004 [ 1520.301503][T18088] RBP: 00007f7bdcd43090 R08: 0000000000000004 R09: 0000000000000000 [ 1520.301515][T18088] R10: 0000200000000640 R11: 0000000000000246 R12: 0000000000000001 [ 1520.301527][T18088] R13: 00007f7bdc026038 R14: 00007f7bdc025fa0 R15: 00007ffd63e3b408 [ 1520.301559][T18088] [ 1521.044170][T18109] netlink: 10 bytes leftover after parsing attributes in process `syz.2.13140'. [ 1521.213468][T18081] lo speed is unknown, defaulting to 1000 [ 1521.373492][T18115] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13143'. [ 1521.505460][T18081] virt_wifi0 speed is unknown, defaulting to 1000 [ 1521.508227][T18081] dummy0 speed is unknown, defaulting to 1000 [ 1521.999744][T18130] netlink: 20 bytes leftover after parsing attributes in process `syz.0.13148'. [ 1522.000999][T18130] Set syz0 is full, maxelem 0 reached [ 1523.048084][T18150] netlink: 100 bytes leftover after parsing attributes in process `syz.0.13157'. [ 1523.131224][T18150] rxe_eth0 speed is unknown, defaulting to 1000 [ 1523.366808][T18158] netlink: 'syz.1.13159': attribute type 11 has an invalid length. [ 1523.516155][T18159] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13160'. [ 1523.818526][T18166] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13164'. [ 1523.862974][T18150] lo speed is unknown, defaulting to 1000 [ 1524.543877][T18150] virt_wifi0 speed is unknown, defaulting to 1000 [ 1524.545531][T18150] dummy0 speed is unknown, defaulting to 1000 [ 1524.659719][T18193] netlink: 'syz.3.13170': attribute type 1 has an invalid length. [ 1524.786013][T18196] netlink: 'syz.3.13172': attribute type 11 has an invalid length. [ 1525.211214][T18208] netlink: 20 bytes leftover after parsing attributes in process `syz.1.13174'. [ 1525.337654][T18215] FAULT_INJECTION: forcing a failure. [ 1525.337654][T18215] name failslab, interval 1, probability 0, space 0, times 0 [ 1525.337685][T18215] CPU: 0 UID: 0 PID: 18215 Comm: syz.4.13178 Not tainted syzkaller #0 PREEMPT(full) [ 1525.337704][T18215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1525.337715][T18215] Call Trace: [ 1525.337722][T18215] [ 1525.337731][T18215] dump_stack_lvl+0xe8/0x150 [ 1525.337762][T18215] should_fail_ex+0x410/0x560 [ 1525.337794][T18215] should_failslab+0xa8/0x100 [ 1525.337821][T18215] __kmalloc_noprof+0xfe/0x720 [ 1525.337840][T18215] ? rcu_is_watching+0x16/0xb0 [ 1525.337865][T18215] ? tomoyo_realpath_from_path+0xef/0x640 [ 1525.337896][T18215] ? tomoyo_realpath_from_path+0xef/0x640 [ 1525.337930][T18215] tomoyo_realpath_from_path+0xef/0x640 [ 1525.337969][T18215] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1525.337992][T18215] tomoyo_path_number_perm+0x246/0x5f0 [ 1525.338019][T18215] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1525.338042][T18215] ? __lock_acquire+0x747/0x2de0 [ 1525.338075][T18215] ? hook_file_ioctl+0x1f2/0x600 [ 1525.338118][T18215] ? __fget_files+0x2a/0x420 [ 1525.338148][T18215] ? __fget_files+0x2a/0x420 [ 1525.338183][T18215] ? __fget_files+0x3a2/0x420 [ 1525.338208][T18215] ? __fget_files+0x2a/0x420 [ 1525.338236][T18215] security_file_ioctl+0xc3/0x2a0 [ 1525.338261][T18215] __se_sys_ioctl+0x47/0x170 [ 1525.338285][T18215] do_syscall_64+0x166/0x520 [ 1525.338309][T18215] ? trace_irq_disable+0x3b/0x140 [ 1525.338329][T18215] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.338348][T18215] ? clear_bhb_loop+0x70/0xc0 [ 1525.338372][T18215] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1525.338390][T18215] RIP: 0033:0x7f9c3199e559 [ 1525.338408][T18215] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1525.338423][T18215] RSP: 002b:00007f9c2fbf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1525.338444][T18215] RAX: ffffffffffffffda RBX: 00007f9c31c26090 RCX: 00007f9c3199e559 [ 1525.338458][T18215] RDX: 0000000000000000 RSI: 0000000040047451 RDI: 0000000000000003 [ 1525.338469][T18215] RBP: 00007f9c2fbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1525.338481][T18215] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1525.338492][T18215] R13: 00007f9c31c26128 R14: 00007f9c31c26090 R15: 00007ffdb8309618 [ 1525.338525][T18215] [ 1525.456034][T18215] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1525.834132][T18218] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13179'. [ 1525.834157][T18218] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13179'. [ 1526.206698][T18234] netlink: 'syz.2.13185': attribute type 11 has an invalid length. [ 1526.682723][T18233] sctp: [Deprecated]: syz.4.13182 (pid 18233) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1526.682723][T18233] Use struct sctp_sack_info instead [ 1526.734827][T18247] geneve1: Caught tx_queue_len zero misconfig [ 1526.734865][T18247] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13189'. [ 1526.894172][T18253] netlink: 16 bytes leftover after parsing attributes in process `syz.3.13189'. [ 1527.403153][T18269] netlink: 'syz.4.13197': attribute type 11 has an invalid length. [ 1527.889527][T18288] syzkaller1: entered promiscuous mode [ 1527.889548][T18288] syzkaller1: entered allmulticast mode [ 1528.255050][T18301] FAULT_INJECTION: forcing a failure. [ 1528.255050][T18301] name failslab, interval 1, probability 0, space 0, times 0 [ 1528.255083][T18301] CPU: 1 UID: 0 PID: 18301 Comm: syz.3.13205 Not tainted syzkaller #0 PREEMPT(full) [ 1528.255104][T18301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1528.255115][T18301] Call Trace: [ 1528.255123][T18301] [ 1528.255132][T18301] dump_stack_lvl+0xe8/0x150 [ 1528.255166][T18301] should_fail_ex+0x410/0x560 [ 1528.255196][T18301] should_failslab+0xa8/0x100 [ 1528.255220][T18301] ? skb_clone+0x212/0x3a0 [ 1528.255242][T18301] kmem_cache_alloc_noprof+0xa1/0x600 [ 1528.255264][T18301] ? skb_clone+0x212/0x3a0 [ 1528.255291][T18301] skb_clone+0x212/0x3a0 [ 1528.255316][T18301] __netlink_deliver_tap+0x355/0x6e0 [ 1528.255350][T18301] ? netlink_deliver_tap+0x2e/0x1b0 [ 1528.255374][T18301] netlink_deliver_tap+0x19c/0x1b0 [ 1528.255399][T18301] netlink_unicast+0x781/0x940 [ 1528.255433][T18301] netlink_sendmsg+0x813/0xb40 [ 1528.255467][T18301] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1528.255501][T18301] ? apparmor_socket_sendmsg+0x98/0x360 [ 1528.255527][T18301] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1528.255551][T18301] sock_sendmsg_nosec+0x14e/0x190 [ 1528.255579][T18301] ____sys_sendmsg+0x54e/0x850 [ 1528.255604][T18301] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1528.255633][T18301] ? import_iovec+0x73/0xa0 [ 1528.255663][T18301] ___sys_sendmsg+0x2a5/0x360 [ 1528.255681][T18301] ? __lock_acquire+0x747/0x2de0 [ 1528.255706][T18301] ? __pfx____sys_sendmsg+0x10/0x10 [ 1528.255762][T18301] ? __fget_files+0x2a/0x420 [ 1528.255788][T18301] ? __fget_files+0x3a2/0x420 [ 1528.255823][T18301] __x64_sys_sendmsg+0x1b1/0x290 [ 1528.255845][T18301] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1528.255892][T18301] do_syscall_64+0x166/0x520 [ 1528.255915][T18301] ? trace_irq_disable+0x3b/0x140 [ 1528.255933][T18301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1528.255952][T18301] ? clear_bhb_loop+0x70/0xc0 [ 1528.255975][T18301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1528.255997][T18301] RIP: 0033:0x7fdc3f39e559 [ 1528.256016][T18301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1528.256032][T18301] RSP: 002b:00007fdc401d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1528.256053][T18301] RAX: ffffffffffffffda RBX: 00007fdc3f625fa0 RCX: 00007fdc3f39e559 [ 1528.256067][T18301] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000005 [ 1528.256079][T18301] RBP: 00007fdc401d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1528.256091][T18301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1528.256103][T18301] R13: 00007fdc3f626038 R14: 00007fdc3f625fa0 R15: 00007ffe2951ab68 [ 1528.256136][T18301] [ 1528.648089][T18303] netlink: 100 bytes leftover after parsing attributes in process `syz.3.13206'. [ 1528.739931][T18308] bridge0: port 4(bridge_slave_0) entered blocking state [ 1528.740064][T18308] bridge0: port 4(bridge_slave_0) entered disabled state [ 1528.740229][T18308] bridge_slave_0: entered allmulticast mode [ 1528.853963][T18303] rxe_eth0 speed is unknown, defaulting to 1000 [ 1528.875268][T18308] bridge_slave_0: left allmulticast mode [ 1528.875489][T18308] bridge0: port 4(bridge_slave_0) entered disabled state [ 1529.487310][T18315] 8021q: VLANs not supported on syzkaller0 [ 1529.492934][T18317] netlink: 'syz.4.13211': attribute type 11 has an invalid length. [ 1529.677257][T18324] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13214'. [ 1529.704711][T18303] lo speed is unknown, defaulting to 1000 [ 1529.710670][T18319] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1529.911532][T18329] tipc: New replicast peer: 127.0.0.1 [ 1529.958815][T18329] tipc: Enabled bearer , priority 26 [ 1530.040629][T18303] virt_wifi0 speed is unknown, defaulting to 1000 [ 1530.044110][T18303] dummy0 speed is unknown, defaulting to 1000 [ 1530.467161][T18350] netlink: 'syz.0.13221': attribute type 29 has an invalid length. [ 1530.467192][T18350] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13221'. [ 1530.491090][T18346] syzkaller0: entered promiscuous mode [ 1530.491112][T18346] syzkaller0: entered allmulticast mode [ 1530.810178][T18353] tap0: tun_chr_ioctl cmd 2147767521 [ 1530.833598][T18353] netlink: 36 bytes leftover after parsing attributes in process `syz.0.13222'. [ 1530.843959][T18353] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13222'. [ 1530.975779][T18359] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13224'. [ 1531.078164][T18356] bond27 (unregistering): Released all slaves [ 1531.805197][T18370] ipvlan3: entered promiscuous mode [ 1531.883913][T18373] ipvlan3: entered promiscuous mode [ 1532.044816][T18385] netlink: 36 bytes leftover after parsing attributes in process `syz.4.13231'. [ 1532.611155][T18410] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13238'. [ 1532.696762][T18413] netlink: 'syz.4.13240': attribute type 3 has an invalid length. [ 1532.696783][T18413] netlink: 3 bytes leftover after parsing attributes in process `syz.4.13240'. [ 1533.037676][T18419] netlink: 12 bytes leftover after parsing attributes in process `syz.2.13243'. [ 1533.235860][T18435] mac80211_hwsim hwsim2 syzkaller0: left promiscuous mode [ 1533.236288][T18435] mac80211_hwsim hwsim2 syzkaller0: left allmulticast mode [ 1533.327515][T18439] tipc: Resetting bearer [ 1533.445218][T18441] netlink: 'syz.0.13247': attribute type 3 has an invalid length. [ 1533.445241][T18441] netlink: 3 bytes leftover after parsing attributes in process `syz.0.13247'. [ 1533.892582][T18455] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13251'. [ 1534.128117][T18441] xt_hashlimit: size too large, truncated to 1048576 [ 1534.390408][T18462] openvswitch: netlink: EtherType 500 is less than min 600 [ 1534.762798][T18471] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13253'. [ 1534.926361][T18476] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13256'. [ 1534.945999][T18476] netlink: 'syz.0.13256': attribute type 1 has an invalid length. [ 1534.970006][T18476] netlink: 'syz.0.13256': attribute type 1 has an invalid length. [ 1534.970027][T18476] netlink: 'syz.0.13256': attribute type 2 has an invalid length. [ 1535.189287][T18482] ip6gretap4: entered promiscuous mode [ 1535.308276][T18485] netlink: 28 bytes leftover after parsing attributes in process `syz.2.13258'. [ 1535.465085][T18492] netlink: 52 bytes leftover after parsing attributes in process `syz.1.13260'. [ 1535.619159][T18496] netlink: 'syz.4.13263': attribute type 1 has an invalid length. [ 1535.683482][T18496] bond16: entered promiscuous mode [ 1535.694087][T18496] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1536.559733][T18536] FAULT_INJECTION: forcing a failure. [ 1536.559733][T18536] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1536.559765][T18536] CPU: 1 UID: 0 PID: 18536 Comm: syz.3.13273 Not tainted syzkaller #0 PREEMPT(full) [ 1536.559785][T18536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1536.559797][T18536] Call Trace: [ 1536.559804][T18536] [ 1536.559813][T18536] dump_stack_lvl+0xe8/0x150 [ 1536.559844][T18536] should_fail_ex+0x410/0x560 [ 1536.559874][T18536] _copy_from_user+0x2d/0xb0 [ 1536.559901][T18536] ___sys_sendmsg+0x1c6/0x360 [ 1536.559919][T18536] ? __lock_acquire+0x747/0x2de0 [ 1536.559948][T18536] ? __pfx____sys_sendmsg+0x10/0x10 [ 1536.560000][T18536] ? __fget_files+0x2a/0x420 [ 1536.560026][T18536] ? __fget_files+0x3a2/0x420 [ 1536.560061][T18536] __x64_sys_sendmsg+0x1b1/0x290 [ 1536.560083][T18536] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1536.560118][T18536] do_syscall_64+0x166/0x520 [ 1536.560142][T18536] ? trace_irq_disable+0x3b/0x140 [ 1536.560161][T18536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1536.560180][T18536] ? clear_bhb_loop+0x70/0xc0 [ 1536.560211][T18536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1536.560228][T18536] RIP: 0033:0x7fdc3f39e559 [ 1536.560244][T18536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1536.560258][T18536] RSP: 002b:00007fdc401d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1536.560278][T18536] RAX: ffffffffffffffda RBX: 00007fdc3f625fa0 RCX: 00007fdc3f39e559 [ 1536.560292][T18536] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1536.560304][T18536] RBP: 00007fdc401d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1536.560315][T18536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1536.560325][T18536] R13: 00007fdc3f626038 R14: 00007fdc3f625fa0 R15: 00007ffe2951ab68 [ 1536.560353][T18536] [ 1537.065560][T18555] __nla_validate_parse: 6 callbacks suppressed [ 1537.065581][T18555] netlink: 224 bytes leftover after parsing attributes in process `syz.1.13281'. [ 1537.219123][T18566] netlink: 4 bytes leftover after parsing attributes in process `syz.1.13281'. [ 1537.844830][T18581] netlink: 24 bytes leftover after parsing attributes in process `syz.1.13284'. [ 1538.123760][T18588] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13287'. [ 1538.164888][T18585] bond27: option arp_all_targets: invalid value (3) [ 1538.187610][T18585] bond27 (unregistering): Released all slaves [ 1538.233995][T18594] netlink: 32 bytes leftover after parsing attributes in process `syz.0.13289'. [ 1538.265176][T18589] netlink: 'syz.1.13286': attribute type 362 has an invalid length. [ 1538.685838][T18608] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1539.001088][T18624] netlink: 24 bytes leftover after parsing attributes in process `syz.4.13296'. [ 1539.048258][T18626] netlink: 48 bytes leftover after parsing attributes in process `syz.2.13295'. [ 1539.248329][T18634] IPVS: set_ctl: invalid protocol: 51 255.255.255.255:20004 [ 1539.482445][T18639] netlink: 28 bytes leftover after parsing attributes in process `syz.1.13303'. [ 1539.500549][T18640] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13301'. [ 1539.652206][T18649] FAULT_INJECTION: forcing a failure. [ 1539.652206][T18649] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1539.652237][T18649] CPU: 1 UID: 0 PID: 18649 Comm: syz.3.13306 Not tainted syzkaller #0 PREEMPT(full) [ 1539.652258][T18649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1539.652269][T18649] Call Trace: [ 1539.652277][T18649] [ 1539.652286][T18649] dump_stack_lvl+0xe8/0x150 [ 1539.652317][T18649] should_fail_ex+0x410/0x560 [ 1539.652349][T18649] _copy_from_user+0x2d/0xb0 [ 1539.652378][T18649] kstrtouint_from_user+0xd6/0x180 [ 1539.652407][T18649] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1539.652439][T18649] ? lock_acquire+0x115/0x350 [ 1539.652466][T18649] proc_fail_nth_write+0x8e/0x210 [ 1539.652488][T18649] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1539.652515][T18649] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1539.652535][T18649] vfs_write+0x296/0xba0 [ 1539.652561][T18649] ? __pfx_vfs_write+0x10/0x10 [ 1539.652583][T18649] ? __fget_files+0x2a/0x420 [ 1539.652614][T18649] ? __fget_files+0x3a2/0x420 [ 1539.652639][T18649] ? __fget_files+0x2a/0x420 [ 1539.652675][T18649] ksys_write+0x150/0x270 [ 1539.652698][T18649] ? __pfx_ksys_write+0x10/0x10 [ 1539.652730][T18649] do_syscall_64+0x166/0x520 [ 1539.652755][T18649] ? trace_irq_disable+0x3b/0x140 [ 1539.652774][T18649] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1539.652794][T18649] ? clear_bhb_loop+0x70/0xc0 [ 1539.652826][T18649] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1539.652845][T18649] RIP: 0033:0x7fdc3f35ed8e [ 1539.652863][T18649] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1539.652878][T18649] RSP: 002b:00007fdc401d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1539.652898][T18649] RAX: ffffffffffffffda RBX: 00007fdc401d56c0 RCX: 00007fdc3f35ed8e [ 1539.652913][T18649] RDX: 0000000000000001 RSI: 00007fdc401d50a0 RDI: 0000000000000004 [ 1539.652925][T18649] RBP: 00007fdc401d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1539.652937][T18649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1539.652948][T18649] R13: 00007fdc3f626038 R14: 00007fdc3f625fa0 R15: 00007ffe2951ab68 [ 1539.652981][T18649] [ 1539.890890][T18653] FAULT_INJECTION: forcing a failure. [ 1539.890890][T18653] name failslab, interval 1, probability 0, space 0, times 0 [ 1539.890919][T18653] CPU: 0 UID: 0 PID: 18653 Comm: syz.1.13307 Not tainted syzkaller #0 PREEMPT(full) [ 1539.890939][T18653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1539.890950][T18653] Call Trace: [ 1539.890958][T18653] [ 1539.890967][T18653] dump_stack_lvl+0xe8/0x150 [ 1539.890997][T18653] should_fail_ex+0x410/0x560 [ 1539.891025][T18653] ? __alloc_skb+0x1db/0x7a0 [ 1539.891051][T18653] should_failslab+0xa8/0x100 [ 1539.891077][T18653] ? __alloc_skb+0x1db/0x7a0 [ 1539.891101][T18653] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1539.891122][T18653] ? __alloc_skb+0x18d/0x7a0 [ 1539.891149][T18653] ? __alloc_skb+0x1db/0x7a0 [ 1539.891182][T18653] __alloc_skb+0x1db/0x7a0 [ 1539.891216][T18653] netlink_sendmsg+0x5d4/0xb40 [ 1539.891251][T18653] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1539.891291][T18653] ? apparmor_socket_sendmsg+0x98/0x360 [ 1539.891318][T18653] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1539.891342][T18653] sock_sendmsg_nosec+0x14e/0x190 [ 1539.891369][T18653] ____sys_sendmsg+0x54e/0x850 [ 1539.891395][T18653] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1539.891424][T18653] ? import_iovec+0x73/0xa0 [ 1539.891454][T18653] ___sys_sendmsg+0x2a5/0x360 [ 1539.891473][T18653] ? __lock_acquire+0x747/0x2de0 [ 1539.891515][T18653] ? __pfx____sys_sendmsg+0x10/0x10 [ 1539.891569][T18653] ? __fget_files+0x2a/0x420 [ 1539.891596][T18653] ? __fget_files+0x3a2/0x420 [ 1539.891633][T18653] __x64_sys_sendmsg+0x1b1/0x290 [ 1539.891657][T18653] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1539.891698][T18653] do_syscall_64+0x166/0x520 [ 1539.891723][T18653] ? trace_irq_disable+0x3b/0x140 [ 1539.891742][T18653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1539.891762][T18653] ? clear_bhb_loop+0x70/0xc0 [ 1539.891792][T18653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1539.891812][T18653] RIP: 0033:0x7fdf54b9e559 [ 1539.891829][T18653] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1539.891846][T18653] RSP: 002b:00007fdf559cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1539.891866][T18653] RAX: ffffffffffffffda RBX: 00007fdf54e25fa0 RCX: 00007fdf54b9e559 [ 1539.891881][T18653] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1539.891892][T18653] RBP: 00007fdf559cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1539.891904][T18653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1539.891915][T18653] R13: 00007fdf54e26038 R14: 00007fdf54e25fa0 R15: 00007fffdb9e3538 [ 1539.891947][T18653] [ 1539.892490][T18654] netlink: 24 bytes leftover after parsing attributes in process `syz.3.13308'. [ 1541.699511][T18709] ipvlan4: entered promiscuous mode [ 1541.739574][T18721] smc: net device macvtap0 applied user defined pnetid SYZ0 [ 1542.423206][T18753] __nla_validate_parse: 12 callbacks suppressed [ 1542.423226][T18753] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13341'. [ 1543.004905][T18762] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13344'. [ 1543.114477][T18764] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13345'. [ 1543.168804][T18767] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13346'. [ 1543.308260][T18773] openvswitch: netlink: IPv4 frag type 228 is out of range max 2 [ 1543.847114][T18799] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13357'. [ 1543.972581][T18806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13360'. [ 1544.008926][T18808] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13359'. [ 1544.116209][T18812] netlink: 72 bytes leftover after parsing attributes in process `syz.0.13362'. [ 1544.206596][T18815] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13363'. [ 1544.419908][T18824] netlink: 'syz.3.13367': attribute type 2 has an invalid length. [ 1544.533555][T18828] netlink: 16 bytes leftover after parsing attributes in process `syz.0.13369'. [ 1544.943179][T18836] rxe_eth0 speed is unknown, defaulting to 1000 [ 1545.675756][ T5629] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1545.679277][ T5629] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1545.687286][ T5629] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1545.688182][ T5629] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1545.689155][ T5629] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1545.768780][ T7813] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1545.773450][ T7813] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1545.778408][ T7813] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1545.787910][ T7813] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1545.788526][ T7813] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1546.067317][T18836] lo speed is unknown, defaulting to 1000 [ 1546.841076][T18836] virt_wifi0 speed is unknown, defaulting to 1000 [ 1546.845614][T18836] dummy0 speed is unknown, defaulting to 1000 [ 1547.077766][T18851] rxe_eth0 speed is unknown, defaulting to 1000 [ 1547.396202][T18851] lo speed is unknown, defaulting to 1000 [ 1547.605833][T18851] virt_wifi0 speed is unknown, defaulting to 1000 [ 1547.615888][T18851] dummy0 speed is unknown, defaulting to 1000 [ 1547.903724][ T7813] Bluetooth: hci5: command tx timeout [ 1548.358884][T18851] bridge0: port 1(bridge_slave_0) entered blocking state [ 1548.359053][T18851] bridge0: port 1(bridge_slave_0) entered disabled state [ 1548.359174][T18851] bridge_slave_0: entered allmulticast mode [ 1548.360934][T18851] bridge_slave_0: entered promiscuous mode [ 1548.363596][T18851] bridge0: port 2(bridge_slave_1) entered blocking state [ 1548.363747][T18851] bridge0: port 2(bridge_slave_1) entered disabled state [ 1548.363857][T18851] bridge_slave_1: entered allmulticast mode [ 1548.365569][T18851] bridge_slave_1: entered promiscuous mode [ 1548.441425][T18851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1548.448139][T18851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1548.514978][T18851] team0: Port device team_slave_0 added [ 1548.518066][T18851] team0: Port device team_slave_1 added [ 1548.561689][T18851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1548.561709][T18851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1548.561731][T18851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1548.563722][T18851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1548.563734][T18851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1548.563757][T18851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1548.607313][T18851] hsr_slave_0: entered promiscuous mode [ 1548.608287][T18851] hsr_slave_1: entered promiscuous mode [ 1548.610753][T18851] debugfs: 'hsr0' already exists in 'hsr' [ 1548.610771][T18851] Cannot create hsr debugfs directory [ 1548.783168][T18851] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1548.976784][T18851] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1549.163336][T18851] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1549.251636][T18851] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1549.557884][T18851] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1549.564639][T18851] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1549.565701][T18851] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1549.577351][T18851] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1549.578499][T18851] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1549.594132][T18851] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1549.595208][T18851] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1549.598517][T18851] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1549.779390][T18851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1549.795355][T18851] 8021q: adding VLAN 0 to HW filter on device team0 [ 1549.804382][ T3308] bridge0: port 1(bridge_slave_0) entered blocking state [ 1549.804483][ T3308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1549.816883][ T3308] bridge0: port 2(bridge_slave_1) entered blocking state [ 1549.816978][ T3308] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1549.989526][ T7813] Bluetooth: hci5: command tx timeout [ 1550.435598][T18851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1550.494820][T18851] veth0_vlan: entered promiscuous mode [ 1550.502657][T18851] veth1_vlan: entered promiscuous mode [ 1550.536819][T18851] veth0_macvtap: entered promiscuous mode [ 1550.547612][T18851] veth1_macvtap: entered promiscuous mode [ 1550.566071][T18851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1550.578188][T18851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1550.613314][ T3271] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1550.613355][ T3271] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1550.613387][ T3271] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1550.613418][ T3271] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1550.818445][ T3284] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1550.818466][ T3284] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1550.880623][ T3284] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1550.880644][ T3284] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1550.987556][T18916] openvswitch: netlink: IP tunnel attribute has 5393 unknown bytes. [ 1552.061872][ T7813] Bluetooth: hci5: command tx timeout [ 1554.138923][ T7813] Bluetooth: hci5: command tx timeout [ 1556.208482][ T3284] bond26: left allmulticast mode [ 1556.230305][ T3284] bond26: left promiscuous mode [ 1556.232052][ T3284] bridge0: port 3(bond26) entered disabled state [ 1556.252004][ T3284] bond6: left allmulticast mode [ 1556.252221][ T3284] bridge0: port 2(bond6) entered disabled state [ 1556.254624][ T3284] bond5: left allmulticast mode [ 1556.254812][ T3284] bridge0: port 1(bond5) entered disabled state [ 1556.311564][ T3284] dummy0: left allmulticast mode [ 1556.343742][ T3284] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1556.344286][ T3284] tipc: Resetting bearer [ 1556.560466][ T3284] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1556.578319][ T3284] bond13 (unregistering): (slave ip6gre2): Releasing backup interface [ 1556.996804][ T3284] bond24 (unregistering): (slave gretap0): Releasing active interface [ 1557.033576][ T3284] bond27 (unregistering): (slave gre6): Releasing backup interface [ 1557.033603][ T3284] gre6 (unregistering): left promiscuous mode [ 1557.053668][ T3284] bond23 (unregistering): (slave gre5): Releasing backup interface [ 1557.053693][ T3284] gre5 (unregistering): left promiscuous mode [ 1557.073180][ T3284] bond20 (unregistering): (slave gre4): Releasing backup interface [ 1557.073206][ T3284] gre4 (unregistering): left promiscuous mode [ 1557.094736][ T3284] bond14 (unregistering): (slave gre2): Releasing backup interface [ 1557.113165][ T3284] tipc: Disabling bearer [ 1557.512230][ T3284] bond1 (unregistering): (slave bridge3): Releasing active interface [ 1557.534614][ T3284] bond2 (unregistering): (slave bridge4): Releasing backup interface [ 1557.553226][ T3284] bond4 (unregistering): (slave bridge0): Releasing backup interface [ 1557.633656][ T3284] bond0 (unregistering): Released all slaves [ 1557.646996][ T3284] bond1 (unregistering): (slave veth3): Releasing active interface [ 1557.651210][ T3284] bond1 (unregistering): Released all slaves [ 1557.663956][ T3284] bond2 (unregistering): Released all slaves [ 1557.697121][ T3284] bond3 (unregistering): Released all slaves [ 1557.717458][ T3284] bond4 (unregistering): Released all slaves [ 1557.730500][ T3284] bond5 (unregistering): Released all slaves [ 1557.750121][ T3284] bond6 (unregistering): Released all slaves [ 1557.787251][ T3284] bond7 (unregistering): Released all slaves [ 1557.818020][ T3284] bond8 (unregistering): (slave veth9): Releasing active interface [ 1557.823562][ T3284] bond8 (unregistering): Released all slaves [ 1557.837189][ T3284] bond9 (unregistering): Released all slaves [ 1557.861587][ T3284] bond10 (unregistering): (slave veth15): Releasing active interface [ 1557.862648][ T3284] bond10 (unregistering): Released all slaves [ 1557.882455][ T3284] bond11 (unregistering): Released all slaves [ 1557.895103][ T3284] bond12 (unregistering): Released all slaves [ 1557.915183][ T3284] bond13 (unregistering): Released all slaves [ 1557.944663][ T3284] bond14 (unregistering): Released all slaves [ 1557.967810][ T3284] bond15 (unregistering): Released all slaves [ 1557.992857][ T3284] bond16 (unregistering): Released all slaves [ 1558.016854][ T3284] bond17 (unregistering): Released all slaves [ 1558.042254][ T3284] bond18 (unregistering): Released all slaves [ 1558.065371][ T3284] bond19 (unregistering): Released all slaves [ 1558.090878][ T3284] bond20 (unregistering): Released all slaves [ 1558.114308][ T3284] bond21 (unregistering): (slave wireguard0): Releasing backup interface [ 1558.114333][ T3284] wireguard0: left promiscuous mode [ 1558.116021][ T3284] bond21 (unregistering): Released all slaves [ 1558.158492][ T3284] bond22 (unregistering): Released all slaves [ 1558.182277][ T3284] bond23 (unregistering): Released all slaves [ 1558.201559][ T3284] bond24 (unregistering): Released all slaves [ 1558.236907][ T3284] bond25 (unregistering): Released all slaves [ 1558.256748][ T3284] bond26 (unregistering): Released all slaves [ 1558.275981][ T3284] bond27 (unregistering): Released all slaves [ 1558.305295][ T3284] bond28 (unregistering): Released all slaves [ 1558.324542][ T3284] bond29 (unregistering): Released all slaves [ 1558.783285][ T3284] ovs-dp0: left promiscuous mode [ 1558.827649][ T3284] ovs0: left promiscuous mode [ 1558.895547][ T3284] tipc: Left network mode [ 1559.987809][ T3284] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 1559.987833][ T3284] batman_adv: batadv0: Removing interface: syzkaller0 [ 1560.004021][ T3284] batman_adv: batadv0: Removing interface: ipvlan2 [ 1561.602760][ T3301] smbdirect: ib_dev[ÿ] removed [ 1562.473730][ T3284] IPVS: stop unused estimator thread 0... [ 1567.748767][T18921] tcf_pedit_act: 7 callbacks suppressed [ 1567.748805][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748818][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748829][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748839][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748849][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748860][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748871][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748882][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748894][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748904][T18921] tc action pedit unable to extract header offset for header type (0x4) [ 1567.748924][T18921] 0: reclassify loop, rule prio 0, protocol 800 [ 1568.062506][ T5629] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1568.066651][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1568.069176][ T5629] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1568.099042][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1568.114163][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1568.156703][ T5627] syz_tun (unregistering): left allmulticast mode [ 1568.157750][ T5627] tipc: Disabling bearer [ 1568.617534][T18974] __nla_validate_parse: 5 callbacks suppressed [ 1568.617554][T18974] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13394'. [ 1568.778796][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1568.944931][T18981] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13397'. [ 1569.476946][T18924] rxe_eth0 speed is unknown, defaulting to 1000 [ 1569.674036][T19003] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13403'. [ 1569.698875][T19003] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13403'. [ 1569.818712][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1569.878119][T19007] tipc: New replicast peer: 255.255.255.255 [ 1569.878508][T19007] tipc: Enabled bearer , priority 26 [ 1569.880608][T19008] netlink: 12 bytes leftover after parsing attributes in process `syz.4.13404'. [ 1570.168825][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.168861][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.168894][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.168916][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.168938][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.168961][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169006][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169029][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169052][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169074][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169096][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169125][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169147][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169169][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169191][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169218][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169240][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169262][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169285][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169307][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169329][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169351][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169374][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169403][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169426][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169448][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169470][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.169493][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171785][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171813][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171836][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171858][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171881][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171903][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171925][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171946][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.171968][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172062][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172086][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172108][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172130][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172152][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172174][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172208][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172230][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172252][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172274][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172296][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172318][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172340][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172362][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172384][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172417][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172439][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172461][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172483][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172505][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172527][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.172561][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.176163][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.176194][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.176217][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.176240][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.176263][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.176284][T19018] IPVS: set_ctl: invalid protocol: 175 10.1.1.0:20001 [ 1570.199021][T18924] lo speed is unknown, defaulting to 1000 [ 1570.229247][ T7813] Bluetooth: hci3: command tx timeout [ 1570.377493][T19022] netlink: 104 bytes leftover after parsing attributes in process `syz.2.13408'. [ 1570.726792][T19028] netlink: 'syz.3.13410': attribute type 1 has an invalid length. [ 1570.855870][T19028] bond19: entered promiscuous mode [ 1570.858772][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1570.881078][T19028] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1570.963441][T19033] netlink: 192 bytes leftover after parsing attributes in process `syz.1.13411'. [ 1570.968283][T19031] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1570.971497][T19031] bond19: (slave gre9): The slave device specified does not support setting the MAC address [ 1570.971518][T19031] bond19: (slave gre9): Setting fail_over_mac to active for active-backup mode [ 1571.005735][T19031] bond19: (slave gre9): making interface the new active one [ 1571.005758][T19031] gre9: entered promiscuous mode [ 1571.025577][T19031] bond19: (slave gre9): Enslaving as an active interface with an up link [ 1571.144679][T18924] dummy0 speed is unknown, defaulting to 1000 [ 1571.329393][T19035] netlink: 'syz.2.13412': attribute type 2 has an invalid length. [ 1571.898801][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1571.990878][T19055] rxe_eth0 speed is unknown, defaulting to 1000 [ 1572.299100][ T7813] Bluetooth: hci3: command tx timeout [ 1572.526744][T19069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13419'. [ 1572.567724][T18924] bridge0: port 1(bridge_slave_0) entered blocking state [ 1572.571424][T18924] bridge0: port 1(bridge_slave_0) entered disabled state [ 1572.571548][T18924] bridge_slave_0: entered allmulticast mode [ 1572.573398][T18924] bridge_slave_0: entered promiscuous mode [ 1572.606587][T18924] bridge0: port 2(bridge_slave_1) entered blocking state [ 1572.607652][T18924] bridge0: port 2(bridge_slave_1) entered disabled state [ 1572.607790][T18924] bridge_slave_1: entered allmulticast mode [ 1572.639017][T18924] bridge_slave_1: entered promiscuous mode [ 1572.735592][T19055] lo speed is unknown, defaulting to 1000 [ 1572.773997][T18924] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1572.840102][T18924] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1572.925573][T19078] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13421'. [ 1572.938785][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1573.084328][T18924] team0: Port device team_slave_0 added [ 1573.110509][T18924] team0: Port device team_slave_1 added [ 1573.286460][T18924] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1573.286478][T18924] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1573.286500][T18924] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1573.309456][T18924] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1573.309472][T18924] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1573.309494][T18924] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1573.566299][T18924] hsr_slave_0: entered promiscuous mode [ 1573.572379][T18924] hsr_slave_1: entered promiscuous mode [ 1573.573032][T18924] debugfs: 'hsr0' already exists in 'hsr' [ 1573.573050][T18924] Cannot create hsr debugfs directory [ 1573.645140][T19080] ipvlan4: entered promiscuous mode [ 1573.645401][T19080] team0: Device ipvlan4 is VLAN challenged and team device has VLAN set up [ 1573.679453][T19084] ipvlan4: entered promiscuous mode [ 1573.679733][T19084] team0: Device ipvlan4 is VLAN challenged and team device has VLAN set up [ 1573.686575][T19055] dummy0 speed is unknown, defaulting to 1000 [ 1573.800523][T19090] netlink: 32 bytes leftover after parsing attributes in process `syz.3.13425'. [ 1573.978784][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1574.126688][T19093] netlink: 'syz.2.13426': attribute type 2 has an invalid length. [ 1574.388838][ T7813] Bluetooth: hci3: command tx timeout [ 1574.668245][T19101] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13428'. [ 1574.818560][T19103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.13429'. [ 1575.019264][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1575.714123][T18924] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1575.761615][T18924] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1575.762663][T18924] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1575.794495][T18924] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1575.797031][T18924] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1575.833497][T18924] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1575.838159][T18924] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1575.886692][T18924] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1575.967858][T19125] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13433'. [ 1576.058750][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1576.359473][T19138] ip6erspan0: entered allmulticast mode [ 1576.419108][T18924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1576.459870][ T7813] Bluetooth: hci3: command tx timeout [ 1576.461466][T18924] 8021q: adding VLAN 0 to HW filter on device team0 [ 1576.472663][ T3295] bridge0: port 1(bridge_slave_0) entered blocking state [ 1576.472758][ T3295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1576.522726][ T3295] bridge0: port 2(bridge_slave_1) entered blocking state [ 1576.522790][ T3295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1576.529107][T19140] netlink: 44 bytes leftover after parsing attributes in process `syz.2.13437'. [ 1576.563110][T19141] netlink: 44 bytes leftover after parsing attributes in process `syz.2.13437'. [ 1576.674527][T19149] netlink: 16 bytes leftover after parsing attributes in process `syz.1.13440'. [ 1576.746940][T19152] netlink: 'syz.3.13439': attribute type 2 has an invalid length. [ 1576.748096][T19149] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13440'. [ 1577.067608][T19162] FAULT_INJECTION: forcing a failure. [ 1577.067608][T19162] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1577.067641][T19162] CPU: 0 UID: 0 PID: 19162 Comm: syz.1.13442 Not tainted syzkaller #0 PREEMPT(full) [ 1577.067662][T19162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1577.067674][T19162] Call Trace: [ 1577.067681][T19162] [ 1577.067691][T19162] dump_stack_lvl+0xe8/0x150 [ 1577.067722][T19162] should_fail_ex+0x410/0x560 [ 1577.067752][T19162] _copy_to_user+0x31/0xb0 [ 1577.067781][T19162] simple_read_from_buffer+0xe1/0x170 [ 1577.067814][T19162] proc_fail_nth_read+0x1bb/0x230 [ 1577.067833][T19162] ? common_file_perm+0x20e/0x2b0 [ 1577.067861][T19162] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1577.067904][T19162] ? rw_verify_area+0x24a/0x4c0 [ 1577.067925][T19162] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1577.067945][T19162] vfs_read+0x213/0xa80 [ 1577.067969][T19162] ? __pfx___mutex_lock+0x10/0x10 [ 1577.067996][T19162] ? __pfx_vfs_read+0x10/0x10 [ 1577.068016][T19162] ? __fget_files+0x2a/0x420 [ 1577.068047][T19162] ? __fget_files+0x3a2/0x420 [ 1577.068073][T19162] ? __fget_files+0x2a/0x420 [ 1577.068106][T19162] ksys_read+0x150/0x270 [ 1577.068127][T19162] ? __pfx_ksys_read+0x10/0x10 [ 1577.068156][T19162] do_syscall_64+0x166/0x520 [ 1577.068178][T19162] ? trace_irq_disable+0x3b/0x140 [ 1577.068198][T19162] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.068226][T19162] ? clear_bhb_loop+0x70/0xc0 [ 1577.068249][T19162] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.068267][T19162] RIP: 0033:0x7fdf54b5ed8e [ 1577.068285][T19162] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1577.068299][T19162] RSP: 002b:00007fdf559cbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1577.068320][T19162] RAX: ffffffffffffffda RBX: 00007fdf559cc6c0 RCX: 00007fdf54b5ed8e [ 1577.068334][T19162] RDX: 000000000000000f RSI: 00007fdf559cc0a0 RDI: 0000000000000004 [ 1577.068346][T19162] RBP: 00007fdf559cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.068358][T19162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1577.068369][T19162] R13: 00007fdf54e26038 R14: 00007fdf54e25fa0 R15: 00007fffdb9e3538 [ 1577.068402][T19162] [ 1577.098750][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1577.331525][T19166] netlink: 16 bytes leftover after parsing attributes in process `syz.2.13441'. [ 1577.364309][T19168] netlink: 32 bytes leftover after parsing attributes in process `syz.1.13443'. [ 1577.695672][T18924] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1577.897109][T18924] veth0_vlan: entered promiscuous mode [ 1577.963191][T18924] veth1_vlan: entered promiscuous mode [ 1578.051165][T19187] netlink: 'syz.4.13451': attribute type 10 has an invalid length. [ 1578.121656][T18924] veth0_macvtap: entered promiscuous mode [ 1578.136731][T18924] veth1_macvtap: entered promiscuous mode [ 1578.138768][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1578.203532][T18924] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1578.228340][T18924] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1578.258750][ T3270] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1578.259064][ T3270] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1578.259108][ T3270] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1578.259152][ T3270] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1578.724267][ T3295] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1578.724287][ T3295] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1579.015854][T19231] veth0_to_bridge: entered promiscuous mode [ 1579.016018][T19231] macvtap1: entered allmulticast mode [ 1579.016027][T19231] veth0_to_bridge: entered allmulticast mode [ 1579.066810][T19231] veth0_to_bridge: left allmulticast mode [ 1579.066838][T19231] veth0_to_bridge: left promiscuous mode [ 1579.178795][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1579.183667][ T3301] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1579.183686][ T3301] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1579.342039][T19242] FAULT_INJECTION: forcing a failure. [ 1579.342039][T19242] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1579.342068][T19242] CPU: 0 UID: 0 PID: 19242 Comm: syz.0.13387 Not tainted syzkaller #0 PREEMPT(full) [ 1579.342088][T19242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1579.342099][T19242] Call Trace: [ 1579.342107][T19242] [ 1579.342115][T19242] dump_stack_lvl+0xe8/0x150 [ 1579.342145][T19242] should_fail_ex+0x410/0x560 [ 1579.342174][T19242] _copy_to_user+0x31/0xb0 [ 1579.342205][T19242] bpf_verifier_vlog+0x496/0x900 [ 1579.342241][T19242] verbose+0x11d/0x1a0 [ 1579.342266][T19242] ? __pfx_verbose+0x10/0x10 [ 1579.342289][T19242] ? ktime_get+0x45/0x220 [ 1579.342309][T19242] ? ktime_get+0x45/0x220 [ 1579.342330][T19242] print_verification_stats+0x10e/0x800 [ 1579.342352][T19242] ? ktime_get+0x45/0x220 [ 1579.342368][T19242] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1579.342391][T19242] ? ktime_get+0x1f5/0x220 [ 1579.342412][T19242] bpf_check+0x1ce6/0x2ef0 [ 1579.342451][T19242] ? __pfx_bpf_check+0x10/0x10 [ 1579.342476][T19242] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1579.342507][T19242] bpf_prog_load+0x14d6/0x1c20 [ 1579.342542][T19242] ? __pfx_bpf_prog_load+0x10/0x10 [ 1579.342590][T19242] __sys_bpf+0xd0d/0xd90 [ 1579.342620][T19242] ? __pfx___sys_bpf+0x10/0x10 [ 1579.342654][T19242] ? __fget_files+0x2a/0x420 [ 1579.342699][T19242] ? ksys_write+0x242/0x270 [ 1579.342721][T19242] ? __pfx_ksys_write+0x10/0x10 [ 1579.342744][T19242] __x64_sys_bpf+0xba/0xd0 [ 1579.342767][T19242] do_syscall_64+0x166/0x520 [ 1579.342791][T19242] ? trace_irq_disable+0x3b/0x140 [ 1579.342810][T19242] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.342830][T19242] ? clear_bhb_loop+0x70/0xc0 [ 1579.342854][T19242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.342873][T19242] RIP: 0033:0x7f0a0139e559 [ 1579.342890][T19242] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1579.342906][T19242] RSP: 002b:00007f0a021cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1579.342927][T19242] RAX: ffffffffffffffda RBX: 00007f0a01625fa0 RCX: 00007f0a0139e559 [ 1579.342940][T19242] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1579.342952][T19242] RBP: 00007f0a021cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1579.342970][T19242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1579.342980][T19242] R13: 00007f0a01626038 R14: 00007f0a01625fa0 R15: 00007ffd91425798 [ 1579.343011][T19242] [ 1580.008384][T19255] __nla_validate_parse: 5 callbacks suppressed [ 1580.008404][T19255] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13462'. [ 1580.031121][T19259] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13464'. [ 1580.033499][ T5629] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1580.036920][ T5629] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1580.039970][ T5629] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1580.055563][ T5629] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1580.056191][ T5629] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1580.218799][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1580.229182][T19262] ipvlan2: entered promiscuous mode [ 1580.235171][T19262] team0: Device ipvlan2 failed to register rx_handler [ 1580.369240][T19250] ipvlan2: entered promiscuous mode [ 1580.394808][T19250] team0: Device ipvlan2 failed to register rx_handler [ 1580.788270][T19278] netlink: 20 bytes leftover after parsing attributes in process `syz.3.13468'. [ 1580.788312][T19278] netlink: 'syz.3.13468': attribute type 1 has an invalid length. [ 1580.796074][T19278] geneve4: entered promiscuous mode [ 1581.050362][T19258] rxe_eth0 speed is unknown, defaulting to 1000 [ 1581.194456][T19296] FAULT_INJECTION: forcing a failure. [ 1581.194456][T19296] name failslab, interval 1, probability 0, space 0, times 0 [ 1581.194484][T19296] CPU: 0 UID: 0 PID: 19296 Comm: syz.0.13473 Not tainted syzkaller #0 PREEMPT(full) [ 1581.194500][T19296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1581.194508][T19296] Call Trace: [ 1581.194514][T19296] [ 1581.194521][T19296] dump_stack_lvl+0xe8/0x150 [ 1581.194546][T19296] should_fail_ex+0x410/0x560 [ 1581.194569][T19296] should_failslab+0xa8/0x100 [ 1581.194587][T19296] ? skb_clone+0x212/0x3a0 [ 1581.194604][T19296] kmem_cache_alloc_noprof+0xa1/0x600 [ 1581.194620][T19296] ? skb_clone+0x212/0x3a0 [ 1581.194639][T19296] skb_clone+0x212/0x3a0 [ 1581.194656][T19296] __netlink_deliver_tap+0x355/0x6e0 [ 1581.194682][T19296] ? netlink_deliver_tap+0x2e/0x1b0 [ 1581.194702][T19296] netlink_deliver_tap+0x19c/0x1b0 [ 1581.194721][T19296] netlink_dump+0x95b/0xee0 [ 1581.194756][T19296] ? __pfx_netlink_dump+0x10/0x10 [ 1581.194786][T19296] ? netlink_recvmsg+0x5bf/0xa50 [ 1581.194804][T19296] ? kmem_cache_free+0x182/0x650 [ 1581.194826][T19296] netlink_recvmsg+0x683/0xa50 [ 1581.194853][T19296] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1581.194870][T19296] ? lock_acquire+0x115/0x350 [ 1581.194888][T19296] ? __lock_acquire+0x747/0x2de0 [ 1581.194909][T19296] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1581.194930][T19296] sock_recvmsg_nosec+0x130/0x170 [ 1581.194952][T19296] ____sys_recvmsg+0x3e3/0x4a0 [ 1581.194976][T19296] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1581.195005][T19296] ? import_iovec+0x73/0xa0 [ 1581.195030][T19296] ___sys_recvmsg+0x213/0x5a0 [ 1581.195050][T19296] ? __pfx____sys_recvmsg+0x10/0x10 [ 1581.195072][T19296] ? lock_acquire+0x115/0x350 [ 1581.195115][T19296] do_recvmmsg+0x31a/0x7f0 [ 1581.195142][T19296] ? __pfx_do_recvmmsg+0x10/0x10 [ 1581.195172][T19296] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1581.195195][T19296] ? __fget_files+0x3a2/0x420 [ 1581.195223][T19296] __x64_sys_recvmmsg+0x198/0x250 [ 1581.195241][T19296] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1581.195267][T19296] do_syscall_64+0x166/0x520 [ 1581.195287][T19296] ? trace_irq_disable+0x3b/0x140 [ 1581.195303][T19296] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.195320][T19296] ? clear_bhb_loop+0x70/0xc0 [ 1581.195340][T19296] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1581.195356][T19296] RIP: 0033:0x7f0a0139e559 [ 1581.195371][T19296] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1581.195383][T19296] RSP: 002b:00007f0a021cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1581.195399][T19296] RAX: ffffffffffffffda RBX: 00007f0a01625fa0 RCX: 00007f0a0139e559 [ 1581.195408][T19296] RDX: 0000000000000004 RSI: 0000200000000140 RDI: 0000000000000003 [ 1581.195418][T19296] RBP: 00007f0a021cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1581.195427][T19296] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1581.195436][T19296] R13: 00007f0a01626038 R14: 00007f0a01625fa0 R15: 00007ffd91425798 [ 1581.195462][T19296] [ 1581.260448][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1581.496877][T19299] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13474'. [ 1581.737482][T19305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13475'. [ 1581.920486][ T3301] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1581.920521][ T3301] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1581.972117][T19309] netlink: 104 bytes leftover after parsing attributes in process `syz.3.13477'. [ 1582.140340][ T5629] Bluetooth: hci4: command tx timeout [ 1582.236833][ T3301] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1582.236865][ T3301] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.298708][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1582.451169][T19326] FAULT_INJECTION: forcing a failure. [ 1582.451169][T19326] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1582.451202][T19326] CPU: 1 UID: 0 PID: 19326 Comm: syz.2.13481 Not tainted syzkaller #0 PREEMPT(full) [ 1582.451225][T19326] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1582.451237][T19326] Call Trace: [ 1582.451245][T19326] [ 1582.451254][T19326] dump_stack_lvl+0xe8/0x150 [ 1582.451285][T19326] should_fail_ex+0x410/0x560 [ 1582.451316][T19326] _copy_to_iter+0x404/0x1810 [ 1582.451354][T19326] ? __pfx__copy_to_iter+0x10/0x10 [ 1582.451379][T19326] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1582.451406][T19326] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1582.451428][T19326] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 1582.451455][T19326] __skb_datagram_iter+0xf8/0x980 [ 1582.451475][T19326] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 1582.451502][T19326] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 1582.451532][T19326] skb_copy_datagram_iter+0xb5/0x240 [ 1582.451557][T19326] netlink_recvmsg+0x2b9/0xa50 [ 1582.451591][T19326] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1582.451614][T19326] ? lock_acquire+0x115/0x350 [ 1582.451637][T19326] ? __lock_acquire+0x747/0x2de0 [ 1582.451663][T19326] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1582.451688][T19326] sock_recvmsg_nosec+0x130/0x170 [ 1582.451722][T19326] ____sys_recvmsg+0x3e3/0x4a0 [ 1582.451751][T19326] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1582.451786][T19326] ? import_iovec+0x73/0xa0 [ 1582.451815][T19326] ___sys_recvmsg+0x213/0x5a0 [ 1582.451840][T19326] ? __pfx____sys_recvmsg+0x10/0x10 [ 1582.451866][T19326] ? lock_acquire+0x115/0x350 [ 1582.451913][T19326] do_recvmmsg+0x31a/0x7f0 [ 1582.451942][T19326] ? __pfx_do_recvmmsg+0x10/0x10 [ 1582.451974][T19326] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1582.452001][T19326] ? __fget_files+0x3a2/0x420 [ 1582.452039][T19326] __x64_sys_recvmmsg+0x198/0x250 [ 1582.452063][T19326] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1582.452096][T19326] do_syscall_64+0x166/0x520 [ 1582.452120][T19326] ? trace_irq_disable+0x3b/0x140 [ 1582.452140][T19326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1582.452159][T19326] ? clear_bhb_loop+0x70/0xc0 [ 1582.452182][T19326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1582.452200][T19326] RIP: 0033:0x7f798d19e559 [ 1582.452216][T19326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1582.452230][T19326] RSP: 002b:00007f798df90028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1582.452250][T19326] RAX: ffffffffffffffda RBX: 00007f798d425fa0 RCX: 00007f798d19e559 [ 1582.452263][T19326] RDX: 0000000000000004 RSI: 0000200000000140 RDI: 0000000000000003 [ 1582.452276][T19326] RBP: 00007f798df90090 R08: 0000000000000000 R09: 0000000000000000 [ 1582.452288][T19326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1582.452300][T19326] R13: 00007f798d426038 R14: 00007f798d425fa0 R15: 00007ffcc32cf108 [ 1582.452331][T19326] [ 1582.547314][T19323] netlink: 120 bytes leftover after parsing attributes in process `syz.1.13480'. [ 1582.568205][ T3301] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1582.568237][ T3301] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.635607][T19258] lo speed is unknown, defaulting to 1000 [ 1583.011855][ T3301] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1583.032448][ T3301] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1583.129631][T19336] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13486'. [ 1583.338692][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1583.642876][T19258] dummy0 speed is unknown, defaulting to 1000 [ 1583.794727][ T3301] bond11: left allmulticast mode [ 1583.794804][ T3301] bond11: left promiscuous mode [ 1583.811484][ T3301] bridge0: port 1(bond11) entered disabled state [ 1583.855441][ T3301] dummy0: left promiscuous mode [ 1583.857911][ T3301] bridge4: port 1(dummy0) entered disabled state [ 1583.966328][ T3301] dummy0: left allmulticast mode [ 1584.028828][T19353] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13491'. [ 1584.067307][T19357] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13494'. [ 1584.219273][ T5629] Bluetooth: hci4: command tx timeout [ 1584.378730][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1584.914942][T19370] FAULT_INJECTION: forcing a failure. [ 1584.914942][T19370] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1584.914975][T19370] CPU: 0 UID: 0 PID: 19370 Comm: syz.1.13498 Not tainted syzkaller #0 PREEMPT(full) [ 1584.914996][T19370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1584.915007][T19370] Call Trace: [ 1584.915015][T19370] [ 1584.915024][T19370] dump_stack_lvl+0xe8/0x150 [ 1584.915055][T19370] should_fail_ex+0x410/0x560 [ 1584.915086][T19370] _copy_from_user+0x2d/0xb0 [ 1584.915114][T19370] __copy_msghdr+0x390/0x590 [ 1584.915140][T19370] ___sys_sendmsg+0x213/0x360 [ 1584.915159][T19370] ? __lock_acquire+0x747/0x2de0 [ 1584.915184][T19370] ? __pfx____sys_sendmsg+0x10/0x10 [ 1584.915212][T19370] ? kstrtouint+0x6e/0xe0 [ 1584.915259][T19370] ? __fget_files+0x2a/0x420 [ 1584.915285][T19370] ? __fget_files+0x3a2/0x420 [ 1584.915320][T19370] __sys_sendmmsg+0x273/0x4d0 [ 1584.915346][T19370] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1584.915374][T19370] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1584.915414][T19370] ? ksys_write+0x242/0x270 [ 1584.915436][T19370] ? __pfx_ksys_write+0x10/0x10 [ 1584.915462][T19370] __x64_sys_sendmmsg+0xa0/0xc0 [ 1584.915484][T19370] do_syscall_64+0x166/0x520 [ 1584.915509][T19370] ? trace_irq_disable+0x3b/0x140 [ 1584.915528][T19370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1584.915548][T19370] ? clear_bhb_loop+0x70/0xc0 [ 1584.915571][T19370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1584.915590][T19370] RIP: 0033:0x7fdf54b9e559 [ 1584.915608][T19370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1584.915623][T19370] RSP: 002b:00007fdf559cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1584.915644][T19370] RAX: ffffffffffffffda RBX: 00007fdf54e25fa0 RCX: 00007fdf54b9e559 [ 1584.915658][T19370] RDX: 0000000000000001 RSI: 0000200000000580 RDI: 0000000000000003 [ 1584.915670][T19370] RBP: 00007fdf559cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1584.915682][T19370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1584.915694][T19370] R13: 00007fdf54e26038 R14: 00007fdf54e25fa0 R15: 00007fffdb9e3538 [ 1584.915724][T19370] [ 1585.115970][ T3301] bond13 (unregistering): (slave gre5): Releasing backup interface [ 1585.242540][ T3301] bond12 (unregistering): (slave gre4): Releasing backup interface [ 1585.418710][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1585.661992][ T3301] bond1 (unregistering): (slave geneve2): Releasing active interface [ 1585.762530][ T3301] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 1585.762559][ T3301] bridge3 (unregistering): left allmulticast mode [ 1585.916778][ T3301] bond0 (unregistering): Released all slaves [ 1585.928305][ T3301] bond1 (unregistering): Released all slaves [ 1585.942698][ T3301] bond2 (unregistering): Released all slaves [ 1585.972238][ T3301] bond3 (unregistering): Released all slaves [ 1585.986064][ T3301] bond4 (unregistering): Released all slaves [ 1586.000668][ T3301] bond5 (unregistering): Released all slaves [ 1586.017219][ T3301] bond6 (unregistering): Released all slaves [ 1586.047328][ T3301] bond7 (unregistering): Released all slaves [ 1586.076664][ T3301] bond8 (unregistering): Released all slaves [ 1586.124506][ T3301] bond9 (unregistering): Released all slaves [ 1586.174108][ T3301] bond10 (unregistering): Released all slaves [ 1586.202977][ T3301] bond11 (unregistering): Released all slaves [ 1586.263914][ T3301] bond12 (unregistering): Released all slaves [ 1586.298683][ T5629] Bluetooth: hci4: command tx timeout [ 1586.303626][ T3301] bond13 (unregistering): Released all slaves [ 1586.344487][ T3301] bond14 (unregistering): Released all slaves [ 1586.363849][ T3301] bond15 (unregistering): Released all slaves [ 1586.384101][ T3301] bond17 (unregistering): Released all slaves [ 1586.421183][ T3301] bond16 (unregistering): Released all slaves [ 1586.458700][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1586.937880][ T3301] ovs-dp0: left promiscuous mode [ 1587.067693][T19393] netlink: 104 bytes leftover after parsing attributes in process `syz.0.13506'. [ 1587.417125][ T3301] : left promiscuous mode [ 1587.451895][T19410] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13508'. [ 1587.498765][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1587.549421][ T3301] tipc: Disabling bearer [ 1587.549551][ T3301] tipc: Disabling bearer [ 1587.549678][ T3301] tipc: Left network mode [ 1587.788464][T19418] FAULT_INJECTION: forcing a failure. [ 1587.788464][T19418] name failslab, interval 1, probability 0, space 0, times 0 [ 1587.788492][T19418] CPU: 1 UID: 0 PID: 19418 Comm: syz.2.13512 Not tainted syzkaller #0 PREEMPT(full) [ 1587.788509][T19418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1587.788519][T19418] Call Trace: [ 1587.788525][T19418] [ 1587.788533][T19418] dump_stack_lvl+0xe8/0x150 [ 1587.788561][T19418] should_fail_ex+0x410/0x560 [ 1587.788592][T19418] should_failslab+0xa8/0x100 [ 1587.788613][T19418] ? inet_bind2_bucket_create+0x34/0x510 [ 1587.788718][T19418] kmem_cache_alloc_noprof+0xa1/0x600 [ 1587.788735][T19418] ? kmem_cache_alloc_noprof+0x31f/0x600 [ 1587.788750][T19418] ? inet_bind_bucket_create+0x30/0x240 [ 1587.788769][T19418] ? inet_bind2_bucket_create+0x34/0x510 [ 1587.788794][T19418] inet_bind2_bucket_create+0x34/0x510 [ 1587.788818][T19418] inet_csk_get_port+0xf58/0x1740 [ 1587.788896][T19418] inet_csk_listen_start+0x17c/0x380 [ 1587.788922][T19418] __inet_listen_sk+0x2d3/0x5c0 [ 1587.788977][T19418] ? __pfx___inet_listen_sk+0x10/0x10 [ 1587.789003][T19418] ? mptcp_listen+0x235/0x4a0 [ 1587.789082][T19418] ? __local_bh_enable_ip+0xd6/0x140 [ 1587.789108][T19418] mptcp_listen+0x23f/0x4a0 [ 1587.789133][T19418] __x64_sys_listen+0x1c7/0x240 [ 1587.789160][T19418] do_syscall_64+0x166/0x520 [ 1587.789180][T19418] ? trace_irq_disable+0x3b/0x140 [ 1587.789197][T19418] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1587.789214][T19418] ? clear_bhb_loop+0x70/0xc0 [ 1587.789234][T19418] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1587.789249][T19418] RIP: 0033:0x7f798d19e559 [ 1587.789265][T19418] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1587.789279][T19418] RSP: 002b:00007f798df90028 EFLAGS: 00000246 ORIG_RAX: 0000000000000032 [ 1587.789296][T19418] RAX: ffffffffffffffda RBX: 00007f798d425fa0 RCX: 00007f798d19e559 [ 1587.789308][T19418] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000003 [ 1587.789317][T19418] RBP: 00007f798df90090 R08: 0000000000000000 R09: 0000000000000000 [ 1587.789327][T19418] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1587.789337][T19418] R13: 00007f798d426038 R14: 00007f798d425fa0 R15: 00007ffcc32cf108 [ 1587.789365][T19418] [ 1588.378694][ T5629] Bluetooth: hci4: command tx timeout [ 1588.538704][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1588.928517][ T5279] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1589.103086][T19443] rxe_eth0 speed is unknown, defaulting to 1000 [ 1589.291091][T19466] netlink: 64 bytes leftover after parsing attributes in process `syz.1.13521'. [ 1589.433541][T19258] bridge0: port 1(bridge_slave_0) entered blocking state [ 1589.436672][T19258] bridge0: port 1(bridge_slave_0) entered disabled state [ 1589.436811][T19258] bridge_slave_0: entered allmulticast mode [ 1589.441317][T19258] bridge_slave_0: entered promiscuous mode [ 1589.498085][T19258] bridge0: port 2(bridge_slave_1) entered blocking state [ 1589.498189][T19258] bridge0: port 2(bridge_slave_1) entered disabled state [ 1589.498345][T19258] bridge_slave_1: entered allmulticast mode [ 1589.502359][T19258] bridge_slave_1: entered promiscuous mode [ 1589.578701][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1589.690622][T19471] netlink: 104 bytes leftover after parsing attributes in process `syz.1.13523'. [ 1589.718269][T19258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1589.744383][T19258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1589.944851][T19258] team0: Port device team_slave_0 added [ 1589.955045][T19258] team0: Port device team_slave_1 added [ 1590.056710][T19258] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1590.056728][T19258] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1590.056752][T19258] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1590.065450][T19258] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1590.065464][T19258] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1590.065487][T19258] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1590.213212][T19451] rxe_eth0 speed is unknown, defaulting to 1000 [ 1590.264844][T19258] hsr_slave_0: entered promiscuous mode [ 1590.267973][T19258] hsr_slave_1: entered promiscuous mode [ 1590.276449][T19258] debugfs: 'hsr0' already exists in 'hsr' [ 1590.276468][T19258] Cannot create hsr debugfs directory [ 1590.571583][T19485] @0Ù: renamed from bond_slave_1 (while UP) [ 1590.618700][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1591.243457][T19451] lo speed is unknown, defaulting to 1000 [ 1591.249064][ T5279] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1591.282877][T19504] netlink: 64 bytes leftover after parsing attributes in process `syz.0.13532'. [ 1591.556851][T19511] netlink: 104 bytes leftover after parsing attributes in process `syz.0.13534'. [ 1591.658744][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1592.051631][T19443] lo speed is unknown, defaulting to 1000 [ 1592.066453][T19451] dummy0 speed is unknown, defaulting to 1000 [ 1592.574608][T19538] netlink: 12 bytes leftover after parsing attributes in process `syz.1.13537'. [ 1592.574638][T19538] openvswitch: netlink: EtherType 0 is less than min 600 [ 1592.698764][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1592.812431][T19542] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13538'. [ 1593.139496][T19258] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1593.172603][T19258] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1593.175340][T19443] dummy0 speed is unknown, defaulting to 1000 [ 1593.177011][T19258] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1593.228255][T19258] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1593.233664][T19258] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1593.258553][T19258] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1593.268440][T19258] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1593.317780][T19258] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1593.404961][T19538] rxe_eth0 speed is unknown, defaulting to 1000 [ 1593.738698][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1594.266068][ T3301] hsr_slave_0: left promiscuous mode [ 1594.308773][ T3301] hsr_slave_1: left promiscuous mode [ 1594.504697][ T3301] veth1_macvtap: left allmulticast mode [ 1594.504724][ T3301] veth1_macvtap: left promiscuous mode [ 1594.504767][ T3301] veth0_macvtap: left promiscuous mode [ 1594.748793][T19572] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13540'. [ 1594.779653][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1594.790990][ T5629] block nbd2: Receive control failed (result -1) [ 1595.818686][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1596.005505][T14504] infiniband syz1: ib_query_port failed (-19) [ 1596.105042][ T3317] smc: removing ib device syz1 [ 1596.400095][T19258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1596.488320][T19258] 8021q: adding VLAN 0 to HW filter on device team0 [ 1596.489927][ T3317] smbdirect: ib_dev[syz1] removed [ 1596.562492][T19583] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13543'. [ 1596.564209][ T3280] bridge0: port 1(bridge_slave_0) entered blocking state [ 1596.564305][ T3280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1596.643477][T18966] bridge0: port 2(bridge_slave_1) entered blocking state [ 1596.643583][T18966] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1596.858693][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1596.875095][T19258] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1597.898735][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1598.611575][T19258] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1598.938713][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1599.510058][T19664] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13561'. [ 1599.978780][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1600.064715][T19258] veth0_vlan: entered promiscuous mode [ 1600.106284][T19258] veth1_vlan: entered promiscuous mode [ 1600.204940][T19258] veth0_macvtap: entered promiscuous mode [ 1600.231748][T19258] veth1_macvtap: entered promiscuous mode [ 1600.275464][T19258] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1600.315830][T19258] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1600.395134][T18971] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.413526][T19685] bridge_slave_1: default FDB implementation only supports local addresses [ 1600.442239][T18968] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.442529][T18968] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.442563][T18968] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1600.745834][ T3308] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1600.745856][ T3308] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1600.990402][T18967] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1600.990424][T18967] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1601.018721][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1602.036712][T19724] ip6gre1: entered allmulticast mode [ 1602.058692][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1602.944519][ T7813] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1602.958219][ T7813] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1602.968560][ T7813] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1602.974560][ T7813] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1602.985539][ T7813] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1603.046319][T19745] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1603.098705][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1603.491506][ T3301] IPVS: stop unused estimator thread 0... [ 1603.859347][T19773] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1604.139105][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1604.213424][T19740] rxe_eth0 speed is unknown, defaulting to 1000 [ 1604.298560][T19787] ipvlan0: entered allmulticast mode [ 1604.298969][T19787] bond0: entered allmulticast mode [ 1604.298991][T19787] netdevsim netdevsim3 netdevsim1: entered allmulticast mode [ 1604.377766][T19789] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1604.452202][T19740] dummy0 speed is unknown, defaulting to 1000 [ 1605.098996][ T5629] Bluetooth: hci0: command tx timeout [ 1605.175446][T19740] bridge0: port 1(bridge_slave_0) entered blocking state [ 1605.175545][T19740] bridge0: port 1(bridge_slave_0) entered disabled state [ 1605.175690][T19740] bridge_slave_0: entered allmulticast mode [ 1605.178718][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1605.182599][T19740] bridge_slave_0: entered promiscuous mode [ 1605.225604][T19740] bridge0: port 2(bridge_slave_1) entered blocking state [ 1605.225708][T19740] bridge0: port 2(bridge_slave_1) entered disabled state [ 1605.225872][T19740] bridge_slave_1: entered allmulticast mode [ 1605.237785][T19740] bridge_slave_1: entered promiscuous mode [ 1605.396254][T19834] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1605.424697][T19740] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1605.443748][T19740] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1605.648184][T19740] team0: Port device team_slave_0 added [ 1605.663421][T19740] team0: Port device team_slave_1 added [ 1605.804213][T19740] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1605.804230][T19740] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1605.804253][T19740] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1605.816949][T19740] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1605.816966][T19740] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1605.816988][T19740] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1606.051346][T19740] hsr_slave_0: entered promiscuous mode [ 1606.052374][T19740] hsr_slave_1: entered promiscuous mode [ 1606.053066][T19740] debugfs: 'hsr0' already exists in 'hsr' [ 1606.053083][T19740] Cannot create hsr debugfs directory [ 1606.218687][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1606.329101][T19740] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1606.553313][T19740] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1606.794556][T19740] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1606.842432][T19885] netlink: 24 bytes leftover after parsing attributes in process `syz.0.13650'. [ 1606.842862][T19890] netlink: 'syz.4.13652': attribute type 5 has an invalid length. [ 1607.005695][T19898] netlink: 8 bytes leftover after parsing attributes in process `syz.4.13654'. [ 1607.026173][T19740] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1607.116481][T19897] bond16: (slave veth0_to_bond): Releasing active interface [ 1607.179243][ T5629] Bluetooth: hci0: command tx timeout [ 1607.197152][T19898] ipvlan2: entered promiscuous mode [ 1607.242030][T19909] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13661'. [ 1607.259790][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1607.300177][T19904] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1500) ! [ 1607.322583][T19904] syzkaller0: entered promiscuous mode [ 1607.322603][T19904] syzkaller0: entered allmulticast mode [ 1607.487018][T19920] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1607.975950][T19740] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1607.996240][T19740] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1608.006601][T19740] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1608.023930][T19740] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1608.025267][T19740] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1608.049731][T19740] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1608.051244][T19740] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1608.100010][T19740] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1608.200977][T19953] ip6gre1: entered promiscuous mode [ 1608.201000][T19953] ip6gre1: entered allmulticast mode [ 1608.298690][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1608.552092][T19740] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1608.611301][T19740] 8021q: adding VLAN 0 to HW filter on device team0 [ 1608.632161][T18967] bridge0: port 1(bridge_slave_0) entered blocking state [ 1608.632262][T18967] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1608.661279][T18971] bridge0: port 2(bridge_slave_1) entered blocking state [ 1608.661384][T18971] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1609.260101][ T5629] Bluetooth: hci0: command tx timeout [ 1609.338812][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1609.787864][T19740] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1609.866921][T19740] veth0_vlan: entered promiscuous mode [ 1609.882526][T19740] veth1_vlan: entered promiscuous mode [ 1609.956459][T19740] veth0_macvtap: entered promiscuous mode [ 1609.986151][T19740] veth1_macvtap: entered promiscuous mode [ 1610.027073][T19740] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1610.067539][T19740] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1610.190923][ T3317] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1610.228429][ T3317] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1610.289887][ T3301] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1610.309009][ T3301] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1610.378817][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1610.562014][T18968] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1610.562035][T18968] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1610.659195][T18966] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1610.659214][T18966] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1611.338512][ T7813] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1611.352033][ T7813] Bluetooth: hci0: command tx timeout [ 1611.363254][ T7813] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1611.365694][ T7813] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1611.386487][T20068] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1611.389098][T20068] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1611.419217][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1612.459519][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1612.671560][T20063] rxe_eth0 speed is unknown, defaulting to 1000 [ 1612.736924][T20120] ip_tables: iptables: counters copy to user failed while replacing table [ 1613.480927][T20147] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1613.482464][T20063] dummy0 speed is unknown, defaulting to 1000 [ 1613.498778][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1613.500886][ T5629] Bluetooth: hci1: command tx timeout [ 1614.507210][T20180] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1614.538776][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1614.783504][T20194] sctp: [Deprecated]: syz.1.13777 (pid 20194) Use of int in max_burst socket option. [ 1614.783504][T20194] Use struct sctp_assoc_value instead [ 1614.833526][T20063] bridge0: port 1(bridge_slave_0) entered blocking state [ 1614.833693][T20063] bridge0: port 1(bridge_slave_0) entered disabled state [ 1614.833926][T20063] bridge_slave_0: entered allmulticast mode [ 1614.835645][T20063] bridge_slave_0: entered promiscuous mode [ 1614.865957][T20063] bridge0: port 2(bridge_slave_1) entered blocking state [ 1614.866130][T20063] bridge0: port 2(bridge_slave_1) entered disabled state [ 1614.866536][T20063] bridge_slave_1: entered allmulticast mode [ 1614.880124][T20063] bridge_slave_1: entered promiscuous mode [ 1615.110288][T20063] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1615.112147][T20203] xt_connbytes: Forcing CT accounting to be enabled [ 1615.112372][T20203] set match dimension is over the limit! [ 1615.125465][T20063] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1615.326153][T20063] team0: Port device team_slave_0 added [ 1615.337623][T20063] team0: Port device team_slave_1 added [ 1615.505376][T20063] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1615.505394][T20063] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1615.505426][T20063] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1615.512295][T20063] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1615.512310][T20063] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1615.512332][T20063] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1615.578830][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1615.579544][ T5629] Bluetooth: hci1: command tx timeout [ 1615.814463][T20063] hsr_slave_0: entered promiscuous mode [ 1615.823926][T20063] hsr_slave_1: entered promiscuous mode [ 1615.824594][T20063] debugfs: 'hsr0' already exists in 'hsr' [ 1615.824611][T20063] Cannot create hsr debugfs directory [ 1616.614451][T20063] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1616.618911][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1616.921047][T20063] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1617.142715][T20063] bond0: (slave netdevsim1): Releasing backup interface [ 1617.165885][T20063] netdevsim netdevsim3 netdevsim1 (unregistering): left allmulticast mode [ 1617.167999][T20063] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1617.221061][T20250] bridge0: port 1(bridge_slave_0) entered disabled state [ 1617.309805][T20063] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1617.658805][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1617.659044][ T5629] Bluetooth: hci1: command tx timeout [ 1617.857697][T20267] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1617.919611][T20063] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1617.926732][T20063] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1617.927573][T20063] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1617.964949][T20063] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1617.965821][T20063] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1617.990539][T20063] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1617.991471][T20063] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1618.021273][T20063] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1618.422803][T20063] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1618.451967][T20063] 8021q: adding VLAN 0 to HW filter on device team0 [ 1618.468501][ T3317] bridge0: port 1(bridge_slave_0) entered blocking state [ 1618.468667][ T3317] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1618.512743][ T3317] bridge0: port 2(bridge_slave_1) entered blocking state [ 1618.512850][ T3317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1618.698872][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1619.683011][T20063] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1619.738817][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1619.739387][ T5629] Bluetooth: hci1: command tx timeout [ 1619.817977][T20063] veth0_vlan: entered promiscuous mode [ 1619.834585][T20063] veth1_vlan: entered promiscuous mode [ 1619.844047][T20362] netlink: 12 bytes leftover after parsing attributes in process `syz.0.13849'. [ 1620.044774][T20368] bond1: (slave macvlan1): Enslaving as an active interface with an up link [ 1620.082752][T20371] bond1 (unregistering): (slave macvlan1): Releasing backup interface [ 1620.102047][T20371] bond1 (unregistering): Released all slaves [ 1620.297180][T20063] veth0_macvtap: entered promiscuous mode [ 1620.325892][T20063] veth1_macvtap: entered promiscuous mode [ 1620.432244][T20063] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1620.474979][T20063] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1620.571422][ T3317] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.573262][T18964] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.573300][T18964] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.573330][T18964] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1620.779940][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1620.907994][T18966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1620.908013][T18966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1621.066759][T20414] netlink: 'syz.4.13873': attribute type 3 has an invalid length. [ 1621.110213][T18968] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1621.110235][T18968] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1621.818859][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1622.858786][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1623.341839][T20525] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1623.797016][T20547] netlink: 8 bytes leftover after parsing attributes in process `syz.3.13936'. [ 1623.899107][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1624.071480][T20562] sctp: [Deprecated]: syz.3.13942 (pid 20562) Use of int in max_burst socket option deprecated. [ 1624.071480][T20562] Use struct sctp_assoc_value instead [ 1624.172436][T20567] openvswitch: netlink: EtherType 8 is less than min 600 [ 1624.732073][T20597] netlink: 52 bytes leftover after parsing attributes in process `syz.2.13960'. [ 1624.938790][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1625.495830][T20629] IPv6: NLM_F_CREATE should be specified when creating new route [ 1625.978820][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1626.726406][T20687] tipc: Started in network mode [ 1626.726436][T20687] tipc: Node identity 7e4f2f96cfc9, cluster identity 4711 [ 1626.726666][T20687] tipc: Enabled bearer , priority 0 [ 1626.747960][T20687] syzkaller0: entered promiscuous mode [ 1626.747982][T20687] syzkaller0: entered allmulticast mode [ 1626.765133][T20687] tipc: Resetting bearer [ 1626.774874][T20686] tipc: Resetting bearer [ 1626.801497][T20686] tipc: Disabling bearer [ 1627.018836][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1627.529601][T20721] sctp: [Deprecated]: syz.2.14019 (pid 20721) Use of int in max_burst socket option. [ 1627.529601][T20721] Use struct sctp_assoc_value instead [ 1628.058791][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1629.100242][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1629.247519][T20793] netlink: 388 bytes leftover after parsing attributes in process `syz.4.14052'. [ 1630.138830][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1631.178765][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1632.218757][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1633.153784][T20962] bridge0: port 1(bridge_slave_0) entered disabled state [ 1633.258754][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1633.630983][T20985] bridge0: port 1(bridge_slave_0) entered disabled state [ 1633.887571][T20997] sctp: [Deprecated]: syz.3.14146 (pid 20997) Use of int in max_burst socket option deprecated. [ 1633.887571][T20997] Use struct sctp_assoc_value instead [ 1634.298772][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1634.820697][T21037] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14166'. [ 1635.338846][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1636.378840][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1637.166092][T21137] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14209'. [ 1637.424246][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1637.832129][T21167] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14223'. [ 1637.853449][T21171] openvswitch: netlink: Flow actions attr not present in new flow. [ 1638.458821][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1638.608830][T21199] openvswitch: netlink: Flow actions attr not present in new flow. [ 1639.257567][T21220] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14245'. [ 1639.496421][T21231] syzkaller0: entered promiscuous mode [ 1639.496443][T21231] syzkaller0: entered allmulticast mode [ 1639.498759][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1639.721615][T21239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14254'. [ 1640.538800][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1640.548513][T21273] netlink: 12 bytes leftover after parsing attributes in process `syz.0.14267'. [ 1641.090646][T21300] openvswitch: netlink: Flow key attr not present in new flow. [ 1641.271326][T21307] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14284'. [ 1641.578765][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1641.711467][T21332] openvswitch: netlink: IP tunnel dst address not specified [ 1642.553526][T21360] openvswitch: netlink: IP tunnel dst address not specified [ 1642.619568][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1643.058422][T21370] netlink: 'syz.2.14315': attribute type 3 has an invalid length. [ 1643.665529][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1644.705178][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1645.668622][ C1] sched: DL replenish lagged too much [ 1645.740796][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1646.778921][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1647.818900][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1648.862074][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1649.899824][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1650.940487][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1651.984149][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1653.025245][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1654.064529][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1655.105493][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1656.141701][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1657.178976][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1658.219574][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1659.261405][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1660.301972][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1661.339534][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1662.386597][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1663.423444][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1664.458840][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1665.503212][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1666.539100][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1667.579633][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1668.625143][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1669.659855][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1670.704457][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1671.696084][T20068] Bluetooth: hci5: command 0x0406 tx timeout [ 1671.743852][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1672.781992][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1673.820775][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1674.861779][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1675.902144][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1676.945990][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1677.979837][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1679.020255][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1680.063679][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1681.099927][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1682.140890][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1683.181364][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1684.225794][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1685.265596][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1686.306277][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1687.340310][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1688.379444][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1689.421196][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1690.461711][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1691.506386][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1692.541513][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1693.585809][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1694.620256][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1695.662635][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1696.703496][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1697.743232][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1698.781786][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1699.825697][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1700.863917][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1701.901952][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1702.942313][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1703.980577][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1705.021913][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1706.062339][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1707.104720][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1708.138764][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1709.184828][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1710.218729][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1711.263377][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1712.305134][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1713.340523][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1714.381316][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1715.423243][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1716.461618][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1717.504911][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1718.544674][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1719.582245][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1720.621368][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1721.661951][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1722.699546][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1723.744103][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1724.780006][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1725.823188][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1726.858717][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1727.904906][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1728.942932][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1729.983272][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1731.024878][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1732.059345][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1733.105998][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1734.145955][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1735.182871][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1736.224272][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1737.264380][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1738.302076][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1739.342273][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1740.382796][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1741.421084][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1742.464777][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1743.503246][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1744.545578][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1745.584422][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1746.623055][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1747.665358][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1748.703920][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1749.740277][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1750.785481][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1751.823049][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1752.865785][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1753.900983][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1754.941375][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1755.983670][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1757.023351][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1758.062779][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1759.100299][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1760.139280][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1761.180358][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1762.218581][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1762.220381][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0 [ 1762.233253][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P21372/1:b..l [ 1762.241289][ C0] rcu: (detected by 0, t=10504 jiffies, g=334993, q=2129 ncpus=2) [ 1762.249192][ C0] task:syz.1.14317 state:R running task stack:25576 pid:21372 tgid:21372 ppid:19740 task_flags:0x400040 flags:0x00080002 [ 1762.262702][ C0] Call Trace: [ 1762.266014][ C0] [ 1762.268954][ C0] __schedule+0x17db/0x58f0 [ 1762.273487][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 1762.278708][ C0] ? __lock_acquire+0x747/0x2de0 [ 1762.283656][ C0] ? __pfx___schedule+0x10/0x10 [ 1762.288531][ C0] ? __lock_acquire+0x747/0x2de0 [ 1762.293489][ C0] preempt_schedule_irq+0x4b/0x90 [ 1762.298526][ C0] irqentry_exit+0x14f/0x920 [ 1762.303137][ C0] ? trace_irq_disable+0x3b/0x140 [ 1762.308185][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1762.314176][ C0] RIP: 0010:lock_is_held_type+0x106/0x150 [ 1762.319909][ C0] Code: 1b 00 00 b8 ff ff ff ff 65 0f c1 05 ec 1b ad 08 83 f8 01 75 25 9c 58 a9 00 02 00 00 75 39 41 f7 c4 00 02 00 00 74 01 fb 89 d8 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 90 0f 0b 90 48 c7 [ 1762.339517][ C0] RSP: 0018:ffffc900049c7608 EFLAGS: 00000206 [ 1762.345592][ C0] RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000046 [ 1762.353566][ C0] RDX: 0000000000000000 RSI: ffffffff8e6dd18a RDI: ffffffff8c6dd880 [ 1762.361541][ C0] RBP: 00000000ffffffff R08: ffffffff8244d222 R09: 0000000000000000 [ 1762.369516][ C0] R10: dffffc0000000000 R11: fffff940003d5ef7 R12: 0000000000000246 [ 1762.377493][ C0] R13: ffff888040775dc0 R14: ffffffff8fd5c8a0 R15: 0000000000000001 [ 1762.385474][ C0] ? page_ext_get+0x22/0x2e0 [ 1762.390093][ C0] ? page_ext_get+0x22/0x2e0 [ 1762.394697][ C0] page_ext_get+0x1b0/0x2e0 [ 1762.399216][ C0] __reset_page_owner+0x28/0x1f0 [ 1762.404187][ C0] __free_frozen_pages+0xc93/0xd90 [ 1762.409316][ C0] __slab_free+0x274/0x2c0 [ 1762.413752][ C0] ? qlist_free_all+0x8e/0x100 [ 1762.418526][ C0] qlist_free_all+0x99/0x100 [ 1762.423123][ C0] kasan_quarantine_reduce+0x148/0x160 [ 1762.428594][ C0] __kasan_slab_alloc+0x22/0x80 [ 1762.433464][ C0] kmem_cache_alloc_node_noprof+0x354/0x610 [ 1762.439368][ C0] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1762.445437][ C0] ? dup_task_struct+0x52/0xa00 [ 1762.450306][ C0] ? dup_task_struct+0x52/0xa00 [ 1762.455180][ C0] dup_task_struct+0x52/0xa00 [ 1762.459872][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1762.465085][ C0] copy_process+0x7e0/0x4400 [ 1762.469702][ C0] ? lock_acquire+0x115/0x350 [ 1762.474396][ C0] ? __pfx_copy_process+0x10/0x10 [ 1762.479442][ C0] kernel_clone+0x2d7/0x940 [ 1762.483963][ C0] ? __pfx_kernel_clone+0x10/0x10 [ 1762.489026][ C0] __se_sys_clone3+0x33c/0x360 [ 1762.493806][ C0] ? __pfx___se_sys_clone3+0x10/0x10 [ 1762.499120][ C0] ? _copy_to_user+0x8a/0xb0 [ 1762.503741][ C0] ? do_user_addr_fault+0xc4c/0x1340 [ 1762.509041][ C0] do_syscall_64+0x166/0x520 [ 1762.513643][ C0] ? trace_irq_disable+0x3b/0x140 [ 1762.518673][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1762.524745][ C0] ? clear_bhb_loop+0x70/0xc0 [ 1762.529430][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1762.535325][ C0] RIP: 0033:0x7f603db9f349 [ 1762.539740][ C0] RSP: 002b:00007ffedf9e6ee8 EFLAGS: 00000202 ORIG_RAX: 00000000000001b3 [ 1762.548158][ C0] RAX: ffffffffffffffda RBX: 00007f603db5a8e0 RCX: 00007f603db9f349 [ 1762.556133][ C0] RDX: 00007f603db5a8e0 RSI: 0000000000000058 RDI: 00007ffedf9e6f40 [ 1762.564107][ C0] RBP: 00007f603e9ed6c0 R08: 00007f603e9ed6c0 R09: 00007ffedf9e7027 [ 1762.572084][ C0] R10: 0000000000000008 R11: 0000000000000202 R12: ffffffffffffffe8 [ 1762.580056][ C0] R13: 000000000000006e R14: 00007ffedf9e6f40 R15: 00007ffedf9e7028 [ 1762.588051][ C0] [ 1762.591073][ C0] rcu: rcu_preempt kthread starved for 2179 jiffies! g334993 f0x0 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=1 [ 1762.602089][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1762.612057][ C0] rcu: RCU grace-period kthread stack dump: [ 1762.617943][ C0] task:rcu_preempt state:R running task stack:27496 pid:17 tgid:17 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1762.631447][ C0] Call Trace: [ 1762.634726][ C0] [ 1762.637659][ C0] __schedule+0x17db/0x58f0 [ 1762.642176][ C0] ? __lock_acquire+0x747/0x2de0 [ 1762.647133][ C0] ? do_raw_spin_unlock+0xf5/0x200 [ 1762.652271][ C0] ? __pfx___schedule+0x10/0x10 [ 1762.657130][ C0] ? lock_acquire+0x115/0x350 [ 1762.661828][ C0] ? schedule+0x90/0x2b0 [ 1762.666085][ C0] schedule+0x164/0x2b0 [ 1762.670260][ C0] schedule_timeout+0x152/0x2c0 [ 1762.675118][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 1762.680504][ C0] ? __pfx_process_timeout+0x10/0x10 [ 1762.685811][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1762.691640][ C0] ? prepare_to_swait_event+0x322/0x350 [ 1762.697214][ C0] rcu_gp_fqs_loop+0x30c/0x11f0 [ 1762.702095][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 1762.708263][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1762.713556][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1762.718772][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1762.724592][ C0] rcu_gp_kthread+0x9e/0x2b0 [ 1762.729198][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1762.734415][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1762.739369][ C0] ? __kthread_parkme+0x199/0x1f0 [ 1762.744418][ C0] kthread+0x38b/0x480 [ 1762.748500][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1762.753714][ C0] ? __pfx_kthread+0x10/0x10 [ 1762.758325][ C0] ret_from_fork+0x514/0xb70 [ 1762.762990][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1762.768123][ C0] ? __switch_to+0xc89/0x1420 [ 1762.772824][ C0] ? __pfx_kthread+0x10/0x10 [ 1762.777422][ C0] ret_from_fork_asm+0x1a/0x30 [ 1762.782221][ C0] [ 1762.785240][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 1762.791576][ C0] Sending NMI from CPU 0 to CPUs 1: [ 1762.796841][ C1] NMI backtrace for cpu 1 [ 1762.796858][ C1] CPU: 1 UID: 0 PID: 3296 Comm: kworker/u8:44 Not tainted syzkaller #0 PREEMPT(full) [ 1762.796880][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1762.796893][ C1] Workqueue: krds_cp_wq#0/1 rds_connect_worker [ 1762.796919][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80 [ 1762.796942][ C1] Code: 89 fb e8 23 00 00 00 48 8b 3d 24 71 aa 0c 48 89 de 5b e9 23 5e 65 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d b8 e0 cc 12 65 48 8b 15 b8 e0 [ 1762.796958][ C1] RSP: 0018:ffffc90000a17d78 EFLAGS: 00000297 [ 1762.796975][ C1] RAX: ffffffff8aa77276 RBX: 0000607edbf3e010 RCX: ffff88802f32be80 [ 1762.796990][ C1] RDX: 8000000000000300 RSI: 0000000000000001 RDI: 0000000000000008 [ 1762.797003][ C1] RBP: ffffc90000a17f80 R08: 0000000000000100 R09: 0000000000000000 [ 1762.797016][ C1] R10: ffffc90000a17ed0 R11: fffff52000142fde R12: ffff88802d89b110 [ 1762.797039][ C1] R13: 0000000000000001 R14: 1ffff11005b13633 R15: 0000000000000001 [ 1762.797052][ C1] FS: 0000000000000000(0000) GS:ffff888123bd0000(0000) knlGS:0000000000000000 [ 1762.797068][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1762.797081][ C1] CR2: 00007f7ae9c00000 CR3: 000000003fa4c000 CR4: 00000000003526f0 [ 1762.797098][ C1] Call Trace: [ 1762.797106][ C1] [ 1762.797113][ C1] ip6t_do_table+0xb65/0x15b0 [ 1762.797186][ C1] ? ip6t_do_table+0x1d1/0x15b0 [ 1762.797207][ C1] ? __pfx_ip6t_do_table+0x10/0x10 [ 1762.797231][ C1] ? ipv6_defrag+0xab/0x3b0 [ 1762.797253][ C1] ? __pfx_ip6t_do_table+0x10/0x10 [ 1762.797273][ C1] nf_hook_slow+0xc5/0x220 [ 1762.797333][ C1] __ip6_local_out+0x819/0x940 [ 1762.797360][ C1] ? __ip6_local_out+0x15c/0x940 [ 1762.797385][ C1] ? __pfx___ip6_local_out+0x10/0x10 [ 1762.797411][ C1] ? __pfx_dst_output+0x10/0x10 [ 1762.797435][ C1] ? ip6_route_output_flags+0x2e/0x5d0 [ 1762.797455][ C1] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 1762.797506][ C1] ip6_local_out+0x2a/0x190 [ 1762.797532][ C1] synproxy_send_tcp_ipv6+0x565/0x730 [ 1762.797557][ C1] ? __pfx_synproxy_send_tcp_ipv6+0x10/0x10 [ 1762.797577][ C1] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1762.797605][ C1] ? synproxy_send_client_synack_ipv6+0x357/0xcd0 [ 1762.797628][ C1] synproxy_send_client_synack_ipv6+0x83f/0xcd0 [ 1762.797657][ C1] ? __pfx_synproxy_send_client_synack_ipv6+0x10/0x10 [ 1762.797686][ C1] ? nft_fib_init+0x224/0x3d0 [ 1762.797736][ C1] ? synproxy_pernet+0x45/0x270 [ 1762.797761][ C1] nft_synproxy_eval_v6+0x362/0x4e0 [ 1762.797786][ C1] ? __pfx_nft_synproxy_eval_v6+0x10/0x10 [ 1762.797811][ C1] ? nf_ip6_checksum+0x215/0x320 [ 1762.797833][ C1] nft_synproxy_do_eval+0x3ff/0x5d0 [ 1762.797855][ C1] ? __lock_acquire+0x747/0x2de0 [ 1762.797877][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 1762.797900][ C1] ? __lock_acquire+0x747/0x2de0 [ 1762.797926][ C1] nft_do_chain+0x48d/0x1b10 [ 1762.797948][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 1762.797980][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 1762.798022][ C1] nft_do_chain_inet+0x360/0x4b0 [ 1762.798076][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1762.798097][ C1] ? nf_nat_ipv6_local_in+0x157/0x660 [ 1762.798154][ C1] ? __pfx_nf_nat_ipv6_local_in+0x10/0x10 [ 1762.798181][ C1] ? lock_acquire+0x115/0x350 [ 1762.798202][ C1] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1762.798225][ C1] nf_hook_slow+0xc5/0x220 [ 1762.798255][ C1] NF_HOOK+0x21f/0x3c0 [ 1762.798279][ C1] ? __pfx_ip6_input_finish+0x10/0x10 [ 1762.798304][ C1] ? NF_HOOK+0x9e/0x3c0 [ 1762.798325][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1762.798350][ C1] ? __pfx_ip6_input_finish+0x10/0x10 [ 1762.798379][ C1] ip6_input+0x16a/0x270 [ 1762.798402][ C1] ? ip6_input+0x23/0x270 [ 1762.798426][ C1] NF_HOOK+0x336/0x3c0 [ 1762.798450][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1762.798473][ C1] ? NF_HOOK+0x9e/0x3c0 [ 1762.798495][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 1762.798519][ C1] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1762.798548][ C1] process_backlog+0x795/0x18b0 [ 1762.798582][ C1] ? call_timer_fn+0xd5/0x5f0 [ 1762.798605][ C1] ? process_backlog+0x3de/0x18b0 [ 1762.798638][ C1] __napi_poll+0xaa/0x330 [ 1762.798665][ C1] net_rx_action+0x61d/0xf50 [ 1762.798703][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 1762.798743][ C1] handle_softirqs+0x226/0x860 [ 1762.798768][ C1] ? do_softirq+0x77/0xd0 [ 1762.798793][ C1] ? __inet6_bind+0x301/0xf30 [ 1762.798819][ C1] do_softirq+0x77/0xd0 [ 1762.798842][ C1] [ 1762.798848][ C1] [ 1762.798855][ C1] __local_bh_enable_ip+0x100/0x140 [ 1762.798879][ C1] __inet6_bind+0x301/0xf30 [ 1762.798909][ C1] kernel_bind+0x13e/0x1c0 [ 1762.798932][ C1] ? __pfx_kernel_bind+0x10/0x10 [ 1762.798960][ C1] ? rds_tcp_conn_path_connect+0x336/0x920 [ 1762.799019][ C1] rds_tcp_conn_path_connect+0x53b/0x920 [ 1762.799051][ C1] ? __pfx_rds_tcp_conn_path_connect+0x10/0x10 [ 1762.799079][ C1] ? lock_acquire+0x115/0x350 [ 1762.799103][ C1] rds_connect_worker+0x1d8/0x290 [ 1762.799123][ C1] ? process_scheduled_works+0x97a/0x1630 [ 1762.799147][ C1] process_scheduled_works+0xc3d/0x1630 [ 1762.799186][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1762.799213][ C1] ? assign_work+0x3cf/0x5d0 [ 1762.799238][ C1] worker_thread+0xa47/0xfb0 [ 1762.799276][ C1] kthread+0x38b/0x480 [ 1762.799293][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1762.799317][ C1] ? __pfx_kthread+0x10/0x10 [ 1762.799334][ C1] ret_from_fork+0x514/0xb70 [ 1762.799364][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1762.799392][ C1] ? __switch_to+0xc89/0x1420 [ 1762.799418][ C1] ? __pfx_kthread+0x10/0x10 [ 1762.799435][ C1] ret_from_fork_asm+0x1a/0x30 [ 1762.799471][ C1] [ 1763.261367][ C1] syz_tun selects TX queue 0, but real number of TX queues is 0