last executing test programs: 5.607977939s ago: executing program 1 (id=6469): r0 = socket$inet_udp(0x2, 0x2, 0x0) unshare(0x2c020400) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)) socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x4, 0x400, 0x0, 0x1}, 0x50) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r1, &(0x7f0000000300)={{0x6, @rose, 0x8}, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default]}, 0x48) unshare(0x2a020400) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000000)={0x3, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000001280)={0x1, {{0x2, 0x4e20, @multicast2}}}, 0x88) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000000)=""/4091, &(0x7f0000001000)=0xffb) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x40000) r3 = socket$igmp(0x2, 0x3, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010004b042cbd7000000000007a000000", @ANYRES32=0x0, @ANYBLOB="c8000000000012800b00010062726964676500000c000280080031000300000000000000"], 0x3c}}, 0x0) getsockopt$sock_cred(r3, 0x1, 0x4d, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000080a05020000000000000000020000030900020073797a3200000000eeff724935377a3000000000140000001100010000000000000000000b00000a"], 0x54}, 0x1, 0x0, 0x0, 0x2004844}, 0x4000000) 5.448547185s ago: executing program 0 (id=6472): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r3, {0xb, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) recvmmsg(r4, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000040)=""/55, 0x37}, {&(0x7f0000000540)=""/189, 0xbd}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000000940)=""/74, 0x4a}, {&(0x7f0000000700)=""/109, 0x6d}, {&(0x7f0000000800)=""/188, 0xbc}, {&(0x7f00000009c0)=""/76, 0x4c}], 0x7}, 0x5d}], 0x1, 0x10022, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200000004000000020000000c00000000140000c1ed4bddb5042d91d984302fc8e6e92e09f298fd0001e737a0db829a07b2190caae342f3c988d50a6da4183cae92ce2c000000000000000063b02785a1102823d3a1af1bd975bacc8a98efed2a68e5af", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600"/14, 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3400000040000100fcff0700040000000100000004004880140001801000108004000f800800020010000000080002"], 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r8 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e00000004000000040000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000300000000000000000000000000e1000000000000000000"], 0x50) write$cgroup_subtree(r8, &(0x7f0000000000)=ANY=[@ANYBLOB='V?\x00\x00-\x00Y'], 0xfe33) 3.13974245s ago: executing program 1 (id=6479): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) socket(0x1d, 0x2, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000280)='S8', 0x2}], 0x1}}], 0x1, 0x20008000) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x200000d0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000001340)={'ip_vti0\x00', 0x0}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="18040000feffffff00000000000000001801000020696c250000000000202020db1af8ff41000000bda100000000000007010000f80000ffb702000008000000b703000000000000850000001900000095"], &(0x7f00000001c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.019494755s ago: executing program 0 (id=6481): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.swap.events\x00', 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4000) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x3}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x50}, 0x1, 0xba01, 0x0, 0x40000080}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.swap.events\x00', 0x0, 0x0) (async) sendmsg$TIPC_CMD_SHOW_PORTS(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x0, 0x8, 0x70bd29, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4000) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x3}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x50}, 0x1, 0xba01, 0x0, 0x40000080}, 0x0) (async) 2.723466013s ago: executing program 0 (id=6485): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_x25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, 0xe, 'wlan1\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket(0x27, 0xa, 0x20134) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000280)={0x84, @private=0xa010101, 0x4e24, 0x3, 'lblc\x00', 0x24, 0x0, 0x7b}, 0x2c) socket(0x2, 0x80805, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) getsockname(r0, &(0x7f0000000180)=@un=@abs, &(0x7f0000000040)=0x80) 2.434595813s ago: executing program 0 (id=6487): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4002050) 2.372279412s ago: executing program 2 (id=6488): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x9, &(0x7f0000000000)=0x1000, 0x4) (async) getsockopt$inet6_tcp_int(r0, 0x6, 0x9, 0x0, &(0x7f0000000080)) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010003b15000800000000000200000000", @ANYRES32=0x0, @ANYBLOB="0000000000b401001c04128009000100626f6e64000000000c00028008000400c5492ed1f83ad31017"], 0x3c}}, 0x0) 2.31387687s ago: executing program 0 (id=6489): socket$inet6_sctp(0xa, 0x4, 0x84) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000850000001300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7fff}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}]}, &(0x7f0000000400)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0xd3) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)) r2 = socket$alg(0x26, 0x5, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r3) sendmsg$NLBL_CIPSOV4_C_REMOVE(r3, &(0x7f0000000940)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000d80)=ANY=[@ANYBLOB="000300686eb485c63db3e0af4dc000", @ANYRES16=r4, @ANYBLOB="04002dbd7000fedbdf2502000000e8000c8014000b800800090013beee6e08000a00b67f00002c000b80080009002ae2f6370800090056e20040080009008b2c212f0800090037f6447508000a00a83200000c000b8008000900d3c5611814000b8008000a00b08b00000800090010e87c300c000b8008000a007e45000034000b80080009008423d61b08000900510a422c08000a008b630000080009007761627e08000a00f711000008000900b9f205342c000b80080009007ffad57008000a00bc2f000008000a004efa000008000900f9c8512d08000a00a4fa00000c000b8008000a00a8e600000c000b8008000900c9a88130080001000100000074000c8054000b8008000a00838c000008000900cd1c504908000900af8b211e08000a008483000008000900c63da07a08000a006e5c000008000a003135000008000a001fd10000080009005fa0203308000a007b4c00001c000b8008000a006248000008000900a01675080800090057325c5dc8000c8044000b8008000a00163b0000080009002734791508000a0078b500000800090091b95c6108000900bb1ef61f08000900a3cff94208000a0065b4000008000a00ded300004c000b8008000a0093a6000008000900fd7c0f6a0800090041602d0008000a00dadc000008000a007baf000008000a0000a5000008000900317c3247080009003542bf7f080009003063130234000b8008000a0056250000080009004ac2642908000a007b53000008000a001531000008000900396a452608000a00242600003c00088024000780080006008f000000080005003f29847e0800050005e51e6a08000600b700000014000780080006000c00000008000600a2000000080002000300000080000880240007800800060030000000080006004a00000008000600f3000000080006006a0000000c00078008000500ff0100004c00078008000500dea98a3d080005000aac284908000600020000000800060006000000080005004df13545080006004000000008000600b8000000080006002900000008000600bf000000ec0008801c000780080005007af3bc65080005007874bd3a080006005a0000004c000780080006009f000000080005004334222e080006000200000008000600f200000008000500a22d5f0a080006001300000008000600390000000800050085e7e559080006005e0000000c00078008000600680000001c000780080005003e9cbd420800050046e27064080006008400000014000780080006007d00000008000600250000004400078008000600bc000000080006009d00000008000600bd00000008000500cbb2ef550800050072a1385b080006002a0000000800060017000000080005001235e610"], 0x3f0}, 0x1, 0x0, 0x0, 0x20000000}, 0x810) bind$alg(r2, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="6a0e6435f82b96e120e95ef657c67f3804ab3fd20f854380e05a23b6758439b1bcc2af4612a9ffbedef954ca796197b2ad54eb4aa5e40f7e0679b02c55444cd757567b124e1c78808a05eac11e93d4de328758952e00000000", 0x59) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001940)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4044805) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, r0, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r6 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r6, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'lc\x00', 0x2c, 0x8, 0x73}, {@loopback, 0x4e23, 0x2, 0xcd, 0x12d5f, 0x3}}, 0x44) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0106004000000000005c0900000024000480130001"], 0x38}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(r6, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="020028bd5800fbdbdf2514000000340007800c00030001000000000000800800020006000000090001000c00040005000000dea1a5edba1d39c60000000000000000127a22b9f7f01fb1008babac7ee52baf50b2de19d9087d01383de48d1cf5eccec99e7e65304aba318664dfb40ff18c09de17e0a2cbd9f3b86ae22b712aaa161d41a315692cdfd9c4a1e7c20f2f74ff74646d7329542480f353da091703230e48e93e3530d5dd402e4f83b5b293aa6b36620524ae60d0a5c4778d8fb3d16e4b24ca704634b35bd8fe3ec2df9e74443c8e5926ea5d7f41372e95a9c4d9fa62b4594311b64931c475c0f62f59eb"], 0x48}, 0x1, 0x0, 0x0, 0x8804}, 0x24000000) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x73, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x9, 0xd}, &(0x7f00000006c0)=0x18) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="20002bbd7000ffdbdf250100000014000b00ff020000000000000000000000000001080008000000000014000b0020010000000000000000000000000001050000035edb32eeb5673a000000000800020901000000"], 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) getsockopt$WPAN_WANTACK(r5, 0x0, 0x0, 0x0, &(0x7f0000000180)) getsockopt$sock_buf(r1, 0x1, 0x37, 0x0, &(0x7f0000000200)) 2.223491364s ago: executing program 2 (id=6491): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48283, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'\x00', 0x52d35ce30131f272}) ioctl$TUNSETOFFLOAD(r3, 0x400454c9, 0xb) ioctl$TUNSETOWNER(r3, 0x400454cc, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000b80)={r4}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x501, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, 0x6001}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r2}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}}]}, 0x44}}, 0x40848c0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, 0x12e1b, 0x1a001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @loopback}]}}}]}, 0x3c}}, 0xc004) 2.213507971s ago: executing program 1 (id=6492): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@gettaction={0x54, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.826434343s ago: executing program 2 (id=6496): socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000001200)={{0xffffffffffffffff, &(0x7f0000000080)=':\'[\x00', 0x4002, &(0x7f00000000c0)={@align=0xfff, {0x2, 0xc71a, 0x6, 0x7}}, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4}, {[0x7, 0x7, 0x2]}, 0x4, 0x1000, &(0x7f0000000200)=""/4096}) (async) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000001200)={{0xffffffffffffffff, &(0x7f0000000080)=':\'[\x00', 0x4002, &(0x7f00000000c0)={@align=0xfff, {0x2, 0xc71a, 0x6, 0x7}}, 0x5, &(0x7f0000000140), &(0x7f0000000180)=0x4}, {[0x7, 0x7, 0x2]}, 0x4, 0x1000, &(0x7f0000000200)=""/4096}) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) (async) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x0) (async) listen(r2, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) (async) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) (async) write(r6, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) splice(r5, 0x0, r4, 0x0, 0x1100000000f336, 0x8) accept4$unix(r2, 0x0, 0x0, 0x0) (async) r7 = accept4$unix(r2, 0x0, 0x0, 0x0) setsockopt$sock_timeval(r7, 0x1, 0x42, &(0x7f0000000080)={0x0, 0xea60}, 0x10) read(r7, &(0x7f0000000240)=""/60, 0x3c) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, 0x0, 0x800) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) sendmsg$rds(r1, &(0x7f0000004dc0)={&(0x7f0000001280)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000001440)=[{&(0x7f00000012c0)=""/7, 0x7}, {&(0x7f0000001300)=""/106, 0x6a}, {&(0x7f0000001380)=""/150, 0x96}], 0x3, &(0x7f0000004c40)=[@rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000001480)=""/40, 0x28}, &(0x7f00000014c0)}}, @mask_cswp={0x58, 0x114, 0x9, {{0x1, 0xfffffffa}, &(0x7f0000001500)=0xa, &(0x7f0000001540)=0x2d, 0xffffffff, 0x3, 0x401, 0x5, 0x22, 0x2}}, @rdma_args={0x48, 0x114, 0x1, {{0x2, 0x1}, {&(0x7f0000001580)=""/83, 0x53}, &(0x7f0000001600)=[{&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000002840)=""/4096, 0x1000}, {&(0x7f00000016c0)=""/159, 0x9f}, {&(0x7f0000003840)=""/4096, 0x1000}, {&(0x7f0000004840)=""/225, 0xe1}, {&(0x7f0000004940)=""/138, 0x8a}], 0x6, 0x40, 0x7}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000004a00)=""/251, 0xfb}, &(0x7f0000001780), 0x40}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f00000017c0)}, &(0x7f0000004b00), 0x22}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000004b40)=""/157, 0x9d}, &(0x7f0000004c00), 0x52}}], 0x160, 0x24008080}, 0x0) socket(0x1, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB="0000000000f200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @broadcast}, @timestamp_reply={0x12, 0x0, 0x0, 0xe000, 0x2}}}}}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000000)={0x0, 0x0}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000000)={0x0, 0x0}, 0x10) socket$inet6(0x10, 0x3, 0x0) socket(0x10, 0x80002, 0x0) 1.711024279s ago: executing program 4 (id=6497): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000002c0)=0x1, 0x4) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000001c0)={'ipvlan1\x00', &(0x7f00000000c0)=@ethtool_rxnfc={0x32, 0x11, 0xf, {0x12, @esp_ip6_spec={@mcast1, @remote, 0x6, 0xf}, {0x0, @remote, 0x5, 0x26a, [0x0, 0x7fffffff]}, @ah_ip4_spec={@dev={0xac, 0x14, 0x14, 0x22}, @empty, 0x800, 0x2}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0x5, 0xfffb, [0x7, 0x8001]}, 0x7, 0x2b9}}}) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) (async) bind$alg(0xffffffffffffffff, 0x0, 0x0) (async) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'xfrm0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmmsg$inet(r0, &(0x7f0000000480)=[{{&(0x7f0000000300)={0x2, 0x4e23, @loopback}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000080)="6f0883", 0x3}], 0x1}}, {{&(0x7f0000000280)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="718a65ee17c07cc27ee525eb468879d7220a696aa99692f205789c537e240efb396a6e2baf4e520afc658da9fee6863c6ed944e753d62f507a3e440d2532950537489fb8cd8ea3fc1a2125ecd423d7cc49cb69bb7e06e3b41cacf21e46cc0f4bafb2e76439489465d4832ac1e6c4e0a1b4c44ef1c4637a57db37c686886021cc7a43d91130113b17e396ad55f182a4cab5d5b6b74ac7d624c3c68196d7b1c418d42189bcd1c1e33a72f89c8c15c2c4c8841634eaead5e6b006b71c226f755d87d1560179a8", 0xc5}], 0x1}}], 0x2, 0x11) (async) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000200)=0x14) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r2, 0x8008f512, &(0x7f0000000240)) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_atm={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40880}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c00038008"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000000408010100000000000000000500000a2400048008000140000000800800014000090000000001400000000408000140000000010600024060060000050003003a000000"], 0x48}, 0x1, 0x0, 0x0, 0x40811}, 0x80) 1.651545803s ago: executing program 1 (id=6499): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x4002050) 1.554512481s ago: executing program 2 (id=6500): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)={0x2, 0xf, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@private, @in6=@dev}}, @sadb_address={0x5, 0x17, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}]}, 0x78}}, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r3, 0x29, 0x4b, &(0x7f0000000000)=0x5, 0x4) bind$inet6(r3, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @loopback={0x2}}, 0x1c) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000010c0)=0x8) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000001240)={r0, 0xffffffffffffffff, 0x5, 0xe4, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0, 0x0, 0x40}}, 0x30) 1.477647206s ago: executing program 1 (id=6501): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0x2, 0x0, @rand_addr=0x64010100}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000180)="e1", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000100)="a7", 0x1}], 0x1}}], 0x2, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000300)={r1, 0x1}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="0d000000000000007110b3000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x94) 1.386923936s ago: executing program 4 (id=6503): r0 = socket$igmp(0x2, 0x3, 0x2) getsockopt$sock_cred(r0, 0x1, 0x4d, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 1.322014245s ago: executing program 1 (id=6504): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x100000}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a9}, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x1, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x80000000, 0x4000005, 0x800, 0x4}}}}, 0x30}, 0x1, 0x0, 0x0, 0x20040803}, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) recvmmsg(r6, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f0000000440)=""/96, 0x60}, {&(0x7f00000004c0)=""/77, 0x4d}, {&(0x7f00000016c0)=""/4096, 0x1000}], 0x5}, 0x1}], 0x400000000000141, 0x20, 0x0) bind$unix(r3, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = socket$pppoe(0x18, 0x1, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, 0x40, 0x107, 0xfffffffe, 0x0, {0x2, 0x7c}, [@nested={0x4, 0x142}, @nested={0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40800}, 0xc000) socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DEST(r8, &(0x7f0000000540)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r9, 0x300, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000010}, 0x804) getsockopt$sock_buf(r7, 0x1, 0x1c, &(0x7f0000000280)=""/126, &(0x7f0000000240)=0x7e) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x508, 0x348, 0x18c, 0x203, 0x348, 0x19030000, 0x438, 0x2e0, 0x2e0, 0x438, 0x2e0, 0x7fffffe, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x348, 0x0, {0x1000000}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x1, 0xe4e7, 0x7, 0x0, 0x0, "756a1796ba7709aaf1afdd4c49089efda626f1a5ffe85e8698e207ea56736661698e1f152f8d024dc4c4dacc58a88e7f1e8534a8b0b9f8704e591c0762a21d16"}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x568) connect$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 1.250978088s ago: executing program 3 (id=6505): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYBLOB="020afc000700000028bd7000fe9bdf2505001a000000000000000000ff80000000000000640101000000000000000000000000000a0030"], 0x38}}, 0x40408c0) 1.191175155s ago: executing program 4 (id=6506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x7, 0x7}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2, 0x4}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x66, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0xffff, 0xe}, {0x3, 0xfff1}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x20004850) r11 = epoll_create1(0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c00000010003b15326a00"/20, @ANYRES32=0x0, @ANYBLOB="00000000008000002c0012800ba1010062726964676500001c0002800c002100ffffffffffffffff0c0022000104080000000000"], 0x4c}}, 0x80) r13 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r13, 0x0, 0x48f, &(0x7f0000000b40)={0x84, @empty, 0x4e22, 0x0, 'wrr\x00', 0x12, 0x6, 0x51}, 0x2c) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r1, &(0x7f0000000000)={0x2}) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a74000000060a0b0400000000000000000200000048000480440001800a0001006d6174636800000034000280180003000f140000a7906e8f58c2052fade1bc2c62cdeb7508000240000000000d00010064657667726f7570000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x18}, 0xc) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x6, 0xff, 0x42}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000080), 0x619, r14}, 0x38) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300), 0x4) 1.054051904s ago: executing program 3 (id=6507): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @fallback=0x14}, 0x94) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000340)=0x14) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8, '\x00', r0, 0xffffffffffffffff, 0x4, 0x1, 0x5}, 0x50) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x86}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r4 = socket$inet(0x2, 0x3, 0x8) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000c40)=@raw={'raw\x00', 0x8, 0x3, 0x338, 0x1c0, 0xe138, 0x198, 0x1c0, 0x198, 0x2a0, 0x358, 0x358, 0x2a0, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bond\x00'}, 0x0, 0x158, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d0004000000080000000404fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3bf45c42995560a99952bed40cf5a804000000db7e2378d5afd35f4c16827f55b3af494e39ecfb33020000030090c332b6a99a8d872b8e88a94cb519f5c17631af956a0002000000000000000000000000000000000049", 0x8}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0xffffffff, 0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x398) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r3, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000780)={'syztnl0\x00', &(0x7f0000000700)={'ip6_vti0\x00', r0, 0x4, 0x6, 0x4, 0x7fff, 0x42, @private1={0xfc, 0x1, '\x00', 0x1}, @private0, 0x1, 0x1, 0x10001, 0xf066}}) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r3, 0x4048587b, &(0x7f0000000b00)={{r1, &(0x7f00000007c0)='bond0\x00', 0x0, &(0x7f0000000800)={@align=0x6, {0xe, 0x5, 0x7156, 0x4}}, 0x10001, &(0x7f0000000840), &(0x7f0000000940)}, 0x1, &(0x7f0000000ac0)=[{0x1, 0x4, &(0x7f00000009c0)='\x00', &(0x7f0000000a00)="ff34370fef0c746aec8cda5df1e583d4636707d97d4ee8a0b6dd2f38b268035b3e69338c0b05bf41376f382a001a581e820921a5eb2fd390df0eecd62fc48b1a5f0f1169c6177fbd55a9dd7a3b2953198b5522b35d61aaa23dc7899dc2fd8d4d31cb4534a84bd2b499362e500244ef3da10af91f21d4f887dc379f0f2cb935d4f26232933571d1d96b6a5648d0b2df7d55f782b1ce1db032d671b8e9872b", 0x9e, 0x3a}]}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c80)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0xbb8, '\x00', r9, r10, 0x1, 0x2, 0x3}, 0x50) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r8}, &(0x7f0000000280), &(0x7f0000000240)=r5}, 0x20) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r11, 0x4) sendmsg$inet(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff00000000000003000000000000000000000000000c0008"], 0xd8}, 0x1, 0x0, 0x0, 0x40044}, 0x20008004) (async) r12 = socket$inet_sctp(0x2, 0x5, 0x84) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r13, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) (async) getsockopt$inet_sctp6_SCTP_MAX_BURST(r13, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r12, 0x84, 0x0, &(0x7f0000000040)={r14, 0x0, 0x1ff, 0x2}, 0x10) (async) recvmsg(r7, &(0x7f00000006c0)={&(0x7f0000000540)=@in={0x2, 0x0, @multicast2}, 0x80, &(0x7f0000000640)=[{&(0x7f00000005c0)=""/93, 0x5d}], 0x1, &(0x7f0000000680)=""/37, 0x25}, 0x120) (async) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r15, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="6400000002060103000000000000000000000000050001000700000016000300686173683a6e65742c706f72742c6e65740000000900020073797a30000000000500040000000000050005000a00000014000780080012400000000005001500", @ANYRES16=r15], 0x64}, 0x1, 0x0, 0x0, 0x24008801}, 0x40) (async) r16 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000200)={'bond0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000140)={'gretap0\x00'}) 906.490786ms ago: executing program 4 (id=6508): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCGSKNS(r0, 0x894c, 0x0) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xb, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000180000002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000004c0)={r1, 0x3, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x44) 771.685709ms ago: executing program 3 (id=6509): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000dc0)=ANY=[@ANYBLOB="7a0af8ff7525757cbfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c80000040000000000b1a297cfddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1ae9f2cfe401dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd853eb3f12225bfcca581f04f317c8301b43267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4800b3c26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc70bb30d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692f01ad194f302d7a658e90000000001000000b6b2f25ddb8c640ab321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f7e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0aa390d0da6972ed719d7e0efb2bb713d1890e317c8de105c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1376eda2b9c662003"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x2800000002000000, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x600, 0x4000000}, 0x28) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, 0x0, 0x0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f00000005c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r3, &(0x7f00000004c0)=[{&(0x7f0000000280)=""/96, 0x46}, {0x0, 0xa00}], 0x2, 0xa, 0x6c8) (async) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x44004890) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000ff90850000007100000018110000", @ANYRES32=r1], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r4}, 0xc) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000040)=']\x00', 0x2002, &(0x7f0000000080)={@_ha_fsid={[0x0, 0x1]}, {0x9, 0x2, 0x80000001, 0x8001}}, 0x6, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x2}) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000005) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r7, &(0x7f0000000100)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43a4b36f808b8e4a94893628e379975e5bbdaa05a060ee71f14b28c7e21310cb22416d420"], 0x340a) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x2, 0x4000}, 0x10}, 0x94) (async) read$rfkill(r5, &(0x7f00000001c0), 0x8) 707.640591ms ago: executing program 4 (id=6510): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xd, &(0x7f0000001c80)=ANY=[@ANYBLOB="1800000020000000000000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000018000006b8af8ff0000bf00bfa200000000000007020000f8ffffffb703000008000000b7040000020200008500000082000000850000001100000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 676.773001ms ago: executing program 3 (id=6511): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008880}, 0x4002050) 607.081276ms ago: executing program 2 (id=6512): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_x25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, 0xe, 'wlan1\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket(0x27, 0xa, 0x20134) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000280)={0x84, @private=0xa010101, 0x4e24, 0x3, 'lblc\x00', 0x24, 0x0, 0x7b}, 0x2c) socket(0x2, 0x80805, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) (fail_nth: 3) 293.822507ms ago: executing program 3 (id=6513): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r2, {0x4}, {}, {0x3, 0x5}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x1c, 0x2, [@TCA_CBS_PARMS={0x18, 0x1, {0x81, '\x00', 0xfffff000, 0x0, 0x2, 0x581}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r3 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x22) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e23, 0x1, @mcast2, 0x9}, 0x1c) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r5) sendmsg$NLBL_MGMT_C_ADD(r4, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000c80)={0x14, r6, 0x1, 0x400a00, 0xa000000}, 0x14}}, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x7, &(0x7f0000000100)=0x9, 0x4) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@dev={0xac, 0x14, 0x14, 0x1c}, @initdev={0xac, 0x1e, 0x1, 0x0}, r2}, 0xc) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c0001060e305900ffdbdf2507000000", @ANYRES32=r9, @ANYBLOB="80007f0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) sendmmsg(r7, &(0x7f0000000000), 0x400000000000235, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r11, &(0x7f0000004680)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000004600)={0x18, 0x1404, 0x1, 0x70bd2a, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x40004}, 0x4) ioctl$sock_SIOCETHTOOL(r10, 0x89f1, &(0x7f0000000340)={'sit0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x2f, 0x9, 0xfffffffd, 0x0, 0x8, 0x0, 0x3, 0xf8, 0x0, 0x1, 0x0, 0x1000000, 0x0, 0x1, 0x0, 0x45, [0x0, 0x2]}}) 293.284263ms ago: executing program 4 (id=6514): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x85289000) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB='\n\x00\x00\x00\v\x00\x00\x00B\x00\x00\x00>'], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0, 0xffffffffffffffff}, &(0x7f0000000100), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000280)}, 0x20) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'geneve0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000fc0)=@newqdisc={0x2b8, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xa}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x288, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x5, 0xfc}}, @TCA_CHOKE_STAB={0x104, 0x2, "547d9ed0effe82c024750032ea49f09c72384049bcc87e42ca7e2c78d6a85178e447e32b5f4e4fabff6fb16a40901dc4221e42eb745b6332c476d0c3aefed8dc95af179570cf8cc43bc29eb93c6e78f5e1153d3d7c1542f77dc4b29877e2002685e850f2969cf2164fbf8db7e1713786899d2a8ab03ca5accb2e9b50e1fb7a4e3681b35f0f68461daa4f4e1583b9a02195dee35ae7c8bca085399157d5f30c2ec691c39267b2655c782b363a11645a0c78a39fab8c0ce69f11f2db45ee16e2975a80664f687d01bd7444244a25bdb9ec5b0fa8b1afc0254ddbca2e22ca1b189502b74d7ec4665c23804df713183d428f50a0d64e31e110c707eb3fe69f437992"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x9, 0x80000000, 0x2, 0x1c, 0x13, 0x1c, 0x6}}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x4}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0xfe, 0x0, 0x13}}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc}}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}]}, 0x2b8}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b82f8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000020000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x4, 0x7, &(0x7f00000014c0)=""/4101, 0x0, 0xc}, 0x94) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000480), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000380)={0x0, 0x9, &(0x7f00000000c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="7c010000575ab8c96081dd7635b015646a93c0a2e7f90a5cdbc23cb63e94eaaa5baedcb464faf4c560a2488a217340c03b0560075afb9e2a9519aad912fb6e19a0155bdd53d4044617695816ac19e2c715454842dc803d8a", @ANYRESDEC=r2, @ANYBLOB="07020000000000000000010000002c01088044b3078008000600b300000008000500ff00000008000600e10091000809050040ef116808000600cd00000008000600af00000008000500f712f706080006009600000034000780080006003c00004f08000500e2f05c100800050012c61f100800060066000000080005007118862e08000600fd0000001c00078008000500a156eb25080005000b608179080006007f0000003c000780080006009100000008000500a06e96730802060094000000080005004baa1d3f0800050038560852080005009889fe5708000600180000004400078008000600570000000800060059000000080006005a0000000800060097000000080006008300000008000500b252a03008000600500000000800060041000000140007800800d9a9bc2c0800050075190a492c0004800500030001000000050003000000000005000300010000000500030000000000050003000100000008000100030000000800020001"], 0x17c}, 0x1, 0x0, 0x0, 0x20008140}, 0x40480d4) ioctl$sock_x25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, 0xe, 'wlan1\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket(0x27, 0xa, 0x20134) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000280)={0x84, @private=0xa010101, 0x4e24, 0x3, 'lblc\x00', 0x24, 0x0, 0x7b}, 0x2c) socket(0x2, 0x80805, 0x0) r8 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r8, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 146.83498ms ago: executing program 0 (id=6515): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x5, 0x810, r1, 0xa9044000) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) close(0x3) 135.74399ms ago: executing program 2 (id=6516): r0 = socket$igmp(0x2, 0x3, 0x2) getsockopt$sock_cred(r0, 0x1, 0x4d, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 0s ago: executing program 3 (id=6517): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_x25_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000080)={@null, 0xe, 'wlan1\x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket(0x27, 0xa, 0x20134) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000280)={0x84, @private=0xa010101, 0x4e24, 0x3, 'lblc\x00', 0x24, 0x0, 0x7b}, 0x2c) socket(0x2, 0x80805, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) kernel console output (not intermixed with test programs): 80.972963][T12424] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 680.985109][T24943] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5356'. [ 681.028004][ T64] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 681.088311][ T64] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 681.112698][ T64] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 681.162107][T24950] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 681.296452][T24958] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5360'. [ 681.312027][T24958] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5360'. [ 681.322599][T24958] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5360'. [ 681.332398][T24958] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5360'. [ 681.341733][T24958] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5360'. [ 681.377850][T24958] tipc: Resetting bearer [ 681.776722][T24991] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 682.073435][T24999] validate_nla: 5 callbacks suppressed [ 682.073458][T24999] netlink: 'syz.3.5372': attribute type 1 has an invalid length. [ 682.259798][T24999] 8021q: adding VLAN 0 to HW filter on device bond8 [ 682.296088][T25002] dummy0: entered allmulticast mode [ 682.324853][T25002] dummy0: left allmulticast mode [ 682.356746][T24997] A٨ speed is unknown, defaulting to 1000 [ 683.193702][T25062] tipc: Enabling of bearer rejected, failed to enable media [ 683.330629][T25072] syzkaller1: entered promiscuous mode [ 683.336173][T25072] syzkaller1: entered allmulticast mode [ 684.227565][T25129] __nla_validate_parse: 128 callbacks suppressed [ 684.227589][T25129] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5401'. [ 684.304250][T25132] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5404'. [ 684.323548][T25133] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5404'. [ 684.843623][T25173] netlink: 'syz.2.5417': attribute type 11 has an invalid length. [ 684.919295][T25175] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5418'. [ 684.951188][T25181] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5419'. [ 685.171813][T25192] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5422'. [ 685.534133][T25209] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5427'. [ 685.728511][T25220] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 686.239372][T25250] ip6_vti0: Caught tx_queue_len zero misconfig [ 686.406081][T25259] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 686.571142][T25262] A٨ speed is unknown, defaulting to 1000 [ 687.106667][T25279] netlink: 210360 bytes leftover after parsing attributes in process `syz.0.5447'. [ 687.328804][T25291] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5451'. [ 687.353250][T25291] sctp: [Deprecated]: syz.0.5451 (pid 25291) Use of struct sctp_assoc_value in delayed_ack socket option. [ 687.353250][T25291] Use struct sctp_sack_info instead [ 687.438762][T25297] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5452'. [ 687.602965][T25308] sctp: [Deprecated]: syz.2.5456 (pid 25308) Use of struct sctp_assoc_value in delayed_ack socket option. [ 687.602965][T25308] Use struct sctp_sack_info instead [ 688.389036][T25326] veth1: Caught tx_queue_len zero misconfig [ 688.439857][T25326] netlink: 'syz.4.5461': attribute type 2 has an invalid length. [ 688.576939][T25333] netlink: 'syz.1.5462': attribute type 1 has an invalid length. [ 688.811892][T25338] bridge12: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 688.960406][T25340] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 689.006314][T25344] A٨ speed is unknown, defaulting to 1000 [ 689.723495][T25358] syzkaller0: entered promiscuous mode [ 689.737497][T25358] syzkaller0: entered allmulticast mode [ 689.971325][T25383] __nla_validate_parse: 4 callbacks suppressed [ 689.971347][T25383] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5478'. [ 690.175204][T25379] siw: device registration error -23 [ 690.378964][T25390] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5479'. [ 692.285880][T25388] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 692.457954][T25399] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5483'. [ 692.577339][T25405] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 692.615114][T25411] A٨ speed is unknown, defaulting to 1000 [ 692.701540][T25419] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 692.898806][T25423] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5490'. [ 692.991956][T25425] A٨ speed is unknown, defaulting to 1000 [ 693.145915][T25436] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5492'. [ 693.850607][T25445] netlink: 830 bytes leftover after parsing attributes in process `syz.0.5494'. [ 693.885942][T25445] x_tables: duplicate underflow at hook 1 [ 693.894822][T25448] netlink: 'syz.4.5495': attribute type 2 has an invalid length. [ 693.945246][T25448] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 694.361606][T25473] ipvlan2: entered promiscuous mode [ 694.381462][T25473] bridge0: port 1(ipvlan2) entered blocking state [ 694.387997][T25473] bridge0: port 1(ipvlan2) entered disabled state [ 694.396910][T25473] ipvlan2: entered allmulticast mode [ 694.405268][T25473] bridge0: entered allmulticast mode [ 694.414825][T25473] ipvlan2: left allmulticast mode [ 694.421230][T25473] bridge0: left allmulticast mode [ 694.450169][T25475] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 694.479381][T25467] A٨ speed is unknown, defaulting to 1000 [ 694.497600][T25477] xt_NFQUEUE: number of total queues is 0 [ 694.744265][T25483] syzkaller0: entered promiscuous mode [ 694.753393][T25483] syzkaller0: entered allmulticast mode [ 694.759263][T25483] tipc: Resetting bearer [ 694.780418][T25485] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5507'. [ 694.934362][T25499] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5512'. [ 694.962109][T25499] ip6gre2: entered promiscuous mode [ 694.967854][T25499] ip6gre2: entered allmulticast mode [ 695.291523][T25513] gre0: MTU too low for tipc bearer [ 695.307125][T25513] tipc: Disabling bearer [ 695.347714][T25515] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5517'. [ 695.423528][T25515] xt_CT: You must specify a L4 protocol and not use inversions on it [ 695.601111][T25521] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5519'. [ 695.799029][T25530] A٨ speed is unknown, defaulting to 1000 [ 695.801062][T25526] bridge_slave_0: entered promiscuous mode [ 695.853852][T25526] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 696.095866][T25539] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5524'. [ 696.105560][T25539] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5524'. [ 696.118037][T25540] netlink: 'syz.3.5525': attribute type 10 has an invalid length. [ 696.120256][T25539] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5524'. [ 696.251544][T25539] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5524'. [ 696.359003][T25539] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5524'. [ 696.409321][T25539] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5524'. [ 696.602893][T25557] netlink: 732 bytes leftover after parsing attributes in process `syz.1.5531'. [ 696.625436][T25557] netlink: 732 bytes leftover after parsing attributes in process `syz.1.5531'. [ 697.146996][T25583] bond0: (slave sit0): The slave device specified does not support setting the MAC address [ 697.182372][T25583] bond0: (slave sit0): Error -95 calling set_mac_address [ 697.257463][T25597] netlink: zone id is out of range [ 697.350577][T25598] netlink: 'syz.2.5544': attribute type 39 has an invalid length. [ 697.618774][T25605] 8021q: adding VLAN 0 to HW filter on device team0 [ 697.659285][T25605] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 697.745937][T25608] syzkaller0: entered promiscuous mode [ 697.753008][T25608] syzkaller0: entered allmulticast mode [ 697.789075][T25608] netlink: 'syz.2.5547': attribute type 1 has an invalid length. [ 697.803357][T25612] netlink: 'syz.0.5548': attribute type 1 has an invalid length. [ 697.813059][T25612] netlink: 'syz.0.5548': attribute type 2 has an invalid length. [ 697.843952][T25608] bond4: entered promiscuous mode [ 697.870501][T25608] 8021q: adding VLAN 0 to HW filter on device bond4 [ 697.971384][T25622] PKCS7: Unknown OID: [4] (bad) [ 697.974928][T25617] 8021q: adding VLAN 0 to HW filter on device bond5 [ 697.976305][T25622] PKCS7: Only support pkcs7_signedData type [ 697.994073][T25617] bond4: (slave bond5): making interface the new active one [ 698.002290][T25617] bond5: entered promiscuous mode [ 698.008711][T25617] bond4: (slave bond5): Enslaving as an active interface with an up link [ 698.131998][T25629] siw: device registration error -23 [ 698.550884][T25654] netlink: 'syz.1.5559': attribute type 32 has an invalid length. [ 698.643859][T25654] bond6: option coupled_control: invalid value (192) [ 698.660469][T25654] bond6 (unregistering): Released all slaves [ 698.745339][T25655] syzkaller0: left promiscuous mode [ 698.755155][T25655] syzkaller0: left allmulticast mode [ 698.773333][T25655] tipc: Resetting bearer [ 699.047041][T25682] netlink: 'syz.1.5568': attribute type 1 has an invalid length. [ 699.047143][T25683] netlink: 'syz.1.5568': attribute type 1 has an invalid length. [ 699.199182][T25682] 8021q: adding VLAN 0 to HW filter on device bond6 [ 699.894469][T25733] nftables ruleset with unbound set [ 700.001861][T25739] bond6: Unable to set peer notification delay as MII monitoring is disabled [ 700.015403][T25739] bond6 (unregistering): Released all slaves [ 700.051617][T25748] netlink: 'syz.1.5586': attribute type 10 has an invalid length. [ 700.234633][T25748] team0: Port device dummy0 added [ 700.490241][T25767] __nla_validate_parse: 5 callbacks suppressed [ 700.490263][T25767] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5591'. [ 700.709254][T25777] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5592'. [ 700.757685][T25778] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5592'. [ 700.801048][T25777] openvswitch: netlink: Flow key attr not present in new flow. [ 700.831656][T25778] openvswitch: netlink: Flow key attr not present in new flow. [ 701.089700][T25798] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 701.144039][T25762] netlink: 'syz.2.5589': attribute type 11 has an invalid length. [ 701.165689][T25762] netlink: 'syz.2.5589': attribute type 23 has an invalid length. [ 701.194688][T25762] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5589'. [ 701.338912][T25813] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 701.527540][T25818] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5600'. [ 701.546374][T25820] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5602'. [ 702.175837][T25846] A٨ speed is unknown, defaulting to 1000 [ 702.782453][T25878] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5612'. [ 703.135215][T25834] lec:lec_atm_close: lec0: Shut down! [ 703.775066][T25928] IPv6: sit4: Disabled Multicast RS [ 703.842682][T25918] netlink: 388 bytes leftover after parsing attributes in process `syz.3.5618'. [ 704.105279][T25919] A٨ speed is unknown, defaulting to 1000 [ 704.132494][T25944] bond0: mtu less than device minimum [ 704.235631][T25947] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5626'. [ 704.490825][T25963] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5630'. [ 704.712147][T25970] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 705.690568][T17194] lec:lec_start_xmit: lec0:No lecd attached [ 705.707758][T26031] __nla_validate_parse: 2 callbacks suppressed [ 705.707781][T26031] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5647'. [ 705.757276][T26030] bridge9: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 705.994585][T26041] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5652'. [ 707.531236][T26093] bridge7: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 707.734778][T26103] tipc: Resetting bearer [ 707.764202][T26103] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5667'. [ 707.868164][T26103] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5667'. [ 707.892553][T26116] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5671'. [ 707.910805][T26102] tipc: Resetting bearer [ 707.967104][T26116] chnl_net:caif_netlink_parms(): no params data found [ 708.490714][T26149] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5681'. [ 708.674718][T26156] bridge10: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 708.887699][ T1142] tipc: Resetting bearer [ 709.051452][T26183] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5693'. [ 709.405264][T26209] tipc: Enabled bearer , priority 0 [ 709.417164][T26209] syzkaller0: entered promiscuous mode [ 709.424855][T26209] syzkaller0: entered allmulticast mode [ 709.433705][T26205] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5703'. [ 709.504778][T26209] tipc: Resetting bearer [ 709.571150][T26208] tipc: Resetting bearer [ 709.611363][T26208] tipc: Disabling bearer [ 709.991161][T26233] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 709.998474][T26233] IPv6: NLM_F_CREATE should be set when creating new route [ 710.610336][T26267] netlink: 'syz.2.5715': attribute type 1 has an invalid length. [ 710.640473][T26267] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5715'. [ 711.251446][T26295] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5724'. [ 711.287485][T26295] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5724'. [ 711.382555][T26296] A٨ speed is unknown, defaulting to 1000 [ 711.549538][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5860 ms [ 711.558080][ C1] lec:lec_tx_timeout: lec0 [ 711.563604][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 711.746268][T26311] netlink: 'syz.2.5728': attribute type 9 has an invalid length. [ 711.754410][T26311] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5728'. [ 712.049047][T26329] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5734'. [ 712.062195][T26329] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5734'. [ 712.073593][T26329] netlink: 'syz.3.5734': attribute type 5 has an invalid length. [ 712.093874][T26329] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5734'. [ 712.148112][T26323] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5730'. [ 712.191876][T26313] A٨ speed is unknown, defaulting to 1000 [ 712.243728][T26336] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5735'. [ 712.504250][T26349] netlink: 'syz.4.5739': attribute type 1 has an invalid length. [ 712.513986][T26349] netlink: 'syz.4.5739': attribute type 6 has an invalid length. [ 712.522335][T26349] netlink: 'syz.4.5739': attribute type 3 has an invalid length. [ 713.050498][T26373] ipvlan2: entered promiscuous mode [ 713.089443][T26378] "syz.2.5745" (26378) uses obsolete ecb(arc4) skcipher [ 713.246762][T26380] netlink: 'syz.0.5744': attribute type 16 has an invalid length. [ 713.268062][T26380] netlink: 'syz.0.5744': attribute type 17 has an invalid length. [ 713.438859][T26381] tipc: Resetting bearer [ 713.693417][T26380] erspan0: left promiscuous mode [ 714.083639][T26380] 8021q: adding VLAN 0 to HW filter on device team0 [ 714.147031][T26380] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 714.473903][T26446] netlink: 'syz.3.5755': attribute type 2 has an invalid length. [ 714.553135][T26446] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 714.676520][T26451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5759'. [ 714.808362][T26451] macvtap0: entered promiscuous mode [ 714.815280][T26451] virtio_net virtio1 eth0: entered promiscuous mode [ 714.827951][T26451] macvtap0: entered allmulticast mode [ 714.839030][T26451] virtio_net virtio1 eth0: entered allmulticast mode [ 715.672256][T26488] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5769'. [ 716.354477][T26522] netlink: 'syz.4.5775': attribute type 1 has an invalid length. [ 716.421542][T26520] netem: incorrect gi model size [ 716.427084][T26520] netem: change failed [ 716.560605][T26522] 8021q: adding VLAN 0 to HW filter on device bond8 [ 716.682023][T26526] bond8: (slave veth17): Enslaving as an active interface with a down link [ 716.803722][T26532] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 716.838971][T26532] bond8: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 716.928264][T26547] syzkaller0: entered promiscuous mode [ 716.942414][T26547] syzkaller0: entered allmulticast mode [ 716.967667][T26550] syzkaller1: entered allmulticast mode [ 717.309536][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 717.317623][ C1] lec:lec_tx_timeout: lec0 [ 717.323752][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 717.479887][T26577] __nla_validate_parse: 1 callbacks suppressed [ 717.479912][T26577] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5790'. [ 717.672670][T26576] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 717.710927][T26576] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 717.766730][T26586] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 717.778038][T26586] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 717.822966][T26598] netlink: 'syz.2.5795': attribute type 11 has an invalid length. [ 717.858099][T26598] netlink: 5984 bytes leftover after parsing attributes in process `syz.2.5795'. [ 718.425792][T26623] IPVS: set_ctl: invalid protocol: 103 172.20.20.170:20000 [ 718.556356][T26627] tipc: Enabled bearer , priority 0 [ 718.574453][T26627] syzkaller0: entered promiscuous mode [ 718.589333][T26627] syzkaller0: entered allmulticast mode [ 718.635678][T26627] bridge8: entered promiscuous mode [ 718.652270][T26627] bridge8: entered allmulticast mode [ 718.685931][T26627] team0: Port device bridge8 added [ 718.706081][T26633] bridge0: port 3(team0) entered blocking state [ 718.723358][T26633] bridge0: port 3(team0) entered disabled state [ 718.743599][T26627] atomic_op ffff88807ed43198 conn xmit_atomic 0000000000000000 [ 718.769895][T26633] team0: entered allmulticast mode [ 718.794180][T26633] team_slave_0: entered allmulticast mode [ 718.823627][T26633] : entered allmulticast mode [ 718.828637][T26633] veth3: entered allmulticast mode [ 718.890465][T26633] macvlan1: entered allmulticast mode [ 718.906440][T26633] veth9: entered allmulticast mode [ 718.937109][T26633] dummy0: entered allmulticast mode [ 718.974834][T26633] team0: entered promiscuous mode [ 718.991601][T26633] team_slave_0: entered promiscuous mode [ 719.015251][T26633] : entered promiscuous mode [ 719.035496][T26633] veth3: entered promiscuous mode [ 719.056778][T26633] macvlan1: entered promiscuous mode [ 719.094986][T26633] veth9: entered promiscuous mode [ 719.109788][T26633] bond0: entered promiscuous mode [ 719.115382][T26633] dummy0: entered promiscuous mode [ 719.188117][T26657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5809'. [ 719.225516][T26657] netlink: 'syz.4.5809': attribute type 5 has an invalid length. [ 719.314401][T26657] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5809'. [ 719.382616][T26660] siw: device registration error -23 [ 719.753176][T26657] geneve3: entered promiscuous mode [ 719.770672][T26657] geneve3: entered allmulticast mode [ 719.820480][T26673] netlink: 'syz.2.5815': attribute type 1 has an invalid length. [ 719.846551][T26654] syzkaller0: entered promiscuous mode [ 719.850984][T26676] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5816'. [ 719.852456][T26654] syzkaller0: entered allmulticast mode [ 719.868099][T26626] tipc: Resetting bearer [ 719.889226][T26626] tipc: Disabling bearer [ 721.810202][ T1142] netdevsim netdevsim4 eth0: set [1, 2] type 2 family 0 port 256 - 0 [ 721.818373][ T1142] netdevsim netdevsim4 eth1: set [1, 2] type 2 family 0 port 256 - 0 [ 721.950918][ T1142] netdevsim netdevsim4 eth2: set [1, 2] type 2 family 0 port 256 - 0 [ 721.959274][ T1142] netdevsim netdevsim4 eth3: set [1, 2] type 2 family 0 port 256 - 0 [ 722.153967][T17194] IPVS: starting estimator thread 0... [ 722.186203][T26697] A٨ speed is unknown, defaulting to 1000 [ 722.258264][T26710] tipc: Enabling of bearer rejected, failed to enable media [ 722.270396][T26708] IPVS: using max 31 ests per chain, 74400 per kthread [ 722.761831][T26728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5821'. [ 723.001995][T26705] A٨ speed is unknown, defaulting to 1000 [ 723.069536][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 723.077644][ C1] lec:lec_tx_timeout: lec0 [ 723.083772][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 723.573556][T26746] openvswitch: netlink: Key 32 has unexpected len 4 expected 2 [ 723.943001][T26761] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5829'. [ 724.124576][T26770] bond9: option mode: invalid value (254) [ 724.156768][T26770] bond9 (unregistering): Released all slaves [ 725.096668][T26805] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5843'. [ 725.108872][ T5843] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 725.119867][ T5843] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 725.130612][ T5843] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 725.138972][ T5843] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 725.147003][ T5843] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 725.226882][ T5828] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 725.240157][ T5828] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 725.249290][ T5828] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 725.261239][ T5828] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 725.301710][ T5828] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 725.333950][T26817] A٨ speed is unknown, defaulting to 1000 [ 725.351829][T26811] IPVS: sh: FWM 3 0x00000003 - no destination available [ 725.359159][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 725.382680][T26811] IPVS: sh: FWM 3 0x00000003 - no destination available [ 725.422820][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 725.662432][T26806] A٨ speed is unknown, defaulting to 1000 [ 725.720797][T26817] netlink: 1315 bytes leftover after parsing attributes in process `syz.0.5844'. [ 725.796960][T26837] batadv0: entered promiscuous mode [ 725.803783][T26837] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 725.825257][T26828] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5847'. [ 725.922632][T26841] x_tables: duplicate underflow at hook 3 [ 726.138268][T26832] A٨ speed is unknown, defaulting to 1000 [ 726.470358][T26806] chnl_net:caif_netlink_parms(): no params data found [ 726.654162][ T1142] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.908149][ T1142] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.082960][ T1142] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.212787][ T1142] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.313522][T26806] bridge0: port 1(bridge_slave_0) entered blocking state [ 727.334096][T26806] bridge0: port 1(bridge_slave_0) entered disabled state [ 727.359939][T26806] bridge_slave_0: entered allmulticast mode [ 727.378623][T26806] bridge_slave_0: entered promiscuous mode [ 727.402343][ T5828] Bluetooth: hci4: command tx timeout [ 727.423135][T26806] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.440683][T26806] bridge0: port 2(bridge_slave_1) entered disabled state [ 727.448065][T26806] bridge_slave_1: entered allmulticast mode [ 727.474447][T26806] bridge_slave_1: entered promiscuous mode [ 727.576999][T26884] A٨ speed is unknown, defaulting to 1000 [ 727.741008][T26806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 727.783551][T26806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 727.977585][T12427] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.072898][T26902] x_tables: ip_tables: SYNPROXY target: used from hooks OUTPUT, but only usable from INPUT/FORWARD [ 728.104415][ T64] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.202358][T26806] team0: Port device team_slave_0 added [ 728.212910][ T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.260517][T26806] team0: Port device team_slave_1 added [ 728.270836][ T12] netdevsim netdevsim2 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 728.583650][ T1142] bond1 (unregistering): (slave ip6gretap1): Releasing backup interface [ 728.606022][ T1142] ip6gretap1 (unregistering): left promiscuous mode [ 729.204158][ T1142] bond0 (unregistering): (slave bridge8): Releasing backup interface [ 729.212435][ T1142] bridge8 (unregistering): left promiscuous mode [ 729.354162][ T1142] bond1 (unregistering): Released all slaves [ 729.367337][ T1142] bond2 (unregistering): Released all slaves [ 729.381350][ T1142] bond3 (unregistering): Released all slaves [ 729.398905][ T1142] bond0 (unregistering): Released all slaves [ 729.424447][ T1142] bond4 (unregistering): (slave bond5): Releasing backup interface [ 729.432478][ T1142] bond5 (unregistering): left promiscuous mode [ 729.440369][ T1142] bond4 (unregistering): Released all slaves [ 729.453773][ T1142] bond5 (unregistering): Released all slaves [ 729.468042][T26806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 729.475316][ T5828] Bluetooth: hci4: command tx timeout [ 729.481830][T26806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 729.508624][T26806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 729.532876][T26916] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 729.621270][T26806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 729.628461][T26806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 729.664825][T26806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 729.681959][ T1142] !9: left promiscuous mode [ 729.735112][T26806] hsr_slave_0: entered promiscuous mode [ 729.742166][T26806] hsr_slave_1: entered promiscuous mode [ 729.765176][ T1142] tipc: Disabling bearer [ 729.772352][ T1142] tipc: Left network mode [ 730.066935][T26806] netdevsim netdevsim2 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.131311][ T1142] batadv0: left promiscuous mode [ 730.158195][ T1142] hsr_slave_0: left promiscuous mode [ 730.166470][ T1142] hsr_slave_1: left promiscuous mode [ 730.441726][ T1142] team0 (unregistering): Port device dummy0 removed [ 730.474107][T26806] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.558517][T26806] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.683135][T26806] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.906940][T26806] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 730.921713][T26806] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 730.936704][T26806] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 730.948915][T26806] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 730.977012][ T1142] IPVS: stop unused estimator thread 0... [ 731.096374][T26806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 731.124696][T26806] 8021q: adding VLAN 0 to HW filter on device team0 [ 731.173949][ T1142] dvmrp0: left allmulticast mode [ 731.393244][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5480 ms [ 731.401378][ C1] lec:lec_tx_timeout: lec0 [ 731.432229][ T1142] geneve1 (unregistering): left allmulticast mode [ 731.550077][ T5828] Bluetooth: hci4: command tx timeout [ 731.894466][ T1142] bond0 (unregistering): Released all slaves [ 731.907361][ T1142] bond1 (unregistering): Released all slaves [ 731.921574][ T1142] bond2 (unregistering): Released all slaves [ 731.943849][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 731.951057][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 731.981662][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 731.988867][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 732.074847][ T1142] tipc: Disabling bearer [ 732.094037][ T1142] tipc: Left network mode [ 732.125997][T26806] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 732.151235][ T1142] IPVS: stopping backup sync thread 6014 ... [ 732.477662][T26806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 732.592632][T26806] veth0_vlan: entered promiscuous mode [ 732.634399][T26806] veth1_vlan: entered promiscuous mode [ 732.717537][T26806] veth0_macvtap: entered promiscuous mode [ 732.729388][ T1142] macsec0: left promiscuous mode [ 732.990106][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 733.128318][T26806] veth1_macvtap: entered promiscuous mode [ 733.181933][T26806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 733.211005][T26806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 733.260076][ T64] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.292350][ T64] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.313917][T12240] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.337512][T12240] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.462750][ T3478] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 733.484264][ T3478] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 733.531648][ T1142] IPVS: stop unused estimator thread 0... [ 733.542745][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 733.562481][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 733.630940][ T5828] Bluetooth: hci4: command tx timeout [ 738.029573][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5040 ms [ 738.037716][ C1] lec:lec_tx_timeout: lec0 [ 738.042373][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 741.314755][T27036] A٨ speed is unknown, defaulting to 1000 [ 741.794545][ T5843] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 741.809805][ T5843] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 741.821283][ T5843] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 741.840769][ T5843] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 741.840997][T27059] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5875'. [ 741.860518][ T5843] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 741.966098][T27058] A٨ speed is unknown, defaulting to 1000 [ 742.016823][T27066] tipc: Enabling of bearer rejected, failed to enable media [ 742.386425][ T1142] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 742.396821][ T1142] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 742.417040][ T1142] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 742.434713][ T1142] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 742.612471][T27076] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5880'. [ 742.818710][T27087] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5882'. [ 742.982053][T27058] chnl_net:caif_netlink_parms(): no params data found [ 743.050054][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 743.058219][ C1] lec:lec_tx_timeout: lec0 [ 743.069683][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 743.086220][T27093] netlink: 'syz.2.5883': attribute type 30 has an invalid length. [ 743.109688][T27093] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5883'. [ 743.223449][T27093] bond1: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 743.238608][T27101] FAULT_INJECTION: forcing a failure. [ 743.238608][T27101] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 743.258820][T27093] bond1 (unregistering): Released all slaves [ 743.263072][T27101] CPU: 1 UID: 0 PID: 27101 Comm: syz.3.5885 Not tainted syzkaller #0 PREEMPT(full) [ 743.263101][T27101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 743.263113][T27101] Call Trace: [ 743.263122][T27101] [ 743.263130][T27101] dump_stack_lvl+0xe8/0x150 [ 743.263163][T27101] should_fail_ex+0x412/0x560 [ 743.263194][T27101] _copy_to_user+0x31/0xb0 [ 743.263224][T27101] bpf_test_finish+0x22c/0x6b0 [ 743.263259][T27101] ? __pfx_bpf_test_finish+0x10/0x10 [ 743.263291][T27101] ? _copy_from_user+0x94/0xb0 [ 743.263318][T27101] ? bpf_test_init+0x113/0x150 [ 743.263344][T27101] bpf_prog_test_run_xdp+0x8fa/0x1160 [ 743.263386][T27101] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 743.263415][T27101] ? __fget_files+0x2a/0x420 [ 743.263453][T27101] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 743.263479][T27101] bpf_prog_test_run+0x2c7/0x340 [ 743.263503][T27101] __sys_bpf+0x643/0x950 [ 743.263532][T27101] ? __pfx___sys_bpf+0x10/0x10 [ 743.263574][T27101] ? ksys_write+0x242/0x270 [ 743.263597][T27101] ? __pfx_ksys_write+0x10/0x10 [ 743.263625][T27101] __x64_sys_bpf+0x7c/0x90 [ 743.263651][T27101] do_syscall_64+0x14d/0xf80 [ 743.263677][T27101] ? trace_irq_disable+0x3b/0x150 [ 743.263703][T27101] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.263722][T27101] ? clear_bhb_loop+0x40/0x90 [ 743.263745][T27101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 743.263764][T27101] RIP: 0033:0x7f4a1039c799 [ 743.263783][T27101] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 743.263799][T27101] RSP: 002b:00007f4a11246028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 743.263820][T27101] RAX: ffffffffffffffda RBX: 00007f4a10615fa0 RCX: 00007f4a1039c799 [ 743.263834][T27101] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 743.263847][T27101] RBP: 00007f4a11246090 R08: 0000000000000000 R09: 0000000000000000 [ 743.263859][T27101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 743.263870][T27101] R13: 00007f4a10616038 R14: 00007f4a10615fa0 R15: 00007ffc1f02e1a8 [ 743.263908][T27101] [ 743.353703][T27104] netlink: 'syz.1.5886': attribute type 1 has an invalid length. [ 743.550748][T27105] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5886'. [ 743.687821][T27105] 8021q: adding VLAN 0 to HW filter on device bond7 [ 743.704422][T27109] tipc: Enabled bearer , priority 10 [ 743.716073][T27117] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5888'. [ 743.811125][T27123] netlink: 'syz.1.5890': attribute type 1 has an invalid length. [ 743.932891][T27123] 8021q: adding VLAN 0 to HW filter on device bond8 [ 743.954475][ T5843] Bluetooth: hci5: command tx timeout [ 744.078067][T27123] bond8: (slave batadv0): Opening slave failed [ 744.125802][T27058] bridge0: port 1(bridge_slave_0) entered blocking state [ 744.143507][T27058] bridge0: port 1(bridge_slave_0) entered disabled state [ 744.160579][T27058] bridge_slave_0: entered allmulticast mode [ 744.179248][T27058] bridge_slave_0: entered promiscuous mode [ 744.207331][T27058] bridge0: port 2(bridge_slave_1) entered blocking state [ 744.224359][T27058] bridge0: port 2(bridge_slave_1) entered disabled state [ 744.242419][T27058] bridge_slave_1: entered allmulticast mode [ 744.261888][T27058] bridge_slave_1: entered promiscuous mode [ 744.379002][T27058] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 744.435424][T27058] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 744.450945][T27153] syzkaller0: entered promiscuous mode [ 744.459288][T27153] syzkaller0: entered allmulticast mode [ 744.632145][T27058] team0: Port device team_slave_0 added [ 744.644724][T27153] x_tables: duplicate entry at hook 3 [ 744.659445][T27164] tipc: Started in network mode [ 744.668841][T27164] tipc: Node identity 9abc0d33a966, cluster identity 4711 [ 744.681850][T27164] tipc: Enabled bearer , priority 0 [ 744.713219][T27169] gretap2: entered promiscuous mode [ 744.731822][T27169] batman_adv: batadv0: Adding interface: gretap2 [ 744.738225][T27169] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 744.773451][T27169] batman_adv: batadv0: Not using interface gretap2 (retrying later): interface not active [ 744.796815][T27058] team0: Port device team_slave_1 added [ 744.803092][T27173] 8021q: VLANs not supported on ip6_vti0 [ 744.809980][T27173] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5903'. [ 744.820883][T27150] tipc: Resetting bearer [ 744.861511][T27150] tipc: Disabling bearer [ 744.872548][T27177] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5903'. [ 744.901574][T17194] tipc: Node number set to 2534196462 [ 745.006019][T27058] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 745.034790][T27058] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 745.107658][T27058] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 745.177221][T27058] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 745.209227][T27058] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 745.375094][T27058] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 745.399353][T27182] netlink: 'syz.2.5905': attribute type 1 has an invalid length. [ 745.446908][T27184] netlink: 312 bytes leftover after parsing attributes in process `syz.1.5906'. [ 745.532507][T27058] hsr_slave_0: entered promiscuous mode [ 745.552113][T27058] hsr_slave_1: entered promiscuous mode [ 745.564931][T27058] debugfs: 'hsr0' already exists in 'hsr' [ 745.573202][T27058] Cannot create hsr debugfs directory [ 745.669988][T27189] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5907'. [ 745.690735][T27189] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 745.813575][T27192] IPv6: sit1: Disabled Multicast RS [ 746.032014][ T5843] Bluetooth: hci5: command tx timeout [ 746.051222][T27058] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 746.068392][T27058] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.080645][T27058] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 746.092094][T27058] netdevsim netdevsim4 eth3 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 746.124691][T27197] openvswitch: netlink: IP tunnel dst address not specified [ 746.184911][T27058] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 746.205841][T27058] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.226488][T27058] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 746.247404][T27058] netdevsim netdevsim4 eth2 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 746.336679][T27058] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 746.367480][T27058] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.389420][T27058] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 746.410987][T27058] netdevsim netdevsim4 eth1 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 746.496390][T27058] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 746.542406][T27058] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.566228][T27058] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 746.584230][T27058] netdevsim netdevsim4 eth0 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 746.848664][T27058] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 746.867958][T27058] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 746.890546][T27058] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 746.913474][T27058] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 747.118296][T27058] 8021q: adding VLAN 0 to HW filter on device bond0 [ 747.195309][T27058] 8021q: adding VLAN 0 to HW filter on device team0 [ 747.235559][ T64] bridge0: port 1(bridge_slave_0) entered blocking state [ 747.242899][ T64] bridge0: port 1(bridge_slave_0) entered forwarding state [ 747.259893][T27226] __nla_validate_parse: 2 callbacks suppressed [ 747.259914][T27226] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5918'. [ 747.287664][ T3478] bridge0: port 2(bridge_slave_1) entered blocking state [ 747.294917][ T3478] bridge0: port 2(bridge_slave_1) entered forwarding state [ 747.500229][T27231] netlink: 'syz.3.5919': attribute type 10 has an invalid length. [ 747.595957][T27237] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5919'. [ 747.622790][T27236] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5920'. [ 747.633995][T27237] bridge_slave_1: left allmulticast mode [ 747.661673][T27237] bridge_slave_1: left promiscuous mode [ 747.697637][T27237] bridge0: port 2(bridge_slave_1) entered disabled state [ 747.746847][T27237] bridge_slave_0: left allmulticast mode [ 747.766880][T27237] bridge0: port 1(bridge_slave_0) entered disabled state [ 747.981474][T27058] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 748.080007][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 748.088064][ C1] lec:lec_tx_timeout: lec0 [ 748.093881][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 748.112514][ T5843] Bluetooth: hci5: command tx timeout [ 748.542523][T27058] veth0_vlan: entered promiscuous mode [ 748.606819][T27058] veth1_vlan: entered promiscuous mode [ 748.765359][T27058] veth0_macvtap: entered promiscuous mode [ 748.805655][T27058] veth1_macvtap: entered promiscuous mode [ 748.894792][T27058] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 748.921518][T27058] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 748.938592][T27269] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5925'. [ 748.962238][ T3478] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 748.972987][ T3478] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 748.973055][T27269] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5925'. [ 749.004312][ T3478] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 749.015760][ T3478] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 749.189364][ T1142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 749.218890][ T1142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 749.288690][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 749.301053][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 749.445360][T27293] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5873'. [ 749.456783][T27293] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5873'. [ 749.477266][T27293] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5873'. [ 749.511217][T27295] team0: left allmulticast mode [ 749.516154][T27295] team_slave_0: left allmulticast mode [ 749.522187][T27295] : left allmulticast mode [ 749.526816][T27295] veth3: left allmulticast mode [ 749.532008][T27295] macvlan1: left allmulticast mode [ 749.537234][T27295] veth9: left allmulticast mode [ 749.542717][T27295] dummy0: left allmulticast mode [ 749.556102][T27295] team0: left promiscuous mode [ 749.566998][T27295] team_slave_0: left promiscuous mode [ 749.589797][T27295] : left promiscuous mode [ 749.595826][T27295] veth3: left promiscuous mode [ 749.619878][T27295] macvlan1: left promiscuous mode [ 749.625223][T27295] veth9: left promiscuous mode [ 749.632327][T27295] bond0: left promiscuous mode [ 749.637473][T27295] dummy0: left promiscuous mode [ 749.643175][T27295] bridge0: port 3(team0) entered disabled state [ 749.654533][T27295] team0: Port device dummy0 removed [ 749.662887][T27295] bridge_slave_0: left allmulticast mode [ 749.669946][T27295] bridge0: port 1(bridge_slave_0) entered disabled state [ 749.680336][T27295] bridge_slave_1: left allmulticast mode [ 749.685996][T27295] bridge_slave_1: left promiscuous mode [ 749.692135][T27295] bridge0: port 2(bridge_slave_1) entered disabled state [ 749.704604][T27295] team0: Port device team_slave_0 removed [ 749.713030][T27295] team0: Port device 76 removed [ 749.718713][T27295] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 749.753271][T27307] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5937'. [ 750.042398][T27320] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5944'. [ 750.190992][ T5843] Bluetooth: hci5: command tx timeout [ 750.424565][T27344] FAULT_INJECTION: forcing a failure. [ 750.424565][T27344] name failslab, interval 1, probability 0, space 0, times 0 [ 750.432039][T27338] x_tables: ip_tables: HMARK.0 target: invalid size 64 (kernel) != (user) 72 [ 750.441260][T27344] CPU: 1 UID: 0 PID: 27344 Comm: syz.2.5954 Not tainted syzkaller #0 PREEMPT(full) [ 750.441288][T27344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 750.441300][T27344] Call Trace: [ 750.441309][T27344] [ 750.441317][T27344] dump_stack_lvl+0xe8/0x150 [ 750.441349][T27344] should_fail_ex+0x412/0x560 [ 750.441379][T27344] should_failslab+0xa8/0x100 [ 750.441402][T27344] ? skb_clone+0x212/0x3a0 [ 750.441422][T27344] kmem_cache_alloc_noprof+0x87/0x650 [ 750.441441][T27344] ? __netlink_lookup+0xc6/0x8b0 [ 750.441475][T27344] skb_clone+0x212/0x3a0 [ 750.441498][T27344] __netlink_deliver_tap+0x404/0x850 [ 750.441535][T27344] ? netlink_deliver_tap+0x2e/0x1b0 [ 750.441561][T27344] netlink_deliver_tap+0x19c/0x1b0 [ 750.441588][T27344] netlink_unicast+0x7e3/0x9b0 [ 750.441620][T27344] ? __pfx_netlink_unicast+0x10/0x10 [ 750.441646][T27344] ? netlink_sendmsg+0x650/0xb40 [ 750.441668][T27344] ? skb_put+0x11b/0x210 [ 750.441698][T27344] netlink_sendmsg+0x813/0xb40 [ 750.441733][T27344] ? __pfx_netlink_sendmsg+0x10/0x10 [ 750.441762][T27344] ? aa_sock_msg_perm+0xf1/0x1b0 [ 750.441788][T27344] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 750.441812][T27344] ____sys_sendmsg+0x972/0x9f0 [ 750.441841][T27344] ? __pfx_____sys_sendmsg+0x10/0x10 [ 750.441869][T27344] ? import_iovec+0x73/0xa0 [ 750.441901][T27344] ___sys_sendmsg+0x2a5/0x360 [ 750.441935][T27344] ? __pfx____sys_sendmsg+0x10/0x10 [ 750.441989][T27344] ? __fget_files+0x2a/0x420 [ 750.442015][T27344] ? __fget_files+0x3a0/0x420 [ 750.442051][T27344] __x64_sys_sendmsg+0x1bd/0x2a0 [ 750.442073][T27344] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 750.442102][T27344] ? __pfx_ksys_write+0x10/0x10 [ 750.442135][T27344] do_syscall_64+0x14d/0xf80 [ 750.442160][T27344] ? trace_irq_disable+0x3b/0x150 [ 750.442186][T27344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.442206][T27344] ? clear_bhb_loop+0x40/0x90 [ 750.442229][T27344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.442247][T27344] RIP: 0033:0x7f8e5679c799 [ 750.442267][T27344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 750.442284][T27344] RSP: 002b:00007f8e549f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 750.442306][T27344] RAX: ffffffffffffffda RBX: 00007f8e56a15fa0 RCX: 00007f8e5679c799 [ 750.442320][T27344] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 750.442332][T27344] RBP: 00007f8e549f6090 R08: 0000000000000000 R09: 0000000000000000 [ 750.442344][T27344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 750.442356][T27344] R13: 00007f8e56a16038 R14: 00007f8e56a15fa0 R15: 00007ffcc7278238 [ 750.442387][T27344] [ 751.470633][T27398] FAULT_INJECTION: forcing a failure. [ 751.470633][T27398] name failslab, interval 1, probability 0, space 0, times 0 [ 751.515301][T27398] CPU: 0 UID: 0 PID: 27398 Comm: syz.2.5967 Not tainted syzkaller #0 PREEMPT(full) [ 751.515333][T27398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 751.515345][T27398] Call Trace: [ 751.515354][T27398] [ 751.515363][T27398] dump_stack_lvl+0xe8/0x150 [ 751.515399][T27398] should_fail_ex+0x412/0x560 [ 751.515432][T27398] should_failslab+0xa8/0x100 [ 751.515457][T27398] ? skb_clone+0x212/0x3a0 [ 751.515479][T27398] kmem_cache_alloc_noprof+0x87/0x650 [ 751.515499][T27398] ? __netlink_lookup+0xc6/0x8b0 [ 751.515535][T27398] skb_clone+0x212/0x3a0 [ 751.515561][T27398] __netlink_deliver_tap+0x404/0x850 [ 751.515602][T27398] ? netlink_deliver_tap+0x2e/0x1b0 [ 751.515632][T27398] netlink_deliver_tap+0x19c/0x1b0 [ 751.515661][T27398] netlink_unicast+0x7e3/0x9b0 [ 751.515695][T27398] ? __pfx_netlink_unicast+0x10/0x10 [ 751.515723][T27398] ? netlink_sendmsg+0x650/0xb40 [ 751.515749][T27398] ? skb_put+0x11b/0x210 [ 751.515781][T27398] netlink_sendmsg+0x813/0xb40 [ 751.515820][T27398] ? __pfx_netlink_sendmsg+0x10/0x10 [ 751.515852][T27398] ? aa_sock_msg_perm+0xf1/0x1b0 [ 751.515889][T27398] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 751.515916][T27398] ____sys_sendmsg+0x972/0x9f0 [ 751.515948][T27398] ? __pfx_____sys_sendmsg+0x10/0x10 [ 751.515980][T27398] ? import_iovec+0x73/0xa0 [ 751.516014][T27398] ___sys_sendmsg+0x2a5/0x360 [ 751.516042][T27398] ? __pfx____sys_sendmsg+0x10/0x10 [ 751.516101][T27398] ? __fget_files+0x2a/0x420 [ 751.516127][T27398] ? __fget_files+0x3a0/0x420 [ 751.516166][T27398] __x64_sys_sendmsg+0x1bd/0x2a0 [ 751.516190][T27398] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 751.516220][T27398] ? __pfx_ksys_write+0x10/0x10 [ 751.516256][T27398] do_syscall_64+0x14d/0xf80 [ 751.516290][T27398] ? trace_irq_disable+0x3b/0x150 [ 751.516319][T27398] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 751.516340][T27398] ? clear_bhb_loop+0x40/0x90 [ 751.516367][T27398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 751.516388][T27398] RIP: 0033:0x7f8e5679c799 [ 751.516408][T27398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 751.516427][T27398] RSP: 002b:00007f8e549f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 751.516451][T27398] RAX: ffffffffffffffda RBX: 00007f8e56a15fa0 RCX: 00007f8e5679c799 [ 751.516467][T27398] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 751.516480][T27398] RBP: 00007f8e549f6090 R08: 0000000000000000 R09: 0000000000000000 [ 751.516494][T27398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 751.516506][T27398] R13: 00007f8e56a16038 R14: 00007f8e56a15fa0 R15: 00007ffcc7278238 [ 751.516540][T27398] [ 753.110103][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 753.118162][ C1] lec:lec_tx_timeout: lec0 [ 753.150215][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 758.022292][T27436] __nla_validate_parse: 1 callbacks suppressed [ 758.022315][T27436] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5969'. [ 758.045099][T27436] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5969'. [ 758.160047][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 758.168240][ C1] lec:lec_tx_timeout: lec0 [ 758.189679][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 758.193278][T27445] netlink: 'syz.2.5974': attribute type 3 has an invalid length. [ 758.433529][T27458] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5978'. [ 758.459921][T27458] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5978'. [ 758.488252][T27458] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5978'. [ 758.497474][T27458] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5978'. [ 758.634177][T27465] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5980'. [ 758.784089][T27470] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5982'. [ 759.556398][T27517] FAULT_INJECTION: forcing a failure. [ 759.556398][T27517] name failslab, interval 1, probability 0, space 0, times 0 [ 759.570891][T27517] CPU: 0 UID: 0 PID: 27517 Comm: syz.1.5996 Not tainted syzkaller #0 PREEMPT(full) [ 759.570921][T27517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 759.570932][T27517] Call Trace: [ 759.570941][T27517] [ 759.570949][T27517] dump_stack_lvl+0xe8/0x150 [ 759.570983][T27517] should_fail_ex+0x412/0x560 [ 759.571016][T27517] should_failslab+0xa8/0x100 [ 759.571044][T27517] __kmalloc_noprof+0xe8/0x760 [ 759.571065][T27517] ? tcf_idr_create+0x5d/0x6b0 [ 759.571094][T27517] tcf_idr_create+0x5d/0x6b0 [ 759.571124][T27517] ? __nla_parse+0x40/0x60 [ 759.571156][T27517] tcf_police_init+0x38a/0x1560 [ 759.571197][T27517] ? __pfx_tcf_police_init+0x10/0x10 [ 759.571245][T27517] ? nla_memcpy+0x5b/0xc0 [ 759.571281][T27517] tcf_action_init_1+0x4ba/0x740 [ 759.571314][T27517] ? __pfx_tcf_action_init_1+0x10/0x10 [ 759.571336][T27517] ? _raw_read_unlock+0x28/0x50 [ 759.571361][T27517] ? tc_action_load_ops+0x247/0x540 [ 759.571403][T27517] ? is_bpf_text_address+0x292/0x2b0 [ 759.571428][T27517] ? __nla_parse+0x40/0x60 [ 759.571460][T27517] tcf_action_init+0x31e/0xb40 [ 759.571494][T27517] ? __pfx_tcf_action_init+0x10/0x10 [ 759.571546][T27517] ? netlink_sendmsg+0x813/0xb40 [ 759.571570][T27517] ? ____sys_sendmsg+0x972/0x9f0 [ 759.571590][T27517] ? __pfx___nla_validate_parse+0x10/0x10 [ 759.571616][T27517] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 759.571678][T27517] tc_ctl_action+0x43b/0xc70 [ 759.571717][T27517] ? __pfx_tc_ctl_action+0x10/0x10 [ 759.571748][T27517] ? trace_contention_end+0x3d/0x150 [ 759.571839][T27517] ? __pfx_tc_ctl_action+0x10/0x10 [ 759.571863][T27517] rtnetlink_rcv_msg+0x77e/0xbe0 [ 759.571896][T27517] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 759.571923][T27517] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 759.571949][T27517] ? ref_tracker_free+0x693/0x840 [ 759.571973][T27517] ? __copy_skb_header+0xa3/0x4a0 [ 759.571997][T27517] ? __pfx_ref_tracker_free+0x10/0x10 [ 759.572036][T27517] netlink_rcv_skb+0x232/0x4b0 [ 759.572065][T27517] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 759.572095][T27517] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 759.572136][T27517] ? netlink_deliver_tap+0x2e/0x1b0 [ 759.572173][T27517] netlink_unicast+0x80f/0x9b0 [ 759.572207][T27517] ? __pfx_netlink_unicast+0x10/0x10 [ 759.572233][T27517] ? netlink_sendmsg+0x650/0xb40 [ 759.572259][T27517] ? skb_put+0x11b/0x210 [ 759.572293][T27517] netlink_sendmsg+0x813/0xb40 [ 759.572333][T27517] ? __pfx_netlink_sendmsg+0x10/0x10 [ 759.572367][T27517] ? aa_sock_msg_perm+0xf1/0x1b0 [ 759.572395][T27517] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 759.572421][T27517] ____sys_sendmsg+0x972/0x9f0 [ 759.572453][T27517] ? __pfx_____sys_sendmsg+0x10/0x10 [ 759.572486][T27517] ? import_iovec+0x73/0xa0 [ 759.572522][T27517] ___sys_sendmsg+0x2a5/0x360 [ 759.572551][T27517] ? __pfx____sys_sendmsg+0x10/0x10 [ 759.572614][T27517] ? __fget_files+0x2a/0x420 [ 759.572641][T27517] ? __fget_files+0x3a0/0x420 [ 759.572684][T27517] __x64_sys_sendmsg+0x1bd/0x2a0 [ 759.572709][T27517] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 759.572742][T27517] ? __pfx_ksys_write+0x10/0x10 [ 759.572787][T27517] do_syscall_64+0x14d/0xf80 [ 759.572816][T27517] ? trace_irq_disable+0x3b/0x150 [ 759.572844][T27517] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 759.572865][T27517] ? clear_bhb_loop+0x40/0x90 [ 759.572890][T27517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 759.572911][T27517] RIP: 0033:0x7f1aa6b9c799 [ 759.572931][T27517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 759.572950][T27517] RSP: 002b:00007f1aa7aad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 759.572973][T27517] RAX: ffffffffffffffda RBX: 00007f1aa6e15fa0 RCX: 00007f1aa6b9c799 [ 759.572988][T27517] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 759.573001][T27517] RBP: 00007f1aa7aad090 R08: 0000000000000000 R09: 0000000000000000 [ 759.573014][T27517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 759.573025][T27517] R13: 00007f1aa6e16038 R14: 00007f1aa6e15fa0 R15: 00007ffd9c8c9a38 [ 759.573061][T27517] [ 760.265541][T27534] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6002'. [ 760.397966][T27539] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6003'. [ 760.461959][T27544] netlink: 'syz.2.6006': attribute type 8 has an invalid length. [ 760.791765][T27562] @0: renamed from bond_slave_1 [ 760.843548][T27555] A٨ speed is unknown, defaulting to 1000 [ 761.034654][T27579] blkio.reset_stats is deprecated [ 761.045580][T27579] netlink: 'syz.1.6015': attribute type 1 has an invalid length. [ 761.212812][T27598] netlink: 'syz.4.6019': attribute type 1 has an invalid length. [ 761.365089][T27598] bond1 (unregistering): Released all slaves [ 761.738218][T27608] vlan2: entered promiscuous mode [ 761.745213][T27608] vlan0: entered promiscuous mode [ 762.202013][T27605] gretap2: entered promiscuous mode [ 762.294792][T27605] batman_adv: batadv0: Adding interface: gretap2 [ 762.390193][T27605] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 762.472679][T27630] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 762.501772][T27630] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 762.520247][T27630] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 762.528363][T27630] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 762.541359][T27605] batman_adv: batadv0: Not using interface gretap2 (retrying later): interface not active [ 762.561489][T27630] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 762.703922][T27633] netlink: 'syz.4.6026': attribute type 10 has an invalid length. [ 762.907561][T27633] team0: Port device dummy0 added [ 762.930124][T27625] A٨ speed is unknown, defaulting to 1000 [ 763.097979][T27628] A٨ speed is unknown, defaulting to 1000 [ 763.117197][T27645] __nla_validate_parse: 6 callbacks suppressed [ 763.117218][T27645] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6029'. [ 763.186356][T27645] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6029'. [ 763.200041][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 763.208092][ C1] lec:lec_tx_timeout: lec0 [ 763.229705][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 763.626437][ T9] IPVS: starting estimator thread 0... [ 763.672974][T27654] netlink: 'syz.4.6030': attribute type 14 has an invalid length. [ 763.720276][T27657] IPVS: using max 27 ests per chain, 64800 per kthread [ 763.977838][T27668] x_tables: duplicate underflow at hook 2 [ 764.072985][T27671] netlink: 'syz.0.6034': attribute type 10 has an invalid length. [ 764.216955][T27671] veth0_vlan: left promiscuous mode [ 764.242659][T27671] veth0_vlan: entered promiscuous mode [ 764.280851][T27671] team0: Device veth0_vlan failed to register rx_handler [ 764.577021][ T1142] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 764.604201][T27628] chnl_net:caif_netlink_parms(): no params data found [ 764.671214][ T5843] Bluetooth: hci2: command tx timeout [ 764.686589][ T1142] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 764.737817][ T64] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 764.850932][T12240] netdevsim netdevsim1 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 765.215275][T12427] bond0 (unregistering): (slave gretap3): Releasing active interface [ 765.666124][T12427] team0: Port device bridge8 removed [ 765.708176][T12427] bond1 (unregistering): Released all slaves [ 765.729293][T12427] bond2 (unregistering): Released all slaves [ 765.756854][T12427] bond3 (unregistering): Released all slaves [ 765.779111][T12427] team0: Port device bond0 removed [ 765.796376][T12427] bond0 (unregistering): Released all slaves [ 765.818319][T12427] bond4 (unregistering): Released all slaves [ 765.838937][T12427] bond5 (unregistering): Released all slaves [ 765.867524][T12427] bond6 (unregistering): Released all slaves [ 765.886815][T12427] bond7 (unregistering): Released all slaves [ 765.905918][T12427] bond8 (unregistering): Released all slaves [ 765.952413][T27628] bridge0: port 1(bridge_slave_0) entered blocking state [ 765.959839][T27628] bridge0: port 1(bridge_slave_0) entered disabled state [ 765.967150][T27628] bridge_slave_0: entered allmulticast mode [ 765.975647][T27628] bridge_slave_0: entered promiscuous mode [ 765.985934][T27628] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.993958][T27628] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.001672][T27628] bridge_slave_1: entered allmulticast mode [ 766.010100][T27628] bridge_slave_1: entered promiscuous mode [ 766.105592][T27628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 766.127554][T12427] tipc: Left network mode [ 766.133852][T27628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 766.244009][T27628] team0: Port device team_slave_0 added [ 766.283943][T27628] team0: Port device team_slave_1 added [ 766.365476][T27628] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 766.373075][T27628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 766.399918][T27628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 766.421315][T27628] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 766.428436][T27628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 766.455787][T27628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 766.511685][T27628] hsr_slave_0: entered promiscuous mode [ 766.518107][T27628] hsr_slave_1: entered promiscuous mode [ 766.525430][T27628] debugfs: 'hsr0' already exists in 'hsr' [ 766.531407][T27628] Cannot create hsr debugfs directory [ 766.751616][ T5843] Bluetooth: hci2: command tx timeout [ 766.822078][T12427] hsr_slave_0: left promiscuous mode [ 766.828938][T12427] hsr_slave_1: left promiscuous mode [ 766.853599][T12427] team0 (unregistering): Port device veth9 removed [ 766.918497][T12427] team0 (unregistering): Port device veth3 removed [ 767.000838][T12427] team0 (unregistering): Port device macvlan1 removed [ 767.212036][ T9] A٨ speed is unknown, defaulting to 1000 [ 767.218693][ T9] infiniband syz2: ib_query_port failed (-19) [ 767.244266][T27628] netdevsim netdevsim1 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.332919][T27628] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.456966][T27628] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.558658][T27628] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.611570][T12427] IPVS: stop unused estimator thread 0... [ 767.789176][T27628] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 767.806352][T27628] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 767.827533][T27628] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 767.839082][T27628] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 767.970598][T27628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 767.996549][T27628] 8021q: adding VLAN 0 to HW filter on device team0 [ 768.011454][T12427] bridge0: port 1(bridge_slave_0) entered blocking state [ 768.018587][T12427] bridge0: port 1(bridge_slave_0) entered forwarding state [ 768.051912][T12427] bridge0: port 2(bridge_slave_1) entered blocking state [ 768.059114][T12427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 768.342041][T27628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 768.422002][T27628] veth0_vlan: entered promiscuous mode [ 768.439241][T27628] veth1_vlan: entered promiscuous mode [ 768.489781][T27628] veth0_macvtap: entered promiscuous mode [ 768.502209][T27628] veth1_macvtap: entered promiscuous mode [ 768.544982][T27628] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 768.564497][T27628] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 768.587296][T12427] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.608044][T12427] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.619043][T12427] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.635648][T12427] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.699098][T12427] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.720074][T12427] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.746721][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.755748][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.829940][ T5843] Bluetooth: hci2: command tx timeout [ 768.989726][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5760 ms [ 768.997849][ C1] lec:lec_tx_timeout: lec0 [ 769.002912][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 770.910049][ T5843] Bluetooth: hci2: command tx timeout [ 774.029872][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 774.037996][ C1] lec:lec_tx_timeout: lec0 [ 776.863563][T27762] bridge0: port 2(bridge_slave_1) entered disabled state [ 776.871439][T27762] bridge0: port 1(bridge_slave_0) entered disabled state [ 776.882505][T27762] bridge0: entered allmulticast mode [ 776.984223][T27773] bridge_slave_1: left allmulticast mode [ 777.000126][T27773] bridge_slave_1: left promiscuous mode [ 777.024449][T27773] bridge0: port 2(bridge_slave_1) entered disabled state [ 777.045110][T27774] IPVS: nq: FWM 3 0x00000003 - no destination available [ 777.480477][T27773] bridge_slave_0: left allmulticast mode [ 777.486193][T27773] bridge_slave_0: left promiscuous mode [ 777.509949][T27773] bridge0: port 1(bridge_slave_0) entered disabled state [ 777.527513][T27767] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6038'. [ 777.536845][T27767] openvswitch: netlink: Flow actions attr not present in new flow. [ 777.793262][T27795] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 777.844101][T27775] bridge_slave_0: left promiscuous mode [ 777.873064][T27775] vlan0: left promiscuous mode [ 777.879687][T27775] geneve1: left promiscuous mode [ 777.886305][T27775] ip6tnl1: left allmulticast mode [ 777.905402][T27775] gtp0: left promiscuous mode [ 777.929207][T27775] gtp0: left allmulticast mode [ 777.952007][T27775] macsec1: left allmulticast mode [ 777.965624][T27775] gretap2: left promiscuous mode [ 778.181195][T27806] netlink: 108 bytes leftover after parsing attributes in process `syz.3.6050'. [ 778.206305][T27799] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.6048'. [ 778.222888][T27806] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6050'. [ 778.320126][T27811] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6051'. [ 778.349642][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 778.375524][T27811] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6051'. [ 778.391936][T27813] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 778.434749][T27818] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6054'. [ 778.484304][T27820] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6051'. [ 779.139060][T27845] bridge_slave_0: entered promiscuous mode [ 779.151349][T27845] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 779.209357][T27846] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 779.346842][T27849] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6062'. [ 779.484041][T27855] tipc: Started in network mode [ 779.500390][T27855] tipc: Node identity 8, cluster identity 9 [ 779.506995][T27855] tipc: Node number set to 8 [ 779.783424][T27864] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6065'. [ 780.214991][T27881] xt_hashlimit: invalid rate [ 780.603860][T27896] IPVS: sh: FWM 3 0x00000003 - no destination available [ 780.630063][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 780.732754][T27902] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 780.797108][T27906] delete_channel: no stack [ 781.215241][T27928] netlink: 'syz.3.6079': attribute type 10 has an invalid length. [ 781.542643][T27936] bridge_slave_0: left allmulticast mode [ 781.569066][T27936] bridge_slave_0: left promiscuous mode [ 781.592628][T27936] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.644019][T27936] bridge_slave_1: left allmulticast mode [ 781.654668][T27936] bridge_slave_1: left promiscuous mode [ 781.676943][T27936] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.761545][T27936] bond0: (slave bond_slave_0): Releasing backup interface [ 781.802935][T27936] bond0: (slave bond_slave_1): Releasing backup interface [ 781.878872][T27936] team0: Port device team_slave_0 removed [ 781.925007][T27936] team0: Port device team_slave_1 removed [ 781.940153][T27936] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 781.954397][T27936] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 781.971019][T27936] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 781.980332][T27936] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 782.005513][T27936] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 782.509428][T27973] netlink: 'syz.0.6090': attribute type 3 has an invalid length. [ 784.029719][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5680 ms [ 784.037778][ C1] lec:lec_tx_timeout: lec0 [ 784.042457][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 787.985363][T28000] IPVS: sh: FWM 3 0x00000003 - no destination available [ 787.998692][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 788.248560][T28006] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 788.369018][T28024] __nla_validate_parse: 5 callbacks suppressed [ 788.369037][T28024] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6097'. [ 789.002254][T28051] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6104'. [ 789.049529][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 789.057672][ C1] lec:lec_tx_timeout: lec0 [ 789.326779][T28073] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6108'. [ 789.399623][T28073] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6108'. [ 789.436303][T28074] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6109'. [ 789.566528][T28078] netlink: 208240 bytes leftover after parsing attributes in process `syz.3.6110'. [ 790.006509][T28074] 8021q: adding VLAN 0 to HW filter on device bond1 [ 790.676067][T28120] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6122'. [ 790.679776][T28115] nbd3: detected capacity change from 0 to 63 [ 790.701038][T28120] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6122'. [ 790.745259][T28118] pim6reg: entered allmulticast mode [ 790.781321][T28118] pim6reg: left allmulticast mode [ 790.835057][T28124] macvtap1: entered promiscuous mode [ 790.849866][T28124] macvtap1: entered allmulticast mode [ 790.863160][T28124] veth1_vlan: entered allmulticast mode [ 791.015792][T28137] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6125'. [ 791.277857][ T5843] block nbd3: Receive control failed (result -104) [ 791.451924][T28161] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6132'. [ 793.053115][T28236] syzkaller0: entered promiscuous mode [ 793.059020][T28236] syzkaller0: entered allmulticast mode [ 793.143604][T28237] tipc: Enabled bearer , priority 0 [ 793.159401][T28234] tipc: Resetting bearer [ 793.188561][T28234] tipc: Disabling bearer [ 793.284575][T28245] : renamed from veth0_to_bond (while UP) [ 793.469967][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 793.590919][T28261] netlink: 'syz.4.6162': attribute type 11 has an invalid length. [ 793.607535][T28261] __nla_validate_parse: 9 callbacks suppressed [ 793.607556][T28261] netlink: 199828 bytes leftover after parsing attributes in process `syz.4.6162'. [ 794.285076][T28288] tipc: Started in network mode [ 794.291002][T28288] tipc: Node identity 42bdf1ed3df5, cluster identity 4711 [ 794.298349][T28288] tipc: Enabled bearer , priority 0 [ 794.325241][T28288] syzkaller0: entered promiscuous mode [ 794.331025][T28288] syzkaller0: entered allmulticast mode [ 794.347957][T28287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 794.362979][T28292] netlink: 188 bytes leftover after parsing attributes in process `syz.0.6170'. [ 794.367970][T28293] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6169'. [ 794.393848][T28293] ip6gre1: entered promiscuous mode [ 794.399116][T28293] ip6gre1: entered allmulticast mode [ 794.463952][T28288] tipc: Resetting bearer [ 794.644930][T28310] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6175'. [ 794.655391][T28310] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6175'. [ 794.664939][T28310] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6175'. [ 794.996664][T28284] tipc: Resetting bearer [ 795.086044][T28284] tipc: Disabling bearer [ 795.169984][T28329] macvtap0: entered promiscuous mode [ 795.176120][T28329] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6179'. [ 795.268299][T28329] macvtap0 (unregistering): left promiscuous mode [ 796.022684][T28349] erspan0: entered promiscuous mode [ 796.047377][T28349] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6184'. [ 796.115377][T28351] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 796.141064][T28351] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6185'. [ 796.415663][T28369] netlink: 'syz.0.6189': attribute type 10 has an invalid length. [ 796.437681][T28369] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6189'. [ 796.735852][T28389] IPv6: NLM_F_CREATE should be specified when creating new route [ 796.910256][T28399] gretap1: entered promiscuous mode [ 796.916623][T28399] batman_adv: batadv0: Adding interface: gretap1 [ 796.925431][T28399] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 797.098836][T28399] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 798.781481][T28438] __nla_validate_parse: 3 callbacks suppressed [ 798.781504][T28438] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6208'. [ 798.990587][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5520 ms [ 798.998698][ C1] lec:lec_tx_timeout: lec0 [ 799.003990][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 799.053959][T28444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6208'. [ 799.063577][T28449] 8021q: adding VLAN 0 to HW filter on device bond2 [ 799.145844][T28444] netlink: 348 bytes leftover after parsing attributes in process `syz.3.6208'. [ 799.155496][T28444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6208'. [ 799.164646][T28444] netlink: 348 bytes leftover after parsing attributes in process `syz.3.6208'. [ 799.174008][T28444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6208'. [ 799.807576][T28463] netlink: 144 bytes leftover after parsing attributes in process `syz.3.6213'. [ 799.950800][T28466] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.6214'. [ 800.005616][T28468] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6215'. [ 800.106990][T28471] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 800.257244][T28474] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 800.706884][T28490] RDS: rds_bind could not find a transport for ::ffff:172.30.1.4, load rds_tcp or rds_rdma? [ 804.029660][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 804.037725][ C1] lec:lec_tx_timeout: lec0 [ 808.589775][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 808.895202][T28518] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 808.919024][T28522] netlink: 183892 bytes leftover after parsing attributes in process `syz.1.6223'. [ 808.973811][T28526] rdma_rxe: rxe_newlink: failed to add lo [ 808.981786][T28522] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6223'. [ 808.987107][T28521] netlink: 'syz.2.6224': attribute type 4 has an invalid length. [ 809.036149][T28522] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6223'. [ 809.065758][T28522] netlink: 'syz.1.6223': attribute type 3 has an invalid length. [ 809.079408][T28531] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6225'. [ 809.229908][T28538] nbd4: detected capacity change from 0 to 127 [ 809.242223][ T5843] block nbd4: Receive control failed (result -104) [ 809.301570][T28545] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.6230'. [ 809.347276][T28545] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.6230'. [ 809.515481][T28544] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6229'. [ 809.823798][T28564] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6235'. [ 810.114570][T28582] syzkaller0: entered promiscuous mode [ 810.121477][T28582] syzkaller0: entered allmulticast mode [ 810.154853][T28586] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6243'. [ 810.262156][T28588] bond3 (unregistering): Released all slaves [ 810.294053][T28586] veth1_macvtap: left promiscuous mode [ 810.330137][T28592] netlink: 'syz.4.6245': attribute type 3 has an invalid length. [ 810.399851][T28597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6246'. [ 810.812300][T28620] netlink: 'syz.1.6254': attribute type 10 has an invalid length. [ 810.945839][T28626] bond0: (slave bond_slave_0): Releasing backup interface [ 811.014608][T28626] bond0: (slave bond_slave_1): Releasing backup interface [ 811.154874][T28647] netlink: 'syz.3.6258': attribute type 153 has an invalid length. [ 811.214270][T28626] team0: Port device team_slave_0 removed [ 811.323987][T28626] team0: Port device team_slave_1 removed [ 811.385158][T28626] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 811.395144][T28626] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 811.404482][T28626] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 811.415965][T28626] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 811.425208][T28626] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 811.449018][T28620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 811.458794][T28620] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 811.521679][T28652] macvlan2: entered allmulticast mode [ 811.527202][T28652] hsr0: entered allmulticast mode [ 811.532933][T28652] hsr_slave_0: entered allmulticast mode [ 811.539021][T28652] hsr_slave_1: entered allmulticast mode [ 812.149207][T27630] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 812.159818][T27630] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 812.168852][T27630] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 812.182241][T27630] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 812.209988][T27630] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 812.598171][ T25] block nbd4: Connection timed out, retrying (0/1 alive) [ 812.605425][ T25] block nbd4: Connection timed out, retrying (0/1 alive) [ 812.613001][ T25] block nbd4: Connection timed out, retrying (0/1 alive) [ 812.620247][ T25] block nbd4: Connection timed out, retrying (0/1 alive) [ 812.628963][ T25] block nbd4: Dead connection, failed to find a fallback [ 812.636606][ T25] block nbd4: shutting down sockets [ 812.642637][ T25] blk_print_req_error: 138 callbacks suppressed [ 812.642659][ T25] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.659051][ T25] buffer_io_error: 138 callbacks suppressed [ 812.659072][ T25] Buffer I/O error on dev nbd4, logical block 3, async page read [ 812.675859][ T25] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.685507][ T25] Buffer I/O error on dev nbd4, logical block 2, async page read [ 812.693518][ T25] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.703301][ T25] Buffer I/O error on dev nbd4, logical block 1, async page read [ 812.711276][ T25] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.722331][ T25] Buffer I/O error on dev nbd4, logical block 0, async page read [ 812.730359][T28433] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.741674][T28433] Buffer I/O error on dev nbd4, logical block 0, async page read [ 812.750508][T28433] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.760100][T28433] Buffer I/O error on dev nbd4, logical block 1, async page read [ 812.767914][T28433] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.780054][T28433] Buffer I/O error on dev nbd4, logical block 2, async page read [ 812.781095][T28687] bridge0: entered allmulticast mode [ 812.788887][T28433] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.803253][T28433] Buffer I/O error on dev nbd4, logical block 3, async page read [ 812.811220][T28433] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.821997][T28433] Buffer I/O error on dev nbd4, logical block 0, async page read [ 812.830140][T28433] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 812.839836][T28433] Buffer I/O error on dev nbd4, logical block 1, async page read [ 812.849050][T28433] ldm_validate_partition_table(): Disk read failed. [ 812.856499][T28433] Dev nbd4: unable to read RDB block 0 [ 812.863261][T28433] nbd4: unable to read partition table [ 812.929339][T28433] ldm_validate_partition_table(): Disk read failed. [ 812.944358][T28433] Dev nbd4: unable to read RDB block 0 [ 812.963451][T28433] nbd4: unable to read partition table [ 812.989391][T28675] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 813.303583][T28710] netlink: 'syz.0.6272': attribute type 1 has an invalid length. [ 813.337433][T28710] netlink: 'syz.0.6272': attribute type 2 has an invalid length. [ 813.345751][T28710] netlink: 'syz.0.6272': attribute type 1 has an invalid length. [ 813.379666][T28710] netlink: 'syz.0.6272': attribute type 3 has an invalid length. [ 813.510655][T28678] chnl_net:caif_netlink_parms(): no params data found [ 813.579139][ T12] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.654858][T12441] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.692944][T12240] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.746659][T12240] netdevsim netdevsim3 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 813.755941][T28729] netlink: 'syz.1.6277': attribute type 29 has an invalid length. [ 813.778851][T28678] bridge0: port 1(bridge_slave_0) entered blocking state [ 813.787477][T28678] bridge0: port 1(bridge_slave_0) entered disabled state [ 813.795291][T28678] bridge_slave_0: entered allmulticast mode [ 813.803334][T28678] bridge_slave_0: entered promiscuous mode [ 813.826514][ T35] geneve2: left allmulticast mode [ 813.835727][ T35] geneve2: left promiscuous mode [ 813.841030][ T35] bridge6: port 1(geneve2) entered disabled state [ 814.001088][ T35] batman_adv: batadv0: Removing interface: gretap2 [ 814.029559][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5440 ms [ 814.037821][ C1] lec:lec_tx_timeout: lec0 [ 814.042876][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 814.043521][ T35] bond5 (unregistering): (slave geneve3): Releasing active interface [ 814.270138][ T5843] Bluetooth: hci0: command tx timeout [ 814.413964][ T35] bond1 (unregistering): Released all slaves [ 814.427195][ T35] bond2 (unregistering): Released all slaves [ 814.442889][ T35] bond0 (unregistering): left promiscuous mode [ 814.452119][ T35] bond0 (unregistering): Released all slaves [ 814.466444][ T35] bond3 (unregistering): (slave veth3): Releasing backup interface [ 814.476168][ T35] bond3 (unregistering): (slave veth5): Releasing backup interface [ 814.487975][ T35] bond3 (unregistering): Released all slaves [ 814.505317][ T35] bond4 (unregistering): Released all slaves [ 814.518834][ T35] bond5 (unregistering): Released all slaves [ 814.533942][ T35] bond6 (unregistering): Released all slaves [ 814.546753][ T35] bond7 (unregistering): Released all slaves [ 814.562865][ T35] bond8 (unregistering): Released all slaves [ 814.578696][ T35] bond9 (unregistering): Released all slaves [ 814.599223][T28678] bridge0: port 2(bridge_slave_1) entered blocking state [ 814.623909][T28678] bridge0: port 2(bridge_slave_1) entered disabled state [ 814.631390][T28678] bridge_slave_1: entered allmulticast mode [ 814.638601][T28678] bridge_slave_1: entered promiscuous mode [ 814.682210][T28678] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 814.717400][T28678] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 814.761859][ T35] tipc: Disabling bearer [ 814.778027][ T35] tipc: Left network mode [ 814.836290][T28678] team0: Port device team_slave_0 added [ 814.848824][T28678] team0: Port device team_slave_1 added [ 814.915490][T28678] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 814.922645][T28678] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 814.949054][T28678] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 814.962160][T28678] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 814.972500][T28678] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 815.000710][T28678] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 815.059637][T28678] hsr_slave_0: entered promiscuous mode [ 815.066212][T28678] hsr_slave_1: entered promiscuous mode [ 815.073880][T28678] debugfs: 'hsr0' already exists in 'hsr' [ 815.080501][T28678] Cannot create hsr debugfs directory [ 815.236257][T28678] netdevsim netdevsim3 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.347035][ T35] batadv0: left promiscuous mode [ 815.357381][ T35] hsr_slave_0: left promiscuous mode [ 815.363516][ T35] hsr_slave_1: left promiscuous mode [ 815.369983][ T35] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 815.377806][ T35] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 815.386141][ T35] hsr0: left allmulticast mode [ 815.556117][ T35] team_slave_1 (unregistering): left allmulticast mode [ 815.568624][ T35] team0 (unregistering): Port device team_slave_1 removed [ 815.677881][T28678] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.740459][T28678] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 815.817312][T28678] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 816.041025][ T35] IPVS: stop unused estimator thread 0... [ 816.150650][T28703] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 816.182217][T28678] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 816.241201][T28678] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 816.321093][T28678] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 816.350460][ T5843] Bluetooth: hci0: command tx timeout [ 816.374508][T28678] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 816.647010][T28756] __nla_validate_parse: 8 callbacks suppressed [ 816.647034][T28756] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6283'. [ 816.723513][T28678] 8021q: adding VLAN 0 to HW filter on device bond0 [ 816.796798][T28756] bond2: Invalid ad_actor_system MAC address. [ 816.803360][T28756] bond2: option ad_actor_system: invalid value (7) [ 816.825057][T28756] bond2 (unregistering): Released all slaves [ 817.055172][T28678] 8021q: adding VLAN 0 to HW filter on device team0 [ 817.079857][ T3478] bridge0: port 1(bridge_slave_0) entered blocking state [ 817.087059][ T3478] bridge0: port 1(bridge_slave_0) entered forwarding state [ 817.126849][ T3478] bridge0: port 2(bridge_slave_1) entered blocking state [ 817.134380][ T3478] bridge0: port 2(bridge_slave_1) entered forwarding state [ 817.613614][T28793] tipc: Enabled bearer , priority 0 [ 817.635125][T28792] syzkaller0: entered promiscuous mode [ 817.664753][T28792] syzkaller0: entered allmulticast mode [ 817.726166][T28791] tipc: Resetting bearer [ 817.780977][T28791] tipc: Disabling bearer [ 817.987718][T28678] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 818.038839][T28801] syzkaller1: entered promiscuous mode [ 818.049778][T28801] syzkaller1: entered allmulticast mode [ 818.156880][T28813] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6294'. [ 818.358442][T28678] veth0_vlan: entered promiscuous mode [ 818.406590][T28678] veth1_vlan: entered promiscuous mode [ 818.418462][T28821] netlink: 'syz.0.6297': attribute type 1 has an invalid length. [ 818.430161][ T5843] Bluetooth: hci0: command tx timeout [ 818.500511][T28825] netlink: 'syz.1.6298': attribute type 7 has an invalid length. [ 818.522334][T28678] veth0_macvtap: entered promiscuous mode [ 818.535517][T28678] veth1_macvtap: entered promiscuous mode [ 818.548057][T28831] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6297'. [ 818.563233][T28678] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 818.570769][T28825] netlink: 'syz.1.6298': attribute type 8 has an invalid length. [ 818.578529][T28825] netlink: 'syz.1.6298': attribute type 9 has an invalid length. [ 818.599404][T28678] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 818.652032][T28825] netlink: 45919 bytes leftover after parsing attributes in process `syz.1.6298'. [ 818.675950][ T64] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.706847][ T64] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.751210][ T64] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 818.796694][ T64] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.049500][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 819.057565][ C1] lec:lec_tx_timeout: lec0 [ 819.134350][ T64] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.174626][ T64] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.216000][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.226515][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.397676][T28864] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6263'. [ 819.422294][T28864] netlink: 'syz.3.6263': attribute type 6 has an invalid length. [ 819.511577][T28868] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6304'. [ 819.560550][T28872] netlink: 'syz.4.6306': attribute type 1 has an invalid length. [ 819.729311][T28880] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6308'. [ 819.787629][T28883] netlink: 'syz.2.6309': attribute type 1 has an invalid length. [ 820.001736][T28887] 8021q: adding VLAN 0 to HW filter on device bond4 [ 820.042467][T28887] bond3: (slave bond4): making interface the new active one [ 820.082416][T28899] netlink: 'syz.4.6310': attribute type 1 has an invalid length. [ 820.099714][T28887] bond3: (slave bond4): Enslaving as an active interface with an up link [ 820.142154][T28902] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6309'. [ 820.222034][T28888] bond3: (slave gretap1): Enslaving as a backup interface with an up link [ 820.306487][T28899] bond2: entered promiscuous mode [ 820.313289][T28899] 8021q: adding VLAN 0 to HW filter on device bond2 [ 820.394086][T28902] 8021q: adding VLAN 0 to HW filter on device bond3 [ 820.480234][T28905] bond2: (slave bridge1): making interface the new active one [ 820.502273][T28905] bridge1: entered promiscuous mode [ 820.510018][ T5843] Bluetooth: hci0: command tx timeout [ 820.537961][T28905] bridge1: left promiscuous mode [ 820.999753][ T11] block nbd3: Possible stuck request ffff888025fc8000: control (read@0,1024B). Runtime 30 seconds [ 821.010489][ T11] block nbd3: Possible stuck request ffff888025fc8200: control (read@1024,1024B). Runtime 30 seconds [ 821.022211][ T11] block nbd3: Possible stuck request ffff888025fc8400: control (read@2048,1024B). Runtime 30 seconds [ 821.033299][ T11] block nbd3: Possible stuck request ffff888025fc8600: control (read@3072,1024B). Runtime 30 seconds [ 828.358348][T28955] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6319'. [ 828.364363][T28952] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6318'. [ 828.381984][T28950] bond0: entered promiscuous mode [ 828.388690][T28950] syz_tun: entered promiscuous mode [ 828.395280][T28950] debugfs: 'hsr1' already exists in 'hsr' [ 828.395783][T28954] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6322'. [ 828.402138][T28950] Cannot create hsr debugfs directory [ 828.449818][T28950] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 828.873828][T28974] netlink: 45 bytes leftover after parsing attributes in process `syz.1.6325'. [ 829.111343][T28995] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6330'. [ 829.330283][T29004] FAULT_INJECTION: forcing a failure. [ 829.330283][T29004] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 829.359523][T29004] CPU: 0 UID: 0 PID: 29004 Comm: syz.1.6332 Not tainted syzkaller #0 PREEMPT(full) [ 829.359555][T29004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 829.359568][T29004] Call Trace: [ 829.359577][T29004] [ 829.359586][T29004] dump_stack_lvl+0xe8/0x150 [ 829.359621][T29004] should_fail_ex+0x412/0x560 [ 829.359655][T29004] _copy_from_user+0x2d/0xb0 [ 829.359688][T29004] unix_setsockopt+0x17e/0x2a0 [ 829.359715][T29004] ? __pfx_unix_setsockopt+0x10/0x10 [ 829.359733][T29004] ? aa_sock_opt_perm+0xd4/0x1a0 [ 829.359764][T29004] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 829.359787][T29004] ? __pfx_unix_setsockopt+0x10/0x10 [ 829.359811][T29004] do_sock_setsockopt+0x17c/0x1b0 [ 829.359847][T29004] __x64_sys_setsockopt+0x13d/0x1b0 [ 829.359884][T29004] do_syscall_64+0x14d/0xf80 [ 829.359912][T29004] ? trace_irq_disable+0x3b/0x150 [ 829.359940][T29004] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.359962][T29004] ? clear_bhb_loop+0x40/0x90 [ 829.359988][T29004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 829.360009][T29004] RIP: 0033:0x7fcac739c799 [ 829.360029][T29004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 829.360048][T29004] RSP: 002b:00007fcac82ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 829.360072][T29004] RAX: ffffffffffffffda RBX: 00007fcac7615fa0 RCX: 00007fcac739c799 [ 829.360087][T29004] RDX: 0000000000000054 RSI: 0000000000000001 RDI: 0000000000000004 [ 829.360099][T29004] RBP: 00007fcac82ac090 R08: 0000000000000004 R09: 0000000000000000 [ 829.360113][T29004] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 829.360126][T29004] R13: 00007fcac7616038 R14: 00007fcac7615fa0 R15: 00007ffead775ce8 [ 829.360159][T29004] [ 829.703874][T29014] tipc: Enabling of bearer rejected, failed to enable media [ 829.745819][T29013] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 829.763062][T29013] bond1 (unregistering): Released all slaves [ 830.207355][T29031] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6339'. [ 830.324303][T29047] FAULT_INJECTION: forcing a failure. [ 830.324303][T29047] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 830.339001][T29047] CPU: 1 UID: 0 PID: 29047 Comm: syz.0.6345 Not tainted syzkaller #0 PREEMPT(full) [ 830.339031][T29047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 830.339042][T29047] Call Trace: [ 830.339051][T29047] [ 830.339060][T29047] dump_stack_lvl+0xe8/0x150 [ 830.339094][T29047] should_fail_ex+0x412/0x560 [ 830.339126][T29047] _copy_to_user+0x31/0xb0 [ 830.339159][T29047] simple_read_from_buffer+0xe1/0x170 [ 830.339193][T29047] proc_fail_nth_read+0x1bb/0x230 [ 830.339225][T29047] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 830.339257][T29047] ? rw_verify_area+0x2a6/0x4d0 [ 830.339278][T29047] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 830.339308][T29047] vfs_read+0x20c/0xa70 [ 830.339335][T29047] ? __pfx_vfs_read+0x10/0x10 [ 830.339363][T29047] ? _copy_from_user+0x94/0xb0 [ 830.339394][T29047] ? unix_setsockopt+0x20e/0x2a0 [ 830.339441][T29047] ksys_read+0x150/0x270 [ 830.339466][T29047] ? __pfx_ksys_read+0x10/0x10 [ 830.339498][T29047] do_syscall_64+0x14d/0xf80 [ 830.339526][T29047] ? trace_irq_disable+0x3b/0x150 [ 830.339553][T29047] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.339575][T29047] ? clear_bhb_loop+0x40/0x90 [ 830.339600][T29047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 830.339621][T29047] RIP: 0033:0x7fab7b55cfce [ 830.339642][T29047] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 830.339660][T29047] RSP: 002b:00007fab797f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 830.339683][T29047] RAX: ffffffffffffffda RBX: 00007fab797f66c0 RCX: 00007fab7b55cfce [ 830.339698][T29047] RDX: 000000000000000f RSI: 00007fab797f60a0 RDI: 0000000000000005 [ 830.339712][T29047] RBP: 00007fab797f6090 R08: 0000000000000000 R09: 0000000000000000 [ 830.339725][T29047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 830.339738][T29047] R13: 00007fab7b816038 R14: 00007fab7b815fa0 R15: 00007fffefef2d08 [ 830.339771][T29047] [ 830.627993][T29053] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6349'. [ 830.661621][T29050] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6347'. [ 830.675614][T29053] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6349'. [ 830.726353][T29050] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6347'. [ 830.767819][T26110] lec:lec_start_xmit: lec0:No lecd attached [ 830.850116][T27630] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 830.876088][T27630] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 830.885081][T27630] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 830.910132][T27630] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 830.922178][T27630] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 831.255745][T29078] syzkaller0: entered promiscuous mode [ 831.262167][T29078] syzkaller0: entered allmulticast mode [ 831.426794][T29078] tipc: Enabled bearer , priority 0 [ 831.444826][T29077] tipc: Resetting bearer [ 831.488623][T29077] tipc: Disabling bearer [ 831.513248][T29059] chnl_net:caif_netlink_parms(): no params data found [ 831.773314][T29059] bridge0: port 1(bridge_slave_0) entered blocking state [ 831.803404][T29059] bridge0: port 1(bridge_slave_0) entered disabled state [ 831.813463][T29059] bridge_slave_0: entered allmulticast mode [ 831.822606][T29059] bridge_slave_0: entered promiscuous mode [ 831.832569][T29099] bridge_slave_0: default FDB implementation only supports local addresses [ 831.843864][T29059] bridge0: port 2(bridge_slave_1) entered blocking state [ 831.853154][T29059] bridge0: port 2(bridge_slave_1) entered disabled state [ 831.863065][T29059] bridge_slave_1: entered allmulticast mode [ 831.874733][T29059] bridge_slave_1: entered promiscuous mode [ 831.882449][T29099] bridge_slave_0: default FDB implementation only supports local addresses [ 831.965783][T29059] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 832.002201][T29059] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 832.013476][T29106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 832.022844][T29109] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 832.278913][T29059] team0: Port device team_slave_0 added [ 832.288160][T29059] team0: Port device team_slave_1 added [ 832.333446][T29059] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 832.340742][T29059] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 832.367766][T29059] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 832.379058][T29126] x_tables: duplicate underflow at hook 2 [ 832.390359][T29121] netlink: 'syz.4.6370': attribute type 3 has an invalid length. [ 832.423173][T29059] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 832.448306][T29059] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 832.475299][T29059] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 832.571120][T29059] hsr_slave_0: entered promiscuous mode [ 832.638918][T29059] hsr_slave_1: entered promiscuous mode [ 832.645970][T29059] debugfs: 'hsr0' already exists in 'hsr' [ 832.662153][T29059] Cannot create hsr debugfs directory [ 832.885553][T29140] netlink: 'syz.1.6377': attribute type 11 has an invalid length. [ 833.005901][ T5843] Bluetooth: hci1: command tx timeout [ 833.529740][T29157] __nla_validate_parse: 9 callbacks suppressed [ 833.529765][T29157] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6383'. [ 833.559896][T29160] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6385'. [ 833.574380][T29059] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 833.605587][T29160] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6385'. [ 833.624849][T29160] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6385'. [ 833.672278][T29059] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 833.743696][T29167] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6386'. [ 833.755143][T29059] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 833.836229][T29059] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20000 - 0 [ 833.972341][T29179] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 834.006920][T29167] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.227066][T29191] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6392'. [ 834.296358][T29167] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.396980][T29167] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.493444][T29167] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.595924][T29059] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 834.618409][T29059] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 834.650570][T29059] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 834.684260][T29059] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 834.781013][T12427] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.872862][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.918461][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.000698][T12240] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 835.073209][ T5843] Bluetooth: hci1: command tx timeout [ 835.134759][T29059] 8021q: adding VLAN 0 to HW filter on device bond0 [ 835.157445][T29059] 8021q: adding VLAN 0 to HW filter on device team0 [ 835.173600][T29240] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6402'. [ 835.266692][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 835.274080][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 835.336756][T29240] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6402'. [ 835.361913][T12240] bridge0: port 2(bridge_slave_1) entered blocking state [ 835.369166][T12240] bridge0: port 2(bridge_slave_1) entered forwarding state [ 835.788359][T29264] netlink: 'syz.1.6406': attribute type 16 has an invalid length. [ 835.808977][T29264] netlink: 'syz.1.6406': attribute type 17 has an invalid length. [ 835.954720][T29269] xt_hashlimit: size too large, truncated to 1048576 [ 835.993297][T29264] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 836.029657][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5260 ms [ 836.037857][ C1] lec:lec_tx_timeout: lec0 [ 836.263771][T29275] 8021q: adding VLAN 0 to HW filter on device bond5 [ 836.305707][T29059] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 836.347957][T29279] geneve2: entered promiscuous mode [ 836.503261][T29059] veth0_vlan: entered promiscuous mode [ 836.526662][T29059] veth1_vlan: entered promiscuous mode [ 836.555368][T29059] veth0_macvtap: entered promiscuous mode [ 836.565568][T29059] veth1_macvtap: entered promiscuous mode [ 836.583927][T29059] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 836.602255][T29059] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 836.622380][T12427] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.631408][T12427] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.644050][T12427] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.653314][T12427] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 836.727490][T12240] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 836.735968][T12240] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 836.773539][T12427] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 836.782097][T12427] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 837.150293][ T5843] Bluetooth: hci1: command tx timeout [ 839.229890][ T5843] Bluetooth: hci1: command tx timeout [ 843.225361][T29307] netlink: 632 bytes leftover after parsing attributes in process `syz.1.6410'. [ 843.250642][T29314] netlink: 632 bytes leftover after parsing attributes in process `syz.1.6410'. [ 843.299921][T29312] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6412'. [ 843.412185][T29322] netlink: 'syz.1.6416': attribute type 1 has an invalid length. [ 843.431335][T29322] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6416'. [ 843.440646][T29324] netlink: 'syz.0.6415': attribute type 21 has an invalid length. [ 843.482770][T29324] 8021q: VLANs not supported on ip6_vti0 [ 843.603682][T29333] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6418'. [ 843.671356][T29333] macvlan2: entered promiscuous mode [ 843.697871][T29333] macvlan2: entered allmulticast mode [ 843.703641][T29333] veth1_to_batadv: entered allmulticast mode [ 843.832980][T29347] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6422'. [ 843.930988][T29347] sctp: [Deprecated]: syz.1.6422 (pid 29347) Use of int in max_burst socket option. [ 843.930988][T29347] Use struct sctp_assoc_value instead [ 843.992312][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.011051][T29347] netlink: 164 bytes leftover after parsing attributes in process `syz.1.6422'. [ 844.047809][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.085187][T29347] netlink: 164 bytes leftover after parsing attributes in process `syz.1.6422'. [ 844.105982][T29360] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 844.115608][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.163014][T29347] netlink: 164 bytes leftover after parsing attributes in process `syz.1.6422'. [ 844.202047][T29359] syzkaller1: entered allmulticast mode [ 844.232008][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.257682][T29347] netlink: 164 bytes leftover after parsing attributes in process `syz.1.6422'. [ 844.272154][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.282141][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.294102][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.305090][T29347] netlink: 'syz.1.6422': attribute type 21 has an invalid length. [ 844.317067][T17184] IPVS: starting estimator thread 0... [ 844.410293][T29366] IPVS: using max 23 ests per chain, 55200 per kthread [ 844.432995][T29370] netlink: 'syz.2.6429': attribute type 11 has an invalid length. [ 844.604715][T29377] sctp: [Deprecated]: syz.0.6431 (pid 29377) Use of int in max_burst socket option deprecated. [ 844.604715][T29377] Use struct sctp_assoc_value instead [ 845.116970][T17184] IPVS: starting estimator thread 0... [ 845.229921][T29398] IPVS: using max 25 ests per chain, 60000 per kthread [ 845.416966][T29420] bond1: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 845.434965][T29420] bond1 (unregistering): Released all slaves [ 845.542680][T29429] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 845.565663][T29426] syzkaller0: entered promiscuous mode [ 845.589905][T29426] syzkaller0: entered allmulticast mode [ 846.156858][T17194] IPVS: starting estimator thread 0... [ 846.254060][T29453] IPVS: using max 23 ests per chain, 55200 per kthread [ 846.466625][T29469] 9: entered promiscuous mode [ 846.905413][T29487] netlink: 'syz.3.6466': attribute type 11 has an invalid length. [ 847.436248][T29506] syzkaller0: entered promiscuous mode [ 847.454801][T29506] syzkaller0: entered allmulticast mode [ 847.490203][T29506] openvswitch: netlink: IP tunnel TTL not specified. [ 849.872624][T29552] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 850.115594][T29559] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 850.128073][T17194] IPVS: starting estimator thread 0... [ 850.174475][T29557] bond6 (unregistering): Released all slaves [ 850.229659][T29560] IPVS: using max 25 ests per chain, 60000 per kthread [ 850.362173][T29564] __nla_validate_parse: 37 callbacks suppressed [ 850.362198][T29564] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6488'. [ 850.561958][T29573] tap0: tun_chr_ioctl cmd 1074025676 [ 850.593928][T29575] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6492'. [ 850.609595][T29573] tap0: owner set to 0 [ 850.624090][T29575] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6492'. [ 850.730318][T29586] openvswitch: netlink: IPv4 tun info is not correct [ 850.755378][T29575] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6492'. [ 850.758377][T12240] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 850.787359][T29585] macvtap0: entered promiscuous mode [ 850.801774][T12240] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 850.844866][T12240] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 850.863233][T29575] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6492'. [ 850.893015][T12240] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 850.947774][T29583] macvtap0: left promiscuous mode [ 851.088401][T29601] RDS: rds_bind could not find a transport for ::1400:0:0:0, load rds_tcp or rds_rdma? [ 851.089570][ T11] block nbd3: Possible stuck request ffff888025fc8000: control (read@0,1024B). Runtime 60 seconds [ 851.109245][ T11] block nbd3: Possible stuck request ffff888025fc8200: control (read@1024,1024B). Runtime 60 seconds [ 851.121221][ T11] block nbd3: Possible stuck request ffff888025fc8400: control (read@2048,1024B). Runtime 60 seconds [ 851.132641][ T11] block nbd3: Possible stuck request ffff888025fc8600: control (read@3072,1024B). Runtime 60 seconds [ 851.163845][T29600] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 851.190206][T29609] RDS: rds_bind could not find a transport for ::1400:0:0:0, load rds_tcp or rds_rdma? [ 851.303291][T29577] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 851.563057][T29628] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6506'. [ 851.768679][T29637] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 851.927679][T27630] Bluetooth: hci4: command 0x0406 tx timeout [ 852.181407][T29651] FAULT_INJECTION: forcing a failure. [ 852.181407][T29651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 852.199698][T29651] CPU: 1 UID: 0 PID: 29651 Comm: syz.2.6512 Not tainted syzkaller #0 PREEMPT(full) [ 852.199731][T29651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 852.199743][T29651] Call Trace: [ 852.199753][T29651] [ 852.199762][T29651] dump_stack_lvl+0xe8/0x150 [ 852.199796][T29651] should_fail_ex+0x412/0x560 [ 852.199829][T29651] _copy_from_user+0x2d/0xb0 [ 852.199859][T29651] ____sys_sendmsg+0x308/0x9f0 [ 852.199890][T29651] ? __pfx_____sys_sendmsg+0x10/0x10 [ 852.199920][T29651] ? import_iovec+0x73/0xa0 [ 852.199954][T29651] ___sys_sendmsg+0x2a5/0x360 [ 852.199979][T29651] ? __pfx____sys_sendmsg+0x10/0x10 [ 852.200031][T29651] ? __fget_files+0x2a/0x420 [ 852.200060][T29651] ? __fget_files+0x3a0/0x420 [ 852.200099][T29651] __x64_sys_sendmsg+0x1bd/0x2a0 [ 852.200123][T29651] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 852.200155][T29651] ? __pfx_ksys_write+0x10/0x10 [ 852.200190][T29651] do_syscall_64+0x14d/0xf80 [ 852.200219][T29651] ? trace_irq_disable+0x3b/0x150 [ 852.200246][T29651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.200267][T29651] ? clear_bhb_loop+0x40/0x90 [ 852.200291][T29651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 852.200312][T29651] RIP: 0033:0x7f8e5679c799 [ 852.200334][T29651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 852.200353][T29651] RSP: 002b:00007f8e549d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 852.200376][T29651] RAX: ffffffffffffffda RBX: 00007f8e56a16090 RCX: 00007f8e5679c799 [ 852.200393][T29651] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000008 [ 852.200407][T29651] RBP: 00007f8e549d5090 R08: 0000000000000000 R09: 0000000000000000 [ 852.200420][T29651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 852.200433][T29651] R13: 00007f8e56a16128 R14: 00007f8e56a16090 R15: 00007ffcc7278238 [ 852.200468][T29651] [ 852.501477][T29657] bridge: RTM_NEWNEIGH with invalid ether address [ 852.530813][T29657] bridge: RTM_NEWNEIGH with invalid ether address [ 852.762946][T29667] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 852.931385][T29671] IPVS: nq: FWM 3 0x00000003 - no destination available [ 853.059872][T29683] x_tables: unsorted underflow at hook 2 [ 853.101456][T29681] syzkaller0: entered promiscuous mode [ 853.107164][T29681] syzkaller0: entered allmulticast mode [ 853.207489][T29690] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6522'. [ 853.272892][T29700] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6523'. [ 853.299054][T29703] IPv6: addrconf: prefix option has invalid lifetime [ 853.353437][T29701] veth1_to_team: entered promiscuous mode [ 853.485928][T29712] FAULT_INJECTION: forcing a failure. [ 853.485928][T29712] name failslab, interval 1, probability 0, space 0, times 0 [ 853.524535][T29712] CPU: 1 UID: 0 PID: 29712 Comm: syz.4.6526 Not tainted syzkaller #0 PREEMPT(full) [ 853.524566][T29712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 853.524580][T29712] Call Trace: [ 853.524588][T29712] [ 853.524597][T29712] dump_stack_lvl+0xe8/0x150 [ 853.524632][T29712] should_fail_ex+0x412/0x560 [ 853.524664][T29712] should_failslab+0xa8/0x100 [ 853.524688][T29712] ? dst_alloc+0x105/0x170 [ 853.524709][T29712] kmem_cache_alloc_noprof+0x87/0x650 [ 853.524741][T29712] dst_alloc+0x105/0x170 [ 853.524769][T29712] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 853.524812][T29712] ? ip_route_output_key_hash+0xd8/0x2a0 [ 853.524844][T29712] ip_route_output_key_hash+0x18d/0x2a0 [ 853.524872][T29712] ? ns_capable+0x89/0xe0 [ 853.524900][T29712] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 853.524928][T29712] ? __sock_cmsg_send+0x450/0x9f0 [ 853.524967][T29712] ip_route_output_flow+0x2a/0x150 [ 853.524991][T29712] ? security_sk_classify_flow+0x6d/0x150 [ 853.525015][T29712] udp_sendmsg+0x141a/0x21a0 [ 853.525044][T29712] ? string+0x279/0x2b0 [ 853.525077][T29712] ? __pfx_udp_sendmsg+0x10/0x10 [ 853.525108][T29712] ? format_decode+0x5a3/0xe10 [ 853.525155][T29712] ? get_random_u32+0x497/0x8b0 [ 853.525176][T29712] ? lockdep_hardirqs_on+0x7a/0x110 [ 853.525203][T29712] ? get_random_u32+0x13a/0x8b0 [ 853.525222][T29712] ? get_random_u32+0x4ce/0x8b0 [ 853.525252][T29712] udpv6_sendmsg+0x996/0x25c0 [ 853.525296][T29712] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 853.525317][T29712] ? udp_lib_get_port+0x168d/0x1b70 [ 853.525379][T29712] ? inet_send_prepare+0x1b9/0x270 [ 853.525409][T29712] ? inet_send_prepare+0x1b9/0x270 [ 853.525443][T29712] ? inet_send_prepare+0x1b9/0x270 [ 853.525471][T29712] ? __local_bh_enable_ip+0xd0/0x130 [ 853.525506][T29712] ? inet_send_prepare+0x1b9/0x270 [ 853.525540][T29712] ? inet6_sendmsg+0xe4/0x120 [ 853.525565][T29712] ____sys_sendmsg+0x5c7/0x9f0 [ 853.525597][T29712] ? __pfx_____sys_sendmsg+0x10/0x10 [ 853.525629][T29712] ? import_iovec+0x73/0xa0 [ 853.525664][T29712] ___sys_sendmsg+0x2a5/0x360 [ 853.525692][T29712] ? __pfx____sys_sendmsg+0x10/0x10 [ 853.525752][T29712] ? __fget_files+0x2a/0x420 [ 853.525781][T29712] ? __fget_files+0x3a0/0x420 [ 853.525822][T29712] __x64_sys_sendmsg+0x1bd/0x2a0 [ 853.525847][T29712] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 853.525879][T29712] ? __pfx_ksys_write+0x10/0x10 [ 853.525915][T29712] do_syscall_64+0x14d/0xf80 [ 853.525943][T29712] ? trace_irq_disable+0x3b/0x150 [ 853.525971][T29712] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.525992][T29712] ? clear_bhb_loop+0x40/0x90 [ 853.526018][T29712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 853.526039][T29712] RIP: 0033:0x7feaded9c799 [ 853.526059][T29712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 853.526075][T29712] RSP: 002b:00007feadfcbb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 853.526098][T29712] RAX: ffffffffffffffda RBX: 00007feadf016090 RCX: 00007feaded9c799 [ 853.526114][T29712] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000008 [ 853.526127][T29712] RBP: 00007feadfcbb090 R08: 0000000000000000 R09: 0000000000000000 [ 853.526140][T29712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 853.526153][T29712] R13: 00007feadf016128 R14: 00007feadf016090 R15: 00007ffe67f87c68 [ 853.526188][T29712] [ 854.920400][ C0] ------------[ cut here ]------------ [ 854.926177][ C0] ODEBUG: free active (active state 0) object: ffff88805b02cc90 object type: timer_list hint: rose_t0timer_expiry+0x0/0x560 [ 854.939124][ C0] WARNING: lib/debugobjects.c:632 at debug_check_no_obj_freed+0x405/0x550, CPU#0: swapper/0/0 [ 854.949558][ C0] Modules linked in: [ 854.953779][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 854.962776][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 854.973137][ C0] RIP: 0010:debug_check_no_obj_freed+0x44a/0x550 [ 854.979512][ C0] Code: 89 44 24 20 e8 e7 2c 77 fd 48 8b 44 24 20 4c 8b 4d 00 4c 89 ef 48 c7 c6 40 bb 27 8c 48 c7 c2 c0 c0 27 8c 8b 0c 24 4d 89 f8 50 <67> 48 0f b9 3a 48 83 c4 08 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc [ 854.999188][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00010246 [ 855.005344][ C0] RAX: ffffffff8a964de0 RBX: ffffffff9a56fa58 RCX: 0000000000000000 [ 855.013399][ C0] RDX: ffffffff8c27c0c0 RSI: ffffffff8c27bb40 RDI: ffffffff901beb60 [ 855.021426][ C0] RBP: ffffffff8bcf3ce0 R08: ffff88805b02cc90 R09: ffffffff8bcf5000 [ 855.029456][ C0] R10: dffffc0000000000 R11: ffffffff81b1e6a0 R12: ffff88805b02ce00 [ 855.037453][ C0] R13: ffffffff901beb60 R14: ffff88805b02c000 R15: ffff88805b02cc90 [ 855.045628][ C0] FS: 0000000000000000(0000) GS:ffff888125467000(0000) knlGS:0000000000000000 [ 855.054699][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 855.061311][ C0] CR2: 00007ffd94bad260 CR3: 000000000e54c000 CR4: 00000000003526f0 [ 855.069403][ C0] Call Trace: [ 855.072747][ C0] [ 855.075586][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 855.081279][ C0] kfree+0x13a/0x630 [ 855.085201][ C0] ? rose_timer_expiry+0x4cb/0x600 [ 855.090365][ C0] rose_timer_expiry+0x4cb/0x600 [ 855.095322][ C0] call_timer_fn+0x192/0x640 [ 855.099939][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 855.105423][ C0] ? call_timer_fn+0xd4/0x640 [ 855.110116][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 855.115233][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 855.120545][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 855.126000][ C0] __run_timer_base+0x652/0x8b0 [ 855.131117][ C0] ? ktime_get+0x45/0x200 [ 855.135454][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 855.140850][ C0] ? sched_clock_cpu+0x74/0x440 [ 855.145853][ C0] run_timer_softirq+0xb7/0x170 [ 855.150762][ C0] handle_softirqs+0x22a/0x870 [ 855.155575][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 855.160387][ C0] __irq_exit_rcu+0x5f/0x150 [ 855.165011][ C0] irq_exit_rcu+0x9/0x30 [ 855.169357][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 855.175138][ C0] [ 855.178077][ C0] [ 855.181019][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 855.187549][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 855.193247][ C0] Code: 6e 6c 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 b2 1a 00 fb f4 fc e9 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 855.212878][ C0] RSP: 0018:ffffffff8e407dc0 EFLAGS: 00000246 [ 855.218969][ C0] RAX: 00000000002087a5 RBX: ffffffff819a8c8d RCX: 0000000080000001 [ 855.226985][ C0] RDX: 0000000000000001 RSI: ffffffff8def7ea8 RDI: ffffffff8c27b500 [ 855.235092][ C0] RBP: ffffffff8e407eb0 R08: ffff8880b863395b R09: 1ffff110170c672b [ 855.243132][ C0] R10: dffffc0000000000 R11: ffffed10170c672c R12: ffffffff901129b0 [ 855.251123][ C0] R13: 1ffffffff1c929d8 R14: 0000000000000000 R15: 0000000000000000 [ 855.259185][ C0] ? do_idle+0x1bd/0x500 [ 855.263474][ C0] default_idle+0x9/0x20 [ 855.267719][ C0] default_idle_call+0x72/0xb0 [ 855.272513][ C0] do_idle+0x1bd/0x500 [ 855.276696][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 855.281933][ C0] ? __pfx_do_idle+0x10/0x10 [ 855.286577][ C0] cpu_startup_entry+0x43/0x60 [ 855.291390][ C0] rest_init+0x2de/0x300 [ 855.295678][ C0] start_kernel+0x385/0x3d0 [ 855.300242][ C0] x86_64_start_reservations+0x24/0x30 [ 855.305916][ C0] x86_64_start_kernel+0x143/0x1c0 [ 855.311228][ C0] common_startup_64+0x13e/0x147 [ 855.316270][ C0] [ 855.319482][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 855.326777][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 855.335707][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 855.345770][ C0] Call Trace: [ 855.349050][ C0] [ 855.351901][ C0] vpanic+0x56c/0xa60 [ 855.355892][ C0] ? __pfx__printk+0x10/0x10 [ 855.360504][ C0] ? __pfx_vpanic+0x10/0x10 [ 855.365023][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 855.370321][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 855.375531][ C0] panic+0xc5/0xd0 [ 855.379269][ C0] ? __pfx_panic+0x10/0x10 [ 855.383688][ C0] ? common_startup_64+0x13e/0x147 [ 855.388798][ C0] __warn+0x315/0x4f0 [ 855.392778][ C0] ? debug_check_no_obj_freed+0x405/0x550 [ 855.398514][ C0] ? debug_check_no_obj_freed+0x405/0x550 [ 855.404261][ C0] __report_bug+0x29a/0x540 [ 855.408774][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 855.414588][ C0] ? debug_check_no_obj_freed+0x405/0x550 [ 855.420313][ C0] ? __pfx___report_bug+0x10/0x10 [ 855.425439][ C0] ? run_timer_softirq+0xb7/0x170 [ 855.430473][ C0] ? handle_softirqs+0x22a/0x870 [ 855.435445][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 855.440242][ C0] ? sysvec_apic_timer_interrupt+0xa6/0xc0 [ 855.446625][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 855.452812][ C0] ? pv_native_safe_halt+0xf/0x20 [ 855.457850][ C0] ? default_idle+0x9/0x20 [ 855.462276][ C0] ? default_idle_call+0x72/0xb0 [ 855.467319][ C0] report_bug_entry+0x19a/0x290 [ 855.472195][ C0] ? debug_check_no_obj_freed+0x44a/0x550 [ 855.477939][ C0] ? debug_check_no_obj_freed+0x44f/0x550 [ 855.483671][ C0] handle_bug+0xce/0x200 [ 855.487961][ C0] exc_invalid_op+0x1a/0x50 [ 855.492597][ C0] asm_exc_invalid_op+0x1a/0x20 [ 855.497565][ C0] RIP: 0010:debug_check_no_obj_freed+0x44a/0x550 [ 855.503911][ C0] Code: 89 44 24 20 e8 e7 2c 77 fd 48 8b 44 24 20 4c 8b 4d 00 4c 89 ef 48 c7 c6 40 bb 27 8c 48 c7 c2 c0 c0 27 8c 8b 0c 24 4d 89 f8 50 <67> 48 0f b9 3a 48 83 c4 08 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc [ 855.523535][ C0] RSP: 0018:ffffc90000007b68 EFLAGS: 00010246 [ 855.529699][ C0] RAX: ffffffff8a964de0 RBX: ffffffff9a56fa58 RCX: 0000000000000000 [ 855.537687][ C0] RDX: ffffffff8c27c0c0 RSI: ffffffff8c27bb40 RDI: ffffffff901beb60 [ 855.545684][ C0] RBP: ffffffff8bcf3ce0 R08: ffff88805b02cc90 R09: ffffffff8bcf5000 [ 855.553663][ C0] R10: dffffc0000000000 R11: ffffffff81b1e6a0 R12: ffff88805b02ce00 [ 855.561678][ C0] R13: ffffffff901beb60 R14: ffff88805b02c000 R15: ffff88805b02cc90 [ 855.569683][ C0] ? __pfx_timer_debug_hint+0x10/0x10 [ 855.575068][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 855.580709][ C0] ? __pfx_rose_t0timer_expiry+0x10/0x10 [ 855.586347][ C0] kfree+0x13a/0x630 [ 855.590255][ C0] ? rose_timer_expiry+0x4cb/0x600 [ 855.595413][ C0] rose_timer_expiry+0x4cb/0x600 [ 855.600529][ C0] call_timer_fn+0x192/0x640 [ 855.605138][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 855.610596][ C0] ? call_timer_fn+0xd4/0x640 [ 855.615268][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 855.620392][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 855.625593][ C0] ? __pfx_rose_timer_expiry+0x10/0x10 [ 855.631062][ C0] __run_timer_base+0x652/0x8b0 [ 855.635945][ C0] ? ktime_get+0x45/0x200 [ 855.640307][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 855.645771][ C0] ? sched_clock_cpu+0x74/0x440 [ 855.650738][ C0] run_timer_softirq+0xb7/0x170 [ 855.655673][ C0] handle_softirqs+0x22a/0x870 [ 855.660476][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 855.665340][ C0] __irq_exit_rcu+0x5f/0x150 [ 855.669934][ C0] irq_exit_rcu+0x9/0x30 [ 855.674173][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 855.679813][ C0] [ 855.682753][ C0] [ 855.685863][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 855.691877][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 855.697695][ C0] Code: 6e 6c 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 b2 1a 00 fb f4 fc e9 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 855.717303][ C0] RSP: 0018:ffffffff8e407dc0 EFLAGS: 00000246 [ 855.723374][ C0] RAX: 00000000002087a5 RBX: ffffffff819a8c8d RCX: 0000000080000001 [ 855.731343][ C0] RDX: 0000000000000001 RSI: ffffffff8def7ea8 RDI: ffffffff8c27b500 [ 855.739310][ C0] RBP: ffffffff8e407eb0 R08: ffff8880b863395b R09: 1ffff110170c672b [ 855.747642][ C0] R10: dffffc0000000000 R11: ffffed10170c672c R12: ffffffff901129b0 [ 855.755680][ C0] R13: 1ffffffff1c929d8 R14: 0000000000000000 R15: 0000000000000000 [ 855.763662][ C0] ? do_idle+0x1bd/0x500 [ 855.767937][ C0] default_idle+0x9/0x20 [ 855.772195][ C0] default_idle_call+0x72/0xb0 [ 855.776955][ C0] do_idle+0x1bd/0x500 [ 855.781019][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 855.786224][ C0] ? __pfx_do_idle+0x10/0x10 [ 855.790836][ C0] cpu_startup_entry+0x43/0x60 [ 855.795645][ C0] rest_init+0x2de/0x300 [ 855.799913][ C0] start_kernel+0x385/0x3d0 [ 855.804427][ C0] x86_64_start_reservations+0x24/0x30 [ 855.809884][ C0] x86_64_start_kernel+0x143/0x1c0 [ 855.814989][ C0] common_startup_64+0x13e/0x147 [ 855.819940][ C0] [ 855.824758][ C0] Kernel Offset: disabled [ 855.829092][ C0] Rebooting in 86400 seconds..