last executing test programs: 13.117482363s ago: executing program 4 (id=2944): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e63, @multicast1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018", @ANYBLOB], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r1 = socket(0x2a, 0x2, 0x0) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r2 = accept4$vsock_stream(r1, &(0x7f0000000740)={0x28, 0x0, 0x0, @hyper}, 0x10, 0x80000) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000780)={r2}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x64}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, 0x0, 0x4) sendmsg$NFT_BATCH(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x24040844}, 0x4023) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000ea3f00000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a140000141169c201be30001100010000000000005f96e812888f45ed02b152f489355f524bff76d503fda085441f5d7b4fd2c2080b48bed3f6974f89b674653ae6a241e710024ad36c16db047fc44a1eff0f867e3c4c2aaf0eebe49d73278c399b18461dff95b72c062f35c09f89e486f2f045456d44f4d8a558cfdf88d42dbbf65c70334e9718b31e3e9ea8be4f3ed384da42032a353096ebe1b5f9f9396cb402c584e6663891f320376490f86032e05a96853241cf08abae9e537bfb4256e2a5916a53ee47a9778ba6f34e6e107d61fed716731ca1f6ff850bfd82b7c61c7b4f4d0d4f0800000000000000b077536390d30580"], 0x64}}, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r6, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x271c, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="68010000100001000000000000000000ac1414bb000000000000000000000000ac14142600000000000000000000000000000000000000000000300000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000033000000ac1414bb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000ff01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000036a9fc333c640e7efcb7957a219900004800010073686132353600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c00040001004e224e240000fe80000000000000000000000000003814000e007f00"], 0x168}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9b"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8924, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000003c0)="89a713c2ca38d36f526284d93c6628738a19795b93d3446d2c98031cfb54a9813147463227b3fff52baefa47aa293da7d73fcc6398d38020308744d22d9f036b8da97c8b63dc998d6d1db8d4d0cc24232366bb18369343a35ce45f8e9eab9c36a87d728a3797be7c771b7d0e30c7e5133b2100c6b6d8ce3a71af3d901c1143a5296e9142cabd7253294b11e92d7c9589030cb2f0a9238465ed2086d1a6f4b6202196559f067cb776ba8194abd5758bd8f0846db2286c8848f222ec3da70dd7db3ec3077f5ff9f044149ab939", 0xcc}], 0x1}}], 0x1, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x1000803c, 0x0, 0x0) 12.902075213s ago: executing program 4 (id=2948): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) getsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, 0x0, &(0x7f00000001c0)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b000000000000000000000000800000000008"], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="e8", 0x1}], 0x1, &(0x7f0000000280)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x26020480) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r10, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f000b000000080026000816"], 0x40}}, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="010000000b0000002f4900000500000041000000", @ANYRES32=0x1, @ANYBLOB="fcffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00'], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r11, &(0x7f00000001c0), &(0x7f0000000300)=""/16}, 0x20) socket$kcm(0x29, 0x7, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$unix(r4, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 12.145083243s ago: executing program 4 (id=2949): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xfff3}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x8}, @TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x53a8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x440e0}, 0x4890) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) 11.55000236s ago: executing program 4 (id=2956): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, 0x0, 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x9, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0x120, 0xffffffff, 0x1d0, 0xffffffff, 0xffffffff, 0x1d0, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private=0xa010102, 0x0, 0xffffffff, 'ip6_vti0\x00', 'caif0\x00', {}, {}, 0x2, 0x1, 0x4}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x8, 0x4000, 0x6, 0x2, 'pptp\x00', 'syz1\x00', {0x7fff}}}}, {{@ip={@multicast1, @broadcast, 0xffffffff, 0xffffffff, 'caif0\x00', 'veth0_virt_wifi\x00', {0xff}, {0xff}, 0x32, 0x1, 0x36}, 0x0, 0x70, 0xb0}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "fb51f0f52069d37c378114554bc1e3e5a78752f61e0d49d5eddd143e2044"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) 11.401975316s ago: executing program 4 (id=2958): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a32000000009c000000060a010400000000000000000100000208000b400000000074000480340001800b000100657874686472000024000280080001400000000c08"], 0x110}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x24}}, 0x0) socket$alg(0x26, 0x5, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) pipe(&(0x7f00000001c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYRESDEC], 0x2c}, 0x1, 0x0, 0x0, 0x4402}, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000000)={0xa0000001}) ppoll(&(0x7f0000000040), 0x0, 0x0, 0x0, 0x12) socket$inet6_tcp(0xa, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000140)={0x4}) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) preadv(r6, &(0x7f0000000240)=[{&(0x7f0000000100)=""/30, 0x1e}], 0x1, 0xe8, 0x8) bind$llc(r5, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x38) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r7) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_REMOVE(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)={0x34, r8, 0x403, 0x70bd29, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x34}}, 0x4008804) sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYRESDEC, @ANYRES16=r8, @ANYBLOB="010025bd7000ffdbdf25040000000800010002000000080002000200000000000100020000000800020200000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8000) 10.27206597s ago: executing program 4 (id=2964): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000440)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000180)={0x1d, r2, 0x0, {0x1, 0xf0, 0x4}}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000300)="b669f5d445082f011a", 0x9}], 0x1}, 0x4048081) connect$can_j1939(r1, &(0x7f0000000000)={0x1d, r2, 0x1, {0x0, 0xff, 0x4}, 0x2}, 0x18) sendmsg$nl_route_sched(r0, 0x0, 0x20000050) 7.015710596s ago: executing program 3 (id=2994): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_netdev_private(r3, 0x8993, &(0x7f0000000040)="58a34d3a") setsockopt$sock_attach_bpf(r1, 0x1, 0x23, &(0x7f0000000000), 0x4) sendmsg$inet(r2, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x20000000) recvmsg(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002940)=""/4098, 0x15}, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x12, "1fe473a8cb3169d4d5b7259627b5cf5b8a50"}, &(0x7f0000000700)=0x1a) 6.148666592s ago: executing program 3 (id=3003): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@random="00008000", @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x18, 0x3a, 0x0, @loopback, @loopback, {[], @mld={0x83, 0x0, 0x0, 0x9, 0xc036, @remote}}}}}}, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x26}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000000000)='e', 0x0, 0xd01, 0x0, 0x300, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) 4.371048826s ago: executing program 3 (id=3014): r0 = socket(0x2b, 0x1, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r2, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r4, &(0x7f0000000580)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000500)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2800ef00015257852095a575e1817907abb464d0362af2520090e71319b5f6d8e785f211217f40b588dbad017c1e2ecd244637388c3cb04284207ae7a3955d64eb8f637e46184d8fbb19645b826c6224a48ebb2d63075fc1f07616613a78774404da8771840b025abb310da52c7c65c1061f5d199c6e04d25769182c102337b2589429f29c916a7c73ca740463a55eb88c12524a1e35159a95e6fb04501097b3", @ANYRES16=r5, @ANYBLOB="000228bd7000ffdbdf25070000000c00060003000000030000000800050000000000"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x804) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x3, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xfff1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x48040}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x1, 0x3}, {}, {0x5, 0xfff1}}}, 0x24}}, 0x40004) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r7, 0x8982, &(0x7f00000005c0)={0x3, 'vlan0\x00', {0x9}}) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x5, &(0x7f0000000040)=0x4, 0x4) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r9, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r11 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r10, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r11, 0xfffffdc8, &(0x7f0000000340)}, 0xc) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x25) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000008c0)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000200000000000000000000030000000003000000020000000800000000000000000000010500000020000000000000000000000b"], 0x0, 0x4e}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x0, 0x0, &(0x7f00000010c0)='syzkaller\x00', 0x9, 0xff2, &(0x7f0000001cc0)=""/4082, 0x41000, 0x6, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400000}, 0x94) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f00000003c0)=ANY=[@ANYBLOB="800000000802110000010802110000005050505050500063c8b5e1410c98403bfda2112a0b000000000000000000640001000012bcb2fc61dca02864d19884114976094ba46f010076065c0504000600"], 0x42) setsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, 0x0, 0x0) 3.092915454s ago: executing program 1 (id=3019): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1e, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = epoll_create1(0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES16=r4, @ANYRES32=0x0, @ANYRES64=r4], 0x28}, 0x1, 0x0, 0x0, 0x48891}, 0x880) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r8, &(0x7f00000008c0)={0x1}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r10, &(0x7f0000000000)) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000001c0)=@newtfilter={0x38, 0x2c, 0x400, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0xffff, 0x5}, {}, {0x3, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004}, 0x80) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) r12 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r12, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030e0000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de40006000000000002004e22ac1414bb000000000000000002000100000000000200070c01000000030005000000000002004e21ac1e01010000000000000000010014000b00000000000000"], 0x70}, 0x1, 0x7}, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r13 = epoll_create(0x5) r14 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r14, 0x0) epoll_ctl$EPOLL_CTL_MOD(r13, 0x3, r14, &(0x7f00000000c0)={0xa}) socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth1_macvtap\x00'}) 2.802880067s ago: executing program 3 (id=3020): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="5000000425bd700004ffffffffffffffec00000000", @ANYRES32=0x0, @ANYBLOB="0005000000800000300012800b00010062726964676500002000028005002d00010000000c001e0002000000000000000500290001000000"], 0x50}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB="0500000008000000ed00000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="03"], 0x48}, 0x1, 0x0, 0x0, 0x2000c014}, 0x800) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r8, 0x400454cd, 0x7) close(0x3) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x200008c1) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x1d, r9}, 0x10, &(0x7f0000000180)={&(0x7f0000001140)=ANY=[@ANYRES64], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000e80)=ANY=[@ANYRESOCT, @ANYRES32=r9, @ANYBLOB="20000100", @ANYRES64=r7, @ANYBLOB="21020200fc0000000000000000000000000000000800000020000100d2c4edb791c26e46f93ad5206a70d6af82bf2ff6f349549fa18468b61dcf6c956cebe0e7aea0d940a3e0056aeeca6254b765c9cf70757c64beedbda00b602f571b19", @ANYRES32=0x0, @ANYBLOB="00000300ac1414bb0000000000000000000000000000000020000100", @ANYRES8, @ANYBLOB="00010200fe800000000000004600000000000000aa0800000020000100", @ANYRES64=r7, @ANYBLOB="01010100000000000000000000000000000000000800000020000100", @ANYRES32=r9, @ANYBLOB="01000200ac1414aa0000000000000000000000000000000020000100", @ANYRES32=r9, @ANYBLOB="01030100fc0200000000000000000000000000010000000020000100", @ANYRES32=r9, @ANYBLOB="01030000ac1e00010000000000000000000000008edd000020000100", @ANYRES32=r9, @ANYRESOCT, @ANYRES32=r9, @ANYBLOB="000000007f00000100000000000000000000000004000000"], 0x138}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000001180)={r5, &(0x7f00000002c0)='\\!!/.)_-[+\xa4*#\xc3#&\\\x00', 0x0, &(0x7f0000001080)={@_ha_fsid={[0xc0, 0x454]}, {0x83d3, 0x1, 0x4, 0xd}}, 0x4, &(0x7f00000010c0), &(0x7f0000001100)=0x3}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001400)={r10, 0x20, &(0x7f00000013c0)={&(0x7f0000001280)=""/236, 0xec, 0x0, &(0x7f0000001380)=""/62, 0x3e}}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000011c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000001440)=ANY=[@ANYRESDEC=r6], 0x0, 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, 0x24, r10, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r11}, 0x94) r12 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000780)=ANY=[@ANYRES32=r7, @ANYRES16=r9, @ANYRES8=0x0, @ANYRESDEC=r4, @ANYRES32=r3, @ANYRESHEX=r9, @ANYRESOCT=r12, @ANYBLOB="43c5069636fa2f17dcde3a6d806458bf6f05a788ea5a6367e65d900484df21c530afb36dfdf32e80e5f75d170c9c964791707f0f7f5431ddaf6d7bc1711b62e1a4f97774fd21f9bf63f3de093c240d561040237ff9dd0add6df689d7ce0c8879d831f0854c09767f75bb32d931d814e73f98922c060c73f23b662691000c2c0993901f2b7af7aec3942ad209ff1a11abb281d8260d63b978e2a5", @ANYBLOB="ceb4f3feee9ce51d03efc7404e90799613eb2d2de0ec9c590f66b40e1facbbf7028e", @ANYRES8=r1], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r11}, 0x94) socket$pptp(0x18, 0x1, 0x2) bind$pptp(r10, &(0x7f0000000000)={0x18, 0x2, {0x3, @empty}}, 0x1e) sendmmsg$inet(r0, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000600)="21fcf4792d44c83ca902a6e61d500498a77fa9d54893670825c2f1249a4fcb83fec5b3adfd80f9011be53a333d015ea22f3c270b3bd716085f9856e1056b40c183e19e1787df1dd6b0547d7eea522d04dc6d6b8c9c3bd8476d80fd68e6a5e7d84decfca1561ba86252ac387b66cdf6fafffea2dfdb64b78cbdb4a0fcbc5cca9df17753b978d763477059f00e9dff4677a579387d8996bc6b1888768a15cb892f66a63e4b8487edcd488473eb0d8bf66ad41ac105a066", 0xb6}], 0x1, &(0x7f0000000200)=[@ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x3}}], 0x30}}, {{&(0x7f0000000980)={0x2, 0x4e23, @private=0xa010102}, 0x10, &(0x7f0000000c80)=[{&(0x7f00000009c0)="c586b9d83398e285bcd55f00853f35b872d35b40809e2ad047c3631591faf19a3b1fa915d65c14b29aa6ee5b2c34070886b1f0abc33067206c1912fbed37173c4da0c49ae95bb53d1a3f41533e89", 0x4e}, {&(0x7f0000000a40)="de52865621137c5a01bade6c1590fc20dd0bbb833c06a505ff37dcb0fc4c0592181837497888c79b876b80a3cc130b1e7d2c784a0eaf8999455f6721003c7a78d712c3b8d8a92abb08ac4cb2deabd777cf7eaa7f0364a17949e62cd0142dd68141cd32ee5fe08bb549a23006e478421e7ced7dfd996ee5cba91813f2f67ce0318fc180c0b444e051ae58ea55d7009a9e2c6d59b4cd3ee4e634ac0c1a591ece875b0ad710dd4cddfffb63faf90643a912a11562edf5b83e21d181d9b4f10bc83c2e436ab8c0ba756122f87c2d6424dffe36892e8e3a2e1b06870092d6ed16cd3cb0e50a4f898c518168be3c1c0a63a1ca0bb19a6b3e9aab1de1", 0xf9}, {&(0x7f0000000b40)="d2fc604d1deec4e3b974e4158d8893621577aeeecdaa3211eebf15e7e554c4d3865dcc057bd4f362d1747d3e691802451b7bcccfb3b3c6f88ea800f14424ebdaa79d2be25a0564c6069afea5dfd5b7464caf784eea93a600703ee40c45bad5e81084b111770a2127bd9d1298e4675509555e2c691fe0721279dd17645152c98b1dd3c9f6dc909f5be402826a85a0af3c3c9e721c6fab7b3d6e55f57b5c6ba97ffdb950dbcafc0fcab3f5744840f259f0f4496cb34e3b", 0xb6}, {&(0x7f0000000c00)="9b4f51f0762c35111b5d046899307863576a976208b7788b35f403756b2d333e8a3eccc18fc8ce6cda4dd45b840a8b2c42b7c7b0e03fcd5bc513d3a3adbc213691e93c2e64138a28ddaaf1f65ef30e95919098159e95f7fa20c2e606f5225dc53f30ba", 0x63}], 0x4, &(0x7f0000001480)=ANY=[], 0x120}}], 0x2, 0x48840) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000340)=0x3, 0x4) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x8528c000) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r13, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e24, @multicast1}}, 0x0, 0x0, 0x92, 0x0, "e83ae75240c2d658ec87bb53679fd0000078548ceb6c4414fab0919616e19aecedec1b76aea5922406b64cddaeb9d339ba3c01c2c7b8df8e61740b9af2d4d58654a4af0fa0ce1f830cc1eaf991fd00"}, 0xd8) 2.520400708s ago: executing program 1 (id=3023): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r4 = socket(0x10, 0x803, 0x0) r5 = socket(0x10, 0x803, 0x2) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYRES16=r6], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r3}) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFADDR(r9, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r7}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0xa1ff, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 2.432062338s ago: executing program 0 (id=3024): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000050000000900010073797a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a30000000004c000000060a010400000800000000000500000008000b400000000018000480140001800b00010074756e6e656c0000040002800900010073797a30000000000b000740ae30c665"], 0xc0}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x7fff}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x100}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$phonet_pipe(0x23, 0x5, 0x2) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x6f}, 0x2c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd2a, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xffff}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), r8) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r8, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f00000005c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010069bd7000fedbdf253f00000008000300", @ANYRES32=r11, @ANYBLOB="3c005e80080009000800001008000600c7f20000080005004d0000000800050022000000080007"], 0x58}, 0x1, 0x0, 0x0, 0x80c0}, 0x4) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r5, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r7, 0x400, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x1000, 0x66}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4008001}, 0x80) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) close(r2) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r12) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r13, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r12, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "12ad"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001400038010"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.348201868s ago: executing program 3 (id=3025): mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r2, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r2, 0xaa0f4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000ff4000/0x3000)=nil, 0x3000, 0x2000004, 0x12, r4, 0xe6905000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r3, 0x1000) r5 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r5, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'lo\x00'}) sendmsg$nl_route(r6, 0x0, 0x48006) recvfrom$inet6(r5, &(0x7f0000000000)=""/31, 0x39, 0x2002, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000000)="48050000150019", 0x7}], 0x1) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='s', 0x573, 0x800, 0x0, 0x4b6ae4f95a5de35b) mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) mmap(&(0x7f0000071000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x4000) mmap(&(0x7f000015b000/0x3000)=nil, 0x3000, 0x800001, 0x10012, r1, 0x0) r8 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000c80), r8) 2.184838053s ago: executing program 2 (id=3026): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, 0x0) openat$cgroup_ro(r0, &(0x7f0000000080)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x28, 0x3, 0xf7, 0xfffff020}, {0x6, 0x2, 0x0, 0x5}]}, 0x10) 2.061739676s ago: executing program 2 (id=3027): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x405, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa}, 0x18) 1.989214301s ago: executing program 1 (id=3028): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e240400", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}}, 0x0) 1.987993079s ago: executing program 0 (id=3029): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@delneigh={0x1c, 0x1a, 0x1, 0x70bd28, 0xfffffffd, {0xa, 0x0, 0x0, 0x0, 0x80}}, 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 84) 1.864457508s ago: executing program 2 (id=3030): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000120000000100000a88000000090a050000000000000000000a0000040900020073797a310000000008000a40fffffffc0900010073797a3100000000080005400000000b44001280200001800a00010071756f7461000000100002800c0001400000000000000080140001800c000100636f756e746572000400028001000180080001006c6f670008000340000001"], 0xb0}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) 1.819440752s ago: executing program 1 (id=3031): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x5, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0xe27d, @remote, 0x1}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000"], 0x78}, 0x1, 0x0, 0x0, 0x24040840}, 0x0) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000480)={0xffffffffffffffff}) getsockopt$SO_J1939_PROMISC(r3, 0x6b, 0x2, &(0x7f0000000500), &(0x7f0000000540)=0x4) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, 0x0, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r5, &(0x7f00000005c0), 0x10) getsockopt$inet6_buf(r1, 0x29, 0x2c, &(0x7f0000000340)=""/135, &(0x7f0000000400)=0x87) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$int_in(r6, 0x5421, &(0x7f0000000440)=0x6) connect$bt_rfcomm(r6, &(0x7f00000001c0)={0x1f, @any, 0x6}, 0xa) close(r6) recvmmsg(r5, &(0x7f00000018c0)=[{{0x0, 0x0, 0x0}, 0x35}], 0x1, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r7, &(0x7f0000000280), &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r7, &(0x7f0000000340)="ee", &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r7, &(0x7f0000000780)}, 0x20) sendmsg$can_bcm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES8=r5], 0x48}}, 0x2404c054) ioctl$SIOCGSTAMPNS(r5, 0x8907, &(0x7f0000000180)) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r8, 0x0, 0xd1, &(0x7f0000000000)=0x8, 0x4) setsockopt$MRT_INIT(r8, 0x0, 0xc8, 0x0, 0x0) sendmsg$inet6(r1, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e20, 0x80000, @dev={0xfe, 0x80, '\x00', 0x3a}, 0xfffe}, 0x1b, 0x0, 0x0, &(0x7f0000000140)=[@dstopts={{0x28, 0x29, 0x32, {0xff, 0x1, '\x00', [@jumbo={0xc2, 0x4, 0xfc5}, @enc_lim={0x4, 0x1, 0x80}]}}}], 0x28}, 0x40) 1.524787674s ago: executing program 2 (id=3032): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1e, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = epoll_create1(0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES16=r4, @ANYRES32=0x0, @ANYRES64=r4], 0x28}, 0x1, 0x0, 0x0, 0x48891}, 0x880) r10 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r8, &(0x7f00000008c0)={0x1}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r10, &(0x7f0000000000)) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000001c0)=@newtfilter={0x38, 0x2c, 0x400, 0x30bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0xffff, 0x5}, {}, {0x3, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004}, 0x80) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r11) r12 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r12, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="020300030e0000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de40006000000000002004e22ac1414bb000000000000000002000100000000000200070c01000000030005000000000002004e21ac1e01010000000000000000010014000b00000000000000"], 0x70}, 0x1, 0x7}, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r11, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r13 = epoll_create(0x5) r14 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r14, 0x0) epoll_ctl$EPOLL_CTL_MOD(r13, 0x3, r14, &(0x7f00000000c0)={0xa}) socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth1_macvtap\x00'}) 1.236926713s ago: executing program 0 (id=3033): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000008500000029000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000000c0), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01600000000000000100077400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a7330000800020000000000080004200000000014000600626f6e64300000000000000000000000080003"], 0x78}, 0x1, 0xffffffff00000003, 0x0, 0x80}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r4, 0x84, 0x1f, 0x0, &(0x7f00000000c0)) sendmsg$NL80211_CMD_GET_WIPHY(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="010328bd7000000000000111000007000001000000000ca18c4b5600000004000000"], 0x28}}, 0x44) clock_gettime(0x0, &(0x7f0000000080)) socket(0x2b, 0x80801, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4000844) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADDDEF(r5, 0x0, 0x4080) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) accept4$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @empty}, &(0x7f00000001c0)=0x1c, 0x80800) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000300)={0xa, 0x3, 0x8, @loopback, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "41328ac33100", "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "89b06aff130000fd"}, 0x38) sendmsg$inet(r7, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@ip_tos_int={{0x14, 0x11a, 0x1, 0x8}}], 0x18}, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r6, 0x84, 0x14, 0x0, 0x0) 1.132725639s ago: executing program 0 (id=3034): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x50) mmap(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x300000b, 0x11, r0, 0x0) mmap(&(0x7f00008b3000/0x1000)=nil, 0x1000, 0x0, 0x3032, r0, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1e000000000000000100000007"], 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r2, 0x0, &(0x7f0000001700)=""/53}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$AUTOFS_IOC_PROTOVER(r3, 0x80049363, &(0x7f0000000040)) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x24000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x14, r4, 0x100, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x8044) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_RM_DEV_V2(r3, 0x5000943a, &(0x7f0000000f00)={{}, r5, 0x14, @unused=[0x0, 0xfffffffffffffffb, 0x7f, 0xffffffffffffb377], @name="d6d9974f2de9a8a5fed20bd1a2f5fb72a7d0bbf58145543daa57558caf26b00dcfbcbbd0df3adb417d743441b405e729fe87a03adbd122ab75692fa9e62d04bdf81cbaba0deec5f891b790eacea3b096052754fa38baa679681691a83b5f9731551debd0f68cbaca597a33bee8bde09ab4917c215dde05592f857e812e09c19d11ba594473ee91a668a437c9a3bd33490f9e22360ec8713a674248f4791da00410a8869641e199d9ce454e617391919b90d5df0ac276e6ab801ad947ebfcee9b964f72bf4b6f5ea93403c1182b295ff4c8bb10a10ac220c8a0eae271ff74d72c2d2790e8ba4199f23dd3c672497fff81267306a68ca80173d412b4f592bdac80b1271c68ad60eae91580214434c6032392f5afd00953e5b98d798eba3b766c53d36dee2b883621019edbbba0212f6aa62cb5fb7ad7e3509ab20900c22a66bfd664543fd181229bebd3ec125eb1873bfff029b23dad1335c4d9cff4525f9623908aa7e3d673b831050d407b7c860cd4865d54b9f19760b9d6c5dc74d91791677dd021f795168e40a0b3d921f8886d3c94471d6b2fc70c8fff91a4dfe4887b574d7b8e0c2a9dd2ac4f9016163f162e482d728f2cd99991b7c17cef5fb3ee5aee735c553b68255590e47c784fe206ba1016982b28814feb81da5cbb39f604abe4cb34053a1d35476bc0dafb2e30e3c6c01d4ba78681482327a200d16a5403743b712e4c7958744fcd31a6176fb58ffcdac0689dd471eec31d047a87329d51754a31d1f022e3c9fca2f7b0addf970087d62dc73eb9de09628e958b26f5403475dfa19e3f94f54cef5d176fcc1352110ee9a53e7cf841ed8a9b999293974e6abd9612d98779df2656b93396e4a197485b08cb61469c651bc8f6db5c62cc2aa33719a4421825992b73a1364afa1e29dfffbb6505705bd3673839b609e38308258d2a35b002d7781e8d0521b6228fad8738125d74d08844e4434b146622be519fae5f9e4b5e602365545c113cafad4871cef4a205d87699472bafbf69fafa7decc85721d0f1709b70e192e97f9385dcb337f5f369573b49e5a681d20223f0a84d84cbd0c6d13dc863e2fdf6e84f32dde69410cb470e573cce5bfb4e4b7f5e5ab17d977110da5c20e14c6d51073c9f5ec7b16a13ede1922da5eac542e2921edf0bd8b403555826741fa254cb6952993ebf33f70515a4e5209d4e62312923c2a510be8e9bcd5ae4a6a2d873b119b4d8cc146de12808885882330b1046ac259edc0eb4aedb395072259b3dca95b71802ee5a0dde465a3e93fd7c7c0e54404bbc488f9fd620ba4542dcf502230da31c42348f608d1a5e633f858c5352def0aa74ee43abc99d0458a6fcfc15485955e19f455d7434bcf3054ff7831f2a21edb189c5d9d84cc4c3fc6e8d2888cb63998bf382eb285c9f3f3b2137a800e0248e5e780d570b8471827681d81b92f612e9186306d696b23d60f2abd7591aa379e548022037d4086c2182777d915f3f77c69a626515c2932f9c395cac0c6227c90d4032a30aac7c9e1828ffc87411aaa03e11c301a6ccf500abdcda6f984745549cd3a69db3fba525528efc5a706b80094998d851a1ea7ef638a1ccd369bfdcee384c522a415f9fb2192a6c217fd603c0f48cbc9f64e4e2761af22e7b8729d356bbac5836643aaf7c86ef33e0ecda937d21539dce577845149cb3862f67919bb6a03a6aacf2257266a2d84366db4686e9c39241bd4a4c762be3a1bdc2c4f2f0a5bb220c427d771877d5189e7b6b2556751c0bda68c4953e51351fcfd5c5613ed5471d93180f155d0da116b440c4ad2196461d0cff466969f9420aba661c67a75c34a86a02b53535fd9bc015112bb52be028929074ee2c770e44981cbea8401ea972c0184e2d6ce464210cd4cc8e9e4ca75d931de6da00a0e6f55371e46ff6e4adc32eb91186719dbcd1e8a43d51953d2ea4cfb08c32c3c7ec34aacacbb66bb9cb88a7f38ace385c8fd195c2ad1fd711e42ad7ab19dcab728c94ab58120c4518e652136cc87719e838ce41674d1edbf53ca855eb176a5b40c4206c10d12e4f0bbca1e3f9ad8ce513126e80592907da42b56a79067f1ad34e7beffa5a7672eb8d330e626e5071f828af7b56c659ff8f88a7bdbe10674f5bbd73b568151bf7797a96c1d95469089ab5f89677fcc5d8e96fe1f1895123799c30bc70e09b4193168b1241bb0c50ab10066d51e807b77c65c0fc3ed3edc777e9f22802ebb8993056d71991b1576a4c3af13a0bb325444674a3b834654303778a0b23a042447ccc6ec2da06d5a174f25f71225d762c8d776508cdc626358fa838affdae7dc0fd58f50e2276a6efe8613a2fe86fab275c2af5e38066eb0d084c6268f8c82d42ce1047a11f245c7bb6c659498bb59373cc23b7e557f7161412956d199314a8b0ff95633092104ef29e120f8192531dc6803cae5854557a349b980adc4cb43a54c3e9e4c97a01bca348dfba8567a65b1cda4d75ac81bfcb01d334536e42a2a9d14e83d2e5435416f575a1ffd74462e94802f58af79bea5ea7abe14daf51ab1da7635674a0101c5c364448ec03d394b34776881aff4ea48378569c213bea0f0fabccaa6d0a7b1e4a166b3f8f61c741a16723be86cbf3256b1a1c008a8c265ada89eba6854aead5c87e5319d497ad395582082aed0509f812d5e7de5b58b32c17dd48f41ec23d753028eac5dd354bbec48eebb384d537b5071ade14d84974818b69d09c499f55417f3a3a7531c689059df9d06d5deefeb2424356b6663f3edf2677e2c30764a886b0279b843229ea7cb8e60194d291d461c1db2461dafcb53d1ee87debf67ae1fc480403d4f49aade176e8739afac8f352add67ff451471912fe6e291f655bff942b9478ec1c8b3d8309f7ef2a790f8d983f2d5fd0e1c3f8b072ba77510147987fe40c3391f5601dd20547af3e98290b8923db50179667f2ceef2ab962154d0eb113d3e94fc5d1b640d669ab5b3215c83a2fb165c6fd03173056bc5f9c381d8ccc79d423b7b583239e56a061d516663c7327ecf7f04a90088ed596161fb60047c4056380f7e5c9aa9c34ce5aadb41a001063f89fd4b8063837775dbf418a9d67e90d72671905135427a6d0b0454001d4bb8582b1c4815466cc491ac53e3037f4d453b635b628889cb50bb3ef48cbd52acfbc40d0d33330d8683cb63ef7a3f5087b50a93d5f90c26b60657a1272ce76e0cc095151663ced62da2445f8bb3b1aed50cd639cd83dddfcad86cb92e005bd5315a93e29e505b09fe634088c535a0b20dc8ade406f5274171677f2f726aa569c12b47fa53e6d41145826c8309407122bc82d6bba0a9dfe0d4eebca772f0e960ddab2e7083dbd0773601224ed7e407669de2fa453659e4165007958b2ea94d407eb7425b67066062f4146baf6d576268298aa6b34e3f31d25bbd54c1e311f05a5ca3c5b00a233cfd8ba480079c7b830394b27ce372f358047d99e9a1c450d7ec2d2042a72f1a52c6d2fb09277358f2ad79d39d89c855c2e8ebb4f5244b344393007a93b95900fdcb5b49354a80d0a084a5bf8a706ad087eee9cf62769c2cddbab10962fbd15a80444f7ca35175c1224b85f0644c6822cc6f200d4f4b355a93acc2f93241903187cbc2225688e9944ae43043d44c25b0ff02c58cc369d5fe52f6ce1b7af3f1a6b07b135fff4deeda08b53e517b8539ad81b238a419a632b5cfa65d89fac5f0c52b7100bbd14eadd8a0d2b386e2ad325c9fb8b7d57024f668dcd0ea90c8e75342997f1d8baf0aab3312c54ecf7a7b6acd084d83488f6f88fff82afa574fb82cb4be6eb14e68eaf347e2eb6b89e26aac573e910af24f35babdd816a68fd8d9534334db09d96fd375463994b3ca727e12775c9cbc4cf11688d9ccb9efe8931c8e61664bd63526572fab48bfe356a29337a59b979e983ed015c280a19ae53987bbeb441b666fab669f46034c4b882fd48c328fd2beac77a7a575de6e03de2b80948d693923b1a9933e48d9e0e20e6c8da428bb532c7d614b05a6f6f7dff440d17f58be758680e0b2d4055eeabbd8af40ed0ddd76716b01267ad6480585d37691e90873bf547d039559f45494b323b3c859dea4e6497d64ff4ef9ade23d5769810d9d569e1c086e455aa71adaa99874dfec7a840ad69cab1165409ce3f086b9de524eee5ddfffcb98a00a22a4adc112f0620c95835d6de5ebebdca8b0968a0a76468cde74a23d411719c21475f9a0d50f23375984d29f648e8cb296b85bf615e98482ea40a117ec6e7deb31f64496abe15bc033b2092b0709791ff59563a916bcb664a3274c1e9fcb5ba8d6155407c8ac8b13efb1b540016fc76722207c8e2f5efeeef962cdc7d3fb00a82348319157e3d6677654ee28d5e4d771ebea6b75c7b59e91e406ac61b7e22bb63b9ca75a64bbb20747a844f9077cdfb1c00fe42ec480ab6d522ce324cc76e79d11ce05fa1fdeb4b56793bc93b838fffd91279de57553f9e1aa67189ff65e9399ddee2601939f31fc901c1adf624443bd9dd8e6148c7686ace5a76ac5ea99fb7df5cb356c1bf37be3f116f1e9960e4e6fa0703ea89703c58d7da64f2eac93c49cbf6c4779273cc2d635964a2252378ff6a30f06c2982841bca6771081aa0fb19f87d577d67180a69cd07d893077756e66063c5d944ed8960a3ef5007215fa415c0b512f5613c303f505ae198b545a8923bf8ca53cd11befbfeef99b152386b5f10be5eaef0c41c64b7ba5afcede5cd4cd621330c4bde6554ca34c8a148ff5902031cf310e18ff5b2a3972aedb31ddb4ac57d681e0d22096f622ae07f06fa6b2e2fe0b98040340b32b4010c96acc71fcb60b15ac217ab46c2dee9b555636f681d9de8325fa73297ca534c6d479db0bf58a81bde276d312e7f07226ad0b824659a29859b195657984641367026bfc556043737b9eac0df4fbff935594058efff2930453a3e260e0e26a63b713b41dfb8d627efcb3b10a34ca1974419eb877bcde9ac14ca78b9274a2d5b78d03cba31f505e83886c21a4c3df84eaa06d54c9277f810ab40d6094a0d53b9d8c62f65df1d6fa1c91eb29cc5a4fd269a7db5aa26e1c9d99b92d7a3c04534944c188ffa3a0495ca957ec00d890c4b09c2ccd8c2d5c3816c3b6a9dca609b6990ebc67912df91585b5957857cadf63fe4185914ea68d869ac1bbee4a8d5d4486a7d7fe1950271de5036a99c762f22fbc8e0dd8ad55cd1a100e3cb6f415511bd272dcb43b4b1e686db439f8eda001bb60bbd1289c6bf6c2212739085722952a3f98b72fa47861f819b27c78761600e6d681069bded2d3f282117965be8ab2aa63835fe94c4e8eed93ba924929466ac28cc17c471a02b1856b5094fe57403c216a259f20f0fcbb6a7c73b75134021921987d1252fe559e8d4629c8f4782520a7c0abec9a035317872001395c94745a2e42e1dcab0f8a128e9666541b02668f208578b3da3d822254bfaca07bb5928db0f9b05543330f654fd132112e5d817f2d952e155d34f19bb24e43114ae8a54c03e58e0f2e8d8b7f4520e6e4eb8c1acec469ac6b00e5992fb1362766f8cf667d1d337032fd21a0161819cafe59a619294dab523dccb6fa3a9a7c233f0174ea6a9dcf1f0ce14430db3e9a3cf54811ed0b2bf4d35abc6a6a10a329f7a919ea87c98b4ceda0b78f4b3b44e6155a807bc6d93c26e74a615840cf99fda7bda"}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000580)={"f48aebd12dc884fb269c0c41848db72d", 0x0, r5, {0x3, 0x6}, {0x2, 0xab62}, 0x57, [0xffffffffffffffff, 0x2b, 0xffffffffffffffff, 0x800, 0x1, 0x3ff, 0x1, 0x9, 0x401, 0x2, 0x9, 0xffffffff, 0x7, 0x3, 0x9, 0x80000001]}) r6 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x6e23, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000040), 0x4) listen(r6, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r8}, &(0x7f0000000280), &(0x7f0000000240)=r7}, 0x20) 1.038873135s ago: executing program 0 (id=3035): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x17}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x8000fe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 688.053061ms ago: executing program 3 (id=3036): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) recvmmsg(r0, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x40010001, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000440)=@filter={'filter\x00', 0x42, 0x4, 0x388, 0xffffffff, 0x0, 0x240, 0x0, 0xffffffff, 0xffffffff, 0x2f0, 0x2f0, 0x2f0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11, 0x1, 0x6d}, 0x0, 0x158, 0x180, 0x0, {0x100000000000000}, [@common=@ttl={{0x28}, {0xa45e9b0095a8efed}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, [0xff000000, 0xffffff00, 0xff000000, 0xffffff00], @ipv4=@dev={0xac, 0x14, 0x14, 0x2a}, [0xffffff00, 0xff000000, 0xffffff00], @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0x0, 0xff, 0xff], @ipv4=@remote, [0xffffff00, 0xffffff00, 0xffffff00, 0xffffffff], 0x3, 0x2, 0x0, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x2800, 0x3020}, 0x200, 0x1080}}]}, @REJECT={0x28}}, {{@ip={@broadcast, @multicast2, 0xffffffff, 0xffffff00, 'veth0_to_hsr\x00', 'wg1\x00', {}, {0xff}, 0x67, 0x2, 0x1}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0xff, 'veth1_virt_wifi\x00', 'veth1_to_bridge\x00', {}, {}, 0x2, 0x2}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3e8) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f0000000000)={0x6, 'syz_tun\x00', {0x3a94}, 0xe3b}) socket$inet6(0xa, 0x800, 0x80000000) connect$can_bcm(r1, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f00000001c0)=0x7f, 0x4) recvmmsg(r1, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0x4251}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x4, 0x12) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x1d, &(0x7f0000000180)=0x2, 0x4) 596.884942ms ago: executing program 1 (id=3037): r0 = socket$kcm(0x29, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6tnl0\x00', 0x0, 0x29, 0x5, 0x3, 0x7ff, 0x20, @dev={0xfe, 0x80, '\x00', 0x2c}, @loopback, 0x20, 0x8, 0x7fff, 0xffffff58}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wg1\x00'}) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000001c0)={@initdev}, &(0x7f0000000200)=0x14) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x60, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r2, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}, @qdisc_kind_options=@q_cake={{0x9}, {0x20, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x100000000}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x3}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x4}]}}]}, 0x60}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r0}) sendmsg$NFT_MSG_GETOBJ_RESET(r4, &(0x7f00000007c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000780)={&(0x7f0000000740)={0x34, 0x15, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000080}, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000040)={r4}) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000480)={'vcan0\x00', {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}) sendmsg(r5, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000180)="93256970edaf21355964ad5ec5c15bea04c17879018910ab950ec98f530e770b32b2e95a15a3b7e7de465f778a809f3bd90febc825cd302ea0250e7a70a44507d52c2694089f14c34538874659931401f9076286f3c7bd9018ce589eeb20e9be959537d30fc2b9eaf61c857f32b4669a9ec1d21b6582e019f1b8dbf932b3323b0e1e575e22624b7eba4a295ef32de50df7ee34d8e3a9b9d23b1188aa35abb0125300b07d3b96b029d0", 0xa9}, {&(0x7f0000000240)="1758943a6ee46c5780a8b5994f1e3ac282a66d5a421b944fded6feca6412149d93e5f415ceae1ebd99ba28dc0126e160d6d21d5b064a02edc2e2274b86934c9c8babf87d6eed5a893a439ee065b9e3f9fe244f9df173dde0336c395c54d81d9c31f72da92264a12c7ead783a5f2feca4463687e4d7f8fa24d6794f243daee30018b491a67f035bf6f5317638978e89f027be77133e93e872f07c2a02e425173427ccb17a793c8ec446a704e74824af0cbfe521fe5bbaeec444b4816797c3a52540cf0f59e51b38540b431f101192870dbc894ace6b57dc9113364b1e58380180398491470b2513f8", 0xe8}, {&(0x7f0000000340)="618c134ce0f210f5a6caaf8619396d630077", 0x12}, {&(0x7f0000000380)="234d11d18cfd7c2171e8b0491832682dbee665c24200000000", 0x19}, {&(0x7f00000003c0)="26fb96dc0c2798243603c1f8c71254a1f3a65501f6da2fa9904a77d596151fc4a2dcc4d5d8cb777ee91ee1e769ff0cc895bced5e41b635683e4a8dda4a95cac58ee1735e23984911347710cd5e9a18172efd26819286e32a5ff3dbf79a4f61e902e96c20ac4aaf886d9154dc438f7d374cde127c6498b630aac36bb852091ef8f6", 0x81}, {&(0x7f0000000640)="af595280f02ab44259a272bc0797cd790f7645a0e3ac7b7367dc5d4bf68275ce1bd025c0d333f04d545f16766152f834b8da420bcf754ef7c22bfd56700a118e5cc524de561f015f4364ec4466b372247e8c667331b91c98e897589a1459a5730611efae2c357ae1f7fd7bced097103a0c0ba66607990595e364c910660e61fdc19fa67aab435a7f15d5098034cfd7b112879fb9a6b90882a40574b7f6fe02baa692be4c53037b4bfde80c482b487ee5a97cc7b09310658f8245f95311f6b09b74560e14aac220a4b1d7e2ad618d41ca36ef580126c46106c379ec62746b506d04b636ce5c1445b70600f14dd8e53b0e0fd3ec734746f7d3c4ec3390a759", 0xfe}, {&(0x7f0000000500)="e42bd2a7669eb29be1f02c60ef9101cb45224ad03a01f5c9903e62a7438e61e45b13900feb1d04492fdbe72798c4225b7f50e75ad52b86f98089decb7e999b1c7d1a28dcc5e8a404b7d5f1a34daaa10e83ff2e19e3c8a3f50591f28b2dc8c6efa35d647c2a439bb966869bb2d87eb074b2c22b620fe34943f3c9a5b5d36f7f16bf6adb03cb987b9d", 0x88}, {&(0x7f00000005c0)="a5fcf0e984b1dac9e16fc44d4bc65ed05d207cb6f64bdaa4c8c4a6b998a9420f2b29eca13c8c379bc9ab56ffa71ebbf70a6a9d789dc559616aadc65f5a4667c66b806efbc28be06132d0066f", 0x4c}, {0x0}, {0x0}], 0xa, &(0x7f0000000b40)=ANY=[@ANYBLOB="08010000000000000100000007000000e27a0c6920fc0250a82914eab51b99e94f7d69689ff91bd6febfef335bbac640dd8e3ece8e79d5f6926c2b90b98c71c038ee0f9ffb00935444ff3acaea509deed7cc8258667d8609bcaea6adda89f89f86731e1e4fc610317bdd71febdda4915a2f4306b1330df0c99c053c65e1f30ea0a7fb65238c12e9a879f39d7d5c9dfc1c9f61fc2daf2418b7eb2078a33bc560a4336ed7f46f9b7f0d21da29107ea7527c9746d7cbdc8f01facd397722c5df8c5cd39abed36c5286ed1d4023fa7f85865bdaf92450011fe10b9639669e09940091a3e7e6c44034a89c5d08c5cb5be288e2bc2bcea5baa973cfaeb6ca5ede4886f3c4b10b910b1dcb88957a500000000"], 0x108}, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r6, &(0x7f0000001bc0)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x400, @private0, 0x3}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) shutdown(r6, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x40) r7 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff0000000071106c000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x94) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f0000000400)=@assoc_value={r8, 0x3d}, 0x8) close(r5) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="4000000010003704000000920cf5d69eff0f00004d91b35677cef7d7741dfdecfb0eb718eb886c37dd70cde414d93b83ae7c179bf52bae2852ad0765e94b71459ef15a575071c21a7d169be8dd50361f310893af2c1838f4a3b655ea012459f28e409720ce46926e48c2acbb68bcbbd25e51196255e5b1207a45ef9e7eff", @ANYRES32=0x0, @ANYBLOB="8b0605002400000020001280080001007369740014000280060008003e0000000500090029000000"], 0x40}}, 0x0) 529.03383ms ago: executing program 2 (id=3038): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f00000001c0)=0x7f, 0x4) recvmmsg(r0, &(0x7f00000099c0)=[{{0x0, 0x0, 0x0}, 0x4251}], 0x1, 0x10002, 0x0) (fail_nth: 2) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000180)=0x2, 0x4) 423.745079ms ago: executing program 0 (id=3039): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xa0, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x78, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x40, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_DATA={0xc, 0x7, 0x0, 0x1, [@NFTA_DATA_VALUE={0x8, 0x1, "1f000000"}]}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x114}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="18020000030000000000000000000000850000002c000000850000000e00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000000)="a83dfd456500b97199cd5c400afc", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x20000800) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)={0x234, r3, 0x5, 0x4, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3f, 0xe, {{{}, {}, @device_b, @broadcast, @from_mac}, 0x0, @random=0x4, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x1, 0x7, 0x3c, 0x2}}, @void, @void, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x1, 0xf0, 0x8}}, @void}}, @NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}, @NL80211_ATTR_IE_ASSOC_RESP={0xa, 0x80, [@random={0xdf}, @perr={0x84, 0x2, {0x6}}]}, @NL80211_ATTR_PROBE_RESP={0x1ac, 0x91, "f4bfa19055c6fd2cd4cfd98da955bc65c67dfd2946774102a2a3b87df1067ad96673c1c046fa7018503b7b0b7596fc3c57ec5a390ede593a98971ed8a4001d4c382ecdfab5b83c8168f883292bf1e3aa73927f86aeb2e457ccd8178e243f6dd5f9e2bc4da6b2249e40e22ef394efb331f3b670522af6db0b71235f8f1a2f914600cc53503f66e9185bbdf3d4d18cd4665f581e763892f0408fea61954fb98cc0f82d580bc74a5e31ca7ae317c8170792b80983e9c2a5cfebfac44caaad54b11669e34ae95549747b3e935e16ba3d67310edae081b4e33b68743c9bbf743c5f1a3b13a18e701a0e2e43f29069afa382be92b2b96aa413d405e4d94f92c35258faf565d6500d316ac4fed7ae64f52f6b6ef9b84ba3d72725ef3f509e061ef1708b32e9914df35d685f700a01cac0763b7ac433a683e8cf65934cdda128099956db198b0fbac85c090c257da78684df566629b10628a2502a714248b427ba37f4bed6168d3eb11ad37e8a064eccadf422a4408b5c5daabc92be4d6413a4d98d747628f1cc25314382051d03906c4b878d344a13a1a77ec0c1956f5feda9e123b271d7a66df09e8bfcfa"}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x234}}, 0x0) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x35c, 0x0) preadv(r6, &(0x7f00000013c0)=[{&(0x7f00000014c0)=""/4075, 0xfeb}, {&(0x7f00000000c0)=""/4092, 0xffc}, {&(0x7f00000010c0)=""/242, 0xf2}], 0x3, 0x5, 0x45) socket(0x1e, 0x4, 0x400) 543.862µs ago: executing program 1 (id=3040): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e24040002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e"], 0xd4}}, 0x0) 0s ago: executing program 2 (id=3041): bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x50) socket$key(0xf, 0x3, 0x2) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) close(0x4) r2 = accept(r0, 0x0, 0x0) shutdown(r2, 0x1) pselect6(0x40, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x6073, 0x7, 0xca9a3b, 0x0, 0x9e25, 0x0, 0xffffffffffffffff}, &(0x7f0000000280), 0x0) kernel console output (not intermixed with test programs): 07fa18b816038 R14: 00007fa18b815fa0 R15: 00007ffc19d97748 [ 253.081739][T11590] [ 253.086295][T11590] debugfs: out of free dentries, can not create file 'netdev@ffff888034538658' [ 253.689795][T11590] vxcan5: entered allmulticast mode [ 253.992226][T11621] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 254.048789][T11624] FAULT_INJECTION: forcing a failure. [ 254.048789][T11624] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 254.083189][T11624] CPU: 0 UID: 0 PID: 11624 Comm: syz.0.1661 Not tainted syzkaller #0 PREEMPT(full) [ 254.083215][T11624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 254.083225][T11624] Call Trace: [ 254.083233][T11624] [ 254.083240][T11624] dump_stack_lvl+0xe8/0x150 [ 254.083266][T11624] should_fail_ex+0x412/0x560 [ 254.083295][T11624] _copy_from_user+0x2d/0xb0 [ 254.083321][T11624] ___sys_sendmsg+0x1c6/0x360 [ 254.083346][T11624] ? __lock_acquire+0x6b5/0x2cf0 [ 254.083371][T11624] ? __pfx____sys_sendmsg+0x10/0x10 [ 254.083426][T11624] ? __fget_files+0x2a/0x420 [ 254.083446][T11624] ? __fget_files+0x3a0/0x420 [ 254.083474][T11624] __x64_sys_sendmsg+0x1bd/0x2a0 [ 254.083501][T11624] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 254.083542][T11624] ? __pfx_ksys_write+0x10/0x10 [ 254.083575][T11624] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.083595][T11624] do_syscall_64+0x15f/0xf80 [ 254.083612][T11624] ? trace_irq_disable+0x3b/0x140 [ 254.083638][T11624] ? clear_bhb_loop+0x40/0x90 [ 254.083658][T11624] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 254.083678][T11624] RIP: 0033:0x7f5bd0f9cdd9 [ 254.083695][T11624] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 254.083710][T11624] RSP: 002b:00007f5bd1da2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 254.083729][T11624] RAX: ffffffffffffffda RBX: 00007f5bd1215fa0 RCX: 00007f5bd0f9cdd9 [ 254.083743][T11624] RDX: 0000000000000000 RSI: 0000200000002540 RDI: 0000000000000003 [ 254.083753][T11624] RBP: 00007f5bd1da2090 R08: 0000000000000000 R09: 0000000000000000 [ 254.083764][T11624] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 254.083774][T11624] R13: 00007f5bd1216038 R14: 00007f5bd1215fa0 R15: 00007ffd46389098 [ 254.083800][T11624] [ 254.312711][T11628] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 254.524394][T11644] netlink: 'syz.4.1668': attribute type 1 has an invalid length. [ 254.596130][T11641] syzkaller0: entered promiscuous mode [ 254.609148][T11641] syzkaller0: entered allmulticast mode [ 254.655736][T11644] bond7: (slave vxcan7): The slave device specified does not support setting the MAC address [ 254.682463][T11644] bond7: (slave vxcan7): Error -95 calling set_mac_address [ 254.792318][T11650] bond7: (slave gretap1): making interface the new active one [ 254.803203][T11650] bond7: (slave gretap1): Enslaving as an active interface with an up link [ 254.945763][T11652] macsec2: entered promiscuous mode [ 254.951301][T11652] macsec2: entered allmulticast mode [ 254.959705][T11652] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1669'. [ 255.066587][T11663] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1672'. [ 255.238713][T11670] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1676'. [ 255.264486][T11668] pim6reg1: entered promiscuous mode [ 255.270366][T11668] pim6reg1: entered allmulticast mode [ 255.475856][T11670] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1676'. [ 255.493808][T11680] bond0: (slave vlan3): Opening slave failed [ 255.666800][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.057496][T11701] syzkaller0: entered promiscuous mode [ 256.077697][T11701] syzkaller0: entered allmulticast mode [ 256.081064][T11708] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1686'. [ 256.310048][ T114] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.319192][ T114] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.331589][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.341965][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.476758][T11720] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.496836][T11720] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.508427][T11720] batman_adv: batadv0: Interface activated: dummy0 [ 256.517515][T11720] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 256.562215][T11720] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 256.572879][T11720] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 256.622591][ T756] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.629827][ T756] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.661424][ T756] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.668625][ T756] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.742259][T11731] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1693'. [ 256.778685][T11731] netlink: 1 bytes leftover after parsing attributes in process `syz.3.1693'. [ 256.793276][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 256.828093][T11731] netlink: 'syz.3.1693': attribute type 1 has an invalid length. [ 256.840991][T11731] netlink: 634 bytes leftover after parsing attributes in process `syz.3.1693'. [ 256.874970][T11733] netlink: 'syz.0.1692': attribute type 1 has an invalid length. [ 257.001109][T11747] netlink: 'syz.2.1698': attribute type 21 has an invalid length. [ 257.001135][T11750] netlink: 'syz.2.1698': attribute type 21 has an invalid length. [ 257.169370][T11759] netlink: 'syz.2.1701': attribute type 7 has an invalid length. [ 257.183139][T11759] netlink: 'syz.2.1701': attribute type 7 has an invalid length. [ 257.183507][ T8974] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.199982][ T8974] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.208912][ T8974] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.221202][ T8974] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.266037][T11764] netlink: 'syz.2.1702': attribute type 1 has an invalid length. [ 257.277777][T11764] tipc: Failed to remove unknown binding: 66,1,1/3571823015:1418683267/1418683269 [ 257.582211][ T137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.592146][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.602134][ T6225] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.777202][T11771] can: request_module (can-proto-0) failed. [ 257.825430][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 257.847853][T11773] ip6gre1: entered promiscuous mode [ 257.854570][T11773] ip6gre1: entered allmulticast mode [ 257.863017][ T8974] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 257.878762][ T8974] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 257.889528][ T6227] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 258.069391][ T6227] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 258.099335][ T6227] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 259.431274][ T6227] net_ratelimit: 1 callbacks suppressed [ 259.431288][ T6227] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 259.873948][T11741] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 259.928687][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 260.096514][T11800] __nla_validate_parse: 4 callbacks suppressed [ 260.096531][T11800] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1711'. [ 260.111368][T11797] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1714'. [ 260.355843][ T29] audit: type=1804 audit(1778446425.747:52): pid=11814 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1718" name="/newroot/348/cgroup.controllers" dev="tmpfs" ino=1804 res=1 errno=0 [ 260.381418][ T29] audit: type=1800 audit(1778446425.777:53): pid=11814 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1718" name="cgroup.controllers" dev="tmpfs" ino=1804 res=0 errno=0 [ 260.611825][ T29] audit: type=1804 audit(1778446425.997:54): pid=11825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.1719" name="/newroot/349/cgroup.controllers" dev="tmpfs" ino=1812 res=1 errno=0 [ 260.686325][ T29] audit: type=1800 audit(1778446425.997:55): pid=11825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1719" name="cgroup.controllers" dev="tmpfs" ino=1812 res=0 errno=0 [ 260.873191][T11831] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1722'. [ 260.950804][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.046775][T11838] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1723'. [ 261.068826][T11840] netlink: 428 bytes leftover after parsing attributes in process `syz.1.1722'. [ 261.419820][ T8974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.431885][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.456437][ T6234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 261.568173][T11832] syzkaller0: entered promiscuous mode [ 261.599828][T11832] syzkaller0: entered allmulticast mode [ 261.739829][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 261.741138][T11835] 8021q: adding VLAN 0 to HW filter on device bond5 [ 261.771428][T11835] bond5 (unregistering): Released all slaves [ 261.829209][T11840] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1722'. [ 262.062531][ T137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 262.072219][ T8974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 262.081196][ T6227] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 262.109085][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 263.728950][T11898] ieee802154 phy1 wpan1: encryption failed: -22 [ 263.943723][T11906] atomic_op ffff888079d31198 conn xmit_atomic 0000000000000000 [ 263.958475][T11888] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1733'. [ 263.965229][T11892] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1731'. [ 264.282206][T11922] sch_tbf: peakrate 67108864 is lower than or equals to rate 4294966145 ! [ 264.632129][ T6234] net_ratelimit: 2 callbacks suppressed [ 264.632146][ T6234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 264.986353][T11958] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 265.040683][ T29] audit: type=1804 audit(1778446430.427:56): pid=11960 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1752" name="/newroot/344/cgroup.controllers" dev="tmpfs" ino=1791 res=1 errno=0 [ 265.094754][ T29] audit: type=1800 audit(1778446430.427:57): pid=11960 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1752" name="cgroup.controllers" dev="tmpfs" ino=1791 res=0 errno=0 [ 265.117683][ T6225] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 265.190896][T11968] syzkaller0: entered promiscuous mode [ 265.202852][T11968] syzkaller0: entered allmulticast mode [ 265.570901][T11985] dvmrp1: entered allmulticast mode [ 265.659643][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 266.699272][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.180000][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.189583][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.197851][ T6225] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.208101][ T6234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.571161][T11936] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 267.825814][ T8974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 267.844684][T12014] macsec1: entered promiscuous mode [ 267.863593][T12009] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1764'. [ 267.908483][T12025] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1765'. [ 268.105216][T12035] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1772'. [ 268.238989][T12041] FAULT_INJECTION: forcing a failure. [ 268.238989][T12041] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 268.289664][T12041] CPU: 1 UID: 0 PID: 12041 Comm: syz.4.1775 Not tainted syzkaller #0 PREEMPT(full) [ 268.289689][T12041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 268.289699][T12041] Call Trace: [ 268.289706][T12041] [ 268.289714][T12041] dump_stack_lvl+0xe8/0x150 [ 268.289740][T12041] should_fail_ex+0x412/0x560 [ 268.289767][T12041] _copy_from_user+0x2d/0xb0 [ 268.289792][T12041] ___sys_sendmsg+0x1c6/0x360 [ 268.289817][T12041] ? __lock_acquire+0x6b5/0x2cf0 [ 268.289840][T12041] ? __pfx____sys_sendmsg+0x10/0x10 [ 268.289898][T12041] ? __fget_files+0x2a/0x420 [ 268.289918][T12041] ? __fget_files+0x3a0/0x420 [ 268.289953][T12041] __x64_sys_sendmsg+0x1bd/0x2a0 [ 268.289982][T12041] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 268.290013][T12041] ? __pfx_ksys_write+0x10/0x10 [ 268.290044][T12041] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.290062][T12041] do_syscall_64+0x15f/0xf80 [ 268.290078][T12041] ? trace_irq_disable+0x3b/0x140 [ 268.290103][T12041] ? clear_bhb_loop+0x40/0x90 [ 268.290124][T12041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 268.290150][T12041] RIP: 0033:0x7fa18b59cdd9 [ 268.290166][T12041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 268.290182][T12041] RSP: 002b:00007fa18c42f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 268.290201][T12041] RAX: ffffffffffffffda RBX: 00007fa18b815fa0 RCX: 00007fa18b59cdd9 [ 268.290214][T12041] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 268.290225][T12041] RBP: 00007fa18c42f090 R08: 0000000000000000 R09: 0000000000000000 [ 268.290237][T12041] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 268.290247][T12041] R13: 00007fa18b816038 R14: 00007fa18b815fa0 R15: 00007ffc19d97748 [ 268.290278][T12041] [ 268.520412][T12048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1777'. [ 268.632431][T12057] netlink: 200 bytes leftover after parsing attributes in process `syz.4.1781'. [ 268.653617][T12057] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1781'. [ 268.752423][T12060] netlink: 'syz.1.1779': attribute type 9 has an invalid length. [ 268.782006][T12060] netlink: 'syz.1.1779': attribute type 3 has an invalid length. [ 268.790976][T12060] netlink: 'syz.1.1779': attribute type 3 has an invalid length. [ 268.844324][T12067] netlink: 'syz.0.1784': attribute type 1 has an invalid length. [ 268.993009][T12067] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1784'. [ 269.002675][T12076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1787'. [ 269.013241][T12066] syzkaller0: entered promiscuous mode [ 269.018902][T12066] syzkaller0: entered allmulticast mode [ 269.059751][T12071] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1784'. [ 269.118304][T12078] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1788'. [ 269.364561][T12088] veth1_vlan: left promiscuous mode [ 269.375343][T12088] veth0_vlan: left promiscuous mode [ 269.389435][T12088] veth0_vlan: entered promiscuous mode [ 269.416083][T12088] veth1_vlan: entered promiscuous mode [ 269.445961][T12088] veth1_macvtap: left promiscuous mode [ 269.452947][T12088] veth0_macvtap: left promiscuous mode [ 269.460819][T12088] veth0_macvtap: entered promiscuous mode [ 269.468022][T12088] veth1_macvtap: entered promiscuous mode [ 269.486895][T12094] xt_CT: You must specify a L4 protocol and not use inversions on it [ 269.503462][T12088] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 269.516281][T12088] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 269.526072][T12088] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 269.535753][T12088] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 269.551894][T12088] 8021q: adding VLAN 0 to HW filter on device bond1 [ 269.582025][T12088] 8021q: adding VLAN 0 to HW filter on device bond2 [ 269.605900][T12088] 8021q: adding VLAN 0 to HW filter on device bond3 [ 269.620998][T12088] 8021q: adding VLAN 0 to HW filter on device bond5 [ 269.655354][ T114] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 269.672126][ T114] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 269.700794][ T114] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 269.725303][ T114] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 269.729383][T12103] FAULT_INJECTION: forcing a failure. [ 269.729383][T12103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 269.750076][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 269.764150][T12103] CPU: 1 UID: 0 PID: 12103 Comm: syz.4.1796 Not tainted syzkaller #0 PREEMPT(full) [ 269.764174][T12103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 269.764185][T12103] Call Trace: [ 269.764193][T12103] [ 269.764200][T12103] dump_stack_lvl+0xe8/0x150 [ 269.764226][T12103] should_fail_ex+0x412/0x560 [ 269.764255][T12103] _copy_to_user+0x31/0xb0 [ 269.764282][T12103] simple_read_from_buffer+0xe1/0x170 [ 269.764309][T12103] proc_fail_nth_read+0x1bb/0x230 [ 269.764335][T12103] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 269.764362][T12103] ? rw_verify_area+0x2a6/0x4d0 [ 269.764385][T12103] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 269.764409][T12103] vfs_read+0x20c/0xa70 [ 269.764438][T12103] ? __pfx___mutex_lock+0x10/0x10 [ 269.764458][T12103] ? __pfx_vfs_read+0x10/0x10 [ 269.764483][T12103] ? __fget_files+0x2a/0x420 [ 269.764509][T12103] ? __fget_files+0x3a0/0x420 [ 269.764530][T12103] ? __fget_files+0x2a/0x420 [ 269.764560][T12103] ksys_read+0x150/0x270 [ 269.764586][T12103] ? __pfx_ksys_read+0x10/0x10 [ 269.764618][T12103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.764639][T12103] do_syscall_64+0x15f/0xf80 [ 269.764656][T12103] ? trace_irq_disable+0x3b/0x140 [ 269.764681][T12103] ? clear_bhb_loop+0x40/0x90 [ 269.764703][T12103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.764720][T12103] RIP: 0033:0x7fa18b55d60e [ 269.764737][T12103] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 269.764752][T12103] RSP: 002b:00007fa18c42efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 269.764770][T12103] RAX: ffffffffffffffda RBX: 00007fa18c42f6c0 RCX: 00007fa18b55d60e [ 269.764783][T12103] RDX: 000000000000000f RSI: 00007fa18c42f0a0 RDI: 0000000000000004 [ 269.764794][T12103] RBP: 00007fa18c42f090 R08: 0000000000000000 R09: 0000000000000000 [ 269.764805][T12103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 269.764815][T12103] R13: 00007fa18b816038 R14: 00007fa18b815fa0 R15: 00007ffc19d97748 [ 269.764846][T12103] [ 270.244858][T12117] net_ratelimit: 5 callbacks suppressed [ 270.244877][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.304461][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.321324][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.331096][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.360140][T12121] syzkaller0: entered promiscuous mode [ 270.365662][T12121] syzkaller0: entered allmulticast mode [ 270.395222][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.405828][ T8974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.429241][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.450948][T12117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.460795][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 270.925472][T12146] bond6: entered promiscuous mode [ 270.932613][T12146] bond6: entered allmulticast mode [ 271.009409][T12156] FAULT_INJECTION: forcing a failure. [ 271.009409][T12156] name failslab, interval 1, probability 0, space 0, times 0 [ 271.067719][T12156] CPU: 1 UID: 0 PID: 12156 Comm: syz.3.1814 Not tainted syzkaller #0 PREEMPT(full) [ 271.067745][T12156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 271.067756][T12156] Call Trace: [ 271.067763][T12156] [ 271.067771][T12156] dump_stack_lvl+0xe8/0x150 [ 271.067797][T12156] should_fail_ex+0x412/0x560 [ 271.067826][T12156] should_failslab+0xa8/0x100 [ 271.067856][T12156] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 271.067881][T12156] ? __alloc_skb+0x186/0x7d0 [ 271.067903][T12156] ? __alloc_skb+0x1d0/0x7d0 [ 271.067927][T12156] ? __local_bh_enable_ip+0xd0/0x130 [ 271.067950][T12156] __alloc_skb+0x1d0/0x7d0 [ 271.067973][T12156] ? netlink_ack_tlv_len+0x6c/0x210 [ 271.068000][T12156] netlink_ack+0x146/0xa50 [ 271.068022][T12156] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 271.068044][T12156] ? ref_tracker_free+0x693/0x840 [ 271.068072][T12156] ? __pfx_ref_tracker_free+0x10/0x10 [ 271.068094][T12156] ? __asan_memcpy+0x40/0x70 [ 271.068113][T12156] ? __skb_clone+0x63/0x7a0 [ 271.068146][T12156] netlink_rcv_skb+0x2b6/0x4b0 [ 271.068172][T12156] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 271.068202][T12156] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 271.068239][T12156] ? netlink_deliver_tap+0x2e/0x1b0 [ 271.068263][T12156] ? netlink_deliver_tap+0x2e/0x1b0 [ 271.068293][T12156] netlink_unicast+0x75c/0x8e0 [ 271.068327][T12156] netlink_sendmsg+0x813/0xb40 [ 271.068361][T12156] ? __pfx_netlink_sendmsg+0x10/0x10 [ 271.068390][T12156] ? aa_sock_msg_perm+0xf1/0x1b0 [ 271.068415][T12156] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 271.068441][T12156] ____sys_sendmsg+0x972/0x9f0 [ 271.068468][T12156] ? __might_fault+0xaf/0x130 [ 271.068496][T12156] ? __pfx_____sys_sendmsg+0x10/0x10 [ 271.068532][T12156] ? import_iovec+0x73/0xa0 [ 271.068560][T12156] ___sys_sendmsg+0x2a5/0x360 [ 271.068584][T12156] ? __lock_acquire+0x6b5/0x2cf0 [ 271.068608][T12156] ? __pfx____sys_sendmsg+0x10/0x10 [ 271.068667][T12156] ? __fget_files+0x2a/0x420 [ 271.068687][T12156] ? __fget_files+0x3a0/0x420 [ 271.068719][T12156] __x64_sys_sendmsg+0x1bd/0x2a0 [ 271.068747][T12156] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 271.068782][T12156] ? __pfx_ksys_write+0x10/0x10 [ 271.068815][T12156] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.068835][T12156] do_syscall_64+0x15f/0xf80 [ 271.068852][T12156] ? trace_irq_disable+0x3b/0x140 [ 271.068878][T12156] ? clear_bhb_loop+0x40/0x90 [ 271.068900][T12156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 271.068918][T12156] RIP: 0033:0x7f085499cdd9 [ 271.068935][T12156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.068950][T12156] RSP: 002b:00007f0855796028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 271.068969][T12156] RAX: ffffffffffffffda RBX: 00007f0854c15fa0 RCX: 00007f085499cdd9 [ 271.068982][T12156] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000007 [ 271.068993][T12156] RBP: 00007f0855796090 R08: 0000000000000000 R09: 0000000000000000 [ 271.069004][T12156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 271.069015][T12156] R13: 00007f0854c16038 R14: 00007f0854c15fa0 R15: 00007fffe2b0eb58 [ 271.069044][T12156] [ 271.391774][ T6234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 271.593190][T12166] netlink: 'syz.3.1817': attribute type 4 has an invalid length. [ 272.225274][T12195] netlink: 'syz.4.1827': attribute type 4 has an invalid length. [ 272.297746][T12201] netlink: 'syz.4.1827': attribute type 4 has an invalid length. [ 272.498595][T12207] FAULT_INJECTION: forcing a failure. [ 272.498595][T12207] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 272.519741][T12207] CPU: 0 UID: 0 PID: 12207 Comm: syz.1.1828 Not tainted syzkaller #0 PREEMPT(full) [ 272.519767][T12207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 272.519778][T12207] Call Trace: [ 272.519785][T12207] [ 272.519792][T12207] dump_stack_lvl+0xe8/0x150 [ 272.519823][T12207] should_fail_ex+0x412/0x560 [ 272.519851][T12207] _copy_from_user+0x2d/0xb0 [ 272.519877][T12207] kstrtouint_from_user+0xd6/0x180 [ 272.519903][T12207] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 272.519938][T12207] proc_fail_nth_write+0x8e/0x210 [ 272.519961][T12207] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 272.519988][T12207] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 272.520012][T12207] vfs_write+0x29a/0xb90 [ 272.520045][T12207] ? __pfx_vfs_write+0x10/0x10 [ 272.520070][T12207] ? __fget_files+0x2a/0x420 [ 272.520100][T12207] ? __fget_files+0x3a0/0x420 [ 272.520117][T12207] ? __fget_files+0x2a/0x420 [ 272.520147][T12207] ksys_write+0x150/0x270 [ 272.520173][T12207] ? __pfx_ksys_write+0x10/0x10 [ 272.520204][T12207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.520223][T12207] do_syscall_64+0x15f/0xf80 [ 272.520240][T12207] ? trace_irq_disable+0x3b/0x140 [ 272.520267][T12207] ? clear_bhb_loop+0x40/0x90 [ 272.520289][T12207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 272.520307][T12207] RIP: 0033:0x7f243355d60e [ 272.520323][T12207] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 272.520336][T12207] RSP: 002b:00007f24343b4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 272.520354][T12207] RAX: ffffffffffffffda RBX: 00007f24343b56c0 RCX: 00007f243355d60e [ 272.520367][T12207] RDX: 0000000000000001 RSI: 00007f24343b50a0 RDI: 000000000000000b [ 272.520378][T12207] RBP: 00007f24343b5090 R08: 0000000000000000 R09: 0000000000000000 [ 272.520388][T12207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 272.520399][T12207] R13: 00007f2433816128 R14: 00007f2433816090 R15: 00007ffd7986a6d8 [ 272.520428][T12207] [ 272.774329][T12195] IPVS: set_ctl: invalid protocol: 43 172.30.1.5:20004 [ 273.008744][T12226] __nla_validate_parse: 5 callbacks suppressed [ 273.008764][T12226] netlink: 140 bytes leftover after parsing attributes in process `syz.2.1835'. [ 273.282272][T12242] netlink: 'syz.4.1840': attribute type 7 has an invalid length. [ 273.292915][T12242] netlink: 'syz.4.1840': attribute type 8 has an invalid length. [ 273.343282][T12244] netlink: 'syz.2.1839': attribute type 11 has an invalid length. [ 274.395425][T12281] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1848'. [ 274.636650][T12285] bond0: entered promiscuous mode [ 274.689230][T12285] bond_slave_0: entered promiscuous mode [ 274.745719][T12285] bond_slave_1: entered promiscuous mode [ 274.777658][T12285] dummy0: entered promiscuous mode [ 274.832453][T12285] batadv0: entered promiscuous mode [ 274.873216][T12285] debugfs: 'hsr1' already exists in 'hsr' [ 274.878943][T12298] netlink: 'syz.2.1854': attribute type 7 has an invalid length. [ 274.895628][T12285] Cannot create hsr debugfs directory [ 274.905897][T12298] netlink: 'syz.2.1854': attribute type 8 has an invalid length. [ 274.935751][T12285] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 274.970605][T12285] bond0: left promiscuous mode [ 274.990323][T12285] bond_slave_0: left promiscuous mode [ 275.032164][T12285] bond_slave_1: left promiscuous mode [ 275.083611][T12285] dummy0: left promiscuous mode [ 275.116561][T12285] batadv0: left promiscuous mode [ 275.315033][T12318] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1860'. [ 275.597098][ T6237] net_ratelimit: 7 callbacks suppressed [ 275.597116][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 275.890454][T12348] syzkaller1: entered promiscuous mode [ 275.911798][T12348] syzkaller1: entered allmulticast mode [ 276.044162][T12357] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1869'. [ 276.064284][T12361] geneve3: entered allmulticast mode [ 276.085162][T12354] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.095015][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.123053][T12365] netlink: 'syz.4.1872': attribute type 7 has an invalid length. [ 276.166911][T12365] netlink: 'syz.4.1872': attribute type 8 has an invalid length. [ 276.302141][T12373] FAULT_INJECTION: forcing a failure. [ 276.302141][T12373] name failslab, interval 1, probability 0, space 0, times 0 [ 276.334139][T12373] CPU: 0 UID: 0 PID: 12373 Comm: syz.3.1874 Not tainted syzkaller #0 PREEMPT(full) [ 276.334165][T12373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 276.334176][T12373] Call Trace: [ 276.334183][T12373] [ 276.334191][T12373] dump_stack_lvl+0xe8/0x150 [ 276.334218][T12373] should_fail_ex+0x412/0x560 [ 276.334247][T12373] should_failslab+0xa8/0x100 [ 276.334275][T12373] __kvmalloc_node_noprof+0x178/0x8a0 [ 276.334305][T12373] ? alloc_netdev_mqs+0xa8/0x1210 [ 276.334333][T12373] alloc_netdev_mqs+0xa8/0x1210 [ 276.334351][T12373] ? __pfx_geneve_setup+0x10/0x10 [ 276.334383][T12373] rtnl_create_link+0x31f/0xd70 [ 276.334409][T12373] rtnl_newlink_create+0x277/0xb70 [ 276.334435][T12373] ? __pfx___nla_validate_parse+0x10/0x10 [ 276.334466][T12373] ? __mutex_lock+0x608/0x1550 [ 276.334486][T12373] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 276.334514][T12373] ? __pfx___mutex_lock+0x10/0x10 [ 276.334542][T12373] ? ns_capable+0x89/0xe0 [ 276.334565][T12373] rtnl_newlink+0x166a/0x1bb0 [ 276.334604][T12373] ? __pfx_rtnl_newlink+0x10/0x10 [ 276.334625][T12373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.334678][T12373] ? kasan_quarantine_put+0xbb/0x1f0 [ 276.334702][T12373] ? lockdep_hardirqs_on+0x7a/0x110 [ 276.334731][T12373] ? nlmon_xmit+0xb0/0x100 [ 276.334749][T12373] ? kmem_cache_free+0x182/0x650 [ 276.334792][T12373] ? __lock_acquire+0x6b5/0x2cf0 [ 276.334816][T12373] ? __dev_queue_xmit+0x2b6/0x3950 [ 276.334838][T12373] ? __local_bh_enable_ip+0xd0/0x130 [ 276.334855][T12373] ? lockdep_hardirqs_on+0x7a/0x110 [ 276.334878][T12373] ? __dev_queue_xmit+0x2b6/0x3950 [ 276.334895][T12373] ? __local_bh_enable_ip+0xd0/0x130 [ 276.334911][T12373] ? __dev_queue_xmit+0x2b6/0x3950 [ 276.334935][T12373] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 276.334975][T12373] ? __pfx_rtnl_newlink+0x10/0x10 [ 276.334997][T12373] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 276.335025][T12373] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 276.335047][T12373] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 276.335068][T12373] ? ref_tracker_free+0x693/0x840 [ 276.335094][T12373] ? __pfx_ref_tracker_free+0x10/0x10 [ 276.335115][T12373] ? __asan_memcpy+0x40/0x70 [ 276.335135][T12373] ? __skb_clone+0x63/0x7a0 [ 276.335169][T12373] netlink_rcv_skb+0x232/0x4b0 [ 276.335196][T12373] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 276.335220][T12373] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 276.335253][T12373] ? netlink_deliver_tap+0x2e/0x1b0 [ 276.335277][T12373] ? netlink_deliver_tap+0x2e/0x1b0 [ 276.335307][T12373] netlink_unicast+0x75c/0x8e0 [ 276.335339][T12373] netlink_sendmsg+0x813/0xb40 [ 276.335373][T12373] ? __pfx_netlink_sendmsg+0x10/0x10 [ 276.335400][T12373] ? aa_sock_msg_perm+0xf1/0x1b0 [ 276.335425][T12373] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 276.335451][T12373] ____sys_sendmsg+0x972/0x9f0 [ 276.335475][T12373] ? __might_fault+0xaf/0x130 [ 276.335503][T12373] ? __pfx_____sys_sendmsg+0x10/0x10 [ 276.335536][T12373] ? import_iovec+0x73/0xa0 [ 276.335565][T12373] ___sys_sendmsg+0x2a5/0x360 [ 276.335588][T12373] ? __lock_acquire+0x6b5/0x2cf0 [ 276.335611][T12373] ? __pfx____sys_sendmsg+0x10/0x10 [ 276.335667][T12373] ? __fget_files+0x2a/0x420 [ 276.335688][T12373] ? __fget_files+0x3a0/0x420 [ 276.335718][T12373] __x64_sys_sendmsg+0x1bd/0x2a0 [ 276.335747][T12373] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 276.335789][T12373] ? __pfx_ksys_write+0x10/0x10 [ 276.335822][T12373] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.335843][T12373] do_syscall_64+0x15f/0xf80 [ 276.335859][T12373] ? trace_irq_disable+0x3b/0x140 [ 276.335884][T12373] ? clear_bhb_loop+0x40/0x90 [ 276.335907][T12373] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.335925][T12373] RIP: 0033:0x7f085499cdd9 [ 276.335942][T12373] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 276.335957][T12373] RSP: 002b:00007f0855796028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 276.335976][T12373] RAX: ffffffffffffffda RBX: 00007f0854c15fa0 RCX: 00007f085499cdd9 [ 276.335989][T12373] RDX: 0000000000004000 RSI: 0000200000000000 RDI: 0000000000000003 [ 276.336001][T12373] RBP: 00007f0855796090 R08: 0000000000000000 R09: 0000000000000000 [ 276.336012][T12373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 276.336023][T12373] R13: 00007f0854c16038 R14: 00007f0854c15fa0 R15: 00007fffe2b0eb58 [ 276.336053][T12373] [ 276.766967][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 276.787895][T12379] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1875'. [ 276.797535][ T6227] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.149651][T12399] tipc: Started in network mode [ 277.154569][T12399] tipc: Node identity 080211, cluster identity 4711 [ 277.163436][T12399] tipc: Enabled bearer , priority 0 [ 277.199599][T12401] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 277.213979][T12399] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 277.224761][T12399] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 277.270130][T12399] tipc: Resetting bearer [ 277.615665][T12410] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1885'. [ 277.841744][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.980086][ T8974] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.988962][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 277.998179][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 278.263920][ T6225] tipc: Node number set to 134353152 [ 278.739752][T12441] ieee802154 phy1 wpan1: encryption failed: -22 [ 279.880996][T12472] netlink: 'syz.2.1903': attribute type 9 has an invalid length. [ 279.912376][T12472] netlink: 'syz.2.1903': attribute type 3 has an invalid length. [ 279.940969][T12472] netlink: 'syz.2.1903': attribute type 3 has an invalid length. [ 280.084681][T12474] 8021q: adding VLAN 0 to HW filter on device eth0 [ 280.113248][T12474] 8021q: adding VLAN 0 to HW filter on device eth1 [ 280.140203][T12474] 8021q: adding VLAN 0 to HW filter on device eth2 [ 280.162786][T12474] 8021q: adding VLAN 0 to HW filter on device eth3 [ 280.209373][T12474] 8021q: adding VLAN 0 to HW filter on device bond2 [ 280.234820][T12474] 8021q: adding VLAN 0 to HW filter on device bond3 [ 280.261087][T12474] tipc: Resetting bearer [ 280.279643][T12474] virt_wifi0: entered promiscuous mode [ 280.288810][T12474] virt_wifi0: entered allmulticast mode [ 280.310450][T12474] 8021q: adding VLAN 0 to HW filter on device bond4 [ 280.329493][ T6237] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 280.339842][T12474] 8021q: adding VLAN 0 to HW filter on device bond5 [ 280.349532][T12474] 8021q: adding VLAN 0 to HW filter on device bond6 [ 280.417504][ T137] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.427590][ T137] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.442729][ T137] tipc: Resetting bearer [ 280.457533][ T3389] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.468546][ T6234] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 280.476786][ T3389] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 280.527696][ T3389] bond1: (slave veth7): link status definitely up, 10000 Mbps full duplex [ 280.558223][ T3389] bond1: (slave veth7): making interface the new active one [ 280.596421][ T3389] bond1: active interface up! [ 280.791202][T12508] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1912'. [ 280.807581][T12512] FAULT_INJECTION: forcing a failure. [ 280.807581][T12512] name failslab, interval 1, probability 0, space 0, times 0 [ 280.835550][T12512] CPU: 1 UID: 0 PID: 12512 Comm: syz.2.1915 Not tainted syzkaller #0 PREEMPT(full) [ 280.835576][T12512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 280.835586][T12512] Call Trace: [ 280.835593][T12512] [ 280.835601][T12512] dump_stack_lvl+0xe8/0x150 [ 280.835628][T12512] should_fail_ex+0x412/0x560 [ 280.835657][T12512] should_failslab+0xa8/0x100 [ 280.835686][T12512] __kmalloc_noprof+0xe8/0x760 [ 280.835711][T12512] ? esp_init_state+0x764/0x1240 [ 280.835740][T12512] esp_init_state+0x764/0x1240 [ 280.835776][T12512] ? __pfx_esp_init_state+0x10/0x10 [ 280.835815][T12512] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 280.835841][T12512] ? xfrm_state_get_afinfo+0x2e/0x1b0 [ 280.835874][T12512] ? __xfrm_init_state+0x842/0x1460 [ 280.835898][T12512] __xfrm_init_state+0xac9/0x1460 [ 280.835917][T12512] ? __xfrm_init_state+0x842/0x1460 [ 280.835941][T12512] xfrm_init_state+0x18/0xa0 [ 280.835959][T12512] pfkey_add+0x1d34/0x2df0 [ 280.835996][T12512] ? __pfx_pfkey_add+0x10/0x10 [ 280.836028][T12512] pfkey_sendmsg+0xc56/0x1120 [ 280.836045][T12512] ? unwind_next_frame+0xa6/0x2550 [ 280.836082][T12512] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 280.836125][T12512] ? aa_sock_msg_perm+0xf1/0x1b0 [ 280.836150][T12512] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 280.836185][T12512] ____sys_sendmsg+0x972/0x9f0 [ 280.836211][T12512] ? __might_fault+0xaf/0x130 [ 280.836239][T12512] ? __pfx_____sys_sendmsg+0x10/0x10 [ 280.836273][T12512] ? import_iovec+0x73/0xa0 [ 280.836302][T12512] ___sys_sendmsg+0x2a5/0x360 [ 280.836326][T12512] ? __lock_acquire+0x6b5/0x2cf0 [ 280.836350][T12512] ? __pfx____sys_sendmsg+0x10/0x10 [ 280.836411][T12512] ? __fget_files+0x2a/0x420 [ 280.836435][T12512] ? __fget_files+0x3a0/0x420 [ 280.836467][T12512] __x64_sys_sendmsg+0x1bd/0x2a0 [ 280.836495][T12512] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 280.836529][T12512] ? __pfx_ksys_write+0x10/0x10 [ 280.836561][T12512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.836580][T12512] do_syscall_64+0x15f/0xf80 [ 280.836596][T12512] ? trace_irq_disable+0x3b/0x140 [ 280.836619][T12512] ? clear_bhb_loop+0x40/0x90 [ 280.836638][T12512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 280.836656][T12512] RIP: 0033:0x7f00bc19cdd9 [ 280.836673][T12512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 280.836686][T12512] RSP: 002b:00007f00bcfc1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 280.836704][T12512] RAX: ffffffffffffffda RBX: 00007f00bc415fa0 RCX: 00007f00bc19cdd9 [ 280.836716][T12512] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000003 [ 280.836727][T12512] RBP: 00007f00bcfc1090 R08: 0000000000000000 R09: 0000000000000000 [ 280.836739][T12512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 280.836749][T12512] R13: 00007f00bc416038 R14: 00007f00bc415fa0 R15: 00007ffd63e72ea8 [ 280.836777][T12512] [ 281.130132][ T6225] net_ratelimit: 7 callbacks suppressed [ 281.130149][ T6225] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 281.312225][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 282.149989][T12559] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1927'. [ 282.385423][ T6237] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 283.424088][ T6234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.139718][ T809] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.416254][T12601] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1938'. [ 284.438613][T12581] syzkaller1: entered promiscuous mode [ 284.444839][T12581] syzkaller1: entered allmulticast mode [ 284.487355][ T6234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 284.641262][T12609] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1940'. [ 284.674446][T12609] bond0: entered promiscuous mode [ 284.682207][T12609] bond0: left promiscuous mode [ 284.739576][T12607] syzkaller0: entered promiscuous mode [ 284.759217][T12607] syzkaller0: entered allmulticast mode [ 284.770514][T12607] 0: reclassify loop, rule prio 0, protocol 800 [ 285.478699][T12640] bond0: (slave vlan3): Opening slave failed [ 285.696911][T12645] netlink: 'syz.4.1954': attribute type 1 has an invalid length. [ 285.740184][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 285.804662][T12656] xt_TPROXY: Can be used only with -p tcp or -p udp [ 285.874346][T12645] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1954'. [ 285.896468][T12659] netlink: 'syz.0.1958': attribute type 7 has an invalid length. [ 285.906351][T12659] netlink: 'syz.0.1958': attribute type 8 has an invalid length. [ 285.930365][T12645] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1954'. [ 286.016686][T12668] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1959'. [ 286.042883][T12670] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1959'. [ 286.419642][T12686] netlink: 'syz.4.1964': attribute type 9 has an invalid length. [ 286.462111][T12686] netlink: 'syz.4.1964': attribute type 3 has an invalid length. [ 286.505020][T12686] netlink: 'syz.4.1964': attribute type 3 has an invalid length. [ 286.527127][T12693] FAULT_INJECTION: forcing a failure. [ 286.527127][T12693] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.550997][T12687] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1962'. [ 286.573611][T12695] netlink: 'syz.3.1965': attribute type 9 has an invalid length. [ 286.583223][T12693] CPU: 1 UID: 0 PID: 12693 Comm: syz.2.1966 Not tainted syzkaller #0 PREEMPT(full) [ 286.583249][T12693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 286.583260][T12693] Call Trace: [ 286.583267][T12693] [ 286.583274][T12693] dump_stack_lvl+0xe8/0x150 [ 286.583300][T12693] should_fail_ex+0x412/0x560 [ 286.583328][T12693] _copy_from_user+0x2d/0xb0 [ 286.583355][T12693] ___sys_recvmsg+0x175/0x590 [ 286.583379][T12693] ? __pfx____sys_recvmsg+0x10/0x10 [ 286.583401][T12693] ? __fget_files+0x2a/0x420 [ 286.583460][T12693] do_recvmmsg+0x334/0x800 [ 286.583486][T12693] ? __pfx_do_recvmmsg+0x10/0x10 [ 286.583516][T12693] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 286.583552][T12693] __x64_sys_recvmmsg+0x198/0x250 [ 286.583574][T12693] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 286.583601][T12693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.583620][T12693] do_syscall_64+0x15f/0xf80 [ 286.583637][T12693] ? trace_irq_disable+0x3b/0x140 [ 286.583663][T12693] ? clear_bhb_loop+0x40/0x90 [ 286.583686][T12693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.583703][T12693] RIP: 0033:0x7f00bc19cdd9 [ 286.583724][T12693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.583739][T12693] RSP: 002b:00007f00bcfc1028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 286.583758][T12693] RAX: ffffffffffffffda RBX: 00007f00bc415fa0 RCX: 00007f00bc19cdd9 [ 286.583771][T12693] RDX: 0000000000000581 RSI: 0000200000001000 RDI: 000000000000000a [ 286.583782][T12693] RBP: 00007f00bcfc1090 R08: 0000000000000000 R09: 0000000000000000 [ 286.583793][T12693] R10: 0000000040000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.583803][T12693] R13: 00007f00bc416038 R14: 00007f00bc415fa0 R15: 00007ffd63e72ea8 [ 286.583834][T12693] [ 286.773855][T12695] netlink: 'syz.3.1965': attribute type 3 has an invalid length. [ 286.801939][T12695] netlink: 'syz.3.1965': attribute type 3 has an invalid length. [ 287.065281][T12708] netlink: 'syz.2.1969': attribute type 29 has an invalid length. [ 287.107888][T12708] netlink: 500 bytes leftover after parsing attributes in process `syz.2.1969'. [ 287.159344][T12708] unsupported nla_type 58 [ 287.341833][T12719] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 287.724729][T12736] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 287.737230][T12735] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1976'. [ 287.826907][T12736] team0: entered promiscuous mode [ 287.858015][T12736] team_slave_0: entered promiscuous mode [ 287.880590][T12736] team_slave_1: entered promiscuous mode [ 287.900230][T12736] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 287.934062][T12744] FAULT_INJECTION: forcing a failure. [ 287.934062][T12744] name failslab, interval 1, probability 0, space 0, times 0 [ 287.971378][T12744] CPU: 0 UID: 0 PID: 12744 Comm: syz.4.1980 Not tainted syzkaller #0 PREEMPT(full) [ 287.971405][T12744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 287.971416][T12744] Call Trace: [ 287.971424][T12744] [ 287.971432][T12744] dump_stack_lvl+0xe8/0x150 [ 287.971458][T12744] should_fail_ex+0x412/0x560 [ 287.971487][T12744] should_failslab+0xa8/0x100 [ 287.971516][T12744] __kmalloc_cache_noprof+0x88/0x660 [ 287.971541][T12744] ? nft_trans_table_add+0x56/0x430 [ 287.971563][T12744] ? __asan_memset+0x22/0x50 [ 287.971587][T12744] nft_trans_table_add+0x56/0x430 [ 287.971616][T12744] nf_tables_newtable+0xce3/0x1910 [ 287.971657][T12744] nfnetlink_rcv+0x123e/0x27b0 [ 287.971716][T12744] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 287.971788][T12744] ? netlink_deliver_tap+0x2e/0x1b0 [ 287.971824][T12744] ? netlink_deliver_tap+0x2e/0x1b0 [ 287.971848][T12744] ? netlink_deliver_tap+0x2e/0x1b0 [ 287.971878][T12744] netlink_unicast+0x75c/0x8e0 [ 287.971918][T12744] netlink_sendmsg+0x813/0xb40 [ 287.971953][T12744] ? __pfx_netlink_sendmsg+0x10/0x10 [ 287.971981][T12744] ? aa_sock_msg_perm+0xf1/0x1b0 [ 287.972007][T12744] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 287.972038][T12744] ____sys_sendmsg+0x972/0x9f0 [ 287.972064][T12744] ? __might_fault+0xaf/0x130 [ 287.972093][T12744] ? __pfx_____sys_sendmsg+0x10/0x10 [ 287.972129][T12744] ? import_iovec+0x73/0xa0 [ 287.972157][T12744] ___sys_sendmsg+0x2a5/0x360 [ 287.972182][T12744] ? __lock_acquire+0x6b5/0x2cf0 [ 287.972207][T12744] ? __pfx____sys_sendmsg+0x10/0x10 [ 287.972271][T12744] ? __fget_files+0x2a/0x420 [ 287.972291][T12744] ? __fget_files+0x3a0/0x420 [ 287.972324][T12744] __x64_sys_sendmsg+0x1bd/0x2a0 [ 287.972353][T12744] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 287.972389][T12744] ? __pfx_ksys_write+0x10/0x10 [ 287.972423][T12744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.972443][T12744] do_syscall_64+0x15f/0xf80 [ 287.972460][T12744] ? trace_irq_disable+0x3b/0x140 [ 287.972486][T12744] ? clear_bhb_loop+0x40/0x90 [ 287.972509][T12744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 287.972527][T12744] RIP: 0033:0x7fa18b59cdd9 [ 287.972544][T12744] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 287.972559][T12744] RSP: 002b:00007fa18c42f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 287.972579][T12744] RAX: ffffffffffffffda RBX: 00007fa18b815fa0 RCX: 00007fa18b59cdd9 [ 287.972609][T12744] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 287.972620][T12744] RBP: 00007fa18c42f090 R08: 0000000000000000 R09: 0000000000000000 [ 287.972632][T12744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 287.972642][T12744] R13: 00007fa18b816038 R14: 00007fa18b815fa0 R15: 00007ffc19d97748 [ 287.972673][T12744] [ 288.757581][T12775] : entered promiscuous mode [ 291.275587][T12748] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 291.571763][T12791] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1995'. [ 291.599981][T12791] openvswitch: netlink: Invalid VLAN frame [ 291.821128][T12808] validate_nla: 3 callbacks suppressed [ 291.821145][T12808] netlink: 'syz.3.2003': attribute type 58 has an invalid length. [ 291.847583][T12802] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 291.886292][T12808] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2003'. [ 291.983517][T12816] openvswitch: netlink: IP tunnel dst address not specified [ 292.043369][T12818] IPVS: set_ctl: invalid protocol: 232 224.0.0.1:20004 [ 292.314041][T12825] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2006'. [ 292.617495][T12836] FAULT_INJECTION: forcing a failure. [ 292.617495][T12836] name failslab, interval 1, probability 0, space 0, times 0 [ 292.682060][T12836] CPU: 0 UID: 0 PID: 12836 Comm: syz.3.2008 Not tainted syzkaller #0 PREEMPT(full) [ 292.682086][T12836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 292.682096][T12836] Call Trace: [ 292.682103][T12836] [ 292.682110][T12836] dump_stack_lvl+0xe8/0x150 [ 292.682137][T12836] should_fail_ex+0x412/0x560 [ 292.682163][T12836] should_failslab+0xa8/0x100 [ 292.682191][T12836] __kvmalloc_node_noprof+0x178/0x8a0 [ 292.682216][T12836] ? __nf_hook_entries_try_shrink+0x328/0x700 [ 292.682242][T12836] __nf_hook_entries_try_shrink+0x328/0x700 [ 292.682271][T12836] __nf_unregister_net_hook+0x4cc/0x6f0 [ 292.682299][T12836] nf_unregister_net_hooks+0xcb/0x140 [ 292.682321][T12836] ip_vs_unregister_hooks+0xbc/0x120 [ 292.682347][T12836] ip_vs_unlink_service+0x628/0xfa0 [ 292.682388][T12836] ip_vs_flush+0x1d5/0x420 [ 292.682418][T12836] do_ip_vs_set_ctl+0x4fb/0xb00 [ 292.682442][T12836] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 292.682479][T12836] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 292.682501][T12836] ? nf_setsockopt+0x3a/0x290 [ 292.682533][T12836] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 292.682556][T12836] ? __pfx_aa_sk_perm+0x10/0x10 [ 292.682586][T12836] nf_setsockopt+0x26f/0x290 [ 292.682607][T12836] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 292.682633][T12836] do_sock_setsockopt+0x17c/0x1b0 [ 292.682663][T12836] __x64_sys_setsockopt+0x13d/0x1b0 [ 292.682691][T12836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.682710][T12836] do_syscall_64+0x15f/0xf80 [ 292.682726][T12836] ? trace_irq_disable+0x3b/0x140 [ 292.682752][T12836] ? clear_bhb_loop+0x40/0x90 [ 292.682774][T12836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.682790][T12836] RIP: 0033:0x7f085499cdd9 [ 292.682807][T12836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.682822][T12836] RSP: 002b:00007f0855796028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 292.682842][T12836] RAX: ffffffffffffffda RBX: 00007f0854c15fa0 RCX: 00007f085499cdd9 [ 292.682855][T12836] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000006 [ 292.682865][T12836] RBP: 00007f0855796090 R08: 0000000000000000 R09: 0000000000000000 [ 292.682876][T12836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.682885][T12836] R13: 00007f0854c16038 R14: 00007f0854c15fa0 R15: 00007fffe2b0eb58 [ 292.682912][T12836] [ 293.255169][T12843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2010'. [ 293.510233][T12857] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 293.677520][T12867] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2022'. [ 293.791403][T12874] netlink: 'syz.0.2025': attribute type 11 has an invalid length. [ 293.810457][T12874] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2025'. [ 293.971121][T12881] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2028'. [ 294.159268][T12894] netlink: 'syz.1.2034': attribute type 10 has an invalid length. [ 294.179004][T12894] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2034'. [ 294.200011][T12894] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2034'. [ 294.323403][T12902] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2039'. [ 295.095284][T12897] dvmrp1: entered allmulticast mode [ 295.735459][ T13] dvmrp1: left allmulticast mode [ 295.940829][T12983] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 296.886902][T13002] __nla_validate_parse: 1 callbacks suppressed [ 296.886918][T13002] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2079'. [ 297.167748][T13017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2086'. [ 297.466640][T13030] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2089'. [ 297.655703][T13040] IPVS: sync thread started: state = MASTER, mcast_ifn = macsec0, syncid = 3, id = 0 [ 297.741859][T13047] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2096'. [ 297.758229][T13044] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 297.789523][T13047] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2096'. [ 297.890748][ T756] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 297.902352][T13047] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2096'. [ 297.917211][ T756] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 297.928365][T13047] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2096'. [ 297.937963][ T756] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 297.956069][ T756] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 298.475452][T13079] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2112'. [ 300.710470][T13109] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 300.746790][T13111] tipc: Resetting bearer [ 300.756056][T13115] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 300.760620][T13114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2125'. [ 300.765637][T13115] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 300.810355][ C1] vcan0: j1939_session_tx_dat: 0xffff888058ff1800: queue data error: -100 [ 300.854165][T13111] tipc: Enabling of bearer rejected, already enabled [ 301.321940][T13133] syzkaller0: entered promiscuous mode [ 301.338143][T13133] syzkaller0: entered allmulticast mode [ 301.407968][T13133] tipc: Enabled bearer , priority 0 [ 301.435311][T13130] tipc: Resetting bearer [ 301.518830][T13130] tipc: Disabling bearer [ 302.206821][T13171] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2152'. [ 302.243407][T13172] tipc: Enabled bearer , priority 0 [ 302.262824][T13172] syzkaller0: entered promiscuous mode [ 302.285459][T13172] syzkaller0: entered allmulticast mode [ 302.344992][T13172] tipc: Resetting bearer [ 302.357785][T13170] tipc: Resetting bearer [ 302.409920][T13170] tipc: Disabling bearer [ 302.570100][T13181] tipc: Enabled bearer , priority 0 [ 302.577684][T13181] syzkaller0: entered promiscuous mode [ 302.583972][T13181] syzkaller0: entered allmulticast mode [ 302.636342][T13181] tipc: Resetting bearer [ 302.658014][T13180] tipc: Resetting bearer [ 302.696613][T13180] tipc: Disabling bearer [ 302.855098][T13191] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2161'. [ 302.923520][T13193] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2162'. [ 303.155056][T13211] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2166'. [ 303.330996][T13219] netlink: 'syz.4.2174': attribute type 5 has an invalid length. [ 303.452151][T13222] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2175'. [ 303.804112][T13249] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2184'. [ 304.366059][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b0b6400: rx timeout, send abort [ 304.439225][T13279] syzkaller1: entered promiscuous mode [ 304.445277][T13279] syzkaller1: entered allmulticast mode [ 304.866178][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b0b5c00: rx timeout, send abort [ 304.874548][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b0b6400: abort rx timeout. Force session deactivation [ 305.374462][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802b0b5c00: abort rx timeout. Force session deactivation [ 305.413297][T13307] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2208'. [ 305.423359][T13308] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2210'. [ 305.459856][T13308] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2210'. [ 305.787115][T13319] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2214'. [ 305.810402][T13321] netlink: 'syz.3.2218': attribute type 3 has an invalid length. [ 306.736621][T13375] netlink: 'syz.2.2234': attribute type 1 has an invalid length. [ 307.352231][T13408] __nla_validate_parse: 4 callbacks suppressed [ 307.352251][T13408] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2251'. [ 307.658865][T13424] netlink: 'syz.0.2256': attribute type 1 has an invalid length. [ 307.781401][T13424] 8021q: adding VLAN 0 to HW filter on device bond6 [ 307.853721][T13431] syzkaller0: entered promiscuous mode [ 307.886961][T13431] syzkaller0: entered allmulticast mode [ 308.042405][T13439] netlink: 'syz.0.2260': attribute type 5 has an invalid length. [ 308.438815][T13456] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2265'. [ 309.062853][T13487] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2278'. [ 309.404628][T13500] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2287'. [ 309.437809][T13500] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2287'. [ 309.461607][T13500] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 309.822643][T13515] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2294'. [ 310.223825][T13529] ipvlan2: entered promiscuous mode [ 310.311546][T13533] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2302'. [ 310.348563][T13533] openvswitch: netlink: Actions may not be safe on all matching packets [ 310.681705][T13545] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2308'. [ 311.378911][T13577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2321'. [ 311.392902][T13579] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2322'. [ 312.144133][T13615] team0: Port device dummy0 removed [ 312.194798][T13615] bond0: (slave bond_slave_0): Releasing backup interface [ 312.247078][T13615] bond0: (slave bond_slave_1): Releasing backup interface [ 312.278760][T13615] team0: Port device team_slave_0 removed [ 312.304566][T13630] netlink: 'syz.4.2336': attribute type 2 has an invalid length. [ 312.345155][T13615] team0: Port device team_slave_1 removed [ 312.370263][T13615] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 312.398331][T13615] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 312.444310][T13621] team0: Mode changed to "broadcast" [ 312.484896][T13626] syzkaller0: entered promiscuous mode [ 312.509883][T13626] syzkaller0: entered allmulticast mode [ 313.118293][T13661] __nla_validate_parse: 4 callbacks suppressed [ 313.118311][T13661] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2350'. [ 313.547692][T13676] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2357'. [ 313.990536][T13693] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2364'. [ 314.119652][T13695] tipc: Enabled bearer , priority 0 [ 314.142767][T13695] syzkaller0: entered promiscuous mode [ 314.167192][T13695] syzkaller0: entered allmulticast mode [ 314.276736][T13705] tipc: Resetting bearer [ 314.316400][T13694] tipc: Resetting bearer [ 314.404312][T13694] tipc: Disabling bearer [ 314.438135][T13699] "syz.4.2367" (13699) uses obsolete ecb(arc4) skcipher [ 314.887421][T13734] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2377'. [ 315.333767][ C0] vcan0: j1939_tp_rxtimer: 0xffff888058e92000: rx timeout, send abort [ 315.833894][ C0] vcan0: j1939_tp_rxtimer: 0xffff888058e92400: rx timeout, send abort [ 315.842218][ C0] vcan0: j1939_tp_rxtimer: 0xffff888058e92000: abort rx timeout. Force session deactivation [ 315.902650][T13771] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2391'. [ 315.977498][T13775] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2393'. [ 316.118772][T13781] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2396'. [ 316.342191][ C0] vcan0: j1939_tp_rxtimer: 0xffff888058e92400: abort rx timeout. Force session deactivation [ 316.544017][T13799] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2400'. [ 316.768774][T13813] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2405'. [ 316.979335][T13822] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2408'. [ 317.009415][T13822] netlink: 'syz.3.2408': attribute type 15 has an invalid length. [ 317.028470][T13822] netlink: 'syz.3.2408': attribute type 25 has an invalid length. [ 317.101994][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 317.103998][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.367196][T13839] syzkaller0: entered promiscuous mode [ 317.391171][T13839] syzkaller0: entered allmulticast mode [ 318.668217][T13912] __nla_validate_parse: 3 callbacks suppressed [ 318.668235][T13912] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2439'. [ 318.720106][T13911] syzkaller0: entered promiscuous mode [ 318.728930][T13911] syzkaller0: entered allmulticast mode [ 318.887254][T13911] tipc: Enabled bearer , priority 0 [ 318.998219][T13910] tipc: Resetting bearer [ 319.065400][T13910] tipc: Disabling bearer [ 319.110573][T13931] tipc: Enabling of bearer rejected, already enabled [ 319.155507][T13931] tipc: Resetting bearer [ 319.504282][T13942] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 319.715478][ T29] audit: type=1804 audit(1778446485.107:58): pid=13958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.2453" name="/newroot/487/cgroup.controllers" dev="tmpfs" ino=2518 res=1 errno=0 [ 319.795357][T13961] tipc: Resetting bearer [ 319.796495][ T29] audit: type=1800 audit(1778446485.107:59): pid=13958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2453" name="cgroup.controllers" dev="tmpfs" ino=2518 res=0 errno=0 [ 319.823367][T13964] syzkaller0: entered promiscuous mode [ 319.847018][T13964] syzkaller0: entered allmulticast mode [ 319.945511][T13961] IPVS: sh: FWM 3 0x00000003 - no destination available [ 319.982436][T13961] IPVS: sh: FWM 3 0x00000003 - no destination available [ 320.644184][T13998] netlink: 644 bytes leftover after parsing attributes in process `syz.0.2467'. [ 320.706110][T14001] tipc: Enabled bearer , priority 0 [ 320.718846][T13996] syzkaller0: entered promiscuous mode [ 320.725119][T13996] syzkaller0: entered allmulticast mode [ 320.756403][T13996] tipc: Resetting bearer [ 320.769250][T14007] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2468'. [ 320.837649][T13995] tipc: Resetting bearer [ 320.904008][T13995] tipc: Disabling bearer [ 321.168889][T14015] tipc: Resetting bearer [ 321.198766][T14015] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 321.221274][ T6225] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 321.261203][T14025] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2473'. [ 321.318543][T14027] syzkaller0: entered promiscuous mode [ 321.334084][T14027] syzkaller0: entered allmulticast mode [ 321.360373][ T6225] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 321.431372][T14032] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2477'. [ 321.505377][T14034] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2478'. [ 321.566917][T14034] ip6gre1: entered promiscuous mode [ 321.584992][T14034] ip6gre1: entered allmulticast mode [ 321.636237][T14037] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2479'. [ 321.641224][T14041] netlink: 'syz.4.2481': attribute type 19 has an invalid length. [ 321.653818][T14041] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2481'. [ 321.680389][T14041] netlink: 'syz.4.2481': attribute type 19 has an invalid length. [ 321.696219][T14041] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2481'. [ 321.841404][T14051] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2483'. [ 322.907157][T14085] netlink: 'syz.4.2496': attribute type 3 has an invalid length. [ 323.268888][T14099] syzkaller0: entered promiscuous mode [ 323.295049][T14099] syzkaller0: entered allmulticast mode [ 323.922612][T14129] __nla_validate_parse: 4 callbacks suppressed [ 323.922630][T14129] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2514'. [ 325.041579][T14169] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2528'. [ 327.381309][T14142] syzkaller0: entered promiscuous mode [ 327.388105][T14142] syzkaller0: entered allmulticast mode [ 327.710824][T14178] af_packet: tpacket_rcv: packet too big, clamped from 1 to 4294967272. macoff=96 [ 328.307455][T14207] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2542'. [ 328.394580][T14191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2538'. [ 328.706443][T14219] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2546'. [ 328.722477][T14216] syzkaller0: entered promiscuous mode [ 328.755083][T14216] syzkaller0: entered allmulticast mode [ 329.528311][T14258] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2558'. [ 329.721294][T14269] netlink: 120 bytes leftover after parsing attributes in process `syz.4.2561'. [ 329.794521][T14274] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 329.798993][T14276] FAULT_INJECTION: forcing a failure. [ 329.798993][T14276] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 329.823144][T14274] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 329.846097][T14276] CPU: 1 UID: 0 PID: 14276 Comm: syz.0.2563 Not tainted syzkaller #0 PREEMPT(full) [ 329.846119][T14276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 329.846145][T14276] Call Trace: [ 329.846152][T14276] [ 329.846160][T14276] dump_stack_lvl+0xe8/0x150 [ 329.846185][T14276] should_fail_ex+0x412/0x560 [ 329.846214][T14276] _copy_from_user+0x2d/0xb0 [ 329.846241][T14276] __sys_sendto+0x2b0/0x710 [ 329.846269][T14276] ? __pfx___sys_sendto+0x10/0x10 [ 329.846290][T14276] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 329.846321][T14276] ? __fget_files+0x3a0/0x420 [ 329.846353][T14276] ? ksys_write+0x242/0x270 [ 329.846380][T14276] ? __pfx_ksys_write+0x10/0x10 [ 329.846408][T14276] __x64_sys_sendto+0xde/0x100 [ 329.846439][T14276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.846459][T14276] do_syscall_64+0x15f/0xf80 [ 329.846474][T14276] ? trace_irq_disable+0x3b/0x140 [ 329.846500][T14276] ? clear_bhb_loop+0x40/0x90 [ 329.846521][T14276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.846536][T14276] RIP: 0033:0x7f5bd0f9cdd9 [ 329.846553][T14276] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.846567][T14276] RSP: 002b:00007f5bd1da2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 329.846586][T14276] RAX: ffffffffffffffda RBX: 00007f5bd1215fa0 RCX: 00007f5bd0f9cdd9 [ 329.846600][T14276] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 329.846610][T14276] RBP: 00007f5bd1da2090 R08: 0000200000000040 R09: 000000000000001c [ 329.846622][T14276] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 329.846636][T14276] R13: 00007f5bd1216038 R14: 00007f5bd1215fa0 R15: 00007ffd46389098 [ 329.846665][T14276] [ 330.163540][T14278] bond0: entered promiscuous mode [ 330.176899][T14278] batadv0: entered promiscuous mode [ 330.249275][T14278] debugfs: 'hsr1' already exists in 'hsr' [ 330.287121][T14278] Cannot create hsr debugfs directory [ 330.294628][T14290] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2568'. [ 330.298074][T14278] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 330.317392][T14278] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 330.331009][T14278] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 330.340935][T14278] bond0: left promiscuous mode [ 330.391754][T14278] batadv0: left promiscuous mode [ 330.869347][T14314] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2577'. [ 331.160883][T14317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 331.182057][T14317] 8021q: adding VLAN 0 to HW filter on device team0 [ 331.226927][T14317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 331.401137][T14317] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 331.414074][T14317] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 331.431809][T14317] veth1_vlan: left promiscuous mode [ 331.440962][T14317] veth0_vlan: left promiscuous mode [ 331.460248][T14317] veth0_vlan: entered promiscuous mode [ 331.474672][T14317] veth1_vlan: entered promiscuous mode [ 331.494889][T14317] veth1_macvtap: left promiscuous mode [ 331.508134][T14317] veth0_macvtap: left promiscuous mode [ 331.515784][T14317] veth0_macvtap: entered promiscuous mode [ 331.522997][T14317] veth1_macvtap: entered promiscuous mode [ 331.528942][T14317] macsec0: left promiscuous mode [ 331.541350][T14317] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 331.549802][T14317] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 331.557902][T14317] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 331.566413][T14317] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 331.598405][T14317] 8021q: adding VLAN 0 to HW filter on device bond1 [ 331.608230][T14317] 8021q: adding VLAN 0 to HW filter on device bond2 [ 331.617920][T14317] bond3: left promiscuous mode [ 331.623261][T14317] 8021q: adding VLAN 0 to HW filter on device bond3 [ 331.631488][T14317] ipip0: left promiscuous mode [ 331.639469][T14317] bond4: left promiscuous mode [ 331.644283][T14317] bridge0: left promiscuous mode [ 331.650362][T14317] 8021q: adding VLAN 0 to HW filter on device bond4 [ 331.660970][T14317] 8021q: adding VLAN 0 to HW filter on device bond5 [ 331.669721][T14317] vlan2: left promiscuous mode [ 331.674521][T14317] bond5: left promiscuous mode [ 331.681659][T14317] bridge1: left promiscuous mode [ 331.691510][T14317] 8021q: adding VLAN 0 to HW filter on device bond6 [ 331.698912][T14317] ipip1: left promiscuous mode [ 331.711896][T14317] 8021q: adding VLAN 0 to HW filter on device bond7 [ 331.724262][T14317] 8021q: adding VLAN 0 to HW filter on device bond8 [ 331.812524][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.826849][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.840680][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.884812][T14330] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 331.980142][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.308670][T14363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2589'. [ 333.058623][T14390] netlink: 'syz.4.2598': attribute type 4 has an invalid length. [ 333.292827][T14405] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2604'. [ 333.307204][T14360] netlink: 'syz.1.2588': attribute type 4 has an invalid length. [ 333.319768][T14360] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2588'. [ 333.817857][T14428] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2606'. [ 333.904898][T14430] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2609'. [ 333.958749][T14432] netlink: 6032 bytes leftover after parsing attributes in process `syz.2.2609'. [ 334.123306][T14440] netlink: ct family unspecified [ 337.407888][T14453] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 337.605608][T14493] __nla_validate_parse: 1 callbacks suppressed [ 337.605627][T14493] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2623'. [ 337.636894][T14491] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2626'. [ 337.690803][T14495] syzkaller0: entered promiscuous mode [ 337.707812][T14495] syzkaller0: entered allmulticast mode [ 337.762315][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.770267][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.776653][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.783051][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.789406][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.795741][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.802128][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.808468][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.814876][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.821250][T14491] tc action pedit 'at' offset 8666 out of bounds [ 337.827619][T14491] TC_ACT_REPEAT abuse ? [ 338.019992][T14517] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2633'. [ 338.211491][T14529] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2637'. [ 338.272307][T14531] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2638'. [ 338.491103][T14541] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2642'. [ 338.526764][T14541] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2642'. [ 338.689933][T14541] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2642'. [ 338.719201][T14541] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2642'. [ 338.721035][T14554] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2646'. [ 338.876185][T14558] syzkaller0: entered promiscuous mode [ 338.890322][T14558] syzkaller0: entered allmulticast mode [ 339.066645][T14565] netlink: 'syz.0.2650': attribute type 9 has an invalid length. [ 339.096074][T14565] netlink: 'syz.0.2650': attribute type 3 has an invalid length. [ 339.129451][T14565] netlink: 'syz.0.2650': attribute type 3 has an invalid length. [ 339.185144][T14573] netlink: 'syz.3.2651': attribute type 9 has an invalid length. [ 339.265727][T14573] netlink: 'syz.3.2651': attribute type 3 has an invalid length. [ 339.297401][T14573] netlink: 'syz.3.2651': attribute type 3 has an invalid length. [ 339.770360][T14592] block nbd4: not configured, cannot reconfigure [ 340.012286][T14598] tipc: Enabled bearer , priority 0 [ 340.021029][T14598] syzkaller0: entered promiscuous mode [ 340.026543][T14598] syzkaller0: entered allmulticast mode [ 340.135548][T14597] tipc: Resetting bearer [ 340.177644][T14597] tipc: Disabling bearer [ 340.664610][T14610] syzkaller0: entered promiscuous mode [ 340.695101][T14610] syzkaller0: entered allmulticast mode [ 341.159970][T14643] netlink: 'syz.3.2676': attribute type 9 has an invalid length. [ 341.177065][T14643] netlink: 'syz.3.2676': attribute type 3 has an invalid length. [ 341.203808][T14643] netlink: 'syz.3.2676': attribute type 3 has an invalid length. [ 341.276009][T14650] tipc: Enabled bearer , priority 0 [ 341.298164][T14650] syzkaller0: entered promiscuous mode [ 341.317234][T14650] syzkaller0: entered allmulticast mode [ 341.450561][T14646] tipc: Resetting bearer [ 341.530745][T14646] tipc: Disabling bearer [ 341.596586][T14661] netlink: 'syz.4.2683': attribute type 6 has an invalid length. [ 341.901886][T14682] syzkaller1: entered allmulticast mode [ 341.929978][T14681] syzkaller0: entered promiscuous mode [ 341.939744][T14681] syzkaller0: entered allmulticast mode [ 342.900266][T14702] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 343.008820][T14709] __nla_validate_parse: 2 callbacks suppressed [ 343.008833][T14709] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2697'. [ 343.030304][T14709] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2697'. [ 343.040995][T14709] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2697'. [ 343.049974][T14709] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2697'. [ 343.183785][T14714] syzkaller0: entered promiscuous mode [ 343.190220][T14714] syzkaller0: entered allmulticast mode [ 344.595552][T14665] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 344.830177][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2705'. [ 344.843088][T14736] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2705'. [ 344.868452][T14736] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2705'. [ 344.880852][T14736] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2705'. [ 344.885109][T14738] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 345.066928][T14750] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2711'. [ 345.126019][T14752] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2710'. [ 345.459786][T14764] xt_TPROXY: Can be used only with -p tcp or -p udp [ 346.248246][T14786] bond0: entered promiscuous mode [ 346.255745][T14786] batadv0: entered promiscuous mode [ 346.275910][T14786] debugfs: 'hsr1' already exists in 'hsr' [ 346.305337][T14786] Cannot create hsr debugfs directory [ 346.325972][T14786] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 346.342141][T14786] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 346.357589][T14785] syzkaller0: entered promiscuous mode [ 346.377331][T14785] syzkaller0: entered allmulticast mode [ 346.703095][T14803] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 346.896246][T14819] FAULT_INJECTION: forcing a failure. [ 346.896246][T14819] name failslab, interval 1, probability 0, space 0, times 0 [ 346.909281][T14819] CPU: 0 UID: 0 PID: 14819 Comm: syz.1.2740 Not tainted syzkaller #0 PREEMPT(full) [ 346.909307][T14819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 346.909319][T14819] Call Trace: [ 346.909332][T14819] [ 346.909340][T14819] dump_stack_lvl+0xe8/0x150 [ 346.909367][T14819] should_fail_ex+0x412/0x560 [ 346.909396][T14819] should_failslab+0xa8/0x100 [ 346.909424][T14819] __kmalloc_cache_noprof+0x88/0x660 [ 346.909451][T14819] ? nfnetlink_rcv+0xfdf/0x27b0 [ 346.909480][T14819] nfnetlink_rcv+0xfdf/0x27b0 [ 346.909537][T14819] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 346.909577][T14819] ? ref_tracker_free+0x693/0x840 [ 346.909630][T14819] ? __netlink_deliver_tap+0x807/0x850 [ 346.909665][T14819] ? netlink_deliver_tap+0x2e/0x1b0 [ 346.909688][T14819] ? netlink_deliver_tap+0x2e/0x1b0 [ 346.909718][T14819] netlink_unicast+0x75c/0x8e0 [ 346.909753][T14819] netlink_sendmsg+0x813/0xb40 [ 346.909788][T14819] ? __pfx_netlink_sendmsg+0x10/0x10 [ 346.909817][T14819] ? aa_sock_msg_perm+0xf1/0x1b0 [ 346.909842][T14819] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 346.909870][T14819] ____sys_sendmsg+0x972/0x9f0 [ 346.909897][T14819] ? __might_fault+0xaf/0x130 [ 346.909924][T14819] ? __pfx_____sys_sendmsg+0x10/0x10 [ 346.909956][T14819] ? import_iovec+0x73/0xa0 [ 346.909984][T14819] ___sys_sendmsg+0x2a5/0x360 [ 346.910007][T14819] ? __lock_acquire+0x6b5/0x2cf0 [ 346.910030][T14819] ? __pfx____sys_sendmsg+0x10/0x10 [ 346.910088][T14819] ? __fget_files+0x2a/0x420 [ 346.910108][T14819] ? __fget_files+0x3a0/0x420 [ 346.910136][T14819] __x64_sys_sendmsg+0x1bd/0x2a0 [ 346.910164][T14819] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 346.910199][T14819] ? __pfx_ksys_write+0x10/0x10 [ 346.910232][T14819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.910251][T14819] do_syscall_64+0x15f/0xf80 [ 346.910268][T14819] ? trace_irq_disable+0x3b/0x140 [ 346.910297][T14819] ? clear_bhb_loop+0x40/0x90 [ 346.910319][T14819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.910343][T14819] RIP: 0033:0x7f243359cdd9 [ 346.910360][T14819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.910375][T14819] RSP: 002b:00007f24343d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 346.910394][T14819] RAX: ffffffffffffffda RBX: 00007f2433815fa0 RCX: 00007f243359cdd9 [ 346.910407][T14819] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 346.910419][T14819] RBP: 00007f24343d6090 R08: 0000000000000000 R09: 0000000000000000 [ 346.910429][T14819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 346.910440][T14819] R13: 00007f2433816038 R14: 00007f2433815fa0 R15: 00007ffd7986a6d8 [ 346.910471][T14819] [ 347.271494][T14823] validate_nla: 4 callbacks suppressed [ 347.271511][T14823] netlink: 'syz.4.2741': attribute type 1 has an invalid length. [ 347.395351][T14823] 8021q: adding VLAN 0 to HW filter on device bond9 [ 347.474109][T14821] netdevsim netdevsim3: Firmware load for './file0/../file0' refused, path contains '..' component [ 347.514955][T14821] netdevsim netdevsim3 netdevsim0: left allmulticast mode [ 347.553167][T14821] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 347.656925][T14843] netlink: 'syz.4.2749': attribute type 1 has an invalid length. [ 347.960663][T14864] FAULT_INJECTION: forcing a failure. [ 347.960663][T14864] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 348.007840][T14864] CPU: 0 UID: 0 PID: 14864 Comm: syz.0.2755 Not tainted syzkaller #0 PREEMPT(full) [ 348.007866][T14864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 348.007877][T14864] Call Trace: [ 348.007884][T14864] [ 348.007892][T14864] dump_stack_lvl+0xe8/0x150 [ 348.007918][T14864] should_fail_ex+0x412/0x560 [ 348.007968][T14864] _copy_from_user+0x2d/0xb0 [ 348.008001][T14864] bpf_prog_test_run_xdp+0xde3/0x1160 [ 348.008041][T14864] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 348.008071][T14864] ? __fget_files+0x2a/0x420 [ 348.008098][T14864] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 348.008124][T14864] bpf_prog_test_run+0x2c7/0x340 [ 348.008146][T14864] __sys_bpf+0x643/0x950 [ 348.008174][T14864] ? __pfx___sys_bpf+0x10/0x10 [ 348.008215][T14864] ? ksys_write+0x242/0x270 [ 348.008241][T14864] ? __pfx_ksys_write+0x10/0x10 [ 348.008269][T14864] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.008289][T14864] __x64_sys_bpf+0x7c/0x90 [ 348.008314][T14864] do_syscall_64+0x15f/0xf80 [ 348.008331][T14864] ? trace_irq_disable+0x3b/0x140 [ 348.008356][T14864] ? clear_bhb_loop+0x40/0x90 [ 348.008379][T14864] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.008397][T14864] RIP: 0033:0x7f5bd0f9cdd9 [ 348.008414][T14864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.008429][T14864] RSP: 002b:00007f5bd1da2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 348.008447][T14864] RAX: ffffffffffffffda RBX: 00007f5bd1215fa0 RCX: 00007f5bd0f9cdd9 [ 348.008460][T14864] RDX: 0000000000000050 RSI: 0000200000000000 RDI: 000000000000000a [ 348.008471][T14864] RBP: 00007f5bd1da2090 R08: 0000000000000000 R09: 0000000000000000 [ 348.008481][T14864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 348.008492][T14864] R13: 00007f5bd1216038 R14: 00007f5bd1215fa0 R15: 00007ffd46389098 [ 348.008522][T14864] [ 348.373483][T14885] FAULT_INJECTION: forcing a failure. [ 348.373483][T14885] name failslab, interval 1, probability 0, space 0, times 0 [ 348.388768][T14885] CPU: 0 UID: 0 PID: 14885 Comm: syz.4.2762 Not tainted syzkaller #0 PREEMPT(full) [ 348.388793][T14885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 348.388804][T14885] Call Trace: [ 348.388812][T14885] [ 348.388820][T14885] dump_stack_lvl+0xe8/0x150 [ 348.388847][T14885] should_fail_ex+0x412/0x560 [ 348.388876][T14885] should_failslab+0xa8/0x100 [ 348.388905][T14885] __kvmalloc_node_noprof+0x178/0x8a0 [ 348.388960][T14885] ? __nf_hook_entries_try_shrink+0x328/0x700 [ 348.388988][T14885] __nf_hook_entries_try_shrink+0x328/0x700 [ 348.389018][T14885] __nf_unregister_net_hook+0x4cc/0x6f0 [ 348.389048][T14885] nf_unregister_net_hooks+0xcb/0x140 [ 348.389067][T14885] ip_vs_unregister_hooks+0xbc/0x120 [ 348.389091][T14885] ip_vs_unlink_service+0x628/0xfa0 [ 348.389129][T14885] ip_vs_flush+0x1d5/0x420 [ 348.389158][T14885] do_ip_vs_set_ctl+0x4fb/0xb00 [ 348.389181][T14885] ? __pfx_do_ip_vs_set_ctl+0x10/0x10 [ 348.389217][T14885] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 348.389234][T14885] ? nf_setsockopt+0x3a/0x290 [ 348.389259][T14885] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 348.389282][T14885] ? __pfx_aa_sk_perm+0x10/0x10 [ 348.389310][T14885] nf_setsockopt+0x26f/0x290 [ 348.389330][T14885] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 348.389354][T14885] do_sock_setsockopt+0x17c/0x1b0 [ 348.389384][T14885] __x64_sys_setsockopt+0x13d/0x1b0 [ 348.389412][T14885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.389430][T14885] do_syscall_64+0x15f/0xf80 [ 348.389445][T14885] ? trace_irq_disable+0x3b/0x140 [ 348.389469][T14885] ? clear_bhb_loop+0x40/0x90 [ 348.389492][T14885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.389508][T14885] RIP: 0033:0x7fa18b59cdd9 [ 348.389525][T14885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 348.389541][T14885] RSP: 002b:00007fa18c42f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 348.389560][T14885] RAX: ffffffffffffffda RBX: 00007fa18b815fa0 RCX: 00007fa18b59cdd9 [ 348.389573][T14885] RDX: 0000000000000485 RSI: 0000000000000000 RDI: 0000000000000006 [ 348.389584][T14885] RBP: 00007fa18c42f090 R08: 0000000000000000 R09: 0000000000000000 [ 348.389595][T14885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 348.389606][T14885] R13: 00007fa18b816038 R14: 00007fa18b815fa0 R15: 00007ffc19d97748 [ 348.389636][T14885] [ 348.655230][T14888] __nla_validate_parse: 13 callbacks suppressed [ 348.655249][T14888] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2763'. [ 348.959992][T14899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2767'. [ 349.026458][T14903] syzkaller0: entered promiscuous mode [ 349.044355][T14903] syzkaller0: entered allmulticast mode [ 349.059772][T14904] netlink: 'syz.0.2769': attribute type 1 has an invalid length. [ 349.115475][T14908] FAULT_INJECTION: forcing a failure. [ 349.115475][T14908] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 349.160683][T14908] CPU: 0 UID: 0 PID: 14908 Comm: syz.3.2770 Not tainted syzkaller #0 PREEMPT(full) [ 349.160709][T14908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 349.160720][T14908] Call Trace: [ 349.160727][T14908] [ 349.160734][T14908] dump_stack_lvl+0xe8/0x150 [ 349.160760][T14908] should_fail_ex+0x412/0x560 [ 349.160791][T14908] _copy_to_user+0x31/0xb0 [ 349.160818][T14908] simple_read_from_buffer+0xe1/0x170 [ 349.160851][T14908] proc_fail_nth_read+0x1bb/0x230 [ 349.160876][T14908] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 349.160901][T14908] ? rw_verify_area+0x2a6/0x4d0 [ 349.160924][T14908] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 349.160948][T14908] vfs_read+0x20c/0xa70 [ 349.160971][T14908] ? __pfx_aa_sk_perm+0x10/0x10 [ 349.160998][T14908] ? __pfx_vfs_read+0x10/0x10 [ 349.161022][T14908] ? x25_bind+0xce/0x450 [ 349.161047][T14908] ? __sys_bind+0x306/0x410 [ 349.161071][T14908] ? __pfx___sys_bind+0x10/0x10 [ 349.161098][T14908] ksys_read+0x150/0x270 [ 349.161124][T14908] ? __pfx_ksys_read+0x10/0x10 [ 349.161155][T14908] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.161175][T14908] do_syscall_64+0x15f/0xf80 [ 349.161192][T14908] ? trace_irq_disable+0x3b/0x140 [ 349.161217][T14908] ? clear_bhb_loop+0x40/0x90 [ 349.161239][T14908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 349.161256][T14908] RIP: 0033:0x7f085495d60e [ 349.161273][T14908] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 349.161287][T14908] RSP: 002b:00007f0855795fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 349.161305][T14908] RAX: ffffffffffffffda RBX: 00007f08557966c0 RCX: 00007f085495d60e [ 349.161317][T14908] RDX: 000000000000000f RSI: 00007f08557960a0 RDI: 0000000000000003 [ 349.161327][T14908] RBP: 00007f0855796090 R08: 0000000000000000 R09: 0000000000000000 [ 349.161337][T14908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.161347][T14908] R13: 00007f0854c16038 R14: 00007f0854c15fa0 R15: 00007fffe2b0eb58 [ 349.161376][T14908] [ 349.511206][T14914] netlink: 'syz.1.2771': attribute type 1 has an invalid length. [ 349.521167][T14914] netlink: 'syz.1.2771': attribute type 2 has an invalid length. [ 349.742895][T14923] syzkaller0: entered promiscuous mode [ 349.748532][T14923] syzkaller0: entered allmulticast mode [ 349.778591][T14925] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2776'. [ 349.886059][T14927] netlink: 'syz.0.2776': attribute type 4 has an invalid length. [ 349.967826][T14927] netlink: 'syz.0.2776': attribute type 4 has an invalid length. [ 350.306128][T14927] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.313505][T14927] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.348708][T14927] batman_adv: batadv0: Interface deactivated: dummy0 [ 350.769866][T14927] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 350.802539][T14927] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 351.253400][T14945] tipc: Resetting bearer [ 351.331087][T14978] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2792'. [ 351.346691][ T137] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.364630][ T137] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.391781][ T137] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.427837][ T137] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.444607][ T137] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.473164][ T137] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.494144][ T137] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.535622][ T137] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.538162][ T29] audit: type=1800 audit(1778446516.927:60): pid=14978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2792" name="memory.events" dev="tmpfs" ino=2869 res=0 errno=0 [ 351.587165][T14988] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2794'. [ 351.856814][T15004] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2800'. [ 352.003633][T15015] syzkaller0: entered promiscuous mode [ 352.009597][T15015] syzkaller0: entered allmulticast mode [ 352.126757][T15019] netlink: 156 bytes leftover after parsing attributes in process `syz.2.2806'. [ 352.869350][T15041] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2810'. [ 352.933840][T15041] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2810'. [ 352.950080][T15043] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2811'. [ 353.003120][T15046] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 353.551919][T15068] syzkaller0: entered promiscuous mode [ 353.575301][T15068] syzkaller0: entered allmulticast mode [ 353.617351][T15071] team0: left promiscuous mode [ 353.622881][T15071] team_slave_0: left promiscuous mode [ 353.628611][T15071] team_slave_1: left promiscuous mode [ 353.635440][T15071] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 353.643193][T15071] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 353.788277][T15079] __nla_validate_parse: 6 callbacks suppressed [ 353.788295][T15079] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2823'. [ 354.014384][T15092] netlink: 'syz.0.2829': attribute type 32 has an invalid length. [ 354.024164][T15092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2829'. [ 354.062682][T15092] bond7: option coupled_control: invalid value (12) [ 354.078757][T15092] bond7 (unregistering): Released all slaves [ 354.133506][T15089] tipc: Enabled bearer , priority 0 [ 354.143558][T15097] netlink: 292 bytes leftover after parsing attributes in process `syz.4.2828'. [ 354.175646][T15087] tipc: Disabling bearer [ 354.358749][T15099] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2830'. [ 354.608477][T15120] dvmrp0: entered allmulticast mode [ 354.610848][T15122] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2838'. [ 354.976634][T15137] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2842'. [ 355.059497][T15142] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2845'. [ 355.489954][T15149] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2848'. [ 355.501862][T15149] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2848'. [ 355.661624][T15155] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2850'. [ 355.958586][T15169] syzkaller0: entered promiscuous mode [ 355.976827][T15169] syzkaller0: entered allmulticast mode [ 356.652752][T15204] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 356.926624][T15215] macvlan3: entered allmulticast mode [ 356.941024][T15215] veth1_vlan: entered allmulticast mode [ 358.092932][T15283] ip6tnl3: entered allmulticast mode [ 358.200372][T15294] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 358.357267][T15283] bond5 (unregistering): Released all slaves [ 358.547730][ T5647] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 358.561629][ T5647] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 358.571337][ T5647] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 358.583087][ T5647] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 358.599398][ T5647] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 359.127292][T15329] __nla_validate_parse: 9 callbacks suppressed [ 359.127320][T15329] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2917'. [ 359.140597][T15331] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2916'. [ 359.224141][ T8973] smbdirect: ib_dev[syz1] removed [ 359.241527][ T809] syz1: Port: 1 Link DOWN [ 359.406032][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 359.518591][ T8973] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 359.529605][ T8973] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.559914][T15345] vlan0: entered promiscuous mode [ 359.561816][T15342] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2919'. [ 359.582027][T15345] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2922'. [ 359.723510][ T8973] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 359.748505][ T8973] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.910612][ T8973] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 359.935080][ T8973] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.082510][ T8973] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 360.102506][ T8973] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.168902][T15376] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2930'. [ 360.421520][T15385] netlink: 'syz.2.2931': attribute type 1 has an invalid length. [ 360.475465][T15389] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2931'. [ 360.512670][T15385] 8021q: adding VLAN 0 to HW filter on device bond8 [ 360.525136][T15391] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2933'. [ 360.535142][T15391] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2933'. [ 360.555369][T15305] bridge0: port 1(bridge_slave_0) entered blocking state [ 360.562935][T15305] bridge0: port 1(bridge_slave_0) entered disabled state [ 360.570840][T15305] bridge_slave_0: entered allmulticast mode [ 360.578738][T15305] bridge_slave_0: entered promiscuous mode [ 360.596689][T15305] bridge0: port 2(bridge_slave_1) entered blocking state [ 360.609859][T15305] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.617207][T15305] bridge_slave_1: entered allmulticast mode [ 360.624762][T15305] bridge_slave_1: entered promiscuous mode [ 360.700105][ T5647] Bluetooth: hci5: command tx timeout [ 360.737585][ T8973] dvmrp0: left allmulticast mode [ 361.213585][ T8973] bond1 (unregistering): (slave bridge5): Releasing active interface [ 361.222642][ T8973] veth7: entered promiscuous mode [ 361.277073][ T8973] bond0 (unregistering): Released all slaves [ 361.288971][ T8973] bond1 (unregistering): (slave veth7): Releasing active interface [ 361.297172][ T8973] veth7: left promiscuous mode [ 361.305127][ T8973] bond1 (unregistering): Released all slaves [ 361.318612][ T8973] bond2 (unregistering): Released all slaves [ 361.336888][ T8973] bond3 (unregistering): Released all slaves [ 361.351199][ T8973] bond4 (unregistering): Released all slaves [ 361.364796][ T8973] bond5 (unregistering): Released all slaves [ 361.392297][ T8973] bond6 (unregistering): Released all slaves [ 361.407222][T15305] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 361.423920][T15394] bond8: (slave batadv2): Opening slave failed [ 361.447084][T15305] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 361.520439][ T8973] tipc: Disabling bearer [ 361.539610][ T8973] tipc: Left network mode [ 361.541925][T15305] team0: Port device team_slave_0 added [ 361.552898][T15305] team0: Port device team_slave_1 added [ 361.583552][T15305] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 361.591414][T15305] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.618130][T15305] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 361.631214][T15305] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 361.638180][T15305] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 361.664886][T15305] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 361.770775][T15305] hsr_slave_0: entered promiscuous mode [ 361.777119][T15305] hsr_slave_1: entered promiscuous mode [ 361.783694][T15305] debugfs: 'hsr0' already exists in 'hsr' [ 361.789904][T15305] Cannot create hsr debugfs directory [ 362.372087][ T8973] hsr_slave_0: left promiscuous mode [ 362.377896][ T8973] hsr_slave_1: left promiscuous mode [ 362.397641][ T8973] virt_wifi0: left allmulticast mode [ 362.403690][ T8973] virt_wifi0: left promiscuous mode [ 362.410428][ T8973] veth1_macvtap: left promiscuous mode [ 362.416678][ T8973] veth0_macvtap: left promiscuous mode [ 362.422443][ T8973] veth1_vlan: left promiscuous mode [ 362.427740][ T8973] veth0_vlan: left promiscuous mode [ 362.789134][ T5647] Bluetooth: hci5: command tx timeout [ 362.816760][T15362] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 362.830562][T15389] netlink: 'syz.2.2931': attribute type 1 has an invalid length. [ 362.940832][T15305] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 363.003671][T15305] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 363.032949][T15400] netlink: 'syz.0.2934': attribute type 10 has an invalid length. [ 363.038479][T15305] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 363.073274][T15305] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 363.098211][T15400] batman_adv: batadv0: Removing interface: dummy0 [ 363.184581][T15411] netlink: 'syz.0.2934': attribute type 10 has an invalid length. [ 363.215708][T15400] team0: Port device dummy0 added [ 363.223231][T15305] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 363.256125][T15305] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 363.312370][T15411] team0: Port device dummy0 removed [ 363.350490][T15411] dummy0: entered promiscuous mode [ 363.386910][T15411] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 363.455445][T15305] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 363.485873][T15305] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 363.495962][T15427] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2940'. [ 363.729793][T15404] nbd1: detected capacity change from 0 to 63 [ 363.766139][ T5647] block nbd1: Receive control failed (result -104) [ 363.768661][T11306] block nbd1: Send control failed (result -32) [ 363.773324][ T5633] block nbd1: Receive control failed (result -32) [ 363.816410][T11306] block nbd1: Request send failed, requeueing [ 363.838776][ T8973] IPVS: stop unused estimator thread 0... [ 363.890717][ T1701] block nbd1: Dead connection, failed to find a fallback [ 363.901443][ T1701] block nbd1: shutting down sockets [ 363.907898][ T1701] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 363.920163][ T1701] Buffer I/O error on dev nbd1, logical block 3, async page read [ 364.258146][T15305] 8021q: adding VLAN 0 to HW filter on device bond0 [ 364.291231][T15455] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 364.307702][T15457] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2945'. [ 364.313746][T15305] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.337766][T15455] netlink: 120 bytes leftover after parsing attributes in process `syz.4.2944'. [ 364.338355][T15457] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2945'. [ 364.366099][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state [ 364.373302][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state [ 364.396433][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 364.403653][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 364.870859][ T5647] Bluetooth: hci5: command tx timeout [ 365.075726][T15466] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2945'. [ 365.413136][T15501] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2951'. [ 365.473323][T15502] tipc: Enabling of bearer rejected, failed to enable media [ 365.842515][T15514] syzkaller0: entered promiscuous mode [ 365.870222][T15514] syzkaller0: entered allmulticast mode [ 365.958640][T15527] netlink: 'syz.3.2954': attribute type 9 has an invalid length. [ 366.244784][T15305] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 366.356535][T15305] veth0_vlan: entered promiscuous mode [ 366.387832][T15305] veth1_vlan: entered promiscuous mode [ 366.452702][T15305] veth0_macvtap: entered promiscuous mode [ 366.466715][T15305] veth1_macvtap: entered promiscuous mode [ 366.488563][T15305] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 366.511469][T15305] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 366.530206][ T114] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.547391][ T114] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.558630][ T114] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.591225][ T114] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 366.716522][ T114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.742878][ T114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 366.893099][ T3306] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 366.940300][ T5647] Bluetooth: hci5: command tx timeout [ 366.955806][ T3306] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 367.441647][ T29] audit: type=1804 audit(1778446532.827:61): pid=15592 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2969" name="/newroot/1/cgroup.controllers" dev="tmpfs" ino=23 res=1 errno=0 [ 367.477282][ T29] audit: type=1800 audit(1778446532.857:62): pid=15592 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2969" name="cgroup.controllers" dev="tmpfs" ino=23 res=0 errno=0 [ 367.933786][ T5633] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 367.946352][ T5633] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 367.958146][ T5633] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 367.971880][ T5633] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 367.981829][ T5633] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 368.373985][ T3389] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.404798][T15625] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 368.414253][ T3389] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.580936][T15637] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.2983'. [ 368.628831][T15637] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2983'. [ 368.637759][T15632] bridge0: port 3(team0) entered disabled state [ 368.678874][T15632] bridge0: port 1(bridge_slave_0) entered disabled state [ 368.710716][T15632] bridge0: port 2(bridge_slave_1) entered disabled state [ 369.567523][ T3389] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 369.578351][ T3389] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 369.647542][T15655] 8021q: adding VLAN 0 to HW filter on device bond0 [ 369.656585][T15655] 8021q: adding VLAN 0 to HW filter on device team0 [ 369.696321][T15655] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 369.754115][T15655] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 369.764062][T15655] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 369.778442][T15655] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 369.789985][T15655] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 369.806913][T15655] veth1_vlan: left promiscuous mode [ 369.818178][T15655] veth1_vlan: entered promiscuous mode [ 369.829007][T15655] veth1_macvtap: left promiscuous mode [ 369.836309][T15655] veth0_macvtap: left promiscuous mode [ 369.844369][T15655] veth0_macvtap: entered promiscuous mode [ 369.852047][T15655] veth1_macvtap: entered promiscuous mode [ 369.865765][T15655] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 369.874603][T15655] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 369.885553][T15655] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 369.894206][T15655] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 369.906450][T15655] 8021q: adding VLAN 0 to HW filter on device bond1 [ 369.922179][T15655] 8021q: adding VLAN 0 to HW filter on device bond2 [ 369.931665][T15655] 8021q: adding VLAN 0 to HW filter on device bond3 [ 369.941802][T15655] 8021q: adding VLAN 0 to HW filter on device bond4 [ 369.951994][T15655] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 369.966329][T15655] 8021q: adding VLAN 0 to HW filter on device bond5 [ 369.975768][T15655] 8021q: adding VLAN 0 to HW filter on device bond6 [ 370.029360][ T114] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.036584][ T114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 370.055020][ T114] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.062228][ T114] bridge0: port 2(bridge_slave_1) entered forwarding state [ 370.071881][ T5647] Bluetooth: hci0: command tx timeout [ 370.116688][ T1166] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.126668][ T1166] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.136176][ T1166] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.151924][ T1166] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.212018][ T3389] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 370.225001][ T3389] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.268871][ T1166] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.290615][ T1166] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.319722][ T1166] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 370.338693][ T1166] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 370.494912][ T3389] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 370.506539][ T3389] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 370.693772][T15693] syzkaller0: entered promiscuous mode [ 370.705613][T15693] syzkaller0: entered allmulticast mode [ 370.727203][T15695] syzkaller0: entered promiscuous mode [ 370.752474][T15695] syzkaller0: entered allmulticast mode [ 371.093926][T15700] syzkaller0: entered promiscuous mode [ 371.106283][T15700] syzkaller0: entered allmulticast mode [ 371.413530][ T3389] dvmrp8: left allmulticast mode [ 371.637023][T15738] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3007'. [ 371.746991][ T3389] bond7 (unregistering): (slave gretap1): Releasing active interface [ 371.798756][ T3389] bond4 (unregistering): (slave bridge0): Releasing backup interface [ 371.810943][ T3389] bridge0 (unregistering): left allmulticast mode [ 371.862890][ T3389] bond5 (unregistering): (slave bridge1): Releasing active interface [ 371.871358][ T3389] bridge1 (unregistering): left allmulticast mode [ 371.995221][ T3389] bond0 (unregistering): left promiscuous mode [ 372.001958][ T3389] bond0 (unregistering): Released all slaves [ 372.013105][ T3389] bond1 (unregistering): Released all slaves [ 372.026944][ T3389] bond2 (unregistering): Released all slaves [ 372.042021][ T3389] bond3 (unregistering): Released all slaves [ 372.066516][ T3389] bond4 (unregistering): Released all slaves [ 372.084688][ T3389] bond5 (unregistering): Released all slaves [ 372.098368][ T3389] bond6 (unregistering): Released all slaves [ 372.113794][ T3389] bond7 (unregistering): Released all slaves [ 372.137479][ T3389] bond8 (unregistering): Released all slaves [ 372.139250][ T5647] Bluetooth: hci0: command tx timeout [ 372.156205][ T3389] bond9 (unregistering): Released all slaves [ 372.237359][T15612] bridge0: port 1(bridge_slave_0) entered blocking state [ 372.244832][T15612] bridge0: port 1(bridge_slave_0) entered disabled state [ 372.253253][T15612] bridge_slave_0: entered allmulticast mode [ 372.264432][T15612] bridge_slave_0: entered promiscuous mode [ 372.351844][T15612] bridge0: port 2(bridge_slave_1) entered blocking state [ 372.371206][T15612] bridge0: port 2(bridge_slave_1) entered disabled state [ 372.378582][T15612] bridge_slave_1: entered allmulticast mode [ 372.425087][T15612] bridge_slave_1: entered promiscuous mode [ 372.564082][T15748] xt_TPROXY: Can be used only with -p tcp or -p udp [ 372.596918][ T3389] tipc: Disabling bearer [ 372.615411][ T3389] tipc: Left network mode [ 372.622139][T15612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 372.653235][T15742] syzkaller0: entered promiscuous mode [ 372.670882][T15742] syzkaller0: entered allmulticast mode [ 372.692251][T15612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 372.759906][T15612] team0: Port device team_slave_0 added [ 372.778751][T15612] team0: Port device team_slave_1 added [ 373.083375][T15612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 373.106030][T15612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 373.221079][T15612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 373.253796][T15612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 373.288250][T15612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 373.343388][T15778] netlink: 'syz.2.3016': attribute type 1 has an invalid length. [ 373.370397][T15612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 373.630612][T15788] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 373.671548][T15763] netlink: 'syz.0.3013': attribute type 1 has an invalid length. [ 374.184540][ T5295] 8021q: adding VLAN 0 to HW filter on device eth1 [ 374.220326][ T5647] Bluetooth: hci0: command tx timeout [ 374.265035][T15771] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 374.631073][T15612] hsr_slave_0: entered promiscuous mode [ 374.652117][T15612] hsr_slave_1: entered promiscuous mode [ 374.675364][T15612] debugfs: 'hsr0' already exists in 'hsr' [ 374.689809][T15612] Cannot create hsr debugfs directory [ 374.871829][T15820] netlink: 'syz.1.3023': attribute type 1 has an invalid length. [ 374.938191][T15820] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3023'. [ 374.966588][T15820] hsr_slave_1: entered allmulticast mode [ 375.027111][ T29] audit: type=1804 audit(1778446540.417:63): pid=15826 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.3025" name="/newroot/589/cgroup.controllers" dev="tmpfs" ino=3022 res=1 errno=0 [ 375.086408][ T29] audit: type=1800 audit(1778446540.417:64): pid=15826 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3025" name="cgroup.controllers" dev="tmpfs" ino=3022 res=0 errno=0 [ 375.200233][T15823] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3024'. [ 375.226031][ T3389] batadv0: left promiscuous mode [ 375.289498][ T3389] hsr_slave_0: left promiscuous mode [ 375.314199][ T3389] hsr_slave_1: left promiscuous mode [ 375.406739][T15842] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3028'. [ 375.431237][ T3389] veth1_macvtap: left promiscuous mode [ 375.447302][ T3389] veth0_macvtap: left promiscuous mode [ 375.468209][ T3389] veth1_vlan: left promiscuous mode [ 375.481051][ T3389] veth0_vlan: left promiscuous mode [ 375.490069][T15845] FAULT_INJECTION: forcing a failure. [ 375.490069][T15845] name failslab, interval 1, probability 0, space 0, times 0 [ 375.502781][T15845] CPU: 1 UID: 0 PID: 15845 Comm: syz.0.3029 Not tainted syzkaller #0 PREEMPT(full) [ 375.502806][T15845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 375.502822][T15845] Call Trace: [ 375.502833][T15845] [ 375.502841][T15845] dump_stack_lvl+0xe8/0x150 [ 375.502868][T15845] should_fail_ex+0x412/0x560 [ 375.502898][T15845] should_failslab+0xa8/0x100 [ 375.502924][T15845] ? skb_clone+0x212/0x3a0 [ 375.502942][T15845] kmem_cache_alloc_noprof+0x87/0x650 [ 375.502969][T15845] ? run_filter+0x23/0x270 [ 375.502995][T15845] skb_clone+0x212/0x3a0 [ 375.503011][T15845] ? packet_rcv+0x567/0x1730 [ 375.503035][T15845] packet_rcv+0x65b/0x1730 [ 375.503073][T15845] __netif_receive_skb_core+0xb86/0x3170 [ 375.503094][T15845] ? is_bpf_text_address+0x26/0x2b0 [ 375.503119][T15845] ? is_bpf_text_address+0x292/0x2b0 [ 375.503142][T15845] ? kernel_text_address+0xa5/0xe0 [ 375.503170][T15845] ? unwind_get_return_address+0x4d/0x90 [ 375.503191][T15845] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 375.503222][T15845] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 375.503269][T15845] ? kasan_save_track+0x4f/0x80 [ 375.503291][T15845] ? __kasan_slab_alloc+0x6c/0x80 [ 375.503313][T15845] ? kmem_cache_alloc_bulk_noprof+0x55e/0x7c0 [ 375.503339][T15845] ? bpf_test_run_xdp_live+0x179c/0x1cf0 [ 375.503363][T15845] ? bpf_prog_test_run_xdp+0x81c/0x1160 [ 375.503392][T15845] __netif_receive_skb_list_core+0x24d/0x810 [ 375.503428][T15845] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 375.503463][T15845] netif_receive_skb_list_internal+0x995/0xcf0 [ 375.503491][T15845] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 375.503512][T15845] ? eth_type_trans+0x348/0x7e0 [ 375.503530][T15845] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 375.503560][T15845] ? __xdp_build_skb_from_frame+0x34b/0x730 [ 375.503584][T15845] netif_receive_skb_list+0x55/0x450 [ 375.503602][T15845] ? bpf_test_run_xdp_live+0x1921/0x1cf0 [ 375.503630][T15845] bpf_test_run_xdp_live+0x1946/0x1cf0 [ 375.503676][T15845] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 375.503708][T15845] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 375.503754][T15845] ? 0xffffffffa02019e4 [ 375.503770][T15845] ? 0xffffffffa0201a48 [ 375.503813][T15845] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 375.503841][T15845] ? _copy_from_user+0x94/0xb0 [ 375.503866][T15845] ? bpf_test_init+0x113/0x150 [ 375.503888][T15845] ? xdp_convert_md_to_buff+0x5b/0x330 [ 375.503916][T15845] bpf_prog_test_run_xdp+0x81c/0x1160 [ 375.503958][T15845] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 375.503989][T15845] ? __fget_files+0x2a/0x420 [ 375.504016][T15845] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 375.504043][T15845] bpf_prog_test_run+0x2c7/0x340 [ 375.504072][T15845] __sys_bpf+0x643/0x950 [ 375.504100][T15845] ? __pfx___sys_bpf+0x10/0x10 [ 375.504143][T15845] ? ksys_write+0x242/0x270 [ 375.504172][T15845] ? __pfx_ksys_write+0x10/0x10 [ 375.504201][T15845] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.504221][T15845] __x64_sys_bpf+0x7c/0x90 [ 375.504247][T15845] do_syscall_64+0x15f/0xf80 [ 375.504264][T15845] ? trace_irq_disable+0x3b/0x140 [ 375.504290][T15845] ? clear_bhb_loop+0x40/0x90 [ 375.504313][T15845] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.504331][T15845] RIP: 0033:0x7f5bd0f9cdd9 [ 375.504348][T15845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 375.504364][T15845] RSP: 002b:00007f5bd1da2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 375.504384][T15845] RAX: ffffffffffffffda RBX: 00007f5bd1215fa0 RCX: 00007f5bd0f9cdd9 [ 375.504397][T15845] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 375.504409][T15845] RBP: 00007f5bd1da2090 R08: 0000000000000000 R09: 0000000000000000 [ 375.504420][T15845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 375.504430][T15845] R13: 00007f5bd1216038 R14: 00007f5bd1215fa0 R15: 00007ffd46389098 [ 375.504462][T15845] [ 376.097565][T15860] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3033'. [ 376.295355][T15866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3035'. [ 376.299231][ T5647] Bluetooth: hci0: command tx timeout [ 376.305371][T15866] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3035'. [ 376.637382][ T5295] 8021q: adding VLAN 0 to HW filter on device eth2 [ 376.651200][T15866] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3035'. [ 376.669808][T15866] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3035'. [ 376.731065][T15871] xt_hl: Unknown TTL match mode: 237 [ 376.890078][T15874] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3037'. [ 376.918612][T15877] FAULT_INJECTION: forcing a failure. [ 376.918612][T15877] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 376.990743][T15877] CPU: 1 UID: 0 PID: 15877 Comm: syz.2.3038 Not tainted syzkaller #0 PREEMPT(full) [ 376.990768][T15877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 376.990776][T15877] Call Trace: [ 376.990782][T15877] [ 376.990788][T15877] dump_stack_lvl+0xe8/0x150 [ 376.990809][T15877] should_fail_ex+0x412/0x560 [ 376.990831][T15877] _copy_to_user+0x31/0xb0 [ 376.990854][T15877] simple_read_from_buffer+0xe1/0x170 [ 376.990874][T15877] proc_fail_nth_read+0x1bb/0x230 [ 376.990895][T15877] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 376.990914][T15877] ? rw_verify_area+0x2a6/0x4d0 [ 376.990933][T15877] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 376.990961][T15877] vfs_read+0x20c/0xa70 [ 376.990985][T15877] ? __pfx___mutex_lock+0x10/0x10 [ 376.991001][T15877] ? __pfx_vfs_read+0x10/0x10 [ 376.991022][T15877] ? __fget_files+0x2a/0x420 [ 376.991044][T15877] ? __fget_files+0x3a0/0x420 [ 376.991060][T15877] ? __fget_files+0x2a/0x420 [ 376.991083][T15877] ksys_read+0x150/0x270 [ 376.991104][T15877] ? __pfx_ksys_read+0x10/0x10 [ 376.991131][T15877] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.991147][T15877] do_syscall_64+0x15f/0xf80 [ 376.991161][T15877] ? trace_irq_disable+0x3b/0x140 [ 376.991184][T15877] ? clear_bhb_loop+0x40/0x90 [ 376.991202][T15877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.991215][T15877] RIP: 0033:0x7f00bc15d60e [ 376.991230][T15877] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 376.991244][T15877] RSP: 002b:00007f00bcfc0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 376.991261][T15877] RAX: ffffffffffffffda RBX: 00007f00bcfc16c0 RCX: 00007f00bc15d60e [ 376.991272][T15877] RDX: 000000000000000f RSI: 00007f00bcfc10a0 RDI: 0000000000000004 [ 376.991282][T15877] RBP: 00007f00bcfc1090 R08: 0000000000000000 R09: 0000000000000000 [ 376.991292][T15877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.991302][T15877] R13: 00007f00bc416038 R14: 00007f00bc415fa0 R15: 00007ffd63e72ea8 [ 376.991330][T15877] [ 377.312813][T15887] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3040'. [ 377.374032][ C0] ------------[ cut here ]------------ [ 377.379593][ C0] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0 [ 377.389459][ C0] WARNING: net/mac80211/rate.c:404 at __rate_control_send_low+0x524/0x800, CPU#0: kworker/u8:15/3389 [ 377.400377][ C0] Modules linked in: [ 377.412897][ C0] CPU: 0 UID: 0 PID: 3389 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT(full) [ 377.422501][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 377.432601][ C0] Workqueue: netns cleanup_net [ 377.437436][ C0] RIP: 0010:__rate_control_send_low+0x5bb/0x800 [ 377.443739][ C0] Code: ff 4c 8b 7c 24 08 48 8b 44 24 38 0f b6 04 28 84 c0 0f 85 d3 01 00 00 41 8b 0f 4c 89 f7 48 8b 74 24 18 44 8b 44 24 2c 45 89 e9 <67> 48 0f b9 3a 4c 8b 74 24 30 e9 81 fe ff ff 44 89 f9 80 e1 07 80 [ 377.463417][ C0] RSP: 0018:ffffc900000076b8 EFLAGS: 00010246 [ 377.469539][ C0] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000000 [ 377.477531][ C0] RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff90425e80 [ 377.485579][ C0] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 [ 377.493627][ C0] R10: 0000000000000004 R11: 0000000000000100 R12: ffff88808dc388e8 [ 377.501677][ C0] R13: 0000000000000000 R14: ffffffff90425e80 R15: ffff8880578b3258 [ 377.509690][ C0] FS: 0000000000000000(0000) GS:ffff888125287000(0000) knlGS:0000000000000000 [ 377.518644][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 377.525298][ C0] CR2: 0000001b34b09ff8 CR3: 000000000e74a000 CR4: 00000000003526f0 [ 377.533317][ C0] Call Trace: [ 377.536612][ C0] [ 377.539549][ C0] rate_control_send_low+0x1a7/0x7b0 [ 377.544888][ C0] rate_control_get_rate+0x20b/0x5d0 [ 377.550264][ C0] ieee80211_beacon_get_finish+0x3af/0x6f0 [ 377.556095][ C0] ? __pfx_ieee80211_beacon_get_finish+0x10/0x10 [ 377.562464][ C0] ? __ieee80211_beacon_add_tim+0x1180/0x15a0 [ 377.568565][ C0] ? ieee80211_beacon_get_ap+0x8cb/0x2040 [ 377.574365][ C0] ieee80211_beacon_get_ap+0x196a/0x2040 [ 377.580067][ C0] ? __pfx_ieee80211_beacon_get_ap+0x10/0x10 [ 377.586095][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 377.591719][ C0] ? lock_acquire+0x106/0x350 [ 377.596432][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 377.602041][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 377.607596][ C0] __ieee80211_beacon_get+0x118e/0x1880 [ 377.613170][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 377.618729][ C0] ieee80211_beacon_get_tim+0xbd/0x2c0 [ 377.624234][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 377.630354][ C0] mac80211_hwsim_beacon_tx+0x382/0x830 [ 377.635933][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 377.643181][ C0] __iterate_interfaces+0x2ab/0x590 [ 377.648401][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 377.654516][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 377.661775][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 377.667865][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 377.674986][ C0] mac80211_hwsim_beacon+0xaa/0x270 [ 377.680246][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 377.686077][ C0] __hrtimer_run_queues+0x3c0/0xa20 [ 377.691363][ C0] hrtimer_run_softirq+0x17a/0x240 [ 377.695176][T15896] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3042'. [ 377.696513][ C0] handle_softirqs+0x22a/0x840 [ 377.706338][T15896] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3042'. [ 377.710190][ C0] ? __irq_exit_rcu+0xca/0x220 [ 377.710229][ C0] __irq_exit_rcu+0xca/0x220 [ 377.710251][ C0] irq_exit_rcu+0x9/0x30 [ 377.710270][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 377.738431][ C0] [ 377.741423][ C0] [ 377.744367][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 377.750413][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 377.756850][ C0] Code: f7 e8 ad 05 f6 f5 f7 c3 00 02 00 00 74 05 e8 b0 9b 21 f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 88 e7 f5 65 8b 05 ed 40 8d 07 85 c0 74 18 5b 41 5e e9 51 48 [ 377.776489][ C0] RSP: 0018:ffffc9000d597590 EFLAGS: 00000206 [ 377.782589][ C0] RAX: 0000000000000002 RBX: 0000000000000202 RCX: 0000000080000002 [ 377.790597][ C0] RDX: 0000000000000006 RSI: ffffffff8dfaab66 RDI: 0000000000000001 [ 377.798586][ C0] RBP: ffff8880780b9ec0 R08: ffffffff9030dcf7 R09: 1ffffffff2061b9e [ 377.806623][ C0] R10: dffffc0000000000 R11: fffffbfff2061b9f R12: dffffc0000000000 [ 377.814645][ C0] R13: 1ffff110170e779c R14: ffff8880780ba930 R15: ffff8880b873bce0 [ 377.822698][ C0] try_to_wake_up+0x7b4/0x1380 [ 377.827514][ C0] kthread_stop+0x177/0x5b0 [ 377.832100][ C0] destroy_workqueue+0x107/0xc60 [ 377.837063][ C0] ? destroy_workqueue+0x891/0xc60 [ 377.842244][ C0] wg_destruct+0x1ec/0x310 [ 377.846689][ C0] ? __pfx_wg_destruct+0x10/0x10 [ 377.851697][ C0] netdev_run_todo+0xc1f/0xde0 [ 377.856480][ C0] ? __pfx_netdev_run_todo+0x10/0x10 [ 377.861821][ C0] ? unregister_netdevice_queue+0x19b/0x360 [ 377.867742][ C0] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 377.874053][ C0] ? batadv_meshif_destroy_netlink+0x1b0/0x250 [ 377.880256][ C0] default_device_exit_batch+0x967/0x9e0 [ 377.885930][ C0] ? __pfx_netdev_run_todo+0x10/0x10 [ 377.891282][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 377.897473][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 377.903700][ C0] ops_undo_list+0x52b/0x940 [ 377.908319][ C0] ? __pfx_ops_undo_list+0x10/0x10 [ 377.913506][ C0] ? idr_destroy+0x218/0x290 [ 377.918114][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 377.923305][ C0] cleanup_net+0x56b/0x800 [ 377.927746][ C0] ? __pfx_cleanup_net+0x10/0x10 [ 377.933271][ C0] ? process_scheduled_works+0xa70/0x1860 [ 377.939019][ C0] ? process_scheduled_works+0xa70/0x1860 [ 377.944809][ C0] process_scheduled_works+0xb5d/0x1860 [ 377.950442][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 377.956445][ C0] ? assign_work+0x3d5/0x5e0 [ 377.961107][ C0] worker_thread+0xa53/0xfc0 [ 377.965739][ C0] kthread+0x388/0x470 [ 377.969894][ C0] ? __pfx_worker_thread+0x10/0x10 [ 377.975018][ C0] ? __pfx_kthread+0x10/0x10 [ 377.979677][ C0] ret_from_fork+0x514/0xb70 [ 377.984283][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 377.989452][ C0] ? __switch_to+0xc79/0x1410 [ 377.994165][ C0] ? __pfx_kthread+0x10/0x10 [ 377.998783][ C0] ret_from_fork_asm+0x1a/0x30 [ 378.003636][ C0] [ 378.006682][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 378.013974][ C0] CPU: 0 UID: 0 PID: 3389 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT(full) [ 378.023530][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 378.033602][ C0] Workqueue: netns cleanup_net [ 378.038399][ C0] Call Trace: [ 378.041684][ C0] [ 378.044533][ C0] vpanic+0x56c/0xa60 [ 378.048561][ C0] ? __pfx__printk+0x10/0x10 [ 378.053154][ C0] ? __pfx_vpanic+0x10/0x10 [ 378.057663][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 378.062967][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 378.068183][ C0] panic+0xc5/0xd0 [ 378.071909][ C0] ? __pfx_panic+0x10/0x10 [ 378.076327][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 378.081267][ C0] __warn+0x315/0x4c0 [ 378.085244][ C0] ? __rate_control_send_low+0x524/0x800 [ 378.090893][ C0] ? __rate_control_send_low+0x524/0x800 [ 378.096532][ C0] __report_bug+0x29a/0x540 [ 378.101033][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 378.105967][ C0] ? __rate_control_send_low+0x524/0x800 [ 378.111602][ C0] ? __pfx___report_bug+0x10/0x10 [ 378.116630][ C0] ? __build_skb+0x62/0x440 [ 378.121128][ C0] ? stack_trace_save+0xa9/0x100 [ 378.126062][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 378.131434][ C0] report_bug_entry+0x19a/0x290 [ 378.136280][ C0] ? __rate_control_send_low+0x5bb/0x800 [ 378.141911][ C0] ? __rate_control_send_low+0x5c0/0x800 [ 378.147539][ C0] handle_bug+0xce/0x200 [ 378.151777][ C0] exc_invalid_op+0x1a/0x50 [ 378.156269][ C0] asm_exc_invalid_op+0x1a/0x20 [ 378.161109][ C0] RIP: 0010:__rate_control_send_low+0x5bb/0x800 [ 378.167350][ C0] Code: ff 4c 8b 7c 24 08 48 8b 44 24 38 0f b6 04 28 84 c0 0f 85 d3 01 00 00 41 8b 0f 4c 89 f7 48 8b 74 24 18 44 8b 44 24 2c 45 89 e9 <67> 48 0f b9 3a 4c 8b 74 24 30 e9 81 fe ff ff 44 89 f9 80 e1 07 80 [ 378.186958][ C0] RSP: 0018:ffffc900000076b8 EFLAGS: 00010246 [ 378.193031][ C0] RAX: 0000000000000000 RBX: 000000000000000c RCX: 0000000000000000 [ 378.200998][ C0] RDX: 00000000ffffffff RSI: 0000000000000000 RDI: ffffffff90425e80 [ 378.208965][ C0] RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 [ 378.216931][ C0] R10: 0000000000000004 R11: 0000000000000100 R12: ffff88808dc388e8 [ 378.224894][ C0] R13: 0000000000000000 R14: ffffffff90425e80 R15: ffff8880578b3258 [ 378.232882][ C0] ? __rate_control_send_low+0x58d/0x800 [ 378.238546][ C0] rate_control_send_low+0x1a7/0x7b0 [ 378.243862][ C0] rate_control_get_rate+0x20b/0x5d0 [ 378.249170][ C0] ieee80211_beacon_get_finish+0x3af/0x6f0 [ 378.254985][ C0] ? __pfx_ieee80211_beacon_get_finish+0x10/0x10 [ 378.261311][ C0] ? __ieee80211_beacon_add_tim+0x1180/0x15a0 [ 378.267385][ C0] ? ieee80211_beacon_get_ap+0x8cb/0x2040 [ 378.273106][ C0] ieee80211_beacon_get_ap+0x196a/0x2040 [ 378.278745][ C0] ? __pfx_ieee80211_beacon_get_ap+0x10/0x10 [ 378.284729][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 378.290270][ C0] ? lock_acquire+0x106/0x350 [ 378.294957][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 378.300519][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 378.306064][ C0] __ieee80211_beacon_get+0x118e/0x1880 [ 378.311609][ C0] ? __ieee80211_beacon_get+0x36/0x1880 [ 378.317152][ C0] ieee80211_beacon_get_tim+0xbd/0x2c0 [ 378.322606][ C0] ? __pfx_ieee80211_beacon_get_tim+0x10/0x10 [ 378.328671][ C0] mac80211_hwsim_beacon_tx+0x382/0x830 [ 378.334219][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 378.341422][ C0] __iterate_interfaces+0x2ab/0x590 [ 378.346618][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 378.352685][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 378.359910][ C0] ? __pfx_mac80211_hwsim_beacon_tx+0x10/0x10 [ 378.365975][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 378.372998][ C0] mac80211_hwsim_beacon+0xaa/0x270 [ 378.378193][ C0] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 378.383990][ C0] __hrtimer_run_queues+0x3c0/0xa20 [ 378.389195][ C0] hrtimer_run_softirq+0x17a/0x240 [ 378.394303][ C0] handle_softirqs+0x22a/0x840 [ 378.399060][ C0] ? __irq_exit_rcu+0xca/0x220 [ 378.403829][ C0] __irq_exit_rcu+0xca/0x220 [ 378.408412][ C0] irq_exit_rcu+0x9/0x30 [ 378.412644][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 378.418275][ C0] [ 378.421190][ C0] [ 378.424108][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 378.430076][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 378.436487][ C0] Code: f7 e8 ad 05 f6 f5 f7 c3 00 02 00 00 74 05 e8 b0 9b 21 f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 88 e7 f5 65 8b 05 ed 40 8d 07 85 c0 74 18 5b 41 5e e9 51 48 [ 378.456086][ C0] RSP: 0018:ffffc9000d597590 EFLAGS: 00000206 [ 378.462156][ C0] RAX: 0000000000000002 RBX: 0000000000000202 RCX: 0000000080000002 [ 378.470123][ C0] RDX: 0000000000000006 RSI: ffffffff8dfaab66 RDI: 0000000000000001 [ 378.478084][ C0] RBP: ffff8880780b9ec0 R08: ffffffff9030dcf7 R09: 1ffffffff2061b9e [ 378.486045][ C0] R10: dffffc0000000000 R11: fffffbfff2061b9f R12: dffffc0000000000 [ 378.494007][ C0] R13: 1ffff110170e779c R14: ffff8880780ba930 R15: ffff8880b873bce0 [ 378.502012][ C0] try_to_wake_up+0x7b4/0x1380 [ 378.506808][ C0] kthread_stop+0x177/0x5b0 [ 378.511320][ C0] destroy_workqueue+0x107/0xc60 [ 378.516265][ C0] ? destroy_workqueue+0x891/0xc60 [ 378.521382][ C0] wg_destruct+0x1ec/0x310 [ 378.525801][ C0] ? __pfx_wg_destruct+0x10/0x10 [ 378.530746][ C0] netdev_run_todo+0xc1f/0xde0 [ 378.535509][ C0] ? __pfx_netdev_run_todo+0x10/0x10 [ 378.540787][ C0] ? unregister_netdevice_queue+0x19b/0x360 [ 378.546693][ C0] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 378.552929][ C0] ? batadv_meshif_destroy_netlink+0x1b0/0x250 [ 378.559085][ C0] default_device_exit_batch+0x967/0x9e0 [ 378.564749][ C0] ? __pfx_netdev_run_todo+0x10/0x10 [ 378.570025][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 378.576182][ C0] ? __pfx_default_device_exit_batch+0x10/0x10 [ 378.582328][ C0] ops_undo_list+0x52b/0x940 [ 378.586920][ C0] ? __pfx_ops_undo_list+0x10/0x10 [ 378.592027][ C0] ? idr_destroy+0x218/0x290 [ 378.596613][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 378.601729][ C0] cleanup_net+0x56b/0x800 [ 378.606142][ C0] ? __pfx_cleanup_net+0x10/0x10 [ 378.611083][ C0] ? process_scheduled_works+0xa70/0x1860 [ 378.616797][ C0] ? process_scheduled_works+0xa70/0x1860 [ 378.622507][ C0] process_scheduled_works+0xb5d/0x1860 [ 378.628066][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 378.634040][ C0] ? assign_work+0x3d5/0x5e0 [ 378.638624][ C0] worker_thread+0xa53/0xfc0 [ 378.643225][ C0] kthread+0x388/0x470 [ 378.647291][ C0] ? __pfx_worker_thread+0x10/0x10 [ 378.652390][ C0] ? __pfx_kthread+0x10/0x10 [ 378.656975][ C0] ret_from_fork+0x514/0xb70 [ 378.661559][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 378.666661][ C0] ? __switch_to+0xc79/0x1410 [ 378.671338][ C0] ? __pfx_kthread+0x10/0x10 [ 378.675920][ C0] ret_from_fork_asm+0x1a/0x30 [ 378.680693][ C0] [ 378.684325][ C0] Kernel Offset: disabled [ 378.688635][ C0] Rebooting in 86400 seconds..