last executing test programs: 11m4.936076748s ago: executing program 3 (id=2132): bind$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x80002, 0x0) getsockopt$sock_int(r0, 0x1, 0x30, 0x0, &(0x7f0000000580)) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x4}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000140)='ns/mnt\x00') ioctl$BTRFS_IOC_ADD_DEV(r1, 0x5000940a, &(0x7f0000000f80)={{}, "3120198113f981905e6a957c5e42c5ff0966ee1f006516b23feff38d0ea48150de2c56e5f771314e52730bbd73c5aa43c7fc4a0bdfb78ea7e210a3ec4a370452489b20e5d7a7cc06422b1fed15a85682868064d4112d3e98353eebb74c8f729501a4e87cca237a62446b0dfdc8f0b74b5a8d1f7f4f8b428bd490d3586a49788fd23a50c3c60636aa5030dd987d3a422ddee7aa2b0efecec05c7e1f9ce0a12f91c57ec3d56e04668b98dee6c9ff76166c4cf500d39e4c2b7f6f826f2893d11b02c20e278a99b686f46b02f9479448797e48bb88ee24c5192ac979d79f44ee2fc60f38aa574c3aa4ffed9de07bdefe312a6a4f55670c46a5f2e9347435063601e7c2071229d4dcae5859578d457bbe12ecb90d92e5f0775958d2fdfbbb99d2fd99e63d77743a2f8a9833381b613d89594dd32b1e950c3191185b8a0c19d09f9b58c0ad1e17f8c7add939e831fe2f1bd9970623d8c2992cc6a84fea31024683d591416497856f775eaf5674c6e45750ec44c8e694abffbfeca50c9ac0f84721a909e0a4551c2db47407f219e7b455b49900d35642899b7f6dbdf765143002b921c3054bce12115ebe62d91ff62429016d64eccab6c7d3d1d6c4927233a0b3d9a7c1af895d12adc0b7d27c408333e0af540e2406fab3b5250366b76d7275adff4b33cd963de95457a89f8cd82b1ea3484e2fc384143e446031cf481a50deb266e374f28e506390ea3305f01838ba279da0d8be800aca6e7384db253be28f043a58ff12a22da02eab0b5907c6dd192924b8a374cac1e9c76b7bacbe2b546bf0b2170674464b08775d30346ef1a6cbb6ca6b781c940d8e2d5bcf8c6889149d820cd00bb820a5ebbc1abd2412e46790450c83dff72f8497eb85299e9f4901d589d9a1cb701fcc8b1c300e3f18175834bdf16571052ab035d4bb5b5718950632ec5a07e19bf43c19306886afe817532ad9583ca8446920df4050f7f3a1c4d643b49c976f09d44780ea4e341a2f9f6ffb916b24024ecf09ac9def4c8b625099ee7c583f274875c9c0baebcf54969505f0aff02d291b78c24be82218041dac750bc0d2d913ad86598243aaeccaae2ee45054c8d22f69f362efafbc69a3875f40cc8b429f62e6e60ba381f567efdd1e8376d87eb8a1ba9a90516547d6d5d3de66220758ebc7db1e210e236c6a684a9ea7326922dd8155c9ad574e1d501a68e326ad02b7b22d802fbee16bdcb329e4f5ce905b95f889184a069563157390210d9f006243a56a1c6fa4bec7751e5cd6baab3e5ee22674f68eb5d8bdae4969ca243128d3584a251e2441a8fd8195943f4994364dc5f20e0574b6d646f610d59a191999adafe97d0ddcef8f569f004e6867a82e93a1e060569d7f4640d7f341b5f097b61d3b7404a7a4ec366012f73ea54a05efa31559137d8bfe654027a9c7b9abc507a9d1b43274ea8bd4aaa685f12413d19e0d2d37c5de634e2d541a6e7e3ce2cf9729fc8982b9c7050fb0678ee6e40b92207ce051c368e099c1c8855b1f5c5093307523b18637f784e5a80ee763adfefc0a6a5687ae4bef5d666e553cb2839a7c59994d96d010a62c3e4182224032a19d4e4aa29070ae8af92d55efb7d865c685d3cbb4940a2b45eb34406e6e7a57fe26c8251ae61a34dd596c294222dd872a259cf176e89abb42972d36eee2b85a71f0e8f33ed167b92bb26f04cd0efd1e54e617421dd1ab2eaa5f72f1041a23b901a95fa5318ee1ad9174da15803d9f986a3d3107346c517f22299c774f170c580d2454a882ac7a2f57dac0f1bc6a10d4ab7cf149abf7f407baa52fcdc6d791df0dd59f60e579f99c95cacb24a29a26b5fb56853aa49d409a25e4397b89349d1eabdd60024effd752c273a3fffcf2f1367dfa0f78bb079a3932a153ad98d9f2b462414321a34ccdfffa436c08c013050f220abddd446a3534a572a1105b1feae067ead1216b7d00c37395dcfaab25aaa0726e2991e9047657b92d7b22bcde95f7e83c5d5184554fa5bc97517c17434258bd212e2110e1c23856eb7cd894ab6c7b2e5d8fbecff83e646899e64a86084b9b811ef29fa56c5196770d1d4bb7f7f3f3ede542ac3aa7e9f5353fc38864953c3059020ba24b9baa5151503c5034dc135a44a99b132ea963e035fae64ac1b8e1318a36f8adf3a7ca9e70ffd7428750a95a68e2c9b73cb9fc69bd90eb26de9c71aaf8a7834e496387d58b24206a25f0028e5e2aea271b04f3dd1a6c25106fcaea8db662fb9b7653a67c3ef8d4b6f63a973b3c6c9d24d2ce85253897e27a5660939d7a6aea14d5d6c1b78aceed128db23719e0c117eb140a499882d2c6bb7eda5bcdb0fe14ceaaee36c8c9834543899109b63393ea09e2ad6d57f07bf6017edb3be68a19b280030b8d4729a13f5f647af14055c88c85a8bf2db196bc5ad115462e07f888f6dd559f08e490a7da686dc63bec39cf699430161bdc90a4620d02905db978c0b0f64145d32fe16a7f31f7deec3b572228268966d088aabd7a7e7311643e80e09b11fcc864a5776230d42d79135222722a377f5b60f651df03a550846ffe417f24e788e7e8a6c83081f04001567354584db4dc2b10184a663aa1a8c5886ccb90311f936c841506b6e374277b23f8b20a0b7d48f082fd56feea9020070e43b82db6481bc7d63fca6765a951e73fa17319cad08ece72568155f38fadb468337066fcbb8854a46e7dbb4d4ff01cf807ab100163cd8240f83b6d8242357ac887b0420ca6117de7a0f843288fdb71909d27cd3a56cdd00a878a96a900726989144a12a5d0efdef3d32337cdb6f1002795f2caa9625a55637c796ca2868e1766ae5b62615399a66dd50a0cc71feb988745f6d512354c91ea8fc632e797753937a95c864338084b9f267327960e2adf8d939b109e6a093a2ccd3e5dacb7dc781494711412cfa3d1f1d8036f2bbb9c43775ce3832c5f8e71dd1de58bb8e5857c32af7660fa9950877c616986b76e7ebc1fcc1667a35fc9f74db910ec00a42d09adad2eaab8ff24128ff3fd2d4172e1ca61772581e4f302173094cfb68d4445c3923849f768133315a4fe7ba2c01880af42c65d5a8e17c07b32bedba2ccbd1adaaaae6aa6ac78b773fe7ff11023797dcdb604f44d66de7596a21f38dbbe7ef06e0e0a0712e2102c8e88945578a937b3aa836ad562febada387776a5eaf24b904ccdd79406985451901d2cffbfb02b1798cd9a41456b430007fd5d50000d46fb267e115fa9561540d9d8143106914b1167798d71e80becf835fc35e3cef8ab5558e7861b92edf30a121ebd7419c6197d17654d64daa942e6bead827d667c2d4cf9fdf01d947a6ea461a1be8765bdafc471b789d19e8683ff200f261fe3052a80e2faa0acb179a0282d9cc41b41c02e1e405bcf1f58e1385a8508e0d301d291f651c9a2f74a696cdbeabdf8c451a7ce469b37e69096ac443e442eef65b54369dd081c0e578f7a218444913875be17f4383dd25db97623f4693971557edca143808c116e32aa9682a54bd56d869e84106630108224d1e271df9fe409ea480856eb1bddf3d1d21d860f7fa7f432f339e268895478e8966a65d6928859998102e5a6e01f7edc4dec7dc1e7a8f6a17890e8b78bc4a5df9aff23e64a6062aadb0703b59a7bc4a017b8facaec08206db084eaab7ceed950c5f447496d8f982a16a05431e4c5c0b0c52d42e85493b78e458667c5d33ff4c52fc9c6008ff167f16efc33e9fc1b140f15d78ece9e47834db6f12f0a0d7696b14b1b83da55fbdb22c8f89da633d4cce3322885094c5e0c4ffebd6fd56eaeac2624a9f8deb808a2847d372c4b784bad478b30fcccbba697751c24c125fdd53275fbef4318d1fea225766344fde6ea010772754807f82d6e82bf4e830ee20337f0179e9899d5dfa52314e2cad3f86959798ce51687839d5facaa6188052ee23b4e5fe9de02413d8297ffb053bd1238bf1e940e21d9d5117a6abdfb7fb35ce413cb422c61136307e0d15ff78057c695ccb8c2aa2cb16edfb6db5313baad380551269ed192334163ae0a5ffc1537795483e0e81946d867998e58da42b7ecff7e07061c092e4ae6b1e3b89b8b818e44e59e9d1c45099fd8a3236e82ba0d9b63898dfc1b01cfc4cbd42a5146624688f19491299f3e2596f91370f5e8e276b50c8139a78c740e43b6cedc73cb2c0968d35ecb41a0924d597f778f08422dfb9e03021d4ccd0e2f1cdbe1c57b7b47a4a41f9d81e3ee9b1871b59519e3e6a4818459b50a5ae9aad0ce10d90070555145d4d784fa815984798257cea4f6cbe229660bdffaef26d1245ab6720214ef133e90223c39cbc8816d23947ab341aef3e9918f6ff2354289775b4a2a90560c017b0bc4cb17be62c4d1ade9d18d7e566f5db16749b99d9a3389cb9578c9ffe3a9ffd68b2bd6234424e112da3695a24342649e8bf13c194a4eefd860c033105ac0e9980b7d5b54f399ca15f2dc535c4884430c52e9c5399d3f2b54003b4dfe75866fa8162729a5b515ccbbcdeb41dbd6310ec376cbe4561de7889325913d87953c135b7bcd31fed4cf5d62d76e5c21f933f2dca7c724fb0a6793dc4be768fe047616f8b9171132235cddce635e2f7c6cab52b21ab64fccff71756d6c91b8e2dc844bb45926993c826eb31c2c1d29ff2dc426b48384ab1f2a5162318bf953212df72ea1b2b8268520229ddf004ee81f38b1393b6555b234ba0b993f2136a029a5f3f1cf7b917764ab8a907088b9ad4fa48f0f5d0efbbb2e5cfa5ea78d8ef5a2612143561ac0c34683b1bb0d69f52474606baf2db8c779350d2227234f5dcd945397ff77d64a0fd1286c27c5eadb2bf00bd973467c1f499d8055ac2e1cd2aeb253c9db0aa21ea187e3c9f19a33b616a1113034a8ad684ec87748490d1e7bf5a1d8eb688717faabcd7064bfef2db4e918ca4d2812da82d44d0702194314bb26f8ad7ac136c24664414114076b806e56ebb81111798147142c34f320a8a38eb076deb3334446acdfee0b25076f81dd87a0c45239573592cd26b091b26aea0890f52b362df9124ec54cb177abe2a91a01964f299531a3cf04f4944f3f78c1c6c96466dd5658d9e739a1cfd27d4fd43b1a86cd27774b8586eb610e7b59a04a892902a0ea64e7e2097d15b2d57db5753185c0858a884e3514b0e917a70b71806c0a13889ffbd26af19242b67a46bb9d039f7c883c288fe7c880525aa0c772ef7a3137f187e4381194ddab62520296ffaa510522b17b42535cbc3cbb6d958712fcb6fa4a1006bfd4838c92ed585a2343b41e39e33d8af3785414f61c5f3c20b060c444d8b3e5349035d7c7e6d2180b2068176f7cf1871420877f02806d6808a7cd6ccc7228b928a1abecc94200aeee93e46a86a7ec77aa0f2b03fdd593b82d00bf641cdcd7adb5256790a1f50ef48ad8472a8a281d13d5c1374acfb34454f6ca1219060d65214f48b5022850721ea2d7f142360fb88f710f29b438134540eae18d1df60b18dcd1721ec26ecfc29785bd738956c7c79ee76b8e28a766150708afc953b3b7b32c3a075c9ad00bb4870cbf698b43c5c1db61271d264d4e50ba67f23e2c446f7a0ca4205f2d2bddeb11502b9cc9d6c701e5f334ccc339a6c1f98f25f44cb3276507950316a23fee777bfe7c36701665fa3ebe864eb999b5147baa81114971d1e3b4603e88253c62432426fbdb51d01d4cf96253d9d3581c930035decf1a6b3958fb2933c20f63cc72079bbfbe6f7efca6d16791ef7463128b0ecd69898542720f748fa4ba"}) syz_emit_ethernet(0x7a, &(0x7f0000000180)={@multicast, @empty, @val={@void, {0x8100, 0x2, 0x1}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x40, 0x3a, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, '\x00', {0x0, 0x6, '%kT', 0x0, 0x2b, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev, [@dstopts={0x2f, 0x0, '\x00', [@padn]}]}}}}}}}, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000000)={0x0, 0xc, 0x30}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f00000000c0)={r4, 0x9, 0xffff, 0x306027ef, 0x0, 0x55d}, &(0x7f0000000100)=0x14) r5 = socket(0x2, 0x3, 0xff) bind$inet(r5, 0x0, 0x0) syz_emit_ethernet(0x22, &(0x7f0000000040)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0xff, 0x0, @dev, @local}}}}}, 0x0) 11m2.507359264s ago: executing program 3 (id=2137): r0 = socket(0xa, 0x3, 0xff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) sendmsg$inet6(r0, &(0x7f0000000400)={&(0x7f0000000140)={0xa, 0xa, 0x4, @mcast2}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001080)="671723d7c6012c", 0x20}, {&(0x7f0000000200)="9efe8000000000002bdfe52c1f51218206f5abfd2a0000000c0000000000000000", 0x21}], 0x2}, 0x20008b88) 11m0.595762718s ago: executing program 3 (id=2141): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r1) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r0) sendmsg$NL80211_CMD_SET_STATION(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={0x24, r3, 0x1, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_VLAN={0x8, 0x14, r2}]}, 0x24}, 0x1, 0x0, 0x0, 0xc001}, 0x8054) 10m59.119781107s ago: executing program 3 (id=2145): sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f00000008c0)={0x34, 0x0, 0x8, 0x70bd2a, 0x25dfdbff, {}, [@NLBL_MGMT_A_DOMAIN={0x0, 0x1, '%!\x00'}, @NLBL_MGMT_A_CLPDOI={0x2d, 0xc, 0x1}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @rand_addr=0x64010100}, @NLBL_MGMT_A_CLPDOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004010}, 0x801) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'ccm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x80000) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r4, &(0x7f0000000340)={0x0, 0xffffff27, &(0x7f0000000880)={&(0x7f0000000840)={0x14, 0x6, 0x1, 0x201, 0x0, 0x0, {0x3, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0xc4}, 0x20044800) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1f, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x2}}, &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', r5, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x4c, r7, 0x1, 0x2, 0x25dfdbfb, {0x41}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x87}}]}, 0x4c}}, 0x0) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000440)=@ieee802154={0x24, @short={0x2, 0xffff, 0xaaa3}}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000540)="7cf0b457f31d17adf6ecfa5ac5cc97e3fbb926426e3987b46913486b160a47da9baea0632cb2682a53a88c071aabc4ed5c189956f96085ea23314803149d0c673a66dd5bd5544b2b19a71a6b97d5e2eb75fcf41bcf5e001f3be2b3daee8260a0c7fffed56002d3dc98e9435a", 0x6c}, {&(0x7f00000006c0)="6a7ed7ec613372792387a4333a342af6dd28560ad7bd9b88c52903c7092da6a0", 0x20}], 0x2}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r9, &(0x7f0000000000)={0x1f, 0x2, 0x3}, 0x6) r10 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r10, 0x400448e3, &(0x7f00000009c0)="c89167381a893f2de7c236d986f36c5f67d937635a397fe8233cbd7987f62bec93e634bd8f029d4dc2d8d20d1f8fa8049b909a7176d0c46c02302c6490e7309a6125aea4d31f79d38fc56f4807d64726efe76713dd1e3d5009807e93c9da9abb838c56c5b69395dab1b5f41700b859a2c0bb574bac56df28f6f63cb15d0f205d6a63f962fe046cbd498d999886d4c032961dd8a9dc624c92bdde7f1c54886345b44606dc8e814f211a4a7fb895f46b206fc3862cfdfbdd818861b48342453e") getsockopt$bt_hci(r1, 0x84, 0x84, &(0x7f0000002140)=""/4092, &(0x7f0000001080)=0xffc) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="ca0000000000000261147c000000000004000001000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xe, 0xc3, &(0x7f000000cf3d)=""/195, 0x40f00, 0x0, '\x00', 0x0, @sock_ops}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet_sctp(0x2, 0x5, 0x84) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f00000016c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r12, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r14, @ANYBLOB="30003300c0100e00ffffffffffff080211"], 0x4c}, 0x1, 0x0, 0x0, 0x200400c9}, 0x28008004) 10m56.876170124s ago: executing program 3 (id=2151): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, r1, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x400}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x40810}, 0x8810) r2 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x12, r2, 0x180000000) 10m55.475767229s ago: executing program 3 (id=2154): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r3 = socket(0x2d, 0x2, 0x0) bind$inet(r3, 0x0, 0x0) connect$can_bcm(r1, &(0x7f0000000100)={0x1d, r2}, 0x10) sendmmsg$sock(r1, &(0x7f0000001000)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000003000)="0100000003000000640000000000000000000000000000000000000000000000000000000000000002000000000000000100000001000000010000000100"/72, 0x48}], 0x1}}, {{0x0, 0x0, &(0x7f0000002200)=[{&(0x7f0000003200)="01000000030000006400000000000000000000000000000000000000000000000000000000000000000000000000000002000000010000000200", 0x3a}], 0x1}}], 0x2, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) sendmsg$can_bcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="04000000080000002000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="030000e001000000040000e0150104"], 0x48}, 0x1, 0x0, 0x0, 0xc044}, 0x8090) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001540)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x10000003, 0xb, 0x4}}}}]}, 0x40}}, 0x0) r8 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$IPT_SO_GET_INFO(r8, 0x0, 0x40, 0x0, &(0x7f0000000300)) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x2c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="7c0000e44213840400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000005c0012800900010069706970000000004c0002800400130005000900890000000800020064010101060011004e22000008000300e00000020500050000000000060011004e20000008000100", @ANYRES32=r7, @ANYBLOB="060010000500000004001300"], 0x7c}}, 0x0) 10m39.8911815s ago: executing program 32 (id=2154): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r3 = socket(0x2d, 0x2, 0x0) bind$inet(r3, 0x0, 0x0) connect$can_bcm(r1, &(0x7f0000000100)={0x1d, r2}, 0x10) sendmmsg$sock(r1, &(0x7f0000001000)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000003000)="0100000003000000640000000000000000000000000000000000000000000000000000000000000002000000000000000100000001000000010000000100"/72, 0x48}], 0x1}}, {{0x0, 0x0, &(0x7f0000002200)=[{&(0x7f0000003200)="01000000030000006400000000000000000000000000000000000000000000000000000000000000000000000000000002000000010000000200", 0x3a}], 0x1}}], 0x2, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) sendmsg$can_bcm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="04000000080000002000000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="030000e001000000040000e0150104"], 0x48}, 0x1, 0x0, 0x0, 0xc044}, 0x8090) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001540)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x10000003, 0xb, 0x4}}}}]}, 0x40}}, 0x0) r8 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$IPT_SO_GET_INFO(r8, 0x0, 0x40, 0x0, &(0x7f0000000300)) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x2c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="7c0000e44213840400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000005c0012800900010069706970000000004c0002800400130005000900890000000800020064010101060011004e22000008000300e00000020500050000000000060011004e20000008000100", @ANYRES32=r7, @ANYBLOB="060010000500000004001300"], 0x7c}}, 0x0) 1m31.967887155s ago: executing program 5 (id=4334): socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x4, 0xb, 0xdc}, 0x1, r7}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x95}, 0x8080) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r4, 0x42, 0x4000}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 1m31.142015319s ago: executing program 0 (id=4342): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'wlan0\x00', 0x1}) clock_gettime(0x0, 0x0) nanosleep(&(0x7f0000000500), &(0x7f0000000540)) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x24040800) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) 1m28.725217989s ago: executing program 5 (id=4345): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000200)={0x1f, 0xeffe, 0x3}, 0x6) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) socket$packet(0x11, 0x2, 0x300) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8153, 0x2000, 0x800, 0x9, 0x3}, 0x20) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$xdp(r2, &(0x7f00000003c0)={0x2c, 0x2, r4, 0x0, 0x0}, 0x10) mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x80000000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a30000000002c000000030a01010000000000000000010000000900030073797a30000000000900010073797a300000000054000000060a01040000000000000000010000002c0004802800018007000100637400001c00028005000300010000000800014000000012080002400000000e08000b40000000000900010073797a300000000014"], 0xc8}, 0x1, 0x0, 0x0, 0x8000}, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x8001, 0x3, 0x0, 0x0, 0x0, 0x9c2a}, 0x0, &(0x7f0000000200)={0x3ff, 0x4000000000002, 0x8000000000000, 0x9, 0x0, 0x0, 0x8000000000000000, 0x9}, 0x0, 0x0) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="44000000100001060000000000000000000000000000000001000000010000000e00030076736f636b6d6f6e30000000140012800d00010076736f636b6d6f6e"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x11, 0xb8}, [@ldst={0x5}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0xea, '\x00', 0x0, @sock_ops}, 0x48) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000000)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0xfd, 0x28c, 0x1, 0x0, 0x3}, {0x7}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb9, 0x0, 0x8000000}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) 1m28.707574176s ago: executing program 0 (id=4346): accept$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 1m27.830888268s ago: executing program 5 (id=4355): sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, 0x0, 0x0) unshare(0x400) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x100, @remote, 'gretap0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) ioctl(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCBRIDGECHAN(0xffffffffffffffff, 0x40047435, 0x0) 1m27.754048062s ago: executing program 0 (id=4356): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000000c0)={0x0, 0xa1ff, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01fffff0000000000000200100000c000280080002006c6f0000180003800400010008000200050000000800040076"], 0x38}}, 0x0) 1m27.546006458s ago: executing program 5 (id=4357): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x3}, @in={0x2, 0x4e24, @local}], 0x2c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084000000080000002001000000000000000000000000000020"], 0x58, 0x4855}, 0x24000052) 1m27.397308109s ago: executing program 5 (id=4358): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}]}, 0x34}}, 0x4084) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) 1m27.269005866s ago: executing program 4 (id=4359): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x6}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000009c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x44000}, 0x20000000) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000900)=@delchain={0x2c, 0x66, 0x221, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {}, {0xb, 0x9}}, [@TCA_CHAIN={0x8, 0xb, 0xfffffff9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8048}, 0x20004800) 1m26.920297127s ago: executing program 1 (id=4361): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x24, r1, 0x5, 0xffffffff, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0xa8, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x30, 0xe, {{{}, {0x6}, @broadcast, @device_a, @from_mac, {0x0, 0xff3}}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x72, 0x6}, @void, @void}}, @NL80211_ATTR_BEACON_TAIL={0x44, 0xf, [@random={0x1, 0x3e, "2421fd45efaa9ae71c1996dcf966b8201d38acf4088e317abf8048e676c5507293d7dd4fe16706751be3b91b19d48f029cfd65cb3465fd7f99293d4c525a"}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x8}]}, 0xa8}}, 0x0) 1m26.737474693s ago: executing program 0 (id=4362): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, 0x0) 1m26.497026062s ago: executing program 1 (id=4363): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x4001, 0x3, 0x318, 0x0, 0x0, 0x148, 0x0, 0x148, 0x280, 0x240, 0x240, 0x280, 0x240, 0x7fffffe, 0x0, {[{{@ip={@private=0xa010102, @local, 0x0, 0x0, 'ip6gretap0\x00', 'nicvf0\x00', {}, {}, 0x88, 0x3, 0x10}, 0x0, 0xf8, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'wg1\x00', {0x0, 0x0, 0x401, 0x100000, 0x0, 0xed, 0x10000007}}}, @common=@unspec=@connmark={{0x30}, {0xfffffff9, 0x8}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x85d, 0xb, [0x10, 0x31, 0x1e, 0x32, 0x2b, 0x25, 0x3f, 0x17, 0x19, 0x22, 0x2c, 0x3d, 0x7, 0x3f, 0x1e, 0x31], 0x0, 0x2, 0x2}}}, {{@ip={@rand_addr=0x64010101, @local, 0xff, 0x0, 'tunl0\x00', 'lo\x00', {0xff}, {}, 0x2e, 0x3, 0x4}, 0x0, 0xc0, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0xfff, 0x7e, 0x1c, 'netbios-ns\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x378) bind$unix(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x2, 0x3, 0x6) bind$inet(r1, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f00000000c0)=0x6, 0x4) sendto$inet(r1, 0x0, 0x0, 0x48800, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) sendto$inet(r1, &(0x7f00000023c0)="8ce2ad4d4f95e087a7846d3f81", 0x14, 0x0, &(0x7f0000002400)={0x2, 0x0, @multicast2}, 0x10) 1m26.48629221s ago: executing program 0 (id=4364): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0xf}, {0x0, 0xffff}, {0x300, 0x2}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x2}, @empty, @private=0xa0100fd, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r1, &(0x7f0000000500)=ANY=[], 0xfdef) 1m25.890606522s ago: executing program 1 (id=4365): r0 = accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={0x0}, 0x1, 0x0, 0x0, 0x8080}, 0x0) 1m25.689337059s ago: executing program 1 (id=4366): accept$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 1m25.224269472s ago: executing program 2 (id=4368): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x3}, @in={0x2, 0x4e24, @local}], 0x2c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084000000080000002001000000000000000000000000000020"], 0x58, 0x4855}, 0x24000052) 1m25.11801834s ago: executing program 2 (id=4369): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, 0x0, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000004780)=[{&(0x7f0000003700)="2e68e9ded130760fe7e5ab02a81a24a7f987a422301e120900f5e5e62f756657146cab9f839aecc0aba23bda2cc29009a42761e23c8ff64c069415255574a20831c52eb7696af180e518565bac6b6c1ab36cf5f476612fddfc4f24f168e03f1b0902d24154444365e091fdb170bbf854a1d56e3d0bce762f761d2821be67c6b610762dffa104b93bf0c0a1dc95d18a36567be2f395f34a6d112812b8813fc3ee3df1958a6586c08e7d0048a2b8ef8715b598b5263dea3d4f0d331ef17577bee31762fcdca1dfa808e2f2e220b9881f27726e6c08121b52dc74792d7c6496bbe417b9084a536b2f885896206aed6df4f4169dd9a195eff28d5d7c6c4ba6c25b769166faa0b4420ecaed89a3283469011c4e28bfb5732f4a67e996eea20e4d532968153225b5ccda6c79ba242dd373bb33fccd7a716f60c446fef3a83e90d8776aab6f6a3b12370c164ace4d3af0c9ba7a3341d203035efb233f37d1bf48ac7a33d25fd4e83e1de195ddcf1077fef0af8e9bb5b3439fae44393c185b6ae2649bf3e6f906f700f8ef57839529ed0a0a31512d4adb6e057f08c63b8a8f5ef31a01387244997a7122c8eb9d9feec31999a04be7e526ce224c6e51ef49b2d92946fd9b5e4b127efc82a61ac00b3a8da6812b92e59e713b78a445decdf2a1ffd704d0e0e0cb31becd6b97dfd7dfcc283d372d4ee424d267375020259c9b170834dfcb257df85f3f4c9cf08ab1c92262c6ae15faadea356fce7b49685cdd484d63305571a3607fb3b2602875ae6f1c722c69135d424acf05300a493fa1af7512e24d377805d0c9aece3538ce3f08a4f139232749f888625499bb7944878b4d082e7e10e9e21c1fa334796ee308ea3a79d96c5374ba768105065027e28bc2b640ed6547c4fa475536de8b6eefdc78f3882c726d401a48dc4387f644f6eb99bb7e61ad1363175c0245d9f600eede91e53bca6035b5a568390fdba000c43bc19157a358b4a94dba267a1266b14fe2edfa2295219b9f71cd891e4d73b11c37e92cf8f46d373c08139e124032e0359e6ece37d1623b275cc2bec7b218d9a807e9974e6801256b3f7aaf37eef7df9d26e53ed0f7bbf480bd321e9d2a8aebfebecfba98d985922c5caac6d64e77832b5a3ffe01d58358c7e0106991cf043c9defdceb8108e74d2a174b9522705f92a2d5c1196280d7414d15df725f9dc1c3964aab544ab39499b9aff3291696a78667cd2ab382712f9b5e11a2d292d37ee05879f78c48c72d95bb89ed9b37d2e1bda19cafef89b3a899449175b8c496a2d26de284b68360a3dd18af8583ef7a940d8ec438d4ac481c2846a4e95f05a3d41a3f26af512de7449307147951782dbd36dd944b39904752e6505f00fdc52856a0ee683e57dd863014819877c589163dca35b260d6370326bf6587e482a39249f81bbf2ecdc252d29aae6cf53d30e97a047648f6acb1e7084c0d506648d1835d49cfe7d8be6717f45753cccfb11b1fd0a4ac0af85c6119051778cbcee53f7b9355501dfc3ed606a663389211ce37fd66e4147cbc0529b83636324fe9b3cc7391852f3dedc94e424bfcbf46741ebefb8e4b755f6d0e1af9c98e46a3e562f892df0fe344157816b2c7a13fbe915585f2fbf48fc7966ab9b2db8bd80559f2cc421b205e5012c2d2d6eb209e155a2387facf7011768675efa688ecd6a111d91caaf4d8941a1240022a58050a63c48d947e11b8232a60292b993bb84e7e967f58c9559fc19f4a8b26f58f16e197b437db5097467c675bc7834ff4702fca75bb4c805b33b5cf6ddf37e5168ad6c189295b9a9337d7ada569982287883f16a50519d1e93f3f38da4d50099cb29ac776e05a3735ac2cbce2fb5388b293c92055edff8ed1eddb9536f051ce50411f8b69e126715bc9f4bfec340f3842cdc0fb51d8814fd70febfd140a6d2adea175acfe21a1c4522fab147bbec10937ccb9f165114849e68c09451a05e79f8cf6ebf06abcb16f150b6a2243174e990b8e814f282324892f98e36cb31772a1ff05a3239a7c632cd5bef6206a7442a91838357d87b9c148be65bbbdcad1298440419cc9cb2870c4315ba6bfcd94b231c6b717ad365660125f6a321ab6a9f1592ff6423b19cd513986f63c718ed33fce8ed3a8565078ce7e230528001edf27262c0d1fb44d6435e18de9f8eea31927530d5d2ec0218ecc30b4d35d86fed251dcb68f9cb9671d33d607c6d38a726a94a2f0ec119bc53b09b1d724146a14bf81839d342c40e5df043c59079f3c6b6ef4778eb5c9030e0d736f6a7789228dae87e2d3f039b63881c2fc534e58e1aac5f27677ebf2dbf5d0a4ff0d221684d3e2d5b5618a9889a2803119ed929602a17b1eedb604c1bad6a93844c466286760191df4fd4421931e5f208b6e43159f72dcd0a9d732548cd767eff4b204fbe3e9b8b78ea6d77faa9c46b4509433c429cce4cbf21286e5822cc3ba50d414a0bc38e34779d30576a802bb495c07ee31c8846f5bcce407fb9b2de50f6d5ae5464e3360aa2aee2de8027ad7739def357baf760d86b01302af318e6a0e29b922040a2ea544805918c1f34db50ddee8d7fdbeb02a6c8d95040d3238bfe68876c9661d16986023b9d184c5d2a18ca1f7548b7032970e76f4ccfea1fb325f5f700ed70c1ba2540b016476522d69a707a741242e8c25d10e6a1206dfbb5252ac3b9387322efacf8e2811b368bc4f08daab39dff87f266b87492aabee77a10f0307c927cdf2f34a6f2ed6902b9bfd1b940db926149c70515fc2be3f726b9faef89a594129aae007ae4b4cdf53ae792b42235d1977a1aac2ef5a60c9e4bce58f9bdc9e78de2fb48457e8fe774f3fdd33d05b3e36e3d3867d520854549ecc274579f5eb5be4e0f7105bd2882b96179112e42b5005b1c3760ac36324ab70bc3c203102abf245819f91c6f1afcc7a5afe2f408560e1d19ee1d70a3771c5f749aec86c481af2b367a2839c83d83f27008af96d7eb23af5f15566eef76128d43ea11fafa62055a94f5abe3b8413814c063113ed4968fc7a2543f66269302498e1f9995cda04c82301de02879e07cc6efcee2859730e1ef99dc39dbf7b39ad78a3c601e0fec0a4f3b701aa08bc766b91cd7bde680aa606933ce76bd825f8da9e380f6c860b96dbb4c323532450fc7478f32e9c0246f23aecee9c567f9a3d28d423527838643ae2ec597760247af3ea6c64eeff7d2d73a01a5a4ea13a5caab84df97721f83784a697fdf17b7b9629e773fdedb2b3bd0a8bcdc1b1a1e78d271502fd0786c4e92734ef697b04b19be2cf47b7718cb564c7d4be294c92a44cd631f83e144f0354251c1ab5e55aab0fad1ac8b3930bcf5b7ae37723c26f68a37f746d0d10f85353c5016e569c80551be064a2acb13e0fe421cfcbb7d50ad13e33450fb7145bcd0f4d722b206ac34f7a2b23724deed88233d7c2784d6d6b988bab3a052de3779e23d92c3491fde75790fffe801a3067f9348a31d78bc6789ed5bb1867c42ddb4f77e1b3213590f26d3d9c4a0708e01614c730c568d99432be3756db2fca46dad796cd2569e6bd2a7e904da5e4242c2d247243326113c5ffaa4e26e1620e73f106465541930da4bdd011ecd6534a150b2fb15e9942084f513e39d69c5313ace54d0cff3335adc95fec346c7ac37b2949a922039ed6992c6a5f1264c78c2d470c6954dda60372ada47ba3c32670d572e5ab428b08f0a0323863ff644ce6f0f80c00bab65fc46f341d41f0cf168bfe1ff523a45877c4e5615fe47ac65121decce241bad766516b499bfc810aae9f0ee755e02df11e110cf874fbc140236d21155b209d268b291bd009ee70cbd23a8f2751f6515dce1d8af8ecdeb9b8d33c213adf0d19893480314901fcb256081e98d71a24b7745cd9652cf35b9d62342c01a23cf0188f53c646dc1cd0c504c4d81ef3a04ee5b4c6c22d847da5b73ec649ab250c2b", 0xaf5}, {&(0x7f0000004700)="2a70580b0b578c5cd8a2421c81f7f49c14d5c1fd749d1e623748e403704fc9158bff8bab475fe6b1af01b72c3d9e11e8c4acf591a3393a18247862dc", 0x3c}], 0x2}}], 0x1, 0x2090) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a06", 0x196) 1m24.831257599s ago: executing program 1 (id=4370): socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) syz_open_procfs$namespace(0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r0, 0x215eb000) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f4, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r2, 0x0, 0x0) writev(r4, &(0x7f00000003c0)=[{&(0x7f00000002c0)="390000001300034700000000c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff080004000000000000000042a47bf6275137277296214e21b4736557bc47929fb15f339599b6f4a75c703db114355c1c7fc97a7df899732605e0be69fda0450d1f487f40bdd962541a9b1e2feec7cfb655c5648170680367877fe0762ef369827730052c37d940c96aca81da9c68f5c5d8bb", 0xa0}], 0x1) 1m24.26496384s ago: executing program 1 (id=4371): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffe, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r4) 1m24.191733063s ago: executing program 2 (id=4372): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1ff}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001600)=ANY=[@ANYBLOB="07000000040000001800000001"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x0, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2a}]}, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x9, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000001000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r1}, 0xc) 1m24.073959302s ago: executing program 2 (id=4373): socket(0x1e, 0x4, 0x0) socket$packet(0x11, 0x2, 0x300) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) connect$bt_l2cap(r0, &(0x7f0000000140)={0x1f, 0x805, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000080)={0x4, 0x4}, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3fd, 0x0, 0x0, 0x9, 0x0, 0x400000000000, 0x7fffffff}, 0x0, 0x0) 1m23.913300092s ago: executing program 2 (id=4374): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f00000000c0)={r1, r1, 0x7, 0x0, 0x0, 0xe, 0x4, 0x16c0, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) 1m23.869102313s ago: executing program 2 (id=4375): syz_emit_ethernet(0x0, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) r2 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000380)={0x1d, r3, 0x2, {0x2, 0x0, 0x2}}, 0x18) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000380)={0x1d, r5, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@deltclass={0x24, 0x29, 0x1, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0xfff3, 0xffff}, {0xfff1, 0xd}, {0xb, 0x7}}}, 0x24}}, 0x4000050) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000011"], 0x30}], 0x1}, 0x0) 1m23.540612618s ago: executing program 5 (id=4376): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, 0x0) syz_genetlink_get_family_id$smc(&(0x7f0000000280), r0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r5, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500090000001400040073"], 0x58}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b"], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}}, 0x0) 1m23.518380487s ago: executing program 0 (id=4377): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x1, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x7}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x200448e4}, 0x44890) socket$kcm(0x11, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) 1m23.45794806s ago: executing program 4 (id=4378): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$OSF_MSG_ADD(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="680200000005030000000000000000000500000254020100010000000000008001050900ff00120073797a310000000000000000000000000000000000000000000000000000000083536fbebb759c421376cc71fc07dd45365540742570280cc97680299f52a2d35d606f739128a0826de95fedb865085504ce24b5735bcc31c9eff26500080700"], 0x268}, 0x1, 0x0, 0x0, 0x40001}, 0x800) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01fffc00000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004"], 0x38}}, 0x0) recvmmsg(r0, &(0x7f0000000e40)=[{{0x0, 0x0, 0x0}, 0xffff}], 0x1, 0x0, 0x0) 1m23.174595833s ago: executing program 4 (id=4379): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x3}, @in={0x2, 0x4e24, @local}], 0x2c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa00000000200000000000000084000000080000002001000000000000000000000000000020"], 0x58, 0x4855}, 0x24000052) 1m23.091556502s ago: executing program 4 (id=4380): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 1m22.179297216s ago: executing program 4 (id=4381): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r0, 0x1, 0xffffffff, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x64}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2c}}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x4c}}, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000044000180060001000200000008000500000000000c000700000000000000"], 0x58}, 0x1, 0x0, 0x0, 0x4810}, 0x0) 1m22.065288052s ago: executing program 4 (id=4382): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, 0x0, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, &(0x7f0000004780)=[{&(0x7f0000003700)="2e68e9ded130760fe7e5ab02a81a24a7f987a422301e120900f5e5e62f756657146cab9f839aecc0aba23bda2cc29009a42761e23c8ff64c069415255574a20831c52eb7696af180e518565bac6b6c1ab36cf5f476612fddfc4f24f168e03f1b0902d24154444365e091fdb170bbf854a1d56e3d0bce762f761d2821be67c6b610762dffa104b93bf0c0a1dc95d18a36567be2f395f34a6d112812b8813fc3ee3df1958a6586c08e7d0048a2b8ef8715b598b5263dea3d4f0d331ef17577bee31762fcdca1dfa808e2f2e220b9881f27726e6c08121b52dc74792d7c6496bbe417b9084a536b2f885896206aed6df4f4169dd9a195eff28d5d7c6c4ba6c25b769166faa0b4420ecaed89a3283469011c4e28bfb5732f4a67e996eea20e4d532968153225b5ccda6c79ba242dd373bb33fccd7a716f60c446fef3a83e90d8776aab6f6a3b12370c164ace4d3af0c9ba7a3341d203035efb233f37d1bf48ac7a33d25fd4e83e1de195ddcf1077fef0af8e9bb5b3439fae44393c185b6ae2649bf3e6f906f700f8ef57839529ed0a0a31512d4adb6e057f08c63b8a8f5ef31a01387244997a7122c8eb9d9feec31999a04be7e526ce224c6e51ef49b2d92946fd9b5e4b127efc82a61ac00b3a8da6812b92e59e713b78a445decdf2a1ffd704d0e0e0cb31becd6b97dfd7dfcc283d372d4ee424d267375020259c9b170834dfcb257df85f3f4c9cf08ab1c92262c6ae15faadea356fce7b49685cdd484d63305571a3607fb3b2602875ae6f1c722c69135d424acf05300a493fa1af7512e24d377805d0c9aece3538ce3f08a4f139232749f888625499bb7944878b4d082e7e10e9e21c1fa334796ee308ea3a79d96c5374ba768105065027e28bc2b640ed6547c4fa475536de8b6eefdc78f3882c726d401a48dc4387f644f6eb99bb7e61ad1363175c0245d9f600eede91e53bca6035b5a568390fdba000c43bc19157a358b4a94dba267a1266b14fe2edfa2295219b9f71cd891e4d73b11c37e92cf8f46d373c08139e124032e0359e6ece37d1623b275cc2bec7b218d9a807e9974e6801256b3f7aaf37eef7df9d26e53ed0f7bbf480bd321e9d2a8aebfebecfba98d985922c5caac6d64e77832b5a3ffe01d58358c7e0106991cf043c9defdceb8108e74d2a174b9522705f92a2d5c1196280d7414d15df725f9dc1c3964aab544ab39499b9aff3291696a78667cd2ab382712f9b5e11a2d292d37ee05879f78c48c72d95bb89ed9b37d2e1bda19cafef89b3a899449175b8c496a2d26de284b68360a3dd18af8583ef7a940d8ec438d4ac481c2846a4e95f05a3d41a3f26af512de7449307147951782dbd36dd944b39904752e6505f00fdc52856a0ee683e57dd863014819877c589163dca35b260d6370326bf6587e482a39249f81bbf2ecdc252d29aae6cf53d30e97a047648f6acb1e7084c0d506648d1835d49cfe7d8be6717f45753cccfb11b1fd0a4ac0af85c6119051778cbcee53f7b9355501dfc3ed606a663389211ce37fd66e4147cbc0529b83636324fe9b3cc7391852f3dedc94e424bfcbf46741ebefb8e4b755f6d0e1af9c98e46a3e562f892df0fe344157816b2c7a13fbe915585f2fbf48fc7966ab9b2db8bd80559f2cc421b205e5012c2d2d6eb209e155a2387facf7011768675efa688ecd6a111d91caaf4d8941a1240022a58050a63c48d947e11b8232a60292b993bb84e7e967f58c9559fc19f4a8b26f58f16e197b437db5097467c675bc7834ff4702fca75bb4c805b33b5cf6ddf37e5168ad6c189295b9a9337d7ada569982287883f16a50519d1e93f3f38da4d50099cb29ac776e05a3735ac2cbce2fb5388b293c92055edff8ed1eddb9536f051ce50411f8b69e126715bc9f4bfec340f3842cdc0fb51d8814fd70febfd140a6d2adea175acfe21a1c4522fab147bbec10937ccb9f165114849e68c09451a05e79f8cf6ebf06abcb16f150b6a2243174e990b8e814f282324892f98e36cb31772a1ff05a3239a7c632cd5bef6206a7442a91838357d87b9c148be65bbbdcad1298440419cc9cb2870c4315ba6bfcd94b231c6b717ad365660125f6a321ab6a9f1592ff6423b19cd513986f63c718ed33fce8ed3a8565078ce7e230528001edf27262c0d1fb44d6435e18de9f8eea31927530d5d2ec0218ecc30b4d35d86fed251dcb68f9cb9671d33d607c6d38a726a94a2f0ec119bc53b09b1d724146a14bf81839d342c40e5df043c59079f3c6b6ef4778eb5c9030e0d736f6a7789228dae87e2d3f039b63881c2fc534e58e1aac5f27677ebf2dbf5d0a4ff0d221684d3e2d5b5618a9889a2803119ed929602a17b1eedb604c1bad6a93844c466286760191df4fd4421931e5f208b6e43159f72dcd0a9d732548cd767eff4b204fbe3e9b8b78ea6d77faa9c46b4509433c429cce4cbf21286e5822cc3ba50d414a0bc38e34779d30576a802bb495c07ee31c8846f5bcce407fb9b2de50f6d5ae5464e3360aa2aee2de8027ad7739def357baf760d86b01302af318e6a0e29b922040a2ea544805918c1f34db50ddee8d7fdbeb02a6c8d95040d3238bfe68876c9661d16986023b9d184c5d2a18ca1f7548b7032970e76f4ccfea1fb325f5f700ed70c1ba2540b016476522d69a707a741242e8c25d10e6a1206dfbb5252ac3b9387322efacf8e2811b368bc4f08daab39dff87f266b87492aabee77a10f0307c927cdf2f34a6f2ed6902b9bfd1b940db926149c70515fc2be3f726b9faef89a594129aae007ae4b4cdf53ae792b42235d1977a1aac2ef5a60c9e4bce58f9bdc9e78de2fb48457e8fe774f3fdd33d05b3e36e3d3867d520854549ecc274579f5eb5be4e0f7105bd2882b96179112e42b5005b1c3760ac36324ab70bc3c203102abf245819f91c6f1afcc7a5afe2f408560e1d19ee1d70a3771c5f749aec86c481af2b367a2839c83d83f27008af96d7eb23af5f15566eef76128d43ea11fafa62055a94f5abe3b8413814c063113ed4968fc7a2543f66269302498e1f9995cda04c82301de02879e07cc6efcee2859730e1ef99dc39dbf7b39ad78a3c601e0fec0a4f3b701aa08bc766b91cd7bde680aa606933ce76bd825f8da9e380f6c860b96dbb4c323532450fc7478f32e9c0246f23aecee9c567f9a3d28d423527838643ae2ec597760247af3ea6c64eeff7d2d73a01a5a4ea13a5caab84df97721f83784a697fdf17b7b9629e773fdedb2b3bd0a8bcdc1b1a1e78d271502fd0786c4e92734ef697b04b19be2cf47b7718cb564c7d4be294c92a44cd631f83e144f0354251c1ab5e55aab0fad1ac8b3930bcf5b7ae37723c26f68a37f746d0d10f85353c5016e569c80551be064a2acb13e0fe421cfcbb7d50ad13e33450fb7145bcd0f4d722b206ac34f7a2b23724deed88233d7c2784d6d6b988bab3a052de3779e23d92c3491fde75790fffe801a3067f9348a31d78bc6789ed5bb1867c42ddb4f77e1b3213590f26d3d9c4a0708e01614c730c568d99432be3756db2fca46dad796cd2569e6bd2a7e904da5e4242c2d247243326113c5ffaa4e26e1620e73f106465541930da4bdd011ecd6534a150b2fb15e9942084f513e39d69c5313ace54d0cff3335adc95fec346c7ac37b2949a922039ed6992c6a5f1264c78c2d470c6954dda60372ada47ba3c32670d572e5ab428b08f0a0323863ff644ce6f0f80c00bab65fc46f341d41f0cf168bfe1ff523a45877c4e5615fe47ac65121decce241bad766516b499bfc810aae9f0ee755e02df11e110cf874fbc140236d21155b209d268b291bd009ee70cbd23a8f2751f6515dce1d8af8ecdeb9b8d33c213adf0d19893480314901fcb256081e98d71a24b7745cd9652cf35b9d62342c01a23cf0188f53c646dc1cd0c504c4d81ef3a04ee5b4c6c22d847da5b73ec649ab250c2b", 0xaf5}, {&(0x7f0000004700)="2a70580b0b578c5cd8a2421c81f7f49c14d5c1fd749d1e623748e403704fc9158bff8bab475fe6b1af01b72c3d9e11e8c4acf591a3393a18247862dc", 0x3c}], 0x2}}], 0x1, 0x2090) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a06", 0x196) 0s ago: executing program 33 (id=4377): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff5656d, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x1, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x7}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x200448e4}, 0x44890) socket$kcm(0x11, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) kernel console output (not intermixed with test programs): 115][T15563] ? __alloc_skb+0x27a/0x7a0 [ 737.594139][T15563] ? __pfx__copy_from_iter+0x10/0x10 [ 737.594161][T15563] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 737.594189][T15563] ? __alloc_skb+0x27a/0x7a0 [ 737.594211][T15563] ? __alloc_skb+0x27a/0x7a0 [ 737.594241][T15563] ? netlink_sendmsg+0x650/0xb40 [ 737.594277][T15563] ? skb_put+0x112/0x210 [ 737.594305][T15563] netlink_sendmsg+0x6c0/0xb40 [ 737.594343][T15563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.594380][T15563] ? apparmor_socket_sendmsg+0x98/0x360 [ 737.594405][T15563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.594432][T15563] sock_sendmsg_nosec+0x13a/0x180 [ 737.594456][T15563] ____sys_sendmsg+0x54e/0x850 [ 737.594489][T15563] ? __pfx_____sys_sendmsg+0x10/0x10 [ 737.594533][T15563] ? import_iovec+0x73/0xa0 [ 737.594562][T15563] ___sys_sendmsg+0x2a5/0x360 [ 737.594587][T15563] ? __lock_acquire+0x747/0x2de0 [ 737.594614][T15563] ? __pfx____sys_sendmsg+0x10/0x10 [ 737.594676][T15563] ? __fget_files+0x2a/0x420 [ 737.594702][T15563] ? __fget_files+0x3a2/0x420 [ 737.594740][T15563] __x64_sys_sendmsg+0x1b1/0x290 [ 737.594781][T15563] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 737.594830][T15563] do_syscall_64+0x166/0x520 [ 737.594854][T15563] ? trace_irq_disable+0x3b/0x140 [ 737.594874][T15563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.594895][T15563] ? clear_bhb_loop+0x70/0xc0 [ 737.594921][T15563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.594941][T15563] RIP: 0033:0x7f678c99e159 [ 737.594962][T15563] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.594979][T15563] RSP: 002b:00007f678d7a7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 737.595002][T15563] RAX: ffffffffffffffda RBX: 00007f678cc25fa0 RCX: 00007f678c99e159 [ 737.595016][T15563] RDX: 0000000000000040 RSI: 0000200000000140 RDI: 0000000000000004 [ 737.595030][T15563] RBP: 00007f678d7a7090 R08: 0000000000000000 R09: 0000000000000000 [ 737.595043][T15563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.595055][T15563] R13: 00007f678cc26038 R14: 00007f678cc25fa0 R15: 00007fff552cabd8 [ 737.595087][T15563] [ 737.639103][T15088] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 737.772097][T15088] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 737.931997][ T1043] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.932064][ T1043] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.932094][ T1043] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.932123][ T1043] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 738.224858][T15566] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2967'. [ 738.624372][T15573] veth1_to_bond: entered allmulticast mode [ 738.653111][T15573] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2968'. [ 738.695225][T15576] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2970'. [ 739.018126][T15573] veth1_to_bond (unregistering): left allmulticast mode [ 739.067310][T15573] bond0: (slave bond_slave_1): Releasing backup interface [ 739.333399][T15549] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 739.333428][T15549] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 739.487529][T15549] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 739.487564][T15549] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 739.744493][T15549] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 739.744557][T15549] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 740.376312][T15593] netlink: 'syz.1.2973': attribute type 1 has an invalid length. [ 740.475164][T15592] team0: No ports can be present during mode change [ 740.625055][T15591] netlink: 'syz.1.2973': attribute type 29 has an invalid length. [ 740.625080][T15591] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2973'. [ 740.782777][T15593] netlink: 'syz.1.2973': attribute type 29 has an invalid length. [ 740.782843][T15593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2973'. [ 741.246824][T15549] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 741.246853][T15549] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 741.266686][T15607] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2976'. [ 742.002795][ T2988] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.002865][ T2988] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.246731][T14696] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.246757][T14696] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.841429][T15627] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2984'. [ 743.713993][T15645] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 743.984339][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 743.992405][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 743.998688][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 744.016093][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 744.018846][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 744.477747][T15649] syzkaller0: entered promiscuous mode [ 744.477809][T15649] syzkaller0: entered allmulticast mode [ 746.128124][T13355] Bluetooth: hci5: command tx timeout [ 746.373623][T15708] netlink: 252 bytes leftover after parsing attributes in process `syz.2.3001'. [ 746.404623][T15702] 8021q: adding VLAN 0 to HW filter on device bond1 [ 746.487205][T15702] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3000'. [ 746.487229][T15702] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3000'. [ 746.566256][T15713] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3003'. [ 746.778804][T15702] 8021q: adding VLAN 0 to HW filter on device bond0 [ 746.824271][T15702] bond1: (slave bond0): making interface the new active one [ 746.849056][T15702] bond1: (slave bond0): Enslaving as an active interface with an up link [ 747.249988][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.757795][T15739] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3012'. [ 747.804885][T15736] netlink: 'syz.2.3010': attribute type 1 has an invalid length. [ 748.208101][T13355] Bluetooth: hci5: command tx timeout [ 748.247550][T15736] 8021q: adding VLAN 0 to HW filter on device bond10 [ 748.622496][T15767] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3017'. [ 748.911166][T15772] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3019'. [ 749.068273][T15775] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.069246][T15777] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.151602][T15782] netlink: 348 bytes leftover after parsing attributes in process `syz.2.3022'. [ 749.491690][T15646] bridge0: port 1(bridge_slave_0) entered blocking state [ 749.493317][T15646] bridge0: port 1(bridge_slave_0) entered disabled state [ 749.494281][T15646] bridge_slave_0: entered allmulticast mode [ 749.525253][T15646] bridge_slave_0: entered promiscuous mode [ 749.539840][T15646] bridge0: port 2(bridge_slave_1) entered blocking state [ 749.539961][T15646] bridge0: port 2(bridge_slave_1) entered disabled state [ 749.540137][T15646] bridge_slave_1: entered allmulticast mode [ 749.546817][T15646] bridge_slave_1: entered promiscuous mode [ 749.653433][T15798] sysfs: cannot create duplicate filename '/class/ieee80211/1ща^!' [ 749.653455][T15798] CPU: 1 UID: 0 PID: 15798 Comm: syz.1.3024 Not tainted syzkaller #0 PREEMPT(full) [ 749.653481][T15798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 749.653495][T15798] Call Trace: [ 749.653505][T15798] [ 749.653516][T15798] dump_stack_lvl+0xe8/0x150 [ 749.653558][T15798] sysfs_warn_dup+0x8e/0xa0 [ 749.653608][T15798] sysfs_do_create_link_sd+0xc0/0x110 [ 749.653646][T15798] device_add_class_symlinks+0x1cf/0x240 [ 749.653681][T15798] device_add+0x467/0xb80 [ 749.653709][T15798] wiphy_register+0x1fc8/0x2ff0 [ 749.653757][T15798] ? __pfx_wiphy_register+0x10/0x10 [ 749.653782][T15798] ? __pfx_netdev_run_todo+0x10/0x10 [ 749.653819][T15798] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 749.653862][T15798] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 749.653895][T15798] ieee80211_register_hw+0x3dbb/0x4b00 [ 749.653939][T15798] ? ieee80211_register_hw+0x1981/0x4b00 [ 749.654002][T15798] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 749.654034][T15798] ? __asan_memset+0x22/0x50 [ 749.654060][T15798] ? __hrtimer_setup+0x1b7/0x260 [ 749.654084][T15798] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 749.654112][T15798] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 749.654160][T15798] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 749.654179][T15798] ? kstrndup+0xbd/0x160 [ 749.654203][T15798] ? kstrndup+0xbd/0x160 [ 749.654224][T15798] hwsim_new_radio_nl+0xd8b/0xf90 [ 749.654260][T15798] genl_family_rcv_msg_doit+0x233/0x340 [ 749.654289][T15798] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 749.654322][T15798] ? bpf_lsm_capable+0x9/0x20 [ 749.654339][T15798] ? security_capable+0x7e/0x2c0 [ 749.654366][T15798] genl_rcv_msg+0x614/0x7a0 [ 749.654392][T15798] ? __pfx_genl_rcv_msg+0x10/0x10 [ 749.654411][T15798] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 749.654444][T15798] netlink_rcv_skb+0x226/0x4a0 [ 749.654469][T15798] ? __pfx_genl_rcv_msg+0x10/0x10 [ 749.654490][T15798] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 749.654529][T15798] ? down_read+0x2be/0x330 [ 749.654556][T15798] genl_rcv+0x28/0x40 [ 749.654573][T15798] netlink_unicast+0x7bd/0x940 [ 749.654614][T15798] netlink_sendmsg+0x813/0xb40 [ 749.654647][T15798] ? __pfx_netlink_sendmsg+0x10/0x10 [ 749.654679][T15798] ? apparmor_socket_sendmsg+0x98/0x360 [ 749.654700][T15798] ? __pfx_netlink_sendmsg+0x10/0x10 [ 749.654722][T15798] sock_sendmsg_nosec+0x13a/0x180 [ 749.654743][T15798] ____sys_sendmsg+0x54e/0x850 [ 749.654773][T15798] ? __pfx_____sys_sendmsg+0x10/0x10 [ 749.654813][T15798] ? import_iovec+0x73/0xa0 [ 749.654845][T15798] ___sys_sendmsg+0x2a5/0x360 [ 749.654868][T15798] ? __lock_acquire+0x747/0x2de0 [ 749.654891][T15798] ? __pfx____sys_sendmsg+0x10/0x10 [ 749.654949][T15798] ? __fget_files+0x2a/0x420 [ 749.654970][T15798] ? __fget_files+0x3a2/0x420 [ 749.655002][T15798] __x64_sys_sendmsg+0x1b1/0x290 [ 749.655026][T15798] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 749.655069][T15798] do_syscall_64+0x166/0x520 [ 749.655089][T15798] ? trace_irq_disable+0x3b/0x140 [ 749.655104][T15798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.655122][T15798] ? clear_bhb_loop+0x70/0xc0 [ 749.655143][T15798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.655159][T15798] RIP: 0033:0x7f691699e159 [ 749.655176][T15798] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 749.655190][T15798] RSP: 002b:00007f6917890028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 749.655211][T15798] RAX: ffffffffffffffda RBX: 00007f6916c25fa0 RCX: 00007f691699e159 [ 749.655223][T15798] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000003 [ 749.655234][T15798] RBP: 00007f6916a3506b R08: 0000000000000000 R09: 0000000000000000 [ 749.655244][T15798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 749.655254][T15798] R13: 00007f6916c26038 R14: 00007f6916c25fa0 R15: 00007ffc26caad38 [ 749.655284][T15798] [ 749.805924][T15646] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 749.945647][T15646] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 750.288196][T13355] Bluetooth: hci5: command tx timeout [ 750.314999][T15646] team0: Port device team_slave_0 added [ 750.331773][T15646] team0: Port device team_slave_1 added [ 750.395091][T15646] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 750.395111][T15646] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 750.395138][T15646] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 750.397215][T15646] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 750.397230][T15646] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 750.397255][T15646] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 750.508699][T15807] FAULT_INJECTION: forcing a failure. [ 750.508699][T15807] name failslab, interval 1, probability 0, space 0, times 0 [ 750.508735][T15807] CPU: 0 UID: 0 PID: 15807 Comm: syz.1.3028 Not tainted syzkaller #0 PREEMPT(full) [ 750.508757][T15807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 750.508769][T15807] Call Trace: [ 750.508778][T15807] [ 750.508788][T15807] dump_stack_lvl+0xe8/0x150 [ 750.508822][T15807] should_fail_ex+0x410/0x560 [ 750.508850][T15807] ? __alloc_skb+0x1db/0x7a0 [ 750.508874][T15807] should_failslab+0xa8/0x100 [ 750.508900][T15807] ? __alloc_skb+0x1db/0x7a0 [ 750.508921][T15807] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 750.508952][T15807] ? __alloc_skb+0x18d/0x7a0 [ 750.508975][T15807] ? __alloc_skb+0x1db/0x7a0 [ 750.509006][T15807] __alloc_skb+0x1db/0x7a0 [ 750.509033][T15807] netlink_dump+0x1e7/0xee0 [ 750.509077][T15807] ? __pfx_netlink_dump+0x10/0x10 [ 750.509120][T15807] ? genl_start+0x497/0x6d0 [ 750.509151][T15807] __netlink_dump_start+0x589/0x7b0 [ 750.509188][T15807] genl_family_rcv_msg_dumpit+0x213/0x310 [ 750.509216][T15807] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 750.509239][T15807] ? genl_get_cmd+0x6cc/0x960 [ 750.509264][T15807] ? __pfx___mutex_lock+0x10/0x10 [ 750.509291][T15807] ? __pfx_genl_start+0x10/0x10 [ 750.509312][T15807] ? __pfx_genl_dumpit+0x10/0x10 [ 750.509332][T15807] ? __pfx_genl_done+0x10/0x10 [ 750.509357][T15807] ? __dev_queue_xmit+0x29b/0x3820 [ 750.509467][T15807] genl_rcv_msg+0x5e1/0x7a0 [ 750.509498][T15807] ? __pfx_genl_rcv_msg+0x10/0x10 [ 750.509530][T15807] ? __pfx_tipc_nl_node_dump_link+0x10/0x10 [ 750.509639][T15807] netlink_rcv_skb+0x226/0x4a0 [ 750.509668][T15807] ? __pfx_genl_rcv_msg+0x10/0x10 [ 750.509694][T15807] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 750.509741][T15807] ? down_read+0x2be/0x330 [ 750.509772][T15807] genl_rcv+0x28/0x40 [ 750.509793][T15807] netlink_unicast+0x7bd/0x940 [ 750.509833][T15807] netlink_sendmsg+0x813/0xb40 [ 750.509872][T15807] ? __pfx_netlink_sendmsg+0x10/0x10 [ 750.509910][T15807] ? apparmor_socket_sendmsg+0x98/0x360 [ 750.509936][T15807] ? __pfx_netlink_sendmsg+0x10/0x10 [ 750.509962][T15807] sock_sendmsg_nosec+0x13a/0x180 [ 750.509987][T15807] ____sys_sendmsg+0x54e/0x850 [ 750.510020][T15807] ? __pfx_____sys_sendmsg+0x10/0x10 [ 750.510057][T15807] ? import_iovec+0x73/0xa0 [ 750.510087][T15807] ___sys_sendmsg+0x2a5/0x360 [ 750.510112][T15807] ? __lock_acquire+0x747/0x2de0 [ 750.510140][T15807] ? __pfx____sys_sendmsg+0x10/0x10 [ 750.510207][T15807] ? __fget_files+0x2a/0x420 [ 750.510233][T15807] ? __fget_files+0x3a2/0x420 [ 750.510271][T15807] __x64_sys_sendmsg+0x1b1/0x290 [ 750.510301][T15807] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 750.510351][T15807] do_syscall_64+0x166/0x520 [ 750.510375][T15807] ? trace_irq_disable+0x3b/0x140 [ 750.510394][T15807] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.510415][T15807] ? clear_bhb_loop+0x70/0xc0 [ 750.510441][T15807] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.510461][T15807] RIP: 0033:0x7f691699e159 [ 750.510481][T15807] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 750.510498][T15807] RSP: 002b:00007f6917890028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 750.510529][T15807] RAX: ffffffffffffffda RBX: 00007f6916c25fa0 RCX: 00007f691699e159 [ 750.510544][T15807] RDX: 0000000000000004 RSI: 00002000000002c0 RDI: 0000000000000003 [ 750.510558][T15807] RBP: 00007f6917890090 R08: 0000000000000000 R09: 0000000000000000 [ 750.510571][T15807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 750.510583][T15807] R13: 00007f6916c26038 R14: 00007f6916c25fa0 R15: 00007ffc26caad38 [ 750.510619][T15807] [ 751.073605][T15646] hsr_slave_0: entered promiscuous mode [ 751.076564][T15646] hsr_slave_1: entered promiscuous mode [ 751.077397][T15646] debugfs: 'hsr0' already exists in 'hsr' [ 751.077417][T15646] Cannot create hsr debugfs directory [ 751.544117][T15824] netlink: 'syz.5.3031': attribute type 4 has an invalid length. [ 752.051256][T15845] netlink: 348 bytes leftover after parsing attributes in process `syz.5.3034'. [ 752.380928][T13355] Bluetooth: hci5: command tx timeout [ 752.445154][T15646] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 752.445196][T15646] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.164213][T15871] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3039'. [ 753.432020][T15867] syzkaller0: entered promiscuous mode [ 753.432047][T15867] syzkaller0: entered allmulticast mode [ 753.634221][T15868] syzkaller0: entered promiscuous mode [ 753.634249][T15868] syzkaller0: entered allmulticast mode [ 753.732749][T15893] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3043'. [ 753.904345][T15897] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3044'. [ 755.893867][T15911] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3046'. [ 755.893897][T15911] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3046'. [ 755.893914][T15911] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3046'. [ 755.958036][T15910] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3045'. [ 759.653789][T15923] netlink: 348 bytes leftover after parsing attributes in process `syz.0.3050'. [ 762.176007][T15915] debugfs: '1ща^!00000000000000000000003яяяя' already exists in 'ieee80211' [ 762.504737][T15646] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 762.504777][T15646] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.121451][T15646] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 763.121488][T15646] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.704432][T15646] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 763.704472][T15646] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.972595][T15977] syzkaller0: entered promiscuous mode [ 763.972625][T15977] syzkaller0: entered allmulticast mode [ 764.483659][T15991] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3064'. [ 764.784581][T15999] netlink: 348 bytes leftover after parsing attributes in process `syz.1.3066'. [ 767.642848][T16009] netlink: 232 bytes leftover after parsing attributes in process `syz.5.3068'. [ 767.814957][T15646] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 767.876130][T15646] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 767.896060][T15646] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 767.940019][T15646] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 767.957510][T15646] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 767.982830][T16019] netlink: 252 bytes leftover after parsing attributes in process `syz.2.3071'. [ 767.998892][T15646] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 768.001912][T15646] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 768.045272][T15646] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 768.245765][T16031] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3072'. [ 768.392514][T15646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 768.477155][T15646] 8021q: adding VLAN 0 to HW filter on device team0 [ 768.518796][ T1173] bridge0: port 1(bridge_slave_0) entered blocking state [ 768.518914][ T1173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 768.574278][ T1173] bridge0: port 2(bridge_slave_1) entered blocking state [ 768.574394][ T1173] bridge0: port 2(bridge_slave_1) entered forwarding state [ 768.581101][T16039] ip_tables: iptables: counters copy to user failed while replacing table [ 768.681188][T16042] netlink: 'syz.2.3077': attribute type 1 has an invalid length. [ 768.681218][T16042] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3077'. [ 768.814465][T16040] sysfs: cannot create duplicate filename '/class/ieee80211/1ща^!00000000000000000000003яяяя' [ 768.814488][T16040] CPU: 1 UID: 0 PID: 16040 Comm: syz.1.3075 Not tainted syzkaller #0 PREEMPT(full) [ 768.814512][T16040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 768.814525][T16040] Call Trace: [ 768.814532][T16040] [ 768.814541][T16040] dump_stack_lvl+0xe8/0x150 [ 768.814604][T16040] sysfs_warn_dup+0x8e/0xa0 [ 768.814633][T16040] sysfs_do_create_link_sd+0xc0/0x110 [ 768.814665][T16040] device_add_class_symlinks+0x1cf/0x240 [ 768.814694][T16040] device_add+0x467/0xb80 [ 768.814720][T16040] wiphy_register+0x1fc8/0x2ff0 [ 768.814759][T16040] ? __pfx_wiphy_register+0x10/0x10 [ 768.814781][T16040] ? __pfx_netdev_run_todo+0x10/0x10 [ 768.814813][T16040] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 768.814850][T16040] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 768.814881][T16040] ieee80211_register_hw+0x3dbb/0x4b00 [ 768.814921][T16040] ? ieee80211_register_hw+0x1981/0x4b00 [ 768.814979][T16040] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 768.815005][T16040] ? __asan_memset+0x22/0x50 [ 768.815034][T16040] ? __hrtimer_setup+0x1b7/0x260 [ 768.815060][T16040] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 768.815091][T16040] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 768.815153][T16040] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 768.815178][T16040] ? kstrndup+0xbd/0x160 [ 768.815207][T16040] ? kstrndup+0xbd/0x160 [ 768.815233][T16040] hwsim_new_radio_nl+0xd8b/0xf90 [ 768.815278][T16040] genl_family_rcv_msg_doit+0x233/0x340 [ 768.815314][T16040] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 768.815354][T16040] ? bpf_lsm_capable+0x9/0x20 [ 768.815374][T16040] ? security_capable+0x7e/0x2c0 [ 768.815408][T16040] genl_rcv_msg+0x614/0x7a0 [ 768.815443][T16040] ? __pfx_genl_rcv_msg+0x10/0x10 [ 768.815468][T16040] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 768.815512][T16040] netlink_rcv_skb+0x226/0x4a0 [ 768.815546][T16040] ? __pfx_genl_rcv_msg+0x10/0x10 [ 768.815585][T16040] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 768.815639][T16040] ? down_read+0x2be/0x330 [ 768.815675][T16040] genl_rcv+0x28/0x40 [ 768.815699][T16040] netlink_unicast+0x7bd/0x940 [ 768.815743][T16040] netlink_sendmsg+0x813/0xb40 [ 768.815787][T16040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.815827][T16040] ? apparmor_socket_sendmsg+0x98/0x360 [ 768.815855][T16040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 768.815886][T16040] sock_sendmsg_nosec+0x13a/0x180 [ 768.815913][T16040] ____sys_sendmsg+0x54e/0x850 [ 768.815950][T16040] ? __pfx_____sys_sendmsg+0x10/0x10 [ 768.815991][T16040] ? import_iovec+0x73/0xa0 [ 768.816044][T16040] ___sys_sendmsg+0x2a5/0x360 [ 768.816071][T16040] ? __lock_acquire+0x747/0x2de0 [ 768.816101][T16040] ? __pfx____sys_sendmsg+0x10/0x10 [ 768.816134][T16040] ? futex_wait+0x2a2/0x390 [ 768.816197][T16040] ? __fget_files+0x2a/0x420 [ 768.816223][T16040] ? __fget_files+0x3a2/0x420 [ 768.816261][T16040] __x64_sys_sendmsg+0x1b1/0x290 [ 768.816292][T16040] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 768.816346][T16040] do_syscall_64+0x166/0x520 [ 768.816369][T16040] ? trace_irq_disable+0x3b/0x140 [ 768.816390][T16040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.816412][T16040] ? clear_bhb_loop+0x70/0xc0 [ 768.816438][T16040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 768.816460][T16040] RIP: 0033:0x7f691699e159 [ 768.816482][T16040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 768.816499][T16040] RSP: 002b:00007f6917890028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 768.816523][T16040] RAX: ffffffffffffffda RBX: 00007f6916c25fa0 RCX: 00007f691699e159 [ 768.816538][T16040] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000003 [ 768.816562][T16040] RBP: 00007f6916a3506b R08: 0000000000000000 R09: 0000000000000000 [ 768.816575][T16040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 768.816589][T16040] R13: 00007f6916c26038 R14: 00007f6916c25fa0 R15: 00007ffc26caad38 [ 768.816626][T16040] [ 769.255365][T16046] netlink: 348 bytes leftover after parsing attributes in process `syz.2.3079'. [ 769.469262][T16055] netlink: 'syz.5.3078': attribute type 1 has an invalid length. [ 770.333311][T16078] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3085'. [ 771.211362][T16101] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3092'. [ 771.356543][T16067] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3083'. [ 771.357648][T16067] unsupported nlmsg_type 40 [ 771.459013][T16105] netlink: 348 bytes leftover after parsing attributes in process `syz.1.3093'. [ 771.592359][T15646] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 771.594565][T16112] netlink: 'syz.2.3096': attribute type 9 has an invalid length. [ 772.153568][T16124] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 772.252768][T16127] nbd: must specify a size in bytes for the device [ 772.400539][T16133] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3103'. [ 772.674860][T16134] vlan2: entered allmulticast mode [ 772.674887][T16134] veth1_virt_wifi: entered allmulticast mode [ 772.807584][T16141] netlink: 348 bytes leftover after parsing attributes in process `syz.1.3107'. [ 773.147485][ T59] dummy0: left allmulticast mode [ 773.163160][ T59] dummy0: left promiscuous mode [ 773.164406][ T59] bridge0: port 3(dummy0) entered disabled state [ 773.187242][ T59] bridge_slave_1: left allmulticast mode [ 773.187271][ T59] bridge_slave_1: left promiscuous mode [ 773.187543][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 773.221183][ T59] bridge_slave_0: left allmulticast mode [ 773.221210][ T59] bridge_slave_0: left promiscuous mode [ 773.221507][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 773.230220][T16152] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3112'. [ 773.268948][ T59] dvmrp8: left allmulticast mode [ 773.274449][ T59] tipc: Resetting bearer [ 773.658949][ T59] bond13 (unregistering): (slave ip6erspan0): Releasing active interface [ 774.086084][ T59] tipc: Disabling bearer [ 774.200277][ T59] bond14 (unregistering): (slave bridge1): Releasing backup interface [ 774.200305][ T59] bridge1 (unregistering): left promiscuous mode [ 774.234787][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 774.237119][ T59] bond0 (unregistering): Released all slaves [ 774.266406][ T59] bond1 (unregistering): (slave bond2): Releasing backup interface [ 774.283454][ T59] bond1 (unregistering): Released all slaves [ 774.319898][ T59] bond2 (unregistering): Released all slaves [ 774.344169][ T59] bond3 (unregistering): Released all slaves [ 774.382201][ T59] bond4 (unregistering): (slave wireguard0): Releasing backup interface [ 774.385817][ T59] bond4 (unregistering): Released all slaves [ 774.423281][ T59] bond5 (unregistering): (slave bond6): Releasing backup interface [ 774.424167][ T59] bond5 (unregistering): Released all slaves [ 774.462429][ T59] bond6 (unregistering): Released all slaves [ 774.496026][ T59] bond7 (unregistering): Released all slaves [ 774.521893][ T59] bond8 (unregistering): Released all slaves [ 774.543085][ T59] bond9 (unregistering): Released all slaves [ 774.581091][ T59] bond10 (unregistering): Released all slaves [ 774.604460][ T59] bond11 (unregistering): Released all slaves [ 774.636616][ T59] bond12 (unregistering): Released all slaves [ 774.662155][ T59] bond13 (unregistering): Released all slaves [ 774.683380][ T59] bond14 (unregistering): Released all slaves [ 774.714675][ T59] bond15 (unregistering): Released all slaves [ 774.736788][ T59] bond16 (unregistering): Released all slaves [ 774.849052][T16165] sysfs: cannot create duplicate filename '/class/ieee80211/1ща^!' [ 774.849079][T16165] CPU: 0 UID: 0 PID: 16165 Comm: syz.1.3116 Not tainted syzkaller #0 PREEMPT(full) [ 774.849104][T16165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 774.849117][T16165] Call Trace: [ 774.849127][T16165] [ 774.849136][T16165] dump_stack_lvl+0xe8/0x150 [ 774.849175][T16165] sysfs_warn_dup+0x8e/0xa0 [ 774.849206][T16165] sysfs_do_create_link_sd+0xc0/0x110 [ 774.849241][T16165] device_add_class_symlinks+0x1cf/0x240 [ 774.849271][T16165] device_add+0x467/0xb80 [ 774.849297][T16165] wiphy_register+0x1fc8/0x2ff0 [ 774.849338][T16165] ? __pfx_wiphy_register+0x10/0x10 [ 774.849360][T16165] ? __pfx_netdev_run_todo+0x10/0x10 [ 774.849391][T16165] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 774.849429][T16165] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 774.849459][T16165] ieee80211_register_hw+0x3dbb/0x4b00 [ 774.849500][T16165] ? ieee80211_register_hw+0x1981/0x4b00 [ 774.849563][T16165] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 774.849596][T16165] ? __asan_memset+0x22/0x50 [ 774.849627][T16165] ? __hrtimer_setup+0x1b7/0x260 [ 774.849654][T16165] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 774.849684][T16165] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 774.849743][T16165] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 774.849766][T16165] ? kstrndup+0xbd/0x160 [ 774.849794][T16165] ? kstrndup+0xbd/0x160 [ 774.849820][T16165] hwsim_new_radio_nl+0xd8b/0xf90 [ 774.849862][T16165] genl_family_rcv_msg_doit+0x233/0x340 [ 774.849896][T16165] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 774.849937][T16165] ? bpf_lsm_capable+0x9/0x20 [ 774.849955][T16165] ? security_capable+0x7e/0x2c0 [ 774.849989][T16165] genl_rcv_msg+0x614/0x7a0 [ 774.850021][T16165] ? __pfx_genl_rcv_msg+0x10/0x10 [ 774.850044][T16165] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 774.850085][T16165] netlink_rcv_skb+0x226/0x4a0 [ 774.850116][T16165] ? __pfx_genl_rcv_msg+0x10/0x10 [ 774.850143][T16165] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 774.850192][T16165] ? down_read+0x2be/0x330 [ 774.850226][T16165] genl_rcv+0x28/0x40 [ 774.850248][T16165] netlink_unicast+0x7bd/0x940 [ 774.850290][T16165] netlink_sendmsg+0x813/0xb40 [ 774.850331][T16165] ? __pfx_netlink_sendmsg+0x10/0x10 [ 774.850371][T16165] ? apparmor_socket_sendmsg+0x98/0x360 [ 774.850397][T16165] ? __pfx_netlink_sendmsg+0x10/0x10 [ 774.850427][T16165] sock_sendmsg_nosec+0x13a/0x180 [ 774.850452][T16165] ____sys_sendmsg+0x54e/0x850 [ 774.850487][T16165] ? __pfx_____sys_sendmsg+0x10/0x10 [ 774.850526][T16165] ? import_iovec+0x73/0xa0 [ 774.850564][T16165] ___sys_sendmsg+0x2a5/0x360 [ 774.850590][T16165] ? __lock_acquire+0x747/0x2de0 [ 774.850618][T16165] ? __pfx____sys_sendmsg+0x10/0x10 [ 774.850651][T16165] ? futex_wait+0x2a2/0x390 [ 774.850715][T16165] ? __fget_files+0x2a/0x420 [ 774.850741][T16165] ? __fget_files+0x3a2/0x420 [ 774.850781][T16165] __x64_sys_sendmsg+0x1b1/0x290 [ 774.850812][T16165] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 774.850865][T16165] do_syscall_64+0x166/0x520 [ 774.850890][T16165] ? trace_irq_disable+0x3b/0x140 [ 774.850910][T16165] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.850931][T16165] ? clear_bhb_loop+0x70/0xc0 [ 774.850958][T16165] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 774.850978][T16165] RIP: 0033:0x7f691699e159 [ 774.851000][T16165] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 774.851017][T16165] RSP: 002b:00007f6917890028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 774.851040][T16165] RAX: ffffffffffffffda RBX: 00007f6916c25fa0 RCX: 00007f691699e159 [ 774.851056][T16165] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000003 [ 774.851070][T16165] RBP: 00007f6916a3506b R08: 0000000000000000 R09: 0000000000000000 [ 774.851083][T16165] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 774.851096][T16165] R13: 00007f6916c26038 R14: 00007f6916c25fa0 R15: 00007ffc26caad38 [ 774.851133][T16165] [ 775.425572][T15646] veth0_vlan: entered promiscuous mode [ 775.446286][T16178] netlink: 'syz.1.3121': attribute type 39 has an invalid length. [ 775.601151][T15646] veth1_vlan: entered promiscuous mode [ 775.614352][T16174] wg0 speed is unknown, defaulting to 1000 [ 775.614439][T16174] wg0 speed is unknown, defaulting to 1000 [ 775.615295][T16174] wg0 speed is unknown, defaulting to 1000 [ 775.627686][ T59] tipc: Disabling bearer [ 775.650731][ T59] tipc: Left network mode [ 775.665423][T16174] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 775.665461][T16174] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 775.665498][T16174] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 775.752709][T15646] veth0_macvtap: entered promiscuous mode [ 775.765513][T15646] veth1_macvtap: entered promiscuous mode [ 775.791867][T15646] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 775.827604][T15646] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 775.883485][T16174] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 776.127750][T16187] netlink: 'syz.0.3124': attribute type 1 has an invalid length. [ 776.324027][T16187] 8021q: adding VLAN 0 to HW filter on device bond16 [ 776.403734][T16189] bond16: (slave geneve3): making interface the new active one [ 776.423872][T16189] bond16: (slave geneve3): Enslaving as an active interface with an up link [ 776.427447][T16174] wg0 speed is unknown, defaulting to 1000 [ 776.447375][T14426] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.466058][T14426] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.466106][T14426] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.466142][T14426] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 776.785902][T16174] wg0 speed is unknown, defaulting to 1000 [ 776.899584][T16174] wg0 speed is unknown, defaulting to 1000 [ 776.958537][T16174] wg0 speed is unknown, defaulting to 1000 [ 777.016008][ T1173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 777.016032][ T1173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 777.112347][T16174] wg0 speed is unknown, defaulting to 1000 [ 777.187782][T16202] syzkaller0: entered promiscuous mode [ 777.187811][T16202] syzkaller0: entered allmulticast mode [ 779.846698][T16174] wg0 speed is unknown, defaulting to 1000 [ 780.072034][ T1043] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 780.072060][ T1043] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 780.157561][T16210] netlink: 'syz.0.3131': attribute type 11 has an invalid length. [ 780.167810][T16210] netlink: 'syz.0.3131': attribute type 58 has an invalid length. [ 780.167833][T16210] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3131'. [ 780.446696][T16211] vlan3: entered allmulticast mode [ 780.446724][T16211] bond0: entered allmulticast mode [ 780.446741][T16211] bond_slave_0: entered allmulticast mode [ 780.446758][T16211] bond_slave_1: entered allmulticast mode [ 780.446774][T16211] bond13: entered allmulticast mode [ 781.239777][T16234] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.240460][T16234] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.246826][T16234] bridge0: entered allmulticast mode [ 781.345566][ T52] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 781.405470][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 781.419988][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 781.434565][ T52] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 781.436234][T16243] ip_tunnel: non-ECT from 2.0.0.0 with TOS=0x3 [ 781.446695][ T52] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 781.500174][T16239] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3138'. [ 781.574216][T16226] syzkaller0: entered promiscuous mode [ 781.574245][T16226] syzkaller0: entered allmulticast mode [ 781.683062][T16238] bridge_slave_1: left allmulticast mode [ 781.683120][T16238] bridge_slave_1: left promiscuous mode [ 781.686556][T16238] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.747833][T16238] bridge_slave_0: left allmulticast mode [ 781.747865][T16238] bridge_slave_0: left promiscuous mode [ 781.763387][T16238] bridge0: port 1(bridge_slave_0) entered disabled state [ 783.494880][T13355] Bluetooth: hci1: command tx timeout [ 785.379173][ T59] hsr_slave_0: left promiscuous mode [ 785.379996][ T59] hsr_slave_1: left promiscuous mode [ 785.417574][ T59] veth1_macvtap: left promiscuous mode [ 785.417615][ T59] veth0_macvtap: left promiscuous mode [ 785.417751][ T59] veth1_vlan: left promiscuous mode [ 785.417821][ T59] veth0_vlan: left promiscuous mode [ 785.574122][T13355] Bluetooth: hci1: command tx timeout [ 786.046973][ T59] team0 (unregistering): Port device team_slave_1 removed [ 786.074966][ T59] team0 (unregistering): Port device team_slave_0 removed [ 786.753617][T16288] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 786.892071][T16290] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3149'. [ 787.257014][T16303] netlink: 104 bytes leftover after parsing attributes in process `syz.5.3155'. [ 787.325181][ T59] IPVS: stop unused estimator thread 0... [ 787.613148][T16307] syzkaller0: entered promiscuous mode [ 787.613176][T16307] syzkaller0: entered allmulticast mode [ 787.648151][T13355] Bluetooth: hci1: command tx timeout [ 789.731480][T13355] Bluetooth: hci1: command tx timeout [ 790.660514][T16315] syzkaller0: entered promiscuous mode [ 790.660557][T16315] syzkaller0: entered allmulticast mode [ 790.881677][T16241] wg0 speed is unknown, defaulting to 1000 [ 790.982864][T16331] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 791.001972][T16332] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3164'. [ 791.534591][T16346] syzkaller0: entered promiscuous mode [ 791.534617][T16346] syzkaller0: entered allmulticast mode [ 791.706273][T16352] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 792.104805][T16357] syzkaller0: entered promiscuous mode [ 792.104828][T16357] syzkaller0: entered allmulticast mode [ 792.137663][T16367] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3176'. [ 792.476273][T16380] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 793.150136][T16241] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.151937][T16241] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.152102][T16241] bridge_slave_0: entered allmulticast mode [ 793.157796][T16241] bridge_slave_0: entered promiscuous mode [ 793.177295][T16241] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.179572][T16241] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.179708][T16241] bridge_slave_1: entered allmulticast mode [ 793.193057][T16241] bridge_slave_1: entered promiscuous mode [ 793.254085][T16403] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3185'. [ 793.517101][T16241] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 793.549147][T16241] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 793.666628][T16412] ip6gre1: entered promiscuous mode [ 793.791704][T16241] team0: Port device team_slave_0 added [ 793.856725][T16241] team0: Port device team_slave_1 added [ 793.856910][T16418] syzkaller0: entered promiscuous mode [ 793.856930][T16418] syzkaller0: entered allmulticast mode [ 793.959809][T16422] netlink: 'syz.1.3190': attribute type 2 has an invalid length. [ 793.959837][T16422] netlink: 'syz.1.3190': attribute type 2 has an invalid length. [ 793.963080][T16241] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 793.963098][T16241] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 793.963122][T16241] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 794.020607][T16241] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 794.020656][T16241] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 794.020684][T16241] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 794.416120][T16425] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 794.845258][T16444] netlink: 252 bytes leftover after parsing attributes in process `syz.5.3196'. [ 794.948749][T16427] syzkaller0: entered promiscuous mode [ 794.948776][T16427] syzkaller0: entered allmulticast mode [ 794.977187][T16241] hsr_slave_0: entered promiscuous mode [ 794.987077][T16241] hsr_slave_1: entered promiscuous mode [ 794.987874][T16241] debugfs: 'hsr0' already exists in 'hsr' [ 794.987894][T16241] Cannot create hsr debugfs directory [ 795.014568][T16449] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3198'. [ 795.114263][T16452] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3200'. [ 798.164049][T16469] netlink: 'syz.5.3202': attribute type 2 has an invalid length. [ 798.164076][T16469] netlink: 'syz.5.3202': attribute type 2 has an invalid length. [ 798.195492][T16467] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 798.577563][T16472] bond17: entered promiscuous mode [ 798.577634][T16472] bond17: entered allmulticast mode [ 798.589653][T16472] 8021q: adding VLAN 0 to HW filter on device bond17 [ 798.894917][T16482] netlink: 252 bytes leftover after parsing attributes in process `syz.0.3207'. [ 798.929668][T16241] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.213071][T16490] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3209'. [ 799.269300][T16241] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.457788][T16241] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.832313][T16493] syzkaller0: entered promiscuous mode [ 799.832339][T16493] syzkaller0: entered allmulticast mode [ 799.873614][T16241] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.938310][T16514] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3215'. [ 800.056889][T16516] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3216'. [ 800.300386][T16525] sock: sock_timestamping_bind_phc: sock not bind to device [ 803.267248][T16541] netdevsim netdevsim4: Direct firmware load for я failed with error -2 [ 803.267290][T16541] netdevsim netdevsim4: Falling back to sysfs fallback for: я [ 803.727819][T16557] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3226'. [ 804.108419][T16241] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 804.154353][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 804.157032][T16241] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 804.221204][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 804.227618][T16241] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 804.278234][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 804.284776][T16241] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 804.339094][T16241] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 804.842564][T16575] syzkaller0: entered promiscuous mode [ 804.842593][T16575] syzkaller0: entered allmulticast mode [ 808.004179][T16605] syzkaller0: entered promiscuous mode [ 808.004207][T16605] syzkaller0: entered allmulticast mode [ 808.078768][T16613] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3234'. [ 808.690411][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 811.622657][T16241] 8021q: adding VLAN 0 to HW filter on device bond0 [ 811.690572][T16241] 8021q: adding VLAN 0 to HW filter on device team0 [ 811.733690][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 811.733809][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 811.751816][T16638] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3240'. [ 811.802059][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 811.802179][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 812.389858][T16648] syzkaller0: entered promiscuous mode [ 812.390089][T16648] syzkaller0: entered allmulticast mode [ 812.426872][T16653] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 812.426900][T16653] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 812.445732][T16653] batman_adv: batadv0: Interface deactivated: gretap1 [ 812.445756][T16653] batman_adv: batadv0: Removing interface: gretap1 [ 815.923617][T16690] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3251'. [ 816.103005][T16696] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3254'. [ 816.103873][T16697] syzkaller0: entered promiscuous mode [ 816.104102][T16697] syzkaller0: entered allmulticast mode [ 816.791284][T16714] netlink: 252 bytes leftover after parsing attributes in process `syz.5.3258'. [ 817.089500][T16721] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 817.247714][T16724] syzkaller0: entered promiscuous mode [ 817.247740][T16724] syzkaller0: entered allmulticast mode [ 817.248222][T16729] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3264'. [ 817.486422][T16241] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 817.706366][T16732] bond3: option arp_all_targets: invalid value (18446744073707454461) [ 817.756342][T16749] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3271'. [ 817.756594][T16732] bond3 (unregistering): Released all slaves [ 817.813944][T16750] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3271'. [ 817.848984][T16738] FAULT_INJECTION: forcing a failure. [ 817.848984][T16738] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 817.849021][T16738] CPU: 0 UID: 0 PID: 16738 Comm: syz.1.3268 Not tainted syzkaller #0 PREEMPT(full) [ 817.849045][T16738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 817.849057][T16738] Call Trace: [ 817.849066][T16738] [ 817.849077][T16738] dump_stack_lvl+0xe8/0x150 [ 817.849112][T16738] should_fail_ex+0x410/0x560 [ 817.849143][T16738] _copy_to_user+0x31/0xb0 [ 817.849172][T16738] simple_read_from_buffer+0xe1/0x170 [ 817.849206][T16738] proc_fail_nth_read+0x1bb/0x230 [ 817.849236][T16738] ? common_file_perm+0x20e/0x2b0 [ 817.849263][T16738] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 817.849297][T16738] ? rw_verify_area+0x24a/0x4c0 [ 817.849329][T16738] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 817.849358][T16738] vfs_read+0x213/0xa80 [ 817.849392][T16738] ? __pfx___mutex_lock+0x10/0x10 [ 817.849419][T16738] ? __pfx_vfs_read+0x10/0x10 [ 817.849449][T16738] ? __fget_files+0x2a/0x420 [ 817.849480][T16738] ? __fget_files+0x3a2/0x420 [ 817.849504][T16738] ? __fget_files+0x2a/0x420 [ 817.849549][T16738] ksys_read+0x150/0x270 [ 817.849578][T16738] ? __pfx_ksys_read+0x10/0x10 [ 817.849615][T16738] do_syscall_64+0x166/0x520 [ 817.849639][T16738] ? trace_irq_disable+0x3b/0x140 [ 817.849659][T16738] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.849679][T16738] ? clear_bhb_loop+0x70/0xc0 [ 817.849704][T16738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 817.849729][T16738] RIP: 0033:0x7f691695e98e [ 817.849758][T16738] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 817.849774][T16738] RSP: 002b:00007f691788ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 817.849799][T16738] RAX: ffffffffffffffda RBX: 00007f69178906c0 RCX: 00007f691695e98e [ 817.849815][T16738] RDX: 000000000000000f RSI: 00007f69178900a0 RDI: 0000000000000005 [ 817.849828][T16738] RBP: 00007f6917890090 R08: 0000000000000000 R09: 0000000000000000 [ 817.849841][T16738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 817.849854][T16738] R13: 00007f6916c26038 R14: 00007f6916c25fa0 R15: 00007ffc26caad38 [ 817.849888][T16738] [ 818.299970][T16241] veth0_vlan: entered promiscuous mode [ 818.339875][T16241] veth1_vlan: entered promiscuous mode [ 818.471113][T16241] veth0_macvtap: entered promiscuous mode [ 818.504182][T16241] veth1_macvtap: entered promiscuous mode [ 818.511274][T16759] block nbd0: NBD_DISCONNECT [ 818.511341][T16759] block nbd0: Send disconnect failed -32 [ 818.511359][T16759] block nbd0: Send disconnect failed -32 [ 818.511375][T16759] block nbd0: shutting down sockets [ 818.617890][T16241] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 818.729635][T16241] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 818.857044][T16773] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3279'. [ 819.128049][T16769] syzkaller0: entered promiscuous mode [ 819.128075][T16769] syzkaller0: entered allmulticast mode [ 819.380513][T16778] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3281'. [ 819.638262][ T1173] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.701981][T14426] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.702389][T14426] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.838200][ T59] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 820.361453][T14696] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 820.361478][T14696] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 820.605674][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 820.605698][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 820.715772][T16811] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3289'. [ 821.189840][T16819] syzkaller0: entered promiscuous mode [ 821.190077][T16819] syzkaller0: entered allmulticast mode [ 821.622348][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 821.627196][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 821.647330][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 821.657765][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 821.662475][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 821.702077][T16834] debugfs: '1ща^!' already exists in 'ieee80211' [ 821.766473][T16832] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3295'. [ 821.944901][T16842] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 822.533153][T16852] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3301'. [ 822.627554][T16827] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 822.639639][T16827] veth1_macvtap: left promiscuous mode [ 822.815715][T16860] netlink: 'syz.2.3305': attribute type 2 has an invalid length. [ 822.815740][T16860] netlink: 'syz.2.3305': attribute type 2 has an invalid length. [ 822.815756][T16860] FAULT_INJECTION: forcing a failure. [ 822.815756][T16860] name failslab, interval 1, probability 0, space 0, times 0 [ 822.815782][T16860] CPU: 0 UID: 0 PID: 16860 Comm: syz.2.3305 Not tainted syzkaller #0 PREEMPT(full) [ 822.815804][T16860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 822.815816][T16860] Call Trace: [ 822.815830][T16860] [ 822.815840][T16860] dump_stack_lvl+0xe8/0x150 [ 822.815878][T16860] should_fail_ex+0x410/0x560 [ 822.815909][T16860] ? __alloc_skb+0x1db/0x7a0 [ 822.815936][T16860] should_failslab+0xa8/0x100 [ 822.815966][T16860] ? __alloc_skb+0x1db/0x7a0 [ 822.815990][T16860] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 822.816022][T16860] ? __alloc_skb+0x18d/0x7a0 [ 822.816047][T16860] ? __alloc_skb+0x1db/0x7a0 [ 822.816081][T16860] __alloc_skb+0x1db/0x7a0 [ 822.816112][T16860] mptcp_pm_nl_get_addr_doit+0x352/0x8b0 [ 822.816254][T16860] ? __pfx_mptcp_pm_nl_get_addr_doit+0x10/0x10 [ 822.816305][T16860] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 822.816333][T16860] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 822.816380][T16860] genl_family_rcv_msg_doit+0x233/0x340 [ 822.816413][T16860] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 822.816452][T16860] ? __dev_queue_xmit+0x29b/0x3820 [ 822.816495][T16860] genl_rcv_msg+0x614/0x7a0 [ 822.816538][T16860] ? __pfx_genl_rcv_msg+0x10/0x10 [ 822.816563][T16860] ? __pfx_mptcp_pm_nl_get_addr_doit+0x10/0x10 [ 822.816612][T16860] netlink_rcv_skb+0x226/0x4a0 [ 822.816646][T16860] ? __pfx_genl_rcv_msg+0x10/0x10 [ 822.816672][T16860] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 822.816716][T16860] ? down_read+0x2be/0x330 [ 822.816745][T16860] genl_rcv+0x28/0x40 [ 822.816764][T16860] netlink_unicast+0x7bd/0x940 [ 822.816801][T16860] netlink_sendmsg+0x813/0xb40 [ 822.816838][T16860] ? __pfx_netlink_sendmsg+0x10/0x10 [ 822.816873][T16860] ? apparmor_socket_sendmsg+0x98/0x360 [ 822.816899][T16860] ? __pfx_netlink_sendmsg+0x10/0x10 [ 822.816927][T16860] sock_sendmsg_nosec+0x13a/0x180 [ 822.816950][T16860] ____sys_sendmsg+0x54e/0x850 [ 822.816981][T16860] ? __pfx_____sys_sendmsg+0x10/0x10 [ 822.817016][T16860] ? import_iovec+0x73/0xa0 [ 822.817044][T16860] ___sys_sendmsg+0x2a5/0x360 [ 822.817068][T16860] ? __lock_acquire+0x747/0x2de0 [ 822.817094][T16860] ? __pfx____sys_sendmsg+0x10/0x10 [ 822.817157][T16860] ? __fget_files+0x2a/0x420 [ 822.817182][T16860] ? __fget_files+0x3a2/0x420 [ 822.817218][T16860] __x64_sys_sendmsg+0x1b1/0x290 [ 822.817247][T16860] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 822.817294][T16860] do_syscall_64+0x166/0x520 [ 822.817316][T16860] ? trace_irq_disable+0x3b/0x140 [ 822.817337][T16860] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.817358][T16860] ? clear_bhb_loop+0x70/0xc0 [ 822.817390][T16860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 822.817411][T16860] RIP: 0033:0x7f55ba19e159 [ 822.817431][T16860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 822.817449][T16860] RSP: 002b:00007f55b83f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 822.817473][T16860] RAX: ffffffffffffffda RBX: 00007f55ba425fa0 RCX: 00007f55ba19e159 [ 822.817489][T16860] RDX: 0000000000008090 RSI: 0000200000000000 RDI: 0000000000000003 [ 822.817504][T16860] RBP: 00007f55b83f6090 R08: 0000000000000000 R09: 0000000000000000 [ 822.817519][T16860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 822.817532][T16860] R13: 00007f55ba426038 R14: 00007f55ba425fa0 R15: 00007fff8550ebf8 [ 822.817568][T16860] [ 823.203812][T16865] netlink: 'syz.4.3304': attribute type 18 has an invalid length. [ 823.203837][T16865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3304'. [ 823.242832][ T1043] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 823.647801][T16865] netlink: 'syz.4.3304': attribute type 18 has an invalid length. [ 823.647827][T16865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3304'. [ 823.701748][T14426] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.701821][T14426] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.701857][T14426] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.701891][T14426] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 823.728416][T13355] Bluetooth: hci2: command tx timeout [ 823.798009][T16877] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 824.334190][T16895] netlink: 'syz.5.3315': attribute type 2 has an invalid length. [ 824.334215][T16895] netlink: 'syz.5.3315': attribute type 2 has an invalid length. [ 824.590923][ T1043] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 824.793125][T16829] wg0 speed is unknown, defaulting to 1000 [ 824.827430][T16901] netlink: 252 bytes leftover after parsing attributes in process `syz.1.3318'. [ 824.919342][T16903] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3320'. [ 825.026179][T16905] netlink: 'syz.5.3321': attribute type 29 has an invalid length. [ 825.087325][ T1043] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.175887][T16915] netlink: 'syz.5.3321': attribute type 29 has an invalid length. [ 825.361097][T14695] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 825.361185][T14695] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 825.361222][T14695] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 825.749621][T16934] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3327'. [ 825.756998][ T1043] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 825.828345][T13355] Bluetooth: hci2: command tx timeout [ 825.910671][T14696] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 826.333036][T16943] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3331'. [ 826.668902][T16952] ip_tables: iptables: counters copy to user failed while replacing table [ 826.766494][T16948] netlink: 92 bytes leftover after parsing attributes in process `syz.4.3333'. [ 827.073383][ T1043] bridge_slave_1: left allmulticast mode [ 827.073413][ T1043] bridge_slave_1: left promiscuous mode [ 827.073628][ T1043] bridge0: port 2(bridge_slave_1) entered disabled state [ 827.115349][ T1043] bridge_slave_0: left allmulticast mode [ 827.115378][ T1043] bridge_slave_0: left promiscuous mode [ 827.115604][ T1043] bridge0: port 1(bridge_slave_0) entered disabled state [ 827.818903][T16981] FAULT_INJECTION: forcing a failure. [ 827.818903][T16981] name failslab, interval 1, probability 0, space 0, times 0 [ 827.818940][T16981] CPU: 0 UID: 0 PID: 16981 Comm: syz.5.3342 Not tainted syzkaller #0 PREEMPT(full) [ 827.818963][T16981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 827.818975][T16981] Call Trace: [ 827.818984][T16981] [ 827.818993][T16981] dump_stack_lvl+0xe8/0x150 [ 827.819029][T16981] should_fail_ex+0x410/0x560 [ 827.819058][T16981] should_failslab+0xa8/0x100 [ 827.819085][T16981] __kmalloc_noprof+0xfe/0x720 [ 827.819105][T16981] ? security_sk_alloc+0x52/0x360 [ 827.819133][T16981] ? security_sk_alloc+0x52/0x360 [ 827.819167][T16981] security_sk_alloc+0x52/0x360 [ 827.819199][T16981] sk_prot_alloc+0x101/0x210 [ 827.819223][T16981] ? sk_alloc+0x27/0x390 [ 827.819259][T16981] sk_alloc+0x3a/0x390 [ 827.819287][T16981] bpf_prog_test_run_skb+0x3a6/0x2230 [ 827.819317][T16981] ? lock_acquire+0x115/0x350 [ 827.819356][T16981] ? __fget_files+0x3a2/0x420 [ 827.819382][T16981] ? __fget_files+0x2a/0x420 [ 827.819412][T16981] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 827.819441][T16981] bpf_prog_test_run+0x2c5/0x340 [ 827.819505][T16981] __sys_bpf+0xa22/0xd90 [ 827.819540][T16981] ? __pfx___sys_bpf+0x10/0x10 [ 827.819574][T16981] ? __fget_files+0x2a/0x420 [ 827.819618][T16981] ? ksys_write+0x242/0x270 [ 827.819650][T16981] ? __pfx_ksys_write+0x10/0x10 [ 827.819683][T16981] __x64_sys_bpf+0xba/0xd0 [ 827.819707][T16981] do_syscall_64+0x166/0x520 [ 827.819731][T16981] ? trace_irq_disable+0x3b/0x140 [ 827.819750][T16981] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.819771][T16981] ? clear_bhb_loop+0x70/0xc0 [ 827.819796][T16981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.819816][T16981] RIP: 0033:0x7f62b219e159 [ 827.819836][T16981] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 827.819853][T16981] RSP: 002b:00007f62b03f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 827.819877][T16981] RAX: ffffffffffffffda RBX: 00007f62b2426090 RCX: 00007f62b219e159 [ 827.819891][T16981] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 827.819905][T16981] RBP: 00007f62b03f6090 R08: 0000000000000000 R09: 0000000000000000 [ 827.819918][T16981] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 827.819931][T16981] R13: 00007f62b2426128 R14: 00007f62b2426090 R15: 00007fffc9c39dd8 [ 827.819964][T16981] [ 827.891909][T13355] Bluetooth: hci2: command tx timeout [ 828.313013][ T1043] bond16 (unregistering): (slave geneve3): Releasing active interface [ 828.640078][ T1043] bond1 (unregistering): (slave bridge1): Releasing active interface [ 828.682289][ T1043] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 828.682690][ T1043] bond_slave_0: left allmulticast mode [ 828.684581][ T1043] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 828.684956][ T1043] bond_slave_1: left allmulticast mode [ 828.687862][ T1043] bond0 (unregistering): (slave bond13): Releasing backup interface [ 828.733332][ T1043] bond13 (unregistering): left allmulticast mode [ 828.733662][ T1043] bond0 (unregistering): Released all slaves [ 828.754832][ T1043] bond1 (unregistering): Released all slaves [ 828.778683][ T1043] bond2 (unregistering): Released all slaves [ 828.804796][ T1043] bond3 (unregistering): Released all slaves [ 828.834151][ T1043] bond4 (unregistering): Released all slaves [ 828.860567][ T1043] bond5 (unregistering): (slave bond6): Releasing backup interface [ 828.862540][ T1043] bond5 (unregistering): Released all slaves [ 828.903268][ T1043] bond6 (unregistering): Released all slaves [ 828.930490][ T1043] bond7 (unregistering): Released all slaves [ 828.955935][ T1043] bond8 (unregistering): Released all slaves [ 828.983649][ T1043] bond9 (unregistering): Released all slaves [ 829.022909][ T1043] bond10 (unregistering): Released all slaves [ 829.051711][ T1043] bond11 (unregistering): Released all slaves [ 829.079951][ T1043] bond12 (unregistering): Released all slaves [ 829.106974][ T1043] bond13 (unregistering): Released all slaves [ 829.129620][ T1043] bond14 (unregistering): Released all slaves [ 829.157459][ T1043] bond15 (unregistering): (slave veth0_to_bond): Releasing active interface [ 829.192337][ T1043] bond15 (unregistering): Released all slaves [ 829.218148][ T1043] bond16 (unregistering): Released all slaves [ 829.247316][ T1043] bond17 (unregistering): Released all slaves [ 829.769449][T16997] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3346'. [ 829.864926][ T1043] tipc: Left network mode [ 829.885775][T16997] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 829.885794][T16997] IPv6: NLM_F_CREATE should be set when creating new route [ 829.968720][T13355] Bluetooth: hci2: command tx timeout [ 830.248147][T17019] netlink: 'syz.5.3351': attribute type 28 has an invalid length. [ 830.248187][T17019] netlink: 'syz.5.3351': attribute type 3 has an invalid length. [ 830.248200][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.248409][T17019] netlink: 'syz.5.3351': attribute type 28 has an invalid length. [ 830.248423][T17019] netlink: 'syz.5.3351': attribute type 3 has an invalid length. [ 830.248435][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.248629][T17019] netlink: 'syz.5.3351': attribute type 28 has an invalid length. [ 830.248643][T17019] netlink: 'syz.5.3351': attribute type 3 has an invalid length. [ 830.248655][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.248840][T17019] netlink: 'syz.5.3351': attribute type 28 has an invalid length. [ 830.248854][T17019] netlink: 'syz.5.3351': attribute type 3 has an invalid length. [ 830.248866][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.249061][T17019] netlink: 'syz.5.3351': attribute type 28 has an invalid length. [ 830.249075][T17019] netlink: 'syz.5.3351': attribute type 3 has an invalid length. [ 830.249087][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.249283][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.249474][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.327316][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.328209][T17019] netlink: 132 bytes leftover after parsing attributes in process `syz.5.3351'. [ 830.675160][T16829] bridge0: port 1(bridge_slave_0) entered blocking state [ 830.675782][T16829] bridge0: port 1(bridge_slave_0) entered disabled state [ 830.675952][T16829] bridge_slave_0: entered allmulticast mode [ 830.708100][T16829] bridge_slave_0: entered promiscuous mode [ 830.879284][T16829] bridge0: port 2(bridge_slave_1) entered blocking state [ 830.880401][T16829] bridge0: port 2(bridge_slave_1) entered disabled state [ 830.880773][T16829] bridge_slave_1: entered allmulticast mode [ 830.893179][T16829] bridge_slave_1: entered promiscuous mode [ 831.210913][T17006] syzkaller0: entered promiscuous mode [ 831.210939][T17006] syzkaller0: entered allmulticast mode [ 832.680545][T17004] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 835.136957][ T5282] 8021q: adding VLAN 0 to HW filter on device eth5 [ 835.152485][T16829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 835.179914][T16829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 835.269572][T16829] team0: Port device team_slave_0 added [ 835.294807][T16829] team0: Port device team_slave_1 added [ 835.362255][T16829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 835.362275][T16829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 835.362301][T16829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 835.364435][T16829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 835.364450][T16829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 835.364475][T16829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 835.557096][T16829] hsr_slave_0: entered promiscuous mode [ 835.565216][T16829] hsr_slave_1: entered promiscuous mode [ 835.566140][T16829] debugfs: 'hsr0' already exists in 'hsr' [ 835.566162][T16829] Cannot create hsr debugfs directory [ 835.595551][ T1043] hsr_slave_0: left promiscuous mode [ 835.627223][ T1043] vlan0: left allmulticast mode [ 835.627248][ T1043] veth0_vlan: left allmulticast mode [ 835.627315][ T1043] vlan0: left promiscuous mode [ 835.627871][ T1043] veth1_macvtap: left promiscuous mode [ 835.649778][ T1043] veth0_macvtap: left promiscuous mode [ 835.649927][ T1043] veth1_vlan: left promiscuous mode [ 835.650115][ T1043] veth0_vlan: left promiscuous mode [ 836.458883][T17058] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 836.768943][T17082] __nla_validate_parse: 56 callbacks suppressed [ 836.768997][T17082] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3366'. [ 837.084502][T17092] netlink: 252 bytes leftover after parsing attributes in process `syz.4.3370'. [ 837.300485][ T1043] team0 (unregistering): Port device team_slave_1 removed [ 837.326645][ T1043] team0 (unregistering): Port device team_slave_0 removed [ 838.342760][T17111] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3377'. [ 838.377349][ T1043] IPVS: stop unused estimator thread 0... [ 838.484821][T17117] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3380'. [ 838.885045][T17129] netlink: 116 bytes leftover after parsing attributes in process `syz.5.3385'. [ 839.222430][T17139] validate_nla: 120 callbacks suppressed [ 839.222526][T17139] netlink: 'syz.4.3387': attribute type 15 has an invalid length. [ 839.222542][T17139] netlink: 'syz.4.3387': attribute type 7 has an invalid length. [ 839.374267][T17144] netlink: 252 bytes leftover after parsing attributes in process `syz.2.3388'. [ 839.531712][T17147] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3389'. [ 839.673157][T17149] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3390'. [ 839.789227][T17151] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3391'. [ 840.176437][T17163] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 840.953321][T17188] FAULT_INJECTION: forcing a failure. [ 840.953321][T17188] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 840.953357][T17188] CPU: 0 UID: 0 PID: 17188 Comm: syz.1.3403 Not tainted syzkaller #0 PREEMPT(full) [ 840.953380][T17188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 840.953392][T17188] Call Trace: [ 840.953402][T17188] [ 840.953411][T17188] dump_stack_lvl+0xe8/0x150 [ 840.953445][T17188] should_fail_ex+0x410/0x560 [ 840.953476][T17188] _copy_from_iter+0x1d3/0x1660 [ 840.953500][T17188] ? __alloc_skb+0x27a/0x7a0 [ 840.953526][T17188] ? __alloc_skb+0x27a/0x7a0 [ 840.953551][T17188] ? __alloc_skb+0x27a/0x7a0 [ 840.953574][T17188] ? __pfx__copy_from_iter+0x10/0x10 [ 840.953594][T17188] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 840.953624][T17188] ? __alloc_skb+0x27a/0x7a0 [ 840.953644][T17188] ? __alloc_skb+0x27a/0x7a0 [ 840.953673][T17188] ? netlink_sendmsg+0x650/0xb40 [ 840.953701][T17188] ? skb_put+0x112/0x210 [ 840.953738][T17188] netlink_sendmsg+0x6c0/0xb40 [ 840.953776][T17188] ? __pfx_netlink_sendmsg+0x10/0x10 [ 840.953813][T17188] ? apparmor_socket_sendmsg+0x98/0x360 [ 840.953838][T17188] ? __pfx_netlink_sendmsg+0x10/0x10 [ 840.953865][T17188] sock_sendmsg_nosec+0x13a/0x180 [ 840.953888][T17188] ____sys_sendmsg+0x54e/0x850 [ 840.953920][T17188] ? __pfx_____sys_sendmsg+0x10/0x10 [ 840.953956][T17188] ? import_iovec+0x73/0xa0 [ 840.953983][T17188] ___sys_sendmsg+0x2a5/0x360 [ 840.954007][T17188] ? __lock_acquire+0x747/0x2de0 [ 840.954033][T17188] ? __pfx____sys_sendmsg+0x10/0x10 [ 840.954095][T17188] ? __fget_files+0x2a/0x420 [ 840.954121][T17188] ? __fget_files+0x3a2/0x420 [ 840.954158][T17188] __x64_sys_sendmsg+0x1b1/0x290 [ 840.954187][T17188] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 840.954239][T17188] do_syscall_64+0x166/0x520 [ 840.954263][T17188] ? trace_irq_disable+0x3b/0x140 [ 840.954283][T17188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.954304][T17188] ? clear_bhb_loop+0x70/0xc0 [ 840.954329][T17188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.954349][T17188] RIP: 0033:0x7f691699e159 [ 840.954369][T17188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 840.954385][T17188] RSP: 002b:00007f6917890028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 840.954409][T17188] RAX: ffffffffffffffda RBX: 00007f6916c25fa0 RCX: 00007f691699e159 [ 840.954423][T17188] RDX: 0000000000000000 RSI: 0000200000001240 RDI: 0000000000000003 [ 840.954436][T17188] RBP: 00007f6917890090 R08: 0000000000000000 R09: 0000000000000000 [ 840.954449][T17188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 840.954461][T17188] R13: 00007f6916c26038 R14: 00007f6916c25fa0 R15: 00007ffc26caad38 [ 840.954493][T17188] [ 841.333076][T16829] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 841.353111][T16829] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 841.355960][T16829] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 841.467707][T16829] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 841.550346][T16829] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 841.571054][T16829] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 841.575699][T16829] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 841.610231][T16829] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 841.784512][T17198] syzkaller0: entered promiscuous mode [ 841.784538][T17198] syzkaller0: entered allmulticast mode [ 842.667393][T16829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 842.816761][T16829] 8021q: adding VLAN 0 to HW filter on device team0 [ 842.880186][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 842.880321][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 842.975562][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 842.975676][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 843.899146][T17269] syzkaller0: entered promiscuous mode [ 843.899382][T17269] syzkaller0: entered allmulticast mode [ 844.415317][T17295] FAULT_INJECTION: forcing a failure. [ 844.415317][T17295] name failslab, interval 1, probability 0, space 0, times 0 [ 844.415353][T17295] CPU: 0 UID: 0 PID: 17295 Comm: syz.4.3430 Not tainted syzkaller #0 PREEMPT(full) [ 844.415376][T17295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 844.415388][T17295] Call Trace: [ 844.415397][T17295] [ 844.415406][T17295] dump_stack_lvl+0xe8/0x150 [ 844.415441][T17295] should_fail_ex+0x410/0x560 [ 844.415469][T17295] should_failslab+0xa8/0x100 [ 844.415496][T17295] __kvmalloc_node_noprof+0x176/0x820 [ 844.415523][T17295] ? bitmap_port_create+0x283/0x770 [ 844.415643][T17295] ? bitmap_port_create+0x283/0x770 [ 844.415673][T17295] bitmap_port_create+0x283/0x770 [ 844.415694][T17295] ? __nla_parse+0x40/0x60 [ 844.415729][T17295] ? __pfx_bitmap_port_create+0x10/0x10 [ 844.415754][T17295] ip_set_create+0xae8/0x1a50 [ 844.415812][T17295] ? ip_set_create+0x4ef/0x1a50 [ 844.415853][T17295] ? __pfx_ip_set_create+0x10/0x10 [ 844.415921][T17295] nfnetlink_rcv_msg+0xcc2/0x12b0 [ 844.415970][T17295] ? unwind_get_return_address+0x4d/0x90 [ 844.416009][T17295] ? nfnetlink_rcv_msg+0x228/0x12b0 [ 844.416055][T17295] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 844.416134][T17295] netlink_rcv_skb+0x226/0x4a0 [ 844.416165][T17295] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 844.416198][T17295] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 844.416240][T17295] ? bpf_lsm_capable+0x9/0x20 [ 844.416258][T17295] ? security_capable+0x7e/0x2c0 [ 844.416291][T17295] nfnetlink_rcv+0x2b9/0x28c0 [ 844.416322][T17295] ? __dev_queue_xmit+0x29b/0x3820 [ 844.416355][T17295] ? __local_bh_enable_ip+0xd6/0x140 [ 844.416383][T17295] ? lockdep_hardirqs_on+0x7b/0x110 [ 844.416408][T17295] ? __dev_queue_xmit+0x29b/0x3820 [ 844.416433][T17295] ? __local_bh_enable_ip+0xd6/0x140 [ 844.416456][T17295] ? __dev_queue_xmit+0x29b/0x3820 [ 844.416483][T17295] ? __dev_queue_xmit+0x1edc/0x3820 [ 844.416507][T17295] ? do_syscall_64+0x166/0x520 [ 844.416529][T17295] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 844.416563][T17295] ? __dev_queue_xmit+0x29b/0x3820 [ 844.416591][T17295] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 844.416624][T17295] ? __pfx___dev_queue_xmit+0x10/0x10 [ 844.416661][T17295] ? ref_tracker_free+0x689/0x830 [ 844.416717][T17295] ? __pfx_ref_tracker_free+0x10/0x10 [ 844.416750][T17295] ? __skb_clone+0x449/0x6c0 [ 844.416792][T17295] ? skb_clone+0x246/0x3a0 [ 844.416822][T17295] ? __netlink_deliver_tap+0x811/0x860 [ 844.416850][T17295] ? netlink_deliver_tap+0x2e/0x1b0 [ 844.416885][T17295] ? netlink_deliver_tap+0x2e/0x1b0 [ 844.416912][T17295] ? netlink_deliver_tap+0x2e/0x1b0 [ 844.416942][T17295] netlink_unicast+0x7bd/0x940 [ 844.416977][T17295] netlink_sendmsg+0x813/0xb40 [ 844.417014][T17295] ? __pfx_netlink_sendmsg+0x10/0x10 [ 844.417050][T17295] ? apparmor_socket_sendmsg+0x98/0x360 [ 844.417076][T17295] ? __pfx_netlink_sendmsg+0x10/0x10 [ 844.417104][T17295] sock_sendmsg_nosec+0x13a/0x180 [ 844.417129][T17295] ____sys_sendmsg+0x54e/0x850 [ 844.417162][T17295] ? __pfx_____sys_sendmsg+0x10/0x10 [ 844.417199][T17295] ? import_iovec+0x73/0xa0 [ 844.417228][T17295] ___sys_sendmsg+0x2a5/0x360 [ 844.417253][T17295] ? __lock_acquire+0x747/0x2de0 [ 844.417278][T17295] ? __pfx____sys_sendmsg+0x10/0x10 [ 844.417343][T17295] ? __fget_files+0x2a/0x420 [ 844.417369][T17295] ? __fget_files+0x3a2/0x420 [ 844.417407][T17295] __x64_sys_sendmsg+0x1b1/0x290 [ 844.417437][T17295] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 844.417485][T17295] do_syscall_64+0x166/0x520 [ 844.417508][T17295] ? trace_irq_disable+0x3b/0x140 [ 844.417528][T17295] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 844.417548][T17295] ? clear_bhb_loop+0x70/0xc0 [ 844.417574][T17295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 844.417594][T17295] RIP: 0033:0x7f513bd9e159 [ 844.417614][T17295] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 844.417631][T17295] RSP: 002b:00007f513cbdd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 844.417654][T17295] RAX: ffffffffffffffda RBX: 00007f513c025fa0 RCX: 00007f513bd9e159 [ 844.417669][T17295] RDX: 0000000000000000 RSI: 0000200000001240 RDI: 0000000000000003 [ 844.417683][T17295] RBP: 00007f513cbdd090 R08: 0000000000000000 R09: 0000000000000000 [ 844.417696][T17295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 844.417709][T17295] R13: 00007f513c026038 R14: 00007f513c025fa0 R15: 00007ffec38d68e8 [ 844.417745][T17295] [ 844.951422][T17299] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3432'. [ 844.951461][T17299] netlink: 'syz.5.3432': attribute type 7 has an invalid length. [ 844.951475][T17299] netlink: 'syz.5.3432': attribute type 8 has an invalid length. [ 844.951488][T17299] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3432'. [ 844.962134][T17299] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3432'. [ 844.962195][T17299] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3432'. [ 845.079216][T17304] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3432'. [ 845.079283][T17304] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3432'. [ 845.844325][T17333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3440'. [ 845.879639][T17329] syzkaller0: entered promiscuous mode [ 845.879887][T17329] syzkaller0: entered allmulticast mode [ 846.303317][T16829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 846.455872][T17340] syzkaller0: entered promiscuous mode [ 846.455896][T17340] syzkaller0: entered allmulticast mode [ 846.881512][T16829] veth0_vlan: entered promiscuous mode [ 846.965247][T17357] openvswitch: netlink: Duplicate or invalid key (type 0). [ 846.982575][T16829] veth1_vlan: entered promiscuous mode [ 847.042891][ T1043] IPVS: starting estimator thread 0... [ 847.114893][T17362] FAULT_INJECTION: forcing a failure. [ 847.114893][T17362] name failslab, interval 1, probability 0, space 0, times 0 [ 847.114928][T17362] CPU: 0 UID: 0 PID: 17362 Comm: syz.4.3450 Not tainted syzkaller #0 PREEMPT(full) [ 847.114951][T17362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 847.114963][T17362] Call Trace: [ 847.114972][T17362] [ 847.114981][T17362] dump_stack_lvl+0xe8/0x150 [ 847.115016][T17362] should_fail_ex+0x410/0x560 [ 847.115043][T17362] ? __alloc_skb+0x1db/0x7a0 [ 847.115067][T17362] should_failslab+0xa8/0x100 [ 847.115092][T17362] ? __alloc_skb+0x1db/0x7a0 [ 847.115113][T17362] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 847.115142][T17362] ? __alloc_skb+0x18d/0x7a0 [ 847.115165][T17362] ? __alloc_skb+0x1db/0x7a0 [ 847.115199][T17362] __alloc_skb+0x1db/0x7a0 [ 847.115236][T17362] netlink_ack+0x136/0xb30 [ 847.115282][T17362] netlink_rcv_skb+0x2a4/0x4a0 [ 847.115312][T17362] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 847.115341][T17362] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 847.115381][T17362] ? bpf_lsm_capable+0x9/0x20 [ 847.115400][T17362] ? security_capable+0x7e/0x2c0 [ 847.115431][T17362] nfnetlink_rcv+0x2b9/0x28c0 [ 847.115462][T17362] ? __dev_queue_xmit+0x29b/0x3820 [ 847.115494][T17362] ? __local_bh_enable_ip+0xd6/0x140 [ 847.115521][T17362] ? lockdep_hardirqs_on+0x7b/0x110 [ 847.115545][T17362] ? __dev_queue_xmit+0x29b/0x3820 [ 847.115570][T17362] ? __local_bh_enable_ip+0xd6/0x140 [ 847.115593][T17362] ? __dev_queue_xmit+0x29b/0x3820 [ 847.115619][T17362] ? __dev_queue_xmit+0x1edc/0x3820 [ 847.115645][T17362] ? do_syscall_64+0x166/0x520 [ 847.115668][T17362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.115701][T17362] ? __dev_queue_xmit+0x29b/0x3820 [ 847.115729][T17362] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 847.115761][T17362] ? __pfx___dev_queue_xmit+0x10/0x10 [ 847.115797][T17362] ? ref_tracker_free+0x689/0x830 [ 847.115824][T17362] ? __pfx_ref_tracker_free+0x10/0x10 [ 847.115856][T17362] ? __skb_clone+0x449/0x6c0 [ 847.115889][T17362] ? skb_clone+0x246/0x3a0 [ 847.115919][T17362] ? __netlink_deliver_tap+0x811/0x860 [ 847.115946][T17362] ? netlink_deliver_tap+0x2e/0x1b0 [ 847.115981][T17362] ? netlink_deliver_tap+0x2e/0x1b0 [ 847.116008][T17362] ? netlink_deliver_tap+0x2e/0x1b0 [ 847.116042][T17362] netlink_unicast+0x7bd/0x940 [ 847.116080][T17362] netlink_sendmsg+0x813/0xb40 [ 847.116119][T17362] ? __pfx_netlink_sendmsg+0x10/0x10 [ 847.116156][T17362] ? apparmor_socket_sendmsg+0x98/0x360 [ 847.116181][T17362] ? __pfx_netlink_sendmsg+0x10/0x10 [ 847.116209][T17362] sock_sendmsg_nosec+0x13a/0x180 [ 847.116250][T17362] ____sys_sendmsg+0x54e/0x850 [ 847.116283][T17362] ? __pfx_____sys_sendmsg+0x10/0x10 [ 847.116319][T17362] ? import_iovec+0x73/0xa0 [ 847.116348][T17362] ___sys_sendmsg+0x2a5/0x360 [ 847.116372][T17362] ? __lock_acquire+0x747/0x2de0 [ 847.116397][T17362] ? __pfx____sys_sendmsg+0x10/0x10 [ 847.116459][T17362] ? __fget_files+0x2a/0x420 [ 847.116484][T17362] ? __fget_files+0x3a2/0x420 [ 847.116521][T17362] __x64_sys_sendmsg+0x1b1/0x290 [ 847.116549][T17362] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 847.116598][T17362] do_syscall_64+0x166/0x520 [ 847.116620][T17362] ? trace_irq_disable+0x3b/0x140 [ 847.116640][T17362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.116659][T17362] ? clear_bhb_loop+0x70/0xc0 [ 847.116685][T17362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 847.116705][T17362] RIP: 0033:0x7f513bd9e159 [ 847.116724][T17362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 847.116748][T17362] RSP: 002b:00007f513cbdd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 847.116771][T17362] RAX: ffffffffffffffda RBX: 00007f513c025fa0 RCX: 00007f513bd9e159 [ 847.116786][T17362] RDX: 0000000000000000 RSI: 0000200000001240 RDI: 0000000000000003 [ 847.116798][T17362] RBP: 00007f513cbdd090 R08: 0000000000000000 R09: 0000000000000000 [ 847.116810][T17362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 847.116823][T17362] R13: 00007f513c026038 R14: 00007f513c025fa0 R15: 00007ffec38d68e8 [ 847.116862][T17362] [ 847.159846][T17360] IPVS: using max 27 ests per chain, 64800 per kthread [ 847.566934][T17368] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3451'. [ 847.676263][T16829] veth0_macvtap: entered promiscuous mode [ 847.837120][T17375] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3451'. [ 848.241159][T17371] syzkaller0: entered promiscuous mode [ 848.241395][T17371] syzkaller0: entered allmulticast mode [ 848.285593][T16829] veth1_macvtap: entered promiscuous mode [ 848.344440][T17395] netlink: 'syz.1.3456': attribute type 1 has an invalid length. [ 848.447875][T17401] netlink: 252 bytes leftover after parsing attributes in process `syz.5.3459'. [ 848.614806][T17405] openvswitch: netlink: Duplicate or invalid key (type 0). [ 851.982191][T17395] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 852.229647][T16829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 852.293662][T16829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 852.429273][ T1043] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.429326][ T1043] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.429363][ T1043] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.469247][ T2988] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.732944][T17443] syzkaller0: entered promiscuous mode [ 852.733182][T17443] syzkaller0: entered allmulticast mode [ 852.815768][T17449] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 852.844524][ T2988] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.844549][ T2988] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 852.917347][T12157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 852.917370][T12157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 853.212130][T17456] __nla_validate_parse: 1 callbacks suppressed [ 853.212155][T17456] netlink: 252 bytes leftover after parsing attributes in process `syz.4.3470'. [ 853.258974][T17460] netlink: 'syz.2.3472': attribute type 6 has an invalid length. [ 853.259000][T17460] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3472'. [ 853.472071][T17462] ip_tables: iptables: counters copy to user failed while replacing table [ 854.219185][T17471] syzkaller0: entered promiscuous mode [ 854.219212][T17471] syzkaller0: entered allmulticast mode [ 854.352841][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 854.358629][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 854.371244][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 854.384907][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 854.395388][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 854.436708][T17484] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3478'. [ 854.700428][T14426] IPVS: starting estimator thread 0... [ 854.789253][T17493] IPVS: using max 25 ests per chain, 60000 per kthread [ 856.449811][ T52] Bluetooth: hci0: command tx timeout [ 858.528014][ T52] Bluetooth: hci0: command tx timeout [ 859.141958][ T5627] bond8: (slave syz_tun): Removing an active aggregator [ 859.142543][ T5627] bond8: (slave syz_tun): Releasing backup interface [ 859.680298][T17576] FAULT_INJECTION: forcing a failure. [ 859.680298][T17576] name failslab, interval 1, probability 0, space 0, times 0 [ 859.680332][T17576] CPU: 0 UID: 0 PID: 17576 Comm: syz.2.3486 Not tainted syzkaller #0 PREEMPT(full) [ 859.680355][T17576] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 859.680367][T17576] Call Trace: [ 859.680375][T17576] [ 859.680385][T17576] dump_stack_lvl+0xe8/0x150 [ 859.680420][T17576] should_fail_ex+0x410/0x560 [ 859.680448][T17576] should_failslab+0xa8/0x100 [ 859.680475][T17576] ? skb_clone+0x212/0x3a0 [ 859.680501][T17576] kmem_cache_alloc_noprof+0xa1/0x600 [ 859.680533][T17576] ? skb_clone+0x212/0x3a0 [ 859.680568][T17576] skb_clone+0x212/0x3a0 [ 859.680598][T17576] bpf_clone_redirect+0x170/0x4b0 [ 859.680691][T17576] ? bpf_test_run+0x1d1/0x830 [ 859.680721][T17576] bpf_prog_047103ee48f4f65a+0x5f/0x68 [ 859.680745][T17576] ? __kernel_text_address+0xd/0x30 [ 859.680771][T17576] ? arch_stack_walk+0xfb/0x150 [ 859.680799][T17576] ? __pfx___schedule+0x10/0x10 [ 859.680840][T17576] ? preempt_schedule_thunk+0x16/0x40 [ 859.680866][T17576] ? preempt_schedule_common+0x7f/0xd0 [ 859.680887][T17576] ? bpf_test_run+0x1d1/0x830 [ 859.680919][T17576] ? bpf_test_timer_continue+0x10c/0x320 [ 859.680944][T17576] bpf_test_run+0x354/0x830 [ 859.680994][T17576] ? __pfx_bpf_test_run+0x10/0x10 [ 859.681038][T17576] ? __kasan_krealloc+0xec/0x110 [ 859.681069][T17576] ? bpf_prog_test_run_skb+0x903/0x2230 [ 859.681096][T17576] ? convert___skb_to_skb+0x3d/0x5b0 [ 859.681128][T17576] bpf_prog_test_run_skb+0xe35/0x2230 [ 859.681178][T17576] ? __fget_files+0x3a2/0x420 [ 859.681204][T17576] ? __fget_files+0x2a/0x420 [ 859.681235][T17576] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 859.681264][T17576] bpf_prog_test_run+0x2c5/0x340 [ 859.681300][T17576] __sys_bpf+0xa22/0xd90 [ 859.681333][T17576] ? __pfx___sys_bpf+0x10/0x10 [ 859.681367][T17576] ? __fget_files+0x2a/0x420 [ 859.681412][T17576] ? ksys_write+0x242/0x270 [ 859.681443][T17576] ? __pfx_ksys_write+0x10/0x10 [ 859.681477][T17576] __x64_sys_bpf+0xba/0xd0 [ 859.681501][T17576] do_syscall_64+0x166/0x520 [ 859.681525][T17576] ? trace_irq_disable+0x3b/0x140 [ 859.681544][T17576] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.681566][T17576] ? clear_bhb_loop+0x70/0xc0 [ 859.681591][T17576] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.681611][T17576] RIP: 0033:0x7f55ba19e159 [ 859.681631][T17576] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 859.681648][T17576] RSP: 002b:00007f55b83d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 859.681672][T17576] RAX: ffffffffffffffda RBX: 00007f55ba426090 RCX: 00007f55ba19e159 [ 859.681686][T17576] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 859.681699][T17576] RBP: 00007f55b83d5090 R08: 0000000000000000 R09: 0000000000000000 [ 859.681712][T17576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 859.681725][T17576] R13: 00007f55ba426128 R14: 00007f55ba426090 R15: 00007fff8550ebf8 [ 859.681759][T17576] [ 859.840620][ T2988] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 859.840656][ T2988] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 860.214131][T17584] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3484'. [ 860.592482][T17591] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3489'. [ 860.608097][ T52] Bluetooth: hci0: command tx timeout [ 860.623482][ T2988] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 860.661798][ T2988] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 861.012885][ T2988] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 861.012924][ T2988] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 861.287931][ T2988] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 861.287971][ T2988] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 861.308136][T17608] netlink: 316 bytes leftover after parsing attributes in process `syz.0.3496'. [ 861.308162][T17608] netlink: 316 bytes leftover after parsing attributes in process `syz.0.3496'. [ 861.479466][T17612] netlink: zone id is out of range [ 861.479486][T17612] netlink: zone id is out of range [ 861.479497][T17612] netlink: zone id is out of range [ 861.479506][T17612] netlink: del zone limit has 4 unknown bytes [ 861.555550][T17482] wg0 speed is unknown, defaulting to 1000 [ 861.831510][T17622] ip_tables: iptables: counters copy to user failed while replacing table [ 861.937625][T17624] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3503'. [ 861.937664][T17624] block nbd0: not configured, cannot reconfigure [ 862.508986][ T2988] vlan2: left allmulticast mode [ 862.509011][ T2988] geneve0: left allmulticast mode [ 862.509031][ T2988] vlan2: left promiscuous mode [ 862.509043][ T2988] geneve0: left promiscuous mode [ 862.532124][ T2988] bridge0: port 1(vlan2) entered disabled state [ 862.581779][ T2988] bridge_slave_1: left allmulticast mode [ 862.582240][ T2988] bridge_slave_1: left promiscuous mode [ 862.599174][ T2988] bridge0: port 2(bridge_slave_1) entered disabled state [ 862.688541][ T52] Bluetooth: hci0: command tx timeout [ 862.755806][ T2988] dvmrp0: left allmulticast mode [ 862.803954][T17636] Bluetooth: MGMT ver 1.23 [ 863.569987][T17652] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 864.134034][ T2988] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 864.135916][ T2988] .` (unregistering): Released all slaves [ 864.162471][ T2988] bond0 (unregistering): Released all slaves [ 864.186697][ T2988] bond1 (unregistering): Released all slaves [ 864.215961][ T2988] bond2 (unregistering): Released all slaves [ 864.243715][ T2988] bond3 (unregistering): Released all slaves [ 864.283641][ T2988] bond4 (unregistering): Released all slaves [ 864.312914][ T2988] bond5 (unregistering): Released all slaves [ 864.337371][ T2988] bond6 (unregistering): Released all slaves [ 864.366613][ T2988] bond7 (unregistering): (slave veth11): Releasing active interface [ 864.366645][ T2988] dummy0: entered promiscuous mode [ 864.391033][ T2988] bond7 (unregistering): (slave dummy0): Releasing active interface [ 864.391062][ T2988] dummy0: left promiscuous mode [ 864.394376][ T2988] bond7 (unregistering): Released all slaves [ 864.413886][ T2988] bond8 (unregistering): Released all slaves [ 864.834072][ T2988] tipc: Left network mode [ 864.877575][T17661] xt_nfacct: accounting object `' does not exist [ 864.991665][T17664] netlink: 'syz.4.3517': attribute type 2 has an invalid length. [ 866.060687][T17690] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 866.060715][T17690] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 866.260946][T17701] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3527'. [ 866.260985][T17701] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3527'. [ 866.266603][T17698] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3530'. [ 866.522545][T17698] syz_tun: entered promiscuous mode [ 866.595203][T17482] bridge0: port 1(bridge_slave_0) entered blocking state [ 866.595362][T17482] bridge0: port 1(bridge_slave_0) entered disabled state [ 866.595536][T17482] bridge_slave_0: entered allmulticast mode [ 866.606231][T17482] bridge_slave_0: entered promiscuous mode [ 866.616588][T17482] bridge0: port 2(bridge_slave_1) entered blocking state [ 866.616696][T17482] bridge0: port 2(bridge_slave_1) entered disabled state [ 866.616821][T17482] bridge_slave_1: entered allmulticast mode [ 866.632019][T17482] bridge_slave_1: entered promiscuous mode [ 867.047747][T17482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 867.051957][T17482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 867.106824][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 867.123597][T17720] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3534'. [ 867.222179][T17482] team0: Port device team_slave_0 added [ 867.275341][T17482] team0: Port device team_slave_1 added [ 867.551850][T17482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 867.551870][T17482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 867.551896][T17482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 867.569754][T17482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 867.569772][T17482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 867.569796][T17482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 867.680499][T17728] Bluetooth: MGMT ver 1.23 [ 867.694971][T17728] Bluetooth: hci1: too big key_count value 29096 [ 867.989774][T17482] hsr_slave_0: entered promiscuous mode [ 867.997361][T17482] hsr_slave_1: entered promiscuous mode [ 868.003796][T17482] debugfs: 'hsr0' already exists in 'hsr' [ 868.003818][T17482] Cannot create hsr debugfs directory [ 869.129828][T17736] bridge0: port 2(bridge_slave_1) entered disabled state [ 869.130605][T17736] bridge0: port 1(bridge_slave_0) entered disabled state [ 869.564425][T17736] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 869.591269][T17736] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 869.919783][ T5282] 8021q: adding VLAN 0 to HW filter on device eth5 [ 869.977487][T17775] tipc: Started in network mode [ 869.977521][T17775] tipc: Node identity ee20829467ea, cluster identity 4711 [ 869.977701][T17775] tipc: Enabled bearer , priority 0 [ 869.980066][T17772] syzkaller0: entered promiscuous mode [ 869.980086][T17772] syzkaller0: entered allmulticast mode [ 870.083284][T14696] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.084341][T14696] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.084386][T14696] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.084422][T14696] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 870.134856][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.187809][T17756] tipc: Resetting bearer [ 870.283268][T17756] tipc: Disabling bearer [ 870.514191][ T2988] hsr_slave_0: left promiscuous mode [ 870.516037][ T2988] hsr_slave_1: left promiscuous mode [ 870.517184][ T2988] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 870.517207][ T2988] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 870.520680][T17785] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3550'. [ 870.521006][ T2988] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 870.521025][ T2988] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 870.537236][ T2988] veth1_vlan: left promiscuous mode [ 871.237168][ T2988] team0 (unregistering): Port device team_slave_1 removed [ 871.279912][ T2988] team0 (unregistering): Port device team_slave_0 removed [ 871.617288][T17783] batman_adv: batadv0: Adding interface: syzkaller0 [ 871.617311][T17783] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 871.617345][T17783] batman_adv: batadv0: Interface activated: syzkaller0 [ 871.670844][T17790] netlink: 'syz.4.3552': attribute type 10 has an invalid length. [ 871.689569][T17782] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 871.842493][T17782] batman_adv: batadv0: Removing interface: syzkaller0 [ 872.571069][ T2988] IPVS: stop unused estimator thread 0... [ 872.597371][T17814] netlink: 15 bytes leftover after parsing attributes in process `syz.5.3556'. [ 874.090155][T17482] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 874.124025][T17482] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 874.137528][T17482] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 874.232184][T17482] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 874.242412][T17482] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 874.269737][T17482] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 874.312652][T17482] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 874.354078][T17482] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 874.470776][T17879] syz_tun: entered allmulticast mode [ 874.479916][T17866] 0: reclassify loop, rule prio 0, protocol 03 [ 874.520587][T17879] dvmrp6: entered allmulticast mode [ 874.875853][T17482] 8021q: adding VLAN 0 to HW filter on device bond0 [ 874.907499][T17889] xt_hashlimit: size too large, truncated to 1048576 [ 875.015395][T17482] 8021q: adding VLAN 0 to HW filter on device team0 [ 875.015981][T17859] syz_tun: left allmulticast mode [ 875.044399][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 875.044518][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 875.120831][T14696] bridge0: port 2(bridge_slave_1) entered blocking state [ 875.120972][T14696] bridge0: port 2(bridge_slave_1) entered forwarding state [ 875.415173][T17902] syzkaller0: entered promiscuous mode [ 875.415209][T17902] syzkaller0: entered allmulticast mode [ 875.499143][T17902] tc mirred to Houston: device batadv_slave_0 is down [ 875.534826][T17906] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3579'. [ 875.960329][T17922] syzkaller0: entered promiscuous mode [ 875.960358][T17922] syzkaller0: entered allmulticast mode [ 877.736973][T13355] Bluetooth: hci0: command tx timeout [ 877.792484][T17992] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3599'. [ 879.645282][T18012] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3601'. [ 880.293954][T17482] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 880.411934][T18041] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3611'. [ 880.450968][T17482] veth0_vlan: entered promiscuous mode [ 880.479680][T17482] veth1_vlan: entered promiscuous mode [ 880.662262][T17482] veth0_macvtap: entered promiscuous mode [ 880.744551][T17482] veth1_macvtap: entered promiscuous mode [ 880.900731][ T5732] hid-generic 0005:0B57:0009.0008: item fetching failed at offset 0/1 [ 880.907534][ T5732] hid-generic 0005:0B57:0009.0008: probe with driver hid-generic failed with error -22 [ 880.970562][T17482] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 881.012822][T17482] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 881.106975][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 881.107027][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 881.107063][ T59] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 881.229611][T14695] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 881.373972][T14696] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 881.373995][T14696] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 881.473455][T12157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 881.473480][T12157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 881.896719][T18085] debugfs: '1ща^!' already exists in 'ieee80211' [ 882.266405][T18102] syzkaller0: entered promiscuous mode [ 882.266431][T18102] syzkaller0: entered allmulticast mode [ 883.872169][T18148] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 884.200199][T18159] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 884.203080][T18159] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 884.303333][T18157] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3659'. [ 884.430833][T18166] x_tables: duplicate entry at hook 1 [ 884.466331][T18166] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3665'. [ 884.490916][T18168] wg2 speed is unknown, defaulting to 1000 [ 884.494474][T18168] wg2 speed is unknown, defaulting to 1000 [ 884.496033][T18168] wg2 speed is unknown, defaulting to 1000 [ 884.519756][T18166] netlink: 'syz.4.3665': attribute type 1 has an invalid length. [ 884.908961][T18168] infiniband syz2: set active [ 884.909027][T14370] wg2 speed is unknown, defaulting to 1000 [ 884.909109][T18168] infiniband syz2: added wg2 [ 884.973726][T18168] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 884.973772][T18168] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 884.973813][T18168] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 885.154183][T18168] RDS/IB: syz2: added [ 885.154248][T18168] smc: adding ib device syz2 with port count 1 [ 885.154270][T18168] smc: ib device syz2 port 1 has no pnetid [ 885.154374][T14370] wg2 speed is unknown, defaulting to 1000 [ 885.176055][T18168] wg2 speed is unknown, defaulting to 1000 [ 885.551323][T18168] wg2 speed is unknown, defaulting to 1000 [ 885.970396][T18168] wg2 speed is unknown, defaulting to 1000 [ 886.755962][T18213] 0: reclassify loop, rule prio 0, protocol 03 [ 886.854667][T18168] wg2 speed is unknown, defaulting to 1000 [ 886.856207][T18219] netlink: 'syz.4.3684': attribute type 11 has an invalid length. [ 887.041574][T18221] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 887.090610][T18221] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 887.907113][T18168] wg2 speed is unknown, defaulting to 1000 [ 888.606341][T18168] wg2 speed is unknown, defaulting to 1000 [ 888.611918][T18283] syzkaller0: entered promiscuous mode [ 888.611939][T18283] syzkaller0: entered allmulticast mode [ 889.140587][T18279] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 889.140616][T18279] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 889.257504][T18279] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 889.257532][T18279] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 889.392950][T18279] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 889.392979][T18279] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 889.425990][T18279] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 889.426018][T18279] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 890.332181][T18236] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 891.485913][T18371] netlink: 'syz.0.3736': attribute type 12 has an invalid length. [ 891.505509][T18371] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3736'. [ 892.846696][T18420] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3756'. [ 893.024217][T18426] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 893.063140][T18429] netlink: 'syz.5.3759': attribute type 11 has an invalid length. [ 893.154899][T18429] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 893.312935][T18435] syzkaller0: entered promiscuous mode [ 893.312961][T18435] syzkaller0: entered allmulticast mode [ 893.363813][T18439] tipc: Started in network mode [ 893.363847][T18439] tipc: Node identity ac14140f, cluster identity 4711 [ 893.366121][T18439] tipc: New replicast peer: 255.255.255.255 [ 893.366550][T18439] tipc: Enabled bearer , priority 10 [ 893.696084][T18450] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3770'. [ 893.928945][T18460] netlink: 'syz.5.3775': attribute type 11 has an invalid length. [ 893.987246][T18460] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 894.137643][T18473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3774'. [ 894.488389][ T990] tipc: Node number set to 2886997007 [ 894.702639][T18495] netlink: 356 bytes leftover after parsing attributes in process `syz.4.3786'. [ 894.772066][T18498] netlink: 'syz.2.3788': attribute type 1 has an invalid length. [ 895.055837][T18510] netlink: 'syz.0.3792': attribute type 11 has an invalid length. [ 895.115587][T18510] syz_tun: left promiscuous mode [ 895.131445][T18510] 8021q: adding VLAN 0 to HW filter on device bond0 [ 895.133123][T18510] 8021q: adding VLAN 0 to HW filter on device team0 [ 895.157639][T18510] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 895.215744][T18510] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 895.225851][T18510] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 895.240189][T18510] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 895.240217][T18510] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 895.244291][T18510] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 895.262743][ T2988] bridge0: port 1(bridge_slave_0) entered blocking state [ 895.262850][ T2988] bridge0: port 1(bridge_slave_0) entered forwarding state [ 895.270479][ T2988] bridge0: port 2(bridge_slave_1) entered blocking state [ 895.270619][ T2988] bridge0: port 2(bridge_slave_1) entered forwarding state [ 895.658506][T18532] netlink: 356 bytes leftover after parsing attributes in process `syz.5.3800'. [ 895.660551][T18531] batman_adv: batadv0: Adding interface: syzkaller0 [ 895.660568][T18531] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 895.660601][T18531] batman_adv: batadv0: Interface activated: syzkaller0 [ 896.546652][T18529] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 896.696068][T18529] batman_adv: batadv0: Removing interface: syzkaller0 [ 896.727018][T18534] tipc: Started in network mode [ 896.727052][T18534] tipc: Node identity aaaaaaaaaa3a, cluster identity 4711 [ 896.731989][T18534] tipc: Enabled bearer , priority 7 [ 897.621834][T18567] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3813'. [ 897.848096][T14370] tipc: Node number set to 9480874 [ 898.003221][T18571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3814'. [ 898.187046][T18575] netlink: 356 bytes leftover after parsing attributes in process `syz.0.3816'. [ 899.664960][T18619] netlink: 332 bytes leftover after parsing attributes in process `syz.4.3832'. [ 900.382802][T18647] batman_adv: batadv0: Adding interface: syzkaller0 [ 900.382824][T18647] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 900.382855][T18647] batman_adv: batadv0: Interface activated: syzkaller0 [ 900.392444][T18644] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 901.178355][T18644] batman_adv: batadv0: Removing interface: syzkaller0 [ 901.226911][T18665] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 901.641396][T18685] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3857'. [ 901.647857][T18685] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 901.750334][T18691] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 902.861262][T18727] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 903.675471][T18749] batman_adv: batadv0: Adding interface: veth0 [ 903.675494][T18749] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 903.675537][T18749] batman_adv: batadv0: Interface activated: veth0 [ 903.771340][T18749] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 903.771370][T18749] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 903.779601][T18749] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 903.779624][T18749] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 903.822705][T18749] batman_adv: batadv0: Interface deactivated: veth0 [ 903.822732][T18749] batman_adv: batadv0: Removing interface: veth0 [ 904.050706][T18761] syzkaller0: entered promiscuous mode [ 904.050732][T18761] syzkaller0: entered allmulticast mode [ 904.294127][T18772] netlink: 'syz.5.3884': attribute type 2 has an invalid length. [ 904.294158][T18772] netlink: 'syz.5.3884': attribute type 2 has an invalid length. [ 904.436867][T18776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3888'. [ 904.852339][T18793] netlink: 'syz.4.3896': attribute type 10 has an invalid length. [ 905.220750][T18807] syzkaller0: entered promiscuous mode [ 905.220775][T18807] syzkaller0: entered allmulticast mode [ 905.722602][T18825] syzkaller0: entered promiscuous mode [ 905.722628][T18825] syzkaller0: entered allmulticast mode [ 906.570905][T18865] syzkaller0: entered promiscuous mode [ 906.570931][T18865] syzkaller0: entered allmulticast mode [ 906.789679][T18876] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3932'. [ 906.962243][T18883] netlink: 'syz.0.3935': attribute type 11 has an invalid length. [ 907.018969][T18883] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 907.369680][T18896] syzkaller0: entered promiscuous mode [ 907.369706][T18896] syzkaller0: entered allmulticast mode [ 907.585485][T18908] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3945'. [ 907.594125][T18906] syzkaller0: entered promiscuous mode [ 907.594147][T18906] syzkaller0: entered allmulticast mode [ 907.740152][T18914] syzkaller0: entered promiscuous mode [ 907.740177][T18914] syzkaller0: entered allmulticast mode [ 907.927191][T18920] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 908.470860][T18948] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3957'. [ 908.588528][T18949] syzkaller0: entered promiscuous mode [ 908.588555][T18949] syzkaller0: entered allmulticast mode [ 908.761751][T18956] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 908.767835][ T5724] wg2 speed is unknown, defaulting to 1000 [ 908.918404][T18966] syz_tun: entered allmulticast mode [ 908.923978][T18966] wg2: entered allmulticast mode [ 908.926829][T18965] syz_tun: left allmulticast mode [ 909.183638][T18976] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 910.105038][T19003] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 910.225774][T19001] syzkaller0: entered promiscuous mode [ 910.225801][T19001] syzkaller0: entered allmulticast mode [ 910.664273][T19019] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3985'. [ 910.719194][T19024] syz_tun: entered allmulticast mode [ 910.721008][T19023] syz_tun: left allmulticast mode [ 911.131295][T19039] syzkaller0: entered promiscuous mode [ 911.131322][T19039] syzkaller0: entered allmulticast mode [ 911.771848][T19057] syz_tun: entered allmulticast mode [ 911.777084][T19056] syz_tun: left allmulticast mode [ 913.017840][T19106] syzkaller0: entered promiscuous mode [ 913.029613][T19106] syzkaller0: entered allmulticast mode [ 913.416024][T19119] syz_tun: entered allmulticast mode [ 913.421967][T19118] syz_tun: left allmulticast mode [ 913.456689][T19122] netlink: 'syz.0.4014': attribute type 2 has an invalid length. [ 913.456718][T19122] netlink: 'syz.0.4014': attribute type 2 has an invalid length. [ 913.590106][T19129] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4017'. [ 913.590140][T19129] block nbd0: not configured, cannot reconfigure [ 914.092097][T19143] syzkaller0: entered promiscuous mode [ 914.092123][T19143] syzkaller0: entered allmulticast mode [ 914.335418][T19149] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4027'. [ 914.864762][T19172] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4036'. [ 915.062428][T19179] syzkaller0: entered promiscuous mode [ 915.062453][T19179] syzkaller0: entered allmulticast mode [ 915.331715][T19192] syzkaller0: entered promiscuous mode [ 915.331742][T19192] syzkaller0: entered allmulticast mode [ 915.989768][T19217] wg0 speed is unknown, defaulting to 1000 [ 915.996197][T19217] wg2 speed is unknown, defaulting to 1000 [ 916.222064][T19227] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4051'. [ 916.410639][T19235] IPVS: set_ctl: invalid protocol: 22 100.1.1.0:20004 [ 916.549405][T19239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4057'. [ 916.588255][T19239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4057'. [ 916.598922][T19239] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4057'. [ 916.599779][ T2988] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 916.599824][ T2988] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 916.599859][ T2988] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 916.621434][T14696] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 917.548019][T19275] netlink: 'syz.4.4067': attribute type 6 has an invalid length. [ 918.124596][T19294] syzkaller0: entered promiscuous mode [ 918.124621][T19294] syzkaller0: entered allmulticast mode [ 918.199883][T19298] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4072'. [ 918.328861][T19300] syz_tun: entered allmulticast mode [ 918.331211][T19299] syz_tun: left allmulticast mode [ 919.087338][T19305] tipc: Enabled bearer , priority 0 [ 919.091134][T19305] syzkaller0: entered promiscuous mode [ 919.091155][T19305] syzkaller0: entered allmulticast mode [ 919.097435][T19305] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 919.237002][T19305] tipc: Resetting bearer [ 919.379728][T19303] tipc: Resetting bearer [ 919.520135][T19303] tipc: Disabling bearer [ 919.756756][T19335] syzkaller0: entered promiscuous mode [ 919.756781][T19335] syzkaller0: entered allmulticast mode [ 920.044751][T19342] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4091'. [ 920.132075][T19351] syz_tun: entered allmulticast mode [ 920.132720][T19351] wg2: entered allmulticast mode [ 920.134552][T19350] syz_tun: left allmulticast mode [ 920.157006][T19353] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4096'. [ 921.044503][T19380] syzkaller0: entered promiscuous mode [ 921.044530][T19380] syzkaller0: entered allmulticast mode [ 921.219572][T19389] syz_tun: entered allmulticast mode [ 921.226859][T19388] syz_tun: left allmulticast mode [ 921.914031][T19410] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4116'. [ 921.915489][T19416] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 922.163094][T19424] syzkaller0: entered promiscuous mode [ 922.163120][T19424] syzkaller0: entered allmulticast mode [ 922.234300][T19426] syz_tun: entered allmulticast mode [ 922.236261][T19426] wg2: entered allmulticast mode [ 922.237073][T19425] syz_tun: left allmulticast mode [ 923.955400][T19496] netlink: 'syz.2.4154': attribute type 1 has an invalid length. [ 923.978452][T19495] netlink: 'syz.1.4153': attribute type 2 has an invalid length. [ 923.978480][T19495] netlink: 'syz.1.4153': attribute type 2 has an invalid length. [ 924.010832][T19501] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4154'. [ 924.010869][T19501] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4154'. [ 924.078161][T19496] 8021q: adding VLAN 0 to HW filter on device bond1 [ 924.157622][T19505] syzkaller0: entered promiscuous mode [ 924.157648][T19505] syzkaller0: entered allmulticast mode [ 924.286958][T19496] bond1: (slave ip6gretap1): making interface the new active one [ 924.296342][T19496] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 924.332872][T19501] macvlan2: entered promiscuous mode [ 924.332899][T19501] macvlan2: entered allmulticast mode [ 924.336681][T19501] bond1: entered allmulticast mode [ 924.336705][T19501] ip6gretap1: entered allmulticast mode [ 924.340331][T19501] ip6gretap1: entered promiscuous mode [ 924.340353][T19501] bond1: entered promiscuous mode [ 924.359121][T19501] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 924.391018][T19501] team0: Port device macvlan2 added [ 924.668367][T19518] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4160'. [ 924.859124][T19534] wg2: entered allmulticast mode [ 926.730006][T19605] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4190'. [ 927.981767][T19638] ip_tables: iptables: counters copy to user failed while replacing table [ 928.299844][T19652] syz_tun: entered allmulticast mode [ 928.318583][T19651] syz_tun: left allmulticast mode [ 928.414644][T19658] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4209'. [ 928.461666][T19656] tipc: Enabled bearer , priority 0 [ 928.485023][T19656] syzkaller0: entered promiscuous mode [ 928.485047][T19656] syzkaller0: entered allmulticast mode [ 928.500174][T19656] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 928.625359][T19656] tipc: Resetting bearer [ 928.632996][T19654] tipc: Resetting bearer [ 928.697765][T19654] tipc: Disabling bearer [ 929.033446][T19687] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 929.265559][T19694] syz_tun: entered allmulticast mode [ 930.383780][T19723] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4228'. [ 930.383818][T19723] bond0: option resend_igmp: invalid value (256) [ 930.383838][T19723] bond0: option resend_igmp: allowed values 0 - 255 [ 930.767472][T19742] tipc: Started in network mode [ 930.767502][T19742] tipc: Node identity d6945ee15cbd, cluster identity 4711 [ 930.767679][T19742] tipc: Enabled bearer , priority 0 [ 930.790361][T19744] 0: reclassify loop, rule prio 0, protocol 03 [ 930.791799][T19742] syzkaller0: entered promiscuous mode [ 930.792278][T19742] syzkaller0: entered allmulticast mode [ 930.842061][T19742] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 930.867418][T19742] tipc: Resetting bearer [ 930.880537][T19741] tipc: Resetting bearer [ 930.924482][T19741] tipc: Disabling bearer [ 931.247828][T19765] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4245'. [ 931.431123][T19767] syzkaller0: entered promiscuous mode [ 931.431151][T19767] syzkaller0: entered allmulticast mode [ 931.574758][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 934.847834][T19845] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4266'. [ 934.847942][T19845] veth0: entered promiscuous mode [ 934.847961][T19845] veth0: entered allmulticast mode [ 934.849693][T19845] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4266'. [ 935.220753][T19857] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4272'. [ 936.604054][T19902] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4285'. [ 936.636099][T19904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4287'. [ 937.957434][T19953] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4299'. [ 938.524029][T19973] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4307'. [ 939.595503][T20004] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4315'. [ 940.605652][T20043] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4326'. [ 941.780909][T20066] syzkaller0: entered promiscuous mode [ 941.780936][T20066] syzkaller0: entered allmulticast mode [ 949.541737][T20198] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4375'. [ 950.098573][T20203] netlink: 'syz.5.4376': attribute type 11 has an invalid length. [ 951.231882][T20213] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4381'. [ 951.232720][T14696] IPVS: starting estimator thread 0... [ 951.720220][T20214] IPVS: using max 21 ests per chain, 50400 per kthread [ 993.455949][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.628486][ T1314] ieee802154 phy1 wpan1: encryption failed: -22 [ 1101.241241][ T32] INFO: task kworker/u8:4:59 blocked for more than 145 seconds. [ 1101.241273][ T32] Not tainted syzkaller #0 [ 1101.241286][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1101.241298][ T32] task:kworker/u8:4 state:D stack:20344 pid:59 tgid:59 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1101.241359][ T32] Workqueue: events_unbound linkwatch_event [ 1101.241442][ T32] Call Trace: [ 1101.241450][ T32] [ 1101.241468][ T32] __schedule+0x17db/0x58f0 [ 1101.241540][ T32] ? __pfx___schedule+0x10/0x10 [ 1101.241577][ T32] ? schedule+0x90/0x2b0 [ 1101.241606][ T32] schedule+0x164/0x2b0 [ 1101.241635][ T32] schedule_preempt_disabled+0x13/0x30 [ 1101.241660][ T32] __mutex_lock+0x7c1/0x1550 [ 1101.241693][ T32] ? __mutex_lock+0x5d4/0x1550 [ 1101.241730][ T32] ? linkwatch_event+0xe/0x60 [ 1101.241764][ T32] ? __pfx___mutex_lock+0x10/0x10 [ 1101.241792][ T32] ? lock_acquire+0x115/0x350 [ 1101.241829][ T32] ? rcu_is_watching+0x16/0xb0 [ 1101.241869][ T32] ? process_scheduled_works+0x97a/0x1630 [ 1101.241899][ T32] linkwatch_event+0xe/0x60 [ 1101.241928][ T32] process_scheduled_works+0xc3d/0x1630 [ 1101.241992][ T32] ? __pfx_process_scheduled_works+0x10/0x10 [ 1101.242027][ T32] ? assign_work+0x3cf/0x5d0 [ 1101.242061][ T32] worker_thread+0xa47/0xfb0 [ 1101.242121][ T32] kthread+0x38b/0x480 [ 1101.242144][ T32] ? __pfx_worker_thread+0x10/0x10 [ 1101.242170][ T32] ? __pfx_kthread+0x10/0x10 [ 1101.242194][ T32] ret_from_fork+0x514/0xb70 [ 1101.242220][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 1101.242242][ T32] ? __switch_to+0xc89/0x1420 [ 1101.242296][ T32] ? __pfx_kthread+0x10/0x10 [ 1101.242321][ T32] ret_from_fork_asm+0x1a/0x30 [ 1101.242372][ T32] [ 1101.242453][ T32] INFO: task kworker/0:5:5724 blocked for more than 145 seconds. [ 1101.242470][ T32] Not tainted syzkaller #0 [ 1101.242481][ T32] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1101.242492][ T32] task:kworker/0:5 state:D stack:24008 pid:5724 tgid:5724 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1101.242562][ T32] Workqueue: events cfg80211_destroy_iface_wk [ 1101.242598][ T32] Call Trace: [ 1101.242606][ T32]