last executing test programs: 2m15.636233094s ago: executing program 0 (id=3167): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000b40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x168, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}, @NFTA_SET_EXPRESSIONS={0x124, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_XFRM_SPNUM={0x8}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0xc4, 0x1, 0x0, 0x1, @match={{0xa}, @val={0xb4, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x7a, 0x3, "40dff4fec9010a50ff8f7617e8777766acbdf6bdfe200f465ac9b6b502b845f19ddecdfd784d3ac1f3b50f9570f860cab6e2c02648e0a0dbc93f20af9f296b7e24fc4ea4458d2fa47689cdaabffe5ebe42c0c055a77f4df24f7cdf68a72d9fc5252c6aacda7a3dddfd4109242f636c5d0e8e210d7fbf"}, @NFTA_MATCH_INFO={0x33, 0x3, "8a6296c81f69c2d0440b52fac986e0833e47ed6beb6d83d074da94ec992c2f0086adcd7298633b95967f0edf3b64d8"}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x132}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x190}, 0x1, 0x0, 0x0, 0x404c050}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) r2 = socket$inet(0x2, 0x800, 0x2) ioctl$sock_inet_SIOCSARP(r2, 0x8955, &(0x7f0000000180)={{0x2, 0x4e21, @multicast1}, {0x306}, 0x4, {0x2, 0x4e22, @multicast1}, 'syzkaller0\x00'}) socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000004c0)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x400e0c0}, 0x6c801) sendmsg$NFT_BATCH(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f74"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a300000000014000000"], 0x84}, 0x1, 0x0, 0x0, 0x54}, 0x20008000) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000840)='ns/net\x00') sendmsg$nl_route(r5, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x52054, 0x2021}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NET_NS_FD={0x8, 0x1c, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8841}, 0x280048c6) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000940)={0xfffffce3, 0x7, 0x2, 0x5}, 0x10) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000980), 0x2, 0x0) write$6lowpan_control(r6, &(0x7f00000009c0)='disconnect aa:aa:aa:aa:aa:11 0', 0x1e) r7 = socket$netlink(0x10, 0x3, 0x9) sendmsg$NFT_BATCH(r7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={0x0}}, 0xc144) sendmsg$nl_route(r4, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="280000001200015e36bfa1000000000007"], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @broadcast}, &(0x7f0000000040)=0x10, 0x80800) 2m14.585723167s ago: executing program 0 (id=3170): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b00000005000000010001000a00000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000030000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x32, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r1}, 0xc) 2m14.575504738s ago: executing program 0 (id=3171): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f0, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x220, 0x2e0, 0x2e0, 0x220, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0xd0, 0xf0, 0x0, {0x3f0}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xb}}, @inet=@rpfilter={{0x28}, {0xd}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x8}, {0x0, 0x6}, {0xffffffffffffffff, 0x1, 0x3}, 0x9, 0x80}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x350) 2m14.517040554s ago: executing program 0 (id=3172): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000180)=0x1, 0x4) (async) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000180)=0x1, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd26, 0x0, {{@in6=@loopback, @in6=@local, 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xf, 0x0, 0x7, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x43}, 0x0, 0x2b}, 0x0, @in6=@private2, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x6048050) (async) sendmsg$nl_xfrm(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd26, 0x0, {{@in6=@loopback, @in6=@local, 0x1, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xf, 0x0, 0x7, 0x3c, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x407ffffffffffe, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@dev={0xac, 0x14, 0x14, 0x43}, 0x0, 0x2b}, 0x0, @in6=@private2, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x6048050) bind$inet(0xffffffffffffffff, 0x0, 0x0) (async) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000340)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000480)={0xa, 0xe22, 0x0, @empty, 0x2}, 0x1c) ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000003c0)) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCDARP(r4, 0x8953, &(0x7f0000000400)={{0x2, 0x4e24, @empty}, {0x1, @broadcast}, 0x4c, {0x2, 0x4e23, @private=0xa010101}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0xd, 0x9, &(0x7f00000000c0)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000500000085000000a0000000a70000000000140018000000000000000000000000000000950000000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x13}, 0x94) sendmsg$nl_route(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000d80)=@newlink={0x20, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6ab1, 0x10000}}, 0x20}}, 0x4048000) 2m14.257863988s ago: executing program 0 (id=3173): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x40, 0x4) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000300)=0x3fa, 0x4) (async) bind$inet6(r2, &(0x7f0000000340)={0xa, 0x4a23, 0x1, @empty, 0xffffff5d}, 0x1c) listen(r2, 0x50) r3 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000380)=0x3fa, 0x4) (async) bind$inet6(r3, &(0x7f00000003c0)={0xa, 0x4e23, 0x5, @empty, 0x4}, 0x1c) listen(r3, 0x50) (async) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'veth1_to_bridge\x00', 0x0}) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002abd7000fedbdf251b0000002000018008000100", @ANYRES32=r6, @ANYBLOB="140016006e657470636930000005000000000000c48f4a3e7a8a7aeee7b0673fe660"], 0x34}, 0x1, 0x0, 0x0, 0x810}, 0x800) listen(r1, 0x0) (async) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) listen(r0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@delneigh={0x38, 0x1a, 0x1, 0x70bd2a, 0x800, {0xa, 0x0, 0x0, 0x0, 0x10, 0x0, 0x7}, [@NDA_CACHEINFO={0x14, 0x3, {0x7}}, @NDA_PROBES={0x8, 0x4, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) close(0x3) 2m14.061226029s ago: executing program 0 (id=3175): socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000800)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4028800) sendmsg$NFT_BATCH(r0, &(0x7f0000000980)={0x0, 0xf5, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a300000000014000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x54}, 0x20008000) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', @multicast}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000bc0)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adff012255f674412d02000000880b5f04596a5e99fce658be2f200c699223886d8be4b50000005ab527ee3697f98125f30e6326996a3cfee33025a30b45bdcf2c69d105e5e55a1d273683623f1a5dc6e3c7e20eb7a98ecf3bd2cf898e924abe26ac296f660e69ba982fd76e00dcff7f0000ca6b78ad833488cfe4109eaf009eddcf21f5c63cde2f00150200000001000000520a0000151d010000000100bf00000000cc587424363da52001a3cdf2000000db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de406e89dcbb7677e65a88a8407a9e7f9c0e91028b0856eb1ed9474480737a55ebb0bd701f7fb21135c6172eba7eb8a341f07e5a2d1e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d93a433f50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56dbe37551b870b2851c3f0a1a9ebfcba105a6ccdd01b0f04edb256c0200000073f6db43661bd7f0e2536ffbfe5ca31b4083145531458b7d1e341c6b351ebc5223f54d6bec93f4ef088e5d1be2515226988d664709ff03f1aa3dc7f1580ace9bf2afd28d0700000000000000d6eb372713255012e028cb2654d493a0b43bf21375709f348f5eda2967199cc936859a538100070000000000dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0c6ef9dd2b6bb700000000000000000c586272c3f4d79bc36315745cb149f3cb385e6add14652003c7cdd3324f07d134d3a6c718bbd1aafe1140cff0be4c6f8df084c5e9734ae30aa9af030025f01ab03a9b1074407136bc506031f0916a39d3057d55183612b39e73ae8e6dc30356886a831836469e2051d937eb85f3f2d5ae2c1dca476b97419a3b76ed62409d004d7fbe362145d19605d760df4c5124ca325d374b371867a79b35c6617fc3327191fbf514573f0e30d1d60be2168fffc2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257bc9110971b749ccd74089ed6b86f81ca3ba47d8f71d290ed1b1a11f7a67125170c88c3b6a50692cc0064fc6bbd312536ac15016c85c6332226401b110da9c786eeca22debc99335587b54c13c3107008fa069af8223b38ced735c2d906551004d8dc10d88738488da01ffa4add56474573c964a270000f2f16625c0c10200000000c7a5ca60fdad159f2e44171f39638410020000004825d081f2d987f05c534187738655d7dc958f2046fa0c1619a6554b82d9c162eb61ca74f1ffdaccf0ea5f06e0fca8b27ff3983ab74fd3d560700a1fab44e77e312b3b129e000302d613916c9bcf9f0000fac73a5b6bfb27f88dba816020be760f7b45e001efada8000000000000fdaf4660402f7b3b79a433e08074ea2462974a00040000eb01352638f56dae0249d15ba8767259658878b7492cfbacde9b57cf4de00788adce638190f3570e0b4c80ef682df22201270955afb6008846557ee3bc09fda6dbb6550d597300eb82a184c96ffde5a30e5433e866665b98ca2002c804c22ff2634b7bfbf5c0d586cda5b45fd00dede1e88a4d41dee7cc76d7a23d06acb1d2d4c58faea84158bb440df2a694f4cdcaa4f65c22efffffffffffdd00000000d503d79986958115ae07b70f991430b7fb475d77b869ee02000000000000000000001ffff0ef89b2a68d2b05c995445d8a7700bcdfbec74fb2dd163e863315e84498dfb52bb93f6c9084659ce777ddac563c8596c2b1d8180289a61faa95a82bf1cfb7f2fd7252e9322abe282c33445d443a67467893b9bf0d1c8130ae6b226900000635376413c29f7c6f7b7e29b9a0c64e68328661f0c06e21f7d7dc22174ea4447a6f60edef3a4168d40200fbc71104512efe8e5d7d934aa289b4bd2b870000000000000000000007000000002000000000009b777883a02f0593dfc4cb4114b9f9cf4ad155110cc6ace2b322ac31bfa27847c799c8009a1ea5b98e525e6383ad7fd9795170e7b11e247603c2ff49a11459c7f606d729d3979676bffb3049166bb84a0f061991bd57c2566c10c282352aba05b6164ef876915a3f2491e4793e590dcc71de10da96366c1e992c0068c940dd4422c9882d3aa0f8a797b8fea6efcfb5276b7679f15559edaa977504cc0b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd04000000de17e1e13b93669b79556abb722d9c085b189b5fd1f30e8dc813f608830b110001732135e8e7262f290000923bfb6b41ff3792cee2fc37eee739c3e36a4bc80112968ec0d8902eced1fe552018014a463abbbf7ccd6a92a5734e3ebfca9b6e88e031f31de2183652e77c164c646a1cfd3710aa4205d8d4d4f974133ccb1e49feb42664eccd809c0ba8917eda87489e8946d5c8156197bcb66fd5606c63e3389ee9e8552381646365066ef9a36a449c96485c22ad1aa423b7b89efbc6cd54000bb0ea5f4f1e8773144fb6ac9a44d43593d77e66aa7ed7f3d4e7b211590c738888d02b2dbb0b2ba73ec72e1d8d7360a128499dd19e1e7b9b0671f4f58515b45ecb9964f3c4ddb8234391d514f8d996d8d6dd7f8fadfee2d7a0035638ce27c2936cb04b30a0eb0cde0000000000000040000000ec3c12ecee8fc3a40000000000000000e215b00ce2570b930723cbadb4033d1b8aaa2cfb3fb89e4a6e89737fd6232218a9e0c099d1eb59d60b3cca089785642f327139bc4394fb6d547a9b3c22599e780c1da7433fb47615d372e3fffe9703e37d5c87d513165278650738efcc04d27b766cf7f60066edd292f6c8a2174f391ed164bb1816819ceb3e378e776d422bc946cd9501accebeac3a5b31d8abc68ae537cd44a04e6bc21c35a7beab2610c51e593676bf635a20f597f4631b91454d182f826071f5210bd6d93173589929b23801e63c2266fde13b5a04b8d48be057c752bc415a756ea9b4d34156c4f73dd5e5924ef101a5fcdaf37c7ba2c4a9de9b000000000000000000000000000000a73b862e4b63c245616b522345587d0ee65a6902bdd0abd941e8aba37510b222ae544f395edd1b92ad53fc68f08ea00edc5e10d768836169dd296d56b306e8b75778c37571792a6c3d8b02ef378ebd59422cdd008bef6f80a80a68641ea5ed4f1126bb676098c10bf663eb3fb8c839364d28fd046dc64b35f9c3397ce6f4ad357b0000000000090000000088c7a8e2638f650a6f04a6f33a090f59414d6ebcbc687e66d600000000bd0a58ea6d36fc2cf9b9a71c137a2a22adb1006f371d4faf47285fd66fe0389afb96854bb360edcdf11b4ff6dd578bba93e949d240cde9b5836cb46032484dc19c93db7b6e5afa10547c78e76a3111557346e52566df196fd630561bb908fff4d2e19562aabd43742a26a43799f8636fa04ceb40c9e4ca1cfbbc7b949cd245a3ee118fd0d4f639444539af8766028d4ac4d4c548e290199e0dacbb4f6796b39bf32934d941ba2f88e3ebd0cf8e24f99eca86e4ca9b2cd2b54044a7fc4631572a6378a32df288785f146275c1f548e2a0c1016744e05f9de5044373d7650125027547eefe7b2d8c8871bb65395fae99d8456883705bfdfb00001854b2e5efa8aaf25827d659f592b1575281ec125de7fb91cd81d91dcb19f5cdf1e1e2b4a8a1389753a09110538689e38e07fb2dc72bd4fd11d7bc16aac5d85c6101bb722895248e463a5fb45ce0e564e90cb19d5993b471687ae4165e29cf2f58082115f5f8569896eedfd798733223e6d6584997510c374912ab798bd4af4654c01bb2c411bc36468ddd62b4eba5cfc8953526e0e5b1359797956152d0098ce47c62c3fe5a23219389622b7f65bf03527d25c3941b9cf1ffeedf6d99082bb57ea871c12213cc40900f83033bc18c529171fae324c315bc6ce358831d0230412212acfd5fc8d5cb0d028cf568e8bb40e27befe2ff01f7c6674a4d86d900633ea36641e0a781ea0ea7f2d928b8b22e2f97dd13348927375baea6863bef4acf4299096ada5cdd2a0eaafaa760a79d102d1e0c0000000000000000007926653b8d79ce16a432f124786a0bc3c5b7d196822492ae1ccf91aeac16406ad6f9cd3d96d57fceba8360ae49f73351814c9c2972f11064aaf3739d9100f9c0e4d0cb17d50c82e305ba7d62cf1cc6da26e34982a8c74dd8122cf5b5e7c34fd2712a0cef05e4d8ec7dd363219676bd9b19943185b132eb35a695e208dfa5cecdb1d6425c8879063c0f11bd64291a4209ee6dc1d9e9010013f6148c603e6a335e298efd6ab5cccc47a2c568c6afec54f8251bd840752addf200371361c9eedf05ed98585cf6d99e9e56055064bda2d373369761238c278147cd0eb7799f6b9c9fcaa3fd282154994f5b25420c86db9b6401e885de1c615a719a1c83e8fbbb181282dbaf3313a4e4a4877e9f37607e2cd6da0cf6371ec06a75f5a4206b2418ad8897ae149085d63f01f22eca44033234b3930b4d5da756669a1d59d69e7de54abf439988ed7ec33c2d0a901bb0985a24878984d8a4340fa9a356d100926fb5f2ef9976366a61b8cc2bcb1c072b0e9c564852388e1edff10d75b3832792e471cc15b40380f94d834243080158603fbc9134d6983c540525447478984611c0d9666941bfc0a30db47a8828b6e5c51aee2094599b4ce52795750e1764f1657ca8c5633c71287239dddf5c651496f7bbd148c937f083d2e4e0197dbc6ff0649c749707b17399b1d7efad23abb8b40b38704737e15662ae4913a4a001cd3b71c7af75b5ffad9780650c800a40ca80ddc41987919142fd28dbf22db5f4c435415a03455e1d55d1783ccef97d7e4655cf839d06f06e137bbe462a03b3100231914b19739dd57b4f12d026ad0c7fd3"], &(0x7f0000001980)='GPL\x00', 0x4, 0x436, &(0x7f00000019c0)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001a80), 0xfffffffffffffc95}, 0x48) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, &(0x7f0000001ac0)=r3) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000001b00)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000001b40), 0x56) sendmsg$kcm(r4, &(0x7f0000001b80)={&(0x7f0000001bc0)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000001c40)=[{&(0x7f0000001c80)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 2m6.809996312s ago: executing program 2 (id=3245): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000440)={r0, &(0x7f0000000080)='\x00', 0x100, &(0x7f00000000c0)={@align=0x68cfad37, {0x5, 0x5, 0x10001, 0x4}}, 0x7, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000240)=0x3ff}) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x20028014, &(0x7f0000000300)={0x2, 0x4e20, @remote}, 0x10) shutdown(r1, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYRESOCT=r1, @ANYRES16=0x0], 0x48}, 0x1, 0x0, 0x0, 0x20000085}, 0x0) r2 = socket$inet6(0xa, 0x80002, 0xd1c9) setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r2, &(0x7f00000004c0)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, 0x0, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1000000000021, &(0x7f0000000500)=0x2005, 0x4) sendmsg$inet6(r5, 0x0, 0x3400c8d4) recvmmsg(r3, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}, 0x7}], 0x1, 0x2, 0x0) sendmmsg$inet6(r2, &(0x7f0000000580)=[{{0x0, 0x0, &(0x7f00000005c0), 0x171}}], 0x400000000000172, 0x4001c00) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000340)='ns/cgroup\x00') r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000680)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100faff0000fcdbdf25010000000c08018005000200070000003cdc911d7ea1b79b68aead6556e94b9c615ca70100b8c0852eb8239809177474abfb4a67c03ed3ec2ec4be35f0fcb82ff6f7f444c0013400000000000000059d236166e922"], 0x20}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x90) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4028800) sendmsg$NFT_BATCH(r8, &(0x7f0000000980)={0x0, 0xf5, &(0x7f00000009c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) 2m6.652269717s ago: executing program 3 (id=3247): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) recvmmsg(r1, &(0x7f0000000040)=[{{0x0, 0x0, 0x0}, 0x263b}], 0x1, 0x40004000, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="8b33000000000300f1000500000008000300", @ANYRES32=r4], 0x28}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x11, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000007c0)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=ANY=[@ANYBLOB="340000001c00010429bd7000fddbdf2507000000", @ANYRES32=r5, @ANYBLOB="0200ee050a000200aae6dd462c0200000c000e80"], 0x34}, 0x1, 0x0, 0x0, 0x14040080}, 0x800) 2m6.630891392s ago: executing program 4 (id=3248): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) close(0x3) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x8000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0f0000000400000004000000120000"], 0x50) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x1, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) syz_emit_ethernet(0xd2, &(0x7f0000000700)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, "1b8100", 0x9c, 0x11, 0x0, @empty, @mcast2, {[], {0x4e25, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "e9807d11549bcfa0d6c4223433d6fa82db055c1e725d8e5b028d6ee44a1ef86d", "c2778fab826f31f4fa3940a9b28b673b4c08586195e407740a89f6aec07ed0348bd5efa724333b58d5ec245672cb1df8", "a6c6f84ebe2039e5e93034a157e198dbf12cbdf463c94007ea7281ed", {"b3c22cc5aa8ca3d6045ce025ad569f7c", "1744e2572963772398c13dde62eab206"}}}}}}}}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000006c0)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000140), &(0x7f0000000180)=r1}, 0x20) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2m5.594269674s ago: executing program 4 (id=3249): accept4$bt_l2cap(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8927, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) unshare(0x22020600) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x1, 0x100001, 0x5, 0x5, 0x1}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000007c0)={r0, &(0x7f0000000800), 0x0}, 0x20) 2m5.472108217s ago: executing program 1 (id=3250): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x368, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x298, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x4, 0x0, 0x8}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x1c}}, 0x0) getsockname$packet(r2, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000004c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r4 = socket(0x10, 0x803, 0x0) r5 = socket(0x10, 0x803, 0x2) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000005c0), r5) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000640)=0x14) sendmsg$nl_route(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYRES16=r6], 0x3c}, 0x1, 0x0, 0x0, 0x40020c1}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000740)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r3}) sendmsg$nl_route(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @broadcast}, @timestamp_reply={0x12, 0x0, 0x0, 0xe000, 0x2}}}}}, 0x0) 2m5.471061591s ago: executing program 4 (id=3251): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1f, 0x1d, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000001000000b708000000000000dbaaf8fff1000000b5080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006a000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a800000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r2, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x1, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0xa}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x3, 0x5, &(0x7f00000005c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}, @call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000600)='syzkaller\x00', 0x3, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f00000006c0)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x5c, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) (async) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$IP_SET_OP_GET_BYINDEX(r4, 0x1, 0x53, &(0x7f0000000700)={0x7, 0x7, 0xffffffffffffffff}, &(0x7f0000000740)=0x28) (async) sendto$inet(r4, &(0x7f0000000240)="0303ec58000000004500001c00000000402f0000ac14140b7f0000014e214e24", 0xffeb, 0x0, &(0x7f0000000480)={0x2, 0x0, @dev}, 0x10) 2m5.43808743s ago: executing program 3 (id=3252): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x1c, r1, 0x5, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (fail_nth: 3) 2m5.144996356s ago: executing program 3 (id=3253): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2d, &(0x7f0000000000)=0xfffffff7, 0x4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x1f, 0xc, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f00000009c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000240)={'hsr0\x00', 0x41}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a00)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x2000000, 0x46, 0x0, 0x0, 0x0, 0x3}, 0xe) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000600), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000640)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r6 = socket(0x10, 0x803, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000cc0)={0x1f, 0x10, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000002000000850000008600000018010000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000e00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) unshare(0x6020400) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000e40)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000680)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=@newtfilter={0x50, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0xb, 0x8}, {0xfff1, 0xffff}, {0x300, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x20, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x4, 0xd}}, @TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8c8}}, @TCA_EMATCH_TREE_LIST={0x4}]}, @TCA_BASIC_ACT={0x4}]}}]}, 0x50}}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r12, 0x5, 0x0, 0x0, &(0x7f0000000600), 0x0, 0x7, 0x0, 0xffffffffffffff90, 0x0, 0x0, 0x0}, 0x50) r13 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r6) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = accept$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000540)=0x14) pipe(&(0x7f0000000a80)={0xffffffffffffffff}) sendmsg$key(r16, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="02070308250000002bbd7000fddbdf25050019000000000002004e23ac1e0001000000000000000002004e24ac1414bb00000000000000000100140005000000030006002b00000002004e23ac14143d000000000000000005001a00fc010000000000000000000000000000e4000002000000000000000000000000010010000800120004000400b86b6e006907000006003c000e02000091b000000000000064010102000000000000000000000000ffffffff000000000000000000000000010016004e23000002001000000004d4000004d2000000000800120000000300b86b6e00ff01000006003c00030100005202000000000000ffffffff000000000000000000000000e0000001000000000000000000000000d4fffd16727b65c1f32c4a6abbd80200090038000000e80d1e6528093100"], 0x128}}, 0x40) ioctl$XFS_IOC_COMMIT_RANGE(r10, 0x40585883, &(0x7f0000000580)={r15, 0x0, 0xa0dd, 0x100, 0xe, 0x1, [0x4, 0x3, 0x8, 0x6, 0x15e, 0x9]}) sendmsg$L2TP_CMD_SESSION_DELETE(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010020bd70100600010007000000080009000200000008000b"], 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x8030) sendmsg$L2TP_CMD_SESSION_DELETE(r10, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYRESHEX=r14, @ANYBLOB="00fd07a845810d84c6082dbd7000fedbdf250600000005000d0001000000050013000100000006001c0000f80000"], 0x2c}, 0x1, 0x0, 0x0, 0xc0c1}, 0x24004000) 2m5.109439993s ago: executing program 2 (id=3254): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="12000000020000000400000002"], 0x50) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x1402, 0x10, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r2}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x48040) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x14, 0x11, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000620afcff00000000bfa200000000000007020000fcffffff1851000000000000000000000000000085000000010000001500070000000000bf07000000000000bf61000000000000bf72000000000000b703000000000000850000007c000000bf710000000000008500000056000000b70000000100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @lirc_mode2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r0], 0x0, 0x0}, 0x94) 2m5.007257095s ago: executing program 4 (id=3255): r0 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=@newtfilter={0x5c, 0x2c, 0xd3b, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0xc, 0x2}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x27, 0x4, 0x5}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x4, 0x84}, {0x4, 0x7, 0x1}}}]}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x410c4}, 0x4880) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000800)=@assoc_value={0x0}, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000840)={r4, 0x9, 0x7}, 0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000880)={r4, 0x1, "80"}, &(0x7f00000008c0)=0x9) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000feffffff0000000003000000850000004100000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f805ffffb702000008000006b703000003000000850000001700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x0, 0x2100, 0x0, &(0x7f0000000300), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000300)={0x1, 0xffffffffffffffff, 0x80000}, &(0x7f0000000340)=0xc) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000380), &(0x7f00000003c0)=0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000000906110200000000000000000000fffe0900020073797a310000020005000100070000001c0007800c00018008000140310000010c0002800800"], 0x44}, 0x1, 0x0, 0x0, 0x10000057}, 0x4000050) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x6}, 0x90) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r8}, 0xc) 2m4.504503779s ago: executing program 2 (id=3256): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d80)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1200000024000000080000000b"], 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000e40)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r1, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000c, 0x11, r1, 0xaa0f4000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000fc0)={{r1, 0xffffffffffffffff}, &(0x7f0000000e80), &(0x7f0000000e00)=r1}, 0xfffffe0f) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000ec0)={{r2}, &(0x7f0000000f00), &(0x7f0000000f40)=r0}, 0x20) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syzkaller0\x00', 0x0}) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e1e, @remote}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000140)='hybla', 0x5) close(r7) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25cfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000280)={'syzkaller0\x00', @multicast}) r8 = socket$kcm(0x11, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f0000000300), 0x4) r11 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x87c, 0x2c, 0xd3f, 0x70bd29, 0x25dfdbf9, {0x0, 0x0, 0x0, r10, {0xffff, 0xfff3}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x84c, 0x2, [@TCA_BASIC_POLICE={0x848, 0x4, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x1000, 0x3ff, 0x2, 0x800007, 0xfffffff7, 0x7, 0x2a3c14c8, 0x2, 0x140, 0x9cd0, 0x78e, 0x7, 0x9, 0x2, 0x80000040, 0x5, 0x80000000, 0x9, 0x6, 0xfff, 0x27, 0x52a67a94, 0xf, 0x209, 0x4, 0xfffffffe, 0x6, 0x0, 0xfffffffe, 0x800, 0x7, 0xfffffffa, 0xffffffad, 0x20000007, 0x68, 0x0, 0x10000, 0x7ff, 0x7, 0xffffff64, 0x4, 0x5b, 0x7, 0x5, 0x14000003, 0xffff, 0x0, 0x1ff, 0x4, 0xffff5edc, 0x8, 0x4, 0x81, 0x5, 0x94c, 0x1cf, 0x10000000, 0x0, 0x6, 0xfffffffb, 0x1, 0x2, 0x7, 0x1, 0x6, 0x0, 0xa, 0xf43, 0xa, 0x4, 0x80000005, 0x1, 0x8000, 0x3ff, 0x100, 0x2, 0x2, 0x8, 0xfffffffd, 0x23fffffd, 0x4, 0x2, 0x6, 0xac5, 0x9, 0xffb, 0x2, 0x7, 0xb, 0x9, 0x5, 0x7fffffff, 0xfffffff8, 0x86, 0x0, 0x0, 0x5, 0x5, 0x75, 0x8000, 0xc, 0x6, 0x400, 0x20, 0x3, 0xffffffdf, 0x389, 0x3, 0x1e800000, 0x80000001, 0x4a, 0xff, 0x2, 0x3, 0x203, 0x9, 0x4, 0x6, 0x2, 0x7, 0x8001, 0x200, 0x263, 0xb, 0x8, 0x6, 0x6, 0x9, 0x6, 0xa, 0x13d, 0x209, 0x3fed, 0x2, 0x1, 0x2, 0x101, 0xffffffff, 0x4007, 0x240, 0x4, 0x5, 0x2, 0xffffdffb, 0x1, 0x800, 0x7ffffffb, 0x8fc, 0x2, 0x68a4, 0xff, 0x6, 0x4, 0x8, 0x4, 0x37, 0xa, 0x2, 0x3, 0x5, 0x8, 0x100, 0x3, 0xfe, 0x722b, 0x7, 0x7, 0x22c, 0x61, 0x3, 0x8, 0x9, 0x66, 0xd6, 0xcac, 0x7, 0x9, 0x2, 0x0, 0x7e6, 0x54d6, 0x2, 0x7ff, 0x8, 0x1, 0xf32, 0xffff, 0xb6, 0x0, 0x6, 0x7, 0x8, 0x400001, 0x4, 0xffff, 0x9, 0x9, 0x0, 0x8, 0x2, 0x0, 0x20000, 0x2, 0x80000000, 0x10000, 0xe, 0x6, 0x2, 0x4, 0x4, 0x8, 0x9, 0x0, 0xe6, 0x2, 0x9, 0x4, 0x1, 0x4, 0x9, 0xa, 0x9, 0x5, 0xb, 0x4, 0x7ffe, 0x200, 0x5, 0xc9f, 0x7f, 0xf, 0x4, 0x1000, 0xfff, 0x5, 0x7, 0x0, 0x7, 0x40, 0x7ffffffd, 0x1, 0x7, 0x6, 0x8, 0xe9375e5, 0x8cf5, 0x3, 0xdf0a, 0x2, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x10, 0xd, 0xd36, 0x4, 0x6bc, 0x480002, 0x401, 0xf, 0x800, 0x7, 0x7, 0xe7f, 0xffff, 0x7, 0x5, 0x1, 0xffffffff, 0x4, 0x909e, 0x89cd, 0xffffffff, 0xa, 0x9, 0x4, 0xfffffffc, 0x2, 0x3000000, 0x4, 0xf23, 0x3ff, 0x9, 0xa, 0x5, 0x0, 0x101, 0x7f, 0x4, 0x0, 0x3, 0x382, 0x40, 0x80, 0x8, 0x2, 0x4000005, 0x20002, 0x9, 0x4f, 0x4, 0x0, 0x7, 0x80000000, 0x80000001, 0x8040, 0x1, 0xe4, 0x3, 0x7fffffff, 0x5a, 0x9, 0xfffffff4, 0x4, 0x6, 0x6, 0x459, 0xf, 0xff, 0x14000000, 0x5f72, 0xe, 0x8, 0x7, 0x69, 0x0, 0x6, 0x4, 0x6, 0x1000, 0xffffffff, 0xcad7, 0x2, 0x5, 0x7, 0x9, 0x1000, 0xb, 0x3, 0xfbb5, 0x4e, 0x0, 0x7, 0x8, 0x9, 0x0, 0xa6, 0x401, 0x0, 0x1, 0x5, 0x800, 0x7fffffff, 0x2, 0x1, 0x3, 0x4, 0x101, 0x5, 0x6, 0x6c, 0x4000009, 0x4, 0x3, 0xb, 0x7, 0x53c0, 0x6, 0x5, 0x9, 0x1, 0x9, 0x2, 0x7, 0x8, 0x3, 0x2, 0x18, 0x5, 0x9, 0x15ef7157, 0xfffffffc, 0x5, 0x2, 0x7, 0x7fffffff, 0xdb5, 0x21000, 0x800, 0x8, 0x80000000, 0x100, 0x7, 0x1, 0x40, 0x1000, 0x3, 0xfffffffb, 0x5270e9b, 0x5, 0x7f, 0xb, 0x40, 0x9, 0x3, 0x3ffffe, 0x9, 0xb, 0x7, 0x1, 0x7, 0x2, 0x9, 0x0, 0xfe23, 0x2, 0x5, 0x8, 0xffffff7f, 0x3, 0xd, 0x80, 0x4, 0x9, 0x4, 0xff, 0x8001, 0x79, 0x40, 0x72e, 0x5c, 0x1, 0xb0, 0x6, 0x8, 0xf278, 0xff, 0x80000001, 0x8, 0x4, 0x4, 0x200, 0x1, 0x1, 0x59ac, 0xebd7, 0x7, 0x10008, 0x4, 0x100, 0x1, 0x7, 0x138, 0x1, 0x8, 0x7, 0x0, 0xb, 0x7, 0xe489, 0x10000, 0x5, 0x6, 0x56, 0x1800000, 0x80000000, 0x5, 0x561, 0x7fff, 0x8001, 0x6, 0x7, 0x5, 0x3, 0x4, 0x371, 0xaa67, 0x2, 0x0, 0x10, 0x8, 0x5a5, 0x400, 0x0, 0xfffeffff, 0xf, 0x8, 0x9, 0xc2b3, 0x0, 0x7fffffff, 0xfffffffa, 0x9, 0x3ff, 0x6, 0xa, 0x5, 0x8, 0x4, 0x10000c, 0x9, 0x1, 0x0, 0x10000, 0x4, 0x4, 0x8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x4, 0x2, 0x6, 0x4d2, 0x0, {0x8, 0x1, 0xa, 0x8, 0x8, 0x2000009}, {0x4, 0x1, 0xa380, 0x7ff, 0x5, 0xc}, 0x7, 0x9303}}]}]}}]}, 0x87c}, 0x1, 0x0, 0x0, 0x10}, 0x8080) sendmsg$kcm(r8, &(0x7f0000000c40)={&(0x7f0000000c80)=@xdp={0x2c, 0x0, r10, 0x3d, 0x300}, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000d40)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 2m4.134131258s ago: executing program 1 (id=3257): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b00000005000000010001000a00000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000030000000000000000400000181100", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x32, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r1}, 0xc) 2m3.859592924s ago: executing program 4 (id=3258): r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000040), 0x318, 0x0) (async) sendmmsg$unix(r2, &(0x7f0000000040), 0x318, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000080)={0x90000005}) (async) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000080)={0x90000005}) epoll_pwait(r3, &(0x7f00000000c0)=[{}], 0x1, 0xfffeffff, 0x0, 0x0) epoll_pwait(r3, &(0x7f0000000100)=[{}], 0x1, 0xfffffffb, 0x0, 0x0) close(r1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x21021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0xfffffffffffffd4b, 0x3, 0x2}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2048080}, 0x4000000) (async) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x21021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0xfffffffffffffd4b, 0x3, 0x2}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2048080}, 0x4000000) 2m3.820922879s ago: executing program 1 (id=3259): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x20, r2, 0x1, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x80000}, 0xc010) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000001c0)={'ipvlan0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x2, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000007a0af8ff0000000018110000", @ANYRES32=r6, @ANYBLOB="000000000000000015010200e9ffffff18110000", @ANYRES32=r7, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r8, 0x0, 0xe, 0x0, &(0x7f0000000580)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000010000304000300"/20, @ANYRES32=0x0, @ANYBLOB="00000000010000002800128009000100766c616e00000000180002800c000200ae35e16bce8e"], 0x58}}, 0x8000) ioctl$NILFS_IOCTL_GET_CPSTAT(r9, 0x80186e83, &(0x7f0000000100)) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001000fd692949c4637d3d94e0e25fcf2dd4010400001d000080000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e00ea03000280fbff8052a642fbf8a56deefc209f950500", @ANYRES32=r5, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x5080) 2m1.504220093s ago: executing program 3 (id=3260): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000043c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000004400)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f0000004740)={0x0, 0x0, &(0x7f0000004780)={&(0x7f00000047c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="3f9d0000fedbdf251700000008000300", @ANYRES32=r2, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2m1.318775124s ago: executing program 3 (id=3261): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="0a00000004000000080000000a"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x1, 0x100, 0x0, 0x0, 0x3b8000, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 2m1.262422602s ago: executing program 3 (id=3262): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000500)={'syzkaller1\x00', 0x5001}) socket$inet6(0xa, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000540)={0x28, 0x0, 0x2710, @local}, 0x10) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000580)=0x33, 0x8) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f00000005c0)={0x28, 0x0, 0x2710}, 0x10) r3 = accept4(r1, 0x0, 0x0, 0x0) sendto(r3, &(0x7f0000000600), 0xfeb5, 0x0, 0x0, 0x0) recvfrom(r2, &(0x7f0000000740)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) pselect6(0x40, &(0x7f0000000780)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000007c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x8000000000000000}, 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000340)=@framed={{0x18, 0x2, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0xe}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r5, 0x0, 0xe, 0x0, &(0x7f0000000480)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0xc201}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}, {0xfff1}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newtfilter={0x44, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xffee, 0xffe0}}, @TCA_FLOWER_KEY_CT_STATE={0x6, 0x5b, 0x7}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=@ipv6_newroute={0x60, 0x18, 0x401, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, 0xfe, 0x2, 0x0, 0x1}, [@RTA_GATEWAY={0x14, 0x5, @dev={0xfe, 0x80, '\x00', 0x2}}, @RTA_OIF={0x8, 0x4, 0x2}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}, @RTA_ENCAP={0x20, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0x1c, 0x1, {0x0, 0x2, 0x1, 0x1, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}}}]}, 0x60}}, 0x0) 1m58.340985099s ago: executing program 1 (id=3263): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000000f40)=[{{&(0x7f0000000080)={0xa, 0x4e22, 0x80, @loopback, 0xc4}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000000300)="2d62e3", 0x3}], 0x1}}, {{&(0x7f0000000980)={0xa, 0x4e23, 0x0, @rand_addr=' \x01\x00', 0x8}, 0x1c, &(0x7f0000000ec0)=[{&(0x7f00000009c0)="a4d359b7f4", 0x5}, {0x0}], 0x2}}], 0x2, 0x20000014) shutdown(r0, 0x1) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x7, 0x17, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000001000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000007200000005000000bf09000000000000b609010000000000650007000000000018010000646c6c2500000000002020207b9af8ff000000004c9100000000000037010000f8ffffffb702000008000000b7030000ffffffff15000000060000005f93000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f00000005c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0xffffffff, [{0x1, 0x3, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e]}}, 0x0, 0x3a, 0x0, 0x6}, 0x28) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x40, 0x2c, 0x601, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r6, {0xb, 0xfff7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xa, 0xa}}]}}]}, 0x40}}, 0x0) setsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000280)={r6, @multicast2, @remote}, 0xc) syz_emit_ethernet(0x8e, &(0x7f0000000340)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x4, 0x80, 0x65, 0x0, 0x2, 0x1, 0x0, @rand_addr=0x64010101, @remote}, @dest_unreach={0x3, 0x5, 0x0, 0x0, 0x6, 0x201f, {0x19, 0x4, 0x3, 0x3a, 0x7ff, 0x68, 0xfffa, 0xd9, 0x2f, 0xe5c, @loopback, @dev={0xac, 0x14, 0x14, 0x36}, {[@cipso={0x86, 0x21, 0x3, [{0x7, 0x9, "a8806558a18f92"}, {0x1, 0x12, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\x00\x00\x00\x00\x00\x00'}]}, @timestamp_addr={0x44, 0x2c, 0x4c, 0x1, 0x0, [{@multicast2, 0x9}, {@dev={0xac, 0x14, 0x14, 0x17}, 0x5}, {@loopback, 0x20005}, {@loopback}, {@remote, 0x329}]}]}}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x1c, &(0x7f0000000640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@btf_id={0x18, 0x4, 0x3, 0x0, 0x3}, @jmp={0x5, 0x0, 0xc, 0x8, 0x0, 0x20, 0x8}, @jmp={0x5, 0x0, 0xc, 0xb, 0xb, 0x20, 0x10}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xffffffffffffffff}, @generic={0x4, 0xf, 0x5, 0x9, 0xffff}, @cb_func={0x18, 0xb, 0x4, 0x0, 0xfffffffffffffffb}, @map_val={0x18, 0x5, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x10}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000740)='GPL\x00', 0x0, 0x9c, &(0x7f0000000780)=""/156, 0x40f00, 0x40, '\x00', r6, 0x0, r2, 0x8, &(0x7f0000000840)={0x8, 0x4}, 0x8, 0x10, &(0x7f0000000880)={0xffffffff, 0xc, 0x6, 0x80}, 0x10, 0x0, 0x0, 0x4, &(0x7f00000008c0)=[r1, r1], &(0x7f0000000900)=[{0x5, 0x3, 0xd, 0x3}, {0x2, 0x2, 0xa, 0x2}, {0x6, 0x4, 0x5, 0xb}, {0x5, 0x2, 0xc, 0x2}], 0x10, 0x80}, 0x94) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000240)={0x0, 0x3, 0xfffffff9, 0x80000001}, 0x10) 1m57.699216479s ago: executing program 4 (id=3264): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@updpolicy={0xc4, 0x19, 0x1, 0x70bd2a, 0xfffd, {{@in6=@dev={0xfe, 0x80, '\x00', 0xd}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x8, 0x0, 0x100000001, 0x0, 0x2000000000000, 0xffffffffffffb473, 0xfffffffffffffffd, 0x2}, {0x1000000000, 0x2000000000000000, 0x0, 0xffffffffffffffff}, 0xfffffffe}, [@mark={0xc, 0x15, {0x35075b, 0x7}}]}, 0xc4}}, 0x4004) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x4, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x20}, {}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x987a3a9f32358a4c) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000080)=@newlink={0x54, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_SNOOPING={0x5}, @IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x1}, @IFLA_BR_NF_CALL_IPTABLES={0x5}, @IFLA_BR_MCAST_ROUTER={0x5}]}}}]}, 0x54}}, 0x0) 1m57.595906785s ago: executing program 1 (id=3265): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0x1c, &(0x7f00000005c0)=ANY=[@ANYBLOB="18080000e9ff0000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a0085000000a0000000bc0900000000000045080100002000009500000000000000b7020000000000007b9af8ff00000000b5090000000000007baaf0ff00000000bf2700000000000007080000fffdffffbfa400000000000007040000f0ffffffc40200000800000018220000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000004608efff76000000bf9800000000000056090000000000008500000000a00000b70000000000000095"], &(0x7f00000006c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000", @ANYRESOCT=r2], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x41, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x80000004, 0x3}, 0x8}, 0x94) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r3, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0xfffffffffffffffe, 0x0) 1m57.568269444s ago: executing program 1 (id=3266): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x5) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000001200010300000000000d0000020000000000000000000000000000000000000000000000000000000100"/56, @ANYRES32=0x0, @ANYBLOB="0100000000000000ffffffff00000000140001000710100002180000ffffffff"], 0x60}}, 0x4044804) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x10, &(0x7f0000000640)=ANY=[], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000006c0)=r7, 0x4) sendmsg$unix(r6, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000200)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f0000000240)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000180)={{0x2, 0x4e21, @multicast1}, {0x306}, 0x4, {0x2, 0x4e22, @multicast1}, 'syzkaller0\x00'}) 1m56.94095432s ago: executing program 2 (id=3267): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000017c0)='memory.events\x00', 0x7a44, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001800)='memory.events\x00', 0x7a05, 0x1700) write$tun(r1, &(0x7f0000000600)=ANY=[], 0x33) sendfile(r2, r1, 0x0, 0x10000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000af02000420000000ddfee7e35539270500000085000000a90000009500000000000000eeaf74739409bd321f64ed7e71610b95641dfba03f6543fc0aa7f3b68c32a378346339be1b4298d8c0b625151ec98cfe3fd884cfd04cd768746ae856530cd6e9716e9368d27069ada4479bf596f4a39b1ecfe49f78a7bc2f91e826953989bd31a24953df43ec1065e035600bf35b16b61da2fe9a50c6921646a1bf4200d925310865f45e127294ac355a218a876f1b0fd4449e43618e9bd2fbb0b3b07c8dccf13c4caef511b14a37c2dcf8b665758e52d84ea2bcccee7667"], &(0x7f0000001840)='GPL\x00', 0x0, 0x26, &(0x7f0000000100)=""/38, 0x40f00, 0x20, '\x00', r0, 0x0, r2, 0x8, &(0x7f00000001c0)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000240)={0x1, 0x0, 0x4, 0xfff}, 0x10, 0x0, 0x0, 0x2, &(0x7f0000000280), &(0x7f00000002c0)=[{0x5, 0x2, 0xc, 0x7}, {0x2, 0x1, 0x7, 0x9}]}, 0x94) r3 = socket(0x2d, 0x2, 0x0) setsockopt(r3, 0x11d, 0x1, 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000001880)=ANY=[@ANYBLOB="02000000000000000a004e200000000600000000000000000000ffffac1414aa0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000040000000a004e2300000009fc0100000000000000000000000000011de706a7000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2300000006fc00000000000000000000000000000106000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e24000000070000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e207ffffffffe88000000000000000000000000010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000005bface985ae1049100"/656], 0x290) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCX25GCAUSEDIAG(0xffffffffffffffff, 0x89e6, &(0x7f0000000080)={0x4, 0x5}) r5 = socket$rxrpc(0x21, 0x2, 0xa) ioctl$int_in(r5, 0x5452, &(0x7f0000000280)=0x8) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001b40)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r7, &(0x7f0000001b80)=[{&(0x7f0000001bc0)="92", 0x1}], 0x1) pipe(&(0x7f0000001c00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, 0x0, r10, 0x0, 0xf3a, 0x0) splice(r6, 0x0, r10, 0x0, 0x80, 0x6) write$bt_hci(r10, &(0x7f0000001c40)=ANY=[@ANYBLOB="011d0482c900"], 0x6) write(r8, 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) pselect6(0x40, &(0x7f00000005c0)={0x0, 0x0, 0x12, 0x2, 0x6, 0x9, 0x40, 0x8000}, 0x0, &(0x7f0000001740)={0x1f, 0x112, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000004}, 0x0, 0x0) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000001780), 0x4) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x14, 0x2f, 0x107, 0x70bd2c, 0x25dfdbfc, {0x4, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x10048001}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x18, &(0x7f0000001cc0)=ANY=[@ANYBLOB="180000008d2000cf0100c59c0ed245fac4827d8c000003100000365f8be8f48b67029bcd061400110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000fffe00008500000086000000bf0900000000000055090100ffffffff950000000000000045000600040000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000ffffff1fb7030000080000005000000006000000bf91000000000000b702000003000000850000002a000000b70000000000000095", @ANYRESOCT=r5], &(0x7f00000006c0)='GPL\x00', 0xf, 0x1009, &(0x7f0000001dc0)=""/4105, 0x40f00, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) ioctl$F2FS_IOC_FLUSH_DEVICE(r7, 0x4008f50a, &(0x7f0000001c80)={0x8, 0x10}) 1m56.855600363s ago: executing program 2 (id=3268): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0b00000005000000010001000a00000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000030000000000000000400000181100", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000000600000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x32, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000400)={r1}, 0xc) 1m56.747378175s ago: executing program 2 (id=3269): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x10, &(0x7f0000000040), 0x4) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000340)=0x79, 0x4) bind$inet(r4, &(0x7f0000000380)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f00000003c0)={0x1, &(0x7f00000004c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000000500)={0x2, 0x4e23, @remote}, 0x10) unshare(0x2c020400) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0e00000004000000080000000b"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x6, 0xb, &(0x7f0000000a80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000fcffffff850000007300000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000b40)={{r5}, &(0x7f0000000b80), &(0x7f0000000bc0)=r6}, 0x20) sendmmsg$inet(r4, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)="32d33a47d96ceacc565129f837dfc4ec8df24612082800303fbc4c7dae05b96c2dc595b8", 0x24}, {&(0x7f0000000600)="9cf1495e028e22049259947af71c968820aac2153e36e05237044004130a31b25cd08e4a582dd094e3cd495eb7e28321e85d8e7da6651a68cb993498df2236fcab1ea0a1cc628ddbe16ac9191d6917ee7f319afaae6058b0a13fa0258fb74bf114e1a95c71a81b46d5d333aef5db36219c3bd7f905a25f5bb07bd3055d210022f04b5acf6a8e20086a71b6b5c7bb87d9c7a209b7f0e56dac72bf77c9773d1b702c", 0xa1}], 0x2}}], 0x1, 0x2090) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00000006c0), 0x4) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000740)="fb7ef3f08d8f0d64c4636b96073c171a2926f00a2baa2c2752e6ba348df7c6cb64a0a5dbc368e6e57135b7c7f20a1e4ca2d0c293b9df5480df71d6dcdd9beb4fa3247b3b7e38346fa0436ee2d9c57c41af42a71188cbd6b252eb449052ef2d76f3c0ab72b88db15921409f4efe9fe517430ec288238072967546e6a834ac62fec1df765d0147d8d2993dceb59f5b66b848a8f1d09a0d8108e7ef271311ea18df574e3e0b9242dd27f45258cb3bb762582f5737efdc15dabfa031673c84696ab886bdd35bb35a5346cf472e001e71c5384fc353b3181775acb185307d6f762e564b7fd4f06f875fc919c3ebb015f673a3cb380b03abbbfe30c781bd8b17292a1e2b748107e60e568c1e1f86a0cf01e30772b6b2146cd4d1f2e9fc7b5bcefded909fe7bf723490ced2d106004e3a0cd7b9c3519b05741751325fe8538085cc1f902fa544dcc929f10469fe39c3cf61f786254a373316923186fa08ef3c8917d4c2df0d3e41c32b6948177e71b23c3a9eb9c30db62011da02d48da9318c20a438f6ba2962ce066b8793e16831c350a379f8c54c5de2eab0b0117e3dc30f5c27c87b2eb33b43215bdcabb7185b1ca317dc967cfdfdcbf92a4e196bcf0d6ba1cea19dd296b4de3625a95ea0ee82efc84379be3125e84d8183ebce42f98654f44f86d49b13529b6cec5acbe93af52987080df30eed17685881b67777877226704091bd1f07b76c3af968b6afc17751d27756d8df673ee1cc", 0x215}], 0x1) sendmsg$inet(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="558d", 0x2}], 0x1}, 0x4) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r7, &(0x7f0000000180)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) sendmmsg$sock(r7, &(0x7f0000000200)=[{{&(0x7f0000000240)=@generic={0x751772a89104bc87, "8a4ac46a7523d11d706aea641732e48716ee0c8a6a0069ecf701f8045d7fbc341c85b89f0c88abbdd55f2d2c2299ca2a884627dccba17b19cb60dd78ab16960960de37714657a7823835cb8c9b5529f5c43a2b66272e80f668a98a1256c13cf3b09745eefe1e9c80c90093bccfc3e4c1a42294e032aae46372177259252d"}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)="1ff8da6912", 0x5}], 0x1}}], 0x1, 0x4000810) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c9c8433", @ANYRES16=r1, @ANYBLOB="050000000000000000001b00000008009a0000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 0s ago: executing program 32 (id=3266): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x5) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000001200010300000000000d0000020000000000000000000000000000000000000000000000000000000100"/56, @ANYRES32=0x0, @ANYBLOB="0100000000000000ffffffff00000000140001000710100002180000ffffffff"], 0x60}}, 0x4044804) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0100000004000000080000000d"], 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f00000004c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1, 0x10, &(0x7f0000000640)=ANY=[], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000006c0)=r7, 0x4) sendmsg$unix(r6, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x306) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000200)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x4bd1bfda, 0x0, 0x6}, 0x1c) setsockopt$packet_tx_ring(r9, 0x107, 0xd, &(0x7f0000000240)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r10 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000180)={{0x2, 0x4e21, @multicast1}, {0x306}, 0x4, {0x2, 0x4e22, @multicast1}, 'syzkaller0\x00'}) kernel console output (not intermixed with test programs): ] SET target dimension over the limit! [ 348.731641][T14913] netlink: 'syz.3.2303': attribute type 10 has an invalid length. [ 348.772077][T14913] team0 (unregistering): Port device team_slave_0 removed [ 348.854148][T14923] __nla_validate_parse: 32 callbacks suppressed [ 348.854170][T14923] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2308'. [ 348.873298][T14913] team0 (unregistering): Port device 76žÿ removed [ 348.913344][T14927] netlink: 596 bytes leftover after parsing attributes in process `syz.1.2308'. [ 348.913775][T14927] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2308'. [ 349.323012][T14913] team0 (unregistering): Port device bridge7 removed [ 349.640444][T14944] tc_dump_action: action bad kind [ 349.707794][T14949] syzkaller0: entered promiscuous mode [ 349.707827][T14949] syzkaller0: entered allmulticast mode [ 349.786011][T14953] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2312'. [ 350.094451][T14970] ip_tables: iptables: counters copy to user failed while replacing table [ 350.096005][T14970] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2318'. [ 350.109724][T14968] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2317'. [ 350.520487][T14996] syzkaller0: entered promiscuous mode [ 350.520511][T14996] syzkaller0: entered allmulticast mode [ 350.853859][T15006] bond4: (slave veth0_to_bond): Releasing backup interface [ 350.853883][T15006] bond4: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 350.885857][T15010] sctp: [Deprecated]: syz.4.2327 (pid 15010) Use of struct sctp_assoc_value in delayed_ack socket option. [ 350.885857][T15010] Use struct sctp_sack_info instead [ 350.898274][T15006] team0: Port device team_slave_0 removed [ 350.915231][T15010] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2327'. [ 350.933658][T15006] team0: Port device team_slave_1 removed [ 350.934656][T15006] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 350.934676][T15006] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 350.938105][T15006] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 350.938124][T15006] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 350.946741][T15006] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 351.037918][T15015] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 351.047590][T15015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2329'. [ 351.083067][T15012] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2328'. [ 351.264674][T15032] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 351.353961][T15037] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 351.557222][T15046] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2333'. [ 351.557257][T15046] netlink: 'syz.1.2333': attribute type 12 has an invalid length. [ 351.557527][T15046] netlink: 'syz.1.2333': attribute type 12 has an invalid length. [ 351.618747][T15047] Unsupported ieee802154 address type: 0 [ 351.657152][T15054] Unsupported ieee802154 address type: 0 [ 352.732082][T15094] netlink: 'syz.4.2345': attribute type 1 has an invalid length. [ 352.732106][T15094] netlink: 'syz.4.2345': attribute type 2 has an invalid length. [ 352.732122][T15094] nbd: illegal input index 393236 [ 352.843992][T15094] IPVS: stopping backup sync thread 8701 ... [ 352.856173][T15101] IPVS: Error joining to the multicast group [ 352.885450][T15085] geneve4: entered promiscuous mode [ 353.120139][T15108] netlink: 'syz.1.2348': attribute type 20 has an invalid length. [ 353.120163][T15108] netlink: 'syz.1.2348': attribute type 21 has an invalid length. [ 353.193125][T15116] netlink: 'syz.1.2348': attribute type 20 has an invalid length. [ 353.193147][T15116] netlink: 'syz.1.2348': attribute type 21 has an invalid length. [ 353.506340][T15137] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 353.518348][T15143] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 353.782061][T15164] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 354.299934][T15182] __nla_validate_parse: 9 callbacks suppressed [ 354.299954][T15182] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2368'. [ 354.299980][T15182] netlink: 'syz.4.2368': attribute type 21 has an invalid length. [ 354.375872][T15185] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2368'. [ 354.375908][T15185] netlink: 'syz.4.2368': attribute type 21 has an invalid length. [ 354.579211][T15191] netlink: 4456 bytes leftover after parsing attributes in process `syz.0.2369'. [ 354.881166][T15204] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 354.937216][T15207] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2373'. [ 355.060201][T15214] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2375'. [ 355.171798][T15219] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2376'. [ 355.212674][T15216] tipc: Enabled bearer , priority 13 [ 355.717324][T15230] tipc: Enabling of bearer rejected, already enabled [ 355.717605][T15232] netlink: 1364 bytes leftover after parsing attributes in process `syz.0.2378'. [ 355.970480][T10195] IPVS: ip_vs_send_async error -101 [ 356.027839][T15262] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2382'. [ 356.281955][T15269] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 356.339328][T15273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2386'. [ 356.413095][T15281] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2387'. [ 356.413661][T15282] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 359.553861][T15435] __nla_validate_parse: 65 callbacks suppressed [ 359.553884][T15435] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2450'. [ 359.553905][T15435] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2450'. [ 359.623342][T15437] bridge0: port 3(gretap0) entered disabled state [ 359.652431][T15437] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.663504][T15437] bridge0: port 2(bridge_slave_1) entered disabled state [ 360.459943][T15488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2475'. [ 360.503771][T15490] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2477'. [ 360.503810][T15490] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2477'. [ 360.855114][T15511] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2485'. [ 361.906943][T15550] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2503'. [ 361.932118][T15550] netlink: 'syz.0.2503': attribute type 61 has an invalid length. [ 361.932143][T15550] netlink: 'syz.0.2503': attribute type 268 has an invalid length. [ 361.997593][T15555] ip_tables: iptables: counters copy to user failed while replacing table [ 362.270528][T15566] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2509'. [ 362.270592][T15566] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2509'. [ 365.163599][T15589] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2518'. [ 365.163638][T15589] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2518'. [ 365.414222][T15594] ip6erspan0: entered allmulticast mode [ 365.467188][T15594] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 365.512116][T15594] netlink: 'syz.3.2520': attribute type 39 has an invalid length. [ 365.956350][T15616] netlink: 'syz.3.2527': attribute type 8 has an invalid length. [ 366.076309][T15618] netlink: 'syz.3.2529': attribute type 3 has an invalid length. [ 366.076330][T15618] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2529'. [ 366.147103][T15627] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2528'. [ 366.237926][T15629] tipc: Enabling of bearer rejected, failed to enable media [ 366.277444][T15634] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2531'. [ 366.277487][T15634] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2531'. [ 366.659249][T15657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2538'. [ 367.384996][T15680] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2541'. [ 367.712479][T15690] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2545'. [ 368.434321][T15722] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2551'. [ 368.946318][T15736] syzkaller0: entered promiscuous mode [ 368.946354][T15736] syzkaller0: entered allmulticast mode [ 369.096505][T15754] SET target dimension over the limit! [ 371.483820][T15779] bridge0: port 1(bridge_slave_0) entered disabled state [ 371.484218][T15779] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 371.555076][T15790] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 371.746244][T15804] SET target dimension over the limit! [ 371.752477][T15801] netlink: 'syz.1.2572': attribute type 1 has an invalid length. [ 371.752497][T15801] netlink: 'syz.1.2572': attribute type 268 has an invalid length. [ 371.752510][T15801] __nla_validate_parse: 4 callbacks suppressed [ 371.752520][T15801] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2572'. [ 371.886080][T15800] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 371.984113][T15817] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 372.348409][T15825] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2579'. [ 372.390396][T15827] syzkaller0: entered promiscuous mode [ 372.390419][T15827] syzkaller0: entered allmulticast mode [ 372.620575][T15837] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2580'. [ 372.687055][T15837] tap0: tun_chr_ioctl cmd 2152240185 [ 372.691952][T15837] bridge0: port 2(veth0) entered blocking state [ 372.692226][T15837] bridge0: port 2(veth0) entered disabled state [ 372.692406][T15837] veth0: entered allmulticast mode [ 372.700027][T15837] veth0: entered promiscuous mode [ 372.700904][T15837] bridge0: port 2(veth0) entered blocking state [ 372.701025][T15837] bridge0: port 2(veth0) entered forwarding state [ 373.304336][T15837] bridge0: port 2(veth0) entered disabled state [ 373.645739][T15837] tipc: Resetting bearer [ 373.646133][T15837] tipc: Resetting bearer [ 373.765466][T15844] geneve2: entered promiscuous mode [ 373.827638][T15846] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 373.908538][T15867] SET target dimension over the limit! [ 374.134124][T15869] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 374.188093][T15878] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 374.204085][T15877] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 374.206709][T15875] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2591'. [ 374.280082][T15882] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2593'. [ 374.693054][T15901] netlink: 'syz.3.2600': attribute type 1 has an invalid length. [ 374.761858][T15901] gretap2: entered allmulticast mode [ 374.766589][T15901] bond16: (slave gretap2): making interface the new active one [ 374.767825][T15901] bond16: (slave gretap2): Enslaving as an active interface with an up link [ 374.924894][T15908] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 375.041024][T15914] FAULT_INJECTION: forcing a failure. [ 375.041024][T15914] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 375.041072][T15914] CPU: 0 UID: 0 PID: 15914 Comm: syz.1.2604 Not tainted syzkaller #0 PREEMPT(full) [ 375.041117][T15914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 375.041145][T15914] Call Trace: [ 375.041153][T15914] [ 375.041162][T15914] dump_stack_lvl+0xe8/0x150 [ 375.041275][T15914] should_fail_ex+0x3eb/0x540 [ 375.041399][T15914] _copy_from_user+0x2d/0xb0 [ 375.041490][T15914] core_sys_select+0x671/0xb40 [ 375.041564][T15914] ? get_pid_task+0x20/0x1f0 [ 375.041619][T15914] ? __pfx_core_sys_select+0x10/0x10 [ 375.041666][T15914] ? __pfx_set_user_sigmask+0x10/0x10 [ 375.041698][T15914] ? __fget_files+0x3a2/0x420 [ 375.041754][T15914] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 375.041859][T15914] __se_sys_pselect6+0x267/0x320 [ 375.041887][T15914] ? __pfx___se_sys_pselect6+0x10/0x10 [ 375.041908][T15914] ? __pfx_ksys_write+0x10/0x10 [ 375.041946][T15914] ? __x64_sys_pselect6+0x21/0xf0 [ 375.041970][T15914] do_syscall_64+0x166/0x520 [ 375.042039][T15914] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.042078][T15914] ? clear_bhb_loop+0x70/0xc0 [ 375.042102][T15914] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.042126][T15914] RIP: 0033:0x7f536199fb19 [ 375.042146][T15914] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 375.042163][T15914] RSP: 002b:00007f5362834028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 375.042185][T15914] RAX: ffffffffffffffda RBX: 00007f5361c25fa0 RCX: 00007f536199fb19 [ 375.042200][T15914] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 375.042212][T15914] RBP: 00007f5362834090 R08: 0000000000000000 R09: 0000000000000000 [ 375.042235][T15914] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000001 [ 375.042248][T15914] R13: 00007f5361c26038 R14: 00007f5361c25fa0 R15: 00007ffd7603fc88 [ 375.042283][T15914] [ 375.480535][ T101] neighbour: arp_cache: neighbor table overflow! [ 375.649535][ C0] neighbour: arp_cache: neighbor table overflow! [ 375.716522][T15932] SET target dimension over the limit! [ 376.009614][ T43] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 376.009664][ T43] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 376.009700][ T43] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 376.009734][ T43] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 376.235055][T15956] FAULT_INJECTION: forcing a failure. [ 376.235055][T15956] name failslab, interval 1, probability 0, space 0, times 0 [ 376.235087][T15956] CPU: 1 UID: 0 PID: 15956 Comm: syz.4.2618 Not tainted syzkaller #0 PREEMPT(full) [ 376.235117][T15956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 376.235128][T15956] Call Trace: [ 376.235136][T15956] [ 376.235144][T15956] dump_stack_lvl+0xe8/0x150 [ 376.235181][T15956] should_fail_ex+0x3eb/0x540 [ 376.235212][T15956] should_failslab+0xa8/0x100 [ 376.235275][T15956] __kmalloc_cache_noprof+0x9e/0x600 [ 376.235305][T15956] ? __pollwait+0x27f/0x430 [ 376.235322][T15956] ? __pollwait+0x27f/0x430 [ 376.235346][T15956] __pollwait+0x27f/0x430 [ 376.235368][T15956] ? __pfx___pollwait+0x10/0x10 [ 376.235384][T15956] datagram_poll_queue+0x8c/0x420 [ 376.235540][T15956] udp_poll+0x34/0x1f0 [ 376.235618][T15956] sock_poll+0x341/0x460 [ 376.235669][T15956] ? __pfx_sock_poll+0x10/0x10 [ 376.235694][T15956] do_select+0x10a8/0x1880 [ 376.235722][T15956] ? do_select+0x8b1/0x1880 [ 376.235763][T15956] ? __pfx_do_select+0x10/0x10 [ 376.235783][T15956] ? lock_acquire+0x115/0x350 [ 376.235819][T15956] ? __lock_acquire+0x747/0x2de0 [ 376.235841][T15956] ? __pfx___pollwait+0x10/0x10 [ 376.235865][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.235922][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.235945][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.235970][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.235996][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.236020][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.236045][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.236069][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.236100][T15956] ? __pfx_pollwake+0x10/0x10 [ 376.236133][T15956] ? __might_fault+0xaf/0x130 [ 376.236172][T15956] core_sys_select+0x86d/0xb40 [ 376.236190][T15956] ? get_pid_task+0x20/0x1f0 [ 376.236225][T15956] ? __pfx_core_sys_select+0x10/0x10 [ 376.236268][T15956] ? __pfx_set_user_sigmask+0x10/0x10 [ 376.236295][T15956] ? __fget_files+0x3a2/0x420 [ 376.236319][T15956] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 376.236353][T15956] __se_sys_pselect6+0x267/0x320 [ 376.236380][T15956] ? __pfx___se_sys_pselect6+0x10/0x10 [ 376.236401][T15956] ? __pfx_ksys_write+0x10/0x10 [ 376.236432][T15956] ? __x64_sys_pselect6+0x21/0xf0 [ 376.236456][T15956] do_syscall_64+0x166/0x520 [ 376.236479][T15956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.236500][T15956] ? clear_bhb_loop+0x70/0xc0 [ 376.236525][T15956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.236545][T15956] RIP: 0033:0x7fd0c599fb19 [ 376.236564][T15956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.236582][T15956] RSP: 002b:00007fd0c6893028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 376.236603][T15956] RAX: ffffffffffffffda RBX: 00007fd0c5c25fa0 RCX: 00007fd0c599fb19 [ 376.236617][T15956] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 376.236630][T15956] RBP: 00007fd0c6893090 R08: 0000000000000000 R09: 0000000000000000 [ 376.236643][T15956] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000001 [ 376.236656][T15956] R13: 00007fd0c5c26038 R14: 00007fd0c5c25fa0 R15: 00007ffc57124718 [ 376.236691][T15956] [ 376.579735][ T101] net_ratelimit: 2 callbacks suppressed [ 376.579753][ T101] neighbour: arp_cache: neighbor table overflow! [ 376.682452][T15935] virtio_blk virtio5: 1/0/0 default/read/poll queues [ 376.689556][ C0] neighbour: arp_cache: neighbor table overflow! [ 376.712780][T15935] virtio_blk virtio5: [vda] 262144 512-byte logical blocks (134 MB/128 MiB) [ 376.918502][T15935] Dev vda: unable to read RDB block 8 [ 376.920392][T15935] vda: unable to read partition table [ 377.198118][T15986] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 377.271663][T15987] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2623'. [ 377.271696][T15987] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2623'. [ 377.491929][T15993] netlink: 9 bytes leftover after parsing attributes in process `syz.1.2627'. [ 377.497872][T15993] gretap0: entered promiscuous mode [ 377.691676][ T6788] neighbour: arp_cache: neighbor table overflow! [ 377.729529][ C0] neighbour: arp_cache: neighbor table overflow! [ 377.786094][T16012] SET target dimension over the limit! [ 378.009144][T16026] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 378.135524][T16035] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2638'. [ 378.239654][ T6788] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.239713][ T6788] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.239747][ T6788] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.239779][ T6788] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 378.435174][T16048] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 378.814720][T16066] SET target dimension over the limit! [ 378.826020][T16061] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 379.065928][T16081] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2649'. [ 379.149957][T16086] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2648'. [ 379.175094][T16069] syzkaller0: entered promiscuous mode [ 379.175120][T16069] syzkaller0: entered allmulticast mode [ 380.102532][T16110] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 382.088084][T16128] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2663'. [ 382.310095][T16145] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2667'. [ 382.362877][T16148] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 382.598331][T16156] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 382.893477][T16177] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2677'. [ 382.956504][T16174] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2675'. [ 382.993129][T16183] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2679'. [ 383.026385][T16183] syzkaller1: entered promiscuous mode [ 383.026407][T16183] syzkaller1: entered allmulticast mode [ 383.317059][T16191] syzkaller0: left promiscuous mode [ 383.317083][T16191] syzkaller0: left allmulticast mode [ 383.516574][T16202] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2684'. [ 383.577078][T16208] netlink: 268 bytes leftover after parsing attributes in process `syz.0.2684'. [ 383.610803][T16207] sit2: entered promiscuous mode [ 383.972570][T16223] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2692'. [ 383.972596][T16223] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2692'. [ 384.383339][T16245] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2697'. [ 384.398829][ T43] neighbour: arp_cache: neighbor table overflow! [ 384.452734][T16252] SET target dimension over the limit! [ 384.479919][T16251] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2700'. [ 385.009974][ C0] neighbour: arp_cache: neighbor table overflow! [ 385.209725][T16287] SET target dimension over the limit! [ 385.490304][ T42] neighbour: arp_cache: neighbor table overflow! [ 386.049893][ C0] neighbour: arp_cache: neighbor table overflow! [ 386.566569][T16343] SET target dimension over the limit! [ 386.600547][ T101] neighbour: arp_cache: neighbor table overflow! [ 386.755588][T16353] netlink: 'syz.1.2739': attribute type 1 has an invalid length. [ 386.797730][T16353] 8021q: adding VLAN 0 to HW filter on device bond7 [ 386.855519][T16353] bond7: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 386.904710][T16353] bridge0: entered promiscuous mode [ 386.912848][T16353] bond7: (slave bridge0): Enslaving as an active interface with an up link [ 386.960249][ T107] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.960400][ T107] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.960436][ T107] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 386.960469][ T107] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 387.089634][ C0] neighbour: arp_cache: neighbor table overflow! [ 387.213511][T16380] netlink: 'syz.0.2749': attribute type 1 has an invalid length. [ 387.254426][T16378] sctp: [Deprecated]: syz.3.2750 (pid 16378) Use of int in max_burst socket option. [ 387.254426][T16378] Use struct sctp_assoc_value instead [ 387.257732][T16379] sctp: [Deprecated]: syz.3.2750 (pid 16379) Use of int in max_burst socket option. [ 387.257732][T16379] Use struct sctp_assoc_value instead [ 387.764462][T16415] __nla_validate_parse: 11 callbacks suppressed [ 387.764484][T16415] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2760'. [ 387.803694][T16417] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2761'. [ 387.803735][T16417] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2761'. [ 388.260822][T16445] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2771'. [ 388.303557][T16448] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2773'. [ 388.316971][T16440] FAULT_INJECTION: forcing a failure. [ 388.316971][T16440] name failslab, interval 1, probability 0, space 0, times 0 [ 388.317000][T16440] CPU: 0 UID: 0 PID: 16440 Comm: syz.2.2770 Not tainted syzkaller #0 PREEMPT(full) [ 388.317022][T16440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 388.317034][T16440] Call Trace: [ 388.317042][T16440] [ 388.317050][T16440] dump_stack_lvl+0xe8/0x150 [ 388.317087][T16440] should_fail_ex+0x3eb/0x540 [ 388.317115][T16440] ? __alloc_skb+0x1db/0x7a0 [ 388.317228][T16440] should_failslab+0xa8/0x100 [ 388.317257][T16440] ? __alloc_skb+0x1db/0x7a0 [ 388.317283][T16440] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 388.317305][T16440] ? __alloc_skb+0x18d/0x7a0 [ 388.317334][T16440] ? __alloc_skb+0x1db/0x7a0 [ 388.317373][T16440] __alloc_skb+0x1db/0x7a0 [ 388.317405][T16440] netlink_sendmsg+0x5cd/0xb20 [ 388.317490][T16440] ? __pfx_netlink_sendmsg+0x10/0x10 [ 388.317520][T16440] ? aa_sock_msg_perm+0x144/0x210 [ 388.317587][T16440] ? apparmor_socket_sendmsg+0x18b/0x360 [ 388.317640][T16440] ? __pfx_netlink_sendmsg+0x10/0x10 [ 388.317666][T16440] sock_sendmsg_nosec+0x14e/0x190 [ 388.317693][T16440] ____sys_sendmsg+0x54e/0x850 [ 388.317720][T16440] ? __pfx_____sys_sendmsg+0x10/0x10 [ 388.317750][T16440] ? import_iovec+0x73/0xa0 [ 388.317776][T16440] ___sys_sendmsg+0x2a5/0x360 [ 388.317794][T16440] ? __lock_acquire+0x747/0x2de0 [ 388.317821][T16440] ? __pfx____sys_sendmsg+0x10/0x10 [ 388.317881][T16440] ? __fget_files+0x3a2/0x420 [ 388.317904][T16440] ? __fget_files+0x2a/0x420 [ 388.317937][T16440] __x64_sys_sendmsg+0x1b1/0x290 [ 388.317962][T16440] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 388.318007][T16440] do_syscall_64+0x166/0x520 [ 388.318029][T16440] ? trace_irq_disable+0x3b/0x140 [ 388.318072][T16440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.318092][T16440] ? clear_bhb_loop+0x70/0xc0 [ 388.318116][T16440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 388.318136][T16440] RIP: 0033:0x7fc98419fb19 [ 388.318155][T16440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 388.318172][T16440] RSP: 002b:00007fc9850dc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 388.318200][T16440] RAX: ffffffffffffffda RBX: 00007fc984425fa0 RCX: 00007fc98419fb19 [ 388.318214][T16440] RDX: 0000000020008000 RSI: 0000200000000ac0 RDI: 0000000000000004 [ 388.318227][T16440] RBP: 00007fc9850dc090 R08: 0000000000000000 R09: 0000000000000000 [ 388.318239][T16440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 388.318251][T16440] R13: 00007fc984426038 R14: 00007fc984425fa0 R15: 00007ffe152a7048 [ 388.318284][T16440] [ 388.748057][T16461] syzkaller0: entered promiscuous mode [ 388.748085][T16461] syzkaller0: entered allmulticast mode [ 389.296717][T16469] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2781'. [ 389.500469][T16475] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2785'. [ 389.526017][T16475] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2785'. [ 389.708158][T16486] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2786'. [ 390.057004][T16508] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2791'. [ 390.662862][T16528] udevd[16528]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 390.670537][T16528] udevd[16528]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 390.991395][T16554] syzkaller1: entered promiscuous mode [ 390.991420][T16554] syzkaller1: entered allmulticast mode [ 391.236199][T16568] ip_tables: iptables: counters copy to user failed while replacing table [ 391.325183][T16572] bridge0: port 3(bridge_slave_0) entered blocking state [ 391.325383][T16572] bridge0: port 3(bridge_slave_0) entered disabled state [ 391.325588][T16572] bridge_slave_0: entered allmulticast mode [ 391.327515][T16572] bridge_slave_0: entered promiscuous mode [ 391.408172][T16578] SET target dimension over the limit! [ 391.717943][T16602] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 391.900013][T16611] SET target dimension over the limit! [ 391.901141][T16610] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 392.012729][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.012837][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 392.021632][T16615] bridge_slave_1: left allmulticast mode [ 392.021657][T16615] bridge_slave_1: left promiscuous mode [ 392.021888][T16615] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.042177][T16615] bridge_slave_0: left allmulticast mode [ 392.042201][T16615] bridge_slave_0: left promiscuous mode [ 392.042421][T16615] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.097660][T16620] ip_tables: iptables: counters copy to user failed while replacing table [ 392.338064][T16635] FAULT_INJECTION: forcing a failure. [ 392.338064][T16635] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.338096][T16635] CPU: 1 UID: 0 PID: 16635 Comm: syz.2.2836 Not tainted syzkaller #0 PREEMPT(full) [ 392.338120][T16635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 392.338130][T16635] Call Trace: [ 392.338137][T16635] [ 392.338146][T16635] dump_stack_lvl+0xe8/0x150 [ 392.338183][T16635] should_fail_ex+0x3eb/0x540 [ 392.338215][T16635] _copy_from_user+0x2d/0xb0 [ 392.338242][T16635] __sys_bpf+0x2e7/0xe00 [ 392.338306][T16635] ? __pfx___sys_bpf+0x10/0x10 [ 392.338338][T16635] ? __fget_files+0x2a/0x420 [ 392.338381][T16635] ? ksys_write+0x242/0x270 [ 392.338409][T16635] ? __pfx_ksys_write+0x10/0x10 [ 392.338440][T16635] __x64_sys_bpf+0xba/0xd0 [ 392.338471][T16635] do_syscall_64+0x166/0x520 [ 392.338494][T16635] ? trace_irq_disable+0x3b/0x140 [ 392.338520][T16635] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.338540][T16635] ? clear_bhb_loop+0x70/0xc0 [ 392.338565][T16635] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.338584][T16635] RIP: 0033:0x7fc98419fb19 [ 392.338603][T16635] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.338618][T16635] RSP: 002b:00007fc9850dc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 392.338639][T16635] RAX: ffffffffffffffda RBX: 00007fc984425fa0 RCX: 00007fc98419fb19 [ 392.338654][T16635] RDX: 0000000000000050 RSI: 0000200000002300 RDI: 000000000000000a [ 392.338667][T16635] RBP: 00007fc9850dc090 R08: 0000000000000000 R09: 0000000000000000 [ 392.338684][T16635] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 392.338696][T16635] R13: 00007fc984426038 R14: 00007fc984425fa0 R15: 00007ffe152a7048 [ 392.338730][T16635] [ 392.702852][T16641] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 392.762748][T16645] syzkaller1: entered promiscuous mode [ 392.762773][T16645] syzkaller1: entered allmulticast mode [ 392.941885][T16655] SET target dimension over the limit! [ 393.324084][ T5658] block nbd7: Receive control failed (result -32) [ 393.564912][T16669] syzkaller0: entered promiscuous mode [ 393.564936][T16669] syzkaller0: entered allmulticast mode [ 393.716507][T16683] __nla_validate_parse: 5 callbacks suppressed [ 393.716529][T16683] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2847'. [ 393.810903][T16681] bond4: option active_slave: mode dependency failed, not supported in mode balance-xor(2) [ 393.833382][T16681] bond4 (unregistering): Released all slaves [ 394.453742][T16705] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 394.551540][T16691] syzkaller0: entered promiscuous mode [ 394.551566][T16691] syzkaller0: entered allmulticast mode [ 394.552616][T16696] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 394.653817][T16710] FAULT_INJECTION: forcing a failure. [ 394.653817][T16710] name failslab, interval 1, probability 0, space 0, times 0 [ 394.653838][T16710] CPU: 0 UID: 0 PID: 16710 Comm: syz.0.2854 Not tainted syzkaller #0 PREEMPT(full) [ 394.653857][T16710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 394.653868][T16710] Call Trace: [ 394.653875][T16710] [ 394.653884][T16710] dump_stack_lvl+0xe8/0x150 [ 394.653918][T16710] should_fail_ex+0x3eb/0x540 [ 394.653948][T16710] should_failslab+0xa8/0x100 [ 394.653977][T16710] ? skb_clone+0x212/0x3a0 [ 394.653998][T16710] kmem_cache_alloc_noprof+0x9c/0x600 [ 394.654022][T16710] ? skb_clone+0x212/0x3a0 [ 394.654041][T16710] skb_clone+0x212/0x3a0 [ 394.654052][T16710] ? nfnetlink_rcv+0x4b0/0x28c0 [ 394.654151][T16710] nfnetlink_rcv+0x4de/0x28c0 [ 394.654166][T16710] ? is_bpf_text_address+0x292/0x2b0 [ 394.654178][T16710] ? is_bpf_text_address+0x26/0x2b0 [ 394.654190][T16710] ? kernel_text_address+0xa5/0xe0 [ 394.654204][T16710] ? __kernel_text_address+0xd/0x30 [ 394.654216][T16710] ? unwind_get_return_address+0x4d/0x90 [ 394.654237][T16710] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 394.654260][T16710] ? arch_stack_walk+0xfb/0x150 [ 394.654284][T16710] ? __lock_acquire+0x747/0x2de0 [ 394.654298][T16710] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 394.654323][T16710] ? __lock_acquire+0x747/0x2de0 [ 394.654343][T16710] ? __netlink_lookup+0xe6/0x8f0 [ 394.654367][T16710] ? lock_acquire+0x115/0x350 [ 394.654380][T16710] ? netlink_deliver_tap+0x2e/0x1b0 [ 394.654398][T16710] ? netlink_deliver_tap+0x2e/0x1b0 [ 394.654412][T16710] ? netlink_deliver_tap+0x2e/0x1b0 [ 394.654430][T16710] netlink_unicast+0x8ef/0xa80 [ 394.654453][T16710] netlink_sendmsg+0x7f0/0xb20 [ 394.654471][T16710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 394.654488][T16710] ? aa_sock_msg_perm+0x144/0x210 [ 394.654502][T16710] ? apparmor_socket_sendmsg+0x18b/0x360 [ 394.654518][T16710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 394.654532][T16710] sock_sendmsg_nosec+0x14e/0x190 [ 394.654548][T16710] ____sys_sendmsg+0x54e/0x850 [ 394.654562][T16710] ? __pfx_____sys_sendmsg+0x10/0x10 [ 394.654578][T16710] ? import_iovec+0x73/0xa0 [ 394.654594][T16710] ___sys_sendmsg+0x2a5/0x360 [ 394.654603][T16710] ? __lock_acquire+0x747/0x2de0 [ 394.654619][T16710] ? __pfx____sys_sendmsg+0x10/0x10 [ 394.654651][T16710] ? __fget_files+0x3a2/0x420 [ 394.654663][T16710] ? __fget_files+0x2a/0x420 [ 394.654681][T16710] __x64_sys_sendmsg+0x1b1/0x290 [ 394.654694][T16710] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 394.654717][T16710] do_syscall_64+0x166/0x520 [ 394.654729][T16710] ? trace_irq_disable+0x3b/0x140 [ 394.654744][T16710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.654756][T16710] ? clear_bhb_loop+0x70/0xc0 [ 394.654771][T16710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.654782][T16710] RIP: 0033:0x7f78e879fb19 [ 394.654793][T16710] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.654802][T16710] RSP: 002b:00007f78e95b9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 394.654814][T16710] RAX: ffffffffffffffda RBX: 00007f78e8a25fa0 RCX: 00007f78e879fb19 [ 394.654822][T16710] RDX: 0000000020008000 RSI: 0000200000000ac0 RDI: 0000000000000004 [ 394.654829][T16710] RBP: 00007f78e95b9090 R08: 0000000000000000 R09: 0000000000000000 [ 394.654835][T16710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.654842][T16710] R13: 00007f78e8a26038 R14: 00007f78e8a25fa0 R15: 00007ffed8718948 [ 394.654859][T16710] [ 395.293858][T16727] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 395.583251][T16742] sctp: [Deprecated]: syz.3.2861 (pid 16742) Use of int in max_burst socket option. [ 395.583251][T16742] Use struct sctp_assoc_value instead [ 395.631817][T16737] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 397.456197][T16761] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2868'. [ 397.456238][T16761] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2868'. [ 397.771194][T16762] FAULT_INJECTION: forcing a failure. [ 397.771194][T16762] name failslab, interval 1, probability 0, space 0, times 0 [ 397.771239][T16762] CPU: 0 UID: 0 PID: 16762 Comm: syz.3.2870 Not tainted syzkaller #0 PREEMPT(full) [ 397.771260][T16762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 397.771271][T16762] Call Trace: [ 397.771278][T16762] [ 397.771285][T16762] dump_stack_lvl+0xe8/0x150 [ 397.771321][T16762] should_fail_ex+0x3eb/0x540 [ 397.771353][T16762] should_failslab+0xa8/0x100 [ 397.771380][T16762] ? skb_clone+0x212/0x3a0 [ 397.771394][T16762] kmem_cache_alloc_noprof+0x9c/0x600 [ 397.771408][T16762] ? skb_clone+0x212/0x3a0 [ 397.771424][T16762] skb_clone+0x212/0x3a0 [ 397.771434][T16762] ? nfnetlink_rcv+0x4b0/0x28c0 [ 397.771450][T16762] nfnetlink_rcv+0x4de/0x28c0 [ 397.771470][T16762] ? __local_bh_enable_ip+0xd6/0x140 [ 397.771485][T16762] ? lockdep_hardirqs_on+0x7b/0x110 [ 397.771497][T16762] ? __dev_queue_xmit+0x29b/0x3920 [ 397.771587][T16762] ? __local_bh_enable_ip+0xd6/0x140 [ 397.771601][T16762] ? __dev_queue_xmit+0x29b/0x3920 [ 397.771612][T16762] ? __dev_queue_xmit+0x1efb/0x3920 [ 397.771626][T16762] ? __dev_queue_xmit+0x29b/0x3920 [ 397.771641][T16762] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 397.771667][T16762] ? __copy_skb_header+0xa3/0x4a0 [ 397.771689][T16762] ? skb_clone+0x246/0x3a0 [ 397.771703][T16762] ? __netlink_deliver_tap+0x681/0x6e0 [ 397.771716][T16762] ? netlink_deliver_tap+0x2e/0x1b0 [ 397.771735][T16762] ? netlink_deliver_tap+0x2e/0x1b0 [ 397.771748][T16762] ? netlink_deliver_tap+0x2e/0x1b0 [ 397.771766][T16762] netlink_unicast+0x8ef/0xa80 [ 397.771789][T16762] netlink_sendmsg+0x7f0/0xb20 [ 397.771808][T16762] ? __pfx_netlink_sendmsg+0x10/0x10 [ 397.771824][T16762] ? aa_sock_msg_perm+0x144/0x210 [ 397.771839][T16762] ? apparmor_socket_sendmsg+0x18b/0x360 [ 397.771855][T16762] ? __pfx_netlink_sendmsg+0x10/0x10 [ 397.771876][T16762] sock_sendmsg_nosec+0x14e/0x190 [ 397.771892][T16762] ____sys_sendmsg+0x54e/0x850 [ 397.771907][T16762] ? __pfx_____sys_sendmsg+0x10/0x10 [ 397.771923][T16762] ? import_iovec+0x73/0xa0 [ 397.771938][T16762] ___sys_sendmsg+0x2a5/0x360 [ 397.771948][T16762] ? __lock_acquire+0x747/0x2de0 [ 397.771965][T16762] ? __pfx____sys_sendmsg+0x10/0x10 [ 397.771996][T16762] ? __fget_files+0x3a2/0x420 [ 397.772008][T16762] ? __fget_files+0x2a/0x420 [ 397.772026][T16762] __x64_sys_sendmsg+0x1b1/0x290 [ 397.772038][T16762] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 397.772062][T16762] do_syscall_64+0x166/0x520 [ 397.772073][T16762] ? trace_irq_disable+0x3b/0x140 [ 397.772088][T16762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.772099][T16762] ? clear_bhb_loop+0x70/0xc0 [ 397.772112][T16762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.772123][T16762] RIP: 0033:0x7fa21e59fb19 [ 397.772134][T16762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 397.772143][T16762] RSP: 002b:00007fa21f481028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 397.772155][T16762] RAX: ffffffffffffffda RBX: 00007fa21e825fa0 RCX: 00007fa21e59fb19 [ 397.772163][T16762] RDX: 0000000020008000 RSI: 0000200000000ac0 RDI: 0000000000000004 [ 397.772170][T16762] RBP: 00007fa21f481090 R08: 0000000000000000 R09: 0000000000000000 [ 397.772176][T16762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 397.772182][T16762] R13: 00007fa21e826038 R14: 00007fa21e825fa0 R15: 00007ffd40cf24a8 [ 397.772199][T16762] [ 398.288814][T16778] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2875'. [ 398.386893][T16783] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 398.698333][T16794] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 398.812313][ T54] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 398.820690][ T54] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 398.823333][ T54] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 398.826087][ T54] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 398.826710][ T54] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 398.886134][ T5658] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 398.886527][ T5658] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 398.891261][ T5658] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 398.893711][ T5658] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 398.899159][ T5658] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 398.944663][T16810] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2887'. [ 399.715346][T16801] wg2 speed is unknown, defaulting to 1000 [ 399.720996][T16801] lo speed is unknown, defaulting to 1000 [ 400.004901][T16852] siw: device registration error -23 [ 400.087305][T16852] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2894'. [ 400.367622][T16801] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.367798][T16801] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.367924][T16801] bridge_slave_0: entered allmulticast mode [ 400.393802][T16801] bridge_slave_0: entered promiscuous mode [ 400.438251][T16866] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2898'. [ 400.465660][T16801] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.467341][T16801] bridge0: port 2(bridge_slave_1) entered disabled state [ 400.467535][T16801] bridge_slave_1: entered allmulticast mode [ 400.469304][T16801] bridge_slave_1: entered promiscuous mode [ 400.551495][T16801] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 400.555607][T16801] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 400.605205][T16801] team0: Port device team_slave_0 added [ 400.608786][T16801] team0: Port device team_slave_1 added [ 400.649335][T16801] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 400.650618][T16801] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 400.650645][T16801] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 400.652673][T16801] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 400.652687][T16801] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 400.652713][T16801] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 400.712373][T16872] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2900'. [ 400.799451][T16801] hsr_slave_0: entered promiscuous mode [ 400.800841][T16801] hsr_slave_1: entered promiscuous mode [ 400.801591][T16801] debugfs: 'hsr0' already exists in 'hsr' [ 400.801609][T16801] Cannot create hsr debugfs directory [ 400.930692][ T54] Bluetooth: hci5: command tx timeout [ 401.114642][T16884] SET target dimension over the limit! [ 401.395161][T16897] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2909'. [ 401.401193][T16897] netlink: 'syz.1.2909': attribute type 4 has an invalid length. [ 401.600678][T16905] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2912'. [ 401.731897][T16907] FAULT_INJECTION: forcing a failure. [ 401.731897][T16907] name failslab, interval 1, probability 0, space 0, times 0 [ 401.731927][T16907] CPU: 0 UID: 0 PID: 16907 Comm: syz.3.2913 Not tainted syzkaller #0 PREEMPT(full) [ 401.731949][T16907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 401.731960][T16907] Call Trace: [ 401.731968][T16907] [ 401.731976][T16907] dump_stack_lvl+0xe8/0x150 [ 401.732013][T16907] should_fail_ex+0x3eb/0x540 [ 401.732039][T16907] should_failslab+0xa8/0x100 [ 401.732063][T16907] __kmalloc_noprof+0xf9/0x710 [ 401.732081][T16907] ? ___neigh_create+0x6da/0x21f0 [ 401.732188][T16907] ? ___neigh_create+0x6da/0x21f0 [ 401.732217][T16907] ___neigh_create+0x6da/0x21f0 [ 401.732240][T16907] ? rcu_is_watching+0x16/0xb0 [ 401.732269][T16907] ? neigh_lookup+0xb6/0x610 [ 401.732287][T16907] ? __pfx_arp_key_eq+0x10/0x10 [ 401.732338][T16907] ? __pfx_neigh_lookup+0x10/0x10 [ 401.732358][T16907] ? __mutex_lock+0x305/0x15a0 [ 401.732377][T16907] ? full_name_hash+0x92/0xe0 [ 401.732435][T16907] arp_req_set+0x7c1/0xe00 [ 401.732450][T16907] ? arp_ioctl+0x387/0x490 [ 401.732466][T16907] ? __pfx_arp_req_set+0x10/0x10 [ 401.732499][T16907] arp_ioctl+0x396/0x490 [ 401.732516][T16907] ? __pfx_arp_ioctl+0x10/0x10 [ 401.732549][T16907] inet_ioctl+0x3c4/0x560 [ 401.732586][T16907] ? __pfx_inet_ioctl+0x10/0x10 [ 401.732626][T16907] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 401.732660][T16907] sock_do_ioctl+0x101/0x320 [ 401.732687][T16907] ? __pfx_sock_do_ioctl+0x10/0x10 [ 401.732727][T16907] sock_ioctl+0x57a/0x7e0 [ 401.732749][T16907] ? __fget_files+0x2a/0x420 [ 401.732770][T16907] ? __pfx_sock_ioctl+0x10/0x10 [ 401.732792][T16907] ? __fget_files+0x2a/0x420 [ 401.732813][T16907] ? __fget_files+0x2a/0x420 [ 401.732838][T16907] ? bpf_lsm_file_ioctl+0x9/0x20 [ 401.732873][T16907] ? __pfx_sock_ioctl+0x10/0x10 [ 401.732895][T16907] __se_sys_ioctl+0xfc/0x170 [ 401.732923][T16907] do_syscall_64+0x166/0x520 [ 401.732943][T16907] ? trace_irq_disable+0x3b/0x140 [ 401.732967][T16907] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.732985][T16907] ? clear_bhb_loop+0x70/0xc0 [ 401.733008][T16907] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.733027][T16907] RIP: 0033:0x7fa21e59fb19 [ 401.733044][T16907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 401.733057][T16907] RSP: 002b:00007fa21f481028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 401.733073][T16907] RAX: ffffffffffffffda RBX: 00007fa21e825fa0 RCX: 00007fa21e59fb19 [ 401.733084][T16907] RDX: 0000200000000180 RSI: 0000000000008955 RDI: 0000000000000004 [ 401.733094][T16907] RBP: 00007fa21f481090 R08: 0000000000000000 R09: 0000000000000000 [ 401.733102][T16907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 401.733111][T16907] R13: 00007fa21e826038 R14: 00007fa21e825fa0 R15: 00007ffd40cf24a8 [ 401.733138][T16907] [ 402.045534][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.046025][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.046444][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.047012][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.047321][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.047656][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.047981][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.048290][T16913] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 402.468343][T16911] ip6gre1: entered promiscuous mode [ 402.468389][T16911] ip6gre1: entered allmulticast mode [ 402.577834][T16801] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 402.591128][T16801] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 402.592202][T16801] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 402.596702][T16801] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 402.597644][T16801] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 402.634989][T16801] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 402.638948][T16801] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 402.658272][T16801] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 402.727966][T16929] FAULT_INJECTION: forcing a failure. [ 402.727966][T16929] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 402.727996][T16929] CPU: 1 UID: 0 PID: 16929 Comm: syz.0.2918 Not tainted syzkaller #0 PREEMPT(full) [ 402.728018][T16929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 402.728029][T16929] Call Trace: [ 402.728036][T16929] [ 402.728044][T16929] dump_stack_lvl+0xe8/0x150 [ 402.728081][T16929] should_fail_ex+0x3eb/0x540 [ 402.728110][T16929] _copy_from_user+0x2d/0xb0 [ 402.728136][T16929] ___sys_sendmsg+0x1c6/0x360 [ 402.728156][T16929] ? __lock_acquire+0x747/0x2de0 [ 402.728186][T16929] ? __pfx____sys_sendmsg+0x10/0x10 [ 402.728247][T16929] ? __fget_files+0x3a2/0x420 [ 402.728269][T16929] ? __fget_files+0x2a/0x420 [ 402.728302][T16929] __x64_sys_sendmsg+0x1b1/0x290 [ 402.728326][T16929] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 402.728367][T16929] do_syscall_64+0x166/0x520 [ 402.728390][T16929] ? trace_irq_disable+0x3b/0x140 [ 402.728415][T16929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 402.728435][T16929] ? clear_bhb_loop+0x70/0xc0 [ 402.728459][T16929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 402.728479][T16929] RIP: 0033:0x7f78e879fb19 [ 402.728498][T16929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 402.728514][T16929] RSP: 002b:00007f78e95b9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 402.728534][T16929] RAX: ffffffffffffffda RBX: 00007f78e8a25fa0 RCX: 00007f78e879fb19 [ 402.728548][T16929] RDX: 0000000000000000 RSI: 0000200000001a40 RDI: 0000000000000004 [ 402.728561][T16929] RBP: 00007f78e95b9090 R08: 0000000000000000 R09: 0000000000000000 [ 402.728572][T16929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 402.728584][T16929] R13: 00007f78e8a26038 R14: 00007f78e8a25fa0 R15: 00007ffed8718948 [ 402.728616][T16929] [ 402.905637][T16932] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2919'. [ 402.927314][T16933] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2920'. [ 402.954687][T16801] 8021q: adding VLAN 0 to HW filter on device bond0 [ 402.972467][T16935] netlink: 'syz.0.2921': attribute type 1 has an invalid length. [ 402.972489][T16935] netlink: 'syz.0.2921': attribute type 4 has an invalid length. [ 402.972512][T16935] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.2921'. [ 403.013525][T16801] 8021q: adding VLAN 0 to HW filter on device team0 [ 403.021613][ T54] Bluetooth: hci5: command tx timeout [ 403.039157][ T6788] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.039259][ T6788] bridge0: port 1(bridge_slave_0) entered forwarding state [ 403.065537][ T6788] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.065635][ T6788] bridge0: port 2(bridge_slave_1) entered forwarding state [ 403.419236][T16948] FAULT_INJECTION: forcing a failure. [ 403.419236][T16948] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 403.419266][T16948] CPU: 0 UID: 0 PID: 16948 Comm: syz.0.2924 Not tainted syzkaller #0 PREEMPT(full) [ 403.419288][T16948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 403.419300][T16948] Call Trace: [ 403.419308][T16948] [ 403.419316][T16948] dump_stack_lvl+0xe8/0x150 [ 403.419356][T16948] should_fail_ex+0x3eb/0x540 [ 403.419383][T16948] _copy_to_user+0x31/0xb0 [ 403.419409][T16948] simple_read_from_buffer+0xe1/0x170 [ 403.419524][T16948] proc_fail_nth_read+0x1bb/0x230 [ 403.419628][T16948] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 403.419662][T16948] ? rw_verify_area+0x24a/0x4c0 [ 403.419689][T16948] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 403.419718][T16948] vfs_read+0x213/0xa80 [ 403.419750][T16948] ? __pfx___mutex_lock+0x10/0x10 [ 403.419775][T16948] ? __pfx_vfs_read+0x10/0x10 [ 403.419802][T16948] ? __fget_files+0x2a/0x420 [ 403.419831][T16948] ? __fget_files+0x3a2/0x420 [ 403.419853][T16948] ? __fget_files+0x2a/0x420 [ 403.419880][T16948] ? fdget+0x1ac/0x250 [ 403.419912][T16948] ksys_read+0x150/0x270 [ 403.419939][T16948] ? __pfx_ksys_read+0x10/0x10 [ 403.419978][T16948] do_syscall_64+0x166/0x520 [ 403.420000][T16948] ? trace_irq_disable+0x3b/0x140 [ 403.420027][T16948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.420048][T16948] ? clear_bhb_loop+0x70/0xc0 [ 403.420073][T16948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.420093][T16948] RIP: 0033:0x7f78e876034e [ 403.420111][T16948] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 403.420128][T16948] RSP: 002b:00007f78e95b8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 403.420148][T16948] RAX: ffffffffffffffda RBX: 00007f78e95b96c0 RCX: 00007f78e876034e [ 403.420163][T16948] RDX: 000000000000000f RSI: 00007f78e95b90a0 RDI: 0000000000000004 [ 403.420175][T16948] RBP: 00007f78e95b9090 R08: 0000000000000000 R09: 0000000000000000 [ 403.420188][T16948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 403.420200][T16948] R13: 00007f78e8a26038 R14: 00007f78e8a25fa0 R15: 00007ffed8718948 [ 403.420235][T16948] [ 403.911347][T16801] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 404.001190][T16801] veth0_vlan: entered promiscuous mode [ 404.015660][T16801] veth1_vlan: entered promiscuous mode [ 404.064817][T16801] veth0_macvtap: entered promiscuous mode [ 404.094562][T16801] veth1_macvtap: entered promiscuous mode [ 404.116828][T16801] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 404.133530][T16801] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 404.249938][ T43] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.292915][ T6788] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.293204][ T6788] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.293268][ T6788] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.347036][T16970] net_ratelimit: 25 callbacks suppressed [ 404.347051][T16970] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 404.465761][ T6788] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.465783][ T6788] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 404.590655][ T107] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 404.590677][ T107] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 404.642473][T16983] FAULT_INJECTION: forcing a failure. [ 404.642473][T16983] name failslab, interval 1, probability 0, space 0, times 0 [ 404.642503][T16983] CPU: 1 UID: 0 PID: 16983 Comm: syz.1.2935 Not tainted syzkaller #0 PREEMPT(full) [ 404.642526][T16983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 404.642538][T16983] Call Trace: [ 404.642546][T16983] [ 404.642555][T16983] dump_stack_lvl+0xe8/0x150 [ 404.642592][T16983] should_fail_ex+0x3eb/0x540 [ 404.642622][T16983] should_failslab+0xa8/0x100 [ 404.642653][T16983] __kmalloc_node_noprof+0xfb/0x720 [ 404.642679][T16983] ? qdisc_alloc+0x92/0x9d0 [ 404.642816][T16983] ? qdisc_alloc+0x92/0x9d0 [ 404.642846][T16983] qdisc_alloc+0x92/0x9d0 [ 404.642878][T16983] qdisc_create_dflt+0x8e/0x4e0 [ 404.642907][T16983] fifo_create_dflt+0x71/0x2c0 [ 404.642960][T16983] ? __red_change+0x5d9/0xeb0 [ 404.643012][T16983] __red_change+0x5f1/0xeb0 [ 404.643049][T16983] ? __pfx___red_change+0x10/0x10 [ 404.643073][T16983] ? __nla_parse+0x40/0x60 [ 404.643104][T16983] red_init+0x17e/0x290 [ 404.643125][T16983] ? __pfx_red_init+0x10/0x10 [ 404.643158][T16983] ? qdisc_lookup+0x5eb/0x6c0 [ 404.643184][T16983] ? __pfx_red_init+0x10/0x10 [ 404.643207][T16983] qdisc_create+0xc23/0x1450 [ 404.643236][T16983] tc_modify_qdisc+0x17af/0x2390 [ 404.643281][T16983] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 404.643302][T16983] ? __pfx_hook_capable+0x10/0x10 [ 404.643392][T16983] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 404.643412][T16983] rtnetlink_rcv_msg+0x7b9/0xc00 [ 404.643485][T16983] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 404.643505][T16983] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 404.643529][T16983] ? __copy_skb_header+0xa3/0x4a0 [ 404.643564][T16983] netlink_rcv_skb+0x226/0x4a0 [ 404.643591][T16983] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 404.643614][T16983] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 404.643654][T16983] ? netlink_deliver_tap+0x2e/0x1b0 [ 404.643682][T16983] ? netlink_deliver_tap+0x2e/0x1b0 [ 404.643715][T16983] netlink_unicast+0x8ef/0xa80 [ 404.643758][T16983] netlink_sendmsg+0x7f0/0xb20 [ 404.643793][T16983] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.643825][T16983] ? aa_sock_msg_perm+0x144/0x210 [ 404.643851][T16983] ? apparmor_socket_sendmsg+0x98/0x360 [ 404.643882][T16983] ? __pfx_netlink_sendmsg+0x10/0x10 [ 404.643909][T16983] sock_sendmsg_nosec+0x14e/0x190 [ 404.643939][T16983] ____sys_sendmsg+0x54e/0x850 [ 404.643967][T16983] ? __pfx_____sys_sendmsg+0x10/0x10 [ 404.643999][T16983] ? import_iovec+0x73/0xa0 [ 404.644028][T16983] ___sys_sendmsg+0x2a5/0x360 [ 404.644047][T16983] ? __lock_acquire+0x747/0x2de0 [ 404.644078][T16983] ? __pfx____sys_sendmsg+0x10/0x10 [ 404.644143][T16983] ? __fget_files+0x3a2/0x420 [ 404.644166][T16983] ? __fget_files+0x2a/0x420 [ 404.644201][T16983] __x64_sys_sendmsg+0x1b1/0x290 [ 404.644227][T16983] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 404.644280][T16983] do_syscall_64+0x166/0x520 [ 404.644304][T16983] ? trace_irq_disable+0x3b/0x140 [ 404.644331][T16983] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.644351][T16983] ? clear_bhb_loop+0x70/0xc0 [ 404.644375][T16983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.644396][T16983] RIP: 0033:0x7f536199fb19 [ 404.644415][T16983] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.644433][T16983] RSP: 002b:00007f5362834028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.644455][T16983] RAX: ffffffffffffffda RBX: 00007f5361c25fa0 RCX: 00007f536199fb19 [ 404.644469][T16983] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 404.644482][T16983] RBP: 00007f5362834090 R08: 0000000000000000 R09: 0000000000000000 [ 404.644495][T16983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 404.644507][T16983] R13: 00007f5361c26038 R14: 00007f5361c25fa0 R15: 00007ffd7603fc88 [ 404.644542][T16983] [ 404.922983][T16990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2937'. [ 405.038685][T16987] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 405.090037][ T54] Bluetooth: hci5: command tx timeout [ 405.329855][T17002] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2881'. [ 405.329879][T17002] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2881'. [ 405.329903][T17002] netlink: 'syz.2.2881': attribute type 13 has an invalid length. [ 405.804182][T17013] FAULT_INJECTION: forcing a failure. [ 405.804182][T17013] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 405.804213][T17013] CPU: 1 UID: 0 PID: 17013 Comm: syz.2.2941 Not tainted syzkaller #0 PREEMPT(full) [ 405.804235][T17013] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 405.804247][T17013] Call Trace: [ 405.804255][T17013] [ 405.804263][T17013] dump_stack_lvl+0xe8/0x150 [ 405.804300][T17013] should_fail_ex+0x3eb/0x540 [ 405.804331][T17013] _copy_from_iter+0x1d3/0x1680 [ 405.804353][T17013] ? __alloc_skb+0x27a/0x7a0 [ 405.804382][T17013] ? __alloc_skb+0x27a/0x7a0 [ 405.804411][T17013] ? __alloc_skb+0x27a/0x7a0 [ 405.804438][T17013] ? __pfx__copy_from_iter+0x10/0x10 [ 405.804458][T17013] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 405.804480][T17013] ? __alloc_skb+0x27a/0x7a0 [ 405.804507][T17013] ? __alloc_skb+0x27a/0x7a0 [ 405.804540][T17013] ? netlink_sendmsg+0x64f/0xb20 [ 405.804567][T17013] ? skb_put+0x112/0x210 [ 405.804605][T17013] netlink_sendmsg+0x6bb/0xb20 [ 405.804640][T17013] ? __pfx_netlink_sendmsg+0x10/0x10 [ 405.804671][T17013] ? aa_sock_msg_perm+0x144/0x210 [ 405.804698][T17013] ? apparmor_socket_sendmsg+0x98/0x360 [ 405.804727][T17013] ? __pfx_netlink_sendmsg+0x10/0x10 [ 405.804754][T17013] sock_sendmsg_nosec+0x14e/0x190 [ 405.804783][T17013] ____sys_sendmsg+0x54e/0x850 [ 405.804810][T17013] ? __pfx_____sys_sendmsg+0x10/0x10 [ 405.804842][T17013] ? import_iovec+0x73/0xa0 [ 405.804870][T17013] ___sys_sendmsg+0x2a5/0x360 [ 405.804888][T17013] ? __lock_acquire+0x747/0x2de0 [ 405.804919][T17013] ? __pfx____sys_sendmsg+0x10/0x10 [ 405.804982][T17013] ? __fget_files+0x3a2/0x420 [ 405.805005][T17013] ? __fget_files+0x2a/0x420 [ 405.805038][T17013] __x64_sys_sendmsg+0x1b1/0x290 [ 405.805063][T17013] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 405.805115][T17013] do_syscall_64+0x166/0x520 [ 405.805138][T17013] ? trace_irq_disable+0x3b/0x140 [ 405.805163][T17013] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.805183][T17013] ? clear_bhb_loop+0x70/0xc0 [ 405.805208][T17013] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.805227][T17013] RIP: 0033:0x7fe0fab9fb19 [ 405.805244][T17013] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.805259][T17013] RSP: 002b:00007fe0f8dee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 405.805280][T17013] RAX: ffffffffffffffda RBX: 00007fe0fae25fa0 RCX: 00007fe0fab9fb19 [ 405.805294][T17013] RDX: 0000000000000000 RSI: 0000200000001a40 RDI: 0000000000000004 [ 405.805305][T17013] RBP: 00007fe0f8dee090 R08: 0000000000000000 R09: 0000000000000000 [ 405.805317][T17013] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 405.805328][T17013] R13: 00007fe0fae26038 R14: 00007fe0fae25fa0 R15: 00007ffdfa42e718 [ 405.805361][T17013] [ 406.154880][T17017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2943'. [ 406.262559][T17019] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2944'. [ 406.519032][T17033] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 406.963937][ T5658] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 406.982265][ T5658] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 406.983541][ T5658] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 406.986132][ T5658] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 406.986766][ T5658] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 407.089977][T10195] IPVS: ip_vs_send_async error -101 [ 407.169862][ T54] Bluetooth: hci5: command tx timeout [ 407.692679][T17059] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2953'. [ 407.970527][T17071] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 408.013601][T17039] wg2 speed is unknown, defaulting to 1000 [ 408.016953][T17039] lo speed is unknown, defaulting to 1000 [ 408.554788][T17039] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.555122][T17039] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.555733][T17039] bridge_slave_0: entered allmulticast mode [ 408.557996][T17039] bridge_slave_0: entered promiscuous mode [ 408.564457][T17039] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.565407][T17039] bridge0: port 2(bridge_slave_1) entered disabled state [ 408.565549][T17039] bridge_slave_1: entered allmulticast mode [ 408.568610][T17039] bridge_slave_1: entered promiscuous mode [ 408.617884][T17087] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2958'. [ 408.665663][T17039] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 408.674960][T17039] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 408.758837][T17039] team0: Port device team_slave_0 added [ 408.770267][T17039] team0: Port device team_slave_1 added [ 408.918192][T17090] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2959'. [ 408.942835][T17092] ip_tables: iptables: counters copy to user failed while replacing table [ 408.944103][T17092] xt_TCPMSS: Only works on TCP SYN packets [ 409.090140][ T54] Bluetooth: hci2: command tx timeout [ 409.733763][T17039] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 409.733782][T17039] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.733808][T17039] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 409.784710][T17039] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 409.784727][T17039] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 409.784755][T17039] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 409.951965][T17039] hsr_slave_0: entered promiscuous mode [ 409.952976][T17039] hsr_slave_1: entered promiscuous mode [ 409.953965][T17039] debugfs: 'hsr0' already exists in 'hsr' [ 409.953984][T17039] Cannot create hsr debugfs directory [ 409.954183][T17117] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 409.959191][T17117] netlink: 308 bytes leftover after parsing attributes in process `syz.0.2969'. [ 410.235478][T17126] netlink: 45349 bytes leftover after parsing attributes in process `syz.2.2971'. [ 410.235603][T17126] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 410.238726][T17126] 0ªX¹¦Dö»: entered allmulticast mode [ 410.385833][T17135] netlink: 320 bytes leftover after parsing attributes in process `syz.3.2975'. [ 410.403899][T17138] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2976'. [ 410.499153][T17039] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 410.514729][T17140] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 410.872691][T17039] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 410.895163][T17150] bridge_slave_0: default FDB implementation only supports local addresses [ 411.007952][T17039] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 411.028428][T17039] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 411.040598][T17039] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 411.072646][T17039] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 411.103197][T17153] bridge0: entered allmulticast mode [ 411.103731][T17039] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 411.125326][T17039] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 411.169675][ T54] Bluetooth: hci2: command tx timeout [ 411.280345][T17039] 8021q: adding VLAN 0 to HW filter on device bond0 [ 411.305503][T17039] 8021q: adding VLAN 0 to HW filter on device team0 [ 411.324138][ T6774] bridge0: port 1(bridge_slave_0) entered blocking state [ 411.324236][ T6774] bridge0: port 1(bridge_slave_0) entered forwarding state [ 411.357493][ T6774] bridge0: port 2(bridge_slave_1) entered blocking state [ 411.357602][ T6774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 411.447396][T17175] FAULT_INJECTION: forcing a failure. [ 411.447396][T17175] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 411.447427][T17175] CPU: 1 UID: 0 PID: 17175 Comm: syz.2.2987 Not tainted syzkaller #0 PREEMPT(full) [ 411.447450][T17175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 411.447462][T17175] Call Trace: [ 411.447470][T17175] [ 411.447478][T17175] dump_stack_lvl+0xe8/0x150 [ 411.447514][T17175] should_fail_ex+0x3eb/0x540 [ 411.447544][T17175] _copy_to_user+0x31/0xb0 [ 411.447572][T17175] simple_read_from_buffer+0xe1/0x170 [ 411.447602][T17175] proc_fail_nth_read+0x1bb/0x230 [ 411.447635][T17175] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 411.447667][T17175] ? rw_verify_area+0x24a/0x4c0 [ 411.447693][T17175] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 411.447718][T17175] vfs_read+0x213/0xa80 [ 411.447749][T17175] ? __pfx___mutex_lock+0x10/0x10 [ 411.447773][T17175] ? __pfx_vfs_read+0x10/0x10 [ 411.447800][T17175] ? __fget_files+0x2a/0x420 [ 411.447822][T17175] ? __fget_files+0x3a2/0x420 [ 411.447843][T17175] ? __fget_files+0x2a/0x420 [ 411.447869][T17175] ? fdget+0x1ac/0x250 [ 411.447898][T17175] ksys_read+0x150/0x270 [ 411.447925][T17175] ? __pfx_ksys_read+0x10/0x10 [ 411.447961][T17175] do_syscall_64+0x166/0x520 [ 411.447981][T17175] ? trace_irq_disable+0x3b/0x140 [ 411.448007][T17175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.448027][T17175] ? clear_bhb_loop+0x70/0xc0 [ 411.448051][T17175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 411.448069][T17175] RIP: 0033:0x7fe0fab6034e [ 411.448088][T17175] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 411.448103][T17175] RSP: 002b:00007fe0f8dedfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 411.448123][T17175] RAX: ffffffffffffffda RBX: 00007fe0f8dee6c0 RCX: 00007fe0fab6034e [ 411.448146][T17175] RDX: 000000000000000f RSI: 00007fe0f8dee0a0 RDI: 0000000000000004 [ 411.448158][T17175] RBP: 00007fe0f8dee090 R08: 0000000000000000 R09: 0000000000000000 [ 411.448170][T17175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 411.448181][T17175] R13: 00007fe0fae26038 R14: 00007fe0fae25fa0 R15: 00007ffdfa42e718 [ 411.448214][T17175] [ 411.471442][T17176] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2984'. [ 411.477912][T17177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2984'. [ 412.165848][T17207] syzkaller0: entered promiscuous mode [ 412.165873][T17207] syzkaller0: entered allmulticast mode [ 412.885721][T17225] IPVS: set_ctl: invalid protocol: 98 127.0.0.1:20000 [ 412.885747][T17227] IPVS: set_ctl: invalid protocol: 98 127.0.0.1:20000 [ 413.250868][ T54] Bluetooth: hci2: command tx timeout [ 414.273375][T17222] ip6tnl3: entered allmulticast mode [ 414.297239][T17232] netlink: 'syz.0.2999': attribute type 29 has an invalid length. [ 414.576637][T17039] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 414.668129][T17249] netlink: 'syz.3.3000': attribute type 3 has an invalid length. [ 414.668151][T17249] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3000'. [ 414.977462][T17268] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 415.181291][T17039] veth0_vlan: entered promiscuous mode [ 415.197172][T17039] veth1_vlan: entered promiscuous mode [ 415.242650][T17039] veth0_macvtap: entered promiscuous mode [ 415.249118][T17039] veth1_macvtap: entered promiscuous mode [ 415.287264][T17039] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 415.307908][T17039] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 415.330660][ T54] Bluetooth: hci2: command tx timeout [ 415.617805][T17272] netlink: 'syz.1.3007': attribute type 33 has an invalid length. [ 415.670082][ T101] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.670133][ T101] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.670160][ T101] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.670187][ T101] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.774569][ T101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.774591][ T101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.845178][ T101] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.845199][ T101] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.899023][T17285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3011'. [ 415.990821][T17285] bond17: entered promiscuous mode [ 415.991333][T17285] 8021q: adding VLAN 0 to HW filter on device bond17 [ 416.146919][T17285] 8021q: adding VLAN 0 to HW filter on device bond17 [ 416.148831][T17285] bond17: (slave xfrm1): The slave device specified does not support setting the MAC address [ 416.149326][T17285] bond17: (slave xfrm1): Error -95 calling set_mac_address [ 416.449897][T10195] IPVS: ip_vs_send_async error -101 [ 416.505465][T17303] netlink: 'syz.3.3014': attribute type 1 has an invalid length. [ 416.505490][T17303] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3014'. [ 416.547518][T17304] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3013'. [ 416.547560][T17304] ip_vti0: entered promiscuous mode [ 416.547578][T17304] ip_vti0: entered allmulticast mode [ 416.548559][T17304] netlink: 'syz.4.3013': attribute type 5 has an invalid length. [ 416.826918][T17316] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3016'. [ 417.136342][ T5658] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 417.153240][ T5658] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 417.161795][ T5658] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 417.165231][ T5658] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 417.165875][ T5658] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 417.197845][T17328] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3017'. [ 417.936942][T17352] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3021'. [ 417.936975][T17352] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3021'. [ 418.080435][T17361] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3023'. [ 418.287025][T17370] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3022'. [ 418.291327][T17356] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3022'. [ 418.421176][T17324] wg2 speed is unknown, defaulting to 1000 [ 418.424444][T17324] lo speed is unknown, defaulting to 1000 [ 418.532170][T17361] veth0: entered promiscuous mode [ 418.566963][T17360] veth0: left promiscuous mode [ 418.648034][T17379] x_tables: ip6_tables: NFQUEUE.0 target: invalid size 8 (kernel) != (user) 0 [ 418.761987][T17387] ip6tnl1: entered allmulticast mode [ 418.764889][T17390] FAULT_INJECTION: forcing a failure. [ 418.764889][T17390] name failslab, interval 1, probability 0, space 0, times 0 [ 418.764917][T17390] CPU: 0 UID: 0 PID: 17390 Comm: syz.4.3028 Not tainted syzkaller #0 PREEMPT(full) [ 418.764939][T17390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 418.764951][T17390] Call Trace: [ 418.764959][T17390] [ 418.764967][T17390] dump_stack_lvl+0xe8/0x150 [ 418.765005][T17390] should_fail_ex+0x3eb/0x540 [ 418.765036][T17390] should_failslab+0xa8/0x100 [ 418.765075][T17390] __kmalloc_noprof+0xf9/0x710 [ 418.765100][T17390] ? __kmalloc_cache_noprof+0x148/0x600 [ 418.765123][T17390] ? nsim_fib_event_nb+0x283/0x11d0 [ 418.765259][T17390] ? nsim_fib_event_nb+0x283/0x11d0 [ 418.765293][T17390] nsim_fib_event_nb+0x283/0x11d0 [ 418.765321][T17390] ? lock_acquire+0x115/0x350 [ 418.765356][T17390] notifier_call_chain+0x1a5/0x3d0 [ 418.765383][T17390] ? atomic_notifier_call_chain+0x26/0x180 [ 418.765408][T17390] atomic_notifier_call_chain+0xda/0x180 [ 418.765433][T17390] call_fib_notifiers+0x31/0x60 [ 418.765496][T17390] fib6_add_rt2node+0x1389/0x3660 [ 418.765603][T17390] ? fib6_add_1+0x996/0x13e0 [ 418.765627][T17390] ? kmem_cache_alloc_noprof+0x31a/0x600 [ 418.765646][T17390] ? fib6_add_1+0x996/0x13e0 [ 418.765666][T17390] ? kmem_cache_alloc_noprof+0x151/0x600 [ 418.765687][T17390] ? fib6_add_1+0x996/0x13e0 [ 418.765710][T17390] ? __pfx_fib6_add_rt2node+0x10/0x10 [ 418.765739][T17390] ? fib6_add_1+0xdca/0x13e0 [ 418.765778][T17390] fib6_add+0x9ae/0x1a20 [ 418.765813][T17390] ? __pfx_fib6_add+0x10/0x10 [ 418.765844][T17390] ? ip6_route_add+0xc9/0x1b0 [ 418.765905][T17390] ip6_route_add+0xde/0x1b0 [ 418.765935][T17390] inet6_rtm_newroute+0x262/0x1ab0 [ 418.765970][T17390] ? kasan_quarantine_put+0xbb/0x1f0 [ 418.765996][T17390] ? lockdep_hardirqs_on+0x7b/0x110 [ 418.766019][T17390] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 418.766044][T17390] ? nlmon_xmit+0xb0/0x100 [ 418.766125][T17390] ? kmem_cache_free+0x182/0x650 [ 418.766158][T17390] ? __lock_acquire+0x747/0x2de0 [ 418.766188][T17390] ? __pfx_hook_capable+0x10/0x10 [ 418.766206][T17390] ? __dev_queue_xmit+0x29b/0x3920 [ 418.766269][T17390] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 418.766292][T17390] rtnetlink_rcv_msg+0x802/0xc00 [ 418.766317][T17390] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 418.766336][T17390] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 418.766357][T17390] ? __copy_skb_header+0xa3/0x4a0 [ 418.766392][T17390] netlink_rcv_skb+0x226/0x4a0 [ 418.766421][T17390] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 418.766442][T17390] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 418.766479][T17390] ? netlink_deliver_tap+0x2e/0x1b0 [ 418.766506][T17390] ? netlink_deliver_tap+0x2e/0x1b0 [ 418.766540][T17390] netlink_unicast+0x8ef/0xa80 [ 418.766585][T17390] netlink_sendmsg+0x7f0/0xb20 [ 418.766620][T17390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 418.766652][T17390] ? aa_sock_msg_perm+0x144/0x210 [ 418.766678][T17390] ? apparmor_socket_sendmsg+0x98/0x360 [ 418.766709][T17390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 418.766735][T17390] sock_sendmsg_nosec+0x14e/0x190 [ 418.766764][T17390] ____sys_sendmsg+0x54e/0x850 [ 418.766796][T17390] ? __pfx_____sys_sendmsg+0x10/0x10 [ 418.766831][T17390] ? import_iovec+0x73/0xa0 [ 418.766859][T17390] ___sys_sendmsg+0x2a5/0x360 [ 418.766877][T17390] ? __lock_acquire+0x747/0x2de0 [ 418.766908][T17390] ? __pfx____sys_sendmsg+0x10/0x10 [ 418.766970][T17390] ? __fget_files+0x3a2/0x420 [ 418.766994][T17390] ? __fget_files+0x2a/0x420 [ 418.767028][T17390] __x64_sys_sendmsg+0x1b1/0x290 [ 418.767052][T17390] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 418.767098][T17390] do_syscall_64+0x166/0x520 [ 418.767119][T17390] ? trace_irq_disable+0x3b/0x140 [ 418.767141][T17390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.767160][T17390] ? clear_bhb_loop+0x70/0xc0 [ 418.767183][T17390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 418.767202][T17390] RIP: 0033:0x7f6db799fb19 [ 418.767220][T17390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 418.767237][T17390] RSP: 002b:00007f6db88b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 418.767257][T17390] RAX: ffffffffffffffda RBX: 00007f6db7c25fa0 RCX: 00007f6db799fb19 [ 418.767271][T17390] RDX: 0000000000000000 RSI: 0000200000000640 RDI: 0000000000000003 [ 418.767284][T17390] RBP: 00007f6db88b3090 R08: 0000000000000000 R09: 0000000000000000 [ 418.767296][T17390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 418.767308][T17390] R13: 00007f6db7c26038 R14: 00007f6db7c25fa0 R15: 00007ffeb3ababd8 [ 418.767342][T17390] [ 418.815757][T17324] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.817590][T17324] bridge0: port 1(bridge_slave_0) entered disabled state [ 418.817755][T17324] bridge_slave_0: entered allmulticast mode [ 418.819545][T17324] bridge_slave_0: entered promiscuous mode [ 418.824565][T17324] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.824791][T17324] bridge0: port 2(bridge_slave_1) entered disabled state [ 418.824929][T17324] bridge_slave_1: entered allmulticast mode [ 418.826633][T17324] bridge_slave_1: entered promiscuous mode [ 418.944868][T17324] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 418.956509][T17324] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 419.001569][T17392] x_tables: ip_tables: osf match: only valid for protocol 6 [ 419.097446][T17324] team0: Port device team_slave_0 added [ 419.132729][T17324] team0: Port device team_slave_1 added [ 419.253841][ T54] Bluetooth: hci4: command tx timeout [ 419.276719][T17324] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 419.276735][T17324] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.276760][T17324] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 419.286382][T17324] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 419.286402][T17324] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 419.286429][T17324] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 419.507533][T17324] hsr_slave_0: entered promiscuous mode [ 419.509269][T17324] hsr_slave_1: entered promiscuous mode [ 419.510076][T17324] debugfs: 'hsr0' already exists in 'hsr' [ 419.510097][T17324] Cannot create hsr debugfs directory [ 420.196660][T17421] netlink: 'syz.4.3036': attribute type 1 has an invalid length. [ 420.362170][T17425] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 420.480088][T17427] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 420.482800][T17428] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 420.490375][T17431] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 421.177323][T17425] 8021q: adding VLAN 0 to HW filter on device team0 [ 421.185877][T17425] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 421.266028][T17425] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 421.267136][T17425] tipc: Resetting bearer [ 421.267436][T17425] tipc: Resetting bearer [ 421.303303][T17425] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 421.306181][T17425] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 421.306838][T17425] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 421.311715][T17425] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 421.324583][T17425] 8021q: adding VLAN 0 to HW filter on device bond1 [ 421.332607][ T54] Bluetooth: hci4: command tx timeout [ 421.339845][T17425] 8021q: adding VLAN 0 to HW filter on device team1 [ 421.347995][T17425] 8021q: adding VLAN 0 to HW filter on device team2 [ 421.375858][T17425] 8021q: adding VLAN 0 to HW filter on device bond2 [ 421.392641][T17425] 8021q: adding VLAN 0 to HW filter on device bond3 [ 421.397847][T17425] 8021q: adding VLAN 0 to HW filter on device bond4 [ 421.406260][T17425] 8021q: adding VLAN 0 to HW filter on device bond5 [ 421.407239][T17425] 8021q: adding VLAN 0 to HW filter on device bond6 [ 421.437996][T17425] 8021q: adding VLAN 0 to HW filter on device bond7 [ 421.447384][T17425] 8021q: adding VLAN 0 to HW filter on device bond8 [ 421.465706][T17425] 8021q: adding VLAN 0 to HW filter on device bond9 [ 421.470123][T17425] 8021q: adding VLAN 0 to HW filter on device bond10 [ 421.474078][T17425] 8021q: adding VLAN 0 to HW filter on device bond11 [ 421.524450][T17425] 8021q: adding VLAN 0 to HW filter on device bond12 [ 421.528880][T17425] 8021q: adding VLAN 0 to HW filter on device bond13 [ 421.533184][T17425] 8021q: adding VLAN 0 to HW filter on device bond14 [ 421.541276][T17425] 8021q: adding VLAN 0 to HW filter on device bond15 [ 421.543958][T17425] 8021q: adding VLAN 0 to HW filter on device bond16 [ 421.552207][T17425] 8021q: adding VLAN 0 to HW filter on device bond0 [ 421.558819][T17425] 8021q: adding VLAN 0 to HW filter on device bond17 [ 421.596404][T17451] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 421.600106][T17429] tipc: Resetting bearer [ 421.662907][ T101] bridge0: port 2(veth0) entered blocking state [ 421.663018][ T101] bridge0: port 2(veth0) entered forwarding state [ 421.668268][ T101] bridge0: port 3(bridge_slave_0) entered blocking state [ 421.668382][ T101] bridge0: port 3(bridge_slave_0) entered forwarding state [ 421.780276][ T6787] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.782437][ T101] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.782492][ T101] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 421.970868][ T6774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.094042][T17324] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.094085][T17324] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 422.094115][T17324] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.208939][T17467] __nla_validate_parse: 3 callbacks suppressed [ 422.208958][T17467] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3047'. [ 422.477980][T17324] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.478017][T17324] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 422.478043][T17324] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.518839][T17471] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3047'. [ 422.518866][T17471] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3047'. [ 422.539314][T17471] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3047'. [ 422.614863][T17473] udevd[17473]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 422.914034][T17324] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.914073][T17324] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 422.914099][T17324] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.937872][T17472] udevd[17472]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 422.945374][T17472] udevd[17472]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 422.950657][T17472] udevd[17472]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 422.995982][T17489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3052'. [ 423.032451][T17488] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 423.038822][T17492] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3052'. [ 423.055525][T17489] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3052'. [ 423.108605][T17492] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3052'. [ 423.126059][T17324] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.127695][T17324] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 4352 - 0 [ 423.127723][T17324] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 423.410836][ T54] Bluetooth: hci4: command tx timeout [ 423.428229][T17506] netlink: 'syz.0.3056': attribute type 29 has an invalid length. [ 423.428250][T17506] netlink: 'syz.0.3056': attribute type 70 has an invalid length. [ 423.453233][T17512] netlink: 'syz.3.3058': attribute type 1 has an invalid length. [ 423.488066][T17324] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 423.510880][T17324] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 423.514216][T17324] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 423.523648][T17324] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 423.530358][T17324] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 423.577718][T17324] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 423.579341][T17324] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 423.595997][T17324] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 423.985540][T17324] 8021q: adding VLAN 0 to HW filter on device bond0 [ 424.067504][T17324] 8021q: adding VLAN 0 to HW filter on device team0 [ 424.108619][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 424.108730][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 424.158252][ T6776] bridge0: port 2(bridge_slave_1) entered blocking state [ 424.158394][ T6776] bridge0: port 2(bridge_slave_1) entered forwarding state [ 424.287587][T17547] netlink: 'syz.4.3069': attribute type 1 has an invalid length. [ 424.406856][T17551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3070'. [ 424.412123][T17536] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.412167][T17536] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.037268][T17536] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 425.037305][T17536] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.268054][T17536] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 425.268091][T17536] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.375275][T17562] bond1: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 425.379119][T17562] bond1 (unregistering): Released all slaves [ 425.424820][T17570] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3074'. [ 425.489647][ T5658] Bluetooth: hci4: command tx timeout [ 425.657039][T17536] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 425.657077][T17536] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.140808][ T43] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.140842][ T43] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.141641][ T101] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.141683][ T101] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.215017][ T12] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.215051][ T12] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.215493][ T101] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.215522][ T101] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.360031][T17608] SET target dimension over the limit! [ 426.400975][T17603] openvswitch: netlink: Key 6 has unexpected len 13 expected 2 [ 427.585623][T17624] __nla_validate_parse: 1 callbacks suppressed [ 427.585643][T17624] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3085'. [ 427.715696][T17630] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3087'. [ 427.878127][T17638] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 427.949269][T17638] syzkaller0: entered promiscuous mode [ 427.949292][T17638] syzkaller0: entered allmulticast mode [ 428.155168][T17649] Cannot find del_set index 0 as target [ 428.245388][T17324] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 428.443744][T17324] veth0_vlan: entered promiscuous mode [ 428.465136][T17324] veth1_vlan: entered promiscuous mode [ 428.624575][T17324] veth0_macvtap: entered promiscuous mode [ 428.668348][T17324] veth1_macvtap: entered promiscuous mode [ 428.805999][T17324] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 428.856094][T17324] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 428.929791][ T6788] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.929862][ T6788] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.929897][ T6788] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.929930][ T6788] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.285199][ T101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.285221][ T101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 429.464076][ T101] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 429.464099][ T101] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 430.490993][T17716] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 430.493081][T16804] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 430.493871][T16804] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 430.495805][T16804] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 430.496792][T16804] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 430.584690][T17717] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3107'. [ 430.641729][T17719] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3108'. [ 430.714581][T17719] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3108'. [ 430.714866][T17719] nbd0: detected capacity change from 0 to 4194303 [ 430.723700][ T1184] block nbd0: Dead connection, failed to find a fallback [ 430.723723][ T1184] block nbd0: shutting down sockets [ 430.723816][ T1184] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.723910][ T1184] Buffer I/O error on dev nbd0, logical block 0, async page read [ 430.724284][ T1184] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.724310][ T1184] Buffer I/O error on dev nbd0, logical block 1, async page read [ 430.724407][ T1184] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.724430][ T1184] Buffer I/O error on dev nbd0, logical block 2, async page read [ 430.724610][ T1184] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.724633][ T1184] Buffer I/O error on dev nbd0, logical block 3, async page read [ 430.726013][ T1184] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.726038][ T1184] Buffer I/O error on dev nbd0, logical block 0, async page read [ 430.726146][ T1184] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.726169][ T1184] Buffer I/O error on dev nbd0, logical block 1, async page read [ 430.726716][ T1184] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.726742][ T1184] Buffer I/O error on dev nbd0, logical block 2, async page read [ 430.727068][ T1184] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.727092][ T1184] Buffer I/O error on dev nbd0, logical block 3, async page read [ 430.728488][ T1184] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.728514][ T1184] Buffer I/O error on dev nbd0, logical block 0, async page read [ 430.728633][ T1184] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 430.728656][ T1184] Buffer I/O error on dev nbd0, logical block 1, async page read [ 430.739514][T17635] ldm_validate_partition_table(): Disk read failed. [ 430.740055][T17635] Dev nbd0: unable to read RDB block 0 [ 430.743337][T17635] nbd0: unable to read partition table [ 430.801579][T17635] ldm_validate_partition_table(): Disk read failed. [ 430.804990][T17635] Dev nbd0: unable to read RDB block 0 [ 430.807752][T17635] nbd0: unable to read partition table [ 431.175753][T17737] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3110'. [ 431.253546][ T5658] block nbd8: Receive control failed (result -32) [ 431.257360][T16804] block nbd8: Receive control failed (result -32) [ 431.450011][T17742] netlink: 'syz.1.3112': attribute type 5 has an invalid length. [ 431.522009][T17713] wg2 speed is unknown, defaulting to 1000 [ 431.536759][T17713] lo speed is unknown, defaulting to 1000 [ 431.847343][T17751] netlink: 'syz.1.3114': attribute type 1 has an invalid length. [ 431.938127][T17751] bond0: (slave geneve2): Enslaving as an active interface with an up link [ 432.245643][T17768] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3119'. [ 432.434800][T17713] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.436593][T17713] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.437034][T17713] bridge_slave_0: entered allmulticast mode [ 432.441307][T17713] bridge_slave_0: entered promiscuous mode [ 432.446771][T17713] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.448490][T17713] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.448881][T17713] bridge_slave_1: entered allmulticast mode [ 432.454831][T17713] bridge_slave_1: entered promiscuous mode [ 432.533811][T16804] Bluetooth: hci3: command tx timeout [ 432.588443][T17713] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 432.599223][T17713] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 432.733606][T17713] team0: Port device team_slave_0 added [ 432.748123][T17713] team0: Port device team_slave_1 added [ 432.775644][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.775694][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.775927][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.775963][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.776181][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.776214][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.776443][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.776477][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.776692][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.776725][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.776955][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.788460][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.788706][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.788741][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.788953][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.788985][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.789191][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.789222][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.792199][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3123'. [ 432.792236][T17788] openvswitch: netlink: Missing key (keys=40, expected=80) [ 432.946888][T17790] bond1: entered promiscuous mode [ 432.947413][T17790] 8021q: adding VLAN 0 to HW filter on device bond1 [ 433.030748][T17713] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 433.030766][T17713] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 433.030786][T17713] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 433.037895][T17713] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 433.037912][T17713] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 433.037938][T17713] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 433.196005][T17713] hsr_slave_0: entered promiscuous mode [ 433.198622][T17713] hsr_slave_1: entered promiscuous mode [ 433.203604][T17713] debugfs: 'hsr0' already exists in 'hsr' [ 433.203626][T17713] Cannot create hsr debugfs directory [ 434.164803][T17713] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.164840][T17713] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.251526][T17713] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.251561][T17713] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.336443][T17834] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-6) [ 434.403976][T17713] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.404011][T17713] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.537465][T17713] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 434.537487][T17713] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.638111][T16804] Bluetooth: hci3: command tx timeout [ 436.427336][T17816] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 436.456944][T17713] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 436.487888][T17713] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 436.497765][T17713] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 436.531072][T17713] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 436.533635][T17713] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 436.576454][T17713] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 436.586810][T17713] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 436.614440][T17713] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 436.653260][T17864] SET target dimension over the limit! [ 436.690030][T16804] Bluetooth: hci3: command tx timeout [ 436.970654][T17883] Bluetooth: MGMT ver 1.23 [ 437.040137][T17884] netlink: 'syz.4.3151': attribute type 1 has an invalid length. [ 437.074320][T17713] 8021q: adding VLAN 0 to HW filter on device bond0 [ 437.122679][T17713] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.152828][ T101] bridge0: port 1(bridge_slave_0) entered blocking state [ 437.152945][ T101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 437.195096][ T101] bridge0: port 2(bridge_slave_1) entered blocking state [ 437.195205][ T101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 437.547390][T17893] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 437.611199][T17893] bond1: (slave lo): Enslaving as an active interface with an up link [ 437.956777][T17906] pim6reg1: entered promiscuous mode [ 437.956800][T17906] pim6reg1: entered allmulticast mode [ 437.959226][T17911] netlink: 'syz.0.3158': attribute type 4 has an invalid length. [ 438.002846][T17911] netlink: 'syz.0.3158': attribute type 4 has an invalid length. [ 438.066733][T17914] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 438.221116][T17922] SET target dimension over the limit! [ 438.503738][T17928] bridge0: port 2(bridge_slave_1) entered disabled state [ 438.504401][T17928] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.622238][T17928] net_ratelimit: 25 callbacks suppressed [ 438.622262][T17928] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 438.771678][T16804] Bluetooth: hci3: command tx timeout [ 438.900412][T17942] __nla_validate_parse: 27 callbacks suppressed [ 438.900433][T17942] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3165'. [ 438.918660][T17713] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 439.036333][T17713] veth0_vlan: entered promiscuous mode [ 439.053786][T17713] veth1_vlan: entered promiscuous mode [ 439.096377][T17713] veth0_macvtap: entered promiscuous mode [ 439.133054][T17713] veth1_macvtap: entered promiscuous mode [ 439.185106][T17958] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3166'. [ 439.196975][T17713] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 439.259279][T17713] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 439.348882][ T42] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 439.349238][ T42] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 439.349610][ T42] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 439.419679][ T42] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 439.716263][T17944] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3167'. [ 439.744613][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 439.744635][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.937869][ T6776] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 439.937891][ T6776] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 440.093522][T18029] SET target dimension over the limit! [ 440.099533][T17954] workqueue: Failed to create a rescuer kthread for wq "nfc4_nci_tx_wq": -EINTR [ 440.487732][T18038] netlink: 'syz.0.3173': attribute type 3 has an invalid length. [ 440.520054][T17998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3169'. [ 440.565315][T18044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3174'. [ 441.039887][T18062] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3179'. [ 441.274401][T18078] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.275080][T18078] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.424747][T18077] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3183'. [ 441.598577][T18079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3183'. [ 442.070767][T18049] syzkaller0: entered promiscuous mode [ 442.070790][T18049] syzkaller0: entered allmulticast mode [ 442.154229][T18100] netlink: 'syz.4.3188': attribute type 1 has an invalid length. [ 442.430501][T18113] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3191'. [ 442.468371][T18112] syzkaller0: left promiscuous mode [ 442.468395][T18112] syzkaller0: left allmulticast mode [ 442.563690][ T5658] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 442.566414][ T5658] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 442.584450][ T5658] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 442.585410][ T5658] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 442.592933][ T5658] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 442.681584][T18117] SET target dimension over the limit! [ 443.276785][T18141] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3199'. [ 443.276810][T18141] FAULT_INJECTION: forcing a failure. [ 443.276810][T18141] name failslab, interval 1, probability 0, space 0, times 0 [ 443.276832][T18141] CPU: 0 UID: 0 PID: 18141 Comm: syz.1.3199 Not tainted syzkaller #0 PREEMPT(full) [ 443.276854][T18141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 443.276866][T18141] Call Trace: [ 443.276873][T18141] [ 443.276881][T18141] dump_stack_lvl+0xe8/0x150 [ 443.276917][T18141] should_fail_ex+0x3eb/0x540 [ 443.276946][T18141] ? __alloc_skb+0x1db/0x7a0 [ 443.276976][T18141] should_failslab+0xa8/0x100 [ 443.277006][T18141] ? __alloc_skb+0x1db/0x7a0 [ 443.277031][T18141] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 443.277053][T18141] ? __alloc_skb+0x18d/0x7a0 [ 443.277081][T18141] ? __alloc_skb+0x1db/0x7a0 [ 443.277115][T18141] __alloc_skb+0x1db/0x7a0 [ 443.277146][T18141] netlink_ack+0x136/0xb30 [ 443.277171][T18141] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 443.277194][T18141] ? __copy_skb_header+0xa3/0x4a0 [ 443.277228][T18141] netlink_rcv_skb+0x2a4/0x4a0 [ 443.277255][T18141] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 443.277277][T18141] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 443.277317][T18141] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.277343][T18141] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.277374][T18141] netlink_unicast+0x8ef/0xa80 [ 443.277415][T18141] netlink_sendmsg+0x7f0/0xb20 [ 443.277449][T18141] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.277481][T18141] ? aa_sock_msg_perm+0x144/0x210 [ 443.277505][T18141] ? apparmor_socket_sendmsg+0x98/0x360 [ 443.277544][T18141] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.277570][T18141] sock_sendmsg_nosec+0x14e/0x190 [ 443.277600][T18141] ____sys_sendmsg+0x54e/0x850 [ 443.277628][T18141] ? __pfx_____sys_sendmsg+0x10/0x10 [ 443.277659][T18141] ? import_iovec+0x73/0xa0 [ 443.277688][T18141] ___sys_sendmsg+0x2a5/0x360 [ 443.277707][T18141] ? __lock_acquire+0x747/0x2de0 [ 443.277737][T18141] ? __pfx____sys_sendmsg+0x10/0x10 [ 443.277797][T18141] ? __fget_files+0x3a2/0x420 [ 443.277820][T18141] ? __fget_files+0x2a/0x420 [ 443.277854][T18141] __x64_sys_sendmsg+0x1b1/0x290 [ 443.277878][T18141] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 443.277922][T18141] do_syscall_64+0x166/0x520 [ 443.277944][T18141] ? trace_irq_disable+0x3b/0x140 [ 443.277971][T18141] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.277992][T18141] ? clear_bhb_loop+0x70/0xc0 [ 443.278016][T18141] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.278035][T18141] RIP: 0033:0x7fbea799fb19 [ 443.278053][T18141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.278069][T18141] RSP: 002b:00007fbea890e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.278091][T18141] RAX: ffffffffffffffda RBX: 00007fbea7c25fa0 RCX: 00007fbea799fb19 [ 443.278106][T18141] RDX: 0000000000000800 RSI: 0000200000000800 RDI: 0000000000000003 [ 443.278119][T18141] RBP: 00007fbea890e090 R08: 0000000000000000 R09: 0000000000000000 [ 443.278131][T18141] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.278143][T18141] R13: 00007fbea7c26038 R14: 00007fbea7c25fa0 R15: 00007fffd3ef6e78 [ 443.278178][T18141] [ 443.338853][T18143] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 443.597618][T18114] wg2 speed is unknown, defaulting to 1000 [ 443.625620][T18114] lo speed is unknown, defaulting to 1000 [ 443.901876][T18153] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 444.203761][T18177] nbd: nbd3 already in use [ 444.273183][T18114] bridge0: port 1(bridge_slave_0) entered blocking state [ 444.273406][T18114] bridge0: port 1(bridge_slave_0) entered disabled state [ 444.273846][T18114] bridge_slave_0: entered allmulticast mode [ 444.275525][T18114] bridge_slave_0: entered promiscuous mode [ 444.316031][T18114] bridge0: port 2(bridge_slave_1) entered blocking state [ 444.316139][T18114] bridge0: port 2(bridge_slave_1) entered disabled state [ 444.316299][T18114] bridge_slave_1: entered allmulticast mode [ 444.324530][T18114] bridge_slave_1: entered promiscuous mode [ 444.380920][T18179] : entered promiscuous mode [ 444.412821][T18187] __nla_validate_parse: 3 callbacks suppressed [ 444.412839][T18187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3211'. [ 444.487396][T18114] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 444.493791][T18189] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3212'. [ 444.503306][T18114] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 444.541536][T18191] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3213'. [ 444.605172][T18114] team0: Port device team_slave_0 added [ 444.611532][T18114] team0: Port device team_slave_1 added [ 444.686106][T18114] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 444.686125][T18114] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 444.686150][T18114] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 444.697701][T16804] Bluetooth: hci0: command tx timeout [ 444.708811][T18114] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 444.708829][T18114] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 444.708854][T18114] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 444.787410][T18196] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3214'. [ 444.787434][T18196] netlink: 34 bytes leftover after parsing attributes in process `syz.2.3214'. [ 444.789937][T18198] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 444.861412][T18114] hsr_slave_0: entered promiscuous mode [ 444.868031][T18114] hsr_slave_1: entered promiscuous mode [ 444.874138][T18114] debugfs: 'hsr0' already exists in 'hsr' [ 444.874162][T18114] Cannot create hsr debugfs directory [ 445.148185][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3219'. [ 445.584024][T18221] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3222'. [ 445.584165][T18221] FAULT_INJECTION: forcing a failure. [ 445.584165][T18221] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 445.584190][T18221] CPU: 0 UID: 0 PID: 18221 Comm: syz.4.3222 Not tainted syzkaller #0 PREEMPT(full) [ 445.584210][T18221] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 445.584220][T18221] Call Trace: [ 445.584227][T18221] [ 445.584235][T18221] dump_stack_lvl+0xe8/0x150 [ 445.584272][T18221] should_fail_ex+0x3eb/0x540 [ 445.584299][T18221] _copy_from_user+0x2d/0xb0 [ 445.584330][T18221] kstrtouint_from_user+0xd6/0x180 [ 445.584356][T18221] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 445.584385][T18221] ? lock_acquire+0x115/0x350 [ 445.584416][T18221] proc_fail_nth_write+0x8e/0x210 [ 445.584448][T18221] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 445.584488][T18221] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 445.584517][T18221] vfs_write+0x296/0xba0 [ 445.584554][T18221] ? __pfx_vfs_write+0x10/0x10 [ 445.584581][T18221] ? __fget_files+0x2a/0x420 [ 445.584604][T18221] ? __fget_files+0x3a2/0x420 [ 445.584626][T18221] ? __fget_files+0x2a/0x420 [ 445.584654][T18221] ? fdget+0x1ac/0x250 [ 445.584685][T18221] ksys_write+0x150/0x270 [ 445.584713][T18221] ? __pfx_ksys_write+0x10/0x10 [ 445.584752][T18221] do_syscall_64+0x166/0x520 [ 445.584776][T18221] ? trace_irq_disable+0x3b/0x140 [ 445.584801][T18221] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.584822][T18221] ? clear_bhb_loop+0x70/0xc0 [ 445.584845][T18221] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.584864][T18221] RIP: 0033:0x7f6db796034e [ 445.584881][T18221] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 445.584898][T18221] RSP: 002b:00007f6db88b2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 445.584919][T18221] RAX: ffffffffffffffda RBX: 00007f6db88b36c0 RCX: 00007f6db796034e [ 445.584933][T18221] RDX: 0000000000000001 RSI: 00007f6db88b30a0 RDI: 0000000000000004 [ 445.584945][T18221] RBP: 00007f6db88b3090 R08: 0000000000000000 R09: 0000000000000000 [ 445.584957][T18221] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 445.584969][T18221] R13: 00007f6db7c26038 R14: 00007f6db7c25fa0 R15: 00007ffeb3ababd8 [ 445.585004][T18221] [ 445.677366][T18223] SET target dimension over the limit! [ 445.993960][T18114] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 445.993995][T18114] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.029287][T18225] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3224'. [ 446.100535][T18114] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.100572][T18114] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.177409][T18244] netlink: 'syz.1.3230': attribute type 1 has an invalid length. [ 446.249057][T18244] 8021q: adding VLAN 0 to HW filter on device bond2 [ 446.258246][T18248] bond2: entered promiscuous mode [ 446.284371][T18114] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.284421][T18114] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.359832][T18244] bond2: (slave dummy0): making interface the new active one [ 446.359857][T18244] dummy0: entered promiscuous mode [ 446.364714][T18244] bond2: (slave dummy0): Enslaving as an active interface with an up link [ 446.425613][T18114] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.425649][T18114] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.774835][T16804] Bluetooth: hci0: command tx timeout [ 447.363982][T18244] sch_tbf: peakrate 8 is lower than or equals to rate 1025 ! [ 447.391061][T18242] bond2: left promiscuous mode [ 447.391084][T18242] dummy0: left promiscuous mode [ 447.414261][T18272] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3239'. [ 447.414568][T18272] bridge_slave_0: default FDB implementation only supports local addresses [ 447.472149][T18270] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 447.562253][T18275] FAULT_INJECTION: forcing a failure. [ 447.562253][T18275] name failslab, interval 1, probability 0, space 0, times 0 [ 447.562288][T18275] CPU: 0 UID: 0 PID: 18275 Comm: syz.3.3240 Not tainted syzkaller #0 PREEMPT(full) [ 447.562310][T18275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 447.562322][T18275] Call Trace: [ 447.562334][T18275] [ 447.562342][T18275] dump_stack_lvl+0xe8/0x150 [ 447.562382][T18275] should_fail_ex+0x3eb/0x540 [ 447.562409][T18275] ? __alloc_skb+0x1db/0x7a0 [ 447.562440][T18275] should_failslab+0xa8/0x100 [ 447.562471][T18275] ? __alloc_skb+0x1db/0x7a0 [ 447.562497][T18275] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 447.562520][T18275] ? __alloc_skb+0x18d/0x7a0 [ 447.562549][T18275] ? __alloc_skb+0x1db/0x7a0 [ 447.562585][T18275] __alloc_skb+0x1db/0x7a0 [ 447.562617][T18275] netlink_sendmsg+0x5cd/0xb20 [ 447.562650][T18275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.562683][T18275] ? aa_sock_msg_perm+0x144/0x210 [ 447.562709][T18275] ? apparmor_socket_sendmsg+0x98/0x360 [ 447.562740][T18275] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.562767][T18275] sock_sendmsg_nosec+0x14e/0x190 [ 447.562797][T18275] ____sys_sendmsg+0x54e/0x850 [ 447.562825][T18275] ? __pfx_____sys_sendmsg+0x10/0x10 [ 447.562862][T18275] ? import_iovec+0x73/0xa0 [ 447.562891][T18275] ___sys_sendmsg+0x2a5/0x360 [ 447.562909][T18275] ? __lock_acquire+0x747/0x2de0 [ 447.562945][T18275] ? __pfx____sys_sendmsg+0x10/0x10 [ 447.563006][T18275] ? __fget_files+0x3a2/0x420 [ 447.563030][T18275] ? __fget_files+0x2a/0x420 [ 447.563064][T18275] __x64_sys_sendmsg+0x1b1/0x290 [ 447.563089][T18275] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 447.563141][T18275] do_syscall_64+0x166/0x520 [ 447.563164][T18275] ? trace_irq_disable+0x3b/0x140 [ 447.563191][T18275] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.563210][T18275] ? clear_bhb_loop+0x70/0xc0 [ 447.563233][T18275] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.563253][T18275] RIP: 0033:0x7f899499fb19 [ 447.563271][T18275] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.563288][T18275] RSP: 002b:00007f89957c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 447.563309][T18275] RAX: ffffffffffffffda RBX: 00007f8994c25fa0 RCX: 00007f899499fb19 [ 447.563324][T18275] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000003 [ 447.563337][T18275] RBP: 00007f89957c5090 R08: 0000000000000000 R09: 0000000000000000 [ 447.563350][T18275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 447.563361][T18275] R13: 00007f8994c26038 R14: 00007f8994c25fa0 R15: 00007fff982d8b68 [ 447.563396][T18275] [ 447.861410][T18283] netlink: 'syz.1.3244': attribute type 29 has an invalid length. [ 447.955939][T18114] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 447.962163][T18287] netlink: 'syz.1.3244': attribute type 1 has an invalid length. [ 448.150624][T18297] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3247'. [ 448.677879][T18114] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 448.678975][T18114] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 448.885206][T18114] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 448.891654][T18287] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 448.892672][T16804] Bluetooth: hci0: command tx timeout [ 448.953174][T18292] erspan1: entered allmulticast mode [ 448.975072][T18114] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 449.004146][T18114] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 449.018947][T18114] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 449.131235][T18114] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 449.647911][T18114] 8021q: adding VLAN 0 to HW filter on device bond0 [ 449.705967][T18114] 8021q: adding VLAN 0 to HW filter on device team0 [ 449.725873][ T6774] bridge0: port 1(bridge_slave_0) entered blocking state [ 449.725979][ T6774] bridge0: port 1(bridge_slave_0) entered forwarding state [ 449.758730][ T6774] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.758844][ T6774] bridge0: port 2(bridge_slave_1) entered forwarding state [ 449.832121][T18319] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 449.860570][T18319] netlink: 'syz.1.3250': attribute type 1 has an invalid length. [ 449.926567][T18324] __nla_validate_parse: 2 callbacks suppressed [ 449.926587][T18324] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3250'. [ 449.979761][T18319] bond3: entered promiscuous mode [ 449.980174][T18319] 8021q: adding VLAN 0 to HW filter on device bond3 [ 450.004396][T18324] bond3: entered allmulticast mode [ 450.156409][T18319] bond3: (slave bridge1): making interface the new active one [ 450.156729][T18319] bridge1: entered promiscuous mode [ 450.156925][T18319] bridge1: entered allmulticast mode [ 450.171057][T18319] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 450.930114][T16804] Bluetooth: hci0: command tx timeout [ 451.075098][T18336] syzkaller0: entered promiscuous mode [ 451.075123][T18336] syzkaller0: entered allmulticast mode [ 451.113675][T18350] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3259'. [ 451.114156][T18350] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3259'. [ 451.115114][T18350] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3259'. [ 456.226455][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.229449][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.305653][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.319027][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.338263][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.357740][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.384713][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.441071][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.443063][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.445733][T18351] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3258'. [ 456.481581][T18351] bridge0: port 2(bridge_slave_1) entered blocking state [ 456.481706][T18351] bridge0: port 2(bridge_slave_1) entered forwarding state [ 456.486830][T18351] 8021q: adding VLAN 0 to HW filter on device bond0 [ 456.638145][T18351] 8021q: adding VLAN 0 to HW filter on device team0 [ 456.674558][T18351] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 456.858348][ T6776] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.858516][ T6776] bridge0: port 1(bridge_slave_0) entered forwarding state [ 463.189420][ C1] sched: DL replenish lagged too much [ 467.740912][T10195] IPVS: ip_vs_send_async error -101 [ 477.900331][T10195] IPVS: ip_vs_send_async error -101 [ 524.301424][T16804] Bluetooth: hci5: command 0x0406 tx timeout [ 531.975573][ T54] Bluetooth: hci2: command 0x0406 tx timeout [ 555.575621][T16804] Bluetooth: hci3: command 0x0406 tx timeout [ 565.694959][ T54] Bluetooth: hci0: command 0x0406 tx timeout [ 596.258560][ T5658] Bluetooth: hci4: command 0x0405 tx timeout [ 619.399116][ T31] INFO: task kworker/u8:3:43 blocked for more than 144 seconds. [ 619.399144][ T31] Not tainted syzkaller #0 [ 619.399155][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 619.399164][ T31] task:kworker/u8:3 state:D stack:21672 pid:43 tgid:43 ppid:2 task_flags:0x4208160 flags:0x00080000 [ 619.399236][ T31] Workqueue: ipv6_addrconf addrconf_dad_work [ 619.399275][ T31] Call Trace: [ 619.399283][ T31] [ 619.399299][ T31] __schedule+0x17dd/0x5830 [ 619.411482][ T31] ? __pfx___schedule+0x10/0x10 [ 619.411529][ T31] ? schedule+0x90/0x2b0 [ 619.411555][ T31] schedule+0x164/0x2b0 [ 619.411579][ T31] schedule_preempt_disabled+0x13/0x30 [ 619.411599][ T31] __mutex_lock+0x7c4/0x15a0 [ 619.411627][ T31] ? __mutex_lock+0x5cd/0x15a0 [ 619.411656][ T31] ? addrconf_dad_work+0x116/0x15c0 [ 619.411683][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 619.411729][ T31] addrconf_dad_work+0x116/0x15c0 [ 619.411763][ T31] ? __pfx_addrconf_dad_work+0x10/0x10 [ 619.411798][ T31] ? rcu_is_watching+0x16/0xb0 [ 619.411833][ T31] ? process_scheduled_works+0x97a/0x1630 [ 619.411863][ T31] process_scheduled_works+0xc3d/0x1630 [ 619.411927][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 619.411965][ T31] ? assign_work+0x3cf/0x5d0 [ 619.412000][ T31] worker_thread+0xa47/0xfb0 [ 619.412046][ T31] ? __kthread_parkme+0x71/0x1f0 [ 619.412077][ T31] kthread+0x38b/0x480 [ 619.412101][ T31] ? __pfx_worker_thread+0x10/0x10 [ 619.412129][ T31] ? __pfx_kthread+0x10/0x10 [ 619.412153][ T31] ret_from_fork+0x514/0xb70 [ 619.412226][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 619.412250][ T31] ? __switch_to+0xc78/0x1410 [ 619.412284][ T31] ? __pfx_kthread+0x10/0x10 [ 619.412309][ T31] ret_from_fork_asm+0x1a/0x30 [ 619.424049][ T31] [ 619.424179][ T31] INFO: task kworker/1:4:5761 blocked for more than 144 seconds. [ 619.424197][ T31] Not tainted syzkaller #0 [ 619.424207][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 619.424216][ T31] task:kworker/1:4 state:D stack:23816 pid:5761 tgid:5761 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 619.424288][ T31] Workqueue: events switchdev_deferred_process_work [ 621.481315][ T31] Call Trace: [ 621.481326][ T31] [ 621.481342][ T31] __schedule+0x17dd/0x5830 [ 621.481394][ T31] ? do_raw_spin_unlock+0xf5/0x200 [ 621.481425][ T31] ? __pfx___schedule+0x10/0x10 [ 621.481456][ T31] ? schedule+0x90/0x2b0 [ 621.481481][ T31] schedule+0x164/0x2b0 [ 621.481505][ T31] schedule_preempt_disabled+0x13/0x30 [ 621.481527][ T31] __mutex_lock+0x7c4/0x15a0 [ 621.481554][ T31] ? __mutex_lock+0x5cd/0x15a0 [ 621.481589][ T31] ? switchdev_deferred_process_work+0xe/0x20 [ 621.481619][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 621.481643][ T31] ? lock_acquire+0x115/0x350 [ 621.481678][ T31] ? rcu_is_watching+0x16/0xb0 [ 621.481708][ T31] ? process_scheduled_works+0x97a/0x1630 [ 621.481739][ T31] switchdev_deferred_process_work+0xe/0x20 [ 621.481763][ T31] process_scheduled_works+0xc3d/0x1630 [ 621.481828][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 621.481865][ T31] ? assign_work+0x3cf/0x5d0 [ 621.481899][ T31] worker_thread+0xa47/0xfb0 [ 621.481945][ T31] ? __kthread_parkme+0x71/0x1f0 [ 621.481977][ T31] kthread+0x38b/0x480 [ 621.482000][ T31] ? __pfx_worker_thread+0x10/0x10 [ 621.482028][ T31] ? __pfx_kthread+0x10/0x10 [ 621.482053][ T31] ret_from_fork+0x514/0xb70 [ 621.482079][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 621.482102][ T31] ? __switch_to+0xc78/0x1410 [ 621.482135][ T31] ? __pfx_kthread+0x10/0x10 [ 621.482160][ T31] ret_from_fork_asm+0x1a/0x30 [ 621.482200][ T31] [ 621.482227][ T31] INFO: task kworker/u8:11:6776 blocked for more than 146 seconds. [ 621.482243][ T31] Not tainted syzkaller #0 [ 621.482253][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 621.482262][ T31] task:kworker/u8:11 state:D stack:23016 pid:6776 tgid:6776 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 621.482321][ T31] Workqueue: events_unbound linkwatch_event [ 621.482349][ T31] Call Trace: [ 621.482355][ T31] [ 621.482367][ T31] __schedule+0x17dd/0x5830 [ 621.482420][ T31] ? __pfx___schedule+0x10/0x10 [ 621.482452][ T31] ? schedule+0x90/0x2b0 [ 621.482476][ T31] schedule+0x164/0x2b0 [ 621.482500][ T31] schedule_preempt_disabled+0x13/0x30 [ 621.482521][ T31] __mutex_lock+0x7c4/0x15a0 [ 621.482548][ T31] ? __mutex_lock+0x5cd/0x15a0 [ 621.482577][ T31] ? linkwatch_event+0xe/0x60 [ 621.482611][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 621.482635][ T31] ? lock_acquire+0x115/0x350 [ 621.482669][ T31] ? rcu_is_watching+0x16/0xb0 [ 621.482700][ T31] ? process_scheduled_works+0x97a/0x1630 [ 621.482729][ T31] linkwatch_event+0xe/0x60 [ 621.482753][ T31] process_scheduled_works+0xc3d/0x1630 [ 621.482817][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 621.482854][ T31] ? assign_work+0x3cf/0x5d0 [ 621.482889][ T31] worker_thread+0xa47/0xfb0 [ 621.482949][ T31] kthread+0x38b/0x480 [ 621.482973][ T31] ? __pfx_worker_thread+0x10/0x10 [ 621.483000][ T31] ? __pfx_kthread+0x10/0x10 [ 621.483025][ T31] ret_from_fork+0x514/0xb70 [ 621.483045][ T31] ? save_fpregs_to_fpstate+0x176/0x200 [ 621.483076][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 621.483098][ T31] ? __switch_to+0xc78/0x1410 [ 621.483132][ T31] ? __pfx_kthread+0x10/0x10 [ 621.483156][ T31] ret_from_fork_asm+0x1a/0x30 [ 621.483196][ T31] [ 621.483280][ T31] INFO: task syz.4.3264:18377 blocked for more than 146 seconds. [ 621.483295][ T31] Not tainted syzkaller #0 [ 621.483305][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 621.483314][ T31] task:syz.4.3264 state:D stack:25640 pid:18377 tgid:18376 ppid:17039 task_flags:0x400140 flags:0x00080002 [ 621.483372][ T31] Call Trace: [ 621.483379][ T31] [ 621.483391][ T31] __schedule+0x17dd/0x5830 [ 621.483445][ T31] ? __pfx___schedule+0x10/0x10 [ 621.483476][ T31] ? schedule+0x90/0x2b0 [ 621.483500][ T31] schedule+0x164/0x2b0 [ 621.483524][ T31] schedule_preempt_disabled+0x13/0x30 [ 621.483544][ T31] __mutex_lock+0x7c4/0x15a0 [ 621.483572][ T31] ? __mutex_lock+0x5cd/0x15a0 [ 621.483608][ T31] ? rtnl_newlink+0xc1d/0x1c30 [ 621.492256][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 621.492301][ T31] ? ns_capable+0x84/0xe0 [ 621.492331][ T31] ? rtnl_nets_add+0x16c/0x300 [ 621.492351][ T31] ? refcount_inc+0x46/0x70 [ 621.492382][ T31] rtnl_newlink+0xc1d/0x1c30 [ 621.492413][ T31] ? kasan_save_free_info+0x40/0x50 [ 621.492438][ T31] ? __pfx_rtnl_newlink+0x10/0x10 [ 621.492456][ T31] ? __netlink_deliver_tap+0x4f1/0x6e0 [ 621.492484][ T31] ? netlink_deliver_tap+0x19c/0x1b0 [ 621.492509][ T31] ? netlink_unicast+0x8c1/0xa80 [ 621.492532][ T31] ? netlink_sendmsg+0x7f0/0xb20 [ 621.492558][ T31] ? sock_sendmsg_nosec+0x14e/0x190 [ 621.492591][ T31] ? ____sys_sendmsg+0x54e/0x850 [ 621.492609][ T31] ? ___sys_sendmsg+0x2a5/0x360 [ 621.492628][ T31] ? __x64_sys_sendmsg+0x1b1/0x290 [ 621.492647][ T31] ? do_syscall_64+0x166/0x520 [ 621.492669][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 621.492731][ T31] ? kasan_quarantine_put+0xbb/0x1f0 [ 621.492765][ T31] ? lockdep_hardirqs_on+0x7b/0x110 [ 621.492792][ T31] ? nlmon_xmit+0xb0/0x100 [ 621.492816][ T31] ? kmem_cache_free+0x182/0x650 [ 621.492852][ T31] ? __lock_acquire+0x747/0x2de0 [ 621.492884][ T31] ? __pfx_hook_capable+0x10/0x10 [ 621.492906][ T31] ? __dev_queue_xmit+0x29b/0x3920 [ 621.492934][ T31] ? __pfx_hook_capable+0x10/0x10 [ 621.492954][ T31] ? lockdep_hardirqs_on+0x7b/0x110