last executing test programs: 6.333431549s ago: executing program 4 (id=20905): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc17}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x1d, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000640)=@gcm_256={{0x304}, "55b2bfe456f65ac5", "94933eabd65daad540f97d075c35dc3d0c5423c36a5a29e09986c18918a9d481", "ea6eda2b", "a3df11c174fa26bb"}, 0x38) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x138) sendmsg$key(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x2, 0xd, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x17, 0x32, 0x20, 0x0, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x15}}}]}, 0x28}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@delqdisc={0x2c, 0x25, 0x400, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0x3, 0x8}, {0xfff2, 0x8}, {0x7, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x7}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x200080c4) 5.639486019s ago: executing program 4 (id=20911): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0x24, r3, 0x1, 0x0, 0x40000, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x51}]}, 0x24}, 0x1, 0x0, 0x0, 0x2004c095}, 0x0) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0xac97, @private2={0xfc, 0x2, '\x00', 0x1}, 0x400}, 0x1c, &(0x7f0000000800)=[{&(0x7f0000000340)="e0487358d364e626387a6d2389bd3fe5aa692793ff3a2b579b7136198f15526512adc38fe8d4c57678830146b72ef6831a6364eaec9b92cbd9824108ef1bc5cc783ce439a6f8687decaa674daeb0b275130226491dcfe61775ed5473d358f3550b63b74ca740771797afb61af600e81371a67043ffa26bcc4d16d3b2ba53aa8facabab70d646106d442a07", 0x8b}, {&(0x7f0000000400)="736c446951522262658548e08cc198d2dcde22d508617ef1caf9458e1013f8e95e5935", 0x23}, {&(0x7f0000000480)="7034ad838b8a66247398bc41d0cd4223c78f0a3429ee507cf6e6002948f379bec46257be0ba86ac6920857553301495313dde57cec9d61cea310f8b6310a1581f8e10ba6186584a3a8e5eb0c40ec5eba65ab0129d895e1f62d1907643d7ee000162e2fa374669b", 0x67}, {&(0x7f0000000500)="b14c33f55831488f48e1a93a909c55", 0xf}, {&(0x7f0000000540)="aae160d591f7e12952982dd1ecfb208c272488854e41ad5c903e92bc18d5e979cae37cb7858495af642027dbb155f709718cd74af3eb53c999ed1abbb3f68d8da15f92ff79f3e7216f4d20b8d3a53551429af8ce442e9f87f11217af70e1579680e223674b3671377c2736d9de4069747286e69082d9b022cab02f7a273fba136faa2524dd2d78d0f3ac4cdeabc3fe699b2988b2148de035e207c734303bdd8cd401d50b666be6478482d56d9fda12b623b1c3b88eee1a5ac6d883da959be9174bfa9b4d99b646d17e1025b5a378c460f1d3f67cb6322d15c4140be87e691a7be6c31635dc16f82efaf648b9b9c6236f061e9a822ebb4f0c07d9d5be8019", 0xfe}, {&(0x7f0000000640)="15dbc3e5b5307ea2a8aa151b3b278c2c50b7f430a9b3b227d4661bf58bd45bbe08fba25fc0debb02c8888f72db60c9c13e3b4f1c6babce29d144b098f13ba272991fd6851f42ee3acf07aad0055b9f3b64ef7ad43f695fa47094d8e7c92850b5a685e46ad6f97909331b06ca35aed0d3651cca5fb4b35ee2e375e58990b67c7799d0045f68f126101e2302d21a94c57727f7cc6554440f80aac642df", 0x9c}, {&(0x7f0000000700)="0f0c6d875580592e4bb6ba8187dacb89388071ac5176d82b718cf85390124757207504e61af373623b53991cad71790bed535c193e64b08c608f231d9e01d1fa96843b67b163b6b99f2a397f803aabea4929e6dec4e74b221d4b733fa0b9f06b627fdc5fe586795ab571a067c6d86f7f", 0x70}, {&(0x7f0000000780)="eea1ca311c1c03774e2613f1599742d2b0d53b50cc17ab770e00e09715481cc2604d61e9b650e4bfb5a97a409d48a13e527d4b0f1f34c437e4c0493d6e97cbca6866cd01ec29cb6b5dfa3f0406809b3a8072b568bbf7d24281d4085650753d2bd32517328ab79bf033", 0x69}], 0x8, &(0x7f0000000880)=[@tclass={{0x14, 0x29, 0x43, 0x40}}], 0x18}}], 0x1, 0x4000000) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="89000000120081ae08060cdc016b3f087f03e3520000000000e2ffca1b1f000000000cc00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120800030004010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000dc0)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20040011}, 0x20004080) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004002000080020"], 0x4c}}, 0x0) 5.142375133s ago: executing program 4 (id=20915): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) (async) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) (async) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000180)=""/111, 0x6f}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18, 0x40080}, 0x4000000) (async) syz_emit_ethernet(0x3e, &(0x7f0000000700)={@broadcast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast}, @time_exceeded={0x21, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast2, @rand_addr=0xe0000000}}}}}}, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009000000000008000b"], 0x54}}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) (async) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000000003000c0000000c00000002000000000000000000000400ffff000000b8f6d2ddc2aebb25f05acb7690d4b98b89f174afbd2b8fd949cf7887eeec2dadfcf844f4db54d37127947bcd5137d81bfcfd0b1df82d24250874212faac7063a504d0f79f8934fa2d37c30b75d3c2dfdb9c1248a8e83a8"], 0x0, 0x26, 0x0, 0x1}, 0x28) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0xf0, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@local, @in6=@mcast1, 0x1, 0x4, 0x4e23, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in=@loopback, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0x2, 0x0, 0xfd, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0xc801}, 0x10) syz_emit_ethernet(0x68, &(0x7f0000000140)={@link_local, @dev, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x8, 0x5a, 0x67, 0x0, 0x5, 0x2f, 0x0, @local, @multicast1}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x1, [0x7]}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x0, {{0x5, 0x1, 0x7, 0x3, 0x0, 0x0, 0x6, 0xb}, 0x1, {0x38}}}, {0x8, 0x22eb, 0x800004, {{0x3, 0x2, 0x6, 0x1, 0x0, 0x1, 0x3, 0x6}, 0x2, {0x7, 0x4, 0x0, 0x5, 0x1, 0x1, 0x2}}}}}}}}, 0x0) (async) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=@migrate={0xa0, 0x29, 0x1, 0x0, 0x4, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private2={0xfc, 0x2, '\x00', 0xff}, 0x0, 0x5, 0x0, 0x2, 0xa, 0x0, 0x0, 0xff}, 0x6e6bbf}, [@migrate={0x50, 0x11, [{@in6=@local, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x4}, 0x32, 0x4, 0x0, 0x3504, 0xa, 0x2}]}]}, 0xa0}}, 0x0) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r5, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r7, 0x4) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@map=r1, 0x1, 0x1, 0x4, &(0x7f0000000380)=[0x0, 0x0], 0x2, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, r4, 0x25, 0x2, @val=@tcx={@void, @value=r1, @void, @void, r8}}, 0x1c) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) recvmmsg(r0, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c40)=""/216, 0xd8}, 0x10001}], 0x2, 0x40010000, 0x0) 4.683709956s ago: executing program 4 (id=20919): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newtaction={0x74, 0x30, 0x1, 0x0, 0xfffffffe, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x0, 0xffffff7f}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8848}, @TCA_MPLS_TC={0x5, 0x6, 0x3}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) 4.356994374s ago: executing program 4 (id=20921): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x33, &(0x7f00000a2000)={0x1, &(0x7f0000000200)=[{0x94}]}, 0x10) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x5c, 0xb, 0x6, 0x1, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x18}]}]}, 0x5c}}, 0x0) r2 = openat$nci(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000000040)=0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0xa, 0x3032, 0xffffffffffffffff, 0xe08b8000) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000000), r4) sendmsg$NFC_CMD_DEV_UP(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r3], 0x1c}}, 0x0) setsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000840)="aaccde331e12fce0e85af820ca4048a191fff5161a766195bf859079144a42bfe621f57f62974e9a425952ca148f282d27d08f547ecdcef3645eabe5869f66badc8ddb73703b100c8c7b4f0cb0e3f4ebe0d99e931a608fc3a25829d28c8e80b3b2d1fdc5d90bffd584b3f534f2b75ce8e1dc7ef8db62d18b8356f96441cedbb08f1de568a9e5f48011de64f0c581c2d06a6a4c5824af896947e430e65361e465ced693f1586d720cb9f746e97ce9612b9e5100d686aa93de6cb57b28b4b0863fa1d65050c10290c55d7acf650d8c0382f7920108437f24be127872d275439d4987a8ab95a687261b0db87151f2223df1ae09c1f27ff1404a0bdb95ca400296139acbaaf1943c7b22600dd90491863c308f394ba7c8db56fd52cbfd1e0572723ceb2f7d2e7d7570a093a8910fd7b8abb72b78703cb328163237c829828ee22d7fb2d827d54a46e667e921728261bb15e5322c2ce0d84329c8601a79e2742b3c391e6547500ebb58ca00cd12e30b2e0704107deeed04b54a5dd4d21d179853dfc7e9809f5f2e21968e3362e66fd5f510a1454fb19aa84fff6d0b905dafeca5a0916ff0c0dfe6ab55765cf59c64a186d9e28fe912c46f6d655c18165cd36febd180ec29893e9b3c5125424ba70a5241c1b443ca519c7543f9146ae63a0cfe13cfd8fae5e1664205d76c7fe0b216eb518a3758e0b4e6466df57e0b4b6e0a95356ef842fc9a49e8f9696b87e531d133ff3b1402aca14df18b6e321b38d1b589f574ad8ef5cdfa08478ad564a79fdb8eb476fce9cde1650dbe4a3605e0c22d99e273f054387368c80bb19c709e94c47a26c499a91ccbaa70f826bfb7d818ce8d67c3c0b2105f4bf3d5231222583b4422bccdce39137c61c67050184f9046272e4eeeee2505fd508552508db6269d32a6c181079878d41e2cfd14faecde476d0e3bafed2e21c321d6b85b8ce95b9c0d93e090816b0d83db40766ef8ce86c829f221398cb48cafeccf6e42ea0f0e4a4f8bcbd3b25d6b2264a06cc8d47c3bb0e9d82df250d22833fa826ac30bf3cfd7008ec0e43a42473e0616cc6f1e50afc60577d0b7590decd20d54b97aae755134eaf4f7610d4942d220f37bd8d621020ee581ba3edceb53fc62508150ccacea9ddf428c776c4090fd10792d059d4ed67a141f2bfefda5956387ec34da57ef7731b450d7d421f9162bf25a0956bd780568d4c710395f65530d60e6ec1a87cc90ddaa54ca9853f9fdb8282749d376de207740b694f9b9fdb641f9d63710e4c0e1a01ddfd90519669641b0799b848755e0a92b14d34034dfbf4e1f641264fd1b5f61a9282420e2195b029c650081bba7623d1039d01aafe6b35d929698406fc5e16ad457fa254909a27ab3a21acc16bc2d25e3a36a92bc32fcca508636fafb3663aa85dfe9cf38a084c3db4a82d8ce9b507fc3a52f52532a032624b16b42cb14ed14678b51b246431fb0417bb91593c5d225a3d6c5784d36d3806d5d44a11a22c80c6027426f81a73cef72a54996bbb2e6f79cf21265725121f74015509a857d00ec6666a96357de597baaf5e2b2e6a35e81c7e9becf161d945f13ecc375dda2a9d79cd402253c0b06a1feeb551e36c09e4666a0c8782648c6f8c16fb11f381d7dfb05f52c90e386de1c4fb8216e16c5820e3a0053c95952daff0abc2a37f526eaa42351d96dea50aa6abf178bd21cd6342def10ece4d3f379a7f5718912a414e2a65fcd079f53c262142402e7b090000c08982246e84b4f07f3ff06f2a7833d595fcca424712a35071bf74d9b30e7da7ed0b9c18fd6fd5964a69994a50ec12a375e13a436b1be60aede679a20641052dd160789c5dd66d3f30c7fb0bea325a10f22b06fa977d6b8583721da25191d55d2b2e58e1a9342aadb3772dd68548a8b8ae6855dd74da8ba8f280d0c846feb35430564361d037043b067cf646f912838d74875bf4acc1858f0b5528ec49996dfb18f585712df108f0868f1803c21cb215d7d89f31834b8b746d672ee754e6d0e98921a31f42a3578ea66098393795d8df6365e11d475c26f7dcc591312e7b0fb8fbf6b348b38d23e5e0b51ab32129eadb4de82baa83fddd1aca1ce3e45fff0c48c235df3c7c09c0a045ceb5b13cb7171a02ae871285f4fe291b86c9a8b7afd63e785749fe55951ea83267f09b2994c473c27f9dde271ef595b000b9a1561b624674898e4bee69771be4075ffdb8f2af2bcb16e01ae0fe7084da7ae9a7dd46053c6f2c51b0166aad383a9be58d5214f81005791ce5d5234c66db781f4b537efda0a4e8cb4af2a78abe1b4d9794e5084d849ab91b5e9644690f3f2e288790256fa5d7b1f3b389802ebd95e129730dfbb5fec11b79ac694864d7f7a0e3a17f8d4b118fa6f9c588b86daae87ecc388facb6dfbfef8c4944b098ff4955beb35791cbb0fbe201de1eb9356cf91b91d89f08a59d22b936d5ac743d9df5df6a6ca69d23cf31a7f4b32cf88a4c96d107f5d7d1d6ec092198a84aa477b2654150dc92990f380db2a3c3a81b129e19b7496d280a0e7070bd64d0dcfa9fc55423e0adccf6f80742b37e6c1b5656800517295acb97598cbc7169f8312a8fa86e2435cb06b8f36fa54d4b4eafa5eeefc4cada0410012b9b39297ea8c2c9bb1ee7af75989bcfccd52ba1920a55bac986c074b2603776127391ef2c3666e8b268a484ff9de5fa261ef503457925038399c73a3a02c9fa3661c0deac9b30e515b23fb3838b04d358e12d19fd22e083e6184f157768fa1835f989e5746e900451602bb937132732f0f735f3516c7058ebaf6c3f9cb7d5db1f404857e6be9fa44830b211f7eb61fcf3be92a82a64c6b564c42d1dd33c8958a30ba7d0e977feb86cf7a3b5c85ceca8bb600dac30db4b92332e22fd7a88627b6872adeedffb1fdf12ff63baf877e827b2fa7733f6286df0e0707a6ee711d7a7c245ff7e5e0269f86110ace8fb7959d7e01bc28bbdd60201cad57723d562821dc3061e3c5fc1439ddf0a668e7381a3f64fa3e27327c43de171ed76d84aaf2d50338f54b98fb9294b4089877a16187b99bc970d102b1a9fde04967ff482a8908515e135d52e366795986e04b0d20758cf26a59e228eb2f5de1d504e1530d5900ce36e6a4a0fd2462ceac1806e60dae7f7c8ead2453077161ac26cadc35e1c1b64c79ba04151f7b0e9582acd94c72cdd4580e6f23c0b603ece51ee21eb94f5d727fbc4da1c5493ad3b8d6c6500bf52b9d47a32a2a19672206c5355667fee57f9a3887b5f99f5858be4917c73d1b0d22a3e2c5464afcceeb4454c0c0af58387709dc4d5a3be09a2acab9ee65fe4cb8daf0b7703fde4218b0af434f7e1a4eed34b30b3e93d5b23f88a89c42016d80077fb9155c0b8b1fff7ec562bf8b1affbab9ba276c0515753f4cedda6c6116786079625678642d325ab0f7fdb4590b0d4e1afd526691867186c351f8672caa5cf895183f4cb2e7123cdec56755d28eeb4f218846a6fdf0cdb518cb0fcf4ffc3addca55ce20f0ffc44558d1fa3ab3642dea840fa6b5ac9fe7b975fd88376e1ad6134164183bcaef5ca76fb34832f54f797912713a751b59ed73c4554709191a56699d9201918dec73f35179353dc71ec79b96affcdf4181710368671cc8f0e9d83159afa9abe7ea10675de6783fdbc009986bd397e74ac4b6e5c82fc860e2e02e0f574744c678dde12d058116fbbf4232154e642072ed4d76c103377ebe8bdba01db8c0690c1957e267f9abdb7e72d916062e36413f3bf98bd0fc70f558fa3aa27d3d35e9cedf4578fb1f5af5e1124f8796dbf586b56f4a0d58f936080883e9c2a2eb99ff0f8e4c64d2a6e0ff50d96a01851a7248a02f78e42676bbb50dbdbac7068e858285cd306c10932feae73dd4a62db2ce8ec36c88fa57da0cd993b255c5b5a420d91787af5191b75646ef36b6445f1b92c22b991dd2c320c839287d0270ee0505dc945844451cd0a52a4ceb6d28af6a6cc9e7352ee997551f254e43ae2c761a133daa049589e264148ee7a425cb9ae8a52864b0fc0a8b75f36825182833d66dc3e1060b0b7ab9d2ae4daa7e9c308c82d70491673d261c00be57dc4ccb385db395084b9c07b498c8c96cd5258ac020b7f0471e06b9b03b2542c2a2bc8de638aa11fc888a37c876155131b50853721a871a834409bfdfa3c5d9485ae05f0861869365c594b162be083d868722d2d6f655f7d793e4418bec7b422300be5a71813f30cf542c4f7762ecd97a4128bc7580c1b5f1879b4370b9fe6d9c4bfdb5351f8f0846f2f09fe3aa4ed8c1329ebfa3e0b2f6866a9df93514e3b0bd739a93afda775bde7512ab5ab089881d0cb7695291774cabd98425f95ee8e0747a48254af205388db9e6fa734269505ad8b27098b085c1c8ea4aec4efedfed4bfc027a390cfe00e1f3530ca3793ebd265e7592a14548a839fd60f87e3f0f19b767c5d406cd1f8369927edb30779536fb1ffb1466ce0daf754acd0d0a1c00e4915dbffebc19cf619c2f0916200e229e819d63c526510b41f8474c401d90a6deb114953763ca62cbe0fb22ebede524dbd4089d127556c6a60553120a7365f586fb1162c2ef8fb7bf04f1eac7a8849756c195d9d4609fb7816f0b4db81f74d3e132757bcb3ab2b6ab83d0cd133e8f13f34faf9b844b111415beb63cfef8dce157e0451b61628e79b10615b601ccdbf5e20097dd9b19c94dbffc0eedf7d2d06c3f95dbc77e70e016f9d17909f1358d8ed2c7b14eee53fdc093fbfa42e0514e4e42e30d2d78253dd15fd850999b7d055526dc82b346d9559fc12c7a1026d0c44277e6a361e580a74b243c9141a6154fe43966a3d4ed84703ae86a9ec068738697ba843fcd278a80e14a5a79df56f06f318ecc36828a98a4bff8c64d2b13a196018bc39ac5969c9315ed480352c7faef3ff3892fb0c5c3e6a1665d48384807eea37bb821d3d57028eccff2a25ac7a33b2e615c219c23e2a780fedd0aaa9b02cec65af87e22c00c0bb1b409fa42152f35c504963bc8eee5c1cd39f08d90adb603695c4e300ea4e6d1a47adb52679fbc001967de0217f258b8865145ea5642ed471e18e3bef14e1d58f91d14285d655abea9e680be973cff319508816cbc79aa34fb2a1ec467840de2060786ec99258ba026107582cdd058d83457ca764aceb060b612997716622151b07e363e266ad7594c60849d0db377f7f3f6fec1b63b04fd2f59b3aec81fe08aa8c7a1509933aadcd6f29236b066d81041aa34a5652e55cf5c7d8bceb1bc9796a5a0eb1a5acf8ddf5327e9382c67dce43c4eeaa9fbd1060909f75b4e04b693e26a0bf8dc2469c09c249e9bb33539a47dd86119bfaf64e4a320c0be1b1f583db2091c2ee720caa9256c48f75c434911184ca9fb563a60a6d51476182c722cb9488dae3412787e92dbdf3e64eb4283fbad78aacdee5ddb04b187157941c507810f778a4230b2ffc7859ddfadbc9352eed4da692861e17dda2d9fdb5cfc89d2eeb5dc19d94e80fb09be274ad9b949b39522f8c4bdc3ea92026cf7065591e32f5fd28a3a6c807716a9a542b6aa76132f2b6f11ac8c2336f93a4398e23b4b1b7d948ef1c47007b2ecc892cff60b029d1c1ca11ea4c1e431eb81f91ebaffc0aed6a3a96f19fbcd40e234aaf639003e158b113758d11bfc402a93cf573acb4a1ead0e270979df2c4f1021eb436f9a2f3c8927cdcad4aab84597f05856a8dd69dbbfb985c832dbf8159fd31632edf741a6b8fcfcabcf6959fac161aab02fe3bdf2e0dd260695ac4e1e354fe5c99ea6", 0x1000) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000000), r6) sendmsg$NLBL_CALIPSO_C_LIST(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NLBL_CALIPSO_C_LISTALL(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, r7, 0x300, 0x70bd27, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x1c040}, 0x4091) 4.000997528s ago: executing program 1 (id=20925): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async, rerun: 32) r2 = socket$kcm(0x2, 0xa, 0x2) (rerun: 32) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) (async, rerun: 32) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f0000000040)) (async, rerun: 32) write$tun(r1, &(0x7f0000000680)={@val={0x0, 0x890d}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @val={@void, {0x8100, 0x0, 0x0, 0x22}}, {@ipv4={0x800, @tipc={{0x5, 0x4, 0x1, 0x2a, 0x40, 0x65, 0x0, 0x7, 0x6, 0x0, @private=0xa010100, @loopback}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x1, 0x1, 0xb, 0x1, 0x2, 0x9000, 0x0, 0x0, 0x4, 0x4, 0x1, 0x6, 0xf5, 0x2, 0x4e23, 0x4e21}, 0x1}}, 0x2}}}}}}}}, 0x56) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=@newlink={0x40, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x88a8}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_SPORT={0x6}]}}}]}, 0x40}}, 0x0) 3.598266406s ago: executing program 0 (id=20926): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="1400000010000100000000000000000001f5ff0a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000000070000000060a010400000000000000000100000008000b400000000048000480440001800b000100657874686472000034000280080001400000000c080003400000000008000440000000220500020007000000080006400000000308000540000000000900010073797a300000000020000000030a010300000000000000000a0000020900030073797a300000000044010000080a01080000000000000000010000073a00074032e97608c07b8f34d704cc507d07a8d4c429672a9b6841e516ce194f03354b3c46a930469ce36ee8391a02352a70d543c633dc17a9d300007900074012119f33dbd27dbba871f33b8206fc0a59dac6df96baf86f3deffa20b8a2b13fa2fbc917a33ad4b9dc903553ff1e7533cd9d1e3f6a3248b10a63552977fab38d9ad7409cbd223b094a0bb6f0884c8839890d122f9b9963668c97749b2304852a8d461ccc39dc307f41ac41688a4f2d64a916dc532d00000008000a40000000000900010073797a30000000000900020073797a31"], 0x248}}, 0x0) 3.565062071s ago: executing program 2 (id=20927): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r3, @ANYRESDEC=r1], 0x3c}}, 0x40000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000001c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x72, r3}) (async) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r3}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r3], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 3.377319229s ago: executing program 0 (id=20929): r0 = socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000003000000000400000073019b00000000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000001c00)={0x2, &(0x7f0000000180)=[{0x84}, {0x6}]}, 0x10) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000200)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4a8, 0x248, 0xf8, 0x248, 0x1b0, 0x0, 0x410, 0x410, 0x410, 0x410, 0x410, 0x6, &(0x7f0000000080), {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@socket0={{0x20}}, @common=@set={{0x40}, {{0x2, [0x5, 0x4, 0x3, 0x9, 0x0, 0x2], 0x3, 0x7}}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x4, 0x42}}}, {{@uncond, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x8}}}}, {{@ip={@rand_addr=0x64010101, @remote, 0xff, 0xffffffff, 'vcan0\x00', 'veth0_macvtap\x00', {}, {}, 0x6c, 0x3, 0x42}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0xff, 0x3}}}, {{@ip={@local, @broadcast, 0xffffff00, 0xffffff00, 'lo\x00', 'erspan0\x00', {0xff}, {0xff}, 0x2, 0x3, 0x54}, 0x0, 0x90, 0xb8, 0x0, {}, [@common=@socket0={{0x20}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x8, 0x1}}}, {{@uncond, 0x0, 0xe8, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @common=@osf={{0x50}, {'syz0\x00', 0x0, 0x1, 0x0, 0x2}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x0, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x508) 3.097637587s ago: executing program 0 (id=20930): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd26, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0xfffd, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20000000007, 0xfffffffffffffffb}, {0x0, 0x0, 0x0, 0xfffffffffffffffe}}}, 0xb8}}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001500010000000000feffffffe00000020000000000000000000000000000000000000000000000000000000000000000000000000a00102000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000000000000008001000000000000000000000000000000000000000000000900000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000e58e6d579f4e1d2400000000000000b56b6e000000000000000000"], 0xb8}}, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x4, 0x0) 3.025419032s ago: executing program 0 (id=20931): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="110000001000ffffff97f4ffffff0000000097000000", 0x16) 2.878247672s ago: executing program 0 (id=20932): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) 2.663898673s ago: executing program 2 (id=20934): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0xe0, 0x6, 0xa, 0x401, 0x0, 0x0, {}, [@NFTA_RULE_USERDATA={0xb6, 0x7, 0x1, 0x0, "681584d4276047d5dc330e38a29125e080128faf6f28e9832e00ba34d92549d30f6ddb6b73ea413936808e131fc966c92d29f2b75261f195b3c4c9018ffe4713a0ac7d7745c0ab2e5805197aa6d68660c89553665c35672b769902d65125cab6f842f57ab95059db6212e739bdcd8b2024d8228393e5d58a6c25fb14aa21d97ff7bfb9a8c6e019f265c1795d426df3a349d8d36bf00a7812be0d1b5a7f81d172221994069382140a4983d0af24ddf533fbf9"}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x154}, 0x1, 0x0, 0x0, 0x480c0}, 0x0) socketpair(0x1, 0x80000, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000040a0000040000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) r3 = socket(0x10, 0x3, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r4, &(0x7f00000000c0), 0x10) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d", 0x24}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000a00)=ANY=[@ANYBLOB="05000000800800"/16, @ANYRES64, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="23ee6ef7cc4a04767a46243354a213f69ccabd73ec544f8a2756bf03d4a07df0d00ff4"], 0x80}}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="07000000a008"], 0x80}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1400000152009cb1dedafcdda5d8c8f70a000000"], 0x14}}, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001c00)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000129408130bc053e68f"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x2}, 0x38) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000090000017b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000440)='GPL\x00', 0x3, 0x0, 0x0, 0x61800, 0x30, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r3}, 0x8) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0x32600) pipe(&(0x7f0000000400)={0xffffffffffffffff}) sendmsg$nl_route(r3, &(0x7f0000000640)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2c0000005800080029bd7000fcdb9f250008000300", @ANYRES32, @ANYBLOB="08000300", @ANYRES32, @ANYBLOB="08000300", @ANYRES32=r9, @ANYBLOB='\x00\x00\x00'], 0x2c}, 0x1, 0x0, 0x0, 0x805}, 0x80) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="9feb0100180000000000000074000000740000000200000008000000060000850d0000000100000003000000030000000000000005000000055e0236020000000200000003000000ff0100000d0000000300000064410000070000000000000008000000000000000100000d000000000000000003000000010000000000000b00"/142], 0x0, 0x8e, 0x0, 0xa}, 0x28) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000003c0)={r2}, 0x4) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0xfffffe4c, &(0x7f0000000180)={0x0, 0xb8}}, 0x0) 2.375278637s ago: executing program 2 (id=20937): r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x9, @private0={0xfc, 0x0, '\x00', 0x1}, 0xff}, 0x1c) 2.252990893s ago: executing program 3 (id=20938): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x10) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) bind$tipc(r1, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r3, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000180)=""/197, 0xc5}, {&(0x7f0000000280)=""/138, 0x8a}, {&(0x7f0000000040)=""/223, 0xdf}, {&(0x7f0000000440)=""/56, 0x38}, {&(0x7f0000000500)=""/174, 0xae}, {&(0x7f00000005c0)=""/4072, 0xfe8}], 0x6}, 0x2}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0xfffffaed}], 0x7, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYRESDEC=r2, @ANYRESHEX=r2, @ANYRES32, @ANYBLOB="002b0f2a16bd65568beec4d3"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r7, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x22, &(0x7f0000000580)=@raw=[@generic={0xa, 0x5, 0x9, 0x9, 0x8}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r8}}, @printk={@x, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}, @cb_func={0x18, 0x1, 0x4, 0x0, 0xfffffffffffffffa}, @call={0x85, 0x0, 0x0, 0x5e}, @exit, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x38ae}}], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x3c}}, 0x0) socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xc, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="b4000000010000006600000000000000730135000000000095000000000000004bb5eea0a6ec9fcd4b0a008a8443f22702000000e63bde9e4a0587536a966992ae7011d6e6c03175717e9912e0dd1a59541f7cbb1548ee5bd627f5b0b8ec77bd6d5f7b543f9aafaabe53339b12fbbe7decc4aa61b8aad0759083bdd61543fbeee8d560bb4b5925fae801f4c91e31674b124a1b38000000bc4da4a9b3d5cc9e0000f6a7a729009973ff07000000000000ac79e5d84abbec7d96629490727375b853f6308a980fba61fbe0131f3c7a026d8f000008000000000000000b20d7ac2df89d7989bf53bec908213d396edf24e9fc3cc004a1097fddc65c1b1b328277ff85ed56b9261eb7bcee28ec2d3616689ab3f31f849eebce6f21e6302003c0467844e000000000db0700bd694a09b253a1c6c7c138b3ec6ee9b83edcc55d3403acd5c50e27401aa306a7ab7069790da79b7ab45184caffff00009bab066bf7a4ab148d44c7e2e4d219cdd7ebeb51511d9df85a648b1b85f93cb6cd21f93d5ea3da2b31657c065d052d9b9ee00320def97ebac25b929b3c15e33be6e7d54e622b427ee8d181d2f18d772fb5c58a936620ba1f5fbb48703ab220f442697edc165b449db2e3c221fbf270a6db414516949b97c200000096a1cbe81a38a23f03bd741a3e60c2e294f828e06f1b2cb70328f151f949e369efed52a28b87aae9d7d2800c8efe7f93c05adc9086d3f143a7b87d06838c6525cafdc01820a8912a131ff1f6acb9439f2d95a746291641b38333ce1c33edc9da00c8a2b42e8adfeff69fce7a35f79748e3e5b235269310988a05bf7c4e4cef3d1aa550c83d6328eb000000044a6458c31431d58973c93f5e9452258a7098bc3d014afe638a40948498faa261213bc20845526e054d6b3ba5ca8f357df67c41acc28edacb31d38994544c3511ea1e8a448e66039425cfb03efb5d5eb81a306746adb8809ef9691863c00085e2dc401325327e54cbfceb400c2663466cd4a79c94b62c9882626499a8a29c564464f2a7aee6a929f831c93d23005787d272b5eaf0c6e11a7f0f1f39f68df44f6bf2ebe448cbe850efd24bf7b96ad33abbd3a8b5814b5e7f85d1a47ee604ccef20bda53c9ce06910568fc200eee12fc6ef2734a6e9af5132f0c507e277fd97f9b48c840697289d38e454467f4d2f94b2f76d06edd083dafefd76deb251b5818de9c27d0df6e7b8862fe42f6c453f551f35b6d76395a1d205f276ae628fbdb8081905a1d7c2805532d3387b88f2997e8ce41c5dca83659cfb7f3a1c7b2bec8a7575dc4241dde6c680ee9a27b197739f4ad86f3bad3e42d4954bef864586ad02c27858d63efc495bcfb6e30f30fedf536d63769a196fc3b472195d0a1a13ecf803136d751cefb0edb5794cab8681214b39f86d88f3aebea4d465ef05f975b09f264d6c8d8e3bb6ea7d21c6602bcc8f76f2546cccc074f55c22aa8b502968040000000000000047c8a50036dd268a1aeff951f5090492b5e941feb1d3785aafe1655876e5a36c40fb5afcfd1eb28952662782097836a4d1aa3de0c06bb7dc27cf1a546b6aa6ce9932f3c6a013bc3791da4d8a33680ba8f1334d75a43e991ebd4582d786ec05cdd3152d52ab15fc7595cbd339f730d2ec8e37e6c500c4c30280a6af986f62a22d9c5c275e7798c165545abfcd304243274db15924a136a0896d56576ed5de90b1bda90f4024b9a0b3b33f688db8e38f784ae3942aba874f95d10c47e2405ceb0438cc272133fac718a6553710e4ca97df646b21d03652c54eade2e99344e11a2671cf274d397650fba8fcfb7e51a926e37b3980a1732111175dd99b9d979042b3ea411a7b4f9081ae9b82974d5eb6fd4e4bcd95e4f897dfba4e44777e6d02a896b650a66d9139696b9c6c36a33eb3adc092bf4586bfab34002f802bbfe6a7679cec20cc25e01f129bbe92a65961fac7bffa3d8feda2ac927743d2bce57ee39b671948576337535180aa754e035421cf1709bc1b5e46c35515fb1fcda637a6405e9b216d2ca09795c5d2f27665da5b17bcf0f387e6dd58202a3a1148e46e55ac7ea027eb3022eee4a000ca543ab566921e5db4f741a71dc202c851d99851bc7a62ea705f942855a9fa30b912045f78ab1e3fdeada84bc8ac36cc1223901e56f6ecbabbc3263098c9c47a1f505a8299b5715a455e834ddddc430f387cafa07bf915522f9a42e34eea51692c90320e892d27924045bcf56135684ca96ada82749371d5766c0d0cae8772f140eef001ca39dc28743f77b8724487a9b37ca66d20aef8a5236393fce29b0531cbd3265c209761ed41a2e473fbd84ca9b67e3ceb58a4b774ee127628faba8702c0a73f8311d269429aaadf74c439404fc9f864e69807dfe2bae2bd4c498a10d4e17dddb1f7539bfeb392e22e7b93d0ecf66cd253a4062bbc8a4307f0e4360651dc7f8924ee7a89ab73dd7c11be13707482c369f02d7b6f242599f95dbfcb55bea158665231f8fe04ed2a8c407fed1a8702e2486386f2ae6347231128be789186ff5651208c8b781f85d3fb51bd28b939a8bc88a471c36fa17fd04c3fbdbd3f7bf144b1466014a77c582aa0380e612cd101d557dd1e5b7bae3da3ea2659f66a3641eaa3b008b978e0a5f69671f52401892dba8a63c8f7eb280880dbdcee5d8e8aae9de9d28cbe0de2f4642c4fe69db3b7432b2eb7ca282fbfe030ad6c33a73feef1cd517cedc2c0059e5636ae0fb3969ce7f64c6f4cffcc40ac1331f6b50d4f95c490edd75e8cdba278a602c8a200000000000000000000000091b39eb79b22cc68dde3760f3bd7377b35f4d41a46959070cddc4a9c340455f97ff0ea8c6adbff47a39269b2e90dffa1ec22d41f9da01ec44847a88334e106ff455f9ca2a0b2900591ceac1f0e823eaa7ed5b359eed1a39a6f75e7556ab52ac0c2c46b28f3791edf8f25cc2e6cab30841d3fac1e16443be84d4e9a903df3901f89e13cee8589df43652fbe05a789881dcae97ffdc52363bc61c334480afac09e04f9e5ce0bcd12c997545053b64bb2ba920a1071d2ca692c72965bdc0022f7f147943001a55ed8c7b3181fbfabd2069ac7bd4f9b459463edb8a05d1fde9a0000000000f4304ef01fb54b38377b030f2a0fb38bf286249b0cd112d9d8a3b3d97834e3a1a43008cb3abe4ecf4edb6b46ae11ce456dd5af00b5bfa294de78bd1b52856d6831286f32af84a659e67ae7cf2f4a669770944f50ae3d7a5718adb492cef3221fbd8af33c0d5dd034a5f066c15cf9"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x21e, 0x10, &(0x7f00000002c0), 0xfffffe9e}, 0x48) sendmsg$nl_route(r4, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000a80)=ANY=[@ANYBLOB="3400000011000500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001400030062617461647630"], 0x34}}, 0x0) 1.977491474s ago: executing program 1 (id=20939): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e23, @broadcast}}, 0x8, 0x5, 0x8, 0x1, 0x3}, &(0x7f0000000380)=0x98) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000400)={0x3ff, 0x0, 0x7, 0x2, r2}, 0x10) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000140)={0x0, 0x6, 0xffff}, 0x8) 1.965054281s ago: executing program 3 (id=20940): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newtaction={0x74, 0x30, 0x1, 0x0, 0xfffffffe, {}, [{0x60, 0x1, [@m_mpls={0x5c, 0x1, 0x0, 0x0, {{0x9}, {0x30, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x0, 0xffffffef}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x8848}, @TCA_MPLS_TC={0x5, 0x6, 0x3}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) 1.905390649s ago: executing program 1 (id=20941): syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@multicast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f4adf7", 0x18, 0x2c, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, @mcast2, {[@hopopts={0x3c}, @dstopts={0x62}], @echo_reply}}}}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, 0x0, &(0x7f0000000100)) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) unshare(0x20000400) bpf$MAP_CREATE(0x15, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r2) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000280)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x5, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_EDITDEST(r3, 0x0, 0x489, &(0x7f0000000200)={{0x84, @dev={0xac, 0x14, 0x14, 0x37}, 0x4e1d, 0x3, 'fo\x00', 0x0, 0x60000000, 0xd}, {@rand_addr=0x64010102, 0x4e23, 0x1, 0x5, 0xffffffff, 0x36}}, 0x44) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRES8=0x0, @ANYRESOCT=r3, @ANYRES16=0x0, @ANYRES8=r2, @ANYRES8=0x0], 0x44}, 0x1, 0x1000000}, 0x20044040) 1.773676634s ago: executing program 3 (id=20942): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001800010000000007000000000a80000000030006000000001400070000000000000000000000000000000001"], 0x38}, 0x1, 0x0, 0x0, 0x404c000}, 0x0) 1.711376171s ago: executing program 3 (id=20943): r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x10c04}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x2404c050) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff120000008000000000000000", @ANYRES32=0x0, @ANYBLOB='H\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB="140012800b000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0x240440d1}, 0x40000) 1.582089384s ago: executing program 3 (id=20944): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) r2 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0xc0, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x138) r3 = socket$inet_icmp(0x2, 0x2, 0x1) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000001180)="5500000018007f5f00fe01b2a4a2809302060000ff00f005020500130a0007003500281014000000190005407f0a006d0004000000d54404009b84136ef75afb83de4411001600c43ab82200000000f2ff00000000", 0x55}], 0x1}, 0x4000) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x4, 0x4, 0x3e8, 0x200, 0x200, 0x300, 0x300, 0x300, 0x300, 0x4, 0x0, {[{{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local={0x2}}, {@mac}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bridge0\x00', 'erspan0\x00'}, 0xc0, 0x100}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x2, 0x4}}}, {{@uncond, 0xc0, 0x100}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x2}}}, {{@arp={@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@link_local}, {@mac=@multicast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_vlan\x00', 'ipvlan1\x00'}, 0xc0, 0x100}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x2, 0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000056000100000000000000000007020000", @ANYRES32, @ANYBLOB="200001"], 0x38}}, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) syz_genetlink_get_family_id$nl80211(&(0x7f0000001140), r0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080010000000e8fe55a1180015000600142603600e12050021", 0x2b}], 0x1}, 0x8000) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0xfe33) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000015c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRESHEX=r1, @ANYRES32=r0], 0x74}, 0x1, 0x0, 0x0, 0x240008a0}, 0x4000) 1.117607516s ago: executing program 0 (id=20945): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000004c0)={'vcan0\x00', 0x0}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x3, &(0x7f0000000000)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x101}, 0x94) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r5, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r4, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r7 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) bind$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x1000, @none, 0x6000, 0x2}, 0xe) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000019c0)={&(0x7f0000000540)=ANY=[@ANYRES32=r0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="4100f60001000000000000000001"], 0x80}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}}, 0x0) r10 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000001900599c6d0eab070004000523"], 0xfe33) r11 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r11, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r12}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) socket$inet6(0xa, 0x800, 0x7) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r11, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x4000810) 1.117170973s ago: executing program 3 (id=20946): sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="20040000f40310002bbd7000fddbdf25050000000000000028000000ffff000008000000000000000e0000000500000001040000fcf70000c7000000ac000000030000000d00000001000000390000000200000009000000ffffff7fea5500000700000001040000f20000000400000003000000070000000d000000000000000100000003000000030000000900000002000000050000000100000000000000040000007f00000000000000000400000100000001000000ff7f0000070000000300000001000000010000000b00000000000000080000000500000008000000010400000d000000000800000100000003000000010100000000000003000000070000000000000008000000a50c0000d00600000000000002000000090000000500000008000000090000000080000006000000c600000008000000020000000e000000ff7f0000d5b60000af23000020000000070000005800000005000000ffffffff04000000000100007f000000060000000800000003000000170c000000000000020000000300000005000000ff0700000800000009000000b485000008000000ffff0000060000000200000000100000060000000000000003000000a306000002000003000000000600000005000000bb00000001000000020000000100000000000100008000020100000006000000001000000500000007000000020000000f0000000400000004000000080000007f00000080000000010000000200000001000000070000000200000001000000fdfffffffeffffff030000000101000001000000faffffff0300000003000000fdffffff00080000020000000c00000008000000000000008dfb44220000a0ab080000000900000001040000040000000800000000000000000000000100008005000000000000800001000005000000ff070000000000002708000003000000c70000000400000000bca8008100000001800000740600000100000001000000018000000600000005000000ff0f0000000000009fae00006f0000000000000080000000ff0100000900000002000000fcffffffff7f000007000000000000000f0000000900000005000000040000000208000000f8ffff7f000000db0e00000000000001000000faffffff000004000700000009000000984d010000000000040000000400000001ffffff00800000020000000700000001fcffff000400000100000001000000090000000900000062ed0000a80000000600000002000000b206000000000000018000000600000006000000810000006e0b00006063506e0500000002000000ed0000001b00000001feffff0104000003000000610a0000ffffff7f0400000005000000050000008000000002000000040000000000ffff02000000e2010000000000000d030000ff0f0000fbffffffff07000009000000060000000300000000000000"], 0x420}}, 0x4000) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r2 = accept4(r0, 0x0, &(0x7f0000000040), 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000580), r2) (async, rerun: 64) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x94) (rerun: 64) r5 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r4}, 0x8) close(r5) (async, rerun: 32) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (rerun: 32) setsockopt$WPAN_SECURITY(r6, 0x0, 0x1, &(0x7f0000000480)=0x2, 0x4) getsockopt$WPAN_SECURITY(r6, 0x0, 0x1, 0x0, &(0x7f0000000040)) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r7, 0x10, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async, rerun: 32) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r5, r7, 0x0, r5}, 0x10) (rerun: 32) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x6c, r3, 0x1, 0x70bd27, 0x25dfdbfb, {}, [@GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_LINK={0x8, 0x1, r1}, @GTPA_TID={0xc}, @GTPA_MS_ADDR6={0x14, 0xc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @GTPA_NET_NS_FD={0x8, 0x7, r5}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_NET_NS_FD={0x8, 0x7, r8}, @GTPA_FAMILY={0x5, 0xd, 0x10}, @GTPA_O_TEI={0x8, 0x9, 0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x800}, 0x42000000) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000070000100000000000000000007000000", @ANYRES32=r1, @ANYBLOB="140001800800010000000100050006"], 0x2c}}, 0x0) 1.116586949s ago: executing program 1 (id=20947): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xd, 0x9, 0x0, 0xc, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x2}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe00, 0xa1}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}]}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x54}}, 0x0) 1.021384954s ago: executing program 2 (id=20948): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x420, 0xf0, 0xf0, 0xfeffffff, 0xf0, 0x2d0, 0x388, 0x388, 0xffffffff, 0x388, 0x388, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {0xff}, 0x6, 0x2}, 0x0, 0xc8, 0xf0, 0x0, {0x32}, [@common=@inet=@tcpmss={{0x28}, {0x8, 0x8}}, @common=@addrtype={{0x30}, {0x8, 0x22b, 0x0, 0x1}}]}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x0, 0xf, 0x5}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @local, 0xff000000, 0xffffff00, 'wg0\x00', 'syzkaller0\x00', {}, {0xff}, 0x84, 0x1, 0x20}, 0x0, 0x100, 0x138, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x4000000, 0x4000000, 0x1000000, 0x4000003]}}}, @common=@osf={{0x50}, {'syz0\x00', 0x0, 0x9, 0x0, 0x2}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id=0x68, @icmp_id=0x67}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x2a}, @dev={0xac, 0x14, 0x14, 0x14}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00', {}, {}, 0x5c}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @gre_key=0x3}}}}, {{@ip={@remote, @private=0xa010101, 0x0, 0x0, 'pim6reg0\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x3}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@dev={0xac, 0x14, 0x14, 0x43}, @port, @gre_key=0x4}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x480) 585.49647ms ago: executing program 1 (id=20949): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x7, 0x4, 0x8, 0x3ff, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) 375.208912ms ago: executing program 2 (id=20950): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d1}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xfffffffd, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56561, 0x70bd2a, 0x25dfdbfa, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0x0, 0x8}, {0xc, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000300}, 0x24048090) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 362.657058ms ago: executing program 4 (id=20951): r0 = socket(0x2, 0x80805, 0x0) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, 0x0}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x3, 0x0) setsockopt(r3, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x2}, 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000001000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b70300000000ffff850000000400000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg(r3, &(0x7f0000000100)={&(0x7f0000000040)=@ll={0x11, 0x3, r6, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f0000000240)=[{&(0x7f00000003c0)="020195ff002d3922ff65b4355e953d23d254f00000000000", 0x18}, {&(0x7f00000001c0)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x4c, 0x10, 0x401, 0x70bd28, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8, 0x10000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x9, 0x1, 0x1a0000, 0x9, 0x20, 0x1, 0x0, '\x00', r7, 0xffffffffffffffff, 0x3, 0x2}, 0x50) getsockopt$inet_mptcp_buf(r1, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000140)=0xb9) syz_emit_ethernet(0x5e, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x28, 0x2c, 0x0, @remote, @local, {[], {{0x4e21, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, {[@generic={0x22, 0x2}, @exp_smc={0xfe, 0x6}, @exp_smc={0xfe, 0x6}, @mss={0x2, 0x4, 0xc5}]}}}}}}}}, 0x0) getsockopt$inet_mptcp_buf(r1, 0x11c, 0x2, &(0x7f0000000100)=""/36, &(0x7f0000000180)=0x24) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000001840)=ANY=[@ANYRES32=r8], 0xb) 61.390492ms ago: executing program 1 (id=20952): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000100)={'lo\x00', &(0x7f0000000000)=@ethtool_cmd={0x4a, 0x6f8, 0x898c, 0x80, 0x6, 0x4, 0x9c, 0xb, 0x3, 0x1, 0xed, 0xfffffff9, 0x66a, 0x4, 0x8, 0x8, [0x7f, 0x6]}}) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000180)={0x20, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0x9, 0x0, 0x0, 0x0, @binary="2cc2ecdb28"}]}]}, 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=ANY=[@ANYBLOB="400100001a00010000000000fedbdf25fc010000000000000000000000000000000000000000000000000000000000000000ecdf000000000000002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe800000000000000000000000ac1e010100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff000000120000000000000000000000000000000000000000030000000000000000000091f6865461f5487f1729339a9a8000000000000000000000000000000000000000000000000700000000000000000200000000000000000000004d0002006362632863617374352900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028000000387cc250ec0000000000000000000000000000663a01e613f75e588ad6f8fda04ef52e962548d4d1a443b0663b55920705f3d6636a33330fed7e77409f899bfc615ad943a402"], 0x140}}, 0x40040) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000140)={0x0, 0x6, 0xffff}, 0x8) 0s ago: executing program 2 (id=20953): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) socket$xdp(0x2c, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000440)) socket$kcm(0x23, 0x5, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$nl_rdma(0x10, 0x3, 0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000024000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r0], 0xc4}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) kernel console output (not intermixed with test programs): tx timeout [ 1703.276104][T25927] veth0: Caught tx_queue_len zero misconfig [ 1703.455509][T25941] netlink: 'syz.4.20227': attribute type 18 has an invalid length. [ 1703.474519][T25938] netlink: 216 bytes leftover after parsing attributes in process `syz.2.20225'. [ 1703.474578][T25938] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20225'. [ 1703.690534][T25938] pim6reg: entered allmulticast mode [ 1704.343602][T25873] bridge0: port 1(bridge_slave_0) entered blocking state [ 1704.345414][T25873] bridge0: port 1(bridge_slave_0) entered disabled state [ 1704.345588][T25873] bridge_slave_0: entered allmulticast mode [ 1704.350523][T25873] bridge_slave_0: entered promiscuous mode [ 1704.390281][T25873] bridge0: port 2(bridge_slave_1) entered blocking state [ 1704.390499][T25873] bridge0: port 2(bridge_slave_1) entered disabled state [ 1704.393747][T25873] bridge_slave_1: entered allmulticast mode [ 1704.430704][T25873] bridge_slave_1: entered promiscuous mode [ 1704.461353][T25959] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 1704.689277][T25873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1704.850884][T25978] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20239'. [ 1704.917493][T25873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1705.155143][T25873] team0: Port device team_slave_0 added [ 1705.252026][T25873] team0: Port device team_slave_1 added [ 1705.319299][T25873] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1705.319322][T25873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1705.319348][T25873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1705.324906][T25873] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1705.324926][T25873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1705.324953][T25873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1705.367962][ T9320] Bluetooth: hci1: command tx timeout [ 1705.786642][T25873] hsr_slave_0: entered promiscuous mode [ 1705.800323][T25873] hsr_slave_1: entered promiscuous mode [ 1705.814092][T25873] debugfs: 'hsr0' already exists in 'hsr' [ 1705.814118][T25873] Cannot create hsr debugfs directory [ 1705.835933][T26005] lo: entered allmulticast mode [ 1706.022794][T26007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20245'. [ 1706.022820][T26007] netlink: 4 bytes leftover after parsing attributes in process `syz.0.20245'. [ 1706.022846][T26007] netlink: 'syz.0.20245': attribute type 15 has an invalid length. [ 1706.180385][T26007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20245'. [ 1706.180432][T26007] netlink: 4 bytes leftover after parsing attributes in process `syz.0.20245'. [ 1706.180457][T26007] netlink: 'syz.0.20245': attribute type 15 has an invalid length. [ 1706.228826][ T2421] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 1706.304907][T24447] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 1706.305108][T24447] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 1706.448876][T26019] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1706.467894][T24442] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 1706.496455][T26013] IPVS: set_ctl: invalid protocol: 4 224.0.0.1:20001 [ 1707.420120][ T9320] Bluetooth: hci1: command tx timeout [ 1707.557204][T25873] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1708.289445][T26059] __nla_validate_parse: 3 callbacks suppressed [ 1708.289472][T26059] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20256'. [ 1708.308756][T25873] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1708.308792][T25873] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1708.308815][T25873] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 1708.343317][T26066] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20256'. [ 1708.735174][T25873] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1708.735213][T25873] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1708.735269][T25873] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 1708.791971][T26072] nbd: couldn't find a device at index 0 [ 1708.983775][T26081] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1709.064373][T26086] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20261'. [ 1709.064470][T26086] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1709.193375][T26090] netlink: 36 bytes leftover after parsing attributes in process `syz.0.20263'. [ 1709.499557][ T9320] Bluetooth: hci1: command tx timeout [ 1709.622598][T26099] netlink: 36 bytes leftover after parsing attributes in process `syz.4.20266'. [ 1709.662345][T26100] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1710.060279][T26110] FAULT_INJECTION: forcing a failure. [ 1710.060279][T26110] name failslab, interval 1, probability 0, space 0, times 0 [ 1710.060316][T26110] CPU: 1 UID: 0 PID: 26110 Comm: syz.2.20270 Not tainted syzkaller #0 PREEMPT(full) [ 1710.060339][T26110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1710.060352][T26110] Call Trace: [ 1710.060362][T26110] [ 1710.060397][T26110] dump_stack_lvl+0xe8/0x150 [ 1710.060438][T26110] should_fail_ex+0x410/0x560 [ 1710.060475][T26110] should_failslab+0xa8/0x100 [ 1710.060510][T26110] __kmalloc_noprof+0xfe/0x720 [ 1710.060532][T26110] ? rcu_is_watching+0x16/0xb0 [ 1710.060562][T26110] ? tomoyo_realpath_from_path+0xef/0x640 [ 1710.060594][T26110] ? tomoyo_realpath_from_path+0xef/0x640 [ 1710.060635][T26110] tomoyo_realpath_from_path+0xef/0x640 [ 1710.060679][T26110] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1710.060706][T26110] tomoyo_path_number_perm+0x246/0x5f0 [ 1710.060736][T26110] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1710.060761][T26110] ? __lock_acquire+0x747/0x2de0 [ 1710.060812][T26110] ? hook_file_ioctl+0x1f2/0x600 [ 1710.060867][T26110] ? __fget_files+0x2a/0x420 [ 1710.060902][T26110] ? __fget_files+0x2a/0x420 [ 1710.060930][T26110] ? __fget_files+0x3a2/0x420 [ 1710.060957][T26110] ? __fget_files+0x2a/0x420 [ 1710.060991][T26110] security_file_ioctl+0xc3/0x2a0 [ 1710.061018][T26110] __se_sys_ioctl+0x47/0x170 [ 1710.061046][T26110] do_syscall_64+0x166/0x520 [ 1710.061078][T26110] ? trace_irq_disable+0x3b/0x140 [ 1710.061102][T26110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1710.061125][T26110] ? clear_bhb_loop+0x70/0xc0 [ 1710.061151][T26110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1710.061173][T26110] RIP: 0033:0x7f1c8c39e159 [ 1710.061195][T26110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1710.061213][T26110] RSP: 002b:00007f1c8d336028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1710.061237][T26110] RAX: ffffffffffffffda RBX: 00007f1c8c625fa0 RCX: 00007f1c8c39e159 [ 1710.061253][T26110] RDX: 0000200000000100 RSI: 0000000000008b0b RDI: 0000000000000004 [ 1710.061268][T26110] RBP: 00007f1c8d336090 R08: 0000000000000000 R09: 0000000000000000 [ 1710.061281][T26110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1710.061294][T26110] R13: 00007f1c8c626038 R14: 00007f1c8c625fa0 R15: 00007ffe7b9273e8 [ 1710.061331][T26110] [ 1710.061341][T26110] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1710.446787][T26114] netlink: 28 bytes leftover after parsing attributes in process `syz.1.20271'. [ 1711.332195][T26143] netlink: 'syz.1.20278': attribute type 5 has an invalid length. [ 1711.332288][T26143] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20278'. [ 1711.457518][T26146] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1713.514795][T26123] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1713.543052][T25873] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1713.759844][T25873] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1713.762591][T25873] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1713.815887][T25873] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1713.828030][T25873] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1713.851539][T25873] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1713.852962][T25873] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1713.894808][T25873] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1714.106576][T26186] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1714.199511][T26166] 8021q: adding VLAN 0 to HW filter on device team0 [ 1714.320623][T20596] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1714.324315][T26166] A link change request failed with some changes committed already. Interface syztnl2 may have been left with an inconsistent configuration, please check. [ 1714.400012][T26182] 0ªî{X¹¦: left allmulticast mode [ 1714.513560][T26182] bridge_slave_1: left allmulticast mode [ 1714.648088][T26182] A link change request failed with some changes committed already. Interface syztnl2 may have been left with an inconsistent configuration, please check. [ 1714.673343][T14557] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1714.941774][T14557] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1715.376593][T25873] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1715.468407][T25873] 8021q: adding VLAN 0 to HW filter on device team0 [ 1715.532226][T17786] bridge0: port 1(bridge_slave_0) entered blocking state [ 1715.532372][T17786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1715.640726][T17786] bridge0: port 2(bridge_slave_1) entered blocking state [ 1715.643210][T17786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1715.654035][T26219] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1716.039877][T26230] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1716.152371][T26230] netlink: 28 bytes leftover after parsing attributes in process `syz.1.20300'. [ 1716.297964][ C1] TC_ACT_REPEAT abuse ? [ 1716.818419][ T9320] Bluetooth: hci5: Received unexpected HCI Event 0x00 [ 1717.670639][T25873] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1717.969748][T26266] ipvlan1: Caught tx_queue_len zero misconfig [ 1718.120013][T25873] veth0_vlan: entered promiscuous mode [ 1718.162901][T25873] veth1_vlan: entered promiscuous mode [ 1718.303742][T25873] veth0_macvtap: entered promiscuous mode [ 1718.346870][T25873] veth1_macvtap: entered promiscuous mode [ 1718.391555][T25873] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1718.440991][T25873] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1718.529125][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.529219][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.529257][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.529295][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.822593][T26296] netlink: 52 bytes leftover after parsing attributes in process `syz.2.20317'. [ 1719.210677][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1719.210703][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1719.352259][T24445] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1719.352285][T24445] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1719.523514][T26309] Bluetooth: hci0: unsupported parameter 5134 [ 1719.523541][T26309] Bluetooth: hci0: unsupported parameter 8192 [ 1719.523556][T26309] Bluetooth: hci0: unsupported parameter 5134 [ 1719.523570][T26309] Bluetooth: hci0: unsupported parameter 8192 [ 1719.660738][T26315] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 1720.035248][T26327] netlink: 'syz.0.20324': attribute type 5 has an invalid length. [ 1720.035293][T26327] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20324'. [ 1720.353915][T26332] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1720.805644][ T864] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1720.817174][ T864] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1720.832611][ T864] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1720.836638][ T864] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1720.851382][ T864] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1721.676133][T26369] netlink: 28 bytes leftover after parsing attributes in process `syz.4.20335'. [ 1721.676173][T26369] netlink: 28 bytes leftover after parsing attributes in process `syz.4.20335'. [ 1721.689012][ T5719] syz_tun (unregistering): left allmulticast mode [ 1721.730484][T26365] tipc: Started in network mode [ 1721.730518][T26365] tipc: Node identity aadb0c722ec, cluster identity 4711 [ 1721.730760][T26365] tipc: Enabled bearer , priority 0 [ 1721.794818][T26360] tipc: Disabling bearer [ 1721.906494][T26375] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20337'. [ 1721.926068][T24441] bond0: (slave bridge13): link status definitely down, disabling slave [ 1722.094534][T26372] Bluetooth: hci0: unsupported parameter 5135 [ 1722.094562][T26372] Bluetooth: hci0: unsupported parameter 8192 [ 1722.094575][T26372] Bluetooth: hci0: unsupported parameter 5135 [ 1722.094588][T26372] Bluetooth: hci0: unsupported parameter 8192 [ 1722.272915][T26386] netlink: 20 bytes leftover after parsing attributes in process `syz.4.20339'. [ 1722.383609][ T2421] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1722.383650][ T2421] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1722.383677][ T2421] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1722.735380][ T2421] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1722.735420][ T2421] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1722.735445][ T2421] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1722.851771][T26342] lo speed is unknown, defaulting to 1000 [ 1722.853786][T26342] wg0 speed is unknown, defaulting to 1000 [ 1722.942084][ T864] Bluetooth: hci4: command tx timeout [ 1723.102463][ T2421] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1723.102503][ T2421] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1723.102528][ T2421] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1723.199636][T26409] netlink: zone id is out of range [ 1723.199702][T26409] netlink: zone id is out of range [ 1723.200067][T26409] netlink: zone id is out of range [ 1723.200078][T26409] netlink: zone id is out of range [ 1723.200088][T26409] netlink: zone id is out of range [ 1723.655571][ T2421] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1723.655611][ T2421] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 1723.655637][ T2421] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 1724.328825][T26434] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20348'. [ 1724.826853][T26446] netlink: 36 bytes leftover after parsing attributes in process `syz.4.20352'. [ 1724.932596][T26448] netlink: 'syz.0.20351': attribute type 21 has an invalid length. [ 1724.932622][T26448] netlink: 128 bytes leftover after parsing attributes in process `syz.0.20351'. [ 1725.021466][ T864] Bluetooth: hci4: command tx timeout [ 1725.043134][T26448] netlink: 3 bytes leftover after parsing attributes in process `syz.0.20351'. [ 1725.324012][T26342] bridge0: port 1(bridge_slave_0) entered blocking state [ 1725.324141][T26342] bridge0: port 1(bridge_slave_0) entered disabled state [ 1725.324367][T26342] bridge_slave_0: entered allmulticast mode [ 1725.373813][T26342] bridge_slave_0: entered promiscuous mode [ 1725.535496][T26457] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20355'. [ 1725.535552][T26457] netlink: 'syz.0.20355': attribute type 9 has an invalid length. [ 1725.535568][T26457] netlink: 4 bytes leftover after parsing attributes in process `syz.0.20355'. [ 1725.636337][ T2421] pim6reg: left allmulticast mode [ 1725.644895][ T2421] lo: left allmulticast mode [ 1725.645036][ T2421] dvmrp1: left allmulticast mode [ 1725.645467][ T2421] pimreg3: left allmulticast mode [ 1725.777746][T26462] netlink: zone id is out of range [ 1725.777801][T26462] netlink: zone id is out of range [ 1725.778133][T26462] netlink: zone id is out of range [ 1725.778145][T26462] netlink: zone id is out of range [ 1725.778155][T26462] netlink: zone id is out of range [ 1726.412984][ T2421] bond18 (unregistering): (slave ip6gre1): Releasing backup interface [ 1726.434280][ T2421] ip6gre1 (unregistering): left promiscuous mode [ 1726.664072][ T2421] tipc: Disabling bearer [ 1727.097410][ T864] Bluetooth: hci4: command tx timeout [ 1727.430139][ T2421]  (unregistering): (slave bridge12): Releasing backup interface [ 1727.524637][ T2421] bond27 (unregistering): (slave bridge18): Releasing backup interface [ 1727.551868][ T2421] bond29 (unregistering): (slave bridge19): Releasing backup interface [ 1727.572697][ T2421] bond31 (unregistering): (slave bridge20): Releasing backup interface [ 1727.610488][ T2421] .` (unregistering): Released all slaves [ 1727.628017][ T2421] bond1 (unregistering): Released all slaves [ 1727.651906][ T2421] bond2 (unregistering): Released all slaves [ 1727.676575][ T2421] bond3 (unregistering): Released all slaves [ 1727.706384][ T2421] bond4 (unregistering): Released all slaves [ 1727.745292][ T2421] bond5 (unregistering): Released all slaves [ 1727.772491][ T2421] bond6 (unregistering): Released all slaves [ 1727.802866][ T2421] bond7 (unregistering): Released all slaves [ 1727.826698][ T2421] bond8 (unregistering): Released all slaves [ 1727.874833][ T2421] bond9 (unregistering): Released all slaves [ 1727.898017][ T2421] bond10 (unregistering): Released all slaves [ 1727.934861][ T2421] bond11 (unregistering): Released all slaves [ 1727.957890][ T2421] bond12 (unregistering): Released all slaves [ 1728.000550][ T2421] bond13 (unregistering): (slave veth9): Releasing active interface [ 1728.005622][ T2421] bond13 (unregistering): Released all slaves [ 1728.037030][ T2421] bond14 (unregistering): Released all slaves [ 1728.062042][ T2421] bond15 (unregistering): Released all slaves [ 1728.093656][ T2421] bond16 (unregistering): (slave veth11): Releasing backup interface [ 1728.111013][ T2421] bond16 (unregistering): Released all slaves [ 1728.143474][ T2421] bond17 (unregistering): Released all slaves [ 1728.170911][ T2421] bond18 (unregistering): Released all slaves [ 1728.230779][ T2421]  (unregistering): Released all slaves [ 1728.275344][ T2421] bond19 (unregistering): Released all slaves [ 1728.297440][ T2421] bond20 (unregistering): Released all slaves [ 1728.324074][ T2421] bond21 (unregistering): Released all slaves [ 1728.352481][ T2421] bond22 (unregistering): Released all slaves [ 1728.373575][ T2421] bond23 (unregistering): Released all slaves [ 1728.406955][ T2421] bond24 (unregistering): Released all slaves [ 1728.428390][ T2421] bond25 (unregistering): Released all slaves [ 1728.460900][ T2421] bond26 (unregistering): Released all slaves [ 1728.496513][ T2421] bond0 (unregistering): Released all slaves [ 1728.527740][ T2421] bond27 (unregistering): Released all slaves [ 1728.566831][ T2421] bond28 (unregistering): Released all slaves [ 1728.589365][ T2421] bond29 (unregistering): Released all slaves [ 1728.624289][ T2421] bond30 (unregistering): Released all slaves [ 1728.646139][ T2421] bond31 (unregistering): Released all slaves [ 1728.684711][ T2421] bond32 (unregistering): Released all slaves [ 1728.714595][ T2421] bond33 (unregistering): Released all slaves [ 1728.735737][ T2421] bond34 (unregistering): Released all slaves [ 1728.759510][ T2421] bond35 (unregistering): (slave veth13): Releasing active interface [ 1728.765819][ T2421] bond35 (unregistering): Released all slaves [ 1728.811474][ T2421] bond36 (unregistering): (slave veth15): Releasing active interface [ 1728.814282][ T2421] bond36 (unregistering): Released all slaves [ 1728.853766][ T2421] bond37 (unregistering): (slave veth17): Releasing active interface [ 1728.856442][ T2421] bond37 (unregistering): Released all slaves [ 1728.893723][ T2421] bond38 (unregistering): (slave veth19): Releasing active interface [ 1728.908672][ T2421] bond38 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1728.911576][ T2421] bond38 (unregistering): Released all slaves [ 1728.951415][ T2421] bond39 (unregistering): Released all slaves [ 1728.972915][ T2421] bond40 (unregistering): Released all slaves [ 1729.012652][T26342] bridge0: port 2(bridge_slave_1) entered blocking state [ 1729.012779][T26342] bridge0: port 2(bridge_slave_1) entered disabled state [ 1729.012946][T26342] bridge_slave_1: entered allmulticast mode [ 1729.015073][T26342] bridge_slave_1: entered promiscuous mode [ 1729.084716][T26456] __nla_validate_parse: 6 callbacks suppressed [ 1729.084739][T26456] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.20355'. [ 1729.087535][T17781] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1729.087599][T17781] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1729.087637][T17781] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1729.102199][T17781] netdevsim netdevsim1 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1729.177915][ T864] Bluetooth: hci4: command tx timeout [ 1729.178742][T24442] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 1729.346769][T17771] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 1729.361787][T17786] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 1729.361908][T17786] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 1729.535377][T26478] netlink: 'syz.2.20360': attribute type 11 has an invalid length. [ 1729.535404][T26478] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20360'. [ 1729.592351][T26342] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1729.628348][T26342] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1729.630722][T26478] netlink: 'syz.2.20360': attribute type 11 has an invalid length. [ 1729.630749][T26478] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20360'. [ 1729.808763][T26342] team0: Port device team_slave_0 added [ 1729.836853][T26342] team0: Port device team_slave_1 added [ 1730.071802][T26342] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1730.071823][T26342] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1730.071849][T26342] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1730.129531][ T2421] ovs-s: left promiscuous mode [ 1731.272804][T26342] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1731.272824][T26342] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1731.272850][T26342] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1731.407867][ T2421] ovs-dp0: left promiscuous mode [ 1731.520487][ T5282] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1731.619544][T26501] netlink: zone id is out of range [ 1731.620940][T26501] netlink: zone id is out of range [ 1731.620955][T26501] netlink: zone id is out of range [ 1731.620968][T26501] netlink: zone id is out of range [ 1731.677630][T26516] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20370'. [ 1731.702546][T26518] netlink: 76 bytes leftover after parsing attributes in process `syz.0.20369'. [ 1731.730992][ T2421] tipc: Disabling bearer [ 1731.733204][ T2421] tipc: Left network mode [ 1731.784665][T26342] hsr_slave_0: entered promiscuous mode [ 1731.808172][T26342] hsr_slave_1: entered promiscuous mode [ 1731.809134][T26342] debugfs: 'hsr0' already exists in 'hsr' [ 1731.809157][T26342] Cannot create hsr debugfs directory [ 1733.164168][ T2421] IPVS: stopping master sync thread 19237 ... [ 1733.571068][T26559] netlink: zone id is out of range [ 1733.571736][T26559] netlink: zone id is out of range [ 1733.571753][T26559] netlink: zone id is out of range [ 1733.571764][T26559] netlink: zone id is out of range [ 1733.827885][T26342] netdevsim netdevsim1 eth4 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1734.480376][T26342] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1734.614075][T26571] vcan0: entered promiscuous mode [ 1734.614102][T26571] vcan0: entered allmulticast mode [ 1734.692347][T26342] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1735.252713][T26598] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20388'. [ 1735.532864][T26342] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1735.951951][T26611] netlink: zone id is out of range [ 1735.952379][T26611] netlink: zone id is out of range [ 1736.149058][ T864] Bluetooth: hci4: command tx timeout [ 1736.471841][ T9320] block nbd6: Receive control failed (result -32) [ 1736.472237][ T864] block nbd6: Receive control failed (result -32) [ 1736.857858][T26631] FAULT_INJECTION: forcing a failure. [ 1736.857858][T26631] name failslab, interval 1, probability 0, space 0, times 0 [ 1736.857895][T26631] CPU: 1 UID: 0 PID: 26631 Comm: syz.3.20398 Not tainted syzkaller #0 PREEMPT(full) [ 1736.857919][T26631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1736.857932][T26631] Call Trace: [ 1736.857941][T26631] [ 1736.857950][T26631] dump_stack_lvl+0xe8/0x150 [ 1736.857987][T26631] should_fail_ex+0x410/0x560 [ 1736.858018][T26631] should_failslab+0xa8/0x100 [ 1736.858048][T26631] __kmalloc_noprof+0xfe/0x720 [ 1736.858071][T26631] ? kernfs_fop_write_iter+0x157/0x540 [ 1736.858109][T26631] ? kernfs_fop_write_iter+0x157/0x540 [ 1736.858144][T26631] kernfs_fop_write_iter+0x157/0x540 [ 1736.858176][T26631] vfs_write+0x612/0xba0 [ 1736.858208][T26631] ? __pfx_vfs_write+0x10/0x10 [ 1736.858241][T26631] ? __fget_files+0x2a/0x420 [ 1736.858280][T26631] ksys_write+0x150/0x270 [ 1736.858304][T26631] ? __pfx_ksys_write+0x10/0x10 [ 1736.858339][T26631] do_syscall_64+0x166/0x520 [ 1736.858366][T26631] ? trace_irq_disable+0x3b/0x140 [ 1736.858387][T26631] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1736.858409][T26631] ? clear_bhb_loop+0x70/0xc0 [ 1736.858435][T26631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1736.858457][T26631] RIP: 0033:0x7fb43b99e159 [ 1736.858477][T26631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1736.858495][T26631] RSP: 002b:00007fb43c928028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1736.858519][T26631] RAX: ffffffffffffffda RBX: 00007fb43bc25fa0 RCX: 00007fb43b99e159 [ 1736.858535][T26631] RDX: 000000000000000a RSI: 0000200000000800 RDI: 0000000000000004 [ 1736.858548][T26631] RBP: 00007fb43c928090 R08: 0000000000000000 R09: 0000000000000000 [ 1736.858561][T26631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1736.858575][T26631] R13: 00007fb43bc26038 R14: 00007fb43bc25fa0 R15: 00007ffdb29afe48 [ 1736.858611][T26631] [ 1736.901414][T26632] net_ratelimit: 2 callbacks suppressed [ 1736.901438][T26632] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1737.318488][T26638] batman_adv: batadv0: Adding interface: veth0 [ 1737.318510][T26638] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1737.318543][T26638] batman_adv: batadv0: Interface activated: veth0 [ 1737.877082][T26342] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1737.909188][T26342] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1737.915726][T26342] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1737.983281][T26655] netlink: zone id is out of range [ 1737.983338][T26655] netlink: zone id is out of range [ 1737.983679][T26655] netlink: zone id is out of range [ 1737.983689][T26655] netlink: zone id is out of range [ 1737.983699][T26655] netlink: zone id is out of range [ 1737.993234][T26342] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1738.219932][ T2421] veth1_vlan: left promiscuous mode [ 1738.220046][ T2421] veth0_vlan: left promiscuous mode [ 1739.058301][T26678] netlink: 'syz.4.20408': attribute type 1 has an invalid length. [ 1739.058328][T26678] netlink: 'syz.4.20408': attribute type 4 has an invalid length. [ 1739.058342][T26678] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.20408'. [ 1739.058711][T26678] netlink: 'syz.4.20408': attribute type 1 has an invalid length. [ 1739.058727][T26678] netlink: 'syz.4.20408': attribute type 4 has an invalid length. [ 1739.058740][T26678] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.20408'. [ 1740.765884][T26342] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1740.826357][T26342] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1740.832357][T26342] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1740.890530][T26342] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1740.995688][T25030] infiniband syz2: ib_query_port failed (-19) [ 1741.015073][T24442] smbdirect: ib_dev[syz2] removed [ 1741.716800][T26342] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1741.919790][T26727] netlink: 40 bytes leftover after parsing attributes in process `syz.0.20415'. [ 1741.919820][T26727] nbd: must specify at least one socket [ 1742.118189][T26731] netlink: zone id is out of range [ 1742.118278][T26731] netlink: zone id is out of range [ 1742.118633][T26731] netlink: zone id is out of range [ 1742.118643][T26731] netlink: zone id is out of range [ 1742.118653][T26731] netlink: zone id is out of range [ 1742.340484][ T2421] IPVS: stop unused estimator thread 0... [ 1742.384391][T26342] 8021q: adding VLAN 0 to HW filter on device team0 [ 1742.454002][T17781] bridge0: port 1(bridge_slave_0) entered blocking state [ 1742.456055][T17781] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1742.526326][T17786] bridge0: port 2(bridge_slave_1) entered blocking state [ 1742.526391][T17786] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1742.571294][T26737] FAULT_INJECTION: forcing a failure. [ 1742.571294][T26737] name failslab, interval 1, probability 0, space 0, times 0 [ 1742.571327][T26737] CPU: 1 UID: 0 PID: 26737 Comm: syz.0.20418 Not tainted syzkaller #0 PREEMPT(full) [ 1742.571347][T26737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1742.571357][T26737] Call Trace: [ 1742.571365][T26737] [ 1742.571373][T26737] dump_stack_lvl+0xe8/0x150 [ 1742.571404][T26737] should_fail_ex+0x410/0x560 [ 1742.571439][T26737] should_failslab+0xa8/0x100 [ 1742.571466][T26737] __kmalloc_noprof+0xfe/0x720 [ 1742.571486][T26737] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1742.571511][T26737] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1742.571540][T26737] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1742.571570][T26737] genl_family_rcv_msg_doit+0xda/0x340 [ 1742.571599][T26737] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1742.571625][T26737] ? __pfx_genl_get_cmd+0x10/0x10 [ 1742.571642][T26737] ? stack_trace_save+0xa9/0x100 [ 1742.571658][T26737] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1742.571775][T26737] ? __lock_acquire+0x747/0x2de0 [ 1742.571805][T26737] genl_rcv_msg+0x614/0x7a0 [ 1742.571834][T26737] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1742.571854][T26737] ? __pfx_nbd_genl_connect+0x10/0x10 [ 1742.571887][T26737] netlink_rcv_skb+0x226/0x4a0 [ 1742.571906][T26737] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1742.571929][T26737] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1742.571963][T26737] ? down_read+0x2be/0x330 [ 1742.571993][T26737] genl_rcv+0x28/0x40 [ 1742.572013][T26737] netlink_unicast+0x7bd/0x940 [ 1742.572051][T26737] netlink_sendmsg+0x813/0xb40 [ 1742.572080][T26737] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1742.572107][T26737] ? apparmor_socket_sendmsg+0x98/0x360 [ 1742.572130][T26737] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1742.572147][T26737] sock_sendmsg_nosec+0x13a/0x180 [ 1742.572171][T26737] ____sys_sendmsg+0x54e/0x850 [ 1742.572202][T26737] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1742.572237][T26737] ? import_iovec+0x73/0xa0 [ 1742.572263][T26737] ___sys_sendmsg+0x2a5/0x360 [ 1742.572286][T26737] ? __lock_acquire+0x747/0x2de0 [ 1742.572311][T26737] ? __pfx____sys_sendmsg+0x10/0x10 [ 1742.572382][T26737] ? __fget_files+0x2a/0x420 [ 1742.572409][T26737] ? __fget_files+0x3a2/0x420 [ 1742.572454][T26737] __x64_sys_sendmsg+0x1b1/0x290 [ 1742.572487][T26737] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1742.572540][T26737] do_syscall_64+0x166/0x520 [ 1742.572566][T26737] ? trace_irq_disable+0x3b/0x140 [ 1742.572586][T26737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1742.572607][T26737] ? clear_bhb_loop+0x70/0xc0 [ 1742.572631][T26737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1742.572652][T26737] RIP: 0033:0x7fbea459e159 [ 1742.572673][T26737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1742.572689][T26737] RSP: 002b:00007fbea5476028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1742.572712][T26737] RAX: ffffffffffffffda RBX: 00007fbea4825fa0 RCX: 00007fbea459e159 [ 1742.572728][T26737] RDX: 0000000000000004 RSI: 0000200000001ac0 RDI: 0000000000000006 [ 1742.572741][T26737] RBP: 00007fbea5476090 R08: 0000000000000000 R09: 0000000000000000 [ 1742.572755][T26737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1742.572766][T26737] R13: 00007fbea4826038 R14: 00007fbea4825fa0 R15: 00007fff3bcc2cf8 [ 1742.572792][T26737] [ 1743.724132][T26766] netlink: 104 bytes leftover after parsing attributes in process `syz.4.20426'. [ 1744.117652][T26777] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1744.636988][T26342] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1744.734161][T26342] veth0_vlan: entered promiscuous mode [ 1744.764273][T26342] veth1_vlan: entered promiscuous mode [ 1744.863104][T26342] veth0_macvtap: entered promiscuous mode [ 1744.881227][T26342] veth1_macvtap: entered promiscuous mode [ 1744.945993][T26342] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1744.985896][T26342] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1745.050083][T24445] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1745.056241][ T2421] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1745.056661][ T2421] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1745.229355][T17771] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1746.704514][T26766] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1746.878531][T24442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1746.878553][T24442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1747.055701][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1747.055729][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1747.096620][T26796] netlink: 88 bytes leftover after parsing attributes in process `syz.0.20432'. [ 1747.889908][T26816] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20440'. [ 1748.160389][ T864] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1748.168556][ T864] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1748.172675][ T864] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1748.198592][ T864] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1748.199928][ T864] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1748.357655][T26820] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20440'. [ 1748.362736][T26820] nbd: nbd64 already in use [ 1748.775497][T26835] netlink: 88 bytes leftover after parsing attributes in process `syz.0.20445'. [ 1748.952168][ C1] TC_ACT_REPEAT abuse ? [ 1748.988637][T26574] udevd[26574]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1749.485425][T26850] FAULT_INJECTION: forcing a failure. [ 1749.485425][T26850] name failslab, interval 1, probability 0, space 0, times 0 [ 1749.485462][T26850] CPU: 0 UID: 0 PID: 26850 Comm: syz.0.20452 Not tainted syzkaller #0 PREEMPT(full) [ 1749.485485][T26850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1749.485508][T26850] Call Trace: [ 1749.485517][T26850] [ 1749.485526][T26850] dump_stack_lvl+0xe8/0x150 [ 1749.485562][T26850] should_fail_ex+0x410/0x560 [ 1749.485593][T26850] should_failslab+0xa8/0x100 [ 1749.485620][T26850] ? skb_clone+0x212/0x3a0 [ 1749.485651][T26850] kmem_cache_alloc_noprof+0xa1/0x600 [ 1749.485675][T26850] ? skb_clone+0x212/0x3a0 [ 1749.485711][T26850] skb_clone+0x212/0x3a0 [ 1749.485744][T26850] __netlink_deliver_tap+0x413/0x860 [ 1749.485780][T26850] ? netlink_deliver_tap+0x2e/0x1b0 [ 1749.485804][T26850] netlink_deliver_tap+0x19c/0x1b0 [ 1749.485828][T26850] netlink_unicast+0x781/0x940 [ 1749.485869][T26850] netlink_sendmsg+0x813/0xb40 [ 1749.485902][T26850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1749.485933][T26850] ? apparmor_socket_sendmsg+0x98/0x360 [ 1749.485961][T26850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1749.485981][T26850] sock_sendmsg_nosec+0x13a/0x180 [ 1749.486007][T26850] ____sys_sendmsg+0x54e/0x850 [ 1749.486043][T26850] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1749.486083][T26850] ? import_iovec+0x73/0xa0 [ 1749.486114][T26850] ___sys_sendmsg+0x2a5/0x360 [ 1749.486142][T26850] ? __lock_acquire+0x747/0x2de0 [ 1749.486169][T26850] ? __pfx____sys_sendmsg+0x10/0x10 [ 1749.486241][T26850] ? __fget_files+0x2a/0x420 [ 1749.486268][T26850] ? __fget_files+0x3a2/0x420 [ 1749.486308][T26850] __x64_sys_sendmsg+0x1b1/0x290 [ 1749.486340][T26850] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1749.486394][T26850] do_syscall_64+0x166/0x520 [ 1749.486421][T26850] ? trace_irq_disable+0x3b/0x140 [ 1749.486443][T26850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1749.486463][T26850] ? clear_bhb_loop+0x70/0xc0 [ 1749.486489][T26850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1749.486516][T26850] RIP: 0033:0x7fbea459e159 [ 1749.486536][T26850] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1749.486554][T26850] RSP: 002b:00007fbea5476028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1749.486578][T26850] RAX: ffffffffffffffda RBX: 00007fbea4825fa0 RCX: 00007fbea459e159 [ 1749.486593][T26850] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 0000000000000003 [ 1749.486606][T26850] RBP: 00007fbea5476090 R08: 0000000000000000 R09: 0000000000000000 [ 1749.486620][T26850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1749.486632][T26850] R13: 00007fbea4826038 R14: 00007fbea4825fa0 R15: 00007fff3bcc2cf8 [ 1749.486668][T26850] [ 1749.584352][T26853] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20453'. [ 1749.666967][T26856] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20454'. [ 1749.713701][T26861] netlink: 20 bytes leftover after parsing attributes in process `syz.0.20455'. [ 1749.844811][T26863] netlink: 60 bytes leftover after parsing attributes in process `syz.4.20454'. [ 1749.846251][T26863] netlink: 60 bytes leftover after parsing attributes in process `syz.4.20454'. [ 1750.115300][T26865] netlink: 20 bytes leftover after parsing attributes in process `syz.0.20455'. [ 1750.120948][T26865] nbd: nbd64 already in use [ 1750.303592][ T9320] Bluetooth: hci3: command tx timeout [ 1750.695586][T26574] udevd[26574]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1750.984930][T26822] wg0 speed is unknown, defaulting to 1000 [ 1751.212490][T26889] veth2: entered promiscuous mode [ 1751.212686][T26889] veth2: entered allmulticast mode [ 1752.252747][T26913] __nla_validate_parse: 4 callbacks suppressed [ 1752.252771][T26913] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20468'. [ 1752.252795][T26913] nbd: nbd64 already in use [ 1752.378907][ T9320] Bluetooth: hci3: command tx timeout [ 1752.523982][T26929] netlink: 84 bytes leftover after parsing attributes in process `syz.0.20476'. [ 1752.710846][T26822] bridge0: port 1(bridge_slave_0) entered blocking state [ 1752.713916][T26822] bridge0: port 1(bridge_slave_0) entered disabled state [ 1752.714315][T26822] bridge_slave_0: entered allmulticast mode [ 1752.721014][T26822] bridge_slave_0: entered promiscuous mode [ 1752.738881][T26937] netlink: 36 bytes leftover after parsing attributes in process `syz.4.20474'. [ 1752.739638][T26822] bridge0: port 2(bridge_slave_1) entered blocking state [ 1752.742631][T26822] bridge0: port 2(bridge_slave_1) entered disabled state [ 1752.743202][T26822] bridge_slave_1: entered allmulticast mode [ 1752.780152][T26822] bridge_slave_1: entered promiscuous mode [ 1752.872748][T26938] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20475'. [ 1752.872782][T26938] nbd: socks must be embedded in a SOCK_ITEM attr [ 1752.917319][T26574] udevd[26574]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1753.003737][T26822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1753.026853][T26822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1753.145890][T26822] team0: Port device team_slave_0 added [ 1753.171285][T26822] team0: Port device team_slave_1 added [ 1753.266254][T26822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1753.266275][T26822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1753.266302][T26822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1753.314849][T26822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1753.314868][T26822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1753.314895][T26822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1753.416299][T26822] hsr_slave_0: entered promiscuous mode [ 1753.427003][T26822] hsr_slave_1: entered promiscuous mode [ 1753.434064][T26822] debugfs: 'hsr0' already exists in 'hsr' [ 1753.434092][T26822] Cannot create hsr debugfs directory [ 1753.581677][T26952] Cannot find add_set index 4 as target [ 1753.593524][T26956] Cannot find add_set index 4 as target [ 1753.642568][T26958] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20484'. [ 1753.695362][T26958] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20484'. [ 1753.695393][T26958] nbd: device at index 64 is going down [ 1754.169005][T26572] udevd[26572]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1754.237753][T26574] udevd[26574]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1754.458825][ T9320] Bluetooth: hci3: command tx timeout [ 1754.480867][T26980] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1754.638614][T26822] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1754.638658][T26822] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1754.757864][T26987] veth0: entered promiscuous mode [ 1754.769446][T26987] veth0: left promiscuous mode [ 1754.828567][T26983] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20492'. [ 1754.829098][T26984] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20492'. [ 1754.892361][T26984] openvswitch: netlink: VXLAN extension 1 has unexpected len 16 expected 4 [ 1755.041444][T26822] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1755.041485][T26822] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1755.443910][T26822] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1755.443967][T26822] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1755.493522][T26991] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20494'. [ 1755.540812][T27006] syzkaller0: entered promiscuous mode [ 1755.540839][T27006] syzkaller0: entered allmulticast mode [ 1755.637968][T27007] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1755.739145][T27012] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1755.962852][T26822] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1755.962892][T26822] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1756.054977][T27016] netlink: 'syz.0.20503': attribute type 1 has an invalid length. [ 1756.055006][T27016] netlink: 'syz.0.20503': attribute type 3 has an invalid length. [ 1756.055022][T27016] netlink: 224 bytes leftover after parsing attributes in process `syz.0.20503'. [ 1756.537423][ T9320] Bluetooth: hci3: command tx timeout [ 1756.632291][T27026] sctp: [Deprecated]: syz.3.20505 (pid 27026) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1756.632291][T27026] Use struct sctp_sack_info instead [ 1756.634731][T27026] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1756.974146][T27038] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1757.866794][T27058] FAULT_INJECTION: forcing a failure. [ 1757.866794][T27058] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1757.866830][T27058] CPU: 1 UID: 0 PID: 27058 Comm: syz.4.20517 Not tainted syzkaller #0 PREEMPT(full) [ 1757.866854][T27058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1757.866866][T27058] Call Trace: [ 1757.866875][T27058] [ 1757.866884][T27058] dump_stack_lvl+0xe8/0x150 [ 1757.866920][T27058] should_fail_ex+0x410/0x560 [ 1757.866951][T27058] _copy_from_user+0x2d/0xb0 [ 1757.866977][T27058] ___sys_sendmsg+0x1c6/0x360 [ 1757.867004][T27058] ? __lock_acquire+0x747/0x2de0 [ 1757.867033][T27058] ? __pfx____sys_sendmsg+0x10/0x10 [ 1757.867100][T27058] ? __fget_files+0x2a/0x420 [ 1757.867128][T27058] ? __fget_files+0x3a2/0x420 [ 1757.867167][T27058] __x64_sys_sendmsg+0x1b1/0x290 [ 1757.867204][T27058] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1757.867255][T27058] do_syscall_64+0x166/0x520 [ 1757.867281][T27058] ? trace_irq_disable+0x3b/0x140 [ 1757.867302][T27058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1757.867324][T27058] ? clear_bhb_loop+0x70/0xc0 [ 1757.867350][T27058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1757.867380][T27058] RIP: 0033:0x7f9a0619e159 [ 1757.867401][T27058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1757.867420][T27058] RSP: 002b:00007f9a07050028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1757.867443][T27058] RAX: ffffffffffffffda RBX: 00007f9a06425fa0 RCX: 00007f9a0619e159 [ 1757.867459][T27058] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 1757.867473][T27058] RBP: 00007f9a07050090 R08: 0000000000000000 R09: 0000000000000000 [ 1757.867486][T27058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1757.867499][T27058] R13: 00007f9a06426038 R14: 00007f9a06425fa0 R15: 00007ffc8402cfa8 [ 1757.867534][T27058] [ 1758.170592][T26822] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1758.196873][T26822] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1758.208717][T26822] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1758.239488][T26822] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1758.241844][T26822] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1758.266706][T26822] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1758.321714][T26822] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1758.344927][T26822] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1758.391777][T27074] __nla_validate_parse: 2 callbacks suppressed [ 1758.391802][T27074] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.20520'. [ 1758.392542][T27073] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20522'. [ 1758.392634][T27073] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1758.392646][T27073] IPv6: NLM_F_CREATE should be set when creating new route [ 1758.392679][T27073] IPv6: NLM_F_CREATE should be set when creating new route [ 1758.429116][T27062] team0: Device xfrm0 is of different type [ 1758.534795][T27082] netlink: 12 bytes leftover after parsing attributes in process `syz.4.20523'. [ 1758.607148][T27082] vlan4: entered promiscuous mode [ 1758.941691][T27096] netlink: 16215 bytes leftover after parsing attributes in process `syz.3.20525'. [ 1758.972546][T26822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1759.042484][T26822] 8021q: adding VLAN 0 to HW filter on device team0 [ 1759.074817][T17781] bridge0: port 1(bridge_slave_0) entered blocking state [ 1759.074949][T17781] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1759.134753][T24441] bridge0: port 2(bridge_slave_1) entered blocking state [ 1759.134897][T24441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1759.747353][ T9320] block nbd7: Receive control failed (result -32) [ 1759.747353][ T864] block nbd7: Receive control failed (result -32) [ 1760.744194][ T9320] block nbd8: Receive control failed (result -32) [ 1760.745300][ T864] block nbd8: Receive control failed (result -32) [ 1761.104312][T27149] nbd: must specify at least one socket [ 1761.157174][T27155] Cannot find set identified by id 0 to match [ 1761.158097][T27157] netlink: 20 bytes leftover after parsing attributes in process `syz.0.20543'. [ 1761.272370][T27153] netlink: 56 bytes leftover after parsing attributes in process `syz.4.20542'. [ 1761.594343][T27169] team0: Device xfrm0 is of different type [ 1761.706737][T27176] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1761.819617][T26822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1761.993789][T27175] netlink: 'syz.0.20546': attribute type 3 has an invalid length. [ 1762.106577][T27175] netlink: 12 bytes leftover after parsing attributes in process `syz.0.20546'. [ 1762.222383][T26822] veth0_vlan: entered promiscuous mode [ 1762.224096][T27175] bond1: entered promiscuous mode [ 1762.224119][T27175] bond1: entered allmulticast mode [ 1762.412391][T27187] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1762.436043][T26822] veth1_vlan: entered promiscuous mode [ 1762.638966][ T864] block nbd9: Receive control failed (result -32) [ 1762.640758][ T9320] block nbd9: Receive control failed (result -32) [ 1762.801737][T26822] veth0_macvtap: entered promiscuous mode [ 1762.843905][T26822] veth1_macvtap: entered promiscuous mode [ 1762.988970][T26822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1763.011995][T27205] netlink: 56 bytes leftover after parsing attributes in process `syz.0.20556'. [ 1763.078724][T26822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1763.294690][T27214] netlink: 232 bytes leftover after parsing attributes in process `syz.1.20562'. [ 1763.381124][T27219] FAULT_INJECTION: forcing a failure. [ 1763.381124][T27219] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1763.381161][T27219] CPU: 0 UID: 0 PID: 27219 Comm: syz.1.20563 Not tainted syzkaller #0 PREEMPT(full) [ 1763.381184][T27219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1763.381200][T27219] Call Trace: [ 1763.381209][T27219] [ 1763.381219][T27219] dump_stack_lvl+0xe8/0x150 [ 1763.381255][T27219] should_fail_ex+0x410/0x560 [ 1763.381287][T27219] _copy_from_user+0x2d/0xb0 [ 1763.381315][T27219] ___sys_sendmsg+0x1c6/0x360 [ 1763.381345][T27219] ? __lock_acquire+0x747/0x2de0 [ 1763.381373][T27219] ? __pfx____sys_sendmsg+0x10/0x10 [ 1763.381438][T27219] ? __fget_files+0x2a/0x420 [ 1763.381476][T27219] ? __fget_files+0x3a2/0x420 [ 1763.381516][T27219] __x64_sys_sendmsg+0x1b1/0x290 [ 1763.381547][T27219] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1763.381600][T27219] do_syscall_64+0x166/0x520 [ 1763.381627][T27219] ? trace_irq_disable+0x3b/0x140 [ 1763.381648][T27219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.381668][T27219] ? clear_bhb_loop+0x70/0xc0 [ 1763.381694][T27219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1763.381714][T27219] RIP: 0033:0x7f2f9f19e159 [ 1763.381735][T27219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1763.381752][T27219] RSP: 002b:00007f2fa0007028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1763.381776][T27219] RAX: ffffffffffffffda RBX: 00007f2f9f425fa0 RCX: 00007f2f9f19e159 [ 1763.381791][T27219] RDX: 0000000000004000 RSI: 00002000000015c0 RDI: 0000000000000003 [ 1763.381804][T27219] RBP: 00007f2fa0007090 R08: 0000000000000000 R09: 0000000000000000 [ 1763.381817][T27219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1763.381829][T27219] R13: 00007f2f9f426038 R14: 00007f2f9f425fa0 R15: 00007ffddc8db468 [ 1763.381864][T27219] [ 1763.980495][T24441] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.031539][T24442] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.198285][T17786] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.204167][T24441] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.449138][T27228] netlink: 'syz.4.20565': attribute type 5 has an invalid length. [ 1764.470912][T24442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1764.470938][T24442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1764.661908][T24442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1764.661933][T24442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1764.704625][T27233] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20569'. [ 1764.865522][T27242] bond1: entered promiscuous mode [ 1764.865552][T27242] bond1: entered allmulticast mode [ 1765.528917][T27265] netlink: 'syz.3.20581': attribute type 1 has an invalid length. [ 1765.716102][T27265] bond2: entered promiscuous mode [ 1765.734641][T27265] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1765.781363][T27266] bond2: (slave bridge1): making interface the new active one [ 1765.781391][T27266] bridge1: entered promiscuous mode [ 1765.782491][T27266] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 1765.926480][T27276] netlink: 'syz.0.20584': attribute type 1 has an invalid length. [ 1765.926522][T27276] netlink: 232 bytes leftover after parsing attributes in process `syz.0.20584'. [ 1765.926541][T27276] netlink: 'syz.0.20584': attribute type 1 has an invalid length. [ 1766.037168][T27280] xt_l2tp: v2 doesn't support IP mode [ 1766.188059][T27276] netlink: 'syz.0.20584': attribute type 1 has an invalid length. [ 1766.366034][ T864] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1766.388815][ T864] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1766.394618][ T864] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1766.395736][ T864] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1766.397129][ T864] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1766.584337][T27290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20586'. [ 1766.584433][T27290] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1766.584455][T27290] IPv6: NLM_F_CREATE should be set when creating new route [ 1766.584488][T27290] IPv6: NLM_F_CREATE should be set when creating new route [ 1767.480785][T27323] netlink: 232 bytes leftover after parsing attributes in process `syz.2.20595'. [ 1767.660224][T27326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20596'. [ 1767.661353][T27326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20596'. [ 1767.662634][T27326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20596'. [ 1767.663746][T27326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20596'. [ 1767.664816][T27326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20596'. [ 1767.666092][T27326] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20596'. [ 1768.002253][T27281] wg0 speed is unknown, defaulting to 1000 [ 1768.256220][T27351] openvswitch: netlink: IP tunnel dst address not specified [ 1768.256262][T27351] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1768.539519][ T9320] Bluetooth: hci0: command tx timeout [ 1768.579125][T27360] FAULT_INJECTION: forcing a failure. [ 1768.579125][T27360] name failslab, interval 1, probability 0, space 0, times 0 [ 1768.579161][T27360] CPU: 0 UID: 0 PID: 27360 Comm: syz.2.20607 Not tainted syzkaller #0 PREEMPT(full) [ 1768.579184][T27360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1768.579201][T27360] Call Trace: [ 1768.579210][T27360] [ 1768.579220][T27360] dump_stack_lvl+0xe8/0x150 [ 1768.579256][T27360] should_fail_ex+0x410/0x560 [ 1768.579285][T27360] ? __alloc_skb+0x1db/0x7a0 [ 1768.579311][T27360] should_failslab+0xa8/0x100 [ 1768.579339][T27360] ? __alloc_skb+0x1db/0x7a0 [ 1768.579369][T27360] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1768.579391][T27360] ? __alloc_skb+0x18d/0x7a0 [ 1768.579417][T27360] ? __alloc_skb+0x1db/0x7a0 [ 1768.579449][T27360] __alloc_skb+0x1db/0x7a0 [ 1768.579481][T27360] netlink_dump+0x1e7/0xee0 [ 1768.579502][T27360] ? __netlink_lookup+0xc6/0x8b0 [ 1768.579535][T27360] ? __pfx_netlink_dump+0x10/0x10 [ 1768.579569][T27360] ? netlink_lookup+0x30/0x200 [ 1768.579588][T27360] ? netlink_lookup+0x30/0x200 [ 1768.579616][T27360] __netlink_dump_start+0x589/0x7b0 [ 1768.579646][T27360] rtnetlink_rcv_msg+0xa48/0xc00 [ 1768.579676][T27360] ? __pfx_tc_dump_tclass+0x10/0x10 [ 1768.579701][T27360] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1768.579727][T27360] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1768.579751][T27360] ? ref_tracker_free+0x689/0x830 [ 1768.579775][T27360] ? __pfx_rtnl_dumpit+0x10/0x10 [ 1768.579801][T27360] ? __pfx_tc_dump_tclass+0x10/0x10 [ 1768.579840][T27360] netlink_rcv_skb+0x226/0x4a0 [ 1768.579863][T27360] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1768.579891][T27360] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1768.579928][T27360] ? netlink_deliver_tap+0x2e/0x1b0 [ 1768.579970][T27360] ? netlink_deliver_tap+0x2e/0x1b0 [ 1768.579997][T27360] netlink_unicast+0x7bd/0x940 [ 1768.580040][T27360] netlink_sendmsg+0x813/0xb40 [ 1768.580072][T27360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1768.580103][T27360] ? apparmor_socket_sendmsg+0x98/0x360 [ 1768.580131][T27360] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1768.580151][T27360] sock_sendmsg_nosec+0x13a/0x180 [ 1768.580179][T27360] ____sys_sendmsg+0x54e/0x850 [ 1768.580214][T27360] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1768.580253][T27360] ? import_iovec+0x73/0xa0 [ 1768.580284][T27360] ___sys_sendmsg+0x2a5/0x360 [ 1768.580311][T27360] ? __lock_acquire+0x747/0x2de0 [ 1768.580339][T27360] ? __pfx____sys_sendmsg+0x10/0x10 [ 1768.580416][T27360] ? __fget_files+0x2a/0x420 [ 1768.580444][T27360] ? __fget_files+0x3a2/0x420 [ 1768.580484][T27360] __x64_sys_sendmsg+0x1b1/0x290 [ 1768.580516][T27360] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1768.580571][T27360] do_syscall_64+0x166/0x520 [ 1768.580598][T27360] ? trace_irq_disable+0x3b/0x140 [ 1768.580619][T27360] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1768.580640][T27360] ? clear_bhb_loop+0x70/0xc0 [ 1768.580666][T27360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1768.580686][T27360] RIP: 0033:0x7f659ad9e159 [ 1768.580707][T27360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1768.580726][T27360] RSP: 002b:00007f659bba8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1768.580750][T27360] RAX: ffffffffffffffda RBX: 00007f659b025fa0 RCX: 00007f659ad9e159 [ 1768.580765][T27360] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 1768.580778][T27360] RBP: 00007f659bba8090 R08: 0000000000000000 R09: 0000000000000000 [ 1768.580791][T27360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1768.580804][T27360] R13: 00007f659b026038 R14: 00007f659b025fa0 R15: 00007ffc0aa4aa08 [ 1768.580839][T27360] [ 1769.375944][T27370] bond0: entered promiscuous mode [ 1769.375971][T27370] bond_slave_0: entered promiscuous mode [ 1769.376239][T27370] bond_slave_1: entered promiscuous mode [ 1769.408318][T27376] netlink: 'syz.1.20610': attribute type 21 has an invalid length. [ 1769.459642][T27370] bond0: left promiscuous mode [ 1769.459671][T27370] bond_slave_0: left promiscuous mode [ 1769.459972][T27370] bond_slave_1: left promiscuous mode [ 1769.844937][T27386] C: renamed from lo (while UP) [ 1769.869703][T27386] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1769.981715][T27281] bridge0: port 1(bridge_slave_0) entered blocking state [ 1769.981835][T27281] bridge0: port 1(bridge_slave_0) entered disabled state [ 1769.982015][T27281] bridge_slave_0: entered allmulticast mode [ 1770.019639][T27281] bridge_slave_0: entered promiscuous mode [ 1770.044700][T27281] bridge0: port 2(bridge_slave_1) entered blocking state [ 1770.044834][T27281] bridge0: port 2(bridge_slave_1) entered disabled state [ 1770.045018][T27281] bridge_slave_1: entered allmulticast mode [ 1770.079719][T27281] bridge_slave_1: entered promiscuous mode [ 1770.144148][T27281] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1770.176067][T27281] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1770.266587][T27392] __nla_validate_parse: 67 callbacks suppressed [ 1770.266613][T27392] netlink: 165 bytes leftover after parsing attributes in process `syz.3.20616'. [ 1770.318352][T27281] team0: Port device team_slave_0 added [ 1770.335908][T27281] team0: Port device team_slave_1 added [ 1770.388178][T27281] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1770.388230][T27281] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1770.388258][T27281] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1770.390639][T27281] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1770.390655][T27281] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1770.390683][T27281] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1770.548905][T27398] netlink: 4880 bytes leftover after parsing attributes in process `syz.0.20619'. [ 1770.548934][T27398] netlink: 5804 bytes leftover after parsing attributes in process `syz.0.20619'. [ 1770.622003][ T9320] Bluetooth: hci0: command tx timeout [ 1771.035629][T27281] hsr_slave_0: entered promiscuous mode [ 1771.045301][T27281] hsr_slave_1: entered promiscuous mode [ 1771.055674][T27281] debugfs: 'hsr0' already exists in 'hsr' [ 1771.055701][T27281] Cannot create hsr debugfs directory [ 1771.410262][T27417] Cannot find set identified by id 0 to match [ 1771.681965][ T864] block nbd10: Receive control failed (result -32) [ 1771.682452][ T9320] block nbd10: Receive control failed (result -32) [ 1771.940724][T27281] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1771.940764][T27281] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 1771.940791][T27281] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1771.940815][T27281] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 42299 - 0 [ 1772.499862][T27444] netlink: 165 bytes leftover after parsing attributes in process `syz.0.20634'. [ 1772.591597][T27448] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1772.699703][ T9320] Bluetooth: hci0: command tx timeout [ 1772.779345][T27281] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1772.779460][T27281] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 1772.779503][T27281] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1772.779529][T27281] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 42299 - 0 [ 1772.870240][T27456] netlink: 60 bytes leftover after parsing attributes in process `syz.3.20641'. [ 1772.872069][T27456] netlink: 60 bytes leftover after parsing attributes in process `syz.3.20641'. [ 1772.904514][T27457] netlink: 60 bytes leftover after parsing attributes in process `syz.3.20641'. [ 1773.224377][T27281] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1773.224416][T27281] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 2816 - 0 [ 1773.224443][T27281] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1773.224467][T27281] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 42299 - 0 [ 1773.345066][T27459] ±ÿ: renamed from lo (while UP) [ 1773.592657][T27474] netlink: 'syz.3.20646': attribute type 8 has an invalid length. [ 1773.829092][T27484] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1773.910541][T27486] netlink: 165 bytes leftover after parsing attributes in process `syz.1.20651'. [ 1774.069182][T27488] netlink: 'syz.3.20653': attribute type 1 has an invalid length. [ 1774.116692][T27488] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1774.246000][T27490] bond3: (slave gretap1): making interface the new active one [ 1774.247181][T27490] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 1774.446353][T27504] netlink: 'syz.2.20655': attribute type 1 has an invalid length. [ 1774.573276][T27498] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20654'. [ 1774.650725][T27281] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1774.763149][T27281] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1774.765503][T27281] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1774.781688][ T9320] Bluetooth: hci0: command tx timeout [ 1774.831742][T27281] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1775.054135][T27281] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1775.094038][T27281] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1775.120379][T27516] netlink: 165 bytes leftover after parsing attributes in process `syz.1.20661'. [ 1775.304248][T27281] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1775.318931][T27281] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1775.362743][T27518] macvlan0: entered promiscuous mode [ 1775.456747][T27523] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1775.596008][T27532] netlink: 'syz.1.20663': attribute type 1 has an invalid length. [ 1775.635723][T27536] netlink: 36 bytes leftover after parsing attributes in process `syz.3.20667'. [ 1775.752301][T27532] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1775.782993][T27281] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1775.837061][T27281] 8021q: adding VLAN 0 to HW filter on device team0 [ 1775.864127][T27532] bond1: (slave ip6gretap1): making interface the new active one [ 1775.878079][T27532] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1775.937760][T17786] bridge0: port 1(bridge_slave_0) entered blocking state [ 1775.937888][T17786] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1776.061510][ T2421] bridge0: port 2(bridge_slave_1) entered blocking state [ 1776.061639][ T2421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1776.339292][T27548] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20669'. [ 1776.497500][T27558] netlink: 165 bytes leftover after parsing attributes in process `syz.2.20672'. [ 1776.631447][T27565] FAULT_INJECTION: forcing a failure. [ 1776.631447][T27565] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1776.631483][T27565] CPU: 0 UID: 0 PID: 27565 Comm: syz.0.20673 Not tainted syzkaller #0 PREEMPT(full) [ 1776.631507][T27565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1776.631519][T27565] Call Trace: [ 1776.631528][T27565] [ 1776.631538][T27565] dump_stack_lvl+0xe8/0x150 [ 1776.631574][T27565] should_fail_ex+0x410/0x560 [ 1776.631605][T27565] _copy_from_iter+0x1d3/0x1660 [ 1776.631638][T27565] ? _copy_from_iter+0x21b/0x1660 [ 1776.631664][T27565] ? __pfx__copy_from_iter+0x10/0x10 [ 1776.631691][T27565] ? __pfx__copy_from_iter+0x10/0x10 [ 1776.631724][T27565] copy_page_from_iter+0x219/0x2d0 [ 1776.631754][T27565] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1776.631788][T27565] packet_sendmsg+0x37d0/0x5150 [ 1776.631913][T27565] ? __lock_acquire+0x747/0x2de0 [ 1776.631949][T27565] ? __lock_acquire+0x747/0x2de0 [ 1776.631977][T27565] ? kstrtouint+0x6e/0xe0 [ 1776.632006][T27565] ? __pfx_packet_sendmsg+0x10/0x10 [ 1776.632027][T27565] ? aa_sk_perm+0x713/0x900 [ 1776.632059][T27565] ? rwsem_spin_on_owner+0x60/0x250 [ 1776.632088][T27565] ? __pfx_aa_sk_perm+0x10/0x10 [ 1776.632117][T27565] ? aa_sock_msg_perm+0x144/0x210 [ 1776.632149][T27565] ? apparmor_socket_sendmsg+0x98/0x360 [ 1776.632176][T27565] ? __pfx_packet_sendmsg+0x10/0x10 [ 1776.632203][T27565] sock_sendmsg_nosec+0x13a/0x180 [ 1776.632230][T27565] __sys_sendto+0x408/0x5a0 [ 1776.632256][T27565] ? ksys_write+0x1e6/0x270 [ 1776.632281][T27565] ? __pfx___sys_sendto+0x10/0x10 [ 1776.632313][T27565] ? __mutex_unlock_slowpath+0x731/0x900 [ 1776.632373][T27565] ? __pfx_ksys_write+0x10/0x10 [ 1776.632401][T27565] __x64_sys_sendto+0xde/0x100 [ 1776.632428][T27565] do_syscall_64+0x166/0x520 [ 1776.632453][T27565] ? trace_irq_disable+0x3b/0x140 [ 1776.632474][T27565] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1776.632495][T27565] ? clear_bhb_loop+0x70/0xc0 [ 1776.632520][T27565] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1776.632541][T27565] RIP: 0033:0x7fbea459e159 [ 1776.632562][T27565] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1776.632580][T27565] RSP: 002b:00007fbea5476028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1776.632604][T27565] RAX: ffffffffffffffda RBX: 00007fbea4825fa0 RCX: 00007fbea459e159 [ 1776.632620][T27565] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1776.632634][T27565] RBP: 00007fbea5476090 R08: 0000200000000140 R09: 0000000000000014 [ 1776.632646][T27565] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 1776.632660][T27565] R13: 00007fbea4826038 R14: 00007fbea4825fa0 R15: 00007fff3bcc2cf8 [ 1776.632694][T27565] [ 1776.760840][T27558] netlink: 24 bytes leftover after parsing attributes in process `syz.2.20672'. [ 1776.761925][T27558] netlink: 24 bytes leftover after parsing attributes in process `syz.2.20672'. [ 1776.864768][ T9320] Bluetooth: hci0: command tx timeout [ 1777.016566][T27570] macvlan0: entered promiscuous mode [ 1777.098637][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 1777.586969][T27583] block nbd3: NBD_DISCONNECT [ 1777.587002][T27583] block nbd3: Send disconnect failed -32 [ 1777.587022][T27583] block nbd3: Send disconnect failed -32 [ 1777.587041][T27583] block nbd3: shutting down sockets [ 1777.766137][T27595] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1777.928687][T27595] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1778.027739][T27605] FAULT_INJECTION: forcing a failure. [ 1778.027739][T27605] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1778.027773][T27605] CPU: 0 UID: 0 PID: 27605 Comm: syz.3.20685 Not tainted syzkaller #0 PREEMPT(full) [ 1778.027798][T27605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1778.027810][T27605] Call Trace: [ 1778.027819][T27605] [ 1778.027829][T27605] dump_stack_lvl+0xe8/0x150 [ 1778.027867][T27605] should_fail_ex+0x410/0x560 [ 1778.027901][T27605] _copy_from_iter+0x1d3/0x1660 [ 1778.027934][T27605] ? _copy_from_iter+0x21b/0x1660 [ 1778.027962][T27605] ? __pfx__copy_from_iter+0x10/0x10 [ 1778.027994][T27605] ? __pfx__copy_from_iter+0x10/0x10 [ 1778.028028][T27605] copy_page_from_iter+0x219/0x2d0 [ 1778.028060][T27605] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1778.028097][T27605] packet_sendmsg+0x37d0/0x5150 [ 1778.028161][T27605] ? __lock_acquire+0x747/0x2de0 [ 1778.028217][T27605] ? __lock_acquire+0x747/0x2de0 [ 1778.028247][T27605] ? kstrtouint+0x6e/0xe0 [ 1778.028277][T27605] ? __pfx_packet_sendmsg+0x10/0x10 [ 1778.028299][T27605] ? aa_sk_perm+0x713/0x900 [ 1778.028333][T27605] ? rwsem_spin_on_owner+0x60/0x250 [ 1778.028362][T27605] ? __pfx_aa_sk_perm+0x10/0x10 [ 1778.028391][T27605] ? aa_sock_msg_perm+0x144/0x210 [ 1778.028426][T27605] ? apparmor_socket_sendmsg+0x98/0x360 [ 1778.028454][T27605] ? __pfx_packet_sendmsg+0x10/0x10 [ 1778.028477][T27605] sock_sendmsg_nosec+0x13a/0x180 [ 1778.028505][T27605] __sys_sendto+0x408/0x5a0 [ 1778.028532][T27605] ? ksys_write+0x1e6/0x270 [ 1778.028558][T27605] ? __pfx___sys_sendto+0x10/0x10 [ 1778.028582][T27605] ? __mutex_unlock_slowpath+0x731/0x900 [ 1778.028645][T27605] ? __pfx_ksys_write+0x10/0x10 [ 1778.028672][T27605] __x64_sys_sendto+0xde/0x100 [ 1778.028703][T27605] do_syscall_64+0x166/0x520 [ 1778.028729][T27605] ? trace_irq_disable+0x3b/0x140 [ 1778.028751][T27605] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1778.028773][T27605] ? clear_bhb_loop+0x70/0xc0 [ 1778.028799][T27605] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1778.028820][T27605] RIP: 0033:0x7fb43b99e159 [ 1778.028842][T27605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1778.028859][T27605] RSP: 002b:00007fb43c928028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1778.028884][T27605] RAX: ffffffffffffffda RBX: 00007fb43bc25fa0 RCX: 00007fb43b99e159 [ 1778.028899][T27605] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1778.028913][T27605] RBP: 00007fb43c928090 R08: 0000200000000140 R09: 0000000000000014 [ 1778.028928][T27605] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 1778.028940][T27605] R13: 00007fb43bc26038 R14: 00007fb43bc25fa0 R15: 00007ffdb29afe48 [ 1778.028977][T27605] [ 1778.340027][T27598] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20682'. [ 1778.393288][T27609] netlink: 165 bytes leftover after parsing attributes in process `syz.3.20686'. [ 1778.416214][T27609] netlink: 24 bytes leftover after parsing attributes in process `syz.3.20686'. [ 1778.416464][T27609] netlink: 24 bytes leftover after parsing attributes in process `syz.3.20686'. [ 1778.722694][T27616] FAULT_INJECTION: forcing a failure. [ 1778.722694][T27616] name failslab, interval 1, probability 0, space 0, times 0 [ 1778.722733][T27616] CPU: 1 UID: 0 PID: 27616 Comm: syz.2.20688 Not tainted syzkaller #0 PREEMPT(full) [ 1778.722757][T27616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1778.722769][T27616] Call Trace: [ 1778.722779][T27616] [ 1778.722788][T27616] dump_stack_lvl+0xe8/0x150 [ 1778.722824][T27616] should_fail_ex+0x410/0x560 [ 1778.722853][T27616] ? __alloc_skb+0x1db/0x7a0 [ 1778.722880][T27616] should_failslab+0xa8/0x100 [ 1778.722910][T27616] ? __alloc_skb+0x1db/0x7a0 [ 1778.722935][T27616] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1778.722957][T27616] ? __alloc_skb+0x18d/0x7a0 [ 1778.722984][T27616] ? __alloc_skb+0x1db/0x7a0 [ 1778.723019][T27616] __alloc_skb+0x1db/0x7a0 [ 1778.723050][T27616] netlink_ack+0x136/0xb30 [ 1778.723070][T27616] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1778.723098][T27616] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1778.723238][T27616] netlink_rcv_skb+0x2a4/0x4a0 [ 1778.723262][T27616] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1778.723301][T27616] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1778.723341][T27616] ? down_read+0x2be/0x330 [ 1778.723376][T27616] genl_rcv+0x28/0x40 [ 1778.723401][T27616] netlink_unicast+0x7bd/0x940 [ 1778.723450][T27616] netlink_sendmsg+0x813/0xb40 [ 1778.723483][T27616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1778.723516][T27616] ? apparmor_socket_sendmsg+0x98/0x360 [ 1778.723546][T27616] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1778.723567][T27616] sock_sendmsg_nosec+0x13a/0x180 [ 1778.723595][T27616] ____sys_sendmsg+0x54e/0x850 [ 1778.723632][T27616] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1778.723673][T27616] ? import_iovec+0x73/0xa0 [ 1778.723705][T27616] ___sys_sendmsg+0x2a5/0x360 [ 1778.723732][T27616] ? __lock_acquire+0x747/0x2de0 [ 1778.723761][T27616] ? __pfx____sys_sendmsg+0x10/0x10 [ 1778.723832][T27616] ? __fget_files+0x2a/0x420 [ 1778.723860][T27616] ? __fget_files+0x3a2/0x420 [ 1778.723902][T27616] __x64_sys_sendmsg+0x1b1/0x290 [ 1778.723935][T27616] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1778.723992][T27616] do_syscall_64+0x166/0x520 [ 1778.724019][T27616] ? trace_irq_disable+0x3b/0x140 [ 1778.724038][T27616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1778.724058][T27616] ? clear_bhb_loop+0x70/0xc0 [ 1778.724080][T27616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1778.724098][T27616] RIP: 0033:0x7f659ad9e159 [ 1778.724117][T27616] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1778.724134][T27616] RSP: 002b:00007f659bba8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1778.724156][T27616] RAX: ffffffffffffffda RBX: 00007f659b025fa0 RCX: 00007f659ad9e159 [ 1778.724170][T27616] RDX: 0000000000004000 RSI: 00002000000015c0 RDI: 0000000000000003 [ 1778.724182][T27616] RBP: 00007f659bba8090 R08: 0000000000000000 R09: 0000000000000000 [ 1778.724194][T27616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1778.724207][T27616] R13: 00007f659b026038 R14: 00007f659b025fa0 R15: 00007ffc0aa4aa08 [ 1778.724243][T27616] [ 1779.216525][ T9320] block nbd3: Receive control failed (result -32) [ 1779.216633][ T864] block nbd3: Receive control failed (result -32) [ 1779.338430][T27625] netlink: 232 bytes leftover after parsing attributes in process `syz.0.20690'. [ 1779.443056][T27281] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1779.672904][T27636] FAULT_INJECTION: forcing a failure. [ 1779.672904][T27636] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1779.672946][T27636] CPU: 0 UID: 0 PID: 27636 Comm: syz.1.20695 Not tainted syzkaller #0 PREEMPT(full) [ 1779.672969][T27636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1779.672981][T27636] Call Trace: [ 1779.672991][T27636] [ 1779.673001][T27636] dump_stack_lvl+0xe8/0x150 [ 1779.673037][T27636] should_fail_ex+0x410/0x560 [ 1779.673067][T27636] _copy_from_iter+0x1d3/0x1660 [ 1779.673101][T27636] ? _copy_from_iter+0x21b/0x1660 [ 1779.673126][T27636] ? __pfx__copy_from_iter+0x10/0x10 [ 1779.673157][T27636] ? __pfx__copy_from_iter+0x10/0x10 [ 1779.673194][T27636] copy_page_from_iter+0x219/0x2d0 [ 1779.673223][T27636] skb_copy_datagram_from_iter+0x2f4/0x720 [ 1779.673365][T27636] packet_sendmsg+0x37d0/0x5150 [ 1779.673415][T27636] ? __lock_acquire+0x747/0x2de0 [ 1779.673469][T27636] ? __lock_acquire+0x747/0x2de0 [ 1779.673497][T27636] ? kstrtouint+0x6e/0xe0 [ 1779.673526][T27636] ? __pfx_packet_sendmsg+0x10/0x10 [ 1779.673549][T27636] ? aa_sk_perm+0x713/0x900 [ 1779.673583][T27636] ? rwsem_spin_on_owner+0x60/0x250 [ 1779.673611][T27636] ? __pfx_aa_sk_perm+0x10/0x10 [ 1779.673639][T27636] ? aa_sock_msg_perm+0x144/0x210 [ 1779.673671][T27636] ? apparmor_socket_sendmsg+0x98/0x360 [ 1779.673706][T27636] ? __pfx_packet_sendmsg+0x10/0x10 [ 1779.673731][T27636] sock_sendmsg_nosec+0x13a/0x180 [ 1779.673761][T27636] __sys_sendto+0x408/0x5a0 [ 1779.673790][T27636] ? ksys_write+0x1e6/0x270 [ 1779.673813][T27636] ? __pfx___sys_sendto+0x10/0x10 [ 1779.673837][T27636] ? __mutex_unlock_slowpath+0x731/0x900 [ 1779.673897][T27636] ? __pfx_ksys_write+0x10/0x10 [ 1779.673928][T27636] __x64_sys_sendto+0xde/0x100 [ 1779.673959][T27636] do_syscall_64+0x166/0x520 [ 1779.673987][T27636] ? trace_irq_disable+0x3b/0x140 [ 1779.674008][T27636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1779.674030][T27636] ? clear_bhb_loop+0x70/0xc0 [ 1779.674056][T27636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1779.674078][T27636] RIP: 0033:0x7f2f9f19e159 [ 1779.674102][T27636] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1779.674121][T27636] RSP: 002b:00007f2fa0007028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1779.674147][T27636] RAX: ffffffffffffffda RBX: 00007f2f9f425fa0 RCX: 00007f2f9f19e159 [ 1779.674162][T27636] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1779.674176][T27636] RBP: 00007f2fa0007090 R08: 0000200000000140 R09: 0000000000000014 [ 1779.674189][T27636] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000002 [ 1779.674203][T27636] R13: 00007f2f9f426038 R14: 00007f2f9f425fa0 R15: 00007ffddc8db468 [ 1779.674239][T27636] [ 1780.166418][T27653] macvlan0: entered promiscuous mode [ 1780.793669][T27667] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 1780.819284][T27658] __nla_validate_parse: 6 callbacks suppressed [ 1780.819310][T27658] netlink: 20 bytes leftover after parsing attributes in process `syz.2.20701'. [ 1780.819332][T27658] nbd: nbd64 already in use [ 1780.819757][T27666] netlink: 'syz.1.20704': attribute type 1 has an invalid length. [ 1780.819785][T27666] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.20704'. [ 1780.819802][T27666] netlink: 'syz.1.20704': attribute type 1 has an invalid length. [ 1780.819816][T27666] netlink: 2016 bytes leftover after parsing attributes in process `syz.1.20704'. [ 1781.053400][T27281] veth0_vlan: entered promiscuous mode [ 1781.136853][T27672] netlink: 'syz.0.20705': attribute type 2 has an invalid length. [ 1781.336828][T27672] : entered promiscuous mode [ 1781.373650][T27281] veth1_vlan: entered promiscuous mode [ 1781.402120][T27682] netlink: 232 bytes leftover after parsing attributes in process `syz.1.20706'. [ 1781.554443][T27427] udevd[27427]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1781.703695][T27281] veth0_macvtap: entered promiscuous mode [ 1781.746083][T27281] veth1_macvtap: entered promiscuous mode [ 1781.796345][T27281] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1781.956506][T27694] macvlan0: entered promiscuous mode [ 1781.985520][T27281] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1782.064472][T27697] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20713'. [ 1782.151112][T27697] netlink: 'syz.3.20713': attribute type 1 has an invalid length. [ 1782.152136][T27695] netlink: 68 bytes leftover after parsing attributes in process `syz.2.20712'. [ 1782.154279][T17785] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1782.159601][T17785] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1782.161881][T17785] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1782.161917][T17785] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1782.676277][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1782.676305][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1782.809462][T27714] netlink: 232 bytes leftover after parsing attributes in process `syz.1.20719'. [ 1782.987080][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1782.987105][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1783.443961][T27722] nbd: couldn't find a device at index 0 [ 1783.476217][T27724] netlink: 36 bytes leftover after parsing attributes in process `syz.2.20721'. [ 1783.753027][T27731] netlink: 16 bytes leftover after parsing attributes in process `syz.3.20722'. [ 1783.754715][T27731] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20722'. [ 1784.343402][T27749] 8021q: VLANs not supported on gre0 [ 1784.600386][T27757] netlink: 'syz.1.20727': attribute type 10 has an invalid length. [ 1784.628657][T27763] Cannot find set identified by id 0 to match [ 1784.769111][T27757] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1784.808652][T27757] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 1785.168001][ T43] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1785.200518][ T2421] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1785.200597][ T2421] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1785.200632][ T2421] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1786.240755][T27803] Cannot find set identified by id 0 to match [ 1786.616497][T27815] vlan3: entered allmulticast mode [ 1786.616524][T27815] bond0: entered allmulticast mode [ 1786.616537][T27815] bond_slave_0: entered allmulticast mode [ 1786.616955][T27815] bond_slave_1: entered allmulticast mode [ 1786.718930][T27817] xfrm1: entered allmulticast mode [ 1786.808824][T27823] Bluetooth: MGMT ver 1.23 [ 1786.808869][T27823] Bluetooth: hci0: unsupported parameter 5161 [ 1786.808885][T27823] Bluetooth: hci0: unsupported parameter 8192 [ 1786.808898][T27823] Bluetooth: hci0: unsupported parameter 5161 [ 1786.808910][T27823] Bluetooth: hci0: unsupported parameter 8192 [ 1787.076706][T27829] __nla_validate_parse: 5 callbacks suppressed [ 1787.076734][T27829] netlink: 36 bytes leftover after parsing attributes in process `syz.4.20750'. [ 1787.518542][T27847] netlink: 12 bytes leftover after parsing attributes in process `syz.0.20759'. [ 1787.669839][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1787.754750][T27855] netlink: 'syz.4.20762': attribute type 10 has an invalid length. [ 1787.900589][T27855] 8021q: adding VLAN 0 to HW filter on device team0 [ 1787.912380][T27855] bond0: (slave team0): Enslaving as an active interface with an up link [ 1788.135261][T27864] tipc: Enabling of bearer rejected, failed to enable media [ 1788.585059][T27858] openvswitch: netlink: Multiple metadata blocks provided [ 1788.651911][T27876] netlink: 16 bytes leftover after parsing attributes in process `syz.2.20766'. [ 1788.769741][T27882] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1789.129801][T27888] netlink: 'syz.1.20773': attribute type 1 has an invalid length. [ 1789.198907][T27888] bond3: entered promiscuous mode [ 1789.202891][T27888] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1789.599000][T27897] FAULT_INJECTION: forcing a failure. [ 1789.599000][T27897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1789.599035][T27897] CPU: 0 UID: 0 PID: 27897 Comm: syz.4.20775 Not tainted syzkaller #0 PREEMPT(full) [ 1789.599058][T27897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1789.599070][T27897] Call Trace: [ 1789.599079][T27897] [ 1789.599089][T27897] dump_stack_lvl+0xe8/0x150 [ 1789.599124][T27897] should_fail_ex+0x410/0x560 [ 1789.599157][T27897] _copy_to_user+0x31/0xb0 [ 1789.599191][T27897] simple_read_from_buffer+0xe1/0x170 [ 1789.599235][T27897] proc_fail_nth_read+0x1bb/0x230 [ 1789.599255][T27897] ? common_file_perm+0x20e/0x2b0 [ 1789.599285][T27897] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1789.599310][T27897] ? rw_verify_area+0x24a/0x4c0 [ 1789.599342][T27897] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1789.599362][T27897] vfs_read+0x213/0xa80 [ 1789.599399][T27897] ? __pfx___mutex_lock+0x10/0x10 [ 1789.599429][T27897] ? __pfx_vfs_read+0x10/0x10 [ 1789.599460][T27897] ? __fget_files+0x2a/0x420 [ 1789.599493][T27897] ? __fget_files+0x3a2/0x420 [ 1789.599521][T27897] ? __fget_files+0x2a/0x420 [ 1789.599559][T27897] ksys_read+0x150/0x270 [ 1789.599582][T27897] ? __pfx_ksys_read+0x10/0x10 [ 1789.599615][T27897] do_syscall_64+0x166/0x520 [ 1789.599642][T27897] ? trace_irq_disable+0x3b/0x140 [ 1789.599663][T27897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1789.599683][T27897] ? clear_bhb_loop+0x70/0xc0 [ 1789.599709][T27897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1789.599728][T27897] RIP: 0033:0x7f4d7815e98e [ 1789.599749][T27897] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1789.599766][T27897] RSP: 002b:00007f4d79035fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1789.599811][T27897] RAX: ffffffffffffffda RBX: 00007f4d790366c0 RCX: 00007f4d7815e98e [ 1789.599826][T27897] RDX: 000000000000000f RSI: 00007f4d790360a0 RDI: 0000000000000004 [ 1789.599839][T27897] RBP: 00007f4d79036090 R08: 0000000000000000 R09: 0000000000000000 [ 1789.599851][T27897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1789.599863][T27897] R13: 00007f4d78426038 R14: 00007f4d78425fa0 R15: 00007ffe33b00d18 [ 1789.599899][T27897] [ 1790.603181][T27924] FAULT_INJECTION: forcing a failure. [ 1790.603181][T27924] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1790.603224][T27924] CPU: 1 UID: 0 PID: 27924 Comm: syz.4.20784 Not tainted syzkaller #0 PREEMPT(full) [ 1790.603247][T27924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1790.603258][T27924] Call Trace: [ 1790.603266][T27924] [ 1790.603275][T27924] dump_stack_lvl+0xe8/0x150 [ 1790.603311][T27924] should_fail_ex+0x410/0x560 [ 1790.603341][T27924] _copy_to_user+0x31/0xb0 [ 1790.603375][T27924] simple_read_from_buffer+0xe1/0x170 [ 1790.603409][T27924] proc_fail_nth_read+0x1bb/0x230 [ 1790.603429][T27924] ? common_file_perm+0x20e/0x2b0 [ 1790.603456][T27924] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1790.603480][T27924] ? rw_verify_area+0x24a/0x4c0 [ 1790.603510][T27924] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1790.603530][T27924] vfs_read+0x213/0xa80 [ 1790.603566][T27924] ? __pfx___mutex_lock+0x10/0x10 [ 1790.603595][T27924] ? __pfx_vfs_read+0x10/0x10 [ 1790.603627][T27924] ? __fget_files+0x2a/0x420 [ 1790.603661][T27924] ? __fget_files+0x3a2/0x420 [ 1790.603687][T27924] ? __fget_files+0x2a/0x420 [ 1790.603724][T27924] ksys_read+0x150/0x270 [ 1790.603748][T27924] ? __pfx_ksys_read+0x10/0x10 [ 1790.603782][T27924] do_syscall_64+0x166/0x520 [ 1790.603810][T27924] ? trace_irq_disable+0x3b/0x140 [ 1790.603831][T27924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1790.603852][T27924] ? clear_bhb_loop+0x70/0xc0 [ 1790.603875][T27924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1790.603894][T27924] RIP: 0033:0x7f4d7815e98e [ 1790.603914][T27924] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1790.603930][T27924] RSP: 002b:00007f4d79014fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1790.603953][T27924] RAX: ffffffffffffffda RBX: 00007f4d790156c0 RCX: 00007f4d7815e98e [ 1790.603968][T27924] RDX: 000000000000000f RSI: 00007f4d790150a0 RDI: 0000000000000006 [ 1790.603982][T27924] RBP: 00007f4d79015090 R08: 0000000000000000 R09: 0000000000000000 [ 1790.603996][T27924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1790.604009][T27924] R13: 00007f4d78426128 R14: 00007f4d78426090 R15: 00007ffe33b00d18 [ 1790.604047][T27924] [ 1791.295784][T27935] FAULT_INJECTION: forcing a failure. [ 1791.295784][T27935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1791.295820][T27935] CPU: 0 UID: 0 PID: 27935 Comm: syz.3.20788 Not tainted syzkaller #0 PREEMPT(full) [ 1791.295844][T27935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1791.295857][T27935] Call Trace: [ 1791.295866][T27935] [ 1791.295877][T27935] dump_stack_lvl+0xe8/0x150 [ 1791.295913][T27935] should_fail_ex+0x410/0x560 [ 1791.295945][T27935] _copy_from_user+0x2d/0xb0 [ 1791.295975][T27935] ___sys_sendmsg+0x1c6/0x360 [ 1791.296006][T27935] ? __lock_acquire+0x747/0x2de0 [ 1791.296035][T27935] ? __pfx____sys_sendmsg+0x10/0x10 [ 1791.296104][T27935] ? __fget_files+0x2a/0x420 [ 1791.296133][T27935] ? __fget_files+0x3a2/0x420 [ 1791.296171][T27935] __x64_sys_sendmsg+0x1b1/0x290 [ 1791.296207][T27935] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1791.296259][T27935] do_syscall_64+0x166/0x520 [ 1791.296286][T27935] ? trace_irq_disable+0x3b/0x140 [ 1791.296308][T27935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1791.296329][T27935] ? clear_bhb_loop+0x70/0xc0 [ 1791.296355][T27935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1791.296375][T27935] RIP: 0033:0x7fb43b99e159 [ 1791.296395][T27935] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1791.296413][T27935] RSP: 002b:00007fb43c928028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1791.296436][T27935] RAX: ffffffffffffffda RBX: 00007fb43bc25fa0 RCX: 00007fb43b99e159 [ 1791.296451][T27935] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1791.296464][T27935] RBP: 00007fb43c928090 R08: 0000000000000000 R09: 0000000000000000 [ 1791.296477][T27935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1791.296490][T27935] R13: 00007fb43bc26038 R14: 00007fb43bc25fa0 R15: 00007ffdb29afe48 [ 1791.296524][T27935] [ 1791.329831][T27936] netlink: 'syz.4.20789': attribute type 2 has an invalid length. [ 1791.329866][T27936] netlink: 188 bytes leftover after parsing attributes in process `syz.4.20789'. [ 1791.333075][T27936] netlink: 'syz.4.20789': attribute type 1 has an invalid length. [ 1791.804375][T27938] ipvlan2: entered allmulticast mode [ 1791.804403][T27938] veth0_vlan: entered allmulticast mode [ 1792.078403][T27952] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1792.291912][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.292513][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.293046][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.294327][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.320322][T17786] IPVS: starting estimator thread 0... [ 1792.332885][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.333492][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.333958][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.335759][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.403312][T27955] xt_TCPMSS: Only works on TCP SYN packets [ 1792.428634][T27960] IPVS: using max 26 ests per chain, 62400 per kthread [ 1792.496574][T27965] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20796'. [ 1792.496602][T27965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20796'. [ 1792.496628][T27965] netlink: 'syz.2.20796': attribute type 12 has an invalid length. [ 1792.496643][T27965] netlink: 'syz.2.20796': attribute type 11 has an invalid length. [ 1792.920064][T27973] FAULT_INJECTION: forcing a failure. [ 1792.920064][T27973] name failslab, interval 1, probability 0, space 0, times 0 [ 1792.920102][T27973] CPU: 1 UID: 0 PID: 27973 Comm: syz.1.20800 Not tainted syzkaller #0 PREEMPT(full) [ 1792.920126][T27973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1792.920139][T27973] Call Trace: [ 1792.920148][T27973] [ 1792.920157][T27973] dump_stack_lvl+0xe8/0x150 [ 1792.920192][T27973] should_fail_ex+0x410/0x560 [ 1792.920221][T27973] ? __alloc_skb+0x1db/0x7a0 [ 1792.920248][T27973] should_failslab+0xa8/0x100 [ 1792.920278][T27973] ? __alloc_skb+0x1db/0x7a0 [ 1792.920303][T27973] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1792.920325][T27973] ? __alloc_skb+0x18d/0x7a0 [ 1792.920352][T27973] ? __alloc_skb+0x1db/0x7a0 [ 1792.920391][T27973] __alloc_skb+0x1db/0x7a0 [ 1792.920424][T27973] netlink_sendmsg+0x5d4/0xb40 [ 1792.920458][T27973] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1792.920488][T27973] ? apparmor_socket_sendmsg+0x98/0x360 [ 1792.920513][T27973] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1792.920533][T27973] sock_sendmsg_nosec+0x13a/0x180 [ 1792.920560][T27973] ____sys_sendmsg+0x54e/0x850 [ 1792.920595][T27973] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1792.920635][T27973] ? import_iovec+0x73/0xa0 [ 1792.920676][T27973] ___sys_sendmsg+0x2a5/0x360 [ 1792.920704][T27973] ? __lock_acquire+0x747/0x2de0 [ 1792.920733][T27973] ? __pfx____sys_sendmsg+0x10/0x10 [ 1792.920803][T27973] ? __fget_files+0x2a/0x420 [ 1792.920832][T27973] ? __fget_files+0x3a2/0x420 [ 1792.920871][T27973] __x64_sys_sendmsg+0x1b1/0x290 [ 1792.920903][T27973] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1792.920957][T27973] do_syscall_64+0x166/0x520 [ 1792.920988][T27973] ? trace_irq_disable+0x3b/0x140 [ 1792.921011][T27973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1792.921032][T27973] ? clear_bhb_loop+0x70/0xc0 [ 1792.921059][T27973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1792.921080][T27973] RIP: 0033:0x7f2f9f19e159 [ 1792.921102][T27973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1792.921120][T27973] RSP: 002b:00007f2fa0007028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1792.921144][T27973] RAX: ffffffffffffffda RBX: 00007f2f9f425fa0 RCX: 00007f2f9f19e159 [ 1792.921159][T27973] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1792.921172][T27973] RBP: 00007f2fa0007090 R08: 0000000000000000 R09: 0000000000000000 [ 1792.921187][T27973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1792.921199][T27973] R13: 00007f2f9f426038 R14: 00007f2f9f425fa0 R15: 00007ffddc8db468 [ 1792.921233][T27973] [ 1793.153538][T27974] netlink: 4 bytes leftover after parsing attributes in process `syz.2.20798'. [ 1793.196019][T27976] FAULT_INJECTION: forcing a failure. [ 1793.196019][T27976] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1793.196053][T27976] CPU: 0 UID: 0 PID: 27976 Comm: syz.1.20802 Not tainted syzkaller #0 PREEMPT(full) [ 1793.196073][T27976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1793.196085][T27976] Call Trace: [ 1793.196093][T27976] [ 1793.196101][T27976] dump_stack_lvl+0xe8/0x150 [ 1793.196135][T27976] should_fail_ex+0x410/0x560 [ 1793.196162][T27976] _copy_from_user+0x2d/0xb0 [ 1793.196193][T27976] ___sys_sendmsg+0x1c6/0x360 [ 1793.196219][T27976] ? __lock_acquire+0x747/0x2de0 [ 1793.196245][T27976] ? __pfx____sys_sendmsg+0x10/0x10 [ 1793.196306][T27976] ? __fget_files+0x2a/0x420 [ 1793.196331][T27976] ? __fget_files+0x3a2/0x420 [ 1793.196367][T27976] __x64_sys_sendmsg+0x1b1/0x290 [ 1793.196396][T27976] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1793.196443][T27976] do_syscall_64+0x166/0x520 [ 1793.196468][T27976] ? trace_irq_disable+0x3b/0x140 [ 1793.196487][T27976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1793.196507][T27976] ? clear_bhb_loop+0x70/0xc0 [ 1793.196530][T27976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1793.196549][T27976] RIP: 0033:0x7f2f9f19e159 [ 1793.196569][T27976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1793.196586][T27976] RSP: 002b:00007f2fa0007028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1793.196610][T27976] RAX: ffffffffffffffda RBX: 00007f2f9f425fa0 RCX: 00007f2f9f19e159 [ 1793.196623][T27976] RDX: 0000000000000080 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1793.196635][T27976] RBP: 00007f2fa0007090 R08: 0000000000000000 R09: 0000000000000000 [ 1793.196649][T27976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1793.196663][T27976] R13: 00007f2f9f426038 R14: 00007f2f9f425fa0 R15: 00007ffddc8db468 [ 1793.196708][T27976] [ 1793.273020][T27980] netlink: 112 bytes leftover after parsing attributes in process `syz.2.20798'. [ 1793.437093][T27981] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20801'. [ 1793.437122][T27981] netlink: 24 bytes leftover after parsing attributes in process `syz.0.20801'. [ 1793.459346][T27981] openvswitch: netlink: IPv4 tun info is not correct [ 1793.510428][T27986] netlink: 28 bytes leftover after parsing attributes in process `syz.1.20805'. [ 1793.634894][T27986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.20805'. [ 1793.869062][T27998] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 1795.341074][T28048] netlink: 'syz.2.20824': attribute type 21 has an invalid length. [ 1795.385773][T28053] netlink: 232 bytes leftover after parsing attributes in process `syz.4.20825'. [ 1795.644753][T28059] FAULT_INJECTION: forcing a failure. [ 1795.644753][T28059] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1795.644790][T28059] CPU: 0 UID: 0 PID: 28059 Comm: syz.4.20829 Not tainted syzkaller #0 PREEMPT(full) [ 1795.644814][T28059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1795.644826][T28059] Call Trace: [ 1795.644836][T28059] [ 1795.644845][T28059] dump_stack_lvl+0xe8/0x150 [ 1795.644882][T28059] should_fail_ex+0x410/0x560 [ 1795.644914][T28059] _copy_from_iter+0x1d3/0x1660 [ 1795.644940][T28059] ? __alloc_skb+0x27a/0x7a0 [ 1795.644968][T28059] ? __alloc_skb+0x27a/0x7a0 [ 1795.644994][T28059] ? __alloc_skb+0x27a/0x7a0 [ 1795.645019][T28059] ? __pfx__copy_from_iter+0x10/0x10 [ 1795.645040][T28059] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1795.645061][T28059] ? __alloc_skb+0x27a/0x7a0 [ 1795.645083][T28059] ? __alloc_skb+0x27a/0x7a0 [ 1795.645115][T28059] ? netlink_sendmsg+0x650/0xb40 [ 1795.645137][T28059] ? skb_put+0x112/0x210 [ 1795.645236][T28059] netlink_sendmsg+0x6c0/0xb40 [ 1795.645292][T28059] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1795.645325][T28059] ? apparmor_socket_sendmsg+0x98/0x360 [ 1795.645359][T28059] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1795.645379][T28059] sock_sendmsg_nosec+0x13a/0x180 [ 1795.645407][T28059] ____sys_sendmsg+0x54e/0x850 [ 1795.645443][T28059] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1795.645482][T28059] ? import_iovec+0x73/0xa0 [ 1795.645514][T28059] ___sys_sendmsg+0x2a5/0x360 [ 1795.645542][T28059] ? __lock_acquire+0x747/0x2de0 [ 1795.645570][T28059] ? __pfx____sys_sendmsg+0x10/0x10 [ 1795.645637][T28059] ? __fget_files+0x2a/0x420 [ 1795.645666][T28059] ? __fget_files+0x3a2/0x420 [ 1795.645719][T28059] __x64_sys_sendmsg+0x1b1/0x290 [ 1795.645760][T28059] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1795.645813][T28059] do_syscall_64+0x166/0x520 [ 1795.645842][T28059] ? trace_irq_disable+0x3b/0x140 [ 1795.645864][T28059] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1795.645886][T28059] ? clear_bhb_loop+0x70/0xc0 [ 1795.645911][T28059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1795.645933][T28059] RIP: 0033:0x7f4d7819e159 [ 1795.645957][T28059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1795.645975][T28059] RSP: 002b:00007f4d79036028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1795.646000][T28059] RAX: ffffffffffffffda RBX: 00007f4d78425fa0 RCX: 00007f4d7819e159 [ 1795.646015][T28059] RDX: 0000000000000080 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1795.646029][T28059] RBP: 00007f4d79036090 R08: 0000000000000000 R09: 0000000000000000 [ 1795.646043][T28059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1795.646056][T28059] R13: 00007f4d78426038 R14: 00007f4d78425fa0 R15: 00007ffe33b00d18 [ 1795.646090][T28059] [ 1795.677945][T28056] netlink: Unknown nat attribute (0) [ 1795.677984][T28056] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1795.701031][T28060] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1796.056309][T28066] block nbd4: NBD_DISCONNECT [ 1796.056390][T28066] block nbd4: Send disconnect failed -32 [ 1796.056413][T28066] block nbd4: shutting down sockets [ 1796.096003][T28060] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1796.186371][T28061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20828'. [ 1796.591529][T28080] FAULT_INJECTION: forcing a failure. [ 1796.591529][T28080] name failslab, interval 1, probability 0, space 0, times 0 [ 1796.591567][T28080] CPU: 0 UID: 0 PID: 28080 Comm: syz.0.20835 Not tainted syzkaller #0 PREEMPT(full) [ 1796.591590][T28080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1796.591603][T28080] Call Trace: [ 1796.591612][T28080] [ 1796.591622][T28080] dump_stack_lvl+0xe8/0x150 [ 1796.591657][T28080] should_fail_ex+0x410/0x560 [ 1796.591687][T28080] ? __alloc_skb+0x1db/0x7a0 [ 1796.591712][T28080] should_failslab+0xa8/0x100 [ 1796.591740][T28080] ? __alloc_skb+0x1db/0x7a0 [ 1796.591763][T28080] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1796.591791][T28080] ? __alloc_skb+0x18d/0x7a0 [ 1796.591817][T28080] ? __alloc_skb+0x1db/0x7a0 [ 1796.591850][T28080] __alloc_skb+0x1db/0x7a0 [ 1796.591882][T28080] netlink_ack+0x136/0xb30 [ 1796.591923][T28080] netlink_rcv_skb+0x2a4/0x4a0 [ 1796.591946][T28080] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1796.591980][T28080] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1796.592013][T28080] ? bpf_lsm_capable+0x9/0x20 [ 1796.592033][T28080] ? security_capable+0x7e/0x2c0 [ 1796.592067][T28080] nfnetlink_rcv+0x2b9/0x28c0 [ 1796.592101][T28080] ? __dev_queue_xmit+0x29b/0x3920 [ 1796.592126][T28080] ? __local_bh_enable_ip+0xd6/0x140 [ 1796.592165][T28080] ? lockdep_hardirqs_on+0x7b/0x110 [ 1796.592197][T28080] ? __dev_queue_xmit+0x29b/0x3920 [ 1796.592215][T28080] ? __local_bh_enable_ip+0xd6/0x140 [ 1796.592239][T28080] ? __dev_queue_xmit+0x29b/0x3920 [ 1796.592257][T28080] ? __dev_queue_xmit+0x1efb/0x3920 [ 1796.592275][T28080] ? do_syscall_64+0x166/0x520 [ 1796.592305][T28080] ? __dev_queue_xmit+0x29b/0x3920 [ 1796.592336][T28080] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1796.592371][T28080] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1796.592400][T28080] ? ref_tracker_free+0x689/0x830 [ 1796.592430][T28080] ? __pfx_ref_tracker_free+0x10/0x10 [ 1796.592465][T28080] ? __skb_clone+0x449/0x6c0 [ 1796.592501][T28080] ? skb_clone+0x246/0x3a0 [ 1796.592533][T28080] ? __netlink_deliver_tap+0x811/0x860 [ 1796.592553][T28080] ? netlink_deliver_tap+0x2e/0x1b0 [ 1796.592581][T28080] ? netlink_deliver_tap+0x2e/0x1b0 [ 1796.592600][T28080] ? netlink_deliver_tap+0x2e/0x1b0 [ 1796.592626][T28080] netlink_unicast+0x7bd/0x940 [ 1796.592662][T28080] netlink_sendmsg+0x813/0xb40 [ 1796.592692][T28080] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1796.592722][T28080] ? apparmor_socket_sendmsg+0x98/0x360 [ 1796.592748][T28080] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1796.592767][T28080] sock_sendmsg_nosec+0x13a/0x180 [ 1796.592792][T28080] ____sys_sendmsg+0x54e/0x850 [ 1796.592828][T28080] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1796.592867][T28080] ? import_iovec+0x73/0xa0 [ 1796.592898][T28080] ___sys_sendmsg+0x2a5/0x360 [ 1796.592927][T28080] ? __lock_acquire+0x747/0x2de0 [ 1796.592955][T28080] ? __pfx____sys_sendmsg+0x10/0x10 [ 1796.593022][T28080] ? __fget_files+0x2a/0x420 [ 1796.593051][T28080] ? __fget_files+0x3a2/0x420 [ 1796.593092][T28080] __x64_sys_sendmsg+0x1b1/0x290 [ 1796.593126][T28080] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1796.593186][T28080] do_syscall_64+0x166/0x520 [ 1796.593213][T28080] ? trace_irq_disable+0x3b/0x140 [ 1796.593235][T28080] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1796.593256][T28080] ? clear_bhb_loop+0x70/0xc0 [ 1796.593282][T28080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1796.593303][T28080] RIP: 0033:0x7fbea459e159 [ 1796.593324][T28080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1796.593343][T28080] RSP: 002b:00007fbea5476028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1796.593365][T28080] RAX: ffffffffffffffda RBX: 00007fbea4825fa0 RCX: 00007fbea459e159 [ 1796.593380][T28080] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1796.593393][T28080] RBP: 00007fbea5476090 R08: 0000000000000000 R09: 0000000000000000 [ 1796.593406][T28080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1796.593419][T28080] R13: 00007fbea4826038 R14: 00007fbea4825fa0 R15: 00007fff3bcc2cf8 [ 1796.593453][T28080] [ 1796.868440][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1796.868970][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1797.002558][T28075] syzkaller0: entered promiscuous mode [ 1797.002771][T28075] syzkaller0: entered allmulticast mode [ 1797.178463][T24447] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1797.185706][T24447] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1797.185762][T24447] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1797.185799][T24447] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1797.363684][T28097] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 1797.435164][T28100] netlink: 'syz.0.20840': attribute type 21 has an invalid length. [ 1797.435221][T28100] IPv6: NLM_F_CREATE should be specified when creating new route [ 1797.577325][T28100] netlink: 8 bytes leftover after parsing attributes in process `syz.0.20840'. [ 1797.608499][T28100] netlink: 9 bytes leftover after parsing attributes in process `syz.0.20840'. [ 1797.646819][T28108] netlink: 36 bytes leftover after parsing attributes in process `syz.2.20841'. [ 1797.656398][T28100] 0·: renamed from hsr0 (while UP) [ 1797.696053][T28100] 0·: entered allmulticast mode [ 1797.696082][T28100] hsr_slave_0: entered allmulticast mode [ 1797.696503][T28100] hsr_slave_1: entered allmulticast mode [ 1797.704659][T28100] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 1798.096598][T28119] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20845'. [ 1798.146328][T28125] netlink: 20 bytes leftover after parsing attributes in process `syz.1.20842'. [ 1798.190441][T28127] batadv_slave_0: entered promiscuous mode [ 1798.226038][T28129] netlink: 232 bytes leftover after parsing attributes in process `syz.2.20846'. [ 1798.340409][T28138] netlink: 44 bytes leftover after parsing attributes in process `syz.0.20847'. [ 1798.572592][T28126] batadv_slave_0: left promiscuous mode [ 1799.015357][T28157] netlink: 88 bytes leftover after parsing attributes in process `syz.3.20857'. [ 1799.305696][T28168] netlink: 32 bytes leftover after parsing attributes in process `syz.2.20860'. [ 1799.596341][T28168] netlink: 'syz.2.20860': attribute type 1 has an invalid length. [ 1799.612160][T28172] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1800.383363][T28208] netlink: 4880 bytes leftover after parsing attributes in process `syz.0.20875'. [ 1800.709216][T28217] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1801.509780][T28248] erspan0: entered promiscuous mode [ 1802.354143][T28269] netlink: 'syz.2.20893': attribute type 1 has an invalid length. [ 1802.354214][T28269] netlink: 'syz.2.20893': attribute type 2 has an invalid length. [ 1802.697108][T28281] __nla_validate_parse: 6 callbacks suppressed [ 1802.697130][T28281] netlink: 256 bytes leftover after parsing attributes in process `syz.4.20898'. [ 1802.924574][T28284] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20899'. [ 1803.544178][T28290] netlink: 20 bytes leftover after parsing attributes in process `syz.3.20899'. [ 1803.544243][T28290] nbd: device at index 64 is going down [ 1803.942459][T28302] udevd[28302]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1803.962738][T28302] udevd[28302]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1804.093167][T28317] netlink: 28 bytes leftover after parsing attributes in process `syz.2.20909'. [ 1804.093237][T28317] netlink: 'syz.2.20909': attribute type 8 has an invalid length. [ 1804.093254][T28317] netlink: 16 bytes leftover after parsing attributes in process `syz.2.20909'. [ 1804.130680][T28312] netlink: 28 bytes leftover after parsing attributes in process `syz.3.20908'. [ 1804.290510][T28324] netlink: 'syz.4.20911': attribute type 32 has an invalid length. [ 1804.290536][T28324] netlink: 8 bytes leftover after parsing attributes in process `syz.4.20911'. [ 1804.572689][T28324] bond1: Setting coupled_control to off (0) [ 1804.987071][T28338] netlink: 16 bytes leftover after parsing attributes in process `syz.4.20915'. [ 1805.068674][T28344] FAULT_INJECTION: forcing a failure. [ 1805.068674][T28344] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1805.068709][T28344] CPU: 0 UID: 0 PID: 28344 Comm: syz.1.20916 Not tainted syzkaller #0 PREEMPT(full) [ 1805.068733][T28344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1805.068744][T28344] Call Trace: [ 1805.068752][T28344] [ 1805.068762][T28344] dump_stack_lvl+0xe8/0x150 [ 1805.068796][T28344] should_fail_ex+0x410/0x560 [ 1805.068826][T28344] _copy_from_iter+0x1d3/0x1660 [ 1805.068853][T28344] ? __alloc_skb+0x27a/0x7a0 [ 1805.068882][T28344] ? __alloc_skb+0x27a/0x7a0 [ 1805.068911][T28344] ? __alloc_skb+0x27a/0x7a0 [ 1805.068936][T28344] ? __pfx__copy_from_iter+0x10/0x10 [ 1805.068960][T28344] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1805.068980][T28344] ? __alloc_skb+0x27a/0x7a0 [ 1805.069004][T28344] ? __alloc_skb+0x27a/0x7a0 [ 1805.069036][T28344] ? netlink_sendmsg+0x650/0xb40 [ 1805.069058][T28344] ? skb_put+0x112/0x210 [ 1805.069089][T28344] netlink_sendmsg+0x6c0/0xb40 [ 1805.069120][T28344] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1805.069153][T28344] ? apparmor_socket_sendmsg+0x98/0x360 [ 1805.069184][T28344] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1805.069205][T28344] sock_sendmsg_nosec+0x13a/0x180 [ 1805.069231][T28344] ____sys_sendmsg+0x54e/0x850 [ 1805.069262][T28344] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1805.069297][T28344] ? import_iovec+0x73/0xa0 [ 1805.069326][T28344] ___sys_sendmsg+0x2a5/0x360 [ 1805.069352][T28344] ? __lock_acquire+0x747/0x2de0 [ 1805.069378][T28344] ? __pfx____sys_sendmsg+0x10/0x10 [ 1805.069445][T28344] ? __fget_files+0x2a/0x420 [ 1805.069472][T28344] ? __fget_files+0x3a2/0x420 [ 1805.069511][T28344] __x64_sys_sendmsg+0x1b1/0x290 [ 1805.069544][T28344] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1805.069608][T28344] do_syscall_64+0x166/0x520 [ 1805.069637][T28344] ? trace_irq_disable+0x3b/0x140 [ 1805.069658][T28344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1805.069678][T28344] ? clear_bhb_loop+0x70/0xc0 [ 1805.069703][T28344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1805.069723][T28344] RIP: 0033:0x7f2f9f19e159 [ 1805.069744][T28344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1805.069762][T28344] RSP: 002b:00007f2fa0007028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1805.069786][T28344] RAX: ffffffffffffffda RBX: 00007f2f9f425fa0 RCX: 00007f2f9f19e159 [ 1805.069802][T28344] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 1805.069817][T28344] RBP: 00007f2fa0007090 R08: 0000000000000000 R09: 0000000000000000 [ 1805.069831][T28344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1805.069844][T28344] R13: 00007f2f9f426038 R14: 00007f2f9f425fa0 R15: 00007ffddc8db468 [ 1805.069877][T28344] [ 1805.914183][T28363] batman_adv: batadv0: Adding interface: veth0 [ 1805.914207][T28363] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1805.914240][T28363] batman_adv: batadv0: Interface activated: veth0 [ 1805.971554][T28365] FAULT_INJECTION: forcing a failure. [ 1805.971554][T28365] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1805.971591][T28365] CPU: 0 UID: 0 PID: 28365 Comm: syz.0.20924 Not tainted syzkaller #0 PREEMPT(full) [ 1805.971614][T28365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1805.971626][T28365] Call Trace: [ 1805.971635][T28365] [ 1805.971644][T28365] dump_stack_lvl+0xe8/0x150 [ 1805.971679][T28365] should_fail_ex+0x410/0x560 [ 1805.971710][T28365] _copy_from_user+0x2d/0xb0 [ 1805.971737][T28365] ___sys_sendmsg+0x1c6/0x360 [ 1805.971766][T28365] ? __lock_acquire+0x747/0x2de0 [ 1805.971793][T28365] ? __pfx____sys_sendmsg+0x10/0x10 [ 1805.971828][T28365] ? kstrtouint+0x6e/0xe0 [ 1805.971879][T28365] ? __fget_files+0x2a/0x420 [ 1805.971907][T28365] ? __fget_files+0x3a2/0x420 [ 1805.971956][T28365] __sys_sendmmsg+0x273/0x4d0 [ 1805.971990][T28365] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1805.972028][T28365] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1805.972074][T28365] ? ksys_write+0x242/0x270 [ 1805.972096][T28365] ? __pfx_ksys_write+0x10/0x10 [ 1805.972124][T28365] __x64_sys_sendmmsg+0xa0/0xc0 [ 1805.972156][T28365] do_syscall_64+0x166/0x520 [ 1805.972187][T28365] ? trace_irq_disable+0x3b/0x140 [ 1805.972208][T28365] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1805.972229][T28365] ? clear_bhb_loop+0x70/0xc0 [ 1805.972253][T28365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1805.972273][T28365] RIP: 0033:0x7fbea459e159 [ 1805.972294][T28365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1805.972312][T28365] RSP: 002b:00007fbea5476028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1805.972335][T28365] RAX: ffffffffffffffda RBX: 00007fbea4825fa0 RCX: 00007fbea459e159 [ 1805.972349][T28365] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 1805.972364][T28365] RBP: 00007fbea5476090 R08: 0000000000000000 R09: 0000000000000000 [ 1805.972377][T28365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1805.972390][T28365] R13: 00007fbea4826038 R14: 00007fbea4825fa0 R15: 00007fff3bcc2cf8 [ 1805.972426][T28365] [ 1806.414022][T28376] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20928'. [ 1806.522892][T28379] netlink: 28 bytes leftover after parsing attributes in process `syz.2.20927'. [ 1806.894576][T28376] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 1807.493029][T28405] FAULT_INJECTION: forcing a failure. [ 1807.493029][T28405] name failslab, interval 1, probability 0, space 0, times 0 [ 1807.493065][T28405] CPU: 1 UID: 0 PID: 28405 Comm: syz.3.20936 Not tainted syzkaller #0 PREEMPT(full) [ 1807.493088][T28405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1807.493102][T28405] Call Trace: [ 1807.493111][T28405] [ 1807.493121][T28405] dump_stack_lvl+0xe8/0x150 [ 1807.493158][T28405] should_fail_ex+0x410/0x560 [ 1807.493188][T28405] ? __alloc_skb+0x1db/0x7a0 [ 1807.493214][T28405] should_failslab+0xa8/0x100 [ 1807.493242][T28405] ? __alloc_skb+0x1db/0x7a0 [ 1807.493266][T28405] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1807.493287][T28405] ? __alloc_skb+0x18d/0x7a0 [ 1807.493313][T28405] ? __alloc_skb+0x1db/0x7a0 [ 1807.493344][T28405] __alloc_skb+0x1db/0x7a0 [ 1807.493375][T28405] netlink_sendmsg+0x5d4/0xb40 [ 1807.493409][T28405] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1807.493441][T28405] ? apparmor_socket_sendmsg+0x98/0x360 [ 1807.493470][T28405] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1807.493491][T28405] sock_sendmsg_nosec+0x13a/0x180 [ 1807.493519][T28405] ____sys_sendmsg+0x54e/0x850 [ 1807.493565][T28405] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1807.493607][T28405] ? import_iovec+0x73/0xa0 [ 1807.493638][T28405] ___sys_sendmsg+0x2a5/0x360 [ 1807.493667][T28405] ? __lock_acquire+0x747/0x2de0 [ 1807.493696][T28405] ? __pfx____sys_sendmsg+0x10/0x10 [ 1807.493731][T28405] ? kstrtouint+0x6e/0xe0 [ 1807.493784][T28405] ? __fget_files+0x2a/0x420 [ 1807.493812][T28405] ? __fget_files+0x3a2/0x420 [ 1807.493853][T28405] __sys_sendmmsg+0x273/0x4d0 [ 1807.493889][T28405] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1807.493926][T28405] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1807.493970][T28405] ? ksys_write+0x242/0x270 [ 1807.493993][T28405] ? __pfx_ksys_write+0x10/0x10 [ 1807.494018][T28405] __x64_sys_sendmmsg+0xa0/0xc0 [ 1807.494046][T28405] do_syscall_64+0x166/0x520 [ 1807.494072][T28405] ? trace_irq_disable+0x3b/0x140 [ 1807.494093][T28405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1807.494111][T28405] ? clear_bhb_loop+0x70/0xc0 [ 1807.494134][T28405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1807.494154][T28405] RIP: 0033:0x7fb43b99e159 [ 1807.494174][T28405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1807.494191][T28405] RSP: 002b:00007fb43c928028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1807.494214][T28405] RAX: ffffffffffffffda RBX: 00007fb43bc25fa0 RCX: 00007fb43b99e159 [ 1807.494229][T28405] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 1807.494242][T28405] RBP: 00007fb43c928090 R08: 0000000000000000 R09: 0000000000000000 [ 1807.494254][T28405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1807.494266][T28405] R13: 00007fb43bc26038 R14: 00007fb43bc25fa0 R15: 00007ffdb29afe48 [ 1807.494296][T28405] [ 1808.071884][T24441] IPVS: starting estimator thread 0... [ 1808.109577][T28419] __nla_validate_parse: 1 callbacks suppressed [ 1808.109600][T28419] netlink: 8 bytes leftover after parsing attributes in process `syz.3.20942'. [ 1808.109688][T28419] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1808.162118][T28417] IPVS: using max 27 ests per chain, 64800 per kthread [ 1808.231890][T28421] netlink: 4 bytes leftover after parsing attributes in process `syz.3.20943'. [ 1808.255777][T28421] bond5: (slave bridge4): Enslaving as an active interface with an up link [ 1808.356143][T28424] netlink: 'syz.3.20944': attribute type 7 has an invalid length. [ 1808.356168][T28424] netlink: 'syz.3.20944': attribute type 5 has an invalid length. [ 1808.356177][T28424] netlink: 17 bytes leftover after parsing attributes in process `syz.3.20944'. [ 1808.467401][T28425] netlink: 168 bytes leftover after parsing attributes in process `syz.3.20944'. [ 1808.539586][T28354] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1808.950917][T28431] netlink: 'syz.0.20945': attribute type 4 has an invalid length. [ 1808.978747][T28431] netlink: 'syz.0.20945': attribute type 4 has an invalid length. [ 1809.175781][T28435] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1809.447943][T28431] nbd0: detected capacity change from 0 to 63 [ 1809.488002][T28439] block nbd0: NBD_DISCONNECT [ 1809.522224][T28439] block nbd0: Disconnected due to user request. [ 1809.542659][T28301] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1809.546031][ T1938] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1809.546286][ T1938] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1809.564822][T28439] block nbd0: shutting down sockets [ 1809.586398][ T1938] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1809.586435][ T1938] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1809.609550][ T1938] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1809.609603][ T1938] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1809.636494][ T1938] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1809.636541][ T1938] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1809.647024][ T1938] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1809.647067][ T1938] Buffer I/O error on dev nbd0, logical block 0, async page read [ 1809.890065][T28301] [ 1809.892815][T28301] ====================================================== [ 1809.900533][T28301] WARNING: possible circular locking dependency detected [ 1809.907796][T28301] syzkaller #0 Not tainted [ 1809.912272][T28301] ------------------------------------------------------ [ 1809.919581][T28301] udevd/28301 is trying to acquire lock: [ 1809.925419][T28301] ffffffff8ee90400 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x5f/0x610 [ 1809.935510][T28301] [ 1809.935510][T28301] but task is already holding lock: [ 1809.942989][T28301] ffffffff905ff1c0 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 [ 1809.953661][T28301] [ 1809.953661][T28301] which lock already depends on the new lock. [ 1809.953661][T28301] [ 1809.964290][T28301] [ 1809.964290][T28301] the existing dependency chain (in reverse order) is: [ 1809.973343][T28301] [ 1809.973343][T28301] -> #8 (uevent_sock_mutex){+.+.}-{4:4}: [ 1809.981633][T28301] __mutex_lock+0x19d/0x1550 [ 1809.986795][T28301] kobject_uevent_net_broadcast+0x27e/0x560 [ 1809.993495][T28301] kobject_uevent_env+0x566/0x9e0 [ 1809.999248][T28301] device_add+0x544/0xb80 [ 1810.004193][T28301] device_create+0x269/0x300 [ 1810.009339][T28301] msr_device_create+0x33/0x50 [ 1810.015076][T28301] cpuhp_invoke_callback+0x434/0x810 [ 1810.020978][T28301] cpuhp_thread_fun+0x362/0x780 [ 1810.026372][T28301] smpboot_thread_fn+0x565/0xa70 [ 1810.031884][T28301] kthread+0x38b/0x480 [ 1810.036609][T28301] ret_from_fork+0x514/0xb70 [ 1810.041968][T28301] ret_from_fork_asm+0x1a/0x30 [ 1810.047287][T28301] [ 1810.047287][T28301] -> #7 (cpuhp_state-up){+.+.}-{0:0}: [ 1810.054855][T28301] cpuhp_thread_fun+0x127/0x780 [ 1810.060245][T28301] smpboot_thread_fn+0x565/0xa70 [ 1810.066239][T28301] kthread+0x38b/0x480 [ 1810.070832][T28301] ret_from_fork+0x514/0xb70 [ 1810.075951][T28301] ret_from_fork_asm+0x1a/0x30 [ 1810.081339][T28301] [ 1810.081339][T28301] -> #6 (cpu_hotplug_lock){++++}-{0:0}: [ 1810.089352][T28301] cpus_read_lock+0x42/0x160 [ 1810.094468][T28301] static_key_slow_inc+0x12/0x30 [ 1810.099957][T28301] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 1810.106208][T28301] nbd_genl_foreach_sock+0x265/0x450 [ 1810.112027][T28301] nbd_genl_reconfigure+0xbbb/0x1040 [ 1810.117858][T28301] genl_family_rcv_msg_doit+0x233/0x340 [ 1810.124019][T28301] genl_rcv_msg+0x614/0x7a0 [ 1810.129062][T28301] netlink_rcv_skb+0x226/0x4a0 [ 1810.134439][T28301] genl_rcv+0x28/0x40 [ 1810.138948][T28301] netlink_unicast+0x7bd/0x940 [ 1810.144348][T28301] netlink_sendmsg+0x813/0xb40 [ 1810.149638][T28301] sock_sendmsg_nosec+0x13a/0x180 [ 1810.155185][T28301] ____sys_sendmsg+0x54e/0x850 [ 1810.160476][T28301] ___sys_sendmsg+0x2a5/0x360 [ 1810.165903][T28301] __x64_sys_sendmsg+0x1b1/0x290 [ 1810.171372][T28301] do_syscall_64+0x166/0x520 [ 1810.176491][T28301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.183083][T28301] [ 1810.183083][T28301] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 1810.190733][T28301] __mutex_lock+0x19d/0x1550 [ 1810.195855][T28301] nbd_queue_rq+0x373/0xff0 [ 1810.200884][T28301] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1810.207156][T28301] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1810.214169][T28301] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1810.221066][T28301] blk_mq_run_hw_queue+0x34a/0x4f0 [ 1810.226729][T28301] blk_mq_dispatch_list+0xd11/0xe10 [ 1810.232469][T28301] blk_mq_flush_plug_list+0x45f/0x540 [ 1810.238658][T28301] __blk_flush_plug+0x3ed/0x4d0 [ 1810.244098][T28301] blk_finish_plug+0x5d/0x80 [ 1810.249400][T28301] read_pages+0x3c2/0x5a0 [ 1810.254261][T28301] page_cache_ra_unbounded+0x754/0x9d0 [ 1810.260334][T28301] force_page_cache_ra+0x26c/0x2e0 [ 1810.266192][T28301] filemap_get_pages+0x4a9/0x1ec0 [ 1810.271961][T28301] filemap_read+0x426/0x11e0 [ 1810.277202][T28301] blkdev_read_iter+0x2f1/0x420 [ 1810.282680][T28301] vfs_read+0x595/0xa80 [ 1810.287368][T28301] ksys_read+0x150/0x270 [ 1810.292137][T28301] do_syscall_64+0x166/0x520 [ 1810.297438][T28301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.303875][T28301] [ 1810.303875][T28301] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 1810.311541][T28301] __mutex_lock+0x19d/0x1550 [ 1810.316662][T28301] nbd_queue_rq+0xc1/0xff0 [ 1810.321603][T28301] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1810.327748][T28301] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1810.334629][T28301] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1810.341135][T28301] blk_mq_run_hw_queue+0x34a/0x4f0 [ 1810.346772][T28301] blk_mq_dispatch_list+0xd11/0xe10 [ 1810.352514][T28301] blk_mq_flush_plug_list+0x45f/0x540 [ 1810.358463][T28301] __blk_flush_plug+0x3ed/0x4d0 [ 1810.363860][T28301] blk_finish_plug+0x5d/0x80 [ 1810.368980][T28301] read_pages+0x3c2/0x5a0 [ 1810.373847][T28301] page_cache_ra_unbounded+0x754/0x9d0 [ 1810.379920][T28301] force_page_cache_ra+0x26c/0x2e0 [ 1810.385656][T28301] filemap_get_pages+0x4a9/0x1ec0 [ 1810.391210][T28301] filemap_read+0x426/0x11e0 [ 1810.396328][T28301] blkdev_read_iter+0x2f1/0x420 [ 1810.401794][T28301] vfs_read+0x595/0xa80 [ 1810.406483][T28301] ksys_read+0x150/0x270 [ 1810.411333][T28301] do_syscall_64+0x166/0x520 [ 1810.416459][T28301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.422878][T28301] [ 1810.422878][T28301] -> #3 (set->srcu){.+.+}-{0:0}: [ 1810.430037][T28301] __synchronize_srcu+0xc9/0x2f0 [ 1810.435708][T28301] elevator_switch+0x1e8/0x7b0 [ 1810.441065][T28301] elevator_change+0x2fa/0x480 [ 1810.446377][T28301] elevator_set_default+0x375/0x440 [ 1810.452107][T28301] blk_register_queue+0x3f3/0x4e0 [ 1810.457661][T28301] __add_disk+0x6b8/0xdb0 [ 1810.462614][T28301] add_disk_fwnode+0x100/0x3a0 [ 1810.467995][T28301] nbd_dev_add+0x733/0xb60 [ 1810.472939][T28301] nbd_init+0x168/0x1f0 [ 1810.477805][T28301] do_one_initcall+0x250/0x870 [ 1810.483221][T28301] do_initcall_level+0x10a/0x1a0 [ 1810.488792][T28301] do_initcalls+0x59/0xa0 [ 1810.493648][T28301] kernel_init_freeable+0x29d/0x3e0 [ 1810.499375][T28301] kernel_init+0x22/0x1d0 [ 1810.504233][T28301] ret_from_fork+0x514/0xb70 [ 1810.509618][T28301] ret_from_fork_asm+0x1a/0x30 [ 1810.514918][T28301] [ 1810.514918][T28301] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 1810.523016][T28301] __mutex_lock+0x19d/0x1550 [ 1810.528141][T28301] elevator_change+0x1af/0x480 [ 1810.533517][T28301] elevator_set_none+0xb5/0x140 [ 1810.538891][T28301] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1810.545258][T28301] nbd_start_device+0x189/0xb30 [ 1810.550658][T28301] nbd_genl_connect+0x167d/0x1cd0 [ 1810.556204][T28301] genl_family_rcv_msg_doit+0x233/0x340 [ 1810.562276][T28301] genl_rcv_msg+0x614/0x7a0 [ 1810.567305][T28301] netlink_rcv_skb+0x226/0x4a0 [ 1810.572705][T28301] genl_rcv+0x28/0x40 [ 1810.577297][T28301] netlink_unicast+0x7bd/0x940 [ 1810.582597][T28301] netlink_sendmsg+0x813/0xb40 [ 1810.587878][T28301] sock_sendmsg_nosec+0x13a/0x180 [ 1810.593432][T28301] ____sys_sendmsg+0x54e/0x850 [ 1810.598809][T28301] ___sys_sendmsg+0x2a5/0x360 [ 1810.604014][T28301] __x64_sys_sendmsg+0x1b1/0x290 [ 1810.609588][T28301] do_syscall_64+0x166/0x520 [ 1810.614712][T28301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.621133][T28301] [ 1810.621133][T28301] -> #1 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 1810.629779][T28301] blk_alloc_queue+0x544/0x690 [ 1810.635159][T28301] __blk_mq_alloc_disk+0x194/0x390 [ 1810.640796][T28301] nbd_dev_add+0x494/0xb60 [ 1810.645738][T28301] nbd_init+0x168/0x1f0 [ 1810.650513][T28301] do_one_initcall+0x250/0x870 [ 1810.655901][T28301] do_initcall_level+0x10a/0x1a0 [ 1810.661479][T28301] do_initcalls+0x59/0xa0 [ 1810.666443][T28301] kernel_init_freeable+0x29d/0x3e0 [ 1810.672311][T28301] kernel_init+0x22/0x1d0 [ 1810.677432][T28301] ret_from_fork+0x514/0xb70 [ 1810.683638][T28301] ret_from_fork_asm+0x1a/0x30 [ 1810.688937][T28301] [ 1810.688937][T28301] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 1810.696168][T28301] __lock_acquire+0x164c/0x2de0 [ 1810.701546][T28301] lock_acquire+0x115/0x350 [ 1810.706691][T28301] fs_reclaim_acquire+0x71/0x100 [ 1810.712241][T28301] kmem_cache_alloc_node_noprof+0x5f/0x610 [ 1810.718925][T28301] __alloc_skb+0x1db/0x7a0 [ 1810.723965][T28301] alloc_uevent_skb+0x7d/0x230 [ 1810.729262][T28301] kobject_uevent_net_broadcast+0x2fa/0x560 [ 1810.735712][T28301] kobject_uevent_env+0x566/0x9e0 [ 1810.741369][T28301] nbd_config_put+0x2c8/0x7e0 [ 1810.746586][T28301] nbd_release+0xfe/0x140 [ 1810.751442][T28301] bdev_release+0x571/0x690 [ 1810.756472][T28301] blkdev_release+0x15/0x20 [ 1810.761515][T28301] __fput+0x418/0xa50 [ 1810.766084][T28301] fput_close_sync+0x11f/0x240 [ 1810.771395][T28301] __x64_sys_close+0x7e/0x110 [ 1810.776707][T28301] do_syscall_64+0x166/0x520 [ 1810.781837][T28301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1810.788373][T28301] [ 1810.788373][T28301] other info that might help us debug this: [ 1810.788373][T28301] [ 1810.798722][T28301] Chain exists of: [ 1810.798722][T28301] fs_reclaim --> cpuhp_state-up --> uevent_sock_mutex [ 1810.798722][T28301] [ 1810.811538][T28301] Possible unsafe locking scenario: [ 1810.811538][T28301] [ 1810.819079][T28301] CPU0 CPU1 [ 1810.824491][T28301] ---- ---- [ 1810.829903][T28301] lock(uevent_sock_mutex); [ 1810.834509][T28301] lock(cpuhp_state-up); [ 1810.841651][T28301] lock(uevent_sock_mutex); [ 1810.848938][T28301] lock(fs_reclaim); [ 1810.852939][T28301] [ 1810.852939][T28301] *** DEADLOCK *** [ 1810.852939][T28301] [ 1810.861195][T28301] locks held by udevd/28301: 3, last CPU#0: [ 1810.867210][T28301] #0: ffff888062667350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1b8/0x690 [ 1810.876990][T28301] #1: ffff88803eb6b260 (&nbd->config_lock){+.+.}-{4:4}, at: refcount_dec_and_mutex_lock+0x30/0xa0 [ 1810.887709][T28301] #2: ffffffff905ff1c0 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 [ 1810.898704][T28301] [ 1810.898704][T28301] stack backtrace: [ 1810.904866][T28301] CPU: 0 UID: 0 PID: 28301 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 1810.913802][T28301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1810.924206][T28301] Call Trace: [ 1810.927635][T28301] [ 1810.930770][T28301] dump_stack_lvl+0xe8/0x150 [ 1810.935559][T28301] print_circular_bug+0x2e2/0x300 [ 1810.940615][T28301] check_noncircular+0x12f/0x150 [ 1810.945592][T28301] __lock_acquire+0x164c/0x2de0 [ 1810.950600][T28301] ? __lock_acquire+0x1511/0x2de0 [ 1810.955665][T28301] lock_acquire+0x115/0x350 [ 1810.960213][T28301] ? kmem_cache_alloc_node_noprof+0x5f/0x610 [ 1810.966380][T28301] ? lock_acquire+0x115/0x350 [ 1810.971161][T28301] ? __alloc_skb+0x1db/0x7a0 [ 1810.975848][T28301] fs_reclaim_acquire+0x71/0x100 [ 1810.980872][T28301] ? kmem_cache_alloc_node_noprof+0x5f/0x610 [ 1810.986945][T28301] kmem_cache_alloc_node_noprof+0x5f/0x610 [ 1810.992947][T28301] ? __alloc_skb+0x18d/0x7a0 [ 1810.997687][T28301] ? __alloc_skb+0x1db/0x7a0 [ 1811.002609][T28301] __alloc_skb+0x1db/0x7a0 [ 1811.007151][T28301] alloc_uevent_skb+0x7d/0x230 [ 1811.012105][T28301] kobject_uevent_net_broadcast+0x2fa/0x560 [ 1811.018012][T28301] kobject_uevent_env+0x566/0x9e0 [ 1811.023070][T28301] nbd_config_put+0x2c8/0x7e0 [ 1811.027756][T28301] ? __pfx_nbd_config_put+0x10/0x10 [ 1811.033072][T28301] ? do_raw_spin_unlock+0xf5/0x200 [ 1811.038204][T28301] nbd_release+0xfe/0x140 [ 1811.042540][T28301] ? __pfx_nbd_release+0x10/0x10 [ 1811.047485][T28301] bdev_release+0x571/0x690 [ 1811.052018][T28301] ? __pfx_blkdev_release+0x10/0x10 [ 1811.057227][T28301] blkdev_release+0x15/0x20 [ 1811.061896][T28301] __fput+0x418/0xa50 [ 1811.066069][T28301] fput_close_sync+0x11f/0x240 [ 1811.070859][T28301] ? __pfx_fput_close_sync+0x10/0x10 [ 1811.076245][T28301] __x64_sys_close+0x7e/0x110 [ 1811.080945][T28301] do_syscall_64+0x166/0x520 [ 1811.085575][T28301] ? trace_irq_disable+0x3b/0x140 [ 1811.090610][T28301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1811.096680][T28301] ? clear_bhb_loop+0x70/0xc0 [ 1811.101451][T28301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1811.107440][T28301] RIP: 0033:0x7f4ff82a7407 [ 1811.111951][T28301] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1811.131649][T28301] RSP: 002b:00007ffd0c445580 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 1811.140268][T28301] RAX: ffffffffffffffda RBX: 00007f4ff8a42880 RCX: 00007f4ff82a7407 [ 1811.148446][T28301] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 1811.156803][T28301] RBP: 00007f4ff8a426e8 R08: 0000000000000000 R09: 0000000000000000 [ 1811.164783][T28301] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [ 1811.172764][T28301] R13: 0000559ebb9b9190 R14: 0000000000000008 R15: 0000559ebb9c8f10 [ 1811.180845][T28301] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1811.361432][ T9320] Bluetooth: hci5: command 0x0406 tx timeout [ 1812.631891][ T43] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1812.666269][ T43] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1812.735557][ T43] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1812.795646][ T43] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1812.950889][ T43] bridge_slave_1: left allmulticast mode [ 1812.950929][ T43] bridge_slave_1: left promiscuous mode [ 1812.951102][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 1812.978823][ T43] bridge_slave_0: left allmulticast mode [ 1812.978849][ T43] bridge_slave_0: left promiscuous mode [ 1812.978989][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 1813.204863][ T43] bond3 (unregistering): (slave gretap1): Releasing active interface [ 1813.250273][ T43] bond2 (unregistering): (slave bridge1): Releasing backup interface [ 1813.250302][ T43] bridge1 (unregistering): left promiscuous mode [ 1813.286251][ T43] bond4 (unregistering): (slave bridge3): Releasing backup interface [ 1813.322757][ T43] bond5 (unregistering): (slave bridge4): Releasing backup interface [ 1813.353841][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1813.354100][ T43] bond_slave_0: left allmulticast mode [ 1813.375036][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1813.375502][ T43] bond_slave_1: left allmulticast mode [ 1813.376652][ T43] bond0 (unregistering): Released all slaves [ 1813.408921][ T43] bond1 (unregistering): Released all slaves [ 1813.414798][ T43] bond2 (unregistering): Released all slaves [ 1813.434558][ T43] bond3 (unregistering): Released all slaves [ 1813.447030][ T43] bond4 (unregistering): Released all slaves [ 1813.463213][ T43] bond5 (unregistering): Released all slaves [ 1813.480315][T24445] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1813.480374][T24445] netdevsim netdevsim3 eth4: set [1, 0] type 2 family 0 port 6081 - 0 [ 1813.480404][T24445] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1813.480434][T24445] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1813.789657][ T5282] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1814.026251][ T43] hsr_slave_0: left promiscuous mode [ 1814.097485][ T43] hsr_slave_1: left promiscuous mode [ 1814.098128][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1814.098147][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1814.098728][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1814.098743][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1814.099214][ T43] batman_adv: batadv0: Interface deactivated: veth0 [ 1814.099228][ T43] batman_adv: batadv0: Removing interface: veth0 [ 1814.103111][ T43] veth1_macvtap: left promiscuous mode [ 1814.103139][ T43] veth0_macvtap: left promiscuous mode [ 1814.103323][ T43] veth1_vlan: left promiscuous mode [ 1814.103368][ T43] veth0_vlan: left promiscuous mode [ 1814.501625][ T43] team0 (unregistering): Port device team_slave_1 removed [ 1814.506855][ T43] team0 (unregistering): Port device team_slave_0 removed [ 1814.626632][ T5282] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1814.896553][ T43] IPVS: stop unused estimator thread 0... [ 1815.090510][ T43] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1815.090558][ T43] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1815.249284][ T43] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1815.249324][ T43] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1815.344401][ T43] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1815.344441][ T43] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1815.359877][ T5282] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1815.456609][ T43] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1815.456648][ T43] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1815.547366][T24447] netdevsim netdevsim4 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1815.549866][T17785] netdevsim netdevsim4 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1815.590881][ T43] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1815.590919][ T43] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1815.590944][ T43] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1815.597587][T17786] netdevsim netdevsim4 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1815.597633][T17786] netdevsim netdevsim4 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1815.765723][ T43] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1815.765762][ T43] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1815.765788][ T43] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1815.949424][ T43] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1815.949461][ T43] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1815.949484][ T43] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1816.007163][ T5282] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1816.036673][ T43] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1816.036711][ T43] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1816.036736][ T43] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1816.191624][T17781] netdevsim netdevsim0 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 1816.223787][ T43] bridge_slave_1: left allmulticast mode [ 1816.223816][ T43] bridge_slave_1: left promiscuous mode [ 1816.223987][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 1816.260659][ T43] bridge_slave_0: left allmulticast mode [ 1816.260688][ T43] bridge_slave_0: left promiscuous mode [ 1816.260846][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 1816.321247][ T43] bridge_slave_1: left allmulticast mode [ 1816.321275][ T43] bridge_slave_1: left promiscuous mode [ 1816.321423][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 1816.322968][ T43] bridge_slave_0: left allmulticast mode [ 1816.322987][ T43] bridge_slave_0: left promiscuous mode [ 1816.323109][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 1816.605552][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1816.629318][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1816.633359][ T43] bond0 (unregistering): (slave team0): Releasing backup interface [ 1816.635372][ T43] bond0 (unregistering): Released all slaves [ 1816.662682][ T43] bond1 (unregistering): Released all slaves [ 1816.786615][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1816.802739][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1816.804212][ T43] bond0 (unregistering): Released all slaves [ 1816.822417][ T43] bond1 (unregistering): Released all slaves [ 1816.847302][T17785] netdevsim netdevsim0 eth10: set [1, 0] type 2 family 0 port 6081 - 0 [ 1816.847372][T17785] netdevsim netdevsim0 eth11: set [1, 0] type 2 family 0 port 6081 - 0 [ 1816.847403][T17785] netdevsim netdevsim0 eth12: set [1, 0] type 2 family 0 port 6081 - 0 [ 1817.011733][ T43] : left promiscuous mode [ 1817.066615][ T5282] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1817.121089][ T43] tipc: Left network mode [ 1817.474472][ T43] hsr_slave_0: left promiscuous mode [ 1817.474924][ T43] hsr_slave_1: left promiscuous mode [ 1817.475437][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1817.475454][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1817.476237][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1817.476253][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1817.533197][ T43] hsr_slave_0: left promiscuous mode [ 1817.533683][ T43] hsr_slave_1: left promiscuous mode [ 1817.534229][ T43] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1817.534247][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1817.535989][ T43] batman_adv: batadv0: Interface deactivated: veth0 [ 1817.536006][ T43] batman_adv: batadv0: Removing interface: veth0 [ 1817.592000][ T43] veth1_macvtap: left promiscuous mode [ 1817.592039][ T43] veth0_macvtap: left promiscuous mode [ 1817.592122][ T43] veth1_vlan: left promiscuous mode [ 1817.592168][ T43] veth0_vlan: left promiscuous mode [ 1817.593381][ T43] veth1_macvtap: left promiscuous mode [ 1817.593407][ T43] veth0_macvtap: left promiscuous mode [ 1817.593593][ T43] veth1_vlan: left promiscuous mode [ 1817.593653][ T43] veth0_vlan: left promiscuous mode [ 1817.903114][ T43] team0 (unregistering): Port device team_slave_1 removed [ 1817.932691][ T43] team0 (unregistering): Port device team_slave_0 removed [ 1818.058763][ C1] TC_ACT_REPEAT abuse ? [ 1818.148804][ T43] team0 (unregistering): Port device team_slave_1 removed [ 1818.154067][ T43] team0 (unregistering): Port device team_slave_0 removed [ 1818.239664][ T5282] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1818.983887][ T5282] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1819.431141][ T5282] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1819.850582][ T5282] 8021q: adding VLAN 0 to HW filter on device eth9