last executing test programs: 15.078372494s ago: executing program 3 (id=16515): r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r1, &(0x7f0000000300)={0x1f, 0x0, @any, 0x3d}, 0xe) connect$bt_l2cap(r1, &(0x7f0000000d00)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x40}, 0xe) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000d40)=ANY=[@ANYRES32=r1]) 14.678053547s ago: executing program 3 (id=16518): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000240)={0x1d, r1, 0x1, {0x1, 0xf0, 0x3}}, 0x18) 14.128854753s ago: executing program 3 (id=16523): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 13.79546458s ago: executing program 3 (id=16525): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={0x0, 0x5}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000180)='\b', 0x1}], 0x1}}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000001c0)={0x0, 0x0, 0xc493}, 0x8) 12.754058876s ago: executing program 3 (id=16532): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0xac, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x14, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x5, 0x1, 0x4e22}, @CTA_PROTONAT_PORT_MAX={0x6}]}]}]}, 0xac}}, 0x0) 12.595185575s ago: executing program 3 (id=16535): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000002060108000034e4000000000000000805000400030000000900020073797a3100000000050005000200000014000300686173683a69702c706f72742c6970000500010007"], 0x4c}, 0x1, 0x0, 0x0, 0x20044095}, 0x8042) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x60, 0x9, 0x6, 0x3, 0x0, 0x0, {0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x38, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @private=0xa010101}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 4.176276448s ago: executing program 2 (id=16594): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480e1211000000e3bd012a128748b429021627e305dd2b7a146efb4400", 0x2e}], 0x1}, 0x4048004) 3.654456694s ago: executing program 2 (id=16599): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x3, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000680)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000006c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000900), 0x100, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000940)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000bc0)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.562328593s ago: executing program 1 (id=16600): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000080)="060000000300000000", 0x9) 3.256024166s ago: executing program 1 (id=16602): socket$key(0xf, 0x3, 0x2) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1}, @in6=@mcast2, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x28c, 0x1, 0x0, 0x0, 0x3}, {0x7}, 0x0, 0x0, 0x1, 0x0, 0x873f24456926a1a5}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in6=@loopback, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000, 0x3}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) 3.063633238s ago: executing program 2 (id=16603): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000005c0)='dctcp', 0x5) 2.742300716s ago: executing program 2 (id=16604): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)="91f8a9", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)="32d33a47d96ceacc565129f837dfc4ec8df24612082800303fbc4c7dae05b96c2dc595b8", 0x24}, {&(0x7f0000000500)="9cf1495e028e22049259947af71c968820aac2153e36e05237044004130a31b25cd08e4a582dd094e3cd495eb7e28321e85d8e7da6651a68cb993498df2236fcab1ea0a1cc628ddbe16ac9191d6917ee7f319afaae6058b0a13fa0258fb74bf114e1a95c71a81b46d5d333aef5db36219c3bd7f905a25f5bb07bd3055d210022f04b5acf6a8e20086a71b6b5c7bb87d9c7a209b7f0e56dac72bf77c9773d1b702c45c9460829ffbf704fbbe1635b301183a8867463de2a0fae686630b7db109ed37404eadf", 0xc5}, {&(0x7f0000000640)="e705ba567be6127d85d39375b10960531cc5504726702fa92b283ee716613616ab01f6e820db6e5cfcb4d90015ea23", 0x2f}, {&(0x7f0000000680)="c05d0dc2fdda573c5872e33584e8", 0xe}], 0x4}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740), 0x4) writev(r0, &(0x7f0000001d40)=[{&(0x7f0000002d80)="fb7ef3f08d8f0d64c4636b96073c171a2926f00a2baa2c2752e6ba348df7c6cb64a0a5dbc368e6e57135b7c7f20a1e4ca2d0c293b9df5480df71d6dcdd9beb4fa3247b3b7e38346fa0436ee2d9c57c41af42a71188cbd6b252eb449052ef2d76f3c0ab72b88db15921409f4efe9fe517430ec288238072967546e6a834ac62fec1df765d0147d8d2993dceb59f5b66b848a8f1d09a0d8108e7ef271311ea18df574e3e0b9242dd27f45258cb3bb762582f5737efdc15dabfa031673c84696ab886bdd35bb35a5346cf472e001e71c5384fc353b3181775acb185307d6f762e564b7fd4f06f875fc919c3ebb015f673a3cb380b03abbbfe30c781bd8b17292a1e2b748107e60e568c1e1f86a0cf01e30772b6b2146cd4d1f2e9fc7b5bcefded909fe7bf723490ced2d106004e3a0cd7b9c3519b05741751325fe8538085cc1f902fa544dcc929f10469fe39c3cf61f786254a373316923186fa08ef3c8917d4c2df0d3e41c32b6948177e71b23c3a9eb9c30db62011da02d48da9318c20a438f6ba2962ce066b8793e16831c350a379f8c54c5de2eab0b0117e3dc30f5c27c87b2eb33b43215bdcabb7185b1ca317dc967cfdfdcbf92a4e196bcf0d6ba1cea19dd296b4de3625a95ea0ee82efc84379be3125e84d8183ebce42f98654f44f86d49b13529b6cec5acbe93af52987080df30eed17685881b67777877226704091bd1f07b76c3af968b6afc17751d27756d8df673ee1cc", 0x215}], 0x1) 2.321387702s ago: executing program 1 (id=16606): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES8], 0x3c}, 0x1, 0x0, 0x0, 0x20004800}, 0x8010) 2.039403086s ago: executing program 1 (id=16608): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000080000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000007400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1.867647148s ago: executing program 1 (id=16609): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)={0x48, 0x0, 0x121, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x14, 0x51, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "3af482ae1a"}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0xf040}, 0x40040) 1.867472887s ago: executing program 0 (id=16610): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x82, 0x0, 0x0) 1.811768533s ago: executing program 4 (id=16541): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @dev={0xac, 0x14, 0x14, 0x8b}, 0x15, 0x3, 'fo\x00', 0x1, 0x400000, 0x4}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @remote, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x36}, {@dev={0xac, 0x14, 0x14, 0x40}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 1.738968898s ago: executing program 2 (id=16611): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000080)="060000000300000000", 0x9) 1.727959936s ago: executing program 0 (id=16612): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000500)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x3, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000680)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000006c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000900), 0x100, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xc, 0xa, 0x0, 0x5}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x2004c090) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000000bc0)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.693683459s ago: executing program 1 (id=16613): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000380), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000480)=@NCI_OP_CORE_RESET_RSP={0x0, 0x0, 0x2, 0x0, 0x3, {0x0, 0x20}}, 0x6) write$nci(r0, &(0x7f00000004c0)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x11, {{}, {0x0, 0x0, 0xff}}}, 0x14) write$nci(r0, 0x0, 0x0) 1.544813014s ago: executing program 4 (id=16614): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x16, 0xb, &(0x7f0000000b40)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x4, 0x0, 0x0, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c00)={r1, 0x0, 0xe, 0x0, &(0x7f0000000c80)='\x00'/14, 0x0, 0x3b66, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.43493442s ago: executing program 4 (id=16615): syz_emit_ethernet(0x22, &(0x7f00000000c0)={@local, @local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @local}}}}}, 0x0) 1.431092733s ago: executing program 2 (id=16616): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_KEY(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)={0xb8, r0, 0x9, 0x70bd2d, 0x1, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x4}, @NL80211_KEY_IDX={0x5}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_MODE={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "38a23ab14f"}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_KEY_IDX={0x0, 0x8, 0x2}, @NL80211_ATTR_KEY={0x30, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4059b6bf61b5ed38f6331bd2c5"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_SEQ={0xd, 0x4, "413155f567590bd2d3"}]}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_SEQ={0x12, 0xa, "dfbf17ce508ceebcbe12a1b126a7"}, @NL80211_ATTR_KEY={0x0, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT]}]}, 0xb8}}, 0x0) 1.312235262s ago: executing program 4 (id=16617): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES8], 0x3c}, 0x1, 0x0, 0x0, 0x20004800}, 0x8010) 1.284627432s ago: executing program 4 (id=16618): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000000)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x3000000, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='bridge0\x00', 0x10) write(r0, &(0x7f0000000180)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) 1.270583675s ago: executing program 0 (id=16619): r0 = socket(0x10, 0x3, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x6}, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r1, 0x0, 0x28, &(0x7f0000000140)={@empty, @private=0xa010101, @local}, 0xc) write(r0, &(0x7f0000000040)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="28000000020301dd000000000000000002000000080001000100000009000200f9ffffff01"], 0x28}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000280)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000005c0)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000600)={'syzkaller1\x00', @broadcast}) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f0000000080)=[{&(0x7f00000000c0)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003001800000000", 0x39}], 0x1) 1.154633706s ago: executing program 4 (id=16620): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d8010000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32, @ANYBLOB="bc01330080000000ffffffffffff080211000000f7ab87594b3f00000000000801000100dd7118aae49bd5937bad5fda023b2a5a78c05782f92fe27196352514ed223d61c8fc17d2692f2a2eecd8d55db037f220440957ec558232ad7346e19d0ffba41dae1bdf25fc38ceb7a7a77ac466c2bb6feb8de070b227826541a0d118d508fc18f3cc6f5f98db435cd2d27a5c0ce49292e72b43cdadc26f69deb1ef3ede9aec85a6554b2c7cd5af891f933549794b8d0f911ffdaed3ba6833441f94f5721cddaf7e6127b1f68192b4d5902dd5c215d8df43165c4061282fcbe5430fdf2448206d0e1561b338289d64b802476bd7d66916ec22a9ba727a7235efa7d79790006ecf9f6cf9dcdddfd6fc6d331c49964061c06dde5fba9c6d0c3e70ab41f94363dfcae6a3094be521aaeb94d767d83c334beb6c7fb826e4445bc76956fa8925f927e16204df31acbbd681b6d593a68b3b3756ff8a78ffb7134aff566b"], 0x1d8}, 0x1, 0x0, 0x0, 0x805}, 0x0) 971.328919ms ago: executing program 0 (id=16621): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)="91f8a9", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)="32d33a47d96ceacc565129f837dfc4ec8df24612082800303fbc4c7dae05b96c2dc595b8", 0x24}, {&(0x7f0000000500)="9cf1495e028e22049259947af71c968820aac2153e36e05237044004130a31b25cd08e4a582dd094e3cd495eb7e28321e85d8e7da6651a68cb993498df2236fcab1ea0a1cc628ddbe16ac9191d6917ee7f319afaae6058b0a13fa0258fb74bf114e1a95c71a81b46d5d333aef5db36219c3bd7f905a25f5bb07bd3055d210022f04b5acf6a8e20086a71b6b5c7bb87d9c7a209b7f0e56dac72bf77c9773d1b702c45c9460829ffbf704fbbe1635b301183a8867463de2a0fae686630b7db109ed37404eadf", 0xc5}, {&(0x7f0000000640)="e705ba567be6127d85d39375b10960531cc5504726702fa92b283ee716613616ab01f6e820db6e5cfcb4d90015ea23", 0x2f}, {&(0x7f0000000680)="c05d0dc2fdda573c5872e33584e8", 0xe}], 0x4}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740), 0x4) writev(r0, &(0x7f0000001d40)=[{&(0x7f0000002d80)="fb7ef3f08d8f0d64c4636b96073c171a2926f00a2baa2c2752e6ba348df7c6cb64a0a5dbc368e6e57135b7c7f20a1e4ca2d0c293b9df5480df71d6dcdd9beb4fa3247b3b7e38346fa0436ee2d9c57c41af42a71188cbd6b252eb449052ef2d76f3c0ab72b88db15921409f4efe9fe517430ec288238072967546e6a834ac62fec1df765d0147d8d2993dceb59f5b66b848a8f1d09a0d8108e7ef271311ea18df574e3e0b9242dd27f45258cb3bb762582f5737efdc15dabfa031673c84696ab886bdd35bb35a5346cf472e001e71c5384fc353b3181775acb185307d6f762e564b7fd4f06f875fc919c3ebb015f673a3cb380b03abbbfe30c781bd8b17292a1e2b748107e60e568c1e1f86a0cf01e30772b6b2146cd4d1f2e9fc7b5bcefded909fe7bf723490ced2d106004e3a0cd7b9c3519b05741751325fe8538085cc1f902fa544dcc929f10469fe39c3cf61f786254a373316923186fa08ef3c8917d4c2df0d3e41c32b6948177e71b23c3a9eb9c30db62011da02d48da9318c20a438f6ba2962ce066b8793e16831c350a379f8c54c5de2eab0b0117e3dc30f5c27c87b2eb33b43215bdcabb7185b1ca317dc967cfdfdcbf92a4e196bcf0d6ba1cea19dd296b4de3625a95ea0ee82efc84379be3125e84d8183ebce42f98654f44f86d49b13529b6cec5acbe93af52987080df30eed17685881b67777877226704091bd1f07b76c3af968b6afc17751d27756d8df673ee1cc", 0x215}], 0x1) 68.97722ms ago: executing program 0 (id=16622): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x82, 0x0, 0x0) 0s ago: executing program 0 (id=16623): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000200)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="070000004000000000000200000014000180060001000200000008000300ac1414aa"], 0x28}}, 0x0) sendto$inet(r2, &(0x7f00000008c0)="94", 0x1, 0x1, 0x0, 0x0) kernel console output (not intermixed with test programs): 07652][T25305] kernel_misc_reclaimable:0 [ 2028.807652][T25305] free:1208231 free_pcp:14332 free_cma:0 [ 2028.807712][T25305] Node 0 active_anon:21692kB inactive_anon:0kB active_file:0kB inactive_file:179348kB unevictable:28kB isolated(anon):0kB isolated(file):0kB mapped:128688kB dirty:884kB writeback:0kB shmem:2184kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:21952kB pagetables:5152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2028.807775][T25305] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2028.807832][T25305] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2028.807896][T25305] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 2028.807939][T25305] Node 0 DMA32 free:885036kB boost:0kB min:33936kB low:42420kB high:50904kB reserved_highatomic:0kB free_highatomic:0kB active_anon:21692kB inactive_anon:0kB active_file:0kB inactive_file:179348kB unevictable:28kB writepending:884kB zspages:0kB present:3129332kB managed:2523116kB mlocked:28kB bounce:0kB free_pcp:57324kB local_pcp:36836kB free_cma:0kB [ 2028.808007][T25305] lowmem_reserve[]: 0 0 1 1 1 [ 2028.808046][T25305] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1660kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 2028.808112][T25305] lowmem_reserve[]: 0 0 0 0 0 [ 2028.808149][T25305] Node 1 Normal free:3932528kB boost:0kB min:55940kB low:69924kB high:83908kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2028.808217][T25305] lowmem_reserve[]: 0 0 0 0 0 [ 2028.808872][T25305] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 2028.809234][T25305] Node 0 DMA32: 127*4kB (UME) 44*8kB (UE) 219*16kB (UME) 677*32kB (UME) 116*64kB (UME) 63*128kB (UME) 37*256kB (UME) 13*512kB (M) 2*1024kB (ME) 3*2048kB (UME) 200*4096kB (UM) = 885036kB [ 2028.809700][T25305] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2028.810251][T25305] Node 1 Normal: 2*4kB (UM) 9*8kB (UM) 26*16kB (UM) 14*32kB (UM) 13*64kB (UM) 7*128kB (UM) 7*256kB (UM) 6*512kB (UM) 3*1024kB (UM) 1*2048kB (U) 957*4096kB (UM) = 3932528kB [ 2028.810716][T25305] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2028.810762][T25305] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2028.810806][T25305] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2028.810860][T25305] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2028.810905][T25305] 45430 total pagecache pages [ 2028.810928][T25305] 0 pages in swap cache [ 2028.810949][T25305] Free swap = 124996kB [ 2028.810971][T25305] Total swap = 124996kB [ 2028.810995][T25305] 2097051 pages RAM [ 2028.811017][T25305] 0 pages HighMem/MovableOnly [ 2028.811039][T25305] 434241 pages reserved [ 2028.811065][T25305] 0 pages cma reserved [ 2029.166643][T25308] netlink: 96 bytes leftover after parsing attributes in process `syz.0.15601'. [ 2033.657316][T25338] netlink: 24 bytes leftover after parsing attributes in process `syz.0.15607'. [ 2033.690236][T25342] netlink: 40 bytes leftover after parsing attributes in process `syz.3.15608'. [ 2033.954606][T25354] netlink: 20 bytes leftover after parsing attributes in process `syz.2.15611'. [ 2034.170211][T25365] netlink: 'syz.3.15615': attribute type 1 has an invalid length. [ 2034.207803][T25365] bond60: entered promiscuous mode [ 2034.208568][T25365] 8021q: adding VLAN 0 to HW filter on device bond60 [ 2034.214378][T25364] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2034.296108][T25365] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15615'. [ 2034.351474][T25371] syzkaller0: entered promiscuous mode [ 2034.351503][T25371] syzkaller0: entered allmulticast mode [ 2034.370195][T25365] bond60: entered allmulticast mode [ 2034.406078][T25365] bond60: (slave bridge51): making interface the new active one [ 2034.406107][T25365] bridge51: entered promiscuous mode [ 2034.406297][T25365] bridge51: entered allmulticast mode [ 2034.422095][T25365] bond60: (slave bridge51): Enslaving as an active interface with an up link [ 2034.461473][T25365] netlink: 80 bytes leftover after parsing attributes in process `syz.3.15615'. [ 2034.461512][T25365] openvswitch: netlink: Missing key (keys=40, expected=80) [ 2034.462722][T25377] netlink: 16 bytes leftover after parsing attributes in process `syz.2.15620'. [ 2034.677177][T25383] FAULT_INJECTION: forcing a failure. [ 2034.677177][T25383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2034.677210][T25383] CPU: 1 UID: 0 PID: 25383 Comm: syz.2.15622 Not tainted syzkaller #0 PREEMPT(full) [ 2034.677244][T25383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2034.677261][T25383] Call Trace: [ 2034.677274][T25383] [ 2034.677284][T25383] dump_stack_lvl+0xe8/0x150 [ 2034.677325][T25383] should_fail_ex+0x3eb/0x540 [ 2034.677357][T25383] _copy_from_user+0x2d/0xb0 [ 2034.677386][T25383] kstrtouint_from_user+0xd6/0x180 [ 2034.677411][T25383] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2034.677443][T25383] ? lock_acquire+0x115/0x350 [ 2034.677475][T25383] proc_fail_nth_write+0x8e/0x210 [ 2034.677510][T25383] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2034.677552][T25383] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2034.677584][T25383] vfs_write+0x296/0xba0 [ 2034.677622][T25383] ? __pfx_vfs_write+0x10/0x10 [ 2034.677651][T25383] ? __fget_files+0x2a/0x420 [ 2034.677677][T25383] ? __fget_files+0x3a2/0x420 [ 2034.677700][T25383] ? __fget_files+0x2a/0x420 [ 2034.677733][T25383] ? fdget+0x1ac/0x250 [ 2034.677766][T25383] ksys_write+0x150/0x270 [ 2034.677796][T25383] ? __pfx_ksys_write+0x10/0x10 [ 2034.677836][T25383] do_syscall_64+0x166/0x520 [ 2034.677860][T25383] ? trace_irq_disable+0x3b/0x140 [ 2034.677889][T25383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2034.677911][T25383] ? clear_bhb_loop+0x70/0xc0 [ 2034.677937][T25383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2034.677958][T25383] RIP: 0033:0x7fdf3736034e [ 2034.677977][T25383] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2034.677996][T25383] RSP: 002b:00007fdf38353fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2034.678018][T25383] RAX: ffffffffffffffda RBX: 00007fdf383546c0 RCX: 00007fdf3736034e [ 2034.678034][T25383] RDX: 0000000000000001 RSI: 00007fdf383540a0 RDI: 0000000000000005 [ 2034.678047][T25383] RBP: 00007fdf38354090 R08: 0000000000000000 R09: 0000000000000000 [ 2034.678060][T25383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2034.678073][T25383] R13: 00007fdf37626038 R14: 00007fdf37625fa0 R15: 00007fff8cdb5c58 [ 2034.678108][T25383] [ 2035.002079][T25387] netlink: 44 bytes leftover after parsing attributes in process `syz.2.15623'. [ 2035.063988][T25391] netlink: 44 bytes leftover after parsing attributes in process `syz.2.15623'. [ 2038.858023][T25405] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15628'. [ 2039.058754][T25413] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15631'. [ 2039.080449][T25415] netlink: 'syz.2.15633': attribute type 4 has an invalid length. [ 2039.080479][T25415] netlink: 17 bytes leftover after parsing attributes in process `syz.2.15633'. [ 2039.129969][T25415] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.15633'. [ 2039.256901][T25422] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15637'. [ 2039.379863][T25427] syzkaller0: entered promiscuous mode [ 2039.379891][T25427] syzkaller0: entered allmulticast mode [ 2039.648551][T25445] nbd: socks must be embedded in a SOCK_ITEM attr [ 2040.093563][T25465] x_tables: duplicate underflow at hook 2 [ 2040.325864][T25473] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15649'. [ 2041.883791][T25508] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15662'. [ 2042.378573][T25531] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15668'. [ 2042.507000][T25538] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15672'. [ 2042.744232][T25546] netlink: 16 bytes leftover after parsing attributes in process `syz.2.15676'. [ 2043.127428][T25564] ip6t_rt: address list match requested but addrnr is 0 [ 2043.151093][T25560] ip6t_frag: unknown flags 4 [ 2043.210368][T25557] syzkaller0: entered promiscuous mode [ 2043.210398][T25557] syzkaller0: entered allmulticast mode [ 2043.275741][T25571] syzkaller0: entered promiscuous mode [ 2043.275769][T25571] syzkaller0: entered allmulticast mode [ 2047.823197][T25587] veth0_macvtap: left promiscuous mode [ 2047.826146][T25587] veth0_macvtap: entered promiscuous mode [ 2047.855124][T25587] A link change request failed with some changes committed already. Interface syzkallerB may have been left with an inconsistent configuration, please check. [ 2047.882965][T31845] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2047.894393][T12258] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2047.894573][T12258] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2047.894737][T12258] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2048.140941][T25604] syzkaller0: entered promiscuous mode [ 2048.140967][T25604] syzkaller0: entered allmulticast mode [ 2048.274178][T25613] __nla_validate_parse: 2 callbacks suppressed [ 2048.274202][T25613] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15699'. [ 2048.547850][T25623] netlink: 'syz.2.15702': attribute type 12 has an invalid length. [ 2048.847247][T25629] netlink: 'syz.2.15704': attribute type 4 has an invalid length. [ 2049.210858][T25643] netlink: 156 bytes leftover after parsing attributes in process `syz.0.15709'. [ 2050.043651][T25663] netlink: 148 bytes leftover after parsing attributes in process `syz.1.15714'. [ 2050.062719][T25665] netlink: 'syz.3.15712': attribute type 1 has an invalid length. [ 2050.062746][T25665] netlink: 244 bytes leftover after parsing attributes in process `syz.3.15712'. [ 2050.092177][T25669] netlink: 148 bytes leftover after parsing attributes in process `syz.1.15714'. [ 2051.686956][T25702] netlink: 220 bytes leftover after parsing attributes in process `syz.2.15724'. [ 2051.764425][T25712] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15727'. [ 2052.113524][T25723] ip_tables: iptables: counters copy to user failed while replacing table [ 2052.141276][T25719] netlink: 28 bytes leftover after parsing attributes in process `syz.2.15728'. [ 2052.163591][T25730] syzkaller1: entered promiscuous mode [ 2052.163618][T25730] syzkaller1: entered allmulticast mode [ 2052.747278][T25746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15735'. [ 2052.747340][T25746] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15735'. [ 2052.822011][T25751] ip_tables: iptables: counters copy to user failed while replacing table [ 2052.947620][T25753] ip_tables: iptables: counters copy to user failed while replacing table [ 2053.545414][T25766] __nla_validate_parse: 1 callbacks suppressed [ 2053.545439][T25766] netlink: 28 bytes leftover after parsing attributes in process `syz.3.15741'. [ 2053.592011][T25766] netlink: 'syz.3.15741': attribute type 10 has an invalid length. [ 2053.655149][T25766] team0 (unregistering): Port device bridge2 removed [ 2053.689690][T25766] team0 (unregistering): Port device bridge3 removed [ 2053.721964][T25766] team0 (unregistering): Port device bridge4 removed [ 2053.755998][T25766] team0 (unregistering): Port device bridge5 removed [ 2053.783085][T25766] team0 (unregistering): Port device bridge6 removed [ 2053.873466][T25766] team0 (unregistering): Port device bridge7 removed [ 2054.205122][T25766] team0 (unregistering): Port device bridge8 removed [ 2054.220723][T25766] team0 (unregistering): Port device bridge9 removed [ 2054.225068][T25766] team0 (unregistering): Port device bridge10 removed [ 2054.240648][T25766] team0 (unregistering): Port device bridge11 removed [ 2054.260184][T25766] team0 (unregistering): Port device bridge17 removed [ 2054.277588][T25766] team0 (unregistering): Port device bridge20 removed [ 2054.292864][T25766] team0 (unregistering): Port device bridge21 removed [ 2054.302413][T25766] team0 (unregistering): Port device bridge22 removed [ 2054.325433][T25766] team0 (unregistering): Port device bridge23 removed [ 2054.328105][T25766] team0 (unregistering): Port device bridge24 removed [ 2054.343805][T25766] team0 (unregistering): Port device bridge25 removed [ 2054.346416][T25766] team0 (unregistering): Port device bridge26 removed [ 2054.351369][T25766] team0 (unregistering): Port device bridge28 removed [ 2054.375049][T25766] team0 (unregistering): Port device bridge29 removed [ 2054.385034][T25766] team0 (unregistering): Port device bridge30 removed [ 2054.394515][T25766] team0 (unregistering): Port device bridge31 removed [ 2054.397739][T25766] team0 (unregistering): Port device bridge32 removed [ 2054.416379][T25766] team0 (unregistering): Port device bridge33 removed [ 2054.427787][T25766] team0 (unregistering): Port device bridge34 removed [ 2054.439426][T25766] team0 (unregistering): Port device bridge35 removed [ 2054.445835][T25766] team0 (unregistering): Port device bridge36 removed [ 2054.466458][T25766] team0 (unregistering): Port device bridge37 removed [ 2054.480826][T25766] team0 (unregistering): Port device bridge38 removed [ 2054.486641][T25766] team0 (unregistering): Port device bridge39 removed [ 2054.667431][T25790] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15748'. [ 2054.682516][T25790] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15748'. [ 2054.948091][T25801] netlink: 16 bytes leftover after parsing attributes in process `syz.1.15751'. [ 2055.006033][T25806] netlink: 108 bytes leftover after parsing attributes in process `syz.0.15752'. [ 2055.521755][T25820] netlink: 'syz.3.15756': attribute type 1 has an invalid length. [ 2055.521784][T25820] netlink: 36 bytes leftover after parsing attributes in process `syz.3.15756'. [ 2055.806287][T25828] netlink: 'syz.3.15756': attribute type 1 has an invalid length. [ 2056.362748][T25836] 8021q: adding VLAN 0 to HW filter on device bond62 [ 2056.937576][T25852] netlink: 16 bytes leftover after parsing attributes in process `syz.2.15765'. [ 2057.271069][T25867] FAULT_INJECTION: forcing a failure. [ 2057.271069][T25867] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2057.271105][T25867] CPU: 0 UID: 0 PID: 25867 Comm: syz.0.15770 Not tainted syzkaller #0 PREEMPT(full) [ 2057.271132][T25867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2057.271147][T25867] Call Trace: [ 2057.271157][T25867] [ 2057.271172][T25867] dump_stack_lvl+0xe8/0x150 [ 2057.271218][T25867] should_fail_ex+0x3eb/0x540 [ 2057.271256][T25867] _copy_to_user+0x31/0xb0 [ 2057.271290][T25867] bpf_verifier_vlog+0x3a2/0x900 [ 2057.271333][T25867] bpf_log+0x113/0x1a0 [ 2057.271359][T25867] ? bpf_compute_loops+0x2dd9/0x3e80 [ 2057.271383][T25867] ? trace_kmalloc+0x2a/0xf0 [ 2057.271426][T25867] ? __pfx_bpf_log+0x10/0x10 [ 2057.271454][T25867] ? __kvmalloc_node_noprof+0x340/0x820 [ 2057.271486][T25867] ? bpf_compute_loops+0x2dd9/0x3e80 [ 2057.271510][T25867] ? bpf_compute_loops+0x2dd9/0x3e80 [ 2057.271545][T25867] bpf_compute_loops+0x36f1/0x3e80 [ 2057.271600][T25867] bpf_check+0x2ce7/0x34e0 [ 2057.271641][T25867] ? ktime_get_with_offset+0x93/0x2d0 [ 2057.271676][T25867] ? ktime_get_with_offset+0x93/0x2d0 [ 2057.271711][T25867] ? __pfx_bpf_check+0x10/0x10 [ 2057.271741][T25867] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2057.271776][T25867] bpf_prog_load+0x14da/0x1c60 [ 2057.271818][T25867] ? __pfx_bpf_prog_load+0x10/0x10 [ 2057.271862][T25867] ? __might_fault+0xaf/0x130 [ 2057.271896][T25867] __sys_bpf+0xd86/0xe00 [ 2057.271931][T25867] ? __pfx___sys_bpf+0x10/0x10 [ 2057.271969][T25867] ? __fget_files+0x2a/0x420 [ 2057.272021][T25867] ? ksys_write+0x242/0x270 [ 2057.272052][T25867] ? __pfx_ksys_write+0x10/0x10 [ 2057.272085][T25867] __x64_sys_bpf+0xba/0xd0 [ 2057.272118][T25867] do_syscall_64+0x166/0x520 [ 2057.272143][T25867] ? trace_irq_disable+0x3b/0x140 [ 2057.272172][T25867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2057.272193][T25867] ? clear_bhb_loop+0x70/0xc0 [ 2057.272219][T25867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2057.272241][T25867] RIP: 0033:0x7f5cf619fb19 [ 2057.272261][T25867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2057.272280][T25867] RSP: 002b:00007f5cf709f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2057.272302][T25867] RAX: ffffffffffffffda RBX: 00007f5cf6425fa0 RCX: 00007f5cf619fb19 [ 2057.272318][T25867] RDX: 0000000000000078 RSI: 0000200000000700 RDI: 0000000000000005 [ 2057.272332][T25867] RBP: 00007f5cf709f090 R08: 0000000000000000 R09: 0000000000000000 [ 2057.272345][T25867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2057.272359][T25867] R13: 00007f5cf6426038 R14: 00007f5cf6425fa0 R15: 00007ffd80aba528 [ 2057.272394][T25867] [ 2057.773077][T25869] tipc: Bearer : already 2 bearers with priority 10 [ 2057.773103][T25869] tipc: Bearer : trying with adjusted priority [ 2057.773280][T25869] tipc: Enabled bearer , priority 9 [ 2058.205136][T25880] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15774'. [ 2058.443236][T25884] netlink: 172 bytes leftover after parsing attributes in process `syz.2.15776'. [ 2058.500158][T25886] netlink: 16 bytes leftover after parsing attributes in process `syz.4.15777'. [ 2059.771144][T25896] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15781'. [ 2059.824162][T25917] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15790'. [ 2059.866461][T25896] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15781'. [ 2059.902218][T25920] netlink: 16 bytes leftover after parsing attributes in process `syz.3.15791'. [ 2059.937799][T25896] bridge51: entered promiscuous mode [ 2060.372359][T25939] FAULT_INJECTION: forcing a failure. [ 2060.372359][T25939] name failslab, interval 1, probability 0, space 0, times 0 [ 2060.372393][T25939] CPU: 1 UID: 0 PID: 25939 Comm: syz.0.15798 Not tainted syzkaller #0 PREEMPT(full) [ 2060.372419][T25939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2060.372434][T25939] Call Trace: [ 2060.372444][T25939] [ 2060.372455][T25939] dump_stack_lvl+0xe8/0x150 [ 2060.372499][T25939] should_fail_ex+0x3eb/0x540 [ 2060.372534][T25939] should_failslab+0xa8/0x100 [ 2060.372571][T25939] __kvmalloc_node_noprof+0x171/0x820 [ 2060.372613][T25939] ? __kvmalloc_node_noprof+0x340/0x820 [ 2060.372643][T25939] ? bpf_compute_postorder+0x179/0x9a0 [ 2060.372674][T25939] ? bpf_compute_postorder+0x179/0x9a0 [ 2060.372714][T25939] bpf_compute_postorder+0x179/0x9a0 [ 2060.372747][T25939] ? __pfx_resolve_func_ptrs+0x10/0x10 [ 2060.372786][T25939] bpf_check+0x298f/0x34e0 [ 2060.372825][T25939] ? ktime_get_with_offset+0x93/0x2d0 [ 2060.372856][T25939] ? ktime_get_with_offset+0x93/0x2d0 [ 2060.372889][T25939] ? __pfx_bpf_check+0x10/0x10 [ 2060.372917][T25939] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2060.372951][T25939] bpf_prog_load+0x14da/0x1c60 [ 2060.372990][T25939] ? __pfx_bpf_prog_load+0x10/0x10 [ 2060.373032][T25939] ? __might_fault+0xaf/0x130 [ 2060.373064][T25939] __sys_bpf+0xd86/0xe00 [ 2060.373097][T25939] ? __pfx___sys_bpf+0x10/0x10 [ 2060.373133][T25939] ? __fget_files+0x2a/0x420 [ 2060.373182][T25939] ? ksys_write+0x242/0x270 [ 2060.373218][T25939] ? __pfx_ksys_write+0x10/0x10 [ 2060.373256][T25939] __x64_sys_bpf+0xba/0xd0 [ 2060.373292][T25939] do_syscall_64+0x166/0x520 [ 2060.373320][T25939] ? trace_irq_disable+0x3b/0x140 [ 2060.373351][T25939] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2060.373375][T25939] ? clear_bhb_loop+0x70/0xc0 [ 2060.373404][T25939] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2060.373427][T25939] RIP: 0033:0x7f5cf619fb19 [ 2060.373450][T25939] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2060.373470][T25939] RSP: 002b:00007f5cf709f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2060.373495][T25939] RAX: ffffffffffffffda RBX: 00007f5cf6425fa0 RCX: 00007f5cf619fb19 [ 2060.373512][T25939] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 2060.373526][T25939] RBP: 00007f5cf709f090 R08: 0000000000000000 R09: 0000000000000000 [ 2060.373542][T25939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2060.373555][T25939] R13: 00007f5cf6426038 R14: 00007f5cf6425fa0 R15: 00007ffd80aba528 [ 2060.373599][T25939] [ 2061.247156][T25968] FAULT_INJECTION: forcing a failure. [ 2061.247156][T25968] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2061.247189][T25968] CPU: 0 UID: 0 PID: 25968 Comm: syz.2.15810 Not tainted syzkaller #0 PREEMPT(full) [ 2061.247214][T25968] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2061.247229][T25968] Call Trace: [ 2061.247238][T25968] [ 2061.247250][T25968] dump_stack_lvl+0xe8/0x150 [ 2061.247294][T25968] should_fail_ex+0x3eb/0x540 [ 2061.247331][T25968] _copy_from_user+0x2d/0xb0 [ 2061.247362][T25968] __sys_bpf+0x2e7/0xe00 [ 2061.247396][T25968] ? __pfx___sys_bpf+0x10/0x10 [ 2061.247433][T25968] ? __fget_files+0x2a/0x420 [ 2061.247483][T25968] ? ksys_write+0x242/0x270 [ 2061.247516][T25968] ? __pfx_ksys_write+0x10/0x10 [ 2061.247552][T25968] __x64_sys_bpf+0xba/0xd0 [ 2061.247590][T25968] do_syscall_64+0x166/0x520 [ 2061.247618][T25968] ? trace_irq_disable+0x3b/0x140 [ 2061.247650][T25968] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2061.247675][T25968] ? clear_bhb_loop+0x70/0xc0 [ 2061.247704][T25968] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2061.247738][T25968] RIP: 0033:0x7fdf3739fb19 [ 2061.247764][T25968] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2061.247785][T25968] RSP: 002b:00007fdf38354028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2061.247810][T25968] RAX: ffffffffffffffda RBX: 00007fdf37625fa0 RCX: 00007fdf3739fb19 [ 2061.247828][T25968] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 2061.247844][T25968] RBP: 00007fdf38354090 R08: 0000000000000000 R09: 0000000000000000 [ 2061.247860][T25968] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2061.247874][T25968] R13: 00007fdf37626038 R14: 00007fdf37625fa0 R15: 00007fff8cdb5c58 [ 2061.247914][T25968] [ 2061.395535][T25973] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15808'. [ 2061.690072][T25982] netlink: 96 bytes leftover after parsing attributes in process `syz.3.15813'. [ 2061.692340][T25982] netlink: 68 bytes leftover after parsing attributes in process `syz.3.15813'. [ 2061.696625][T25982] netlink: 'syz.3.15813': attribute type 1 has an invalid length. [ 2062.852269][T26009] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2062.852311][T26009] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2062.996949][T26009] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2062.996991][T26009] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2063.105363][T26009] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2063.105404][T26009] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2063.196644][T26009] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2063.196685][T26009] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2063.404652][T26033] FAULT_INJECTION: forcing a failure. [ 2063.404652][T26033] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2063.404839][T26033] CPU: 0 UID: 0 PID: 26033 Comm: syz.0.15830 Not tainted syzkaller #0 PREEMPT(full) [ 2063.404869][T26033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2063.404893][T26033] Call Trace: [ 2063.404903][T26033] [ 2063.404914][T26033] dump_stack_lvl+0xe8/0x150 [ 2063.404960][T26033] should_fail_ex+0x3eb/0x540 [ 2063.405015][T26033] prepare_alloc_pages+0x21e/0x5f0 [ 2063.405060][T26033] __alloc_frozen_pages_noprof+0x17c/0x410 [ 2063.405099][T26033] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2063.405129][T26033] ? __alloc_frozen_pages_noprof+0x24c/0x410 [ 2063.405165][T26033] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2063.405211][T26033] __alloc_pages_noprof+0x10/0x100 [ 2063.405244][T26033] alloc_pages_bulk_noprof+0x67a/0x8a0 [ 2063.405293][T26033] ? alloc_pages_noprof+0x140/0x2b0 [ 2063.405336][T26033] __kasan_populate_vmalloc+0xb7/0x1c0 [ 2063.405374][T26033] alloc_vmap_area+0xd10/0x1410 [ 2063.405416][T26033] ? __pfx_alloc_vmap_area+0x10/0x10 [ 2063.405438][T26033] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 2063.405469][T26033] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 2063.405499][T26033] ? __get_vm_area_node+0x155/0x2f0 [ 2063.405529][T26033] __get_vm_area_node+0x200/0x2f0 [ 2063.405563][T26033] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 2063.405592][T26033] ? bpf_check+0x14ae/0x34e0 [ 2063.405624][T26033] ? lock_acquire+0x115/0x350 [ 2063.405663][T26033] ? hook_capable+0x1c3/0x5e0 [ 2063.405696][T26033] ? __pfx_hook_capable+0x10/0x10 [ 2063.405738][T26033] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 2063.405767][T26033] ? apparmor_capable+0x126/0x170 [ 2063.405799][T26033] ? bpf_lsm_capable+0x9/0x20 [ 2063.405820][T26033] ? security_capable+0x7e/0x2c0 [ 2063.405859][T26033] ? bpf_check+0x14ae/0x34e0 [ 2063.405881][T26033] __vmalloc_noprof+0xd2/0x120 [ 2063.405915][T26033] ? bpf_check+0x14ae/0x34e0 [ 2063.405942][T26033] bpf_check+0x14ae/0x34e0 [ 2063.405980][T26033] ? ktime_get_with_offset+0x93/0x2d0 [ 2063.406013][T26033] ? ktime_get_with_offset+0x93/0x2d0 [ 2063.406046][T26033] ? __pfx_bpf_check+0x10/0x10 [ 2063.406076][T26033] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2063.406111][T26033] bpf_prog_load+0x14da/0x1c60 [ 2063.406152][T26033] ? __pfx_bpf_prog_load+0x10/0x10 [ 2063.406198][T26033] ? __might_fault+0xaf/0x130 [ 2063.406232][T26033] __sys_bpf+0xd86/0xe00 [ 2063.406267][T26033] ? __pfx___sys_bpf+0x10/0x10 [ 2063.406305][T26033] ? __fget_files+0x2a/0x420 [ 2063.406357][T26033] ? ksys_write+0x242/0x270 [ 2063.406392][T26033] ? __pfx_ksys_write+0x10/0x10 [ 2063.406430][T26033] __x64_sys_bpf+0xba/0xd0 [ 2063.406469][T26033] do_syscall_64+0x166/0x520 [ 2063.406503][T26033] ? trace_irq_disable+0x3b/0x140 [ 2063.406536][T26033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2063.406571][T26033] ? clear_bhb_loop+0x70/0xc0 [ 2063.406601][T26033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2063.406630][T26033] RIP: 0033:0x7f5cf619fb19 [ 2063.406655][T26033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2063.406676][T26033] RSP: 002b:00007f5cf709f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2063.406702][T26033] RAX: ffffffffffffffda RBX: 00007f5cf6425fa0 RCX: 00007f5cf619fb19 [ 2063.406720][T26033] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 2063.406736][T26033] RBP: 00007f5cf709f090 R08: 0000000000000000 R09: 0000000000000000 [ 2063.406751][T26033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2063.406766][T26033] R13: 00007f5cf6426038 R14: 00007f5cf6425fa0 R15: 00007ffd80aba528 [ 2063.406807][T26033] [ 2063.424242][T26033] syz.0.15830: vmalloc error: size 13084800, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2063.424325][T26033] CPU: 0 UID: 0 PID: 26033 Comm: syz.0.15830 Not tainted syzkaller #0 PREEMPT(full) [ 2063.424352][T26033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2063.424366][T26033] Call Trace: [ 2063.424412][T26033] [ 2063.424422][T26033] dump_stack_lvl+0xe8/0x150 [ 2063.424465][T26033] warn_alloc+0x24d/0x270 [ 2063.424496][T26033] ? lockdep_hardirqs_on+0x7b/0x110 [ 2063.424528][T26033] ? __pfx_warn_alloc+0x10/0x10 [ 2063.424557][T26033] ? kfree+0x1c5/0x650 [ 2063.424598][T26033] ? __get_vm_area_node+0x219/0x2f0 [ 2063.424633][T26033] __vmalloc_node_range_noprof+0x396/0x16f0 [ 2063.424670][T26033] ? lock_acquire+0x115/0x350 [ 2063.424704][T26033] ? hook_capable+0x1c3/0x5e0 [ 2063.424737][T26033] ? __pfx_hook_capable+0x10/0x10 [ 2063.424809][T26033] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 2063.424907][T26033] ? apparmor_capable+0x126/0x170 [ 2063.424998][T26033] ? bpf_lsm_capable+0x9/0x20 [ 2063.425054][T26033] ? security_capable+0x7e/0x2c0 [ 2063.425157][T26033] ? bpf_check+0x14ae/0x34e0 [ 2063.425223][T26033] __vmalloc_noprof+0xd2/0x120 [ 2063.425285][T26033] ? bpf_check+0x14ae/0x34e0 [ 2063.425355][T26033] bpf_check+0x14ae/0x34e0 [ 2063.425456][T26033] ? ktime_get_with_offset+0x93/0x2d0 [ 2063.425545][T26033] ? ktime_get_with_offset+0x93/0x2d0 [ 2063.425626][T26033] ? __pfx_bpf_check+0x10/0x10 [ 2063.425705][T26033] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2063.425798][T26033] bpf_prog_load+0x14da/0x1c60 [ 2063.425900][T26033] ? __pfx_bpf_prog_load+0x10/0x10 [ 2063.426019][T26033] ? __might_fault+0xaf/0x130 [ 2063.426101][T26033] __sys_bpf+0xd86/0xe00 [ 2063.426182][T26033] ? __pfx___sys_bpf+0x10/0x10 [ 2063.426295][T26033] ? __fget_files+0x2a/0x420 [ 2063.426449][T26033] ? ksys_write+0x242/0x270 [ 2063.426538][T26033] ? __pfx_ksys_write+0x10/0x10 [ 2063.426631][T26033] __x64_sys_bpf+0xba/0xd0 [ 2063.426733][T26033] do_syscall_64+0x166/0x520 [ 2063.426838][T26033] ? trace_irq_disable+0x3b/0x140 [ 2063.426925][T26033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2063.426992][T26033] ? clear_bhb_loop+0x70/0xc0 [ 2063.427064][T26033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2063.427123][T26033] RIP: 0033:0x7f5cf619fb19 [ 2063.427190][T26033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2063.427245][T26033] RSP: 002b:00007f5cf709f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2063.427310][T26033] RAX: ffffffffffffffda RBX: 00007f5cf6425fa0 RCX: 00007f5cf619fb19 [ 2063.427355][T26033] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 2063.427398][T26033] RBP: 00007f5cf709f090 R08: 0000000000000000 R09: 0000000000000000 [ 2063.427433][T26033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2063.427469][T26033] R13: 00007f5cf6426038 R14: 00007f5cf6425fa0 R15: 00007ffd80aba528 [ 2063.427826][T26033] [ 2063.455645][T26033] Mem-Info: [ 2063.455691][T26033] active_anon:5401 inactive_anon:0 isolated_anon:0 [ 2063.455691][T26033] active_file:0 inactive_file:44902 isolated_file:0 [ 2063.455691][T26033] unevictable:1425 dirty:259 writeback:0 [ 2063.455691][T26033] slab_reclaimable:14620 slab_unreclaimable:155066 [ 2063.455691][T26033] mapped:32567 shmem:1949 pagetables:3487 [ 2063.455691][T26033] sec_pagetables:0 bounce:0 [ 2063.455691][T26033] kernel_misc_reclaimable:0 [ 2063.455691][T26033] free:1143480 free_pcp:20659 free_cma:0 [ 2063.455851][T26033] Node 0 active_anon:21604kB inactive_anon:0kB active_file:0kB inactive_file:179404kB unevictable:5700kB isolated(anon):0kB isolated(file):0kB mapped:130268kB dirty:1036kB writeback:0kB shmem:7796kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:22148kB pagetables:13808kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2063.456026][T26033] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2063.456199][T26033] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2063.456376][T26033] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 2063.456481][T26033] Node 0 DMA32 free:626032kB boost:0kB min:33936kB low:42420kB high:50904kB reserved_highatomic:0kB free_highatomic:0kB active_anon:21604kB inactive_anon:0kB active_file:0kB inactive_file:179404kB unevictable:5700kB writepending:1036kB zspages:0kB present:3129332kB managed:2523116kB mlocked:5700kB bounce:0kB free_pcp:82632kB local_pcp:42372kB free_cma:0kB [ 2063.464967][T26033] lowmem_reserve[]: 0 0 1 1 1 [ 2063.465103][T26033] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1660kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 2063.482173][T26033] lowmem_reserve[]: 0 0 0 0 0 [ 2063.482361][T26033] Node 1 Normal free:3932528kB boost:0kB min:55940kB low:69924kB high:83908kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2063.482557][T26033] lowmem_reserve[]: 0 0 0 0 0 [ 2063.482663][T26033] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 2063.483004][T26033] Node 0 DMA32: 2376*4kB (UME) 1309*8kB (UME) 1353*16kB (UME) 1176*32kB (UE) 611*64kB (UME) 429*128kB (UME) 255*256kB (UME) 113*512kB (UM) 58*1024kB (UME) 6*2048kB (UME) 63*4096kB (M) = 626136kB [ 2063.501088][T26033] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2063.501390][T26033] Node 1 Normal: 2*4kB (UM) 9*8kB (UM) 26*16kB (UM) 14*32kB (UM) 13*64kB (UM) 7*128kB (UM) 7*256kB (UM) 6*512kB (UM) 3*1024kB (UM) 1*2048kB (U) 957*4096kB (UM) = 3932528kB [ 2063.502012][T26033] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2063.502069][T26033] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2063.502116][T26033] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2063.502170][T26033] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2063.502217][T26033] 46847 total pagecache pages [ 2063.502241][T26033] 0 pages in swap cache [ 2063.502258][T26033] Free swap = 124996kB [ 2063.502282][T26033] Total swap = 124996kB [ 2063.502313][T26033] 2097051 pages RAM [ 2063.502335][T26033] 0 pages HighMem/MovableOnly [ 2063.502359][T26033] 434241 pages reserved [ 2063.502381][T26033] 0 pages cma reserved [ 2063.715248][T12250] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 2063.715354][T12250] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2063.725514][T31845] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 2063.739486][T31845] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2064.600276][T12255] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 2064.600327][T12255] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2064.668656][T31845] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2064.668698][T31845] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2064.955622][T26028] 8021q: adding VLAN 0 to HW filter on device bond59 [ 2064.987099][T26028] bond58: (slave veth0_to_bond): Releasing backup interface [ 2064.991619][T26028] bond58: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2065.034732][T26049] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15828'. [ 2065.052854][T26028] bond59: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2065.101365][T26049] bridge63: entered promiscuous mode [ 2065.114360][T26049] bond59: (slave bridge63): Enslaving as an active interface with an up link [ 2065.859893][T26068] syzkaller0: entered promiscuous mode [ 2065.859924][T26068] syzkaller0: entered allmulticast mode [ 2066.664063][T26102] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15850'. [ 2066.771597][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.771844][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.772089][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.774224][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.774450][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.774677][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.774942][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2066.775162][T26109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15854'. [ 2071.150398][T26115] workqueue: Failed to create a rescuer kthread for wq "bond60": -EINTR [ 2071.166122][T26116] bond59: (slave veth0_to_bond): Releasing backup interface [ 2071.166154][T26116] bond59: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2071.237924][T26117] bridge64: entered promiscuous mode [ 2071.277993][T19807] syz2: Port: 1 Link DOWN [ 2071.291212][T26128] netlink: 'syz.0.15860': attribute type 12 has an invalid length. [ 2071.991390][T26159] __nla_validate_parse: 27 callbacks suppressed [ 2071.991417][T26159] netlink: 32 bytes leftover after parsing attributes in process `syz.3.15870'. [ 2072.229612][T26169] gre0: entered promiscuous mode [ 2072.229650][T26169] gre0: entered allmulticast mode [ 2072.519805][T26177] netlink: 256 bytes leftover after parsing attributes in process `syz.0.15876'. [ 2072.520929][T26177] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15876'. [ 2072.787570][T26184] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15879'. [ 2072.871089][T26175] 8021q: adding VLAN 0 to HW filter on device bond46 [ 2072.922079][T26182] bond46: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2072.947184][T26175] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15875'. [ 2072.978680][T26175] bridge51: entered promiscuous mode [ 2072.995798][T26175] bond46: (slave bridge51): Enslaving as an active interface with an up link [ 2073.550914][T26217] netlink: 16 bytes leftover after parsing attributes in process `syz.4.15892'. [ 2073.772236][T26226] netlink: 64 bytes leftover after parsing attributes in process `syz.1.15895'. [ 2073.772279][T26226] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15895'. [ 2073.772301][T26226] netlink: 'syz.1.15895': attribute type 1 has an invalid length. [ 2073.870868][T26228] syzkaller0: entered promiscuous mode [ 2073.870897][T26228] syzkaller0: entered allmulticast mode [ 2074.376412][T26245] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15904'. [ 2074.434806][T26236] 8021q: adding VLAN 0 to HW filter on device bond67 [ 2074.452274][T26236] bond65: (slave veth0_to_bond): Releasing backup interface [ 2074.452303][T26236] bond65: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2074.490232][T26236] bond67: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2074.496083][T26236] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15901'. [ 2074.540158][T26236] bridge63: entered promiscuous mode [ 2074.566020][T26236] bond67: (slave bridge63): Enslaving as an active interface with an up link [ 2074.725636][T26258] x_tables: unsorted underflow at hook 3 [ 2074.726497][T26258] x_tables: duplicate underflow at hook 2 [ 2074.961313][T26266] IPVS: nq: FWM 3 0x00000003 - no destination available [ 2075.194814][T26275] openvswitch: netlink: Invalid VLAN frame [ 2075.213610][T26277] SET target dimension over the limit! [ 2076.080640][T26287] syzkaller0: entered promiscuous mode [ 2076.080668][T26287] syzkaller0: entered allmulticast mode [ 2076.731254][T26289] netlink: 'syz.1.15925': attribute type 1 has an invalid length. [ 2076.810139][T26289] 8021q: adding VLAN 0 to HW filter on device bond47 [ 2076.814955][T26310] bond46: (slave veth0_to_bond): Releasing backup interface [ 2076.814982][T26310] bond46: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2076.893264][T26310] bond47: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2076.933903][T26289] bridge52: entered promiscuous mode [ 2076.946062][T26289] bond47: (slave bridge52): Enslaving as an active interface with an up link [ 2077.252420][T26326] __nla_validate_parse: 6 callbacks suppressed [ 2077.252445][T26326] netlink: 176 bytes leftover after parsing attributes in process `syz.4.15937'. [ 2077.252894][T26326] tap0: tun_chr_ioctl cmd 2148553947 [ 2077.628972][T26345] netlink: 'syz.0.15945': attribute type 1 has an invalid length. [ 2077.629008][T26345] netlink: 244 bytes leftover after parsing attributes in process `syz.0.15945'. [ 2078.311639][T26352] netlink: 'syz.0.15948': attribute type 1 has an invalid length. [ 2078.385798][T26352] 8021q: adding VLAN 0 to HW filter on device bond63 [ 2078.405986][T26366] bond61: (slave veth0_to_bond): Releasing backup interface [ 2078.406018][T26366] bond61: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2078.464331][T26352] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15948'. [ 2078.481054][T26366] bond63: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2078.521492][T26352] bridge53: entered promiscuous mode [ 2078.537962][T26352] bond63: (slave bridge53): Enslaving as an active interface with an up link [ 2079.029372][T26394] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2079.034834][T26394] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15963'. [ 2079.181440][T26397] tipc: Enabled bearer , priority 0 [ 2079.285914][T26397] syzkaller0: entered promiscuous mode [ 2079.285945][T26397] syzkaller0: entered allmulticast mode [ 2079.286641][T26397] tipc: Resetting bearer [ 2079.286798][T26403] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15966'. [ 2079.286822][T26403] netlink: 24 bytes leftover after parsing attributes in process `syz.2.15966'. [ 2079.485302][T20602] tipc: Resetting bearer [ 2079.495145][T26396] tipc: Resetting bearer [ 2079.677614][T26415] netlink: 108 bytes leftover after parsing attributes in process `syz.4.15971'. [ 2079.837296][T26413] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15970'. [ 2079.848999][T26413] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15970'. [ 2080.066415][T26409] netlink: 'syz.2.15968': attribute type 1 has an invalid length. [ 2080.103448][T26427] netlink: 'syz.1.15975': attribute type 1 has an invalid length. [ 2080.183259][T26429] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15968'. [ 2084.022319][T26396] tipc: Disabling bearer [ 2084.026976][T26409] workqueue: Failed to create a rescuer kthread for wq "bond60": -EINTR [ 2084.041607][T26429] bridge64: entered promiscuous mode [ 2084.609994][T26480] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15989'. [ 2084.912250][T26487] veth101: entered allmulticast mode [ 2086.099125][T26538] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2086.227650][T26510] netlink: 'syz.4.15998': attribute type 1 has an invalid length. [ 2086.281223][T26541] syzkaller0: entered promiscuous mode [ 2086.281257][T26541] syzkaller0: entered allmulticast mode [ 2086.323298][T26510] 8021q: adding VLAN 0 to HW filter on device bond68 [ 2086.343216][T26542] bond67: (slave veth0_to_bond): Releasing backup interface [ 2086.343335][T26542] bond67: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2086.347301][T26510] netlink: 4 bytes leftover after parsing attributes in process `syz.4.15998'. [ 2086.365220][T26542] bond68: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2087.451815][T26567] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16015'. [ 2087.451879][T26567] openvswitch: netlink: Missing key (keys=40, expected=80) [ 2087.982017][T26574] netlink: 24 bytes leftover after parsing attributes in process `syz.2.16017'. [ 2093.664828][T26510] bridge64: entered promiscuous mode [ 2093.672617][T26510] bond68: (slave bridge64): Enslaving as an active interface with an up link [ 2094.396993][T26610] netlink: 9 bytes leftover after parsing attributes in process `syz.1.16030'. [ 2094.415341][T26610] 0ªX¹¦Dö»: entered promiscuous mode [ 2094.415370][T26610] 0ªX¹¦Dö»: left allmulticast mode [ 2094.460549][T26610] netlink: 5 bytes leftover after parsing attributes in process `syz.1.16030'. [ 2094.460877][T26610] 0ªî{X¹¦: renamed from 00ªX¹¦Dö» [ 2094.482344][T26610] 0ªî{X¹¦: left promiscuous mode [ 2094.482416][T26610] 0ªî{X¹¦: entered allmulticast mode [ 2094.513759][T26610] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 2094.773875][T26617] x_tables: duplicate underflow at hook 2 [ 2094.936919][T26619] syzkaller0: entered promiscuous mode [ 2094.936947][T26619] syzkaller0: entered allmulticast mode [ 2095.875201][T26632] netlink: 'syz.4.16039': attribute type 1 has an invalid length. [ 2095.981600][T26639] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16039'. [ 2099.972682][T26632] workqueue: Failed to create a rescuer kthread for wq "bond69": -EINTR [ 2099.982362][T26636] bond68: (slave veth0_to_bond): Releasing backup interface [ 2099.982397][T26636] bond68: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2100.046030][T26639] bridge65: entered promiscuous mode [ 2100.180191][T26656] netlink: 24 bytes leftover after parsing attributes in process `syz.1.16044'. [ 2100.610039][T26669] bridge0: port 1(veth1_virt_wifi) entered blocking state [ 2100.610800][T26669] bridge0: port 1(veth1_virt_wifi) entered disabled state [ 2100.610995][T26669] veth1_virt_wifi: entered allmulticast mode [ 2100.617584][T26669] veth1_virt_wifi: left allmulticast mode [ 2100.857808][T26683] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16054'. [ 2101.055309][T26689] netlink: 16 bytes leftover after parsing attributes in process `syz.3.16057'. [ 2101.678023][T26696] netlink: 'syz.3.16059': attribute type 1 has an invalid length. [ 2101.721563][T26696] 8021q: adding VLAN 0 to HW filter on device bond62 [ 2101.778116][T26711] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16065'. [ 2101.803885][T26696] bond59: (slave veth0_to_bond): Releasing backup interface [ 2101.803913][T26696] bond59: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2101.804221][T26702] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16059'. [ 2101.859936][T26713] netlink: 'syz.1.16064': attribute type 1 has an invalid length. [ 2101.859961][T26713] netlink: 36 bytes leftover after parsing attributes in process `syz.1.16064'. [ 2101.885039][T26696] bond62: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 2101.922455][T26702] bridge52: entered promiscuous mode [ 2101.941141][T26702] bond62: (slave bridge52): Enslaving as an active interface with an up link [ 2102.199458][T26723] netlink: 'syz.2.16068': attribute type 14 has an invalid length. [ 2102.346948][T26700] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 2102.386839][T26731] x_tables: unsorted underflow at hook 3 [ 2102.451632][T26733] netlink: 16 bytes leftover after parsing attributes in process `syz.2.16072'. [ 2102.550453][T26739] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16074'. [ 2102.790995][T26747] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16076'. [ 2102.960031][T26756] netlink: 'syz.2.16080': attribute type 1 has an invalid length. [ 2102.960633][T26756] netlink: 244 bytes leftover after parsing attributes in process `syz.2.16080'. [ 2103.180434][T26761] x_tables: unsorted underflow at hook 3 [ 2103.181216][T26761] x_tables: duplicate underflow at hook 2 [ 2103.277556][T26753] bridge65: entered promiscuous mode [ 2103.522057][T26772] syzkaller0: entered promiscuous mode [ 2103.522086][T26772] syzkaller0: entered allmulticast mode [ 2104.526777][T26790] netlink: 'syz.3.16093': attribute type 3 has an invalid length. [ 2104.947667][T26806] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 2105.328787][T26827] netlink: 'syz.3.16103': attribute type 4 has an invalid length. [ 2105.447381][T26832] x_tables: unsorted underflow at hook 3 [ 2105.448193][T26832] x_tables: duplicate underflow at hook 2 [ 2105.725625][T26811] __nla_validate_parse: 6 callbacks suppressed [ 2105.725652][T26811] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16096'. [ 2105.824051][T26840] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16096'. [ 2106.062034][T26839] bond47: (slave veth0_to_bond): Releasing backup interface [ 2106.062064][T26839] bond47: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2106.122504][T26840] bridge53: entered promiscuous mode [ 2106.369926][T26845] bond38: entered allmulticast mode [ 2106.370698][T26845] bond38: left allmulticast mode [ 2106.784259][T26866] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16115'. [ 2107.114583][T26888] x_tables: unsorted underflow at hook 3 [ 2107.117445][T26888] x_tables: duplicate underflow at hook 2 [ 2107.354390][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.354433][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.354480][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.354509][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.354539][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.354567][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.354606][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.366083][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.366184][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.366260][T26877] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 2107.810153][T26897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16124'. [ 2107.832447][T26897] bond62: (slave veth0_to_bond): Releasing backup interface [ 2107.832478][T26897] bond62: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2107.870201][T26897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16124'. [ 2107.957380][T26897] bridge53: entered promiscuous mode [ 2107.996422][T26912] netlink: 160 bytes leftover after parsing attributes in process `syz.4.16130'. [ 2108.154408][T26918] netlink: 32 bytes leftover after parsing attributes in process `syz.0.16133'. [ 2108.154438][T26918] netlink: 30 bytes leftover after parsing attributes in process `syz.0.16133'. [ 2108.154459][T26918] netlink: 30 bytes leftover after parsing attributes in process `syz.0.16133'. [ 2108.260798][T26922] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16132'. [ 2108.294782][T19807] lo speed is unknown, defaulting to 1000 [ 2108.305738][T28860] lo speed is unknown, defaulting to 1000 [ 2108.309750][T31845] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2108.313117][T12255] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 2108.313313][T12255] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 2108.313421][T12255] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 2108.357592][T26920] tipc: Enabling of bearer rejected, already enabled [ 2108.608999][T26935] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2108.616282][T26934] netlink: 'syz.2.16139': attribute type 4 has an invalid length. [ 2108.825827][T26948] x_tables: unsorted underflow at hook 3 [ 2108.826526][T26948] x_tables: duplicate underflow at hook 2 [ 2109.438171][T26952] bond63: (slave veth0_to_bond): Releasing backup interface [ 2109.445988][T26952] bond63: (slave veth0_to_bond): the permanent HWaddr of slave - aa:aa:aa:aa:aa:1d - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 2109.523239][T26968] bridge54: entered promiscuous mode [ 2110.598133][T26993] tipc: Enabled bearer , priority 0 [ 2110.697427][T26993] syzkaller0: entered promiscuous mode [ 2110.697460][T26993] syzkaller0: entered allmulticast mode [ 2110.711849][T26993] tipc: Resetting bearer [ 2110.771154][T26990] tipc: Resetting bearer [ 2114.277294][T27011] x_tables: unsorted underflow at hook 3 [ 2114.278106][T27011] x_tables: duplicate underflow at hook 2 [ 2114.459476][T27019] __nla_validate_parse: 2 callbacks suppressed [ 2114.474206][T27019] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16164'. [ 2114.474237][T27019] netlink: 24 bytes leftover after parsing attributes in process `syz.4.16164'. [ 2114.479790][T27019] netlink: 64 bytes leftover after parsing attributes in process `syz.4.16164'. [ 2115.680369][T27024] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16165'. [ 2116.614406][T26990] tipc: Disabling bearer [ 2116.709301][T27024] bridge65: entered promiscuous mode [ 2116.836293][T27032] syzkaller0: entered promiscuous mode [ 2116.836320][T27032] syzkaller0: entered allmulticast mode [ 2117.145037][T27039] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 2117.303987][T27042] syzkaller0: entered promiscuous mode [ 2117.304015][T27042] syzkaller0: entered allmulticast mode [ 2117.806291][T27076] netlink: 44 bytes leftover after parsing attributes in process `syz.0.16185'. [ 2118.707758][T27124] netlink: 108 bytes leftover after parsing attributes in process `syz.0.16203'. [ 2118.775080][T27126] bond63: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 2118.790160][T27126] bond63 (unregistering): Released all slaves [ 2118.831506][T27131] openvswitch: netlink: Key 6 has unexpected len 13 expected 2 [ 2118.882251][T27131] netlink: 292 bytes leftover after parsing attributes in process `syz.4.16207'. [ 2119.093202][T27144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16210'. [ 2119.093260][T27144] nbd0: detected capacity change from 0 to 4194303 [ 2119.143524][ T1682] block nbd0: Dead connection, failed to find a fallback [ 2120.119944][T27174] FAULT_INJECTION: forcing a failure. [ 2120.119944][T27174] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2120.119979][T27174] CPU: 0 UID: 0 PID: 27174 Comm: syz.4.16222 Not tainted syzkaller #0 PREEMPT(full) [ 2120.120005][T27174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2120.120020][T27174] Call Trace: [ 2120.120030][T27174] [ 2120.120040][T27174] dump_stack_lvl+0xe8/0x150 [ 2120.120086][T27174] should_fail_ex+0x3eb/0x540 [ 2120.120124][T27174] _copy_from_iter+0x1d3/0x1680 [ 2120.120152][T27174] ? __alloc_skb+0x27a/0x7a0 [ 2120.120192][T27174] ? __alloc_skb+0x27a/0x7a0 [ 2120.120229][T27174] ? __alloc_skb+0x27a/0x7a0 [ 2120.120264][T27174] ? __pfx__copy_from_iter+0x10/0x10 [ 2120.120288][T27174] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 2120.120316][T27174] ? __alloc_skb+0x27a/0x7a0 [ 2120.120348][T27174] ? __alloc_skb+0x27a/0x7a0 [ 2120.120390][T27174] ? netlink_sendmsg+0x64f/0xb20 [ 2120.120425][T27174] ? skb_put+0x112/0x210 [ 2120.120450][T27174] netlink_sendmsg+0x6bb/0xb20 [ 2120.120495][T27174] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2120.120533][T27174] ? aa_sock_msg_perm+0x144/0x210 [ 2120.120564][T27174] ? apparmor_socket_sendmsg+0x98/0x360 [ 2120.120608][T27174] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2120.120645][T27174] sock_sendmsg_nosec+0x14e/0x190 [ 2120.120679][T27174] ____sys_sendmsg+0x54e/0x850 [ 2120.120709][T27174] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2120.120746][T27174] ? import_iovec+0x73/0xa0 [ 2120.120779][T27174] ___sys_sendmsg+0x2a5/0x360 [ 2120.120800][T27174] ? __lock_acquire+0x747/0x2de0 [ 2120.120836][T27174] ? __pfx____sys_sendmsg+0x10/0x10 [ 2120.120907][T27174] ? __fget_files+0x3a2/0x420 [ 2120.120935][T27174] ? __fget_files+0x2a/0x420 [ 2120.120975][T27174] __x64_sys_sendmsg+0x1b1/0x290 [ 2120.121005][T27174] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2120.121057][T27174] do_syscall_64+0x166/0x520 [ 2120.121087][T27174] ? trace_irq_disable+0x3b/0x140 [ 2120.121120][T27174] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2120.121145][T27174] ? clear_bhb_loop+0x70/0xc0 [ 2120.121175][T27174] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2120.121198][T27174] RIP: 0033:0x7f680979fb19 [ 2120.121220][T27174] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2120.121240][T27174] RSP: 002b:00007f680a65a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2120.121265][T27174] RAX: ffffffffffffffda RBX: 00007f6809a25fa0 RCX: 00007f680979fb19 [ 2120.121283][T27174] RDX: 0000000000000000 RSI: 0000200000000b40 RDI: 0000000000000005 [ 2120.121298][T27174] RBP: 00007f680a65a090 R08: 0000000000000000 R09: 0000000000000000 [ 2120.121312][T27174] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2120.121326][T27174] R13: 00007f6809a26038 R14: 00007f6809a25fa0 R15: 00007ffec74bc818 [ 2120.121364][T27174] [ 2120.449411][T27181] x_tables: unsorted underflow at hook 3 [ 2120.450166][T27181] x_tables: duplicate underflow at hook 2 [ 2120.566519][T27187] netlink: 'syz.4.16227': attribute type 1 has an invalid length. [ 2120.681172][T27187] bond69: entered promiscuous mode [ 2120.682921][T27187] 8021q: adding VLAN 0 to HW filter on device bond69 [ 2120.873497][T27200] netlink: 'syz.3.16232': attribute type 1 has an invalid length. [ 2121.085923][T27210] netlink: 68 bytes leftover after parsing attributes in process `syz.1.16236'. [ 2121.280553][T27215] x_tables: unsorted underflow at hook 3 [ 2121.282879][T27215] x_tables: duplicate underflow at hook 2 [ 2121.587688][T27234] netlink: 'syz.1.16245': attribute type 4 has an invalid length. [ 2121.587715][T27234] netlink: 17 bytes leftover after parsing attributes in process `syz.1.16245'. [ 2122.326288][T27271] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16258'. [ 2122.328167][T27271] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16258'. [ 2122.943922][T27267] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16259'. [ 2122.989742][T27289] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2122.992596][T27267] bridge64: entered promiscuous mode [ 2123.261212][T27292] netlink: 24 bytes leftover after parsing attributes in process `syz.0.16262'. [ 2123.302249][T27302] x_tables: unsorted underflow at hook 3 [ 2123.303122][T27302] x_tables: duplicate underflow at hook 2 [ 2123.877086][T27334] syzkaller0: entered promiscuous mode [ 2123.877114][T27334] syzkaller0: entered allmulticast mode [ 2124.532129][T27358] syzkaller1: entered promiscuous mode [ 2124.532156][T27358] syzkaller1: entered allmulticast mode [ 2124.570837][T27362] syzkaller0: entered promiscuous mode [ 2124.570862][T27362] syzkaller0: entered allmulticast mode [ 2124.580225][T27358] netlink: 'syz.4.16286': attribute type 1 has an invalid length. [ 2124.675508][T27346] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16281'. [ 2124.699996][T27346] bridge64: entered promiscuous mode [ 2125.343360][T27394] syzkaller0: entered promiscuous mode [ 2125.343385][T27394] syzkaller0: entered allmulticast mode [ 2125.388031][T27395] netlink: 160 bytes leftover after parsing attributes in process `syz.1.16301'. [ 2125.520915][T27397] netlink: 24 bytes leftover after parsing attributes in process `syz.2.16302'. [ 2125.677201][T27412] netlink: 16 bytes leftover after parsing attributes in process `syz.3.16307'. [ 2125.700195][T27414] netlink: 'syz.1.16308': attribute type 1 has an invalid length. [ 2125.710622][T27412] FAULT_INJECTION: forcing a failure. [ 2125.710622][T27412] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2125.712829][T27412] CPU: 1 UID: 0 PID: 27412 Comm: syz.3.16307 Not tainted syzkaller #0 PREEMPT(full) [ 2125.712905][T27412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2125.712954][T27412] Call Trace: [ 2125.712984][T27412] [ 2125.713014][T27412] dump_stack_lvl+0xe8/0x150 [ 2125.713140][T27412] should_fail_ex+0x3eb/0x540 [ 2125.713227][T27412] _copy_from_iter+0x1d3/0x1680 [ 2125.713298][T27412] ? __alloc_skb+0x27a/0x7a0 [ 2125.713395][T27412] ? __alloc_skb+0x27a/0x7a0 [ 2125.713489][T27412] ? __alloc_skb+0x27a/0x7a0 [ 2125.713579][T27412] ? __pfx__copy_from_iter+0x10/0x10 [ 2125.713646][T27412] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 2125.713720][T27412] ? __alloc_skb+0x27a/0x7a0 [ 2125.713819][T27412] ? __alloc_skb+0x27a/0x7a0 [ 2125.713925][T27412] ? netlink_sendmsg+0x64f/0xb20 [ 2125.714012][T27412] ? skb_put+0x112/0x210 [ 2125.714071][T27412] netlink_sendmsg+0x6bb/0xb20 [ 2125.714176][T27412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2125.714274][T27412] ? aa_sock_msg_perm+0x144/0x210 [ 2125.714363][T27412] ? apparmor_socket_sendmsg+0x18b/0x360 [ 2125.714473][T27412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2125.714561][T27412] sock_sendmsg_nosec+0x14e/0x190 [ 2125.714661][T27412] ____sys_sendmsg+0x54e/0x850 [ 2125.714740][T27412] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2125.714836][T27412] ? import_iovec+0x73/0xa0 [ 2125.714915][T27412] ___sys_sendmsg+0x2a5/0x360 [ 2125.714978][T27412] ? __lock_acquire+0x747/0x2de0 [ 2125.715059][T27412] ? __pfx____sys_sendmsg+0x10/0x10 [ 2125.715226][T27412] ? __fget_files+0x3a2/0x420 [ 2125.715293][T27412] ? __fget_files+0x2a/0x420 [ 2125.715416][T27412] __x64_sys_sendmsg+0x1b1/0x290 [ 2125.715489][T27412] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2125.715637][T27412] do_syscall_64+0x166/0x520 [ 2125.715711][T27412] ? trace_irq_disable+0x3b/0x140 [ 2125.715812][T27412] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2125.715877][T27412] ? clear_bhb_loop+0x70/0xc0 [ 2125.715946][T27412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2125.716009][T27412] RIP: 0033:0x7f47a159fb19 [ 2125.716059][T27412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2125.716113][T27412] RSP: 002b:00007f47a2550028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2125.716177][T27412] RAX: ffffffffffffffda RBX: 00007f47a1825fa0 RCX: 00007f47a159fb19 [ 2125.716221][T27412] RDX: 0000000020000000 RSI: 00002000000003c0 RDI: 0000000000000006 [ 2125.716262][T27412] RBP: 00007f47a2550090 R08: 0000000000000000 R09: 0000000000000000 [ 2125.716304][T27412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2125.716338][T27412] R13: 00007f47a1826038 R14: 00007f47a1825fa0 R15: 00007ffd38f5e6e8 [ 2125.716435][T27412] [ 2126.027085][T27414] 8021q: adding VLAN 0 to HW filter on device bond48 [ 2126.400762][T27411] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16306'. [ 2126.421368][T27411] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16306'. [ 2126.446849][T27411] bridge64: entered promiscuous mode [ 2126.542722][T27434] syzkaller0: entered promiscuous mode [ 2126.542749][T27434] syzkaller0: entered allmulticast mode [ 2126.603457][T27436] netlink: 'syz.3.16315': attribute type 1 has an invalid length. [ 2126.603483][T27436] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16315'. [ 2127.457062][T24752] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 2127.467936][T24752] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 2127.477388][T24752] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 2127.488052][T24752] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 2127.495987][T24752] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 2127.876637][T27475] syzkaller0: entered promiscuous mode [ 2127.876662][T27475] syzkaller0: entered allmulticast mode [ 2128.380258][T27482] netlink: 28 bytes leftover after parsing attributes in process `syz.1.16328'. [ 2128.382434][T27482] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16328'. [ 2128.411857][T27482] bridge53: entered promiscuous mode [ 2128.465598][T27461] lo speed is unknown, defaulting to 1000 [ 2128.893394][T27461] bridge0: port 1(bridge_slave_0) entered blocking state [ 2128.893531][T27461] bridge0: port 1(bridge_slave_0) entered disabled state [ 2128.893804][T27461] bridge_slave_0: entered allmulticast mode [ 2128.895105][T27461] bridge_slave_0: entered promiscuous mode [ 2128.903013][T27461] bridge0: port 2(bridge_slave_1) entered blocking state [ 2128.903509][T27461] bridge0: port 2(bridge_slave_1) entered disabled state [ 2128.903901][T27461] bridge_slave_1: entered allmulticast mode [ 2128.912499][T27461] bridge_slave_1: entered promiscuous mode [ 2128.967434][T27461] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2128.975410][T27461] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2129.006891][T27461] team0: Port device team_slave_0 added [ 2129.013931][T27461] team0: Port device team_slave_1 added [ 2129.040832][T27461] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2129.040853][T27461] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2129.040887][T27461] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2129.042530][T27461] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2129.042547][T27461] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2129.042577][T27461] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2129.150741][T27461] hsr_slave_0: entered promiscuous mode [ 2129.151663][T27461] hsr_slave_1: entered promiscuous mode [ 2129.280627][T27461] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2129.280657][T27461] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2129.331736][T27461] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2129.331766][T27461] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2129.366577][T27461] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2129.366606][T27461] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2129.413929][T27461] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2129.413959][T27461] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2129.551745][T27494] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16329'. [ 2129.577662][T27494] netlink: 'syz.0.16329': attribute type 9 has an invalid length. [ 2129.614139][T27494] bridge54: entered promiscuous mode [ 2129.628729][ T54] Bluetooth: hci5: command tx timeout [ 2129.690445][T27461] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2129.709580][T27461] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2129.711016][T27461] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2129.739670][T27461] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2129.740691][T27461] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2129.769146][T27461] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2129.771019][T27461] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2129.804784][T27461] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2130.066153][T27461] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2130.097752][T27461] 8021q: adding VLAN 0 to HW filter on device team0 [ 2130.113208][T12248] bridge0: port 1(bridge_slave_0) entered blocking state [ 2130.113322][T12248] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2130.146220][T12259] bridge0: port 2(bridge_slave_1) entered blocking state [ 2130.146323][T12259] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2130.615233][T27461] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2130.666421][T27461] veth0_vlan: entered promiscuous mode [ 2130.680960][T27461] veth1_vlan: entered promiscuous mode [ 2130.712805][T27461] veth0_macvtap: entered promiscuous mode [ 2130.716702][T27461] veth1_macvtap: entered promiscuous mode [ 2130.746757][T27461] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2130.766449][T27461] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2130.873443][T12260] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2130.873468][T12260] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2130.915629][T12259] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2130.915655][T12259] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2130.922958][T31845] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2130.926564][T12260] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2130.926724][T12260] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2130.926823][T12260] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2131.708620][ T54] Bluetooth: hci5: command tx timeout [ 2133.788530][ T54] Bluetooth: hci5: command tx timeout [ 2135.868621][ T54] Bluetooth: hci5: command tx timeout [ 2147.204834][T27551] syzkaller1: entered promiscuous mode [ 2147.204860][T27551] syzkaller1: entered allmulticast mode [ 2147.249392][T27551] netlink: 'syz.4.16342': attribute type 1 has an invalid length. [ 2147.404100][T24752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2147.410785][T24752] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2147.418945][T24752] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2147.440589][T24752] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2147.445015][T24752] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2148.007836][T27546] netlink: 28 bytes leftover after parsing attributes in process `syz.1.16339'. [ 2148.031845][T27546] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16339'. [ 2148.054687][T27546] bridge53: entered promiscuous mode [ 2148.637753][T27588] netlink: 108 bytes leftover after parsing attributes in process `syz.3.16350'. [ 2148.826474][T27557] lo speed is unknown, defaulting to 1000 [ 2149.149867][T27602] syzkaller1: entered promiscuous mode [ 2149.149893][T27602] syzkaller1: entered allmulticast mode [ 2149.178146][T27602] netlink: 'syz.1.16355': attribute type 1 has an invalid length. [ 2149.468640][ T54] Bluetooth: hci2: command tx timeout [ 2149.560856][T27608] syzkaller1: entered promiscuous mode [ 2149.560882][T27608] syzkaller1: entered allmulticast mode [ 2149.581406][T27608] netlink: 'syz.2.16357': attribute type 1 has an invalid length. [ 2150.160069][T27616] netlink: 28 bytes leftover after parsing attributes in process `syz.1.16360'. [ 2150.162388][T27616] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16360'. [ 2150.202928][T27616] bridge53: entered promiscuous mode [ 2150.961986][T27557] bridge0: port 1(bridge_slave_0) entered blocking state [ 2150.965143][T27557] bridge0: port 1(bridge_slave_0) entered disabled state [ 2150.965325][T27557] bridge_slave_0: entered allmulticast mode [ 2150.993390][T27557] bridge_slave_0: entered promiscuous mode [ 2151.005147][T27557] bridge0: port 2(bridge_slave_1) entered blocking state [ 2151.006939][T27557] bridge0: port 2(bridge_slave_1) entered disabled state [ 2151.007115][T27557] bridge_slave_1: entered allmulticast mode [ 2151.031789][T27557] bridge_slave_1: entered promiscuous mode [ 2151.082906][T27557] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2151.086171][T27557] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2151.146206][T27557] team0: Port device team_slave_0 added [ 2151.155837][T27557] team0: Port device team_slave_1 added [ 2151.192568][T27557] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2151.192588][T27557] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2151.192616][T27557] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2151.194685][T27557] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2151.194703][T27557] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2151.194733][T27557] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2151.411073][T27557] hsr_slave_0: entered promiscuous mode [ 2151.412213][T27557] hsr_slave_1: entered promiscuous mode [ 2151.413029][T27557] debugfs: 'hsr0' already exists in 'hsr' [ 2151.413051][T27557] Cannot create hsr debugfs directory [ 2151.548360][ T54] Bluetooth: hci2: command tx timeout [ 2151.627772][T27655] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 2151.705895][T27658] ip_tables: iptables: counters copy to user failed while replacing table [ 2151.770606][T27653] netlink: 'syz.2.16372': attribute type 1 has an invalid length. [ 2151.770633][T27653] nbd: illegal input index 33022 [ 2152.335408][T27557] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2152.348573][T27557] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2152.351543][T27557] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2152.383044][T27557] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2152.384021][T27557] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2152.432275][T27557] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2152.435667][T27557] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2152.460488][T27557] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2152.550377][T27670] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16378'. [ 2152.595119][T27670] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16378'. [ 2152.600967][T27680] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16381'. [ 2152.643381][T27670] bridge1: entered promiscuous mode [ 2152.839981][T27557] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2152.889153][T27557] 8021q: adding VLAN 0 to HW filter on device team0 [ 2152.924960][T20602] bridge0: port 1(bridge_slave_0) entered blocking state [ 2152.925075][T20602] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2152.967164][T20602] bridge0: port 2(bridge_slave_1) entered blocking state [ 2152.967277][T20602] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2153.167608][T27707] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16389'. [ 2153.387766][T27710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16389'. [ 2153.628458][ T54] Bluetooth: hci2: command tx timeout [ 2153.801132][T27731] netlink: 16 bytes leftover after parsing attributes in process `syz.1.16396'. [ 2154.151366][T27557] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2154.336800][T27557] veth0_vlan: entered promiscuous mode [ 2154.374020][T27557] veth1_vlan: entered promiscuous mode [ 2154.525930][T27557] veth0_macvtap: entered promiscuous mode [ 2154.543868][T27729] netlink: 28 bytes leftover after parsing attributes in process `syz.2.16395'. [ 2154.544134][T27557] veth1_macvtap: entered promiscuous mode [ 2154.593947][T27729] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16395'. [ 2154.616373][T27729] bridge1: entered promiscuous mode [ 2154.683504][T27557] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2154.744543][T27557] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2154.938527][T20602] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2154.939440][T20602] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2154.978556][T31845] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2154.978950][T31845] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2155.109903][T20602] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2155.109925][T20602] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2155.207592][T12260] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2155.207615][T12260] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2155.293129][T27763] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16406'. [ 2155.293156][T27763] netlink: 48 bytes leftover after parsing attributes in process `syz.1.16406'. [ 2155.620116][T27782] netlink: 'syz.1.16410': attribute type 21 has an invalid length. [ 2155.620144][T27782] netlink: 128 bytes leftover after parsing attributes in process `syz.1.16410'. [ 2155.620209][T27782] netlink: 'syz.1.16410': attribute type 5 has an invalid length. [ 2155.620226][T27782] netlink: 3 bytes leftover after parsing attributes in process `syz.1.16410'. [ 2155.708361][ T54] Bluetooth: hci2: command tx timeout [ 2156.012859][T24752] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2156.021602][T24752] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2156.037193][T24752] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2156.061413][T24752] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2156.062325][T24752] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2156.725929][T27795] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16414'. [ 2156.746292][T12260] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2156.746335][T12260] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2156.811479][T27795] bridge1: entered promiscuous mode [ 2156.859621][T12260] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2156.859662][T12260] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2156.960434][T12260] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2156.960474][T12260] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2157.047063][T27791] lo speed is unknown, defaulting to 1000 [ 2157.054544][T12260] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2157.054582][T12260] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2157.665554][T12260] pimreg: left allmulticast mode [ 2158.063229][T27760] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 2158.207967][ T54] Bluetooth: hci1: command tx timeout [ 2158.577115][T27833] __nla_validate_parse: 1 callbacks suppressed [ 2158.577142][T27833] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16420'. [ 2158.661058][T12260] bond38 (unregistering): (slave gre2): Releasing backup interface [ 2158.661158][T12260] gre2 (unregistering): left promiscuous mode [ 2158.712039][T27840] netlink: 'syz.2.16422': attribute type 21 has an invalid length. [ 2158.712069][T27840] IPv6: NLM_F_CREATE should be specified when creating new route [ 2158.763192][T27840] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16422'. [ 2158.763230][T27840] openvswitch: netlink: IP tunnel dst address not specified [ 2159.040527][T12260] bond34 (unregistering): (slave geneve4): Releasing active interface [ 2159.106010][T12260] team0: Port device bridge1 removed [ 2159.119822][T12260] team0: Port device bridge2 removed [ 2159.126715][T12260] team0: Port device bridge3 removed [ 2159.142267][T12260] team0: Port device bridge4 removed [ 2159.147996][T12260] team0: Port device bridge5 removed [ 2159.167362][T12260] team0: Port device bridge6 removed [ 2159.181734][T12260] team0: Port device bridge7 removed [ 2159.187729][T12260] team0: Port device bridge8 removed [ 2159.211326][T12260] team0: Port device bridge9 removed [ 2159.217422][T12260] team0: Port device bridge10 removed [ 2159.243523][T12260] team0: Port device bridge11 removed [ 2159.255067][T12260] team0: Port device bridge12 removed [ 2159.271082][T12260] team0: Port device bridge13 removed [ 2159.282300][T12260] team0: Port device bridge14 removed [ 2159.295368][T12260] team0: Port device bridge15 removed [ 2159.307481][T12260] team0: Port device bridge16 removed [ 2159.323502][T12260] team0: Port device bridge17 removed [ 2159.337922][T12260] team0: Port device bridge18 removed [ 2159.353984][T12260] team0: Port device bridge19 removed [ 2159.366855][T12260] team0: Port device bridge20 removed [ 2159.381212][T12260] team0: Port device bridge21 removed [ 2159.417315][T12260] team0: Port device bridge0 removed [ 2159.432206][T12260] team0: Port device bridge24 removed [ 2159.437365][T12260] team0: Port device bridge25 removed [ 2159.453867][T12260] team0: Port device bridge26 removed [ 2159.468109][T12260] team0: Port device bridge27 removed [ 2159.480838][T12260] team0: Port device bridge28 removed [ 2159.485834][T12260] team0: Port device bridge29 removed [ 2159.502355][T12260] team0: Port device bridge30 removed [ 2159.507452][T12260] team0: Port device bridge31 removed [ 2159.524133][T12260] team0: Port device bridge32 removed [ 2159.536995][T12260] team0: Port device bridge33 removed [ 2159.551218][T12260] team0: Port device bridge34 removed [ 2159.556482][T12260] team0: Port device bridge35 removed [ 2159.573797][T12260] team0: Port device bridge36 removed [ 2159.586683][T12260] team0: Port device bridge37 removed [ 2159.598907][T12260] team0: Port device bridge38 removed [ 2159.652410][T12260] bond37 (unregistering): (slave bridge45): Releasing backup interface [ 2159.657951][T12260] bond42 (unregistering): (slave bridge46): Releasing backup interface [ 2159.657983][T12260] bridge46 (unregistering): left promiscuous mode [ 2159.658011][T12260] bridge46 (unregistering): left allmulticast mode [ 2159.705398][T12260] bond43 (unregistering): (slave bridge47): Releasing backup interface [ 2159.729183][T12260] bond45 (unregistering): (slave bridge50): Releasing backup interface [ 2159.734490][T12260] bond46 (unregistering): (slave bridge51): Releasing backup interface [ 2159.760442][T12260] bond47 (unregistering): (slave bridge52): Releasing backup interface [ 2159.784776][T12260] bond0 (unregistering): Released all slaves [ 2159.796612][T12260] bond1 (unregistering): (slave veth5): Releasing active interface [ 2159.797450][T12260] bond1 (unregistering): Released all slaves [ 2159.823306][T12260] bond2 (unregistering): Released all slaves [ 2159.841526][T12260] bond3 (unregistering): (slave veth17): Releasing active interface [ 2159.842300][T12260] bond3 (unregistering): Released all slaves [ 2159.881793][T12260] bond4 (unregistering): (slave veth23): Releasing active interface [ 2159.882579][T12260] bond4 (unregistering): Released all slaves [ 2159.909074][T12260] bond5 (unregistering): (slave veth25): Releasing active interface [ 2159.909880][T12260] bond5 (unregistering): Released all slaves [ 2159.935683][T12260] bond6 (unregistering): (slave veth27): Releasing active interface [ 2159.936941][T12260] bond6 (unregistering): Released all slaves [ 2159.971641][T12260] bond7 (unregistering): (slave veth29): Releasing active interface [ 2159.974584][T12260] bond7 (unregistering): Released all slaves [ 2160.000129][T12260] bond8 (unregistering): Released all slaves [ 2160.016545][T12260] bond9 (unregistering): (slave veth31): Releasing active interface [ 2160.017382][T12260] bond9 (unregistering): Released all slaves [ 2160.052227][T12260] bond10 (unregistering): Released all slaves [ 2160.070831][T12260] bond11 (unregistering): Released all slaves [ 2160.088136][T12260] bond12 (unregistering): Released all slaves [ 2160.121522][T12260] bond13 (unregistering): (slave veth33): Releasing active interface [ 2160.122310][T12260] bond13 (unregistering): Released all slaves [ 2160.150975][T12260] bond14 (unregistering): (slave veth35): Releasing active interface [ 2160.151789][T12260] bond14 (unregistering): Released all slaves [ 2160.176835][T12260] bond15 (unregistering): (slave veth37): Releasing active interface [ 2160.177598][T12260] bond15 (unregistering): Released all slaves [ 2160.206970][T12260] bond16 (unregistering): Released all slaves [ 2160.222818][T12260] bond17 (unregistering): Released all slaves [ 2160.240588][T12260] bond18 (unregistering): (slave veth39): Releasing active interface [ 2160.242169][T12260] bond18 (unregistering): Released all slaves [ 2160.268602][ T54] Bluetooth: hci1: command tx timeout [ 2160.276487][T12260] bond19 (unregistering): Released all slaves [ 2160.300040][T12260] bond20 (unregistering): Released all slaves [ 2160.319762][T12260] bond21 (unregistering): (slave veth55): Releasing backup interface [ 2160.323294][T12260] bond21 (unregistering): Released all slaves [ 2160.352853][T12260] bond22 (unregistering): (slave veth57): Releasing backup interface [ 2160.354963][T12260] bond22 (unregistering): Released all slaves [ 2160.384171][T12260] bond23 (unregistering): Released all slaves [ 2160.400314][T12260] bond24 (unregistering): Released all slaves [ 2160.417323][T12260] bond25 (unregistering): (slave veth63): Releasing active interface [ 2160.422646][T12260] bond25 (unregistering): Released all slaves [ 2160.445968][T12260] bond26 (unregistering): (slave veth65): Releasing active interface [ 2160.447478][T12260] bond26 (unregistering): Released all slaves [ 2160.475620][T12260] bond27 (unregistering): (slave veth69): Releasing active interface [ 2160.477117][T12260] bond27 (unregistering): Released all slaves [ 2160.504602][T12260] bond28 (unregistering): (slave veth73): Releasing active interface [ 2160.506093][T12260] bond28 (unregistering): Released all slaves [ 2160.530892][T12260] bond29 (unregistering): (slave veth75): Releasing active interface [ 2160.532347][T12260] bond29 (unregistering): Released all slaves [ 2160.559782][T12260] bond30 (unregistering): (slave veth81): Releasing active interface [ 2160.561307][T12260] bond30 (unregistering): Released all slaves [ 2160.587046][T12260] bond31 (unregistering): (slave veth83): Releasing active interface [ 2160.605802][T12260] bond31 (unregistering): Released all slaves [ 2160.624797][T12260] bond32 (unregistering): (slave veth85): Releasing active interface [ 2160.626398][T12260] bond32 (unregistering): Released all slaves [ 2160.657542][T12260] bond33 (unregistering): (slave veth87): Releasing active interface [ 2160.662288][T12260] bond33 (unregistering): Released all slaves [ 2160.681014][T12260] bond34 (unregistering): Released all slaves [ 2160.699680][T12260] bond35 (unregistering): Released all slaves [ 2160.721580][T12260] bond36 (unregistering): (slave wireguard0): Releasing backup interface [ 2160.721603][T12260] wireguard0: left promiscuous mode [ 2160.722954][T12260] bond36 (unregistering): Released all slaves [ 2160.764139][T12260] bond37 (unregistering): Released all slaves [ 2160.779439][T12260] bond38 (unregistering): Released all slaves [ 2160.795260][T12260] bond39 (unregistering): Released all slaves [ 2160.814977][T12260] bond40 (unregistering): Released all slaves [ 2160.836319][T12260] bond41 (unregistering): Released all slaves [ 2160.863204][T12260] bond42 (unregistering): Released all slaves [ 2160.883800][T12260] bond43 (unregistering): Released all slaves [ 2160.904511][T12260] bond44 (unregistering): (slave wireguard2): Releasing backup interface [ 2160.904550][T12260] wireguard2: left promiscuous mode [ 2160.905925][T12260] bond44 (unregistering): Released all slaves [ 2160.936885][T12260] bond45 (unregistering): Released all slaves [ 2160.956217][T12260] bond46 (unregistering): Released all slaves [ 2160.974801][T12260] bond47 (unregistering): Released all slaves [ 2161.003118][T12260] bond48 (unregistering): Released all slaves [ 2162.275813][T12260] ovs-dp0: left promiscuous mode [ 2162.348449][ T54] Bluetooth: hci1: command tx timeout [ 2162.423087][T27791] bridge0: port 1(bridge_slave_0) entered blocking state [ 2162.423210][T27791] bridge0: port 1(bridge_slave_0) entered disabled state [ 2162.423379][T27791] bridge_slave_0: entered allmulticast mode [ 2162.469273][T27791] bridge_slave_0: entered promiscuous mode [ 2162.492972][T27791] bridge0: port 2(bridge_slave_1) entered blocking state [ 2162.493070][T27791] bridge0: port 2(bridge_slave_1) entered disabled state [ 2162.493245][T27791] bridge_slave_1: entered allmulticast mode [ 2162.523792][T27791] bridge_slave_1: entered promiscuous mode [ 2162.531371][T12260] : left promiscuous mode [ 2162.596369][T27862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16425'. [ 2162.675524][T27791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2162.675599][T12260] tipc: Disabling bearer [ 2162.675853][T12260] tipc: Disabling bearer [ 2162.676029][T12260] tipc: Left network mode [ 2162.716082][T27791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2162.786220][T27862] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16425'. [ 2162.826787][T27862] bridge1: entered promiscuous mode [ 2163.027505][T27791] team0: Port device team_slave_0 added [ 2163.032403][T27791] team0: Port device team_slave_1 added [ 2163.102938][ T5296] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2163.404707][T27791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2163.404727][T27791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2163.404755][T27791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2163.459117][T27791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2163.459138][T27791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2163.459169][T27791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2163.820683][T27791] hsr_slave_0: entered promiscuous mode [ 2163.821844][T27791] hsr_slave_1: entered promiscuous mode [ 2163.828827][T27791] debugfs: 'hsr0' already exists in 'hsr' [ 2163.828908][T27791] Cannot create hsr debugfs directory [ 2163.977830][T12260] IPVS: stopping backup sync thread 11936 ... [ 2164.092350][T27928] FAULT_INJECTION: forcing a failure. [ 2164.092350][T27928] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2164.092387][T27928] CPU: 1 UID: 0 PID: 27928 Comm: syz.3.16442 Not tainted syzkaller #0 PREEMPT(full) [ 2164.092413][T27928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2164.092428][T27928] Call Trace: [ 2164.092437][T27928] [ 2164.092447][T27928] dump_stack_lvl+0xe8/0x150 [ 2164.092490][T27928] should_fail_ex+0x3eb/0x540 [ 2164.092523][T27928] prepare_alloc_pages+0x21e/0x5f0 [ 2164.092561][T27928] __alloc_frozen_pages_noprof+0x17c/0x410 [ 2164.092595][T27928] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2164.092623][T27928] ? __alloc_frozen_pages_noprof+0x24c/0x410 [ 2164.092656][T27928] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 2164.092696][T27928] __alloc_pages_noprof+0x10/0x100 [ 2164.092727][T27928] alloc_pages_bulk_noprof+0x67a/0x8a0 [ 2164.092767][T27928] ? alloc_pages_noprof+0x140/0x2b0 [ 2164.092805][T27928] __kasan_populate_vmalloc+0xb7/0x1c0 [ 2164.092839][T27928] alloc_vmap_area+0xd10/0x1410 [ 2164.092875][T27928] ? __pfx_alloc_vmap_area+0x10/0x10 [ 2164.092895][T27928] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 2164.092933][T27928] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 2164.092958][T27928] ? __get_vm_area_node+0x155/0x2f0 [ 2164.092984][T27928] __get_vm_area_node+0x200/0x2f0 [ 2164.093015][T27928] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 2164.093039][T27928] ? bpf_check+0x14ae/0x34e0 [ 2164.093068][T27928] ? lock_acquire+0x115/0x350 [ 2164.093101][T27928] ? hook_capable+0x1c3/0x5e0 [ 2164.093133][T27928] ? __pfx_hook_capable+0x10/0x10 [ 2164.093165][T27928] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 2164.093192][T27928] ? apparmor_capable+0x126/0x170 [ 2164.093223][T27928] ? bpf_lsm_capable+0x9/0x20 [ 2164.093244][T27928] ? security_capable+0x7e/0x2c0 [ 2164.093283][T27928] ? bpf_check+0x14ae/0x34e0 [ 2164.093304][T27928] __vmalloc_noprof+0xd2/0x120 [ 2164.093330][T27928] ? bpf_check+0x14ae/0x34e0 [ 2164.093356][T27928] bpf_check+0x14ae/0x34e0 [ 2164.093394][T27928] ? ktime_get_with_offset+0x93/0x2d0 [ 2164.093426][T27928] ? ktime_get_with_offset+0x93/0x2d0 [ 2164.093458][T27928] ? __pfx_bpf_check+0x10/0x10 [ 2164.093486][T27928] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2164.093520][T27928] bpf_prog_load+0x14da/0x1c60 [ 2164.093558][T27928] ? __pfx_bpf_prog_load+0x10/0x10 [ 2164.093600][T27928] ? __might_fault+0xaf/0x130 [ 2164.093632][T27928] __sys_bpf+0xd86/0xe00 [ 2164.093665][T27928] ? __pfx___sys_bpf+0x10/0x10 [ 2164.093701][T27928] ? __fget_files+0x2a/0x420 [ 2164.093745][T27928] ? ksys_write+0x242/0x270 [ 2164.093777][T27928] ? __pfx_ksys_write+0x10/0x10 [ 2164.093812][T27928] __x64_sys_bpf+0xba/0xd0 [ 2164.093847][T27928] do_syscall_64+0x166/0x520 [ 2164.093875][T27928] ? trace_irq_disable+0x3b/0x140 [ 2164.093913][T27928] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2164.093936][T27928] ? clear_bhb_loop+0x70/0xc0 [ 2164.093964][T27928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2164.093987][T27928] RIP: 0033:0x7f47a159fb19 [ 2164.094009][T27928] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2164.094029][T27928] RSP: 002b:00007f47a2550028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2164.094054][T27928] RAX: ffffffffffffffda RBX: 00007f47a1825fa0 RCX: 00007f47a159fb19 [ 2164.094071][T27928] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 2164.094086][T27928] RBP: 00007f47a2550090 R08: 0000000000000000 R09: 0000000000000000 [ 2164.094100][T27928] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2164.094114][T27928] R13: 00007f47a1826038 R14: 00007f47a1825fa0 R15: 00007ffd38f5e6e8 [ 2164.094151][T27928] [ 2164.095730][T27928] syz.3.16442: vmalloc error: size 13084800, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2164.095800][T27928] CPU: 1 UID: 0 PID: 27928 Comm: syz.3.16442 Not tainted syzkaller #0 PREEMPT(full) [ 2164.095820][T27928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2164.095832][T27928] Call Trace: [ 2164.095840][T27928] [ 2164.095848][T27928] dump_stack_lvl+0xe8/0x150 [ 2164.095883][T27928] warn_alloc+0x24d/0x270 [ 2164.095919][T27928] ? lockdep_hardirqs_on+0x7b/0x110 [ 2164.095945][T27928] ? __pfx_warn_alloc+0x10/0x10 [ 2164.095966][T27928] ? kfree+0x1c5/0x650 [ 2164.095992][T27928] ? __get_vm_area_node+0x219/0x2f0 [ 2164.096017][T27928] __vmalloc_node_range_noprof+0x396/0x16f0 [ 2164.096045][T27928] ? lock_acquire+0x115/0x350 [ 2164.096074][T27928] ? hook_capable+0x1c3/0x5e0 [ 2164.096100][T27928] ? __pfx_hook_capable+0x10/0x10 [ 2164.096127][T27928] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 2164.096149][T27928] ? apparmor_capable+0x126/0x170 [ 2164.096180][T27928] ? bpf_lsm_capable+0x9/0x20 [ 2164.096196][T27928] ? security_capable+0x7e/0x2c0 [ 2164.096229][T27928] ? bpf_check+0x14ae/0x34e0 [ 2164.096247][T27928] __vmalloc_noprof+0xd2/0x120 [ 2164.096269][T27928] ? bpf_check+0x14ae/0x34e0 [ 2164.096294][T27928] bpf_check+0x14ae/0x34e0 [ 2164.096323][T27928] ? ktime_get_with_offset+0x93/0x2d0 [ 2164.096348][T27928] ? ktime_get_with_offset+0x93/0x2d0 [ 2164.096373][T27928] ? __pfx_bpf_check+0x10/0x10 [ 2164.096394][T27928] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2164.096423][T27928] bpf_prog_load+0x14da/0x1c60 [ 2164.096453][T27928] ? __pfx_bpf_prog_load+0x10/0x10 [ 2164.096486][T27928] ? __might_fault+0xaf/0x130 [ 2164.096512][T27928] __sys_bpf+0xd86/0xe00 [ 2164.096537][T27928] ? __pfx___sys_bpf+0x10/0x10 [ 2164.096566][T27928] ? __fget_files+0x2a/0x420 [ 2164.096608][T27928] ? ksys_write+0x242/0x270 [ 2164.096636][T27928] ? __pfx_ksys_write+0x10/0x10 [ 2164.096667][T27928] __x64_sys_bpf+0xba/0xd0 [ 2164.096698][T27928] do_syscall_64+0x166/0x520 [ 2164.096720][T27928] ? trace_irq_disable+0x3b/0x140 [ 2164.096746][T27928] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2164.096767][T27928] ? clear_bhb_loop+0x70/0xc0 [ 2164.096792][T27928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2164.096813][T27928] RIP: 0033:0x7f47a159fb19 [ 2164.096833][T27928] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2164.096852][T27928] RSP: 002b:00007f47a2550028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2164.096873][T27928] RAX: ffffffffffffffda RBX: 00007f47a1825fa0 RCX: 00007f47a159fb19 [ 2164.096889][T27928] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 2164.096913][T27928] RBP: 00007f47a2550090 R08: 0000000000000000 R09: 0000000000000000 [ 2164.096925][T27928] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2164.096936][T27928] R13: 00007f47a1826038 R14: 00007f47a1825fa0 R15: 00007ffd38f5e6e8 [ 2164.096965][T27928] [ 2164.098005][T27928] Mem-Info: [ 2164.098019][T27928] active_anon:5696 inactive_anon:0 isolated_anon:0 [ 2164.098019][T27928] active_file:0 inactive_file:44943 isolated_file:0 [ 2164.098019][T27928] unevictable:33 dirty:196 writeback:0 [ 2164.098019][T27928] slab_reclaimable:15110 slab_unreclaimable:162309 [ 2164.098019][T27928] mapped:30121 shmem:550 pagetables:3547 [ 2164.098019][T27928] sec_pagetables:0 bounce:0 [ 2164.098019][T27928] kernel_misc_reclaimable:0 [ 2164.098019][T27928] free:1182815 free_pcp:13012 free_cma:0 [ 2164.098080][T27928] Node 0 active_anon:22784kB inactive_anon:0kB active_file:0kB inactive_file:179568kB unevictable:132kB isolated(anon):0kB isolated(file):0kB mapped:120484kB dirty:784kB writeback:0kB shmem:2200kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:21032kB pagetables:14048kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2164.098142][T27928] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 2164.346060][T27928] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2164.367699][T27928] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 2164.367833][T27928] Node 0 DMA32 free:798188kB boost:0kB min:33936kB low:42420kB high:50904kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22708kB inactive_anon:0kB active_file:0kB inactive_file:179568kB unevictable:0kB writepending:808kB zspages:0kB present:3129332kB managed:2523116kB mlocked:0kB bounce:0kB free_pcp:37736kB local_pcp:17448kB free_cma:0kB [ 2164.368017][T27928] lowmem_reserve[]: 0 0 1 1 1 [ 2164.368117][T27928] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1660kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 2164.372601][T27928] lowmem_reserve[]: 0 0 0 0 0 [ 2164.372711][T27928] Node 1 Normal free:3917808kB boost:0kB min:55940kB low:69924kB high:83908kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:14608kB local_pcp:6800kB free_cma:0kB [ 2164.372888][T27928] lowmem_reserve[]: 0 0 0 0 0 [ 2164.372986][T27928] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 2164.373336][T27928] Node 0 DMA32: 1371*4kB (UM) 828*8kB (UME) 1148*16kB (UME) 1001*32kB (UME) 857*64kB (UM) 617*128kB (UM) 403*256kB (UM) 222*512kB (UM) 110*1024kB (UME) 7*2048kB (UME) 63*4096kB (UM) = 798188kB [ 2164.414265][T27928] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2164.414627][T27928] Node 1 Normal: 2*4kB (UM) 2*8kB (UM) 2*16kB (UM) 3*32kB (UM) 3*64kB (UM) 2*128kB (UM) 2*256kB (M) 2*512kB (M) 2*1024kB (UM) 1*2048kB (U) 955*4096kB (M) = 3917912kB [ 2164.415157][T27928] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2164.415203][T27928] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2164.415248][T27928] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2164.415302][T27928] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2164.415357][T27928] 45467 total pagecache pages [ 2164.415387][T27928] 0 pages in swap cache [ 2164.415410][T27928] Free swap = 124996kB [ 2164.415499][T27928] Total swap = 124996kB [ 2164.415530][T27928] 2097051 pages RAM [ 2164.415551][T27928] 0 pages HighMem/MovableOnly [ 2164.415572][T27928] 434241 pages reserved [ 2164.415594][T27928] 0 pages cma reserved [ 2164.433210][ T54] Bluetooth: hci1: command tx timeout [ 2165.423400][T27943] netlink: 'syz.0.16443': attribute type 1 has an invalid length. [ 2165.876706][T27937] syzkaller1: entered promiscuous mode [ 2165.876732][T27937] syzkaller1: entered allmulticast mode [ 2166.462721][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 2166.733250][T27970] syzkaller0: entered promiscuous mode [ 2166.733277][T27970] syzkaller0: entered allmulticast mode [ 2166.752704][T27970] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 2166.789373][T27954] netlink: 8 bytes leftover after parsing attributes in process `syz.2.16448'. [ 2166.929240][T27980] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16448'. [ 2167.237733][T27980] bridge1: entered promiscuous mode [ 2167.424181][T27995] tipc: Resetting bearer [ 2167.546248][T27995] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2167.563228][T27995] 8021q: adding VLAN 0 to HW filter on device team0 [ 2167.565642][T27995] tipc: Resetting bearer [ 2167.680692][T28007] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16461'. [ 2167.700249][T27995] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 2167.701325][ T4444] lo speed is unknown, defaulting to 1000 [ 2167.701366][ T4444] syz0: Port: 1 Link ACTIVE [ 2167.701444][ T4444] lo speed is unknown, defaulting to 1000 [ 2169.245070][T28045] netlink: 4 bytes leftover after parsing attributes in process `syz.0.16473'. [ 2169.390435][T31845] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2169.390477][T31845] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2169.390562][T31845] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2169.390592][T31845] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2169.390634][T31845] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2169.390663][T31845] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2169.541316][T28023] workqueue: Failed to create a rescuer kthread for wq "bond70": -EINTR [ 2169.630030][T31845] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2169.630071][T31845] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2170.633032][T27791] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 2170.657526][T27791] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2170.666697][T27791] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 2170.696144][T27791] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2170.707248][T27791] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 2170.757548][T27791] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2170.782916][T27791] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 2170.816112][T27791] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2170.975773][T28102] netlink: 'syz.2.16492': attribute type 1 has an invalid length. [ 2171.299047][T28102] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2171.396078][T28113] bond1: (slave geneve2): making interface the new active one [ 2171.412120][T28113] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 2171.441869][T12260] hsr_slave_0: left promiscuous mode [ 2171.444748][T12260] hsr_slave_1: left promiscuous mode [ 2171.534781][T12260] veth0_to_bridge: left allmulticast mode [ 2171.534816][T12260] veth0_to_bridge: left promiscuous mode [ 2171.558572][T12260] veth1_macvtap: left promiscuous mode [ 2171.617963][T28131] netlink: 36 bytes leftover after parsing attributes in process `syz.2.16498'. [ 2171.801956][T28142] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16499'. [ 2172.011790][T28149] netlink: 'syz.2.16502': attribute type 10 has an invalid length. [ 2172.120541][T12255] wlan1: Trigger new scan to find an IBSS to join [ 2172.866601][T28133] tipc: Enabling of bearer rejected, already enabled [ 2172.892273][T28145] tipc: Resetting bearer [ 2172.913991][T28149] syz_tun: entered promiscuous mode [ 2172.946419][T28149] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 2173.015250][T28860] lo speed is unknown, defaulting to 1000 [ 2173.243741][T28160] bond0: (slave bond_slave_0): Releasing backup interface [ 2173.323883][T27791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2173.350060][T28164] bond0: (slave bond_slave_1): Releasing backup interface [ 2173.386875][T28167] netlink: 'syz.4.16508': attribute type 1 has an invalid length. [ 2173.551453][T28175] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16507'. [ 2173.662978][T28167] 8021q: adding VLAN 0 to HW filter on device bond70 [ 2173.731534][T28160] bond0: option mode: unable to set because the bond device is up [ 2174.644783][T27791] 8021q: adding VLAN 0 to HW filter on device team0 [ 2174.676855][T12250] bridge0: port 1(bridge_slave_0) entered blocking state [ 2174.676981][T12250] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2174.766956][T12259] bridge0: port 2(bridge_slave_1) entered blocking state [ 2174.767072][T12259] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2175.514742][T12260] IPVS: stop unused estimator thread 0... [ 2175.701934][T28246] netlink: 'syz.3.16523': attribute type 1 has an invalid length. [ 2175.833185][T28246] 8021q: adding VLAN 0 to HW filter on device bond63 [ 2176.109500][T12255] wlan1: Trigger new scan to find an IBSS to join [ 2176.210297][T12255] wlan1: Creating new IBSS network, BSSID 76:05:72:09:4f:05 [ 2176.842714][T27791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2177.025322][T27791] veth0_vlan: entered promiscuous mode [ 2177.055588][T27791] veth1_vlan: entered promiscuous mode [ 2177.110028][T28290] netlink: 'syz.3.16532': attribute type 1 has an invalid length. [ 2177.153055][T27791] veth0_macvtap: entered promiscuous mode [ 2177.195855][T27791] veth1_macvtap: entered promiscuous mode [ 2177.248101][T28297] ip_tables: iptables: counters copy to user failed while replacing table [ 2177.292247][T27791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2177.343340][T27791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2177.502792][T27837] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2177.502942][T12240] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2177.502985][T12240] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2177.503022][T12240] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2177.677067][T31845] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2177.677092][T31845] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2177.728041][T31845] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2177.728066][T31845] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2178.184098][T28316] veth0: left allmulticast mode [ 2178.184127][T28316] veth0: left promiscuous mode [ 2178.184379][T28316] bridge0: port 1(veth0) entered disabled state [ 2178.238019][T28316] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16539'. [ 2179.027733][T24752] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2179.053737][T24752] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2179.071916][T24752] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2179.074819][T24752] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2179.076916][T24752] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2179.435351][T28349] pim6reg: entered allmulticast mode [ 2179.444776][T28346] pim6reg: left allmulticast mode [ 2179.945369][T28366] ip_tables: iptables: counters copy to user failed while replacing table [ 2180.556062][T28340] lo speed is unknown, defaulting to 1000 [ 2180.795453][T27837] IPVS: starting estimator thread 0... [ 2180.879728][T28380] IPVS: using max 24 ests per chain, 57600 per kthread [ 2181.008023][T28387] bridge0: port 3(syz_tun) entered blocking state [ 2181.012516][T28387] bridge0: port 3(syz_tun) entered disabled state [ 2181.012704][T28387] syz_tun: entered allmulticast mode [ 2181.041070][T28387] syz_tun: entered promiscuous mode [ 2181.045847][T28387] bridge0: port 3(syz_tun) entered blocking state [ 2181.045974][T28387] bridge0: port 3(syz_tun) entered forwarding state [ 2181.149444][ T54] Bluetooth: hci3: command tx timeout [ 2181.547063][T28401] geneve2: entered promiscuous mode [ 2181.715314][T28383] virtio_blk virtio6: 1/0/0 default/read/poll queues [ 2181.755835][T28383] virtio_blk virtio6: [vdb] 262144 512-byte logical blocks (134 MB/128 MiB) [ 2181.875712][T28383] Dev vdb: unable to read RDB block 8 [ 2181.876011][T28383] vdb: unable to read partition table [ 2181.960256][T28340] bridge0: port 1(bridge_slave_0) entered blocking state [ 2181.960930][T28340] bridge0: port 1(bridge_slave_0) entered disabled state [ 2181.961404][T28340] bridge_slave_0: entered allmulticast mode [ 2181.963292][T28340] bridge_slave_0: entered promiscuous mode [ 2181.971718][T28340] bridge0: port 2(bridge_slave_1) entered blocking state [ 2181.971899][T28340] bridge0: port 2(bridge_slave_1) entered disabled state [ 2181.972059][T28340] bridge_slave_1: entered allmulticast mode [ 2181.976947][T28340] bridge_slave_1: entered promiscuous mode [ 2182.123950][T28340] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2182.160684][T28340] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2182.339005][T28340] team0: Port device team_slave_0 added [ 2182.365761][T28340] team0: Port device team_slave_1 added [ 2182.489437][T28340] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2182.489458][T28340] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2182.489488][T28340] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2182.506787][T28340] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2182.506834][T28340] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2182.506920][T28340] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2182.713042][T28340] hsr_slave_0: entered promiscuous mode [ 2182.717164][T28340] hsr_slave_1: entered promiscuous mode [ 2182.730537][T28340] debugfs: 'hsr0' already exists in 'hsr' [ 2182.730564][T28340] Cannot create hsr debugfs directory [ 2183.199542][T28340] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2183.229265][ T54] Bluetooth: hci3: command tx timeout [ 2183.330699][T28340] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2183.385645][T28427] syzkaller1: entered promiscuous mode [ 2183.385671][T28427] syzkaller1: entered allmulticast mode [ 2183.453335][T28340] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2183.518814][T28340] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 2183.889169][T28340] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 2183.897229][T28340] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2183.917356][T28340] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 2183.935269][T28340] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2183.936295][T28340] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 2183.969081][T28340] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2183.971651][T28340] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 2184.029838][T28340] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2184.343667][T28340] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2184.396030][T28340] 8021q: adding VLAN 0 to HW filter on device team0 [ 2184.425523][T12260] bridge0: port 1(bridge_slave_0) entered blocking state [ 2184.425650][T12260] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2184.461085][T12260] bridge0: port 2(bridge_slave_1) entered blocking state [ 2184.461199][T12260] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2184.537413][T28457] netlink: 100 bytes leftover after parsing attributes in process `syz.0.16579'. [ 2184.706780][T28465] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16584'. [ 2185.308660][ T54] Bluetooth: hci3: command tx timeout [ 2185.661981][T28495] netlink: 100 bytes leftover after parsing attributes in process `syz.1.16593'. [ 2185.746822][T28498] netlink: 14 bytes leftover after parsing attributes in process `syz.2.16594'. [ 2185.882535][T28340] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2186.315684][T28514] syzkaller0: entered promiscuous mode [ 2186.315710][T28514] syzkaller0: entered allmulticast mode [ 2186.334336][T28514] tipc: Started in network mode [ 2186.334371][T28514] tipc: Node identity 56a305701469, cluster identity 4711 [ 2186.352215][T28514] tipc: Enabled bearer , priority 0 [ 2186.386561][T28514] tipc: Resetting bearer [ 2186.415464][T28512] tipc: Resetting bearer [ 2186.496216][T28512] tipc: Disabling bearer [ 2186.730317][T28340] veth0_vlan: entered promiscuous mode [ 2186.770065][T28340] veth1_vlan: entered promiscuous mode [ 2186.887237][T28340] veth0_macvtap: entered promiscuous mode [ 2186.888534][ T5001] udevd[5001]: worker [27146] /devices/virtual/block/nbd0 is taking a long time [ 2186.930264][T28340] veth1_macvtap: entered promiscuous mode [ 2186.981616][T28340] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2187.027922][T28340] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2187.144626][T12260] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2187.146484][T27837] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2187.146528][T27837] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2187.146565][T27837] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2187.387851][T12260] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2187.387878][T12260] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2187.388516][ T54] Bluetooth: hci3: command tx timeout [ 2187.523921][T28530] netlink: 100 bytes leftover after parsing attributes in process `syz.0.16605'. [ 2187.524430][T12258] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2187.524450][T12258] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2188.061148][T12240] IPVS: starting estimator thread 0... [ 2188.148356][T28545] IPVS: using max 29 ests per chain, 69600 per kthread [ 2188.153648][T28547] syzkaller0: entered promiscuous mode [ 2188.153673][T28547] syzkaller0: entered allmulticast mode [ 2188.192300][T28547] tipc: Started in network mode [ 2188.192344][T28547] tipc: Node identity 6293d7de3087, cluster identity 4711 [ 2188.192634][T28547] tipc: Enabled bearer , priority 0 [ 2188.238818][T28547] tipc: Resetting bearer [ 2188.246217][T28546] tipc: Resetting bearer [ 2188.310785][T28546] tipc: Disabling bearer [ 2188.576713][T28568] ip_tables: iptables: counters copy to user failed while replacing table [ 2188.605030][T28568] syzkaller1: entered promiscuous mode [ 2188.605058][T28568] syzkaller1: entered allmulticast mode [ 2188.608033][T28568] sit0: entered promiscuous mode [ 2188.631369][T28568] netlink: 'syz.0.16619': attribute type 1 has an invalid length. [ 2188.631398][T28568] netlink: 1 bytes leftover after parsing attributes in process `syz.0.16619'. [ 2191.112612][T28551] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 2192.016619][ T54] Bluetooth: hci5: unexpected event 0x0f length: 0 < 4 [ 2192.908057][T24752] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2192.922778][T24752] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2192.925079][T24752] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2192.926169][T24752] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2192.927227][T24752] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2193.404596][T28294] Set syz1 is full, maxelem 65536 reached [ 2193.796246][T28629] lo speed is unknown, defaulting to 1000 [ 2194.169077][T28629] bridge0: port 1(bridge_slave_0) entered blocking state [ 2194.169211][T28629] bridge0: port 1(bridge_slave_0) entered disabled state [ 2194.169323][T28629] bridge_slave_0: entered allmulticast mode [ 2194.170876][T28629] bridge_slave_0: entered promiscuous mode [ 2194.178662][T28629] bridge0: port 2(bridge_slave_1) entered blocking state [ 2194.178951][T28629] bridge0: port 2(bridge_slave_1) entered disabled state [ 2194.179138][T28629] bridge_slave_1: entered allmulticast mode [ 2194.187108][T28629] bridge_slave_1: entered promiscuous mode [ 2194.242692][T28629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2194.245723][T28629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2194.285337][T28629] team0: Port device team_slave_0 added [ 2194.293806][T28629] team0: Port device team_slave_1 added [ 2194.320053][T28629] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2194.320073][T28629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2194.320103][T28629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2194.322412][T28629] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2194.322440][T28629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2194.322472][T28629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2194.433437][T28629] hsr_slave_0: entered promiscuous mode [ 2194.434247][T28629] hsr_slave_1: entered promiscuous mode [ 2194.435015][T28629] debugfs: 'hsr0' already exists in 'hsr' [ 2194.435036][T28629] Cannot create hsr debugfs directory [ 2194.633486][T28629] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2194.636668][T28629] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2194.637611][T28629] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2194.649107][T28629] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2194.652012][T28629] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2194.681072][T28629] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2194.682037][T28629] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2194.685227][T28629] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2194.731171][T28629] bridge0: port 2(bridge_slave_1) entered blocking state [ 2194.731281][T28629] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2194.731519][T28629] bridge0: port 1(bridge_slave_0) entered blocking state [ 2194.731622][T28629] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2194.814199][T28629] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2194.832770][T27837] bridge0: port 1(bridge_slave_0) entered disabled state [ 2194.833414][T27837] bridge0: port 2(bridge_slave_1) entered disabled state [ 2194.855049][T28629] 8021q: adding VLAN 0 to HW filter on device team0 [ 2194.867808][T12250] bridge0: port 1(bridge_slave_0) entered blocking state [ 2194.867901][T12250] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2194.891884][T31845] bridge0: port 2(bridge_slave_1) entered blocking state [ 2194.891980][T31845] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2195.071137][ T54] Bluetooth: hci4: command tx timeout [ 2195.304494][T28629] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2195.555305][T28629] veth0_vlan: entered promiscuous mode [ 2195.566839][T28629] veth1_vlan: entered promiscuous mode [ 2195.600483][T28629] veth0_macvtap: entered promiscuous mode [ 2195.605664][T28629] veth1_macvtap: entered promiscuous mode [ 2195.634581][T28629] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2195.650007][T28629] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2195.739378][T12258] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2195.739432][T12258] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2195.739468][T12258] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2195.739505][T12258] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2195.799746][T12258] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2195.799782][T12258] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2195.843132][T31845] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2195.843157][T31845] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2197.148722][ T54] Bluetooth: hci4: command tx timeout [ 2199.228377][ T54] Bluetooth: hci4: command tx timeout [ 2201.309205][ T54] Bluetooth: hci4: command tx timeout [ 2209.289761][ T54] Bluetooth: hci1: link tx timeout [ 2209.289787][ T54] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 2211.308696][T24752] Bluetooth: hci1: command 0x0406 tx timeout [ 2249.708976][ T54] Bluetooth: hci5: command 0x0406 tx timeout [ 2270.195070][T24752] Bluetooth: hci2: command 0x0406 tx timeout [ 2273.241447][ T33] INFO: task kworker/1:1H:1682 blocked for more than 143 seconds. [ 2273.241478][ T33] Not tainted syzkaller #0 [ 2273.241490][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2273.241502][ T33] task:kworker/1:1H state:D stack:25136 pid:1682 tgid:1682 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2273.241571][ T33] Workqueue: kblockd blk_mq_run_work_fn [ 2273.241684][ T33] Call Trace: [ 2273.241694][ T33] [ 2273.241711][ T33] __schedule+0x17dd/0x5830 [ 2273.241766][ T33] ? __pfx___schedule+0x10/0x10 [ 2273.241792][ T33] ? schedule+0x90/0x2b0 [ 2273.241812][ T33] schedule+0x164/0x2b0 [ 2273.241831][ T33] schedule_timeout+0x152/0x2c0 [ 2273.241856][ T33] ? __pfx_schedule_timeout+0x10/0x10 [ 2273.241903][ T33] ? __pfx_process_timeout+0x10/0x10 [ 2273.242248][ T33] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2273.242267][ T33] ? prepare_to_wait_event+0x3e4/0x4d0 [ 2273.242284][ T33] ? prepare_to_wait_event+0x440/0x4d0 [ 2273.242306][ T33] nbd_queue_rq+0x96a/0xff0 [ 2273.242378][ T33] ? __pfx_nbd_queue_rq+0x10/0x10 [ 2273.242396][ T33] ? __pfx_autoremove_wake_function+0x10/0x10 [ 2273.242423][ T33] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 2273.242482][ T33] blk_mq_dispatch_rq_list+0x499/0x1990 [ 2273.242545][ T33] ? sbitmap_get+0x229/0x390 [ 2273.242575][ T33] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 2273.242601][ T33] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 2273.242633][ T33] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 2273.242673][ T33] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 2273.242693][ T33] ? do_raw_spin_lock+0x12b/0x2f0 [ 2273.242713][ T33] ? lock_acquire+0x115/0x350 [ 2273.242737][ T33] ? process_scheduled_works+0x97a/0x1630 [ 2273.242767][ T33] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 2273.242788][ T33] ? blk_mq_run_work_fn+0x13f/0x2f0 [ 2273.242809][ T33] blk_mq_run_work_fn+0x167/0x2f0 [ 2273.242831][ T33] ? process_scheduled_works+0x97a/0x1630 [ 2273.242857][ T33] process_scheduled_works+0xc3d/0x1630 [ 2273.242907][ T33] ? __pfx_process_scheduled_works+0x10/0x10 [ 2273.242944][ T33] ? assign_work+0x3cf/0x5d0 [ 2273.242972][ T33] worker_thread+0xa47/0xfb0 [ 2273.243008][ T33] ? __kthread_parkme+0x71/0x1f0 [ 2273.243032][ T33] kthread+0x38b/0x480 [ 2273.243051][ T33] ? __pfx_worker_thread+0x10/0x10 [ 2273.243074][ T33] ? __pfx_kthread+0x10/0x10 [ 2273.243094][ T33] ret_from_fork+0x514/0xb70 [ 2273.243117][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 2273.243136][ T33] ? __switch_to+0xc78/0x1410 [ 2273.243166][ T33] ? __pfx_kthread+0x10/0x10 [ 2273.243186][ T33] ret_from_fork_asm+0x1a/0x30 [ 2273.243218][ T33] [ 2273.243413][ T33] [ 2273.243413][ T33] Showing all locks held in the system: [ 2273.243432][ T33] locks held by khungtaskd/33: 1, last CPU#0: [ 2273.243488][ T33] #0: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2273.243584][ T33] locks held by kworker/1:1H/1682: 4, on CPU#1: [ 2273.243596][ T33] #0: ffff8880216c2548 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 2273.243642][ T33] #1: ffffc90005b0fc40 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 2273.243702][ T33] #2: ffff888027708a18 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x13f/0x2f0 [ 2273.243745][ T33] #3: ffff888027fd7178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 2273.243792][ T33] locks held by getty/5392: 2, on CPU#0: [ 2273.243803][ T33] #0: ffff88803346a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2273.243869][ T33] #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 2273.243960][ T33] locks held by udevd/27146: 1, on CPU#1: [ 2273.243972][ T33] #0: ffff888027e45350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 [ 2273.244054][ T33] [ 2273.244058][ T33] ============================================= [ 2273.244058][ T33] [ 2273.244071][ T33] NMI backtrace for cpu 0 [ 2273.244087][ T33] CPU: 0 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2273.244111][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2273.244123][ T33] Call Trace: [ 2273.244133][ T33] [ 2273.244142][ T33] dump_stack_lvl+0xe8/0x150 [ 2273.244175][ T33] nmi_cpu_backtrace+0x274/0x2d0 [ 2273.244198][ T33] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2273.244220][ T33] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 2273.244249][ T33] sys_info+0x135/0x170 [ 2273.244273][ T33] watchdog+0x1073/0x10f0 [ 2273.244303][ T33] ? watchdog+0x209/0x10f0 [ 2273.244331][ T33] kthread+0x38b/0x480 [ 2273.244350][ T33] ? __pfx_watchdog+0x10/0x10 [ 2273.244371][ T33] ? __pfx_kthread+0x10/0x10 [ 2273.244390][ T33] ret_from_fork+0x514/0xb70 [ 2273.244411][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 2273.244430][ T33] ? __switch_to+0xc78/0x1410 [ 2273.244458][ T33] ? __pfx_kthread+0x10/0x10 [ 2273.244478][ T33] ret_from_fork_asm+0x1a/0x30 [ 2273.244508][ T33] [ 2273.244538][ T33] Sending NMI from CPU 0 to CPUs 1: [ 2273.244589][ C1] NMI backtrace for cpu 1 [ 2273.244604][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 2273.244626][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2273.244639][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2273.244666][ C1] Code: db 94 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 ea 26 00 fb f4 3c 17 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 2273.244684][ C1] RSP: 0018:ffffc90000197e40 EFLAGS: 00000242 [ 2273.244702][ C1] RAX: 00000000003ee767 RBX: ffffffff819c9e60 RCX: 8000000000000001 [ 2273.244717][ C1] RDX: 0000000000000001 RSI: ffffffff8e6a2103 RDI: ffffffff8c8e8c80 [ 2273.244732][ C1] RBP: ffffc90000197f10 R08: ffff8880b8333d9b R09: 1ffff110170667b3 [ 2273.244747][ C1] R10: dffffc0000000000 R11: ffffed10170667b4 R12: 0000000000000000 [ 2273.244761][ C1] R13: 1ffff11003e52000 R14: 1ffff92000032fd0 R15: dffffc0000000000 [ 2273.244777][ C1] FS: 0000000000000000(0000) GS:ffff88812371f000(0000) knlGS:0000000000000000 [ 2273.244793][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2273.244807][ C1] CR2: 000055bc1c814168 CR3: 000000007ee50000 CR4: 00000000003526f0 [ 2273.244826][ C1] Call Trace: [ 2273.244833][ C1] [ 2273.244841][ C1] default_idle+0x9/0x20 [ 2273.244865][ C1] default_idle_call+0x72/0xb0 [ 2273.244891][ C1] do_idle+0x2e0/0x540 [ 2273.244931][ C1] ? __pfx_do_idle+0x10/0x10 [ 2273.244973][ C1] cpu_startup_entry+0x43/0x60 [ 2273.244995][ C1] start_secondary+0x101/0x110 [ 2273.245015][ C1] common_startup_64+0x13e/0x157 [ 2273.245054][ C1] [ 2273.245653][ T33] Kernel panic - not syncing: hung_task: blocked tasks [ 2273.900957][ T33] CPU: 0 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2273.910131][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 2273.920244][ T33] Call Trace: [ 2273.923553][ T33] [ 2273.926521][ T33] vpanic+0x26f/0x710 [ 2273.930592][ T33] panic+0xc5/0xd0 [ 2273.934366][ T33] ? __pfx_panic+0x10/0x10 [ 2273.938815][ T33] ? preempt_schedule_common+0x7f/0xd0 [ 2273.944316][ T33] ? preempt_schedule_thunk+0x16/0x40 [ 2273.949731][ T33] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 2273.955960][ T33] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 2273.962177][ T33] watchdog+0x10e7/0x10f0 [ 2273.966557][ T33] ? watchdog+0x209/0x10f0 [ 2273.971022][ T33] kthread+0x38b/0x480 [ 2273.975126][ T33] ? __pfx_watchdog+0x10/0x10 [ 2273.979842][ T33] ? __pfx_kthread+0x10/0x10 [ 2273.984473][ T33] ret_from_fork+0x514/0xb70 [ 2273.989110][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 2273.994296][ T33] ? __switch_to+0xc78/0x1410 [ 2273.999020][ T33] ? __pfx_kthread+0x10/0x10 [ 2274.003652][ T33] ret_from_fork_asm+0x1a/0x30 [ 2274.008460][ T33] [ 2274.012105][ T33] Kernel Offset: disabled [ 2274.016456][ T33] Rebooting in 86400 seconds..