last executing test programs: 15.124628878s ago: executing program 1 (id=3002): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="01"], 0x48}, 0x1, 0x0, 0x0, 0x4040812}, 0x1) 14.803100601s ago: executing program 1 (id=3005): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c0002800500010006000000"], 0x90}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="c8000000010201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500"], 0xc8}}, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r1) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r4, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4080}, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02"], 0xe) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$inet_udp(0x2, 0x2, 0x0) close(r9) socket$key(0xf, 0x3, 0x2) ioctl$SIOCX25GDTEFACILITIES(r8, 0x89ea, &(0x7f0000000340)) write$cgroup_subtree(r8, &(0x7f0000000080)=ANY=[], 0x48) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x65, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x20000854) splice(r7, 0x0, r9, 0x0, 0x3000, 0x100000000000000d) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x100000c, 0x11, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) 13.235044394s ago: executing program 1 (id=3011): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200400095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x19, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x90) vmsplice(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000002c0)="2287", 0x2}], 0x1, 0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1100000004000000040000000c"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001", @ANYRES64=r1, @ANYRES8=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) clock_gettime(0x0, &(0x7f0000000000)) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e80), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000001600)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)={0x40, r3, 0x1, 0x70bd65, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_LEVEL={0x24, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x3}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0xfd}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x3}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x4}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x24881}, 0x404c800) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000007c0)={'xfrm0\x00'}) 12.896232779s ago: executing program 1 (id=3015): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000011040)=@newtaction={0x48, 0x31, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x34, 0x1, [@m_gact={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x48}}, 0x48010) 12.603931417s ago: executing program 1 (id=3016): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000240)={@remote, @rand_addr=0x64010102, 0x1, "1500b9007ce1f2866ec98b9cb52710e59ef0e164c7a709c8bef98f17272a1c45", 0xfff, 0x200, 0x6, 0x5}, 0x3c) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_buf(r4, 0x0, 0x29, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 11.522043866s ago: executing program 1 (id=3022): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0xc044) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000080)={0x0, 0x300, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[], 0x2c}}, 0x0) 6.98575659s ago: executing program 3 (id=3045): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448d4, &(0x7f0000000400)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000540)=ANY=[@ANYBLOB="bf16000000000000b70700000001e4ff4870000000000000350000000000000095000000000000002ba728041598fbd30cb599e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f0711e6bd917487960717142da7646c4fe02996b60cf81ebcd50fa9ea4318123f602000000000000de89e661168c1886d0d4d94f204e345c652fbc1626e3a2a2ad358061d0ae0209e62f51ee988e6ea604ce974a22a550d6f97080980400003e05df3ceb9f1feae5737ecaa80a666963c474c2a100c788b277beee1cbf9b0a4d3881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3431abe802f5ab3e89cf6c662ed4048d3b3e22278d00ce00000000d3a02762c2951257b85802189d74005d2a1bcf9436e192e23fd275985bf31b714f000bcab6fcd610f25f5888000000003f11afc9bd08c6ebfbb89432fb465bc52f49129b9b6150e320c9901de2ebb9000000018e3095c4c5c7a156cec33a667dccaff950ca1e5efdd4c968dacf81baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba175d876defd3541772f26e27c44cfdb2d85d6d29983e830a9cdd79837b3468e8c67a571d0a017c100344c52a6f387a1340a1c8889464f90cc4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae630afd014a337ac5d58bcb5e51723257c872c5255f20100000000000000f041b665ab21372c8d8b7bac5b5c784d20a4a24d8dbd75062e1daef9dead619cc6e7baa72707157791c3d2a286ffb8d35452bb5d36c2a8682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b9935f771fd49e480cd9d48aeb12b1d255be1ed66d9051f22614d1f62734d679039a97d2b74f9e8e997ccd314000f747f4e8e7025123e783df8b8a17e3aa9fe1f662aef87a065b03cfb65b4dfe4f1b56e1f23128d743753a1de172d683d5892ce9414a1d98ea93e3d35dbb6c23b90cf36e83b8a434a97d09343d7f83079ccb02e69d384146056d125cfa788237874dd42dae334bda042819a2aa24dba1c25be2794448b4f63483026b5e34d44705b76ef29241adab0dd7d68bf975e02069f6f2425e1bc97a3d588085f16bef63a06578d4f5de7bfb6aaa75f16996d536256c02284cb1d3a6fb8cae87691fae365a70c3fc69e1565bba8dd8a8ca049f798abe646f738bebd69413afc9d8a5edd7aaa000000000000001e6c2f2a287c5278a218dbfaffffff00a14db5cfa6819eb1d39c48cfdc80d215c9e16e0c4736c819363154cca4e2f89800d18c89d7f46f679df6c9e2952ae1ebfd0ca88368ee6ce139e8b5822c22cf2e9dde943d34c432e1001171792c65986146666a5490928441f47e0fe5eac41824ca1fd0eb71aa243c88d5480e5aee9c9e5f2e5a56a6d920335c8e8726fd8329d9a728995b1531bd20360d33d8f9ffffff5f912ac4e34bf6ea8a86da707b03bddb491ba0cc98f6be92c55969a2b50025419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9b844051f1a642aca9ff98c9036471ccff0522903e7bcf62e18f7696bbc280b95e8e0d6fd5644b0ebde3a95b06548862de809d3dae3cccf109f7c78e8479a345e800000000000000000000009455bf417627ce723a5d9103706aba69279500bb82f6b5a3ddc0bd9856712945b70c75ce5b722578820820d010d7a3cffc99fc647d0b82ef26ab708c0b19ed144be51c3b398f0e6bb7a30006000000cba12953d58cff0f0378740fe6662f377b97d8e7cdb047050d7296cd3856476a60a49ad127ba6570bafc2bbcf9ee721fd9cb467ff071e5604fbf0491245c0000007d932d7a64de4c4aa433fc0840aff7c47da3a4c6966d0000000000000000f6bfbae29e8a6e2a889f6ef6869d82d6bd73eb76b65c7a35a54a4a6b8ad4600e3a972a0bb5971a5f16590b0a03dafa3fd1118765cc8ab9fccf3b51c41a339f200f2fa33006910a679a9ae0187b4d750c4bd244cb0cbfd23b265f4d4da448a7a0d19c5e43eae50a31609dfa2dde267551467eb6475293dd7012cc449009981f22820e57a0eff234ccfe21d7a2302e000669753d3c3432cc14ee1abe724adb6b5431befedd3e22971118f0e21aed03a6fe7860b3e13c3173a60a1823cb7dde8212a8531bd9691dd4cc6a370e9eb56b3d790b98f2bd0db1e5de6a146597b2cbb7103040d2a39d7965d34df524b760ab92efcce7dd1574052c735935bf6a752c015c7f5ffee9ff66e5dd2866b15b6e0d17618cb1f5c1ee4b05ebf1445ea110f499f840a5c965443d725556351ee25fe09f69494b053678dcadcf02e063dff2fa4bef1ac3bbbebe6c74d71ec3b23e29895eff1d1017024fe3e8cc759b05785adc346b7ffd05963f92c1d0d7d90ba878ad89e490f3e29ac51d30632869a534418f916bf6fe8167827a8e6c8f8b391c822805cb0adf1b8bd6947ff208753eb0d208ce14f7b206b2e02c21e963abc5ceb735c1b3c46b0a843de52a0000000000000001ee9c2b2705c1a81d9d3b9656b219c8cd99c9cafcd0d0540884d97aecb19983fc6af29ab44a82aff9cba921192c665b877af6539bdb1b567f481ba07982e7ad758f4e1eac69e7e88a63960975f490e161e371ec8534791e3b61c685d900a9c0839208356b53750e76fcc3c2d1bddcbd83897921414d0c02e8188f3df79ea2a5c5444004830e6cb227ca1bdafb977c00000000003a417193b8c5d793687335a930867094fd6a78218218e04b705ec62f1608cb569b81914e68f175b392af6bc4fd2121d7fd276af2c97a441b56e7a0687d98b8e76d8d0d231e4fe00be1de76bd19cc12e2bd938eb681ed6bc951c1b4f7c51af59eea4d40c6000000000200778a677b72786311153271a3313da02645e11761699e4d04ac86dd14ff7b9a10d3fa74696fe3953a5b7706bf5d1faba4b18808d9cb0e9db696dec4e0820ee4028d7225a2c9c427cf64cbde6fba056b2006b7a37c1181d530fb865e235cd302f3b4071ee5237ada186b9e5e3144bf479f277f10656ad3744037ccc9c63685a6f1109d2ea73773d3635f61497f1fa1ea4a16f601800bf3e59141fbf05a96113320c445f9ba8596970d5254727e804fbd99ccefb7c09269dd2c5c25e56e169ac15980f3f85f7ca36dd5950ef5b64fd46f123311829534a82940994199b3cf7a8f09c1946e55289f668c423fcbb31ae91864c882313151741a67538c9689dc8ecc9903c7041e5c0704e2fa55a756487517a7445cbd9e3f5175e41c00000000000000000000000000bf98efd587fffe326f474b0b089c017b16c0062cbce96f5adebec52a79f9363909842f79c50a1520be46d87003137e4c5031f00123e812a5e37cd52c9eb7336281cb8c6ce9934b157d7875a70eaf103cb3138e2361c51cd1eab8a26b232acf6bf0ab829c26dab637538b2eb1420d812d2b80c777710ba0f18e4661681aa218d9ba54023ab4305d77eb15611ae2545835e9d30e9f6d4fb43a291c69545a1eea0f8720431132d8549f99bf6c5cb060da70cbb59d0a000000000034d083fc37d2449f72de0cbea4bc1dc89c136cdbc504f849d5502d77a95c7bfff4cd9c03058d0d4d07ea64824f1acf2b39289f675f39d01719cdbab3f1ce10609c8d7b3e37cb99b41da5e485a441b6a103549f55ab09dc98767763d1f2fafd45bb7d2b40050d1f8292f4d9ec6d0000000000003932062290f4996fdd55b06023437e9e2072daf7f5d82f6f1b5b89a41134f4dc2e65bb11272fdf8c8141f41d6160b3d8b6ecd16d14267f61b4881adee7f07f3d6af5ae79e16fe2c3f55ac7a6392d2e1d9b4286b6c3e1f5a76b85ed6e1f0000c67e6c5fcdc8c39381be4799b8cb2d08b8262c807dd755e22b801162381aa9d1af2bbc9cfd497585337eac408b8475b47a392a10cae349160f128e5f873a58064eb400c36a90624f6aed398a215e9ce64522ab249f67c38a656d32ecff5cdb2b039c4abf349d2c0f88a42e9189bbfa7f5cf35b6e7ef8f9d33163b7ea87550fb1ba334c83e3aec4714c9c4ca3ecb04f2720237615a28bf310b58ffa2a103216fdcc8c2d8f5d55e5e7ebf147105272aaae56e86d856b3cf79a3f7306436762dd07cebc7892ec6f9f696da38feed3dc0001500e34adae1ba89a32bad2af9030f840f1ba4664f35547cdadd5cbacc59352c290f55d971b65953533668c25f21d8d62d849e9058eaa97c63491568887548f668cdbca2abf01a361a0b64d8b523e669da350e3ec7445dfbf366b0b3bc5e76824a1e43eaaeca70db90f2fa39596443447671933079a24fe3681ad9ac361f71ac279a688f10a12105edebc5e3b8dad4c8305ab129ca2dfb9b7c5e9d097bd01b495cccefddce569117f7f5d6a6270ff0f0f4c371029ca8489571b55841bf3dd003bc81460eee57ceb3c33f4e9300b0144fe040cf5fcfcbb616c2070237881afdb314cecd1623f3e55ab8b7627fa1be349145a8d6313cbc790eefe2020138e82fb9d351be4ddcbcc9bc048dd3db5828d16baec6e07a007f0030f34ea3cfd524d6fa1d45da5641d6c94e1d3ae7fba1c85035d2a60ef1696e0d96aa1c60019f73ae0aa6113cd66ef26b5777337c26e1461405d86fdf091edd526f25cada439bb3609ed5c35ab60a539ade786bd6004d0ea3edbd6c4da0d8e8be8c771c8c8a0b07d9859e04adb18964dcce9bce546074c26dffbc2df372a016e8c845d4257000000000000000000000000000000000000f29657697d9c2b132b2dc2f5ea5122836582a7e85fe2bc166f17aefd9d861de0191f5277d4a3b5afb6f200000000000000000089de7f8485d9507164a187220b36ddc7fa645d4bd0c1414c30a416"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89, 0x10, 0x0, 0xfffffffffffffe3c}, 0x48) 6.620851489s ago: executing program 3 (id=3047): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000240)={@remote, @rand_addr=0x64010102, 0x1, "1500b9007ce1f2866ec98b9cb52710e59ef0e164c7a709c8bef98f17272a1c45", 0xfff, 0x200, 0x6, 0x5}, 0x3c) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_buf(r4, 0x0, 0x29, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 5.603639089s ago: executing program 0 (id=3050): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x11, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00'}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f00000001c0)={r2, 0x1, 0x6}, 0x10) r3 = socket(0x40000000015, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x8, &(0x7f0000019580)=""/102394, &(0x7f0000000040)=0x18ffa) getsockname$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000040)=0x14) 5.129312036s ago: executing program 0 (id=3052): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) close(0x3) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) r3 = socket(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000005c0)={'ip6gretap0\x00', 0x0}) bind$packet(r3, &(0x7f0000000180)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @remote}, 0x14) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0xe9, 0x4) sendmsg$netlink(r3, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="3f011400dcdc14"], 0xdd12}], 0x1}, 0x200400d1) recvmmsg$unix(r3, &(0x7f000000a440)=[{{&(0x7f0000000040), 0x6e, &(0x7f0000002900)=[{&(0x7f00000001c0)=""/170, 0xaa}, {&(0x7f00000002c0)=""/123, 0x7b}, {&(0x7f0000000440)=""/215, 0xd7}, {&(0x7f0000000600)=""/244, 0xf4}, {&(0x7f0000000700)=""/22, 0x16}, {&(0x7f0000000740)=""/36, 0x24}, {&(0x7f0000000780)=""/80, 0x50}, {&(0x7f0000000800)=""/25, 0x19}, {&(0x7f0000000340)=""/109, 0x6d}], 0x9}}, {{&(0x7f00000008c0), 0x6e, &(0x7f0000001140)=[{&(0x7f0000000940)=""/212, 0xd4}, {&(0x7f0000000a40)=""/47, 0x2f}, {&(0x7f0000000a80)=""/178, 0xb2}, {&(0x7f0000000b40)=""/212, 0xd4}, {&(0x7f0000000c40)=""/168, 0xa8}, {&(0x7f0000000d00)=""/171, 0xab}, {&(0x7f0000000dc0)=""/248, 0xf8}, {&(0x7f0000000ec0)=""/222, 0xde}, {&(0x7f0000000fc0)=""/199, 0xc7}, {&(0x7f00000010c0)=""/66, 0x42}], 0xa, &(0x7f0000001200)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}], 0x118}}, {{&(0x7f0000001340), 0x6e, &(0x7f0000002700)=[{&(0x7f00000013c0)=""/166, 0xa6}, {&(0x7f0000001480)=""/114, 0x72}, {&(0x7f0000001500)=""/164, 0xa4}, {&(0x7f00000015c0)=""/144, 0x90}, {&(0x7f0000001680)=""/67, 0x43}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x6, &(0x7f0000002780)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}}, {{&(0x7f00000027c0), 0x6e, &(0x7f0000007380)=[{&(0x7f0000002840)=""/178, 0xb2}, {&(0x7f0000003100)=""/4096, 0x1000}, {&(0x7f0000004100)=""/168, 0xa8}, {&(0x7f00000041c0)=""/4096, 0x1000}, {&(0x7f00000051c0)=""/86, 0x56}, {&(0x7f0000005240)=""/4096, 0x1000}, {&(0x7f0000006240)=""/252, 0xfc}, {&(0x7f0000006340)=""/4096, 0x1000}, {&(0x7f0000007340)=""/34, 0x22}], 0x9, &(0x7f0000007440)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xc0}}, {{&(0x7f0000007500), 0x6e, &(0x7f0000007880)=[{&(0x7f0000007580)=""/225, 0xe1}, {&(0x7f0000007680)=""/37, 0x25}, {&(0x7f00000076c0)=""/221, 0xdd}, {&(0x7f00000077c0)=""/156, 0x9c}], 0x4}}, {{&(0x7f00000078c0)=@abs, 0x6e, &(0x7f0000008a80)=[{&(0x7f0000007940)=""/4096, 0x1000}, {&(0x7f0000008940)=""/27, 0x1b}, {&(0x7f0000008980)=""/80, 0x50}, {&(0x7f0000008a00)=""/13, 0xd}, {&(0x7f0000008a40)=""/42, 0x2a}], 0x5, &(0x7f0000008b00)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x28}}, {{0x0, 0x0, &(0x7f0000009000)=[{&(0x7f00000029c0)=""/189, 0xbd}, {&(0x7f0000008c00)=""/43, 0x2b}, {&(0x7f0000008c40)=""/160, 0xa0}, {&(0x7f0000008d00)=""/67, 0x43}, {&(0x7f0000008d80)=""/172, 0xac}, {&(0x7f0000008e40)=""/3, 0x3}, {&(0x7f0000008e80)=""/52, 0x34}, {&(0x7f0000008ec0)=""/116, 0x74}, {&(0x7f0000008f40)=""/94, 0x5e}, {&(0x7f0000008fc0)=""/26, 0x1a}], 0xa, &(0x7f00000090c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}, {{&(0x7f0000009180), 0x6e, &(0x7f000000a340)=[{&(0x7f0000009200)=""/4096, 0x1000}, {&(0x7f000000a200)=""/105, 0x69}, {&(0x7f000000a280)=""/129, 0x81}], 0x3, &(0x7f000000a380)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x88}}], 0x8, 0x40000281, 0x0) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) 4.970004184s ago: executing program 3 (id=3053): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000f2ffffff0000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x4000000, 0xe, 0x0, &(0x7f0000000040)="976d9023d56482cd284a63da5397", 0x0, 0xdc0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000280)="bf049fd184f7b03c21d9bcddc4eef9ebb6a0da3eb91c5645", 0x0, 0x8000}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000074f6967d00000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150005000000280016800c0001"], 0x4c}}, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r0, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x2000) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x5, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000456d9dee5713be00020000008d261000040000009500000000000000d37fdedd955c81fcbe208cebace322c8d9c834e0455db87d6872de0d39d39d419965d76d83aea66bdfef4ef624f37900827e6c7815ecbd4356f650a0ae43b86962a812a33208dd2ed69584cf44706374479582758930bc60d410c871000000000000000000000016f75f698af74d37ef2826e8edd7874b128a2412688a9420df2e3a37d3861e321b4876150e1582942d31c9868428183b0bd6cf8656191e09b7bd4b0e8dbc44c21c2d1df01b35c4a888f42569e2e6f1673fc2a3616452e25699b5ffd2a506b0c8b4d66eb0bbba42e0456ce2631d9af2b7aafd9450e1d331ae24d0447672095b5db3a9fc5f013a4ec2b205ac2e1f901747429dc42e940b4222334a8560210254a53a44e4c3bc081b6af8"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r5, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) unshare(0x26020480) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xee, 0x4000004) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r7, 0x0, 0x0) ioctl$SIOCPNENABLEPIPE(r7, 0x89ed, 0x0) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000003c0)="d8000000100081044e81f782db44b96d001d006a0f000000050000002900150006000e2603600e120900040044000000a80016000a0001400200000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de643ec0dd6e4edef76874fbe0f32b1608621e9e0", 0xd8}], 0x1}, 0x20000080) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000070000000000000013d38000911171000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000280)={'ip6tnl0\x00', &(0x7f0000000200)={'ip6tnl0\x00', 0x0, 0x2f, 0x9, 0x0, 0x0, 0x24, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8000, 0x0, 0x3}}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r3, r8, 0x25, 0x0, @void}, 0x10) 4.742124112s ago: executing program 4 (id=3054): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000f2ffffff0000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x4000000, 0xe, 0x0, &(0x7f0000000040)="976d9023d56482cd284a63da5397", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r0}) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150005000000280016800c0001"], 0x4c}}, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r0, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x2000) socket(0x10, 0x3, 0xf1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x0, 0xb}, {0xfff1, 0x6}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_TARGET={0x8, 0x1, 0x7}, @TCA_PIE_LIMIT={0x8, 0x2, 0x7}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240048e4}, 0x20004810) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 3.932272859s ago: executing program 0 (id=3057): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f000000a7c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=ANY=[], 0x20}}], 0x1, 0x800) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff0000"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000680)={r2, &(0x7f0000000500), 0x0}, 0x20) epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r3, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000012c0)={0x30, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r4}, @nested={0xb, 0x2, 0x0, 0x1, [@generic="976b6408686030"]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}]}]}, 0x30}], 0x1}, 0x0) getgid() socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f0000000140)=0x1, 0x4) sendmsg$802154_dgram(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x24, @short={0x2, 0x1, 0xaaa1}}, 0x14, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x1000}, 0x800) unshare(0x24020400) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000010800000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="140000008196011c0c002d8008000100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffffffffffcf, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x80) 3.199721704s ago: executing program 3 (id=3058): syz_genetlink_get_family_id$netlbl_mgmt(0x0, 0xffffffffffffffff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000009c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x40003}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x50}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0x4, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80000000, 0x7, 0x3, 0x7}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x14, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fcffffff00000000800000af18010000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000a000000850000000600000095"], &(0x7f0000000740)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{r6}, &(0x7f00000005c0), &(0x7f00000006c0)}, 0x20) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000001180)={0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000f9000018110000", @ANYRES64=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55, 0x0, 0x0, 0x0, 0x200000}, 0x94) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r5, 0xd000943e, &(0x7f0000000a40)={0x0, r7, "4c92c9f9c6765a3ef0da4bc7a92e76b65b45d27b37d4bfece991f24f14f0d1be4c3dd31c2fe6f168ba9e2274575563b9df47cb2f7dd1160fc65f58561414b81721fd3153380a6ad2abf138a87110f8159005ef0fc54b3876543bcc2dbf8ef5de3a7b078f3618b1d6975d630943788619103d713d10b12af0d309d1c344030eeeb805dbd70c3b3ad0d39587da43542cb42f110bda6055a27b95e0233bc59cf533f64cd977ce314448962c5578c258a2daabb99696e3ca82c48ae9e044c5a039e84513d1598290f1fd4488f2e8fdd8442c8daaed88dfac4fedc3c7c0a205897cbc317d1ffc038029820bd30d1c56071d904bd22ad5e121188ec9029b61141ae0c1", "63af6b120a203a58bb805f4bed52ea72722daa9e58ecad9cb1b334bb727a27aa2d6dd59fd85bd43889a5306327c6a2d9f442b887382c19a20021df7d65d0805f305a565752e5429d3b1663f49a5fa8a6ad67c6594e3274224d85fa11e7f2b884aa39e87d1b7184ce49c7ced59bfa542bcb22f83c86abb887bfd1bc1e698762b75ac31799ad6b56306de2bb44d93b37ac280b202c09b04cea02025ec25e88cfba00486813d93c8f2b13ec9f3f0f7c7393809ca6d9f107e00d951924ca0d6063b1496b54b57f9152bc789e507702c8013bde8e28f683773ae71fb0057cfc871f58c82d9d1c392930fd0ab3dee6009c996ac2df32a98bb3bf5eea25b5a75d55abc8be2ff9f5b00886f3539f38410ac2525f35b63232bf8eebe6ed6175074c6113455a931d494dfde523cf01c929ec876d8ced58dd6389dbfa9bfd6f3f71abcb29cfa35362ffe9d7d67f5f4946e787f4a3c98234f8d7137a1b76d8046bf4402c29a16c23c20449297d3ccc7bfbb06d2dc433bc7ef8d466ad64d3e339988d22d9cd715bb11461f724ce2cde143576fdb15291352cda275f0cc3ac44819ad366d66d8ae53375f2d7fbe8f45c13fb74526378de7f4b81df681509bceaa1e27e798b8302c9984e7c714e6aea510ea03edb4ad1a1c2fa964489896315017cac3e2f07a3d94719c9f8ca18ff152b73dcbaab0e93fab81dd019b11a4d6bc3a6a912dc4c761138f3237b40b709372142c88f5317ec42ab89b1bd7f99e8cbb9f4d921861d94ace1c5a830774781d4e4c6a5a194f74e9b2407e30a0c14bd8829597e855a6aa7698f6d825f6f5ce816f1048dd0bd7df6feb1c56cf0c8eb723793792a08d55f270778ee4603f84ed3d7f6385059472a9e9bcf17c11af1f6c52fef01376e2b94d7f2a0911ed12f3be6ed78139dc053c5b2c2b314384d8d10c7cf4ebe919a467e1082ec8c842c0ca1a9fec3a87634320e7d1bf2ab8cc4254c1e36795625e3660ae8221867c99d50ece35284b9777d78ceb74e25c1d5d42829d529bb0d2c0ac53d022c64da9343afdfb9d1f7bdc0867a67b4cce46846d2a91602011789363a427ac893432131aa554146605862e6b98e50e0f6aedecd148220c59e51450dd6f0b6c836ae003e314fd256606a096cdbe98859723a0abc2ba8b12fa084e942a229b44f17c9c2241d333d12c73b083f7e22f3d46948c2170d132ebbd33ca6aceb266846b42eaaba1cf94fdfc6d7ccba35ca28be5cbdab200692e334c0386c3f9cbb5a6ff82eec610e17d61a9530b82a24f69820c54a7df5a7ac2ad6e35db885498b7c94551616132224638f261895a6188eea4893b6e56497a6281781032f9db6605cb0ea3eb5b0d6eda388eab2750792102b3ea4a1113c304ab5c0c68c1c469956463f13003923ccf8f656b43ef0842abb17cf38593f01f34f738cfd539290265de8f299ff5a5a1ece910a5f1413fd899eba5948dfc4009abf5efe30013ae060441252a98ffc5b3e62ec0b16acf284e821c1578b304444c7bab2e757dd17489be38d61a18c03028643a7c65a1360a3edb0bcaf083499dbd63780a8d56ee51a1ccb98050d5d6c3d57c41c66dc150436ff0212abf13edf673ab6e11b99bab1ed41535fd4a02265dc984e13b81886de0ed49309f6940012f76d23d55f44eeae3e848e9d01af32ccdd64049441c7e8eb8942c7827b451b8206dc0e979b239f439d7b78b5f1c081fce85ce579ff0eb95388e4e1fff77f0200cfa1cdb3d278ebeae33227e81ede36bfe26b6b30a239da29dd995e0908f3283987b0ddbfc5a472cf8acba8cc9abbc5dd6b0e94f9724fa6c9c6c335da03e4458c1e806becc783b539f6649486dd71afa8625187a3b083ea78b7582efc61786b65d083683816c624d9fd492523eebc65c487f4a77384df149d9dc20398594609d3d6ab9c46a9dee44a9be6687850f229664330187de10137549ea96cab8fb3ec2b80bf7889bbb82123da26b5cb4859f17d10b60c0c4285a2268cd7caacd20faade9184497db33c02c9803788e321bf57242f2bab369d9b4c2d2c607863064a724adaf093bf677d6e94d6afab0d37a9f0d59fff2bee5d72f05a7868a33612af6ca2037b401a3a377af8f0433f51f8266b630fe778e8480230160edacb47ad685c2b678e95411400f260736916f35e1f093b5bab146ce6de3919e819b5f15f50a029741136ac7b767e447f271fe5c54299f5630b23f4d77af8bdcc078fd22b7f83ecd9ad06476a3da030120e9f6e1061b28e31c979beed54b7a803b861f55c47fb66b7d7683371d771a4c3faabf53159a064f1a53da7a5bef2e1d43aa1c1c02fb72a00038e17aee23b18b5e3bcbf551faf4769e3ac83a068aba50bfbe80d56799d3645ca69f4641f9deac270642c4e5e12ad65d42b10d8c79da6b630f437eb565932fb67ac540b0b806749f7f97d7064b6afa19e0cfa9b7d82a593d9c256fe7589571056e146871823dd9ccbc778d73515483a518ef833c01688cc844d36e5f83863d133bdd72c36b16f9a9d77cdf7e0353a906b23d609fceb7ba33aeb913979a110176a42af908521d79460cfa6b2e14d89855a8b36ba35ca072861261664c742699731bef56cc364dcf0f3efadb1613f655745dda98145677dca7117a761389b393f0e893f635f244274ab85fbb0212566744cd1db8217a03868f9d5afd977e6bfe45d92052b5af8e94568c07f3370d8197c87a63f9a985bf371e4e01d37c08480cbd21bc349c441a8ef311fd6cabb3e252bec3dedd378bd3aadc508be725832e959021ad5efbd12398d1fa9442a15bc9c6313e58d5543601e11b5a389315c8f376f1928c8b3bda15ccc49a40bb0f0f29a0d1c6224cc293eb0b5667899878114a6cd84cf4134358a96c055676ef53c1d688e7c695a727964ded013007e176a2a0f2b242a8b547891c22b4e47223a294f41104358a02180e0993f3897e2561e835104c674c56e352dba4a67b21f3dd02b51510f1907f89dd972b7bb3b9d160e8da6f3ed86f2aa73a5dae6e06476c76b73f7e4537b6f1d9c790c5b299de44c514a9978abf94c51015b205f87de9af1736d49ca0751697f2418c4f0d53becfeb65cb2c683cf117c3ac96d011052f07fe94fb64a44900817016d446150267c1ec522f6fd931fafc5451d813559ba3a1813bc248e97a9bf93e19ee6732ee06974e140bda0f12a9470905c1502cd75f8a9e0a3f91a1c9cc9305e62ac58b557fb854e2737647710c744691401211a92c6f8992f797af995a709d1dc40c7b58d52c44f6f18d03ad07465f3e0aed6c99170e2ce19ccae381fc609d61d249beda54697c4805f97f189dfb8455e7c6506b06e176b67bea293bea78684befa3e989d98177634fc850ee7463eaa0c730f2e88337d4b481e1217c490ee95ef4914d1729df0697b8b6127020cf53f730d6d2bd04fc59adbd0f404e1b4821b088481869e436233dd047a89fdbe2ce30008b8e083ec4d3d1cb4f7a42d5056e4b793de19b8b4281a228ec4d384f3683b44e1f0e64cd79d432c9743cf6ea2c6667d857a0b0894b2fed2a181209cd41a8bcbe44e34ad14da4dfabc454731c52dcb83cdf9e2ebacb92d616ecb36dfe68e710752de788c21b7c3745224a264e43f01a4c2c729d8041e2a83897b95ce85641b0b696070f9b76881ecd22cb6c725b8c611f2647953c2cc720589e6d700d283aa33ea6e40f856378a5e8e7cfa165609f6f613e2dea037f02b11344371d4f2dd101b7f50a50693d435dec279ee6859bfa288dc8710ada09da85b74433da218087f581a985bf3adc640aa8bceb9c7248cd6d8b246040d266e49ebe09769ca4fe9afd653ec34a5db148d852e149491f65b0556b7c3f37d99fbdbe410a17e96d7c3fcbe9e74438f7f1f9c1107e24043a190e148a00b8dca9829e8dda5433c1cc0a32286dd0d59a6f9081f479da9d28a1cf83250bcba8920accb36ffc1401458aefff63985de4cd36a9508e3abb35c3ef7e8fbb568a305f4aae7d9ba72e543512a295d83d91b8164f118db4e12202555616703017e9741da6e98a83e8cc4564a38b614dc14bfd971fca3706b20a582a13031e6578b9fc53b7da45ec2c3058cc15abf1ef8172d74a598d11fa58c2dd819dec4ba51e234ddf8cbe3444eaffd4a63ce4da0515ea61980906eb7740aac6203abee25a4f3073ea18b71469f427d58997f6aeb523eb9f6722491d5078d73551151d4a8aa14eb8accbd51488a0b3cfbdacfa0687966e64b27fbe543faf727650e856db245d26fe6e07fe89a28722ee44c39e103efb5cbdbdc903204b9d2a924f09edbaca70863ab9c082de524c227a790b600f93b089c3d766eeae7ebf6656d65af92b78a189e9601fb85b897a87f384fa7322cdda54eefdc91ee1471fd4154e51890a6e3fde5231616efea7dd033bdfa6fed32e850b34555b4bb936584d3f51b770339e1d6f7aa852b2a05df365684692fa1383835032be7f24118b0e6656a70015c63e0bf410679c4c255a82121fc5d7ef9d023b2532d95604dcf167a65c5701b955f92b5d8fadb4d0274405ae1ac358756210f13340094d816cfd51c3d93aea27660fe351c592e6250a30a4aff4748ef61ef27fabaf21da1f2300a04f9a5559a722844017694ebc5a441b73d34c97d1604c5cdde2e6393a6bf9326f72cf509d90fbab636b9d8014ad91ee4503b7374da4eb1ff933c0987b096b3143956b89decbc56b1fefc1ad7714acef78c75fc4529ab5055ff5b2d16209897bf79e9c2dadf897bcce8331987057acbb9b43a5e14893b1783f0568b1d1e36378826a2bdd9f3a23deea2dad3f121ebba55a5982ba41b6e3dbec022ca151b330eb09392947b512b57a1db3af7d5ceccfb8a9629b7949a5edf3dfc41a5f7919f1167c946775dc482fa4ebbf32e9c2e098b5bdad1b0fd26307173528f49f67fbe6e94e6dd82dd676dadadafd86f7e3837d892daa9feed6ec06e772ca9c1f1ff82f52f382318250da9b3d25bd8b3be01e540df084e5d73a23ac387eb1af7245a7c184b64a038756c3ca9b9d41cd0ef05ed5fd5a350c57574c462f8702c2cfd9220e1ab57a64cc44882f9c6eb1d08c6d8f821be503530873d5435bd984a2416bcb544c51ff28381b3dcf123c4e53badffbbc00aed5e35fcbbe3793197c30fa9ba0a349d62d92afcf036e21fe79bf2944a045af9afcd3374daecdd468be05042db08d6b1ba13fedb36d2f9555c5624c59ad3cab72fcbe23cae7e08fdf0ca1789c3e23df9ccea0fd0244042dc222057bce77c1ce19a8641e64bf76a4b010048e357c16e102fd0ec27016012476afd147521849ea4ea6b47b27f9fa6e3b0dac061bf51e7bff8451a0049d1a12eb9332385b4542b16513481971fddcc6525896d130bd0fbba45cdbe790802cd795fe5f54527cfbd"}) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) syz_emit_ethernet(0x10a, &(0x7f0000000040)={@remote, @multicast, @void, {@llc_tr={0x11, {@llc={0x1, 0x8e, '=', "93e43b85ae0956b0c49437be61fc0f807e6c4e34bf051d25c7d5bf3a2a6f7044d8218be330b52c67fabf1fc24aaadc3ce254e03faf63c5198d4e9e99396db209ac34396b160501728b567ab2c86ad7bf325966aee84f77a7fb1313b9251586b9c4f16fc05995728b45a6738501c1dc680f12f718cc56168f33b021617256fd1b8ffd78833ed57a270d251a2cee988c07dd95b1763d2e92be732763a7df418cf7d9f0d99756b226734df74f1139c6b60a6246a84e2997a1562b3e19bf81a1c8beedc7c330ad4211988652a8cc2a4719d0490808ba31cdb4ad87b43bf4ad578d540e691aac4679ad3260b213fe93d7d9717337a210e354d8790c"}}}}}, &(0x7f0000000180)={0x1, 0x4, [0xa5a, 0xa60, 0xf7f, 0x518]}) 3.134237315s ago: executing program 4 (id=3059): r0 = socket$kcm(0x29, 0x2, 0x0) r1 = socket$kcm(0x2, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000000), r2) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'team_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000001100)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000fbdbdf250100000008000100", @ANYRES32=r5, @ANYBLOB="44000280400001002400010071756575655f6964000000000000000000000000000000000000400000000000050003000300000008000400fdffffff08000600", @ANYRES32=r6], 0x60}}, 0x48004) unshare(0x400) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4e22, @broadcast}, 0x10, 0x0}, 0x20000811) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=@newchain={0x30, 0x1e, 0x1, 0x1000, 0x7ffc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x8}, {0x4, 0x1}, {0x10, 0x9}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x20044000) shutdown(r1, 0x0) 2.983351621s ago: executing program 2 (id=3060): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001a140100000000000000000908000300000000000800", @ANYRES64=r0], 0x20}, 0x1, 0x0, 0x0, 0x4000015}, 0x0) 2.977916397s ago: executing program 2 (id=3061): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x9, 0x32, 0xffffffffffffffff, 0x34d4c000) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e, 0x0, 0x2}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r0, 0x1, 0x3}, 0x48) syz_emit_ethernet(0x46, &(0x7f0000000400)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x4, 0x38, 0x80, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x12, 0x6, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x67, 0x0, 0x0, 0x89, 0x0, @loopback, @multicast2}, "00186371ae9b1c03"}}}}}, 0x0) r2 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={0xffffffffffffffff}, 0x4) poll(&(0x7f0000000040), 0x0, 0x81) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xd, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB="bfa200000000000007020000fcffffff620200000000000018110000", @ANYRES32=r1, @ANYBLOB="000000000000000085000000010000001500070000000000bf06000000000000bf61000000000000070100000400000085bf610000000000000701000004000000850000005d000000b7000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0xc, 0x1000, &(0x7f0000001000)=""/4096, 0x2a079ff5b90a2b9f, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.902243462s ago: executing program 0 (id=3062): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000240)={@remote, @rand_addr=0x64010102, 0x1, "1500b9007ce1f2866ec98b9cb52710e59ef0e164c7a709c8bef98f17272a1c45", 0xfff, 0x200, 0x6, 0x5}, 0x3c) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r2 = socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40011}, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x61) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0x0) setsockopt$inet_buf(r4, 0x0, 0x29, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r2, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x440, 0x0, @multicast1=0xe000cc02}}) 2.679493467s ago: executing program 4 (id=3063): bind$x25(0xffffffffffffffff, &(0x7f0000000080), 0x12) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2c, &(0x7f0000000000)=0x80000001, 0x4) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, 0x0, &(0x7f00000001c0)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r3, &(0x7f00000001c0), 0x12) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000100001000000000000000000bd00000a28000000000a010300000000000000000100000008000240000000030900010073797a310000000054000000030a01020000000000000000010000000900030073797a300000000028000480080002400000000008000140000000059900030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000200004801400030076657468315f6d6163767461700000000800014000000005"], 0xf0}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'bond0\x00', 0x2000}) 2.662757519s ago: executing program 2 (id=3064): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000020605000600000000000000000000030c000300686173683a6970000900020073797a320000000005000400000000000500050002000000050001000600000014000780080006"], 0x58}}, 0x20000000) 2.331195021s ago: executing program 2 (id=3065): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x9, 0x6, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000d00)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xd65, &(0x7f0000000d40)={@empty, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@mpls_mc={0x8848, {[], @ipv6=@gre_packet={0x1, 0x6, "04dbd3", 0xd2f, 0x2f, 0x0, @dev={0xfe, 0x80, '\x00', 0x2e}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0xb9a, 0x3, [], "d0f193b5e0fa684482abbd34a356b964578530a2c4c5227b74fc94d242566f351e79af85a8043aec462c54ed5787b02a345ad77e4000308d28ddc4f21e8c8f5b8a8b9ad79374f0e897c91cf4669f8f100a1b17569bbd8fc1fccb2a2a4290a595311c9c3ee49a4a2219866358ab8f0fb66ecb8f39bfbd0d642e30f0acb24b0878080dbaa2364b9e554616edcfd20e27bd9cd72a8ca55c0d1b1bda4e66ba03b74867bbb94250d76f537a893862d0fc6ea06aecae50edcf6e6748fff49d793da1d742909b6bd36fdac776c902a0b23a16ebbef4a203cda052ad91d8827189a88a3dbc54203ed33006a080217b6f9c6279c4afdd1e5facc49da4b9d8c224f4e1da8477d2d3454debfd86efe5226d1e093a066c422bc6097cf246485d7ec1f97aa5b0de934d2b3488dda2a421abd27c024b8605937edfe1f08bfb10422ef64566ed36f18963214a05bbbbd97df054a18636dbfea3c3a1d79a4ec02948f89aff3f37983de0209cdee4698096578c9d41f14b49aa77ec4a6ab4539225922aaeb64982f834251522845be4c189d340624f2ef555e6a8403c3b97a194d23c008071877210fff1b3fa3102aaa18e8d31f2218c77326400d6d469e9d3f8f108bcd88526bc553a87ec17b68991068a8e0055651242d882e751974a0a04ff8d8b20684ca3d361d5e970a3e7b30ae48009177f9f4b240598e353400518584e32e9a07fb967fc926a9b5ecacd21ac6bb61666bb90196f1a709adcf0e412d0ae9b31eab86f8e8f686fd9c778df74652661bacd76f5d9385c21b9720e4878f6e8d0bd36027b03bdd10c9c8773ebff72fdd2b4ad73aa120abb81860ee67a4805e6262c29a8e1f8db06cc9258a49c40dfd06ce67c9cf0b8a48e1e6d83e561005fdd7c2b29cef4b12669c259fd954ea5a09abe7a7f82366774b7530ba45522b5e80c9f4dc55fefde8a80e18080d3b12b7f395eef31662001987c2c17484eb7c1c4a66cb9b87483c621a94e013eba6fb40cec7f5561686795dc2a21cac1acd5c4eebf377a3bb2a06e8a4be63c8988e2e8604a157a5af27674616f39ff761600f5ce26becf70d18357948bc15125a417756bd2d86a4c707c2708667f18ec4c993c89f46baab3dff931f1b1ab0c06af5fbeda46779dd19cf285794d5c12dc95193222f6fee32b571f7f16f4b041f8453f4f19770a4b2cd365f4c86caf2bfc343789a32bd694d9a2548496828d54cb5bd277cef5cc489948b21bff4749f75962208e86272eeaa87516966882216b98b76e3ea303ff28fea6d140382bfc4039de85daa0b1dced70c5e9249d6540b62def5bde70c2898fa266e625ba8823a521576effeba981568a30a6579ad55c4db3263320415afdf957f965ce10cc203b4ca86fc246317ea90418b1ea8d105036ed4507b985779278dd8ae195c470f42679c41f847d328716fbcb7ae9846061ecf9a719aa965db3f0c2915dfa89f98c97268f8deb6d5ddb9443d296387d43ee6c30a2d62a4214836b0019f23c0a7399fca351ba63be67d197061e40c6e74f37cdb6c4492316a3ff1663cba24385aed80481fe5e979e4b60aacbe53b618732070ef5ca56e3f45a413d506abcc49f071c6a44b06ea2256927b60009d641846f20116f38d785b4e8e2fc619d4e4ef2893c947ae130652773c1362b79aa8e1244c884b424ddf8d872668a601ad7f3df1eec4f9da73761c597efb337835fc12c861b7c49bd974dd0578ffef27be84ae5b843df32142793febd8527c84bab8c37d3261dd09b4e105c05abfe2c3a7f25a1e11cf58c10faf0c625c557d7cc696b15a5f074fa2aef9fbddb22b87d1bcd1265b178aa3bb168dd5003176b6445587ea3d7fbca52954399d8ecb23cfcab6773639e0daf180667c4e97a8ebe1ea0887c87f0b0228585391aadd4e22b8a7d92a135204eade4b6b91749d57270e7e62237cf4700fda89973ca6a77b6ad1a470d43c8064bf45b8e06e0d86005f51c4a9cae754a132319a36f48e89d07f853f38f508fe182fda6886af97cb3cc0d53811d6543a3cb34dab93149dc31bfed09906d72fac16fc4b8ebad8123ae07402db59e6e756d72b8ab6f1f055691df89fbe99f5f08757e74df694c1e75fe423873081150cc0724db96a152ca96fde684ce998be3b834145ffc5675eec139f21cc3155f1d8be29749e4e7ee6bb24fb467bebdf124f4394a12cb682adb483f31ace8237267e7c2fe2bd06ed2aa374efc6e65ca14694bc4124773c1588acb5796b655ae95f583b4d4faf41fbfed3b7cf26c4900354ced7b1629e7a409b74d34eaddf704661702970d4855fd605075fdc6350244e1ab315bde278c3685e127450bf97fb0808a86b7727b9731b949f45bcb050f0f86a6210f47b774d4072dafba340e1793b9779fc7ae38c2efac819c7cca30d9f6c5a3141ba84d333851d0953ddb8ad344f2f5a502d0658e0fcfa2dc65eb58aae9793e7592d7b7681912456f7e47e093d12b23ce2986eeadb6ef010658fba4d5c25604da089b9ebdc706793e573311fd78279d2881b8c884da4e4d6128c453369a083e3b783135f11b49b302a202eceb1d7e1daa10b694d062b6fa33d83d2427d06e57202ba23140f701d067bd75c5ba10574c3c71e2e2e2c1d1b48f7755c2f1d4d436d69fa9600aef10861200d4c938b36b4bf2deef1053d743c7926fed68f8c416ccc87a4149f9bedab0538c682b7b5ac385832c2631bcd0d05eced98208a4e623e32994668b81fef5a2c3831aeaa5988b0e96d132cd3daeefb50192e5bf8ba934ef98ee7592ee7b07f6560fecb117fb2d94ea151950e7a602bb474beaf5d2e088bbfbf0f62bf395efa802e15b08a24697ef8889b5f15bd862fbe377769bd42322bb0450262d7718b06cb5d3654e25f3289aa8a53d7558ef10e2abfd453da26beb225f984571b4325c71fc6868f109d5087eacae30dda51121a044e12bfed58a7c8793298595fd1c802cf97610b12c39213b5e440639d292c298ce4d41435f46f4108050d1de3958b093ee829318d850f260196ee98d48f95ac3d6c66892872ad760853df0ba797eb38c07c31bd58c6b2cfe8ec6a612b8cc6811fe50fbcdf68fc30e4995739af2145a9bb56490d7b63adba797fd8f5bab41eb311fb5ef63eadbe57989adfb197146653ceaec6fddc3f1c13787a536ca904ecb7df31d44eef5f8a75ef0c93ca6876c882a0053456aa6526b0f726e6c8d5daddee303cee76a1729ecb9fed0402ac6620611b518858d2e8e9ac282b389e81d23994ce87f033f44ea963cb550f370aea9bfa51f868818829460902530fdd48084d438d7e7c012db83137e10846599f6b757901e8cc2becf01ae4bb01917324ced1e8784f41ae673833dfb44fae3c400d80c00f0025f3ebc87e41c91391956b987a511bbb2d6cab3e08f2dd84aa3dba991ad5c65d9b253af064882703bd1c11d3078e66444e743a6fac24c2931f7e60aba9dd0cf7415b6de4ddb00802b78565cc4c9e9130b2781ac8b70b147415e9a4abbc8fe32f37f28175627d75779bd4ef1b50ef7acd75468a2dabd89b1c9ee30896aff1f095b48bf49b97d2a8b17faf87657ca5604835bea50ca3594a3d9faed8c534fa1661eb88d02a337838b309d7dd8b51708a49bd71037637e32b0f74677642419f05bd5301a3b727f8151cea1da17b06406f10a7c5af90a505c801c5cf16a702cd71a32f0635973739c07c675c07258b33a07942797e1f2bcb39cd7478f4afc5ad35aea423fd99b1de6a1816f3cb310bbb7fe363f01aaa8a943b5d7aacd8815f9a27a23a4dfa0bc5f3bdc092749ecca31f23e90d788de2c8ddbabf6d1cfde9e5c725c74f5147cc7352191306ac979cc526c1e10b875fcd25e5b50520ab1ae0c57b76ba724ffd19eeb8a1f31cfa793a47e9ec59a850652eeb7ac15483437cda44115bbc7ade1d3ced94c5057dba7fdf17cfe6f05293e4f0cc8c7c0feb1ed0dd0f380bb945a12242c71cd923334a52f78846f575682a368e71cc130864a0fc43df201f514789b02f89a06d8e7c2d6c630a20c0da0c32613e2d0704a8e7528479fdb6559377422ac6419c3cbedaab99e485330a5019c088c462d726d48f03c23786a68528d2256257cb43f6625c064b2e44842525e29872a70d8d23694f21ee573b6da3e864ec1960a38cf74b2ac2b515d4ed1893a368063b33a70c042a31e01435b507e004fa7"}, {0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800, [0x6], "a75596a2dd563f27c54b381055e6d57568f9f74d9b8bb93a750a6aeeff49f59b3a93f2a9131157c515c68904c25ccda2bf970df6ebb243038c0cdc2b39f688a4fc523e66595e50f83eb8e790c9f6bfb13c4c993ad3a473d3b0c4e0d4c27b2b3d110434c03ce47b4dd109140b9708f102495539ba5f3cef92f7f4e5c2986ea614dac5dfccec86ebd8bdf499a074938ac15b76f3d683ddf7c225b78b28838b28a6f66ceb2c2922c12a3221973d337177e68626b522e43fe1ad516a2d8f9f714ea2483937770e3237812e02c1"}, {0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x8, 0x5, 0x0], "090cf8fd911393fec0760a3c5d587acdc32483e3a3b567a26d834b84d9672bce4acff0142271c0c0a0cd92c75365c812bd1a680cfc99d6f0129e9ee63b96e17cf1e20fff484dfa2bf8aa7343606887c6e60a9d1c152bd4a78292f14e0ced4e1ab6c2d07faa86d64d46a36c59675bf98b7b713ba17857e061e78f2099fca6"}, {0x8, 0x88be, 0x1, {{0x0, 0x1, 0x46, 0x0, 0x1, 0x2, 0x0, 0x80}, 0x1, {0x7fffffff}}}, {0x8, 0x22eb, 0x4, {{0x6, 0x2, 0x9, 0x3, 0x0, 0x0, 0x2}, 0x2, {0x6, 0x8, 0x0, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1}}}, {0x8, 0x6558, 0x3}}}}}}}}, 0x0) 2.256801398s ago: executing program 4 (id=3066): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x1c, 0x26, 0x109, 0x870bd22, 0xfffffff9, {0x2}, [@nested={0x8, 0x3e, 0x0, 0x1, [@nested={0x4, 0x126}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)={0x20, 0x3, 0x3, 0x101, 0x0, 0x0, {}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x3, 0xff}}]}, 0x20}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={0x1, 0xffffffffffffffff}, 0x4) ioctl$FS_IOC_GETFSUUID(r5, 0x80111500, &(0x7f0000000140)) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, &(0x7f0000001b80)={0x0, 0x0, &(0x7f0000001b40)={&(0x7f00000003c0)={0x80, r4, 0x1, 0x70bd28, 0x25dfdbfe, {}, [@ETHTOOL_A_FEATURES_WANTED={0x54, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x200}, @ETHTOOL_A_BITSET_VALUE={0x44, 0x4, "d700981b00eb2e2466b3b726c12bfffe5f916f1716088a9129f9d2da6226169a994f49a227f189a859257dea5b53a46afb0f8effa4689efe631ffa5f5e03709c"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x881}, 0x8000) sendmsg$inet(r0, &(0x7f0000000580)={&(0x7f0000000000)={0x2, 0x4e23, @empty}, 0x10, 0x0}, 0x4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000001400030500008000ffdbdf25020156ff", @ANYRES32, @ANYBLOB='\b\x00'], 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x4000880) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0xffe}, 0x10) write(r7, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b160000000000000000020000084c00048018000180080001006f7366000c000280080001400000000430000180080001006e6174002400028008000140000000000802034000000014080002400000000208000740000000000900010073797a30000000000900020073797a32"], 0xa0}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 1.711992034s ago: executing program 3 (id=3067): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="90000000000101060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500003400028014000180080001000506070808000200010203041c000280050001000600000006000200001500000600030004d20000080007000000012c0c0005"], 0x90}}, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000800)=ANY=[@ANYBLOB="c8000000010201060000000000000000020000003400018014000180080001000102030408000200050607081c00028005000100060000000600020004d2000006000300001500"], 0xc8}}, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r1) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r4, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4080}, 0x10) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02"], 0xe) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$inet_udp(0x2, 0x2, 0x0) close(r9) socket$key(0xf, 0x3, 0x2) ioctl$SIOCX25GDTEFACILITIES(r8, 0x89ea, &(0x7f0000000340)) write$cgroup_subtree(r8, &(0x7f0000000080)=ANY=[], 0x48) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_NAME={0x65, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x20000854) splice(r7, 0x0, r9, 0x0, 0x3000, 0x100000000000000d) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x100000c, 0x11, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) 1.702045341s ago: executing program 2 (id=3068): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000f2ffffff0000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x4000000, 0xe, 0x0, &(0x7f0000000040)="976d9023d56482cd284a63da5397", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r0}) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x10, 0x17, &(0x7f0000000140)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c0000001800dd8d00000000000000000200000000000005000000000600150005000000280016800c0001"], 0x4c}}, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r0, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x2000) socket(0x10, 0x3, 0xf1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x0, 0xb}, {0xfff1, 0x6}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x14, 0x2, [@TCA_PIE_TARGET={0x8, 0x1, 0x7}, @TCA_PIE_LIMIT={0x8, 0x2, 0x7}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240048e4}, 0x20004810) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.589451942s ago: executing program 0 (id=3069): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000010916800000300000041000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYRES16=r0], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000f40)={r1, &(0x7f0000000e80), 0x0}, 0x20) bind$x25(r0, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x1}}, 0x12) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x5, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x4, 0xe, &(0x7f0000000b80)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8e0400000000000000c61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b36db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece010000000100000010223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff814f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffff854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e92604e1026e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c36981edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ce852364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b00000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24}, 0x94) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(0xffffffffffffffff, 0x0, 0xc0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r7, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001440)=ANY=[@ANYBLOB="1400000030000103000000000000000001"], 0x114}], 0x1}, 0x0) recvmmsg(r7, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) write$tun(r4, &(0x7f0000001280)=ANY=[@ANYBLOB="000086dd0000110005000000a60c6b63851e0f9829"], 0xfce) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000003c0)='nv', 0x2) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r3, &(0x7f0000000240)="c9", 0x1, 0x4044880, 0x0, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0100566f4843bb36c89bb3a6f881a1bdaed00004000000000000000000e672", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@map=r9, r2, 0x26}, 0x10) 584.149946ms ago: executing program 3 (id=3070): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000540)={&(0x7f00000005c0)={0xa, 0x4e21, 0xffffffff, @ipv4={'\x00', '\xff\xff', @remote}, 0x4}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x28}, 0x8000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f00000004c0), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r4, &(0x7f0000001700)={0x0, 0x300, &(0x7f00000016c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000002300000008000300", @ANYRES32=r6, @ANYBLOB="05001f0002000000080021"], 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, r8, 0x20, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x28}, 0x1, 0x0, 0x0, 0x44000}, 0x240008d0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r10 = socket$netlink(0x10, 0x3, 0xc) sendmsg$netlink(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)={0x18, 0x56, 0x601, 0x2, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1}, 0x0) read(r10, &(0x7f0000000200)=""/191, 0xbf) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) r11 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r12, 0x2000002, 0xe, 0x0, &(0x7f00000004c0)="df034affffffffffff0000000000", 0x0, 0x800001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r2, &(0x7f0000000440)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x44, r3, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r13}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r3, 0x100, 0x70bd25, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r15}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x20000040) 573.004081ms ago: executing program 2 (id=3071): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f000000a7c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=ANY=[], 0x20}}], 0x1, 0x800) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r1, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff0000"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000680)={r2, &(0x7f0000000500), 0x0}, 0x20) epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) r3 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000080)=0xc) sendmsg$netlink(r3, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000012c0)={0x30, 0x2c, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @uid=r4}, @nested={0xb, 0x2, 0x0, 0x1, [@generic="976b6408686030"]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @uid}]}]}, 0x30}], 0x1}, 0x0) getgid() socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f0000000140)=0x1, 0x4) sendmsg$802154_dgram(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x24, @short={0x2, 0x1, 0xaaa1}}, 0x14, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x1000}, 0x800) unshare(0x24020400) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000010800000000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="140000008196011c0c002d8008000100", @ANYRES32, @ANYBLOB="08001b0000000000"], 0x34}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffffffffffcf, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910700004f78d4c1a0731cccff"], 0x1c}}, 0x80) 541.580034ms ago: executing program 4 (id=3072): socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_rdma(0x10, 0x3, 0x14) r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) bind$packet(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0xa, 0x300) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000000)={0xa, 0x4e25, 0x97, @mcast2}, 0x1c, 0x0}}], 0x1, 0x4004800) socket$netlink(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), 0xc0}, 0x40000002) socket(0x28, 0x5, 0x0) socket$netlink(0x10, 0x3, 0xf) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r3], 0x28}, 0x1, 0x0, 0x0, 0x24008821}, 0x802) 291.193751ms ago: executing program 4 (id=3073): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000000)=@sack_info={r3, 0x7, 0x5}, &(0x7f0000000040)=0xc) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={r3, 0xfffd, 0x8d3}, &(0x7f0000000100)=0x8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r4, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x11, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x3}, [@exit, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x800}, @btf_id={0x18, 0xf, 0x3, 0x0, 0x5}, @exit, @printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x800}}]}, &(0x7f0000000680)='GPL\x00', 0xb, 0x1016, &(0x7f0000001880)=""/4118, 0x40f00, 0x28, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x11, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) 0s ago: executing program 0 (id=3074): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha512)\x00'}, 0x58) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='='], 0x20) r1 = socket$inet(0x2, 0x2, 0x0) socket$rxrpc(0x21, 0x2, 0x2) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) bpf$ENABLE_STATS(0x20, &(0x7f0000001580), 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x48, &(0x7f0000001540)=0x10001, 0x4) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f0000000300)="00000000020001000003a90830332b35", 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000001800090000000000010000001c140000fe0000010000000008000100000001"], 0x24}}, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r3) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x14, r5, 0x1, 0x201}, 0x14}}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071123d000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) recvmsg(r7, &(0x7f0000000500)={&(0x7f0000000240)=@sco, 0x80, &(0x7f0000000440)=[{&(0x7f00000002c0)=""/158, 0x9e}, {&(0x7f0000000380)=""/154, 0x9a}], 0x2, &(0x7f0000000480)=""/66, 0x42}, 0x20) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="00070800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001311"], 0x4a) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r8, 0x0, 0x48a, &(0x7f0000000240)={0x80000000, 0x8000, 0xb}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xb, &(0x7f0000001800)=ANY=[@ANYBLOB="18080000d0ff0000000000000000000018010000202078250000000000203e207b1af8ff00000000bfa100000000000007010000f8ffffffb702004c9d52723c010008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000180)=0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001600), r6) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f00000017c0)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001780)={&(0x7f0000001640)={0x108, r10, 0x4, 0x6, 0x25dfdbfe, {{}, {@void, @void, @val={0xc, 0x99, {0x4, 0x6d}}}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "c9b1d2d05bc682aea20e4c06e469831ec4322ce82a219061"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @mon_options, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}]]}, 0x108}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f0000000540)={{r7}, r9, 0x8, @unused=[0xfff, 0x4, 0x6, 0x2], @subvolid=0x6}) kernel console output (not intermixed with test programs): :0x7f236b99e159 [ 369.049851][T14094] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.049868][T14094] RSP: 002b:00007f236c7d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 369.049890][T14094] RAX: ffffffffffffffda RBX: 00007f236bc26090 RCX: 00007f236b99e159 [ 369.049911][T14094] RDX: 0000000004040010 RSI: 00002000000012c0 RDI: 0000000000000005 [ 369.049925][T14094] RBP: 00007f236c7d4090 R08: 0000000000000000 R09: 0000000000000000 [ 369.049937][T14094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 369.049949][T14094] R13: 00007f236bc26128 R14: 00007f236bc26090 R15: 00007fff75593d58 [ 369.049981][T14094] [ 369.708599][T14097] tipc: Enabling of bearer rejected, already enabled [ 370.269292][T14115] ip_tables: iptables: counters copy to user failed while replacing table [ 370.936828][T14135] netlink: 'syz.4.2582': attribute type 1 has an invalid length. [ 370.936850][T14135] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2582'. [ 370.940684][T14141] macsec1: entered promiscuous mode [ 370.940705][T14141] bridge0: entered promiscuous mode [ 370.980144][T14142] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2583'. [ 371.250999][T14146] syzkaller0: entered promiscuous mode [ 371.251022][T14146] syzkaller0: entered allmulticast mode [ 371.291207][T14146] tipc: Enabled bearer , priority 0 [ 371.302507][T14145] tipc: Resetting bearer [ 371.454779][T14145] tipc: Disabling bearer [ 371.724716][T14153] xt_hashlimit: size too large, truncated to 1048576 [ 371.787562][T14157] ip_tables: iptables: counters copy to user failed while replacing table [ 372.271102][T14170] netlink: 'syz.2.2595': attribute type 1 has an invalid length. [ 372.347551][T14170] bond11: option mode: invalid value (7) [ 372.367597][T14170] bond11 (unregistering): Released all slaves [ 372.573773][T14184] gretap3: entered allmulticast mode [ 372.586929][T14187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 372.710899][T14188] xt_hashlimit: size too large, truncated to 1048576 [ 372.977457][T14200] FAULT_INJECTION: forcing a failure. [ 372.977457][T14200] name failslab, interval 1, probability 0, space 0, times 0 [ 372.977491][T14200] CPU: 1 UID: 0 PID: 14200 Comm: syz.2.2603 Not tainted syzkaller #0 PREEMPT(full) [ 372.977514][T14200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 372.977533][T14200] Call Trace: [ 372.977541][T14200] [ 372.977549][T14200] dump_stack_lvl+0xe8/0x150 [ 372.977584][T14200] should_fail_ex+0x410/0x560 [ 372.977610][T14200] ? __alloc_skb+0x1db/0x7a0 [ 372.977631][T14200] should_failslab+0xa8/0x100 [ 372.977657][T14200] ? __alloc_skb+0x1db/0x7a0 [ 372.977676][T14200] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 372.977706][T14200] ? __alloc_skb+0x18d/0x7a0 [ 372.977727][T14200] ? __alloc_skb+0x1db/0x7a0 [ 372.977755][T14200] __alloc_skb+0x1db/0x7a0 [ 372.977780][T14200] netlink_sendmsg+0x5d4/0xb40 [ 372.977818][T14200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 372.977853][T14200] ? apparmor_socket_sendmsg+0x98/0x360 [ 372.977877][T14200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 372.977904][T14200] sock_sendmsg_nosec+0x13a/0x180 [ 372.977937][T14200] ____sys_sendmsg+0x54e/0x850 [ 372.977967][T14200] ? __pfx_____sys_sendmsg+0x10/0x10 [ 372.978000][T14200] ? import_iovec+0x73/0xa0 [ 372.978025][T14200] ___sys_sendmsg+0x2a5/0x360 [ 372.978048][T14200] ? __lock_acquire+0x747/0x2de0 [ 372.978072][T14200] ? __pfx____sys_sendmsg+0x10/0x10 [ 372.978128][T14200] ? __fget_files+0x2a/0x420 [ 372.978153][T14200] ? __fget_files+0x3a2/0x420 [ 372.978188][T14200] __x64_sys_sendmsg+0x1b1/0x290 [ 372.978215][T14200] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 372.978258][T14200] do_syscall_64+0x166/0x520 [ 372.978279][T14200] ? trace_irq_disable+0x3b/0x140 [ 372.978299][T14200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.978319][T14200] ? clear_bhb_loop+0x70/0xc0 [ 372.978343][T14200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.978362][T14200] RIP: 0033:0x7fc76eb9e159 [ 372.978380][T14200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 372.978397][T14200] RSP: 002b:00007fc76f984028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 372.978419][T14200] RAX: ffffffffffffffda RBX: 00007fc76ee25fa0 RCX: 00007fc76eb9e159 [ 372.978433][T14200] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 372.978446][T14200] RBP: 00007fc76f984090 R08: 0000000000000000 R09: 0000000000000000 [ 372.978458][T14200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 372.978469][T14200] R13: 00007fc76ee26038 R14: 00007fc76ee25fa0 R15: 00007ffe98350038 [ 372.978500][T14200] [ 373.267626][T14203] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2604'. [ 373.267646][T14203] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2604'. [ 373.268217][T14203] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2604'. [ 373.268232][T14203] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2604'. [ 373.543022][T14207] ip_tables: iptables: counters copy to user failed while replacing table [ 373.977608][T14211] FAULT_INJECTION: forcing a failure. [ 373.977608][T14211] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.977641][T14211] CPU: 0 UID: 0 PID: 14211 Comm: syz.2.2607 Not tainted syzkaller #0 PREEMPT(full) [ 373.977662][T14211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 373.977673][T14211] Call Trace: [ 373.977680][T14211] [ 373.977689][T14211] dump_stack_lvl+0xe8/0x150 [ 373.977719][T14211] should_fail_ex+0x410/0x560 [ 373.977745][T14211] _copy_to_user+0x31/0xb0 [ 373.977770][T14211] bpf_test_finish+0x4ea/0x690 [ 373.977805][T14211] ? __pfx_bpf_test_finish+0x10/0x10 [ 373.977845][T14211] bpf_prog_test_run_skb+0x11fe/0x2230 [ 373.977875][T14211] ? kstrtouint+0x6e/0xe0 [ 373.977929][T14211] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 373.977957][T14211] bpf_prog_test_run+0x2c5/0x340 [ 373.977985][T14211] __sys_bpf+0xa22/0xd90 [ 373.978011][T14211] ? vfs_write+0x960/0xba0 [ 373.978039][T14211] ? __pfx___sys_bpf+0x10/0x10 [ 373.978080][T14211] ? ksys_write+0x1fc/0x270 [ 373.978107][T14211] ? __pfx_ksys_write+0x10/0x10 [ 373.978136][T14211] __x64_sys_bpf+0xba/0xd0 [ 373.978157][T14211] do_syscall_64+0x166/0x520 [ 373.978176][T14211] ? trace_irq_disable+0x3b/0x140 [ 373.978194][T14211] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.978214][T14211] ? clear_bhb_loop+0x70/0xc0 [ 373.978238][T14211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.978256][T14211] RIP: 0033:0x7fc76eb9e159 [ 373.978273][T14211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.978289][T14211] RSP: 002b:00007fc76f984028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 373.978308][T14211] RAX: ffffffffffffffda RBX: 00007fc76ee25fa0 RCX: 00007fc76eb9e159 [ 373.978321][T14211] RDX: 0000000000000023 RSI: 0000200000000240 RDI: 000000000000000a [ 373.978333][T14211] RBP: 00007fc76f984090 R08: 0000000000000000 R09: 0000000000000000 [ 373.978346][T14211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.978358][T14211] R13: 00007fc76ee26038 R14: 00007fc76ee25fa0 R15: 00007ffe98350038 [ 373.978387][T14211] [ 374.247173][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.247465][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.247680][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.336450][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.336667][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.336876][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.351563][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.351763][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.351946][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.352133][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.352315][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.355961][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.356154][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.359856][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.360044][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.360308][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.360495][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.360677][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.368685][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.368874][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.373811][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.373999][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.374182][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.374363][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.374624][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.374851][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.375085][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.382614][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.382800][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.382983][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.391312][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.391594][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.397844][T14225] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 374.475212][T14232] netlink: 88 bytes leftover after parsing attributes in process `syz.4.2615'. [ 374.475232][T14232] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2615'. [ 374.522282][T14233] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2614'. [ 374.525898][T14232] FAULT_INJECTION: forcing a failure. [ 374.525898][T14232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 374.525927][T14232] CPU: 1 UID: 0 PID: 14232 Comm: syz.4.2615 Not tainted syzkaller #0 PREEMPT(full) [ 374.525948][T14232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 374.525958][T14232] Call Trace: [ 374.525965][T14232] [ 374.525973][T14232] dump_stack_lvl+0xe8/0x150 [ 374.526004][T14232] should_fail_ex+0x410/0x560 [ 374.526029][T14232] _copy_to_user+0x31/0xb0 [ 374.526055][T14232] bpf_verifier_vlog+0x496/0x900 [ 374.526110][T14232] diag_write+0x11c/0x1a0 [ 374.526141][T14232] ? __pfx_diag_write+0x10/0x10 [ 374.526171][T14232] ? kfree+0x1c5/0x650 [ 374.526196][T14232] ? bpf_diag_program_structure+0x28a/0x430 [ 374.526225][T14232] bpf_diag_program_structure+0x2f6/0x430 [ 374.526254][T14232] ? verbose+0x11d/0x1a0 [ 374.526274][T14232] ? __pfx_bpf_diag_program_structure+0x10/0x10 [ 374.526300][T14232] ? bpf_prepare_btf_info+0x639/0x1200 [ 374.526322][T14232] ? rcu_is_watching+0x16/0xb0 [ 374.526352][T14232] check_subprogs+0x66b/0x740 [ 374.526383][T14232] bpf_check+0x17ba/0x2e10 [ 374.526413][T14232] ? ktime_get_with_offset+0x93/0x2d0 [ 374.526436][T14232] ? __pfx_bpf_check+0x10/0x10 [ 374.526465][T14232] ? bpf_obj_name_cpy+0x194/0x1e0 [ 374.526494][T14232] bpf_prog_load+0x14d6/0x1c20 [ 374.526529][T14232] ? __pfx_bpf_prog_load+0x10/0x10 [ 374.526572][T14232] __sys_bpf+0xd0d/0xd90 [ 374.526600][T14232] ? __pfx___sys_bpf+0x10/0x10 [ 374.526630][T14232] ? __fget_files+0x2a/0x420 [ 374.526671][T14232] ? ksys_write+0x242/0x270 [ 374.526700][T14232] ? __pfx_ksys_write+0x10/0x10 [ 374.526732][T14232] __x64_sys_bpf+0xba/0xd0 [ 374.526753][T14232] do_syscall_64+0x166/0x520 [ 374.526773][T14232] ? trace_irq_disable+0x3b/0x140 [ 374.526791][T14232] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.526810][T14232] ? clear_bhb_loop+0x70/0xc0 [ 374.526833][T14232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.526851][T14232] RIP: 0033:0x7f236b99e159 [ 374.526869][T14232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 374.526886][T14232] RSP: 002b:00007f236c7f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 374.526906][T14232] RAX: ffffffffffffffda RBX: 00007f236bc25fa0 RCX: 00007f236b99e159 [ 374.526921][T14232] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 374.526933][T14232] RBP: 00007f236c7f5090 R08: 0000000000000000 R09: 0000000000000000 [ 374.526944][T14232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 374.526956][T14232] R13: 00007f236bc26038 R14: 00007f236bc25fa0 R15: 00007fff75593d58 [ 374.526985][T14232] [ 374.559723][T14232] tipc: Enabling of bearer rejected, failed to enable media [ 375.059070][T14244] tipc: Resetting bearer [ 375.151572][T14244] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 375.223311][T14245] xt_hashlimit: size too large, truncated to 1048576 [ 375.834456][T14258] netlink: 'syz.0.2621': attribute type 12 has an invalid length. [ 375.854675][T14258] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2621'. [ 375.893424][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 376.330164][T14264] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2624'. [ 376.330209][T14264] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2624'. [ 376.369209][T14264] gretap0: entered promiscuous mode [ 376.385558][T14264] gretap0: left promiscuous mode [ 376.507800][T14270] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2624'. [ 376.560232][ T12] IPVS: starting estimator thread 0... [ 376.664796][T14279] IPVS: using max 37 ests per chain, 88800 per kthread [ 376.977883][T14287] FAULT_INJECTION: forcing a failure. [ 376.977883][T14287] name failslab, interval 1, probability 0, space 0, times 0 [ 376.977915][T14287] CPU: 1 UID: 0 PID: 14287 Comm: syz.1.2629 Not tainted syzkaller #0 PREEMPT(full) [ 376.977938][T14287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 376.977950][T14287] Call Trace: [ 376.977957][T14287] [ 376.977965][T14287] dump_stack_lvl+0xe8/0x150 [ 376.977998][T14287] should_fail_ex+0x410/0x560 [ 376.978025][T14287] should_failslab+0xa8/0x100 [ 376.978052][T14287] __kmalloc_cache_noprof+0xa3/0x600 [ 376.978071][T14287] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 376.978102][T14287] ? __request_module+0x2d0/0x630 [ 376.978133][T14287] ? __request_module+0x2d0/0x630 [ 376.978163][T14287] __request_module+0x2d0/0x630 [ 376.978190][T14287] ? rtnl_link_ops_get+0x23/0x250 [ 376.978215][T14287] ? __pfx___request_module+0x10/0x10 [ 376.978253][T14287] ? rtnl_link_ops_get+0x23/0x250 [ 376.978275][T14287] ? rtnl_link_ops_get+0x23/0x250 [ 376.978301][T14287] ? rtnl_link_ops_get+0x215/0x250 [ 376.978328][T14287] rtnl_newlink+0x66c/0x1c30 [ 376.978354][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.978380][T14287] ? __pfx_rtnl_newlink+0x10/0x10 [ 376.978401][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.978424][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.978450][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.978484][T14287] ? lock_acquire+0x115/0x350 [ 376.978511][T14287] ? lock_acquire+0x115/0x350 [ 376.978539][T14287] ? is_bpf_text_address+0x26/0x2b0 [ 376.978568][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.978594][T14287] ? __kernel_text_address+0xd/0x30 [ 376.978615][T14287] ? unwind_get_return_address+0x4d/0x90 [ 376.978638][T14287] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 376.978658][T14287] ? arch_stack_walk+0xfb/0x150 [ 376.978708][T14287] ? __pfx_rtnl_newlink+0x10/0x10 [ 376.978729][T14287] rtnetlink_rcv_msg+0x802/0xc00 [ 376.978750][T14287] ? netlink_sendmsg+0x5d4/0xb40 [ 376.978781][T14287] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 376.978802][T14287] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 376.978826][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.978858][T14287] netlink_rcv_skb+0x226/0x4a0 [ 376.978886][T14287] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 376.978911][T14287] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 376.978950][T14287] ? netlink_deliver_tap+0x2e/0x1b0 [ 376.978977][T14287] ? netlink_deliver_tap+0x2e/0x1b0 [ 376.979009][T14287] netlink_unicast+0x7bd/0x940 [ 376.979044][T14287] netlink_sendmsg+0x813/0xb40 [ 376.979080][T14287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.979122][T14287] ? apparmor_socket_sendmsg+0x98/0x360 [ 376.979146][T14287] ? __pfx_netlink_sendmsg+0x10/0x10 [ 376.979173][T14287] sock_sendmsg_nosec+0x13a/0x180 [ 376.979206][T14287] ____sys_sendmsg+0x54e/0x850 [ 376.979236][T14287] ? __pfx_____sys_sendmsg+0x10/0x10 [ 376.979270][T14287] ? import_iovec+0x73/0xa0 [ 376.979297][T14287] ___sys_sendmsg+0x2a5/0x360 [ 376.979321][T14287] ? __lock_acquire+0x747/0x2de0 [ 376.979346][T14287] ? __pfx____sys_sendmsg+0x10/0x10 [ 376.979404][T14287] ? __fget_files+0x2a/0x420 [ 376.979430][T14287] ? __fget_files+0x3a2/0x420 [ 376.979466][T14287] __x64_sys_sendmsg+0x1b1/0x290 [ 376.979494][T14287] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 376.979539][T14287] do_syscall_64+0x166/0x520 [ 376.979559][T14287] ? trace_irq_disable+0x3b/0x140 [ 376.979579][T14287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.979600][T14287] ? clear_bhb_loop+0x70/0xc0 [ 376.979624][T14287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 376.979643][T14287] RIP: 0033:0x7fb30719e159 [ 376.979662][T14287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.979679][T14287] RSP: 002b:00007fb308040028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.979700][T14287] RAX: ffffffffffffffda RBX: 00007fb307425fa0 RCX: 00007fb30719e159 [ 376.979715][T14287] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 376.979727][T14287] RBP: 00007fb308040090 R08: 0000000000000000 R09: 0000000000000000 [ 376.979740][T14287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 376.979752][T14287] R13: 00007fb307426038 R14: 00007fb307425fa0 R15: 00007ffc53f99208 [ 376.979782][T14287] [ 376.982669][T14287] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2629'. [ 377.624069][T14289] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 377.624091][T14289] CPU: 1 UID: 0 PID: 14289 Comm: syz.4.2632 Not tainted syzkaller #0 PREEMPT(full) [ 377.624115][T14289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 377.624127][T14289] Call Trace: [ 377.624135][T14289] [ 377.624143][T14289] dump_stack_lvl+0xe8/0x150 [ 377.624181][T14289] sysfs_warn_dup+0x8e/0xa0 [ 377.624210][T14289] sysfs_do_create_link_sd+0xc0/0x110 [ 377.624243][T14289] device_add_class_symlinks+0x1cf/0x240 [ 377.624268][T14289] device_add+0x467/0xb80 [ 377.624289][T14289] wiphy_register+0x1fc8/0x2ff0 [ 377.624337][T14289] ? __pfx_wiphy_register+0x10/0x10 [ 377.624367][T14289] ? __pfx_netdev_run_todo+0x10/0x10 [ 377.624396][T14289] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 377.624431][T14289] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 377.624470][T14289] ieee80211_register_hw+0x3d3d/0x4a50 [ 377.624505][T14289] ? ieee80211_register_hw+0x19d1/0x4a50 [ 377.624563][T14289] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 377.624590][T14289] ? __asan_memset+0x22/0x50 [ 377.624621][T14289] ? __hrtimer_setup+0x1b7/0x260 [ 377.624648][T14289] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 377.624676][T14289] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 377.624733][T14289] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 377.624754][T14289] ? kstrndup+0xbd/0x160 [ 377.624778][T14289] ? kstrndup+0xbd/0x160 [ 377.624802][T14289] hwsim_new_radio_nl+0xd8b/0xf90 [ 377.624844][T14289] genl_family_rcv_msg_doit+0x233/0x340 [ 377.624877][T14289] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 377.624916][T14289] ? bpf_lsm_capable+0x9/0x20 [ 377.624933][T14289] ? security_capable+0x7e/0x2c0 [ 377.624965][T14289] genl_rcv_msg+0x614/0x7a0 [ 377.624994][T14289] ? __pfx_genl_rcv_msg+0x10/0x10 [ 377.625016][T14289] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 377.625053][T14289] netlink_rcv_skb+0x226/0x4a0 [ 377.625082][T14289] ? __pfx_genl_rcv_msg+0x10/0x10 [ 377.625106][T14289] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 377.625149][T14289] ? down_read+0x2be/0x330 [ 377.625178][T14289] genl_rcv+0x28/0x40 [ 377.625198][T14289] netlink_unicast+0x7bd/0x940 [ 377.625235][T14289] netlink_sendmsg+0x813/0xb40 [ 377.625273][T14289] ? __pfx_netlink_sendmsg+0x10/0x10 [ 377.625311][T14289] ? apparmor_socket_sendmsg+0x98/0x360 [ 377.625335][T14289] ? __pfx_netlink_sendmsg+0x10/0x10 [ 377.625363][T14289] sock_sendmsg_nosec+0x13a/0x180 [ 377.625398][T14289] ____sys_sendmsg+0x54e/0x850 [ 377.625428][T14289] ? __pfx_____sys_sendmsg+0x10/0x10 [ 377.625464][T14289] ? import_iovec+0x73/0xa0 [ 377.625490][T14289] ___sys_sendmsg+0x2a5/0x360 [ 377.625521][T14289] ? __pfx____sys_sendmsg+0x10/0x10 [ 377.625546][T14289] ? futex_wait+0x2a2/0x390 [ 377.625620][T14289] ? __pfx_do_futex+0x10/0x10 [ 377.625654][T14289] __x64_sys_sendmsg+0x1b1/0x290 [ 377.625682][T14289] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 377.625729][T14289] do_syscall_64+0x166/0x520 [ 377.625750][T14289] ? trace_irq_disable+0x3b/0x140 [ 377.625769][T14289] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.625804][T14289] ? clear_bhb_loop+0x70/0xc0 [ 377.625830][T14289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.625849][T14289] RIP: 0033:0x7f236b99e159 [ 377.625869][T14289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.625887][T14289] RSP: 002b:00007f236c7f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 377.625909][T14289] RAX: ffffffffffffffda RBX: 00007f236bc25fa0 RCX: 00007f236b99e159 [ 377.625924][T14289] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 377.625937][T14289] RBP: 00007f236ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 377.625950][T14289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 377.625962][T14289] R13: 00007f236bc26038 R14: 00007f236bc25fa0 R15: 00007fff75593d58 [ 377.625993][T14289] [ 378.398598][T14311] netlink: 'syz.2.2638': attribute type 12 has an invalid length. [ 378.415990][T14311] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2638'. [ 378.456267][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.499952][T14314] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 378.500395][T14314] tipc: Resetting bearer [ 378.874498][T14326] 8021q: adding VLAN 0 to HW filter on device bond0 [ 378.879486][T14324] syzkaller0: entered promiscuous mode [ 378.879507][T14324] syzkaller0: entered allmulticast mode [ 379.047951][T14324] Bluetooth: hci0: invalid length 0, exp 2 for type 10 [ 380.385602][T14366] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 380.385621][T14366] CPU: 1 UID: 0 PID: 14366 Comm: syz.2.2652 Not tainted syzkaller #0 PREEMPT(full) [ 380.385645][T14366] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 380.385658][T14366] Call Trace: [ 380.385666][T14366] [ 380.385675][T14366] dump_stack_lvl+0xe8/0x150 [ 380.385711][T14366] sysfs_warn_dup+0x8e/0xa0 [ 380.385743][T14366] sysfs_do_create_link_sd+0xc0/0x110 [ 380.385777][T14366] device_add_class_symlinks+0x1cf/0x240 [ 380.385812][T14366] device_add+0x467/0xb80 [ 380.385835][T14366] wiphy_register+0x1fc8/0x2ff0 [ 380.385883][T14366] ? __pfx_wiphy_register+0x10/0x10 [ 380.385914][T14366] ? __pfx_netdev_run_todo+0x10/0x10 [ 380.385947][T14366] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 380.385981][T14366] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 380.386020][T14366] ieee80211_register_hw+0x3d3d/0x4a50 [ 380.386056][T14366] ? ieee80211_register_hw+0x19d1/0x4a50 [ 380.386105][T14366] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 380.386131][T14366] ? __asan_memset+0x22/0x50 [ 380.386163][T14366] ? __hrtimer_setup+0x1b7/0x260 [ 380.386189][T14366] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 380.386218][T14366] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 380.386273][T14366] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 380.386296][T14366] ? kstrndup+0xbd/0x160 [ 380.386322][T14366] ? kstrndup+0xbd/0x160 [ 380.386346][T14366] hwsim_new_radio_nl+0xd8b/0xf90 [ 380.386386][T14366] genl_family_rcv_msg_doit+0x233/0x340 [ 380.386418][T14366] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 380.386456][T14366] ? bpf_lsm_capable+0x9/0x20 [ 380.386473][T14366] ? security_capable+0x7e/0x2c0 [ 380.386504][T14366] genl_rcv_msg+0x614/0x7a0 [ 380.386533][T14366] ? __pfx_genl_rcv_msg+0x10/0x10 [ 380.386554][T14366] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 380.386593][T14366] netlink_rcv_skb+0x226/0x4a0 [ 380.386624][T14366] ? __pfx_genl_rcv_msg+0x10/0x10 [ 380.386649][T14366] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 380.386696][T14366] ? down_read+0x2be/0x330 [ 380.386725][T14366] genl_rcv+0x28/0x40 [ 380.386745][T14366] netlink_unicast+0x7bd/0x940 [ 380.386789][T14366] netlink_sendmsg+0x813/0xb40 [ 380.386832][T14366] ? __pfx_netlink_sendmsg+0x10/0x10 [ 380.386872][T14366] ? apparmor_socket_sendmsg+0x98/0x360 [ 380.386897][T14366] ? __pfx_netlink_sendmsg+0x10/0x10 [ 380.386926][T14366] sock_sendmsg_nosec+0x13a/0x180 [ 380.386962][T14366] ____sys_sendmsg+0x54e/0x850 [ 380.386994][T14366] ? __pfx_____sys_sendmsg+0x10/0x10 [ 380.387031][T14366] ? import_iovec+0x73/0xa0 [ 380.387060][T14366] ___sys_sendmsg+0x2a5/0x360 [ 380.387085][T14366] ? __lock_acquire+0x747/0x2de0 [ 380.387111][T14366] ? __pfx____sys_sendmsg+0x10/0x10 [ 380.387140][T14366] ? futex_wait+0x2a2/0x390 [ 380.387203][T14366] ? __fget_files+0x2a/0x420 [ 380.387230][T14366] ? __fget_files+0x3a2/0x420 [ 380.387268][T14366] __x64_sys_sendmsg+0x1b1/0x290 [ 380.387297][T14366] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 380.387347][T14366] do_syscall_64+0x166/0x520 [ 380.387368][T14366] ? trace_irq_disable+0x3b/0x140 [ 380.387387][T14366] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.387408][T14366] ? clear_bhb_loop+0x70/0xc0 [ 380.387433][T14366] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.387453][T14366] RIP: 0033:0x7fc76eb9e159 [ 380.387472][T14366] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 380.387489][T14366] RSP: 002b:00007fc76c58f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 380.387511][T14366] RAX: ffffffffffffffda RBX: 00007fc76ee26360 RCX: 00007fc76eb9e159 [ 380.387527][T14366] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 380.387540][T14366] RBP: 00007fc76ec3506b R08: 0000000000000000 R09: 0000000000000000 [ 380.387552][T14366] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 380.387564][T14366] R13: 00007fc76ee263f8 R14: 00007fc76ee26360 R15: 00007ffe98350038 [ 380.387599][T14366] [ 381.019845][T14375] netlink: 'syz.3.2659': attribute type 12 has an invalid length. [ 381.032694][T14375] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2659'. [ 381.322618][T14382] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 381.322637][T14382] CPU: 1 UID: 0 PID: 14382 Comm: syz.0.2656 Not tainted syzkaller #0 PREEMPT(full) [ 381.322662][T14382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 381.322675][T14382] Call Trace: [ 381.322683][T14382] [ 381.322692][T14382] dump_stack_lvl+0xe8/0x150 [ 381.322729][T14382] sysfs_warn_dup+0x8e/0xa0 [ 381.322761][T14382] sysfs_do_create_link_sd+0xc0/0x110 [ 381.322795][T14382] device_add_class_symlinks+0x1cf/0x240 [ 381.322823][T14382] device_add+0x467/0xb80 [ 381.322848][T14382] wiphy_register+0x1fc8/0x2ff0 [ 381.322897][T14382] ? __pfx_wiphy_register+0x10/0x10 [ 381.322928][T14382] ? __pfx_netdev_run_todo+0x10/0x10 [ 381.322958][T14382] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 381.322992][T14382] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 381.323032][T14382] ieee80211_register_hw+0x3d3d/0x4a50 [ 381.323070][T14382] ? ieee80211_register_hw+0x19d1/0x4a50 [ 381.323117][T14382] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 381.323142][T14382] ? __asan_memset+0x22/0x50 [ 381.323173][T14382] ? __hrtimer_setup+0x1b7/0x260 [ 381.323207][T14382] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 381.323236][T14382] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 381.323293][T14382] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 381.323316][T14382] ? kstrndup+0xbd/0x160 [ 381.323343][T14382] ? kstrndup+0xbd/0x160 [ 381.323367][T14382] hwsim_new_radio_nl+0xd8b/0xf90 [ 381.323408][T14382] genl_family_rcv_msg_doit+0x233/0x340 [ 381.323441][T14382] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 381.323480][T14382] ? bpf_lsm_capable+0x9/0x20 [ 381.323498][T14382] ? security_capable+0x7e/0x2c0 [ 381.323530][T14382] genl_rcv_msg+0x614/0x7a0 [ 381.323561][T14382] ? __pfx_genl_rcv_msg+0x10/0x10 [ 381.323583][T14382] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 381.323623][T14382] netlink_rcv_skb+0x226/0x4a0 [ 381.323655][T14382] ? __pfx_genl_rcv_msg+0x10/0x10 [ 381.323677][T14382] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 381.323720][T14382] ? down_read+0x2be/0x330 [ 381.323749][T14382] genl_rcv+0x28/0x40 [ 381.323770][T14382] netlink_unicast+0x7bd/0x940 [ 381.323806][T14382] netlink_sendmsg+0x813/0xb40 [ 381.323845][T14382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 381.323885][T14382] ? apparmor_socket_sendmsg+0x98/0x360 [ 381.323911][T14382] ? __pfx_netlink_sendmsg+0x10/0x10 [ 381.323941][T14382] sock_sendmsg_nosec+0x13a/0x180 [ 381.323977][T14382] ____sys_sendmsg+0x54e/0x850 [ 381.324011][T14382] ? __pfx_____sys_sendmsg+0x10/0x10 [ 381.324048][T14382] ? import_iovec+0x73/0xa0 [ 381.324079][T14382] ___sys_sendmsg+0x2a5/0x360 [ 381.324105][T14382] ? __lock_acquire+0x747/0x2de0 [ 381.324133][T14382] ? __pfx____sys_sendmsg+0x10/0x10 [ 381.324163][T14382] ? futex_wait+0x2a2/0x390 [ 381.324237][T14382] ? __fget_files+0x2a/0x420 [ 381.324265][T14382] ? __fget_files+0x3a2/0x420 [ 381.324305][T14382] __x64_sys_sendmsg+0x1b1/0x290 [ 381.324336][T14382] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 381.324388][T14382] do_syscall_64+0x166/0x520 [ 381.324410][T14382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.324433][T14382] ? clear_bhb_loop+0x70/0xc0 [ 381.324458][T14382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 381.324480][T14382] RIP: 0033:0x7f8d8eb9e159 [ 381.324500][T14382] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 381.324518][T14382] RSP: 002b:00007f8d8fab9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 381.324542][T14382] RAX: ffffffffffffffda RBX: 00007f8d8ee26180 RCX: 00007f8d8eb9e159 [ 381.324558][T14382] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 381.324573][T14382] RBP: 00007f8d8ec3506b R08: 0000000000000000 R09: 0000000000000000 [ 381.324586][T14382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 381.324599][T14382] R13: 00007f8d8ee26218 R14: 00007f8d8ee26180 R15: 00007ffce84443a8 [ 381.324636][T14382] [ 382.355503][T14392] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 382.492741][T14399] tipc: Enabling of bearer rejected, already enabled [ 382.744146][T14413] netlink: 'syz.4.2667': attribute type 3 has an invalid length. [ 382.744168][T14413] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2667'. [ 383.307184][T14421] xt_hashlimit: size too large, truncated to 1048576 [ 383.400808][T14426] netlink: 'syz.0.2675': attribute type 12 has an invalid length. [ 383.420184][T14426] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2675'. [ 383.851519][T14437] tipc: Enabling of bearer rejected, already enabled [ 383.992206][T14444] xt_hashlimit: size too large, truncated to 1048576 [ 384.401225][T14455] netlink: 248 bytes leftover after parsing attributes in process `syz.0.2683'. [ 384.947644][T14468] FAULT_INJECTION: forcing a failure. [ 384.947644][T14468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 384.947677][T14468] CPU: 0 UID: 0 PID: 14468 Comm: syz.3.2687 Not tainted syzkaller #0 PREEMPT(full) [ 384.947700][T14468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 384.947712][T14468] Call Trace: [ 384.947720][T14468] [ 384.947729][T14468] dump_stack_lvl+0xe8/0x150 [ 384.947762][T14468] should_fail_ex+0x410/0x560 [ 384.947790][T14468] _copy_from_iter+0x1d3/0x1660 [ 384.947812][T14468] ? __alloc_skb+0x27a/0x7a0 [ 384.947836][T14468] ? __alloc_skb+0x27a/0x7a0 [ 384.947860][T14468] ? __alloc_skb+0x27a/0x7a0 [ 384.947882][T14468] ? __pfx__copy_from_iter+0x10/0x10 [ 384.947910][T14468] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 384.947939][T14468] ? __alloc_skb+0x27a/0x7a0 [ 384.947958][T14468] ? __alloc_skb+0x27a/0x7a0 [ 384.947983][T14468] ? netlink_sendmsg+0x650/0xb40 [ 384.948010][T14468] ? skb_put+0x112/0x210 [ 384.948033][T14468] netlink_sendmsg+0x6c0/0xb40 [ 384.948073][T14468] ? __pfx_netlink_sendmsg+0x10/0x10 [ 384.948107][T14468] ? apparmor_socket_sendmsg+0x98/0x360 [ 384.948131][T14468] ? __pfx_netlink_sendmsg+0x10/0x10 [ 384.948157][T14468] sock_sendmsg_nosec+0x13a/0x180 [ 384.948189][T14468] ____sys_sendmsg+0x54e/0x850 [ 384.948219][T14468] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.948253][T14468] ? import_iovec+0x73/0xa0 [ 384.948280][T14468] ___sys_sendmsg+0x2a5/0x360 [ 384.948304][T14468] ? __lock_acquire+0x747/0x2de0 [ 384.948329][T14468] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.948387][T14468] ? __fget_files+0x2a/0x420 [ 384.948414][T14468] ? __fget_files+0x3a2/0x420 [ 384.948448][T14468] __x64_sys_sendmsg+0x1b1/0x290 [ 384.948477][T14468] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 384.948520][T14468] do_syscall_64+0x166/0x520 [ 384.948541][T14468] ? trace_irq_disable+0x3b/0x140 [ 384.948561][T14468] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.948582][T14468] ? clear_bhb_loop+0x70/0xc0 [ 384.948607][T14468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.948627][T14468] RIP: 0033:0x7fdcf5d9e159 [ 384.948645][T14468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.948661][T14468] RSP: 002b:00007fdcf6c05028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 384.948682][T14468] RAX: ffffffffffffffda RBX: 00007fdcf6025fa0 RCX: 00007fdcf5d9e159 [ 384.948696][T14468] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 384.948708][T14468] RBP: 00007fdcf6c05090 R08: 0000000000000000 R09: 0000000000000000 [ 384.948721][T14468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.948732][T14468] R13: 00007fdcf6026038 R14: 00007fdcf6025fa0 R15: 00007ffc6b4f9f98 [ 384.948762][T14468] [ 385.474201][T14477] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2689'. [ 385.526266][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 385.542832][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 385.542876][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 385.542911][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 388.291971][T14471] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 388.461283][T14511] xt_hashlimit: size too large, truncated to 1048576 [ 389.332126][T14524] ip_tables: iptables: counters copy to user failed while replacing table [ 390.189330][T14549] netlink: 'syz.4.2711': attribute type 3 has an invalid length. [ 390.345453][T14553] pim6reg: entered allmulticast mode [ 390.361112][T14553] pim6reg: left allmulticast mode [ 390.439469][T14557] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2712'. [ 390.876680][T14555] netlink: 'syz.4.2713': attribute type 3 has an invalid length. [ 391.119685][T14568] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 391.119706][T14568] CPU: 1 UID: 0 PID: 14568 Comm: syz.0.2715 Not tainted syzkaller #0 PREEMPT(full) [ 391.119730][T14568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 391.119742][T14568] Call Trace: [ 391.119751][T14568] [ 391.119760][T14568] dump_stack_lvl+0xe8/0x150 [ 391.119795][T14568] sysfs_warn_dup+0x8e/0xa0 [ 391.119827][T14568] sysfs_do_create_link_sd+0xc0/0x110 [ 391.119862][T14568] device_add_class_symlinks+0x1cf/0x240 [ 391.119888][T14568] device_add+0x467/0xb80 [ 391.119913][T14568] wiphy_register+0x1fc8/0x2ff0 [ 391.119961][T14568] ? __pfx_wiphy_register+0x10/0x10 [ 391.119993][T14568] ? __pfx_netdev_run_todo+0x10/0x10 [ 391.120022][T14568] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 391.120057][T14568] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 391.120095][T14568] ieee80211_register_hw+0x3d3d/0x4a50 [ 391.120136][T14568] ? ieee80211_register_hw+0x19d1/0x4a50 [ 391.120187][T14568] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 391.120212][T14568] ? __asan_memset+0x22/0x50 [ 391.120253][T14568] ? __hrtimer_setup+0x1b7/0x260 [ 391.120281][T14568] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 391.120311][T14568] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 391.120367][T14568] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 391.120390][T14568] ? kstrndup+0xbd/0x160 [ 391.120416][T14568] ? kstrndup+0xbd/0x160 [ 391.120439][T14568] hwsim_new_radio_nl+0xd8b/0xf90 [ 391.120478][T14568] genl_family_rcv_msg_doit+0x233/0x340 [ 391.120511][T14568] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 391.120562][T14568] ? bpf_lsm_capable+0x9/0x20 [ 391.120581][T14568] ? security_capable+0x7e/0x2c0 [ 391.120612][T14568] genl_rcv_msg+0x614/0x7a0 [ 391.120643][T14568] ? __pfx_genl_rcv_msg+0x10/0x10 [ 391.120666][T14568] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 391.120705][T14568] netlink_rcv_skb+0x226/0x4a0 [ 391.120736][T14568] ? __pfx_genl_rcv_msg+0x10/0x10 [ 391.120759][T14568] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 391.120805][T14568] ? down_read+0x2be/0x330 [ 391.120834][T14568] genl_rcv+0x28/0x40 [ 391.120854][T14568] netlink_unicast+0x7bd/0x940 [ 391.120890][T14568] netlink_sendmsg+0x813/0xb40 [ 391.120928][T14568] ? __pfx_netlink_sendmsg+0x10/0x10 [ 391.120965][T14568] ? apparmor_socket_sendmsg+0x98/0x360 [ 391.120989][T14568] ? __pfx_netlink_sendmsg+0x10/0x10 [ 391.121017][T14568] sock_sendmsg_nosec+0x13a/0x180 [ 391.121051][T14568] ____sys_sendmsg+0x54e/0x850 [ 391.121082][T14568] ? __pfx_____sys_sendmsg+0x10/0x10 [ 391.121120][T14568] ? import_iovec+0x73/0xa0 [ 391.121149][T14568] ___sys_sendmsg+0x2a5/0x360 [ 391.121174][T14568] ? __lock_acquire+0x747/0x2de0 [ 391.121201][T14568] ? __pfx____sys_sendmsg+0x10/0x10 [ 391.121231][T14568] ? futex_wait+0x2a2/0x390 [ 391.121297][T14568] ? __fget_files+0x2a/0x420 [ 391.121321][T14568] ? __fget_files+0x3a2/0x420 [ 391.121356][T14568] __x64_sys_sendmsg+0x1b1/0x290 [ 391.121383][T14568] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 391.121429][T14568] do_syscall_64+0x166/0x520 [ 391.121448][T14568] ? trace_irq_disable+0x3b/0x140 [ 391.121468][T14568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.121487][T14568] ? clear_bhb_loop+0x70/0xc0 [ 391.121510][T14568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.121528][T14568] RIP: 0033:0x7f8d8eb9e159 [ 391.121548][T14568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.121565][T14568] RSP: 002b:00007f8d8fab9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 391.121587][T14568] RAX: ffffffffffffffda RBX: 00007f8d8ee26180 RCX: 00007f8d8eb9e159 [ 391.121604][T14568] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 391.121616][T14568] RBP: 00007f8d8ec3506b R08: 0000000000000000 R09: 0000000000000000 [ 391.121629][T14568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 391.121642][T14568] R13: 00007f8d8ee26218 R14: 00007f8d8ee26180 R15: 00007ffce84443a8 [ 391.121675][T14568] [ 391.560398][T14576] netlink: 'syz.3.2717': attribute type 62 has an invalid length. [ 392.088827][T14586] ip_tables: iptables: counters copy to user failed while replacing table [ 392.596924][T14596] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 392.596947][T14596] CPU: 0 UID: 0 PID: 14596 Comm: syz.0.2721 Not tainted syzkaller #0 PREEMPT(full) [ 392.596973][T14596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 392.596986][T14596] Call Trace: [ 392.596995][T14596] [ 392.597005][T14596] dump_stack_lvl+0xe8/0x150 [ 392.597043][T14596] sysfs_warn_dup+0x8e/0xa0 [ 392.597076][T14596] sysfs_do_create_link_sd+0xc0/0x110 [ 392.597115][T14596] device_add_class_symlinks+0x1cf/0x240 [ 392.597149][T14596] device_add+0x467/0xb80 [ 392.597173][T14596] wiphy_register+0x1fc8/0x2ff0 [ 392.597223][T14596] ? __pfx_wiphy_register+0x10/0x10 [ 392.597254][T14596] ? __pfx_netdev_run_todo+0x10/0x10 [ 392.597283][T14596] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 392.597318][T14596] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 392.597355][T14596] ieee80211_register_hw+0x3d3d/0x4a50 [ 392.597391][T14596] ? ieee80211_register_hw+0x19d1/0x4a50 [ 392.597442][T14596] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 392.597467][T14596] ? __asan_memset+0x22/0x50 [ 392.597498][T14596] ? __hrtimer_setup+0x1b7/0x260 [ 392.597525][T14596] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 392.597554][T14596] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 392.597610][T14596] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 392.597633][T14596] ? kstrndup+0xbd/0x160 [ 392.597660][T14596] ? kstrndup+0xbd/0x160 [ 392.597683][T14596] hwsim_new_radio_nl+0xd8b/0xf90 [ 392.597723][T14596] genl_family_rcv_msg_doit+0x233/0x340 [ 392.597756][T14596] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 392.597794][T14596] ? bpf_lsm_capable+0x9/0x20 [ 392.597812][T14596] ? security_capable+0x7e/0x2c0 [ 392.597842][T14596] genl_rcv_msg+0x614/0x7a0 [ 392.597873][T14596] ? __pfx_genl_rcv_msg+0x10/0x10 [ 392.597897][T14596] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 392.597935][T14596] netlink_rcv_skb+0x226/0x4a0 [ 392.597964][T14596] ? __pfx_genl_rcv_msg+0x10/0x10 [ 392.597987][T14596] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 392.598030][T14596] ? down_read+0x2be/0x330 [ 392.598058][T14596] genl_rcv+0x28/0x40 [ 392.598078][T14596] netlink_unicast+0x7bd/0x940 [ 392.598116][T14596] netlink_sendmsg+0x813/0xb40 [ 392.598163][T14596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 392.598200][T14596] ? apparmor_socket_sendmsg+0x98/0x360 [ 392.598224][T14596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 392.598252][T14596] sock_sendmsg_nosec+0x13a/0x180 [ 392.598285][T14596] ____sys_sendmsg+0x54e/0x850 [ 392.598315][T14596] ? __pfx_____sys_sendmsg+0x10/0x10 [ 392.598350][T14596] ? import_iovec+0x73/0xa0 [ 392.598380][T14596] ___sys_sendmsg+0x2a5/0x360 [ 392.598404][T14596] ? __lock_acquire+0x747/0x2de0 [ 392.598431][T14596] ? __pfx____sys_sendmsg+0x10/0x10 [ 392.598462][T14596] ? futex_wait+0x2a2/0x390 [ 392.598526][T14596] ? __fget_files+0x2a/0x420 [ 392.598554][T14596] ? __fget_files+0x3a2/0x420 [ 392.598594][T14596] __x64_sys_sendmsg+0x1b1/0x290 [ 392.598624][T14596] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 392.598674][T14596] do_syscall_64+0x166/0x520 [ 392.598697][T14596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.598718][T14596] ? clear_bhb_loop+0x70/0xc0 [ 392.598745][T14596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.598765][T14596] RIP: 0033:0x7f8d8eb9e159 [ 392.598785][T14596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.598803][T14596] RSP: 002b:00007f8d8fab9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 392.598825][T14596] RAX: ffffffffffffffda RBX: 00007f8d8ee26180 RCX: 00007f8d8eb9e159 [ 392.598841][T14596] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 392.598854][T14596] RBP: 00007f8d8ec3506b R08: 0000000000000000 R09: 0000000000000000 [ 392.598868][T14596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 392.598881][T14596] R13: 00007f8d8ee26218 R14: 00007f8d8ee26180 R15: 00007ffce84443a8 [ 392.598916][T14596] [ 393.089851][T14603] FAULT_INJECTION: forcing a failure. [ 393.089851][T14603] name failslab, interval 1, probability 0, space 0, times 0 [ 393.089892][T14603] CPU: 1 UID: 0 PID: 14603 Comm: syz.4.2728 Not tainted syzkaller #0 PREEMPT(full) [ 393.089913][T14603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 393.089924][T14603] Call Trace: [ 393.089932][T14603] [ 393.089941][T14603] dump_stack_lvl+0xe8/0x150 [ 393.089969][T14603] should_fail_ex+0x410/0x560 [ 393.089996][T14603] should_failslab+0xa8/0x100 [ 393.090022][T14603] __kvmalloc_node_noprof+0x176/0x820 [ 393.090044][T14603] ? kasan_save_track+0x3e/0x80 [ 393.090065][T14603] ? __kvmalloc_node_noprof+0x50f/0x820 [ 393.090086][T14603] ? bpf_stack_liveness_init+0x29/0x90 [ 393.090108][T14603] ? bpf_check+0x24f6/0x2e10 [ 393.090129][T14603] ? bpf_compute_const_regs+0x18f/0x3450 [ 393.090151][T14603] ? bpf_compute_const_regs+0x18f/0x3450 [ 393.090181][T14603] bpf_compute_const_regs+0x18f/0x3450 [ 393.090227][T14603] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 393.090251][T14603] ? check_attach_btf_id+0x325/0x1a30 [ 393.090280][T14603] ? rcu_is_watching+0x16/0xb0 [ 393.090304][T14603] ? bpf_stack_liveness_init+0x29/0x90 [ 393.090323][T14603] ? trace_kmalloc+0x2a/0xf0 [ 393.090352][T14603] ? __pfx_check_attach_btf_id+0x10/0x10 [ 393.090375][T14603] ? bpf_stack_liveness_init+0x29/0x90 [ 393.090396][T14603] ? __kvmalloc_node_noprof+0x52f/0x820 [ 393.090428][T14603] ? __asan_memset+0x22/0x50 [ 393.090461][T14603] bpf_check+0x255d/0x2e10 [ 393.090492][T14603] ? ktime_get_with_offset+0x93/0x2d0 [ 393.090518][T14603] ? __pfx_bpf_check+0x10/0x10 [ 393.090543][T14603] ? bpf_obj_name_cpy+0x194/0x1e0 [ 393.090575][T14603] bpf_prog_load+0x14d6/0x1c20 [ 393.090618][T14603] ? __pfx_bpf_prog_load+0x10/0x10 [ 393.090662][T14603] __sys_bpf+0xd0d/0xd90 [ 393.090691][T14603] ? __pfx___sys_bpf+0x10/0x10 [ 393.090723][T14603] ? __fget_files+0x2a/0x420 [ 393.090767][T14603] ? ksys_write+0x242/0x270 [ 393.090799][T14603] ? __pfx_ksys_write+0x10/0x10 [ 393.090833][T14603] __x64_sys_bpf+0xba/0xd0 [ 393.090856][T14603] do_syscall_64+0x166/0x520 [ 393.090877][T14603] ? trace_irq_disable+0x3b/0x140 [ 393.090897][T14603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.090919][T14603] ? clear_bhb_loop+0x70/0xc0 [ 393.090943][T14603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.090964][T14603] RIP: 0033:0x7f236b99e159 [ 393.090983][T14603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.091000][T14603] RSP: 002b:00007f236c7f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 393.091022][T14603] RAX: ffffffffffffffda RBX: 00007f236bc25fa0 RCX: 00007f236b99e159 [ 393.091037][T14603] RDX: 0000000000000094 RSI: 00002000000006c0 RDI: 0000000000000005 [ 393.091051][T14603] RBP: 00007f236c7f5090 R08: 0000000000000000 R09: 0000000000000000 [ 393.091064][T14603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 393.091077][T14603] R13: 00007f236bc26038 R14: 00007f236bc25fa0 R15: 00007fff75593d58 [ 393.091108][T14603] [ 394.125332][T14634] ip_tables: iptables: counters copy to user failed while replacing table [ 394.801117][T14658] syzkaller0: entered promiscuous mode [ 394.801140][T14658] syzkaller0: entered allmulticast mode [ 394.820095][T14658] tipc: Enabled bearer , priority 0 [ 394.830790][T14657] tipc: Resetting bearer [ 394.901858][T14660] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2742'. [ 394.916123][T14657] tipc: Disabling bearer [ 395.260406][T14667] netlink: 'syz.1.2744': attribute type 11 has an invalid length. [ 395.260427][T14667] netlink: 4320 bytes leftover after parsing attributes in process `syz.1.2744'. [ 395.699292][T14682] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 395.707502][T14682] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 395.729051][T14682] bond0 (unregistering): Released all slaves [ 395.768200][T14680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2750'. [ 395.905024][T14685] syzkaller0: entered promiscuous mode [ 395.905047][T14685] syzkaller0: entered allmulticast mode [ 396.057449][T14694] FAULT_INJECTION: forcing a failure. [ 396.057449][T14694] name failslab, interval 1, probability 0, space 0, times 0 [ 396.057483][T14694] CPU: 0 UID: 0 PID: 14694 Comm: syz.1.2756 Not tainted syzkaller #0 PREEMPT(full) [ 396.057505][T14694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 396.057518][T14694] Call Trace: [ 396.057526][T14694] [ 396.057535][T14694] dump_stack_lvl+0xe8/0x150 [ 396.057568][T14694] should_fail_ex+0x410/0x560 [ 396.057596][T14694] should_failslab+0xa8/0x100 [ 396.057622][T14694] __kmalloc_node_noprof+0x100/0x720 [ 396.057642][T14694] ? __get_vm_area_node+0x200/0x2f0 [ 396.057668][T14694] ? __get_vm_area_node+0x283/0x2f0 [ 396.057693][T14694] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.057721][T14694] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.057756][T14694] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.057785][T14694] ? __lock_acquire+0x747/0x2de0 [ 396.057830][T14694] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 396.057868][T14694] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 396.057891][T14694] __vmalloc_noprof+0xd2/0x120 [ 396.057918][T14694] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 396.057945][T14694] bpf_prog_alloc_no_stats+0x47/0x560 [ 396.057966][T14694] ? bpf_prog_alloc+0x2a/0x1a0 [ 396.057991][T14694] bpf_prog_alloc+0x3c/0x1a0 [ 396.058015][T14694] bpf_prog_load+0x7f8/0x1c20 [ 396.058048][T14694] ? __pfx_bpf_prog_load+0x10/0x10 [ 396.058095][T14694] __sys_bpf+0xd0d/0xd90 [ 396.058124][T14694] ? __pfx___sys_bpf+0x10/0x10 [ 396.058157][T14694] ? __fget_files+0x2a/0x420 [ 396.058201][T14694] ? ksys_write+0x242/0x270 [ 396.058232][T14694] ? __pfx_ksys_write+0x10/0x10 [ 396.058273][T14694] __x64_sys_bpf+0xba/0xd0 [ 396.058297][T14694] do_syscall_64+0x166/0x520 [ 396.058318][T14694] ? trace_irq_disable+0x3b/0x140 [ 396.058341][T14694] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.058362][T14694] ? clear_bhb_loop+0x70/0xc0 [ 396.058387][T14694] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.058407][T14694] RIP: 0033:0x7fb30719e159 [ 396.058426][T14694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.058445][T14694] RSP: 002b:00007fb308040028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 396.058467][T14694] RAX: ffffffffffffffda RBX: 00007fb307425fa0 RCX: 00007fb30719e159 [ 396.058482][T14694] RDX: 0000000000000094 RSI: 00002000000007c0 RDI: 0000000000000005 [ 396.058495][T14694] RBP: 00007fb308040090 R08: 0000000000000000 R09: 0000000000000000 [ 396.058508][T14694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.058520][T14694] R13: 00007fb307426038 R14: 00007fb307425fa0 R15: 00007ffc53f99208 [ 396.058552][T14694] [ 396.062356][T14694] syz.1.2756: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 396.062437][T14694] CPU: 0 UID: 0 PID: 14694 Comm: syz.1.2756 Not tainted syzkaller #0 PREEMPT(full) [ 396.062460][T14694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 396.062471][T14694] Call Trace: [ 396.062479][T14694] [ 396.062488][T14694] dump_stack_lvl+0xe8/0x150 [ 396.062519][T14694] warn_alloc+0x24d/0x270 [ 396.062544][T14694] ? __pfx_warn_alloc+0x10/0x10 [ 396.062569][T14694] ? __kmalloc_node_noprof+0x4d7/0x720 [ 396.062585][T14694] ? __get_vm_area_node+0x200/0x2f0 [ 396.062609][T14694] ? __get_vm_area_node+0x283/0x2f0 [ 396.062630][T14694] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.062655][T14694] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.062688][T14694] __vmalloc_node_range_noprof+0x969/0x1540 [ 396.062715][T14694] ? __lock_acquire+0x747/0x2de0 [ 396.062757][T14694] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 396.062794][T14694] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 396.062815][T14694] __vmalloc_noprof+0xd2/0x120 [ 396.062841][T14694] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 396.062866][T14694] bpf_prog_alloc_no_stats+0x47/0x560 [ 396.062885][T14694] ? bpf_prog_alloc+0x2a/0x1a0 [ 396.062909][T14694] bpf_prog_alloc+0x3c/0x1a0 [ 396.062934][T14694] bpf_prog_load+0x7f8/0x1c20 [ 396.062966][T14694] ? __pfx_bpf_prog_load+0x10/0x10 [ 396.063008][T14694] __sys_bpf+0xd0d/0xd90 [ 396.063038][T14694] ? __pfx___sys_bpf+0x10/0x10 [ 396.063066][T14694] ? __fget_files+0x2a/0x420 [ 396.063106][T14694] ? ksys_write+0x242/0x270 [ 396.063135][T14694] ? __pfx_ksys_write+0x10/0x10 [ 396.063166][T14694] __x64_sys_bpf+0xba/0xd0 [ 396.063190][T14694] do_syscall_64+0x166/0x520 [ 396.063210][T14694] ? trace_irq_disable+0x3b/0x140 [ 396.063229][T14694] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.063249][T14694] ? clear_bhb_loop+0x70/0xc0 [ 396.063282][T14694] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.063302][T14694] RIP: 0033:0x7fb30719e159 [ 396.063321][T14694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.063338][T14694] RSP: 002b:00007fb308040028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 396.063359][T14694] RAX: ffffffffffffffda RBX: 00007fb307425fa0 RCX: 00007fb30719e159 [ 396.063374][T14694] RDX: 0000000000000094 RSI: 00002000000007c0 RDI: 0000000000000005 [ 396.063388][T14694] RBP: 00007fb308040090 R08: 0000000000000000 R09: 0000000000000000 [ 396.063401][T14694] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 396.063414][T14694] R13: 00007fb307426038 R14: 00007fb307425fa0 R15: 00007ffc53f99208 [ 396.063445][T14694] [ 396.134199][T14691] syzkaller0: entered promiscuous mode [ 396.134221][T14691] syzkaller0: entered allmulticast mode [ 396.169242][T14691] tipc: Enabled bearer , priority 0 [ 396.183830][T14690] tipc: Resetting bearer [ 396.226179][T14694] Mem-Info: [ 396.226195][T14694] active_anon:6137 inactive_anon:0 isolated_anon:0 [ 396.226195][T14694] active_file:0 inactive_file:43755 isolated_file:0 [ 396.226195][T14694] unevictable:0 dirty:223 writeback:0 [ 396.226195][T14694] slab_reclaimable:11240 slab_unreclaimable:111454 [ 396.226195][T14694] mapped:29932 shmem:650 pagetables:1213 [ 396.226195][T14694] sec_pagetables:0 bounce:0 [ 396.226195][T14694] kernel_misc_reclaimable:0 [ 396.226195][T14694] free:1308774 free_pcp:9142 free_cma:0 [ 396.226253][T14694] Node 0 active_anon:24548kB inactive_anon:0kB active_file:0kB inactive_file:174828kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119728kB dirty:888kB writeback:0kB shmem:2600kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13372kB pagetables:4720kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 396.226305][T14694] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 396.226358][T14694] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.226413][T14694] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 396.226449][T14694] Node 0 DMA32 free:1282172kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:24548kB inactive_anon:0kB active_file:0kB inactive_file:174828kB unevictable:0kB writepending:888kB zspages:0kB present:3129332kB managed:2546612kB mlocked:0kB bounce:0kB free_pcp:36568kB local_pcp:20172kB free_cma:0kB [ 396.226505][T14694] lowmem_reserve[]: 0 0 0 0 0 [ 396.226538][T14694] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.226590][T14694] lowmem_reserve[]: 0 0 0 0 0 [ 396.226627][T14694] Node 1 Normal free:3937564kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.226683][T14694] lowmem_reserve[]: 0 0 0 0 0 [ 396.226716][T14694] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 396.226875][T14694] Node 0 DMA32: 1149*4kB (UME) 605*8kB (UME) 287*16kB (UME) 787*32kB (UM) 336*64kB (UME) 229*128kB (UM) 133*256kB (UM) 42*512kB (UME) 32*1024kB (UM) 9*2048kB (UME) 265*4096kB (UM) = 1282220kB [ 396.227029][T14694] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 396.227122][T14694] Node 1 Normal: 1*4kB (M) 7*8kB (UM) 6*16kB (UM) 12*32kB (UM) 4*64kB (UM) 6*128kB (UM) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 0*2048kB 960*4096kB (UM) = 3937564kB [ 396.227275][T14694] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 396.227291][T14694] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 396.227311][T14694] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 396.227326][T14694] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 396.227342][T14694] 44401 total pagecache pages [ 396.227354][T14694] 0 pages in swap cache [ 396.227361][T14694] Free swap = 124996kB [ 396.227368][T14694] Total swap = 124996kB [ 396.227376][T14694] 2097051 pages RAM [ 396.227383][T14694] 0 pages HighMem/MovableOnly [ 396.227391][T14694] 428782 pages reserved [ 396.227398][T14694] 0 pages cma reserved [ 396.318511][T14690] tipc: Disabling bearer [ 397.030752][T14711] xt_hashlimit: size too large, truncated to 1048576 [ 397.401789][T14721] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 397.401812][T14721] CPU: 1 UID: 0 PID: 14721 Comm: syz.4.2761 Not tainted syzkaller #0 PREEMPT(full) [ 397.401837][T14721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 397.401852][T14721] Call Trace: [ 397.401861][T14721] [ 397.401871][T14721] dump_stack_lvl+0xe8/0x150 [ 397.401909][T14721] sysfs_warn_dup+0x8e/0xa0 [ 397.401941][T14721] sysfs_do_create_link_sd+0xc0/0x110 [ 397.401975][T14721] device_add_class_symlinks+0x1cf/0x240 [ 397.402001][T14721] device_add+0x467/0xb80 [ 397.402026][T14721] wiphy_register+0x1fc8/0x2ff0 [ 397.402073][T14721] ? __pfx_wiphy_register+0x10/0x10 [ 397.402103][T14721] ? __pfx_netdev_run_todo+0x10/0x10 [ 397.402132][T14721] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 397.402165][T14721] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 397.402209][T14721] ieee80211_register_hw+0x3d3d/0x4a50 [ 397.402245][T14721] ? ieee80211_register_hw+0x19d1/0x4a50 [ 397.402297][T14721] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 397.402324][T14721] ? __asan_memset+0x22/0x50 [ 397.402357][T14721] ? __hrtimer_setup+0x1b7/0x260 [ 397.402385][T14721] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 397.402414][T14721] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 397.402471][T14721] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 397.402494][T14721] ? kstrndup+0xbd/0x160 [ 397.402521][T14721] ? kstrndup+0xbd/0x160 [ 397.402545][T14721] hwsim_new_radio_nl+0xd8b/0xf90 [ 397.402585][T14721] genl_family_rcv_msg_doit+0x233/0x340 [ 397.402618][T14721] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 397.402657][T14721] ? bpf_lsm_capable+0x9/0x20 [ 397.402674][T14721] ? security_capable+0x7e/0x2c0 [ 397.402703][T14721] genl_rcv_msg+0x614/0x7a0 [ 397.402732][T14721] ? __pfx_genl_rcv_msg+0x10/0x10 [ 397.402755][T14721] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 397.402793][T14721] netlink_rcv_skb+0x226/0x4a0 [ 397.402824][T14721] ? __pfx_genl_rcv_msg+0x10/0x10 [ 397.402849][T14721] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 397.402896][T14721] ? down_read+0x2be/0x330 [ 397.402926][T14721] genl_rcv+0x28/0x40 [ 397.402946][T14721] netlink_unicast+0x7bd/0x940 [ 397.402987][T14721] netlink_sendmsg+0x813/0xb40 [ 397.403028][T14721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 397.403067][T14721] ? apparmor_socket_sendmsg+0x98/0x360 [ 397.403093][T14721] ? __pfx_netlink_sendmsg+0x10/0x10 [ 397.403119][T14721] sock_sendmsg_nosec+0x13a/0x180 [ 397.403150][T14721] ____sys_sendmsg+0x54e/0x850 [ 397.403183][T14721] ? __pfx_____sys_sendmsg+0x10/0x10 [ 397.403242][T14721] ? import_iovec+0x73/0xa0 [ 397.403272][T14721] ___sys_sendmsg+0x2a5/0x360 [ 397.403297][T14721] ? __lock_acquire+0x747/0x2de0 [ 397.403324][T14721] ? __pfx____sys_sendmsg+0x10/0x10 [ 397.403355][T14721] ? futex_wait+0x2a2/0x390 [ 397.403418][T14721] ? __fget_files+0x2a/0x420 [ 397.403446][T14721] ? __fget_files+0x3a2/0x420 [ 397.403486][T14721] __x64_sys_sendmsg+0x1b1/0x290 [ 397.403517][T14721] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 397.403568][T14721] do_syscall_64+0x166/0x520 [ 397.403589][T14721] ? trace_irq_disable+0x3b/0x140 [ 397.403610][T14721] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.403632][T14721] ? clear_bhb_loop+0x70/0xc0 [ 397.403658][T14721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.403678][T14721] RIP: 0033:0x7f236b99e159 [ 397.403697][T14721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 397.403715][T14721] RSP: 002b:00007f236c7b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 397.403738][T14721] RAX: ffffffffffffffda RBX: 00007f236bc26180 RCX: 00007f236b99e159 [ 397.403754][T14721] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 397.403767][T14721] RBP: 00007f236ba3506b R08: 0000000000000000 R09: 0000000000000000 [ 397.403780][T14721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 397.403793][T14721] R13: 00007f236bc26218 R14: 00007f236bc26180 R15: 00007fff75593d58 [ 397.403828][T14721] [ 398.058588][T14730] ip_tables: iptables: counters copy to user failed while replacing table [ 398.402733][T14741] syzkaller0: entered promiscuous mode [ 398.402757][T14741] syzkaller0: entered allmulticast mode [ 398.491261][T14741] tipc: Enabled bearer , priority 0 [ 398.505718][T14739] tipc: Resetting bearer [ 398.676970][T14739] tipc: Disabling bearer [ 398.882418][T14753] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2775'. [ 398.882450][T14753] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2775'. [ 399.171335][T14758] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2777'. [ 399.220422][T14758] netlink: 'syz.1.2777': attribute type 4 has an invalid length. [ 399.220444][T14758] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2777'. [ 399.374392][T14765] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2779'. [ 399.480525][T14772] ip_tables: iptables: counters copy to user failed while replacing table [ 399.640584][T14783] ip_tables: iptables: counters copy to user failed while replacing table [ 400.027018][T14794] syzkaller0: entered promiscuous mode [ 400.027041][T14794] syzkaller0: entered allmulticast mode [ 400.052595][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2789'. [ 400.052624][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2789'. [ 400.105904][T14794] tipc: Enabled bearer , priority 0 [ 400.122630][T14792] tipc: Resetting bearer [ 400.258099][T14792] tipc: Disabling bearer [ 400.739695][T14817] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2794'. [ 400.833879][T14820] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2794'. [ 400.833904][T14820] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2794'. [ 400.863683][T14820] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2794'. [ 400.921677][T14812] syzkaller0: entered promiscuous mode [ 400.921863][T14812] syzkaller0: entered allmulticast mode [ 401.350969][T14830] FAULT_INJECTION: forcing a failure. [ 401.350969][T14830] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 401.351006][T14830] CPU: 1 UID: 0 PID: 14830 Comm: syz.4.2797 Not tainted syzkaller #0 PREEMPT(full) [ 401.351032][T14830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 401.351045][T14830] Call Trace: [ 401.351053][T14830] [ 401.351063][T14830] dump_stack_lvl+0xe8/0x150 [ 401.351098][T14830] should_fail_ex+0x410/0x560 [ 401.351128][T14830] _copy_to_user+0x31/0xb0 [ 401.351157][T14830] simple_read_from_buffer+0xe1/0x170 [ 401.351191][T14830] proc_fail_nth_read+0x1bb/0x230 [ 401.351222][T14830] ? common_file_perm+0x20e/0x2b0 [ 401.351249][T14830] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 401.351284][T14830] ? rw_verify_area+0x24a/0x4c0 [ 401.351316][T14830] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 401.351347][T14830] vfs_read+0x213/0xa80 [ 401.351382][T14830] ? __pfx___mutex_lock+0x10/0x10 [ 401.351407][T14830] ? __pfx_vfs_read+0x10/0x10 [ 401.351438][T14830] ? __fget_files+0x2a/0x420 [ 401.351471][T14830] ? __fget_files+0x3a2/0x420 [ 401.351501][T14830] ? __fget_files+0x2a/0x420 [ 401.351538][T14830] ksys_read+0x150/0x270 [ 401.351569][T14830] ? __pfx_ksys_read+0x10/0x10 [ 401.351597][T14830] ? fput+0xa0/0xd0 [ 401.351632][T14830] do_syscall_64+0x166/0x520 [ 401.351653][T14830] ? trace_irq_disable+0x3b/0x140 [ 401.351674][T14830] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.351696][T14830] ? clear_bhb_loop+0x70/0xc0 [ 401.351722][T14830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 401.351750][T14830] RIP: 0033:0x7f236b95e98e [ 401.351770][T14830] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 401.351788][T14830] RSP: 002b:00007f236c7f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 401.351811][T14830] RAX: ffffffffffffffda RBX: 00007f236c7f56c0 RCX: 00007f236b95e98e [ 401.351827][T14830] RDX: 000000000000000f RSI: 00007f236c7f50a0 RDI: 0000000000000004 [ 401.351841][T14830] RBP: 00007f236c7f5090 R08: 0000000000000000 R09: 0000000000000000 [ 401.351856][T14830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 401.351869][T14830] R13: 00007f236bc26038 R14: 00007f236bc25fa0 R15: 00007fff75593d58 [ 401.351904][T14830] [ 401.797965][ T31] audit: type=1800 audit(1789529113.415:12): pid=14820 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.2794" name="memory.events" dev="tmpfs" ino=2722 res=0 errno=0 [ 402.082209][T14835] ip_tables: iptables: counters copy to user failed while replacing table [ 404.062322][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 404.376606][T14821] debugfs: '1ãà^!' already exists in 'ieee80211' [ 404.590415][T14849] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2802'. [ 404.590447][T14849] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2802'. [ 404.679201][T14847] syzkaller0: entered promiscuous mode [ 404.679225][T14847] syzkaller0: entered allmulticast mode [ 404.969497][T14864] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2809'. [ 404.976635][T14864] ipvlan0: entered promiscuous mode [ 404.977852][T14864] ipvlan0: left promiscuous mode [ 405.269003][T14869] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 405.269074][T14869] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 405.269326][T14869] tipc: Resetting bearer [ 405.294469][T14872] syzkaller0: entered promiscuous mode [ 405.294492][T14872] syzkaller0: entered allmulticast mode [ 405.299350][T14866] ip_tables: iptables: counters copy to user failed while replacing table [ 405.826607][ T31] audit: type=1804 audit(1789529117.445:13): pid=14891 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2818" name="/newroot/531/cgroup.controllers" dev="tmpfs" ino=2763 res=1 errno=0 [ 405.865108][ T31] audit: type=1800 audit(1789529117.485:14): pid=14891 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2818" name="cgroup.controllers" dev="tmpfs" ino=2763 res=0 errno=0 [ 405.866057][ T31] audit: type=1800 audit(1789529117.485:15): pid=14890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2818" name="cgroup.controllers" dev="tmpfs" ino=2763 res=0 errno=0 [ 406.658575][T14917] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2824'. [ 406.970393][T14921] ip_tables: iptables: counters copy to user failed while replacing table [ 407.040483][T14918] syzkaller0: entered promiscuous mode [ 407.040665][T14918] syzkaller0: entered allmulticast mode [ 407.232383][T14928] netlink: 'syz.4.2829': attribute type 1 has an invalid length. [ 409.957635][T14928] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 410.206959][T14948] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 410.207046][T14948] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 410.207303][T14948] tipc: Resetting bearer [ 410.208072][T14937] sysfs: cannot create duplicate filename '/class/ieee80211/1ãà^!' [ 410.208091][T14937] CPU: 1 UID: 0 PID: 14937 Comm: syz.2.2831 Not tainted syzkaller #0 PREEMPT(full) [ 410.208117][T14937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 410.208130][T14937] Call Trace: [ 410.208138][T14937] [ 410.208148][T14937] dump_stack_lvl+0xe8/0x150 [ 410.208185][T14937] sysfs_warn_dup+0x8e/0xa0 [ 410.208217][T14937] sysfs_do_create_link_sd+0xc0/0x110 [ 410.208252][T14937] device_add_class_symlinks+0x1cf/0x240 [ 410.208280][T14937] device_add+0x467/0xb80 [ 410.208304][T14937] wiphy_register+0x1fc8/0x2ff0 [ 410.208353][T14937] ? __pfx_wiphy_register+0x10/0x10 [ 410.208384][T14937] ? __pfx_netdev_run_todo+0x10/0x10 [ 410.208414][T14937] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 410.208450][T14937] ? ieee80211_init_rate_ctrl_alg+0x55d/0x5d0 [ 410.208488][T14937] ieee80211_register_hw+0x3d3d/0x4a50 [ 410.208525][T14937] ? ieee80211_register_hw+0x19d1/0x4a50 [ 410.208576][T14937] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 410.208603][T14937] ? __asan_memset+0x22/0x50 [ 410.208635][T14937] ? __hrtimer_setup+0x1b7/0x260 [ 410.208663][T14937] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 410.208692][T14937] mac80211_hwsim_new_radio+0x3258/0x56b0 [ 410.208749][T14937] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 410.208772][T14937] ? kstrndup+0xbd/0x160 [ 410.208799][T14937] ? kstrndup+0xbd/0x160 [ 410.208823][T14937] hwsim_new_radio_nl+0xd8b/0xf90 [ 410.208863][T14937] genl_family_rcv_msg_doit+0x233/0x340 [ 410.208896][T14937] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 410.208935][T14937] ? bpf_lsm_capable+0x9/0x20 [ 410.208953][T14937] ? security_capable+0x7e/0x2c0 [ 410.208985][T14937] genl_rcv_msg+0x614/0x7a0 [ 410.209023][T14937] ? __pfx_genl_rcv_msg+0x10/0x10 [ 410.209046][T14937] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 410.209085][T14937] netlink_rcv_skb+0x226/0x4a0 [ 410.209119][T14937] ? __pfx_genl_rcv_msg+0x10/0x10 [ 410.209144][T14937] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 410.209191][T14937] ? down_read+0x2be/0x330 [ 410.209221][T14937] genl_rcv+0x28/0x40 [ 410.209242][T14937] netlink_unicast+0x7bd/0x940 [ 410.209282][T14937] netlink_sendmsg+0x813/0xb40 [ 410.209323][T14937] ? __pfx_netlink_sendmsg+0x10/0x10 [ 410.209363][T14937] ? apparmor_socket_sendmsg+0x98/0x360 [ 410.209389][T14937] ? __pfx_netlink_sendmsg+0x10/0x10 [ 410.209418][T14937] sock_sendmsg_nosec+0x13a/0x180 [ 410.209454][T14937] ____sys_sendmsg+0x54e/0x850 [ 410.209487][T14937] ? __pfx_____sys_sendmsg+0x10/0x10 [ 410.209524][T14937] ? import_iovec+0x73/0xa0 [ 410.209554][T14937] ___sys_sendmsg+0x2a5/0x360 [ 410.209587][T14937] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.209618][T14937] ? futex_wait+0x2a2/0x390 [ 410.209687][T14937] ? __pfx_do_futex+0x10/0x10 [ 410.209721][T14937] __x64_sys_sendmsg+0x1b1/0x290 [ 410.209752][T14937] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 410.209802][T14937] do_syscall_64+0x166/0x520 [ 410.209824][T14937] ? trace_irq_disable+0x3b/0x140 [ 410.209844][T14937] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.209866][T14937] ? clear_bhb_loop+0x70/0xc0 [ 410.209897][T14937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 410.209919][T14937] RIP: 0033:0x7fc76eb9e159 [ 410.209939][T14937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 410.209957][T14937] RSP: 002b:00007fc76f984028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 410.209980][T14937] RAX: ffffffffffffffda RBX: 00007fc76ee25fa0 RCX: 00007fc76eb9e159 [ 410.209995][T14937] RDX: 0000000000000084 RSI: 0000200000000100 RDI: 0000000000000009 [ 410.210016][T14937] RBP: 00007fc76ec3506b R08: 0000000000000000 R09: 0000000000000000 [ 410.210030][T14937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 410.210043][T14937] R13: 00007fc76ee26038 R14: 00007fc76ee25fa0 R15: 00007ffe98350038 [ 410.210078][T14937] [ 411.049198][T14966] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 411.103330][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 411.360238][T14969] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2836'. [ 411.746052][T14979] ip_tables: iptables: counters copy to user failed while replacing table [ 411.954774][ T540] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 6081 - 0 [ 411.954826][ T540] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 6081 - 0 [ 411.954872][ T540] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 6081 - 0 [ 411.954908][ T540] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 6081 - 0 [ 412.543074][T14992] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2841'. [ 412.552140][T14992] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2841'. [ 412.743563][T14992] tipc: Enabling of bearer rejected, already enabled [ 412.750308][T15001] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 412.764846][T15001] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 412.765596][T15001] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 412.766446][T15001] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 412.767002][T15001] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 413.261245][T15012] netlink: 'syz.3.2845': attribute type 62 has an invalid length. [ 413.352139][ T5608] bond1: (slave syz_tun): Removing an active aggregator [ 413.365878][ T5608] bond1: (slave syz_tun): Releasing backup interface [ 413.814978][T15020] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2846'. [ 414.011857][T15020] ovs-system: entered promiscuous mode [ 414.026389][T15025] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2848'. [ 414.241033][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 414.241071][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.241098][ T12] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 414.490222][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 414.490259][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.490286][ T12] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 414.609076][T15048] ip_tables: iptables: counters copy to user failed while replacing table [ 414.806592][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 414.806629][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.806656][ T12] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 414.857816][T15001] Bluetooth: hci5: command tx timeout [ 415.335804][T15066] syzkaller0: entered promiscuous mode [ 415.335828][T15066] syzkaller0: entered allmulticast mode [ 415.795617][T15076] netlink: 'syz.0.2856': attribute type 62 has an invalid length. [ 415.932403][ T12] vlan2: left allmulticast mode [ 415.932427][ T12] geneve0: left allmulticast mode [ 415.968821][ T12] vlan2: left promiscuous mode [ 415.968844][ T12] geneve0: left promiscuous mode [ 415.977051][ T12] bridge0: port 2(vlan2) entered disabled state [ 416.025130][ T12] bridge_slave_0: left allmulticast mode [ 416.025176][ T12] bridge_slave_0: left promiscuous mode [ 416.030221][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 416.615418][T15091] netlink: 'syz.2.2860': attribute type 9 has an invalid length. [ 417.000385][T15001] Bluetooth: hci5: command tx timeout [ 417.272279][ T12] batman_adv: batadv0: Interface deactivated: gretap2 [ 417.272357][ T12] batman_adv: batadv0: Interface deactivated: gretap1 [ 417.772933][ T12] batman_adv: batadv0: Removing interface: gretap2 [ 417.816323][ T12] batman_adv: batadv0: Removing interface: gretap1 [ 417.961321][T15113] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2863'. [ 417.972317][T15113] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2863'. [ 418.126091][ T12] bond1 (unregistering): Released all slaves [ 418.174265][ T12] bond0 (unregistering): Released all slaves [ 418.177518][ T49] smc: removing ib device syz0 [ 418.214506][ T12] bond2 (unregistering): Released all slaves [ 418.449706][T15118] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2865'. [ 418.535976][T15121] ip_tables: iptables: counters copy to user failed while replacing table [ 418.628438][T15113] tipc: Resetting bearer [ 419.015361][T15001] Bluetooth: hci5: command tx timeout [ 419.067040][ T49] smbdirect: ib_dev[syz0] removed [ 419.192746][T15142] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2870'. [ 419.210794][T15142] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2870'. [ 419.557403][T15155] x_tables: unsorted underflow at hook 2 [ 419.948095][T15157] ip6tnl2: left allmulticast mode [ 419.990410][T15166] netlink: 'syz.1.2874': attribute type 62 has an invalid length. [ 420.310316][T15157] bridge0: left promiscuous mode [ 420.600473][T14997] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.600579][T14997] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.600722][T14997] bridge_slave_0: entered allmulticast mode [ 420.671049][T14997] bridge_slave_0: entered promiscuous mode [ 420.689836][T14997] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.689947][T14997] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.690096][T14997] bridge_slave_1: entered allmulticast mode [ 420.809378][T14997] bridge_slave_1: entered promiscuous mode [ 421.094423][T15001] Bluetooth: hci5: command tx timeout [ 421.204374][T15188] xt_hashlimit: size too large, truncated to 1048576 [ 421.329525][T14997] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 421.498269][T15199] netlink: 'syz.0.2880': attribute type 4 has an invalid length. [ 421.498290][T15199] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2880'. [ 421.532277][T14997] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.659211][T15197] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2880'. [ 421.959851][ T7891] hid-generic 0005:0008:0009.0010: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 422.176141][T14997] team0: Port device team_slave_0 added [ 422.234607][T14997] team0: Port device team_slave_1 added [ 422.470438][T15204] fido_id[15204]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci5/hci5:200/report_descriptor': No such file or directory [ 422.799934][T15214] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 422.901300][T14997] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 422.901319][T14997] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.901346][T14997] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 422.944197][ T7890] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 422.981824][T14997] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 422.981841][T14997] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 422.981867][T14997] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 423.179373][T10988] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 423.363461][T15222] xt_hashlimit: size too large, truncated to 1048576 [ 423.406049][T15224] netlink: 'syz.3.2887': attribute type 1 has an invalid length. [ 423.532023][T14997] hsr_slave_0: entered promiscuous mode [ 423.545580][T14997] hsr_slave_1: entered promiscuous mode [ 423.557899][T14997] debugfs: 'hsr0' already exists in 'hsr' [ 423.557922][T14997] Cannot create hsr debugfs directory [ 423.593619][ T7890] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 423.785714][T15242] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2888'. [ 423.785740][T15242] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2888'. [ 424.098770][ T7878] hid-generic 0005:0008:0009.0011: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 424.309928][T15224] bond4 (unregistering): Released all slaves [ 424.732320][T15259] fido_id[15259]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci5/hci5:200/report_descriptor': No such file or directory [ 424.931026][ T12] tipc: Left network mode [ 425.079249][ T43] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 425.079482][ T43] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 425.367037][ T5276] 8021q: adding VLAN 0 to HW filter on device eth1 [ 425.393370][ T7891] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 425.509898][T15265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2891'. [ 425.770579][T15278] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2894'. [ 426.187510][T15288] FAULT_INJECTION: forcing a failure. [ 426.187510][T15288] name failslab, interval 1, probability 0, space 0, times 0 [ 426.187544][T15288] CPU: 1 UID: 0 PID: 15288 Comm: syz.3.2896 Not tainted syzkaller #0 PREEMPT(full) [ 426.187568][T15288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 426.187580][T15288] Call Trace: [ 426.187589][T15288] [ 426.187598][T15288] dump_stack_lvl+0xe8/0x150 [ 426.187632][T15288] should_fail_ex+0x410/0x560 [ 426.187663][T15288] should_failslab+0xa8/0x100 [ 426.187690][T15288] __kvmalloc_node_noprof+0x176/0x820 [ 426.187715][T15288] ? __kvmalloc_node_noprof+0x345/0x820 [ 426.187735][T15288] ? sort_subprogs_topo+0xf5/0xf20 [ 426.187758][T15288] ? sort_subprogs_topo+0xf5/0xf20 [ 426.187787][T15288] sort_subprogs_topo+0xf5/0xf20 [ 426.187811][T15288] ? bpf_prune_dead_branches+0xa3b/0xab0 [ 426.187859][T15288] bpf_check+0x25a5/0x2e10 [ 426.187892][T15288] ? ktime_get_with_offset+0x93/0x2d0 [ 426.187918][T15288] ? __pfx_bpf_check+0x10/0x10 [ 426.187942][T15288] ? bpf_obj_name_cpy+0x194/0x1e0 [ 426.187974][T15288] bpf_prog_load+0x14d6/0x1c20 [ 426.188010][T15288] ? __pfx_bpf_prog_load+0x10/0x10 [ 426.188058][T15288] __sys_bpf+0xd0d/0xd90 [ 426.188089][T15288] ? __pfx___sys_bpf+0x10/0x10 [ 426.188122][T15288] ? __fget_files+0x2a/0x420 [ 426.188168][T15288] ? ksys_write+0x242/0x270 [ 426.188199][T15288] ? __pfx_ksys_write+0x10/0x10 [ 426.188234][T15288] __x64_sys_bpf+0xba/0xd0 [ 426.188257][T15288] do_syscall_64+0x166/0x520 [ 426.188279][T15288] ? trace_irq_disable+0x3b/0x140 [ 426.188299][T15288] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.188320][T15288] ? clear_bhb_loop+0x70/0xc0 [ 426.188345][T15288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.188365][T15288] RIP: 0033:0x7fdcf5d9e159 [ 426.188384][T15288] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.188401][T15288] RSP: 002b:00007fdcf6c05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 426.188423][T15288] RAX: ffffffffffffffda RBX: 00007fdcf6025fa0 RCX: 00007fdcf5d9e159 [ 426.188439][T15288] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 426.188452][T15288] RBP: 00007fdcf6c05090 R08: 0000000000000000 R09: 0000000000000000 [ 426.188465][T15288] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 426.188478][T15288] R13: 00007fdcf6026038 R14: 00007fdcf6025fa0 R15: 00007ffc6b4f9f98 [ 426.188511][T15288] [ 426.625631][T15290] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2897'. [ 426.676160][T15292] FAULT_INJECTION: forcing a failure. [ 426.676160][T15292] name failslab, interval 1, probability 0, space 0, times 0 [ 426.676193][T15292] CPU: 1 UID: 0 PID: 15292 Comm: syz.3.2898 Not tainted syzkaller #0 PREEMPT(full) [ 426.676215][T15292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 426.676228][T15292] Call Trace: [ 426.676236][T15292] [ 426.676246][T15292] dump_stack_lvl+0xe8/0x150 [ 426.676281][T15292] should_fail_ex+0x410/0x560 [ 426.676308][T15292] should_failslab+0xa8/0x100 [ 426.676336][T15292] __kvmalloc_node_noprof+0x176/0x820 [ 426.676358][T15292] ? kasan_save_track+0x3e/0x80 [ 426.676379][T15292] ? __kvmalloc_node_noprof+0x50f/0x820 [ 426.676400][T15292] ? bpf_stack_liveness_init+0x29/0x90 [ 426.676422][T15292] ? bpf_check+0x24f6/0x2e10 [ 426.676443][T15292] ? bpf_compute_const_regs+0x18f/0x3450 [ 426.676467][T15292] ? bpf_compute_const_regs+0x18f/0x3450 [ 426.676498][T15292] bpf_compute_const_regs+0x18f/0x3450 [ 426.676545][T15292] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 426.676568][T15292] ? check_attach_btf_id+0x325/0x1a30 [ 426.676598][T15292] ? rcu_is_watching+0x16/0xb0 [ 426.676622][T15292] ? bpf_stack_liveness_init+0x29/0x90 [ 426.676643][T15292] ? trace_kmalloc+0x2a/0xf0 [ 426.676673][T15292] ? __pfx_check_attach_btf_id+0x10/0x10 [ 426.676695][T15292] ? bpf_stack_liveness_init+0x29/0x90 [ 426.676717][T15292] ? __kvmalloc_node_noprof+0x52f/0x820 [ 426.676749][T15292] ? __asan_memset+0x22/0x50 [ 426.676782][T15292] bpf_check+0x255d/0x2e10 [ 426.676825][T15292] ? ktime_get_with_offset+0x93/0x2d0 [ 426.676851][T15292] ? __pfx_bpf_check+0x10/0x10 [ 426.676876][T15292] ? bpf_obj_name_cpy+0x194/0x1e0 [ 426.676909][T15292] bpf_prog_load+0x14d6/0x1c20 [ 426.676943][T15292] ? __pfx_bpf_prog_load+0x10/0x10 [ 426.676991][T15292] __sys_bpf+0xd0d/0xd90 [ 426.677021][T15292] ? __pfx___sys_bpf+0x10/0x10 [ 426.677055][T15292] ? __fget_files+0x2a/0x420 [ 426.677099][T15292] ? ksys_write+0x242/0x270 [ 426.677132][T15292] ? __pfx_ksys_write+0x10/0x10 [ 426.677166][T15292] __x64_sys_bpf+0xba/0xd0 [ 426.677188][T15292] do_syscall_64+0x166/0x520 [ 426.677210][T15292] ? trace_irq_disable+0x3b/0x140 [ 426.677230][T15292] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.677251][T15292] ? clear_bhb_loop+0x70/0xc0 [ 426.677275][T15292] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.677295][T15292] RIP: 0033:0x7fdcf5d9e159 [ 426.677314][T15292] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.677333][T15292] RSP: 002b:00007fdcf6c05028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 426.677355][T15292] RAX: ffffffffffffffda RBX: 00007fdcf6025fa0 RCX: 00007fdcf5d9e159 [ 426.677371][T15292] RDX: 0000000000000094 RSI: 00002000000006c0 RDI: 0000000000000005 [ 426.677385][T15292] RBP: 00007fdcf6c05090 R08: 0000000000000000 R09: 0000000000000000 [ 426.677397][T15292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 426.677409][T15292] R13: 00007fdcf6026038 R14: 00007fdcf6025fa0 R15: 00007ffc6b4f9f98 [ 426.677441][T15292] [ 426.868986][T15294] ip_tables: iptables: counters copy to user failed while replacing table [ 427.062288][T15299] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2900'. [ 427.390665][T15310] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2902'. [ 427.484236][T15307] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2903'. [ 427.534563][T15312] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2904'. [ 427.648402][T15314] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2902'. [ 427.813797][ T4930] Bluetooth: hci5: command 0x0405 tx timeout [ 428.557944][ T31] audit: type=1800 audit(1789529140.175:16): pid=15316 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2904" name="memory.events" dev="tmpfs" ino=3138 res=0 errno=0 [ 428.946492][T15341] __nla_validate_parse: 6 callbacks suppressed [ 428.946514][T15341] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2910'. [ 429.330734][ T12] hsr_slave_0: left promiscuous mode [ 429.349305][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 429.349490][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 429.364598][T15350] netlink: 'syz.3.2911': attribute type 62 has an invalid length. [ 429.503475][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 429.530418][ T12] veth1_vlan: left promiscuous mode [ 429.530516][ T12] veth0_vlan: left promiscuous mode [ 429.922825][T15359] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2914'. [ 429.996928][T15361] xt_hashlimit: size too large, truncated to 1048576 [ 430.251846][T15370] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2917'. [ 430.498275][ T7890] hid-generic 0005:0008:0009.0012: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 430.731156][T15378] fido_id[15378]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci5/hci5:200/report_descriptor': No such file or directory [ 431.481985][T15384] xt_hashlimit: size too large, truncated to 1048576 [ 432.176493][T14997] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 432.190324][T14997] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 432.198169][T14997] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 432.234480][T14997] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 432.236290][T14997] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 432.296701][T14997] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 432.312969][T14997] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 432.356200][T14997] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 432.487870][T15412] bridge0: port 1(vlan2) entered blocking state [ 432.488114][T15412] bridge0: port 1(vlan2) entered disabled state [ 432.488244][T15412] vlan2: entered allmulticast mode [ 432.488259][T15412] geneve0: entered allmulticast mode [ 432.847764][T15419] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2926'. [ 432.903005][T14997] 8021q: adding VLAN 0 to HW filter on device bond0 [ 432.936106][T14997] 8021q: adding VLAN 0 to HW filter on device team0 [ 432.954919][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.955041][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 433.011292][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 433.011417][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 433.126773][T15424] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2927'. [ 433.782686][T15436] xt_hashlimit: size too large, truncated to 1048576 [ 434.032247][T15449] ip_tables: iptables: counters copy to user failed while replacing table [ 434.098994][ T5700] hid-generic 0005:0008:0009.0013: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 434.477329][T15457] fido_id[15457]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci5/hci5:200/report_descriptor': No such file or directory [ 434.726150][T15470] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2936'. [ 434.726183][T15470] netlink: 'syz.1.2936': attribute type 8 has an invalid length. [ 434.726195][T15470] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2936'. [ 434.791667][T15473] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2936'. [ 434.791702][T15473] netlink: 'syz.1.2936': attribute type 8 has an invalid length. [ 434.791714][T15473] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2936'. [ 434.850331][T15474] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2939'. [ 434.873180][T15480] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2937'. [ 434.972252][T15471] netlink: 'syz.2.2937': attribute type 12 has an invalid length. [ 435.583698][T14997] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.776112][T15523] netlink: 128 bytes leftover after parsing attributes in process `syz.3.2945'. [ 436.799349][T15524] ip_tables: iptables: counters copy to user failed while replacing table [ 436.932964][T14997] veth0_vlan: entered promiscuous mode [ 436.954295][T15525] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2945'. [ 436.954329][T15525] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2945'. [ 437.018987][T15525] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2945'. [ 437.022510][T14997] veth1_vlan: entered promiscuous mode [ 437.252608][T14997] veth0_macvtap: entered promiscuous mode [ 437.294938][T14997] veth1_macvtap: entered promiscuous mode [ 437.425504][T14997] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 437.472088][T15538] xt_hashlimit: size too large, truncated to 1048576 [ 437.478279][T14997] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 437.534452][ T538] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.534542][ T538] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.534577][ T538] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.534610][ T538] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.686411][ T31] audit: type=1800 audit(1789529149.305:17): pid=15525 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2945" name="memory.events" dev="tmpfs" ino=3186 res=0 errno=0 [ 437.892137][ T7890] hid-generic 0005:0008:0009.0014: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 437.973634][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 438.293063][T15547] fido_id[15547]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci5/hci5:200/report_descriptor': No such file or directory [ 438.676939][T15559] tipc: Resetting bearer [ 438.691757][T15559] syzkaller0: left allmulticast mode [ 438.731926][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.731947][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.900954][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 438.900976][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 439.136848][T15579] ip_tables: iptables: counters copy to user failed while replacing table [ 439.599661][T15001] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 439.625789][T15001] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 439.629783][T15001] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 439.650232][T15001] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 439.651150][T15001] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 439.694819][T15593] xt_hashlimit: size too large, truncated to 1048576 [ 439.895584][ T1309] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.020016][ T7890] hid-generic 0005:0008:0009.0015: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 440.159078][T15602] __nla_validate_parse: 2 callbacks suppressed [ 440.159099][T15602] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2963'. [ 440.176265][T15602] netlink: 128 bytes leftover after parsing attributes in process `syz.4.2963'. [ 440.248518][T15608] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2963'. [ 440.248541][T15608] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2963'. [ 440.251557][T15608] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2963'. [ 440.430727][T15609] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2965'. [ 440.460323][T15605] fido_id[15605]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci0/hci0:200/report_descriptor': No such file or directory [ 440.497091][T15615] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2964'. [ 440.524567][ T31] audit: type=1800 audit(1789529152.145:18): pid=15608 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2963" name="memory.events" dev="tmpfs" ino=23 res=0 errno=0 [ 441.259617][T15627] netlink: 'syz.2.2967': attribute type 12 has an invalid length. [ 441.277569][T15627] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2967'. [ 441.566791][T15637] ip_tables: iptables: counters copy to user failed while replacing table [ 441.689831][T15635] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 441.733791][ T4930] Bluetooth: hci0: command tx timeout [ 441.756543][T15642] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 441.855586][T15642] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 441.855619][T15642] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 442.302105][T15653] xt_hashlimit: size too large, truncated to 1048576 [ 442.569735][T15665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2976'. [ 442.684074][ T538] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 442.684125][ T538] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 442.684161][ T538] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 442.684197][ T538] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 442.690956][ T7884] hid-generic 0005:0008:0009.0016: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 442.941566][T15672] fido_id[15672]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci0/hci0:200/report_descriptor': No such file or directory [ 443.017856][T15592] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.017970][T15592] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.018129][T15592] bridge_slave_0: entered allmulticast mode [ 443.032614][T15592] bridge_slave_0: entered promiscuous mode [ 443.048886][T15592] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.048985][T15592] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.049137][T15592] bridge_slave_1: entered allmulticast mode [ 443.058258][T15592] bridge_slave_1: entered promiscuous mode [ 443.190221][T15674] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2978'. [ 443.202379][T15592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 443.220877][T15592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 443.280033][T15592] team0: Port device team_slave_0 added [ 443.287310][T15592] team0: Port device team_slave_1 added [ 443.378836][T15592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 443.378854][T15592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 443.378881][T15592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 443.405786][T15592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 443.405804][T15592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 443.405830][T15592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.466335][T15684] FAULT_INJECTION: forcing a failure. [ 443.466335][T15684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 443.466368][T15684] CPU: 1 UID: 0 PID: 15684 Comm: syz.1.2981 Not tainted syzkaller #0 PREEMPT(full) [ 443.466390][T15684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 443.466402][T15684] Call Trace: [ 443.466411][T15684] [ 443.466419][T15684] dump_stack_lvl+0xe8/0x150 [ 443.466451][T15684] should_fail_ex+0x410/0x560 [ 443.466477][T15684] _copy_to_user+0x31/0xb0 [ 443.466504][T15684] bpf_test_finish+0x4ea/0x690 [ 443.466536][T15684] ? csum_partial+0x239/0x2c0 [ 443.466563][T15684] ? __pfx_bpf_test_finish+0x10/0x10 [ 443.466602][T15684] bpf_prog_test_run_skb+0x11fe/0x2230 [ 443.466657][T15684] ? __fget_files+0x3a2/0x420 [ 443.466683][T15684] ? __fget_files+0x2a/0x420 [ 443.466713][T15684] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 443.466740][T15684] bpf_prog_test_run+0x2c5/0x340 [ 443.466767][T15684] __sys_bpf+0xa22/0xd90 [ 443.466796][T15684] ? __pfx___sys_bpf+0x10/0x10 [ 443.466828][T15684] ? __fget_files+0x2a/0x420 [ 443.466869][T15684] ? ksys_write+0x242/0x270 [ 443.466900][T15684] ? __pfx_ksys_write+0x10/0x10 [ 443.466933][T15684] __x64_sys_bpf+0xba/0xd0 [ 443.466954][T15684] do_syscall_64+0x166/0x520 [ 443.466975][T15684] ? trace_irq_disable+0x3b/0x140 [ 443.466994][T15684] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.467014][T15684] ? clear_bhb_loop+0x70/0xc0 [ 443.467037][T15684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.467056][T15684] RIP: 0033:0x7fb30719e159 [ 443.467074][T15684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.467091][T15684] RSP: 002b:00007fb308040028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 443.467112][T15684] RAX: ffffffffffffffda RBX: 00007fb307425fa0 RCX: 00007fb30719e159 [ 443.467127][T15684] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 443.467139][T15684] RBP: 00007fb308040090 R08: 0000000000000000 R09: 0000000000000000 [ 443.467152][T15684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.467163][T15684] R13: 00007fb307426038 R14: 00007fb307425fa0 R15: 00007ffc53f99208 [ 443.467193][T15684] [ 443.617642][T15592] hsr_slave_0: entered promiscuous mode [ 443.626196][T15592] hsr_slave_1: entered promiscuous mode [ 443.629797][T15592] debugfs: 'hsr0' already exists in 'hsr' [ 443.629818][T15592] Cannot create hsr debugfs directory [ 443.672718][T15688] ip_tables: iptables: counters copy to user failed while replacing table [ 443.715579][T15687] netlink: 'syz.2.2982': attribute type 12 has an invalid length. [ 443.813267][ T4930] Bluetooth: hci0: command tx timeout [ 444.309522][T15592] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 444.309559][T15592] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 444.486775][T15592] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 444.486812][T15592] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 444.606494][T15592] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 444.606531][T15592] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 444.636275][T15704] xt_hashlimit: size too large, truncated to 1048576 [ 444.749777][T15592] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 444.752023][T15592] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 444.828299][ T7884] hid-generic 0005:0008:0009.0017: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 445.019172][T15710] fido_id[15710]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci0/hci0:200/report_descriptor': No such file or directory [ 445.058378][T15712] FAULT_INJECTION: forcing a failure. [ 445.058378][T15712] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 445.058412][T15712] CPU: 1 UID: 0 PID: 15712 Comm: syz.2.2989 Not tainted syzkaller #0 PREEMPT(full) [ 445.058439][T15712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 445.058452][T15712] Call Trace: [ 445.058461][T15712] [ 445.058469][T15712] dump_stack_lvl+0xe8/0x150 [ 445.058504][T15712] should_fail_ex+0x410/0x560 [ 445.058532][T15712] _copy_to_user+0x31/0xb0 [ 445.058560][T15712] simple_read_from_buffer+0xe1/0x170 [ 445.058594][T15712] proc_fail_nth_read+0x1bb/0x230 [ 445.058625][T15712] ? common_file_perm+0x20e/0x2b0 [ 445.058651][T15712] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 445.058685][T15712] ? rw_verify_area+0x24a/0x4c0 [ 445.058713][T15712] ? tun_chr_write_iter+0x18a/0x200 [ 445.058736][T15712] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 445.058766][T15712] vfs_read+0x213/0xa80 [ 445.058800][T15712] ? __pfx___mutex_lock+0x10/0x10 [ 445.058824][T15712] ? __pfx_vfs_read+0x10/0x10 [ 445.058855][T15712] ? __fget_files+0x2a/0x420 [ 445.058886][T15712] ? __fget_files+0x3a2/0x420 [ 445.058911][T15712] ? __fget_files+0x2a/0x420 [ 445.058947][T15712] ksys_read+0x150/0x270 [ 445.058987][T15712] ? __pfx_ksys_read+0x10/0x10 [ 445.059028][T15712] do_syscall_64+0x166/0x520 [ 445.059049][T15712] ? trace_irq_disable+0x3b/0x140 [ 445.059071][T15712] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.059092][T15712] ? clear_bhb_loop+0x70/0xc0 [ 445.059118][T15712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.059138][T15712] RIP: 0033:0x7fc76eb5e98e [ 445.059158][T15712] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 445.059177][T15712] RSP: 002b:00007fc76f983fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 445.059213][T15712] RAX: ffffffffffffffda RBX: 00007fc76f9846c0 RCX: 00007fc76eb5e98e [ 445.059229][T15712] RDX: 000000000000000f RSI: 00007fc76f9840a0 RDI: 0000000000000003 [ 445.059243][T15712] RBP: 00007fc76f984090 R08: 0000000000000000 R09: 0000000000000000 [ 445.059257][T15712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 445.059269][T15712] R13: 00007fc76ee26038 R14: 00007fc76ee25fa0 R15: 00007ffe98350038 [ 445.059303][T15712] [ 445.243672][T15714] __nla_validate_parse: 1 callbacks suppressed [ 445.243693][T15714] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2990'. [ 445.327906][T15655] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 445.388573][T15592] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 445.576301][T15592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 445.587257][T15592] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 445.611850][T15592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 445.628939][T15592] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 445.667206][T15592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 445.676199][T15592] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 445.712818][T15592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 445.745313][T15718] ip_tables: iptables: counters copy to user failed while replacing table [ 445.893374][ T4930] Bluetooth: hci0: command tx timeout [ 446.150433][T15592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.178386][T15738] can: request_module (can-proto-0) failed. [ 446.221966][T15592] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.248565][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.248699][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.280975][T15743] IPVS: set_ctl: invalid protocol: 52 100.1.0.255:20004 [ 446.289272][ T538] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.289379][ T538] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.487552][T15749] netlink: 'syz.0.2999': attribute type 12 has an invalid length. [ 446.501928][T15749] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2999'. [ 446.849020][T15757] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3000'. [ 447.445946][T15772] xt_hashlimit: size too large, truncated to 1048576 [ 447.469430][T15775] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.469462][T15775] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.469477][T15775] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.470290][T15775] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.668709][T15780] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.668733][T15780] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.726165][ T7890] hid-generic 0005:0008:0009.0018: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 447.730102][T15780] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3005'. [ 447.851403][T15787] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 447.938226][T15788] fido_id[15788]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci0/hci0:200/report_descriptor': No such file or directory [ 447.973414][ T4930] Bluetooth: hci0: command tx timeout [ 448.635087][ T31] audit: type=1800 audit(1789529160.255:19): pid=15780 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3005" name="memory.events" dev="tmpfs" ino=3303 res=0 errno=0 [ 448.830121][T15810] tipc: Enabling of bearer rejected, failed to enable media [ 448.933972][T15592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 449.184629][T15592] veth0_vlan: entered promiscuous mode [ 449.234649][T15592] veth1_vlan: entered promiscuous mode [ 449.554694][T15592] veth0_macvtap: entered promiscuous mode [ 449.586543][T15592] veth1_macvtap: entered promiscuous mode [ 449.656857][T15592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 449.715375][T15592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 449.788420][T15832] netlink: 'syz.1.3016': attribute type 12 has an invalid length. [ 449.794587][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.794628][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.794661][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.794692][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 450.245180][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.245203][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.467363][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.467386][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.750664][T15844] __nla_validate_parse: 4 callbacks suppressed [ 450.750685][T15844] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3021'. [ 450.840789][T15851] netlink: 'syz.3.2960': attribute type 5 has an invalid length. [ 450.841196][T15852] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3022'. [ 450.860952][T15852] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3022'. [ 451.311271][T15857] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3026'. [ 451.524753][T15001] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 451.531780][T15001] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 451.550250][T15001] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 451.566279][T15001] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 451.580486][T15001] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 451.865762][T15871] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3029'. [ 451.865802][T15871] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3029'. [ 451.865818][T15871] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3029'. [ 451.866920][T15871] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3029'. [ 452.072932][T15874] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3029'. [ 452.072957][T15874] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3029'. [ 452.346804][T15868] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.347476][T15868] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.438111][T15878] netlink: zone id is out of range [ 452.438128][T15878] netlink: zone id is out of range [ 452.438137][T15878] netlink: zone id is out of range [ 452.439219][T15878] netlink: zone id is out of range [ 452.440149][T15878] netlink: zone id is out of range [ 452.440176][T15878] netlink: zone id is out of range [ 452.442407][T15878] netlink: zone id is out of range [ 452.466228][T15878] netlink: zone id is out of range [ 452.466243][T15878] netlink: zone id is out of range [ 452.466291][T15878] netlink: zone id is out of range [ 452.728538][ T31] audit: type=1800 audit(1789529164.345:20): pid=15874 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3029" name="memory.events" dev="tmpfs" ino=3021 res=0 errno=0 [ 453.037245][T15868] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 453.058178][T15868] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 453.481549][T15886] tipc: Disabling bearer [ 453.535581][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.535687][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.535796][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.535919][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.659066][ T4930] Bluetooth: hci2: command tx timeout [ 454.249993][T15925] FAULT_INJECTION: forcing a failure. [ 454.249993][T15925] name failslab, interval 1, probability 0, space 0, times 0 [ 454.250026][T15925] CPU: 1 UID: 0 PID: 15925 Comm: syz.4.3040 Not tainted syzkaller #0 PREEMPT(full) [ 454.250049][T15925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 454.250062][T15925] Call Trace: [ 454.250070][T15925] [ 454.250080][T15925] dump_stack_lvl+0xe8/0x150 [ 454.250114][T15925] should_fail_ex+0x410/0x560 [ 454.250142][T15925] should_failslab+0xa8/0x100 [ 454.250170][T15925] __kvmalloc_node_noprof+0x176/0x820 [ 454.250191][T15925] ? kasan_save_track+0x3e/0x80 [ 454.250213][T15925] ? __kvmalloc_node_noprof+0x50f/0x820 [ 454.250239][T15925] ? bpf_stack_liveness_init+0x29/0x90 [ 454.250263][T15925] ? bpf_check+0x24f6/0x2e10 [ 454.250287][T15925] ? bpf_compute_const_regs+0x18f/0x3450 [ 454.250310][T15925] ? bpf_compute_const_regs+0x18f/0x3450 [ 454.250342][T15925] bpf_compute_const_regs+0x18f/0x3450 [ 454.250389][T15925] ? __pfx_bpf_compute_const_regs+0x10/0x10 [ 454.250412][T15925] ? check_attach_btf_id+0x325/0x1a30 [ 454.250442][T15925] ? rcu_is_watching+0x16/0xb0 [ 454.250466][T15925] ? bpf_stack_liveness_init+0x29/0x90 [ 454.250486][T15925] ? trace_kmalloc+0x2a/0xf0 [ 454.250516][T15925] ? __pfx_check_attach_btf_id+0x10/0x10 [ 454.250539][T15925] ? bpf_stack_liveness_init+0x29/0x90 [ 454.250561][T15925] ? __kvmalloc_node_noprof+0x52f/0x820 [ 454.250592][T15925] ? __asan_memset+0x22/0x50 [ 454.250625][T15925] bpf_check+0x255d/0x2e10 [ 454.250658][T15925] ? ktime_get_with_offset+0x93/0x2d0 [ 454.250684][T15925] ? __pfx_bpf_check+0x10/0x10 [ 454.250709][T15925] ? bpf_obj_name_cpy+0x194/0x1e0 [ 454.250802][T15925] bpf_prog_load+0x14d6/0x1c20 [ 454.250853][T15925] ? __pfx_bpf_prog_load+0x10/0x10 [ 454.250902][T15925] __sys_bpf+0xd0d/0xd90 [ 454.250934][T15925] ? __pfx___sys_bpf+0x10/0x10 [ 454.250967][T15925] ? __fget_files+0x2a/0x420 [ 454.251012][T15925] ? ksys_write+0x242/0x270 [ 454.251044][T15925] ? __pfx_ksys_write+0x10/0x10 [ 454.251076][T15925] __x64_sys_bpf+0xba/0xd0 [ 454.251101][T15925] do_syscall_64+0x166/0x520 [ 454.251123][T15925] ? trace_irq_disable+0x3b/0x140 [ 454.251144][T15925] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.251165][T15925] ? clear_bhb_loop+0x70/0xc0 [ 454.251191][T15925] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.251212][T15925] RIP: 0033:0x7f334cd9e159 [ 454.251233][T15925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 454.251252][T15925] RSP: 002b:00007f334dcfb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 454.251276][T15925] RAX: ffffffffffffffda RBX: 00007f334d025fa0 RCX: 00007f334cd9e159 [ 454.251291][T15925] RDX: 0000000000000094 RSI: 0000200000000100 RDI: 0000000000000005 [ 454.251304][T15925] RBP: 00007f334dcfb090 R08: 0000000000000000 R09: 0000000000000000 [ 454.251318][T15925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 454.251330][T15925] R13: 00007f334d026038 R14: 00007f334d025fa0 R15: 00007ffcb88f9478 [ 454.251372][T15925] [ 455.434265][ T538] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 455.434316][ T538] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 455.434355][ T538] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 455.434391][ T538] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 455.660517][T15952] netlink: 'syz.3.3047': attribute type 12 has an invalid length. [ 455.734423][ T4930] Bluetooth: hci2: command tx timeout [ 455.893337][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 457.081101][T10988] vlan3: left allmulticast mode [ 457.081125][T10988] geneve0: left allmulticast mode [ 457.081145][T10988] vlan3: left promiscuous mode [ 457.081158][T10988] geneve0: left promiscuous mode [ 457.081549][T10988] bridge0: port 3(vlan3) entered disabled state [ 457.144432][T10988] bridge_slave_1: left allmulticast mode [ 457.144459][T10988] bridge_slave_1: left promiscuous mode [ 457.144673][T10988] bridge0: port 2(bridge_slave_1) entered disabled state [ 457.176427][T10988] bridge_slave_0: left allmulticast mode [ 457.176453][T10988] bridge_slave_0: left promiscuous mode [ 457.178110][T10988] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.592439][T15985] netlink: 'syz.3.3053': attribute type 4 has an invalid length. [ 457.592468][T15985] __nla_validate_parse: 10 callbacks suppressed [ 457.592481][T15985] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3053'. [ 457.814319][ T4930] Bluetooth: hci2: command tx timeout [ 458.066905][T16004] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3056'. [ 458.087236][T16003] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3056'. [ 458.258177][T10988] batman_adv: batadv0: Removing interface: gretap1 [ 458.457007][T10988] bond1 (unregistering): Released all slaves [ 458.516748][T10988] bond2 (unregistering): Released all slaves [ 458.556557][T10988] bond3 (unregistering): (slave veth0_to_bond): Releasing active interface [ 458.559465][T10988] bond3 (unregistering): Released all slaves [ 458.595411][T10988] bond4 (unregistering): Released all slaves [ 458.730159][T10988] bond5 (unregistering): Released all slaves [ 458.818083][T15983] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3053'. [ 458.818585][T15984] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3054'. [ 458.844830][T15985] 8021q: adding VLAN 0 to HW filter on device bond0 [ 459.031876][ T5276] 8021q: adding VLAN 0 to HW filter on device eth1 [ 459.241084][T16035] netlink: 'syz.4.3059': attribute type 9 has an invalid length. [ 459.289168][T10988] tipc: Left network mode [ 459.511701][T16043] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3062'. [ 459.561619][T16044] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3063'. [ 459.604319][T16046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3064'. [ 459.687013][T16038] netlink: 'syz.0.3062': attribute type 12 has an invalid length. [ 459.880727][T15860] bridge0: port 1(bridge_slave_0) entered blocking state [ 459.880834][T15860] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.880992][T15860] bridge_slave_0: entered allmulticast mode [ 459.897743][ T4930] Bluetooth: hci2: command tx timeout [ 459.918262][T15860] bridge_slave_0: entered promiscuous mode [ 460.049701][T16024] tipc: Started in network mode [ 460.049734][T16024] tipc: Node identity ae28115a05a9, cluster identity 4711 [ 460.049931][T16024] tipc: Enabled bearer , priority 0 [ 460.050355][T15860] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.050454][T15860] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.050647][T15860] bridge_slave_1: entered allmulticast mode [ 460.053016][T15860] bridge_slave_1: entered promiscuous mode [ 460.159567][T16023] tipc: Disabling bearer [ 460.204427][T16056] netlink: 'syz.4.3066': attribute type 62 has an invalid length. [ 460.597261][T15860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.600521][T15860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 460.697329][T16063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3067'. [ 460.697813][T16063] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3067'. [ 460.804753][T15860] team0: Port device team_slave_0 added [ 460.889594][T15860] team0: Port device team_slave_1 added [ 461.141237][T15860] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.141256][T15860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.141283][T15860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.212972][ T31] audit: type=1800 audit(1789529172.825:21): pid=16068 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3067" name="memory.events" dev="tmpfs" ino=75 res=0 errno=0 [ 461.436363][T15860] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.436381][T15860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.436409][T15860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.360504][ C1] ------------[ cut here ]------------ [ 462.360519][ C1] current_phy->suspended [ 462.360533][ C1] WARNING: drivers/net/ieee802154/mac802154_hwsim.c:266 at hwsim_hw_xmit+0x15f4/0x1620, CPU#1: kworker/u8:3/49 [ 462.382755][ C1] Modules linked in: [ 462.387986][ C1] CPU: 1 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 462.397331][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 462.407443][ C1] Workqueue: phy0-mac-cmds mac802154_scan_worker [ 462.413860][ C1] RIP: 0010:hwsim_hw_xmit+0x15f4/0x1620 [ 462.419431][ C1] Code: c6 05 53 86 24 09 01 48 c7 c7 00 5d be 8c be 0d 01 00 00 48 c7 c2 a0 5d be 8c e8 c7 5b 64 fa e9 f4 eb ff ff e8 6d b0 88 fa 90 <0f> 0b 90 e9 e1 ea ff ff 89 d9 80 e1 07 38 c1 0f 8c c6 ea ff ff 48 [ 462.439099][ C1] RSP: 0018:ffffc90000a18a60 EFLAGS: 00010246 [ 462.445214][ C1] RAX: ffffffff873f1a43 RBX: ffff888028f7ed78 RCX: ffff8880236e1f40 [ 462.453245][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888028f7e720 [ 462.461242][ C1] RBP: ffffc90000a18bd8 R08: ffff888028f7e6ab R09: 1ffff110051efcd5 [ 462.469285][ C1] R10: dffffc0000000000 R11: ffffffff873f0450 R12: dffffc0000000000 [ 462.477312][ C1] R13: ffff888028f7e760 R14: ffff888028f7ed20 R15: 1ffff110051efcec [ 462.485339][ C1] FS: 0000000000000000(0000) GS:ffff888124dd1000(0000) knlGS:0000000000000000 [ 462.494324][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 462.500917][ C1] CR2: 00007f724db47ee0 CR3: 0000000035e76000 CR4: 00000000003526f0 [ 462.508960][ C1] Call Trace: [ 462.512251][ C1] [ 462.515167][ C1] ? ieee802154_hold_queue+0xd1/0x3a0 [ 462.520581][ C1] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 462.525769][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 462.531604][ C1] ieee802154_tx+0x26d/0x510 [ 462.536261][ C1] ieee802154_subif_start_xmit+0x110/0x190 [ 462.542094][ C1] dev_hard_start_xmit+0x2cd/0x830 [ 462.547289][ C1] sch_direct_xmit+0x257/0x4c0 [ 462.552076][ C1] ? __pfx_sch_direct_xmit+0x10/0x10 [ 462.557432][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 462.562843][ C1] __qdisc_run+0xb11/0x1620 [ 462.567430][ C1] net_tx_action+0x7cb/0xc30 [ 462.572037][ C1] ? net_tx_action+0x5bb/0xc30 [ 462.576874][ C1] handle_softirqs+0x226/0x860 [ 462.581664][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 462.586496][ C1] __irq_exit_rcu+0xcb/0x220 [ 462.591112][ C1] irq_exit_rcu+0x9/0x30 [ 462.595397][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 462.601046][ C1] [ 462.604010][ C1] [ 462.606951][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 462.612948][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 462.619420][ C1] Code: f7 e8 8d d3 bb f5 f7 c3 00 02 00 00 74 05 e8 50 17 e8 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 94 e2 ac f5 65 48 8b 05 0c f1 ac 07 48 85 c0 74 18 5b 41 5e e9 [ 462.639170][ C1] RSP: 0018:ffffc90000ba7968 EFLAGS: 00000206 [ 462.645290][ C1] RAX: 0000000000000002 RBX: 0000000000000282 RCX: 0000000000000001 [ 462.653300][ C1] RDX: 0000000000000006 RSI: ffffffff8e4777a6 RDI: 0000000000000001 [ 462.661279][ C1] RBP: 0000000000000000 R08: ffffffff907a317f R09: 1ffffffff20f462f [ 462.669297][ C1] R10: dffffc0000000000 R11: fffffbfff20f4630 R12: ffff88807d2f5680 [ 462.677304][ C1] R13: ffff888028510ed0 R14: ffff888028f7e668 R15: ffff888028f7e0a0 [ 462.685336][ C1] mac802154_scan_cleanup_locked+0xc9/0x280 [ 462.691284][ C1] mac802154_scan_worker+0x775/0xe60 [ 462.696619][ C1] ? mac802154_scan_worker+0xc9/0xe60 [ 462.702026][ C1] ? __pfx_mac802154_scan_worker+0x10/0x10 [ 462.707886][ C1] ? rcu_is_watching+0x16/0xb0 [ 462.712673][ C1] ? process_scheduled_works+0x97a/0x1630 [ 462.718442][ C1] process_scheduled_works+0xc3d/0x1630 [ 462.724078][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 462.730083][ C1] ? assign_work+0x3cf/0x5d0 [ 462.734722][ C1] worker_thread+0xa47/0xfb0 [ 462.739359][ C1] kthread+0x38b/0x480 [ 462.743468][ C1] ? __pfx_worker_thread+0x10/0x10 [ 462.748593][ C1] ? __pfx_kthread+0x10/0x10 [ 462.753252][ C1] ret_from_fork+0x514/0xb70 [ 462.757855][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 462.762988][ C1] ? __switch_to+0xc89/0x1420 [ 462.767716][ C1] ? __pfx_kthread+0x10/0x10 [ 462.772328][ C1] ret_from_fork_asm+0x1a/0x30 [ 462.777173][ C1] [ 462.780214][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 462.787504][ C1] CPU: 1 UID: 0 PID: 49 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 462.796802][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 462.806873][ C1] Workqueue: phy0-mac-cmds mac802154_scan_worker [ 462.813229][ C1] Call Trace: [ 462.816527][ C1] [ 462.819377][ C1] vpanic+0x56d/0xa60 [ 462.823386][ C1] ? __pfx__printk+0x10/0x10 [ 462.827986][ C1] ? __pfx_vpanic+0x10/0x10 [ 462.832504][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 462.837807][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 462.843017][ C1] panic+0xc5/0xd0 [ 462.846763][ C1] ? __pfx_panic+0x10/0x10 [ 462.851213][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 462.856174][ C1] __warn+0x315/0x4c0 [ 462.860167][ C1] ? hwsim_hw_xmit+0x15f4/0x1620 [ 462.865124][ C1] ? hwsim_hw_xmit+0x15f4/0x1620 [ 462.870075][ C1] __report_bug+0x276/0x570 [ 462.874574][ C1] ? arch_stack_walk+0x11b/0x150 [ 462.879512][ C1] ? hwsim_hw_xmit+0x15f4/0x1620 [ 462.884451][ C1] ? __pfx___report_bug+0x10/0x10 [ 462.889469][ C1] ? __bfs+0x153/0x290 [ 462.893529][ C1] ? __pfx_usage_match+0x10/0x10 [ 462.898476][ C1] ? __bfs+0x153/0x290 [ 462.902536][ C1] ? __pfx_hlock_conflict+0x10/0x10 [ 462.907739][ C1] ? check_path+0x21/0x40 [ 462.912063][ C1] ? hwsim_hw_xmit+0x15f4/0x1620 [ 462.916995][ C1] report_bug+0x16b/0x220 [ 462.921318][ C1] ? hwsim_hw_xmit+0x15f4/0x1620 [ 462.926245][ C1] ? hwsim_hw_xmit+0x15f6/0x1620 [ 462.931179][ C1] handle_bug+0x9c/0x200 [ 462.935415][ C1] exc_invalid_op+0x1a/0x50 [ 462.939917][ C1] asm_exc_invalid_op+0x1a/0x20 [ 462.944758][ C1] RIP: 0010:hwsim_hw_xmit+0x15f4/0x1620 [ 462.950298][ C1] Code: c6 05 53 86 24 09 01 48 c7 c7 00 5d be 8c be 0d 01 00 00 48 c7 c2 a0 5d be 8c e8 c7 5b 64 fa e9 f4 eb ff ff e8 6d b0 88 fa 90 <0f> 0b 90 e9 e1 ea ff ff 89 d9 80 e1 07 38 c1 0f 8c c6 ea ff ff 48 [ 462.969891][ C1] RSP: 0018:ffffc90000a18a60 EFLAGS: 00010246 [ 462.975960][ C1] RAX: ffffffff873f1a43 RBX: ffff888028f7ed78 RCX: ffff8880236e1f40 [ 462.983931][ C1] RDX: 0000000000000100 RSI: 0000000000000100 RDI: ffff888028f7e720 [ 462.991895][ C1] RBP: ffffc90000a18bd8 R08: ffff888028f7e6ab R09: 1ffff110051efcd5 [ 462.999863][ C1] R10: dffffc0000000000 R11: ffffffff873f0450 R12: dffffc0000000000 [ 463.007920][ C1] R13: ffff888028f7e760 R14: ffff888028f7ed20 R15: 1ffff110051efcec [ 463.015891][ C1] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 463.021016][ C1] ? hwsim_hw_xmit+0x15f3/0x1620 [ 463.025964][ C1] ? ieee802154_hold_queue+0xd1/0x3a0 [ 463.031336][ C1] ? __pfx_hwsim_hw_xmit+0x10/0x10 [ 463.036452][ C1] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 463.042261][ C1] ieee802154_tx+0x26d/0x510 [ 463.046846][ C1] ieee802154_subif_start_xmit+0x110/0x190 [ 463.052643][ C1] dev_hard_start_xmit+0x2cd/0x830 [ 463.057772][ C1] sch_direct_xmit+0x257/0x4c0 [ 463.062538][ C1] ? __pfx_sch_direct_xmit+0x10/0x10 [ 463.067823][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 463.072936][ C1] __qdisc_run+0xb11/0x1620 [ 463.077466][ C1] net_tx_action+0x7cb/0xc30 [ 463.082047][ C1] ? net_tx_action+0x5bb/0xc30 [ 463.086811][ C1] handle_softirqs+0x226/0x860 [ 463.091573][ C1] ? __irq_exit_rcu+0xcb/0x220 [ 463.096334][ C1] __irq_exit_rcu+0xcb/0x220 [ 463.100919][ C1] irq_exit_rcu+0x9/0x30 [ 463.105188][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 463.110812][ C1] [ 463.113733][ C1] [ 463.116661][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 463.122629][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 [ 463.129042][ C1] Code: f7 e8 8d d3 bb f5 f7 c3 00 02 00 00 74 05 e8 50 17 e8 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 94 e2 ac f5 65 48 8b 05 0c f1 ac 07 48 85 c0 74 18 5b 41 5e e9 [ 463.148640][ C1] RSP: 0018:ffffc90000ba7968 EFLAGS: 00000206 [ 463.154704][ C1] RAX: 0000000000000002 RBX: 0000000000000282 RCX: 0000000000000001 [ 463.162676][ C1] RDX: 0000000000000006 RSI: ffffffff8e4777a6 RDI: 0000000000000001 [ 463.170634][ C1] RBP: 0000000000000000 R08: ffffffff907a317f R09: 1ffffffff20f462f [ 463.178594][ C1] R10: dffffc0000000000 R11: fffffbfff20f4630 R12: ffff88807d2f5680 [ 463.186560][ C1] R13: ffff888028510ed0 R14: ffff888028f7e668 R15: ffff888028f7e0a0 [ 463.194565][ C1] mac802154_scan_cleanup_locked+0xc9/0x280 [ 463.200465][ C1] mac802154_scan_worker+0x775/0xe60 [ 463.205770][ C1] ? mac802154_scan_worker+0xc9/0xe60 [ 463.211146][ C1] ? __pfx_mac802154_scan_worker+0x10/0x10 [ 463.216947][ C1] ? rcu_is_watching+0x16/0xb0 [ 463.221703][ C1] ? process_scheduled_works+0x97a/0x1630 [ 463.227422][ C1] process_scheduled_works+0xc3d/0x1630 [ 463.232993][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 463.238972][ C1] ? assign_work+0x3cf/0x5d0 [ 463.243562][ C1] worker_thread+0xa47/0xfb0 [ 463.248168][ C1] kthread+0x38b/0x480 [ 463.252230][ C1] ? __pfx_worker_thread+0x10/0x10 [ 463.257335][ C1] ? __pfx_kthread+0x10/0x10 [ 463.261916][ C1] ret_from_fork+0x514/0xb70 [ 463.266500][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 463.271607][ C1] ? __switch_to+0xc89/0x1420 [ 463.276308][ C1] ? __pfx_kthread+0x10/0x10 [ 463.280890][ C1] ret_from_fork_asm+0x1a/0x30 [ 463.285665][ C1] [ 463.289004][ C1] Kernel Offset: disabled [ 463.293324][ C1] Rebooting in 86400 seconds..