last executing test programs: 23.348541474s ago: executing program 2 (id=12022): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xd, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bb000000180100002020702500000000002020207b1af8ff00"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x46, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa}, 0x94) 23.043155338s ago: executing program 2 (id=12025): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7020000ff4100007b2af8ff000000007b2af0ff000000007b2ae8ff000000007b2ae0ff000000007b2ad8ff000000007b2ad0ff000000007b2ac8ff000000007b2ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac4ff00000000180200000a0000010000000000000000632accff00000000180200000a0000020000000000000000632ac0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb70300004000"], &(0x7f00000011c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002200)={r0, 0x0, 0xe, 0x0, &(0x7f0000000080)="0000000000002d9d8aaf5dc79048", 0x0, 0x8ce3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 22.754552854s ago: executing program 2 (id=12027): r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) listen(r0, 0x5) r2 = accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) recvfrom$inet(r2, &(0x7f0000000400), 0x4000, 0xf0ff, 0x0, 0x0) 21.619418004s ago: executing program 2 (id=12036): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004000000060022"], 0x4c}}, 0x0) 21.143327787s ago: executing program 2 (id=12041): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000005a80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x605, 0x0, 0x0, {0x0, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x3c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 20.335959679s ago: executing program 2 (id=12044): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x6, 0x5, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0xc25}, [@call={0x85, 0x0, 0x0, 0x2c}, @call={0x85, 0x0, 0x0, 0xf}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x355}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r0, 0x0, 0xdc0, 0x0, &(0x7f0000000140)="410c49bc3c388e38d0da5a20564e", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 13.878163296s ago: executing program 0 (id=12076): r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0x800, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) r2 = accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) sendto$inet(r1, &(0x7f0000000300)='\x00', 0x1000, 0x40, 0x0, 0x0) 12.636509741s ago: executing program 0 (id=12084): r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) listen(r0, 0x5) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x4e24, @loopback}, 0x10) r2 = accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) recvfrom$inet(r2, &(0x7f0000000400), 0x4000, 0xf0ff, 0x0, 0x0) 11.561973259s ago: executing program 0 (id=12087): sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000002200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x2000004) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001780)=ANY=[@ANYBLOB="cc1100001900010000000000000000001d0109005000108049002100c9a7befe6f6d645a1a11b81b2c4b101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06db1a75df432aa833928a0772ff8f5e9ed32d3b477d35b296674f1fe35663c0d236fd000000681106"], 0x11cc}, 0x1, 0x0, 0x0, 0x5}, 0x0) 10.548377942s ago: executing program 0 (id=12094): r0 = socket$inet_tcp(0x2, 0x1, 0x6) r1 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0x800, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) r2 = accept$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) setsockopt$inet_tcp_TLS_RX(r2, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x303}, "1234567812345678", "12345678123456781234567812345678", "12345678", "1234567812345678"}, 0x28) sendto$inet(r1, &(0x7f0000000300)='\x00', 0x1000, 0x40, 0x0, 0x0) 9.393604063s ago: executing program 0 (id=12101): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = gettid() ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000002c0)=r1) sendto$inet(r0, &(0x7f0000000800)='5/O', 0x3, 0x1, 0x0, 0x0) 9.003610967s ago: executing program 3 (id=12104): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x806, 0xfa, 0x0, 0xe4}, {0x4, 0x3, 0x4, 0x1}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet_sctp(r0, &(0x7f0000006240)=[{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000380)="814c594d0bd78f542ea6a16cec7785d432e2f8a665a1968faa5d7b0517bec0169c184f9ad000641ab638f707ba01bd87f403d521f2c4ea80d483c6e7709d741f7525d98c7a2d029f8e6f13003417a90a9d4b3b9be5510b7e12246be2714983cb18c82b4bc716ea5f50b26463b53aa2dab41dbd7135c862ac612c19892b810ca51cc005af6bbcbc9430e06f59cf75804d62df7ecbacfa0a6c500b541c8ba3d7958fe338b7c9d9eecc39328a7cf84cf20fa0e26fc9b2a305de84", 0xb9}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20000000) sendmmsg$inet(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000980)="91f8a9849519def28691bbc4173c3d6f357d0272b7e95a136b3ffec75b73e6937b7b22a1319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000f2ffffff2e3591ceb1757de97fb25500620d0d30506e7429fa5337b74945da657f", 0x6e}], 0x1}}, {{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000880)="b527ce144a9e865255e6f85f4d18156225c3396c992b47cedd740a6a6c3c82aba6b56bd441a6dd0856d664fb959853821ce9917ed023550816ba4b21413e5e7c41c7e2197da810d26109c4572ec3dfb28073599772cf3e04b596b22fce7db25609f21c6da4db35a48c20cdfa45", 0x6d}, {&(0x7f0000002300)="27cb1547d73d51c2b9eb909bbb859214eabfa995b909a5faccc33d38140dc15d080af6eaf18b2031f0c88867e93763c3466f13a7e1c71f9b7ed9652a901d80e85e1ba265a9837970a9a20940b0208fa916a034be9eb50defe37271f579ecbb2f7e6157f8bac11e6657ddcd368291be85f6fbe3696d907770e9214e33190c4f9d0a048b2442a7dde887cf7c3f2e7fca619e0f1717850a65d661e72c55a293a7e4332309066fc4e40951535235d7a51b3c1bdfc5996f817e817caf5d035e24b79089ab10bf1a15448774f85810bb5276a5f49c64823fa5472ce8f93627cf3e8e24e23437c78443fdbf5127970b5b11290ccf407f1ebc06f0fe54a6770bfd5c806f22b890b75e2844cc77696eb115f1be20312044be6b0aeab130a9ce0abcbf038afdb2575cb3943d77d0e6c0f217730d8aec201b7d235d1ffb7608a3f1f73b72af1a58c709e420f5a882c9089df362e595e1bac2da54764ebe798db45e81e9b33878bdc0f7ecf1b657c2b8f4d1d2ed1e", 0x16f}], 0x2}}], 0x2, 0x2090) 8.303411203s ago: executing program 0 (id=12108): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="000086dd0203050009000a004000683739ed112889fffe8000000000000000000000000000aaff020000000000000000000000000001"], 0xfdef) 7.79475943s ago: executing program 3 (id=12111): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f00000004c0)=0x7d, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) sendmmsg$inet(r0, &(0x7f0000004480)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="4e871eb7", 0x4}], 0x1}}], 0x1, 0x4005) 6.474762558s ago: executing program 3 (id=12120): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000c80)={0xe8, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x74, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @rand_addr=0x64010101}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}]}, @CTA_EXPECT_NAT={0x60, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @mcast2}}}]}, @CTA_EXPECT_NAT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @broadcast}, {0x8, 0x2, @empty}}}]}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 4.690876579s ago: executing program 1 (id=12128): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000002280)={0x3, &(0x7f0000000180)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x8, 0xfffff010}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 4.470041391s ago: executing program 1 (id=12129): sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000002200)={0x0, 0x0, &(0x7f00000021c0)={0x0}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000004) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001780)=ANY=[@ANYBLOB="cc1100001900010000000000000000001d0109005000108049002100c9a7befe6f6d645a1a11b81b2c4b101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06db1a75df432aa833928a0772ff8f5e9ed32d3b477d35b296674f1fe35663c0d236fd000000681106"], 0x11cc}, 0x1, 0x0, 0x0, 0x5}, 0x0) 1.775789361s ago: executing program 1 (id=12131): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f0000000300)="89", 0x1, 0x4044880, 0x0, 0x0) 1.768031673s ago: executing program 3 (id=12132): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xa, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x8, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r1, &(0x7f0000000000), &(0x7f0000000200)=""/157}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2, r0}, 0xc) 1.45388978s ago: executing program 4 (id=12133): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000}, [@call={0x85, 0x0, 0x0, 0x87}, @call={0x85, 0x0, 0x0, 0x2a}]}, &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xd, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5b", 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.396158064s ago: executing program 3 (id=12134): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000700850000002d"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 1.241170866s ago: executing program 1 (id=12135): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000100000000000000000000008500000087000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8c9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 1.142171653s ago: executing program 4 (id=12136): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005500)={0x0, 0x0, &(0x7f00000054c0)={&(0x7f00000016c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x55fdd7e50386e5c2}}, [@NFT_MSG_DELTABLE={0x20, 0x2, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSETELEM={0x108, 0xe, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0xf4, 0x3, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_EXPRESSIONS={0x4}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @redir={{0xa}, @void}}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1}]}, {0xac, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0xa8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa1, 0x1, "5609a4bfe10f2f993959b1a2a7e724c61d87534f1e187f6459d7137701bb74f0dd21a84f6469d64c1c761377b1d8b8552070792f9a42c0a1836c8d59e3f1f331bcd96f5ec9f24408a27bd67d5363340d0f7f04e148cc721f18d8bebf6d84dc34e28066bc0764f0e0c5427383a8a4685554897fe5935d656b82cc045d901d2b7394602ae7b5c60ecf537105df0d0d630a64796a44fe486e8618456b6dfd"}]}]}, {0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x4}]}]}]}, @NFT_MSG_DELSETELEM={0x14, 0xe, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x164}, 0x1, 0x0, 0x0, 0x4004800}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3cd2e7b3d6526bf5}}}, 0x68}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001640)="5346f7f875528ef24043c68e04180a332e94ee4784fffee263c06f2d924e8699b6af71aa257b5a316af31628e5148c7012f4d55ce4c29fea9e5b0b61fdf0b2dc866fa81b4e775e235eaebe330e16114548f147b8a966bf1f1fc6c24b9d47d349c87c3f789d2ba608cd25b17b6c80a7f0ce", 0x71}, {0x0}, {&(0x7f0000000e40), 0x6000}], 0x3}, 0x800) 1.04655787s ago: executing program 3 (id=12137): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r1, &(0x7f00000000c0)="1c", 0x10002, 0xf5, 0x0, 0x0) 828.652139ms ago: executing program 1 (id=12138): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000020000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec004a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) 732.480236ms ago: executing program 4 (id=12139): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x1b32, 0x4) sendto$inet(r0, &(0x7f0000000180)='!', 0x1, 0x448c4, 0x0, 0x0) recvmmsg(r0, &(0x7f0000007ac0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=""/73, 0x49}, 0x8}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001300)=""/208, 0xd0}, 0xc}], 0x2, 0x2141, 0x0) 498.5212ms ago: executing program 4 (id=12140): socket$inet6_udp(0xa, 0x2, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000540)={@random="5b685c7e778f", @multicast, @void, {@ipv6={0x86dd, @udp={0xa, 0x6, '\x00', 0x64, 0x11, 0x0, @local, @mcast2, {[], {0x4e1d, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x2, 0x1, "2e46c1c5274bfad707406bd51cb60bf33c125f4cf999196aa6cefa7be0886490", "2bea6a9d710cbcec5e65a090c11d7317", {"0e8016d6bdca858c164744fb8b6005b5", "bc30e337b7acddad3b22de49438a1f39"}}}}}}}}, 0x0) 243.069582ms ago: executing program 1 (id=12141): sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000002200)={0x0, 0x0, &(0x7f00000021c0)={&(0x7f0000000380)=@newchain={0x24, 0x64, 0x400, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x1, 0x9}, {0xc, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000004) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001780)=ANY=[@ANYBLOB="cc1100001900010000000000000000001d0109005000108049002100c9a7befe6f6d645a1a11b81b2c4b101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06db1a75df432aa833928a0772ff8f5e9ed32d3b477d35b296674f1fe35663c0d236fd000000681106"], 0x11cc}, 0x1, 0x0, 0x0, 0x5}, 0x0) 226.298055ms ago: executing program 4 (id=12142): recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="5c00000015006b0300224ed86e6c1d0002117ea6e070d6064e22000300000002250002000f00000017d34460bc24eab556a705251e6182949a00003d3b48dfd8cdbf9767b4fa51f62a64c9f4060046d88037e786a6d0a5d700000017", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 0s ago: executing program 4 (id=12143): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c00028008000140000000ffffffff800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006c6173740000000004b6028008000340"], 0xe4}}, 0x8002) kernel console output (not intermixed with test programs): 757] netlink: 26 bytes leftover after parsing attributes in process `syz.4.10943'. [ 1513.254780][T15762] netlink: 100 bytes leftover after parsing attributes in process `syz.3.10946'. [ 1513.274964][T15762] netlink: 239 bytes leftover after parsing attributes in process `syz.3.10946'. [ 1513.611528][T15771] syzkaller0: entered promiscuous mode [ 1513.650149][T15771] syzkaller0: entered allmulticast mode [ 1513.719924][T15778] Cannot find set identified by id 65534 to match [ 1514.275416][T15792] syzkaller0: entered promiscuous mode [ 1514.303207][T15792] syzkaller0: entered allmulticast mode [ 1515.602753][T15816] tipc: Resetting bearer [ 1515.616569][T15831] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10970'. [ 1515.873302][T15834] netlink: 'syz.4.10971': attribute type 1 has an invalid length. [ 1515.882383][T15816] net_ratelimit: 19 callbacks suppressed [ 1515.882414][T15816] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1516.001462][T12955] bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex [ 1516.022112][T12955] bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex [ 1516.065469][T12955] bond0: (slave syz_tun): link status definitely up, 10000 Mbps full duplex [ 1516.097087][T12955] bond0: active interface up! [ 1516.120409][ T5714] lo speed is unknown, defaulting to 1000 [ 1516.157960][ T5714] syz0: Port: 1 Link ACTIVE [ 1516.282331][T15832] bond85: (slave ip6tnl3): The slave device specified does not support setting the MAC address [ 1516.371708][T15832] bond85: (slave ip6tnl3): Error -95 calling set_mac_address [ 1516.419588][T15834] workqueue: Failed to create a rescuer kthread for wq "bond79": -EINTR [ 1516.556049][T15844] syzkaller0: entered promiscuous mode [ 1516.581579][T15844] syzkaller0: entered allmulticast mode [ 1516.685542][T15849] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10977'. [ 1516.803528][T15855] netlink: Conntrack attr has 4 unknown bytes [ 1516.819816][T15856] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10978'. [ 1516.860746][T15855] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1516.884857][T15849] hsr_slave_0: left promiscuous mode [ 1516.894940][T15849] hsr_slave_1: left promiscuous mode [ 1516.932498][T15856] hsr_slave_0: left promiscuous mode [ 1517.095099][T15858] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10979'. [ 1517.481733][T15869] netlink: 32 bytes leftover after parsing attributes in process `syz.1.10982'. [ 1517.562463][T15876] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10985'. [ 1517.612919][T15879] IPVS: set_ctl: invalid protocol: 51 172.30.1.4:20000 [ 1518.071231][T15886] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10989'. [ 1518.087221][T15888] syzkaller0: entered promiscuous mode [ 1518.119934][T15890] netlink: 1 bytes leftover after parsing attributes in process `syz.2.10989'. [ 1518.131744][T15888] syzkaller0: entered allmulticast mode [ 1518.701603][T15909] openvswitch: netlink: Key 6 has unexpected len 59 expected 2 [ 1518.927472][T15913] Cannot find set identified by id 65534 to match [ 1518.973986][T15915] netlink: 184 bytes leftover after parsing attributes in process `syz.3.10997'. [ 1519.407906][T15926] ip6tnl5: entered allmulticast mode [ 1519.421676][T15929] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11003'. [ 1520.282860][T15954] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11011'. [ 1520.429380][T15958] bond30: (slave gretap0): Releasing active interface [ 1520.471023][T15963] openvswitch: netlink: Key type 262 is out of range max 32 [ 1520.564365][T15958] bond70: (slave erspan0): Releasing active interface [ 1520.710052][T15958] bond0: (slave syz_tun): Releasing backup interface [ 1520.765931][T15958] bond25: (slave bond0): Releasing active interface [ 1520.797740][T15958] bond41: (slave team0): Releasing active interface [ 1520.830893][T15958] bond0: (slave bond_slave_0): Releasing backup interface [ 1520.840794][T15972] Cannot find set identified by id 65534 to match [ 1520.869373][T15958] bond0: (slave bond_slave_1): Releasing backup interface [ 1520.912058][T15958] team0: Port device team_slave_0 removed [ 1520.943446][T15958] team0: Port device team_slave_1 removed [ 1520.964507][T15958] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1520.989603][T15958] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1521.014800][T15958] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 1521.026882][T15958] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 1521.034097][T15958] bridge0: port 1(wlan1) entered disabled state [ 1521.055768][T15958] bond12: (slave gretap1): Releasing active interface [ 1521.079785][T15959] team0: Port device xfrm0 added [ 1521.085488][T15962] tipc: Enabled bearer , priority 0 [ 1521.388367][T15990] ip_tables: iptables: counters copy to user failed while replacing table [ 1521.815951][T16007] Cannot find set identified by id 65534 to match [ 1521.827952][T16006] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 1521.851505][T16010] __nla_validate_parse: 1 callbacks suppressed [ 1521.851525][T16010] netlink: 180 bytes leftover after parsing attributes in process `syz.2.11031'. [ 1521.889020][T16006] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 1521.976739][T16006] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 1522.354295][T16030] netlink: 'syz.0.11037': attribute type 3 has an invalid length. [ 1522.655140][T16037] openvswitch: netlink: Key 6 has unexpected len 59 expected 2 [ 1522.767625][T16043] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11043'. [ 1522.819068][T16044] tc_dump_action: action bad kind [ 1522.894865][T16043] bond81: (slave erspan0): Releasing active interface [ 1523.075573][T16043] bond39: (slave bond0): Releasing active interface [ 1523.124852][T16043] bond67: (slave ): Releasing active interface [ 1523.152538][T16043] bond74: (slave veth0_to_bond): Releasing backup interface [ 1523.181519][T16043] batman_adv: batadv0: Removing interface: vlan2 [ 1523.212803][T16043] batman_adv: batadv0: Removing interface: macsec1 [ 1523.293344][T16043] bond73: (slave geneve2): Releasing active interface [ 1523.426314][T16043] bond79: (slave ipip3): Releasing backup interface [ 1523.453014][T16043] ipip3: left promiscuous mode [ 1523.617591][T12961] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1523.659959][T12961] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1523.717764][T12961] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1523.947716][T16067] syzkaller0: entered promiscuous mode [ 1523.981284][T16067] syzkaller0: entered allmulticast mode [ 1524.228073][T16098] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11048'. [ 1524.364069][T16100] netlink: 'syz.4.11052': attribute type 3 has an invalid length. [ 1527.678364][T12954] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1527.955739][T16127] netlink: 36 bytes leftover after parsing attributes in process `syz.3.11056'. [ 1528.033122][T16129] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11057'. [ 1528.734063][T16151] netlink: 'syz.1.11065': attribute type 5 has an invalid length. [ 1528.770437][T16151] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11065'. [ 1528.987235][T16166] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11067'. [ 1529.331137][T16165] syzkaller0: entered promiscuous mode [ 1529.350652][T16165] syzkaller0: entered allmulticast mode [ 1530.445744][T16193] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11077'. [ 1532.982336][T16173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11071'. [ 1533.162666][T16198] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 1533.270193][T16205] netlink: 'syz.0.11081': attribute type 3 has an invalid length. [ 1533.335890][T16208] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11082'. [ 1533.430958][T16211] bridge0: port 1(veth0) entered blocking state [ 1533.450428][T16213] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11084'. [ 1533.455748][T16211] bridge0: port 1(veth0) entered disabled state [ 1533.485682][T16211] veth0: entered allmulticast mode [ 1533.510822][T16211] veth0: entered promiscuous mode [ 1533.570924][T16214] bridge0: port 2(veth1) entered blocking state [ 1533.596683][T16214] bridge0: port 2(veth1) entered disabled state [ 1533.617011][T16214] veth1: entered allmulticast mode [ 1533.885701][T16226] openvswitch: netlink: Key 6 has unexpected len 59 expected 2 [ 1534.121338][T16236] nbd: socks must be embedded in a SOCK_ITEM attr [ 1534.240837][T16241] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 1534.412324][T16245] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11096'. [ 1534.597184][T16253] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11097'. [ 1534.730217][T16255] syzkaller0: entered promiscuous mode [ 1534.754656][T16255] syzkaller0: entered allmulticast mode [ 1534.838631][T16255] IPv6: sit2: Disabled Multicast RS [ 1534.878788][T16261] netlink: 'syz.3.11100': attribute type 13 has an invalid length. [ 1534.925118][T16261] netlink: 'syz.3.11100': attribute type 17 has an invalid length. [ 1535.112146][T16269] netlink: 'syz.4.11104': attribute type 1 has an invalid length. [ 1535.233842][T16270] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1535.262776][T16261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1535.294680][T16261] 8021q: adding VLAN 0 to HW filter on device team0 [ 1535.324243][T16261] : left promiscuous mode [ 1535.480574][T16261] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1535.670849][T16282] netlink: 'syz.0.11106': attribute type 3 has an invalid length. [ 1535.707133][T16282] netlink: 'syz.0.11106': attribute type 1 has an invalid length. [ 1535.741091][T16282] netlink: 196 bytes leftover after parsing attributes in process `syz.0.11106'. [ 1535.773241][T16285] netlink: 'syz.4.11109': attribute type 3 has an invalid length. [ 1535.784290][T16282] NCSI netlink: No device for ifindex 0 [ 1536.218940][T16300] pim6reg: left allmulticast mode [ 1536.389024][T16303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11113'. [ 1536.667861][T16315] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11118'. [ 1536.695602][T16318] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11119'. [ 1536.711913][T16315] netlink: 'syz.4.11118': attribute type 1 has an invalid length. [ 1536.742595][T16315] netlink: 'syz.4.11118': attribute type 2 has an invalid length. [ 1537.335923][T16345] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1537.692772][T16339] syzkaller0: entered promiscuous mode [ 1537.713396][T16339] syzkaller0: entered allmulticast mode [ 1538.341917][T16383] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11135'. [ 1538.581294][T16392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11134'. [ 1541.199277][ T4973] udevd[4973]: worker [11413] /devices/virtual/block/nbd1 timeout; kill it [ 1541.221254][ T4973] udevd[4973]: seq 39838 '/devices/virtual/block/nbd1' killed [ 1542.711121][ T25] block nbd1: Possible stuck request ffff888027135080: control (read@0,1024B). Runtime 210 seconds [ 1542.722089][ T25] block nbd1: Possible stuck request ffff888027135240: control (read@1024,1024B). Runtime 210 seconds [ 1542.740864][ T25] block nbd1: Possible stuck request ffff888027135400: control (read@2048,1024B). Runtime 210 seconds [ 1542.752010][ T25] block nbd1: Possible stuck request ffff8880271355c0: control (read@3072,1024B). Runtime 210 seconds [ 1543.299021][T16438] netlink: 'syz.3.11142': attribute type 4 has an invalid length. [ 1543.355635][T16441] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11138'. [ 1543.890656][T16466] netlink: 'syz.2.11146': attribute type 16 has an invalid length. [ 1544.322787][T16483] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11149'. [ 1544.815060][T16501] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11151'. [ 1545.075953][T16509] netlink: 168 bytes leftover after parsing attributes in process `syz.3.11153'. [ 1545.703139][T16530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11157'. [ 1545.937960][T16542] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11159'. [ 1546.548314][T16551] Cannot find set identified by id 65534 to match [ 1546.805271][T16567] xt_bpf: check failed: parse error [ 1547.085574][T16580] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11166'. [ 1548.286355][T16627] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11172'. [ 1548.783570][T16644] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11178'. [ 1549.312225][T16661] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11183'. [ 1549.545279][T16678] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11186'. [ 1549.643186][T16669] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11186'. [ 1550.034342][T16687] netlink: 44 bytes leftover after parsing attributes in process `syz.1.11187'. [ 1550.232535][T16690] netlink: 144 bytes leftover after parsing attributes in process `syz.2.11188'. [ 1550.555087][T16700] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11190'. [ 1550.613201][T12162] udevd[12162]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1550.671332][T16699] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1550.821068][T16700] bond63: (slave macvlan2): Releasing active interface [ 1551.154980][T16714] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11196'. [ 1551.178034][T16711] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11194'. [ 1551.199401][T16711] netlink: 'syz.4.11194': attribute type 1 has an invalid length. [ 1551.554185][T16728] FAULT_INJECTION: forcing a failure. [ 1551.554185][T16728] name failslab, interval 1, probability 0, space 0, times 0 [ 1551.576931][T16726] syzkaller0: entered promiscuous mode [ 1551.584289][T16726] syzkaller0: entered allmulticast mode [ 1551.590599][T16728] CPU: 1 UID: 0 PID: 16728 Comm: syz.1.11200 Not tainted syzkaller #0 PREEMPT(full) [ 1551.590627][T16728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1551.590640][T16728] Call Trace: [ 1551.590649][T16728] [ 1551.590659][T16728] dump_stack_lvl+0xe8/0x150 [ 1551.590698][T16728] should_fail_ex+0x40c/0x560 [ 1551.590727][T16728] should_failslab+0xa8/0x100 [ 1551.590760][T16728] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 1551.590786][T16728] ? skb_clone+0x212/0x3a0 [ 1551.590815][T16728] ? skb_clone+0x212/0x3a0 [ 1551.590846][T16728] skb_clone+0x212/0x3a0 [ 1551.590874][T16728] __netlink_deliver_tap+0x413/0x860 [ 1551.590914][T16728] ? netlink_deliver_tap+0x2e/0x1b0 [ 1551.590941][T16728] netlink_deliver_tap+0x19c/0x1b0 [ 1551.590966][T16728] netlink_unicast+0x77f/0x940 [ 1551.591001][T16728] netlink_sendmsg+0x813/0xb40 [ 1551.591038][T16728] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1551.591068][T16728] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1551.591106][T16728] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1551.591130][T16728] sock_sendmsg_nosec+0x13a/0x180 [ 1551.591162][T16728] ____sys_sendmsg+0x54e/0x850 [ 1551.591192][T16728] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1551.591227][T16728] ? import_iovec+0x73/0xa0 [ 1551.591268][T16728] ___sys_sendmsg+0x2a5/0x360 [ 1551.591290][T16728] ? __lock_acquire+0x683/0x2cf0 [ 1551.591324][T16728] ? __pfx____sys_sendmsg+0x10/0x10 [ 1551.591407][T16728] ? __fget_files+0x2a/0x420 [ 1551.591434][T16728] ? __fget_files+0x3a2/0x420 [ 1551.591473][T16728] __x64_sys_sendmsg+0x1b1/0x290 [ 1551.591502][T16728] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1551.591558][T16728] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1551.591582][T16728] do_syscall_64+0x174/0x580 [ 1551.591615][T16728] ? trace_irq_disable+0x3b/0x140 [ 1551.591642][T16728] ? clear_bhb_loop+0x70/0xc0 [ 1551.591668][T16728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1551.591690][T16728] RIP: 0033:0x7fe28099e0d9 [ 1551.591710][T16728] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1551.591729][T16728] RSP: 002b:00007fe281873028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1551.591752][T16728] RAX: ffffffffffffffda RBX: 00007fe280c25fa0 RCX: 00007fe28099e0d9 [ 1551.591768][T16728] RDX: 000000000000c000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1551.591782][T16728] RBP: 00007fe281873090 R08: 0000000000000000 R09: 0000000000000000 [ 1551.591795][T16728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1551.591807][T16728] R13: 00007fe280c26038 R14: 00007fe280c25fa0 R15: 00007ffd389d3778 [ 1551.591842][T16728] [ 1551.886861][T16726] TC_ACT_REPEAT abuse ? [ 1551.973130][T16733] netlink: 44 bytes leftover after parsing attributes in process `syz.3.11201'. [ 1552.242206][T16743] pim6reg: entered allmulticast mode [ 1552.282185][T16743] pim6reg: left allmulticast mode [ 1552.792148][T16761] bridge0: port 1(veth0) entered blocking state [ 1552.862846][T16761] bridge0: port 1(veth0) entered disabled state [ 1552.875747][T16761] veth0: entered allmulticast mode [ 1552.908913][T16761] veth0: entered promiscuous mode [ 1552.941520][T16764] bridge0: port 2(veth1) entered blocking state [ 1552.961583][T16764] bridge0: port 2(veth1) entered disabled state [ 1552.988424][T16764] veth1: entered allmulticast mode [ 1553.050371][T16764] veth1: entered promiscuous mode [ 1553.161067][T16782] bond41: (slave team0): Releasing active interface [ 1553.286934][T16782] team0 (unregistering): Port device team_slave_0 removed [ 1553.409411][T16790] netlink: 'syz.4.11218': attribute type 1 has an invalid length. [ 1553.428181][T16782] team0 (unregistering): Port device team_slave_1 removed [ 1553.560860][T16790] 8021q: adding VLAN 0 to HW filter on device bond79 [ 1553.610369][T16793] bond76: (slave erspan0): Releasing active interface [ 1553.695614][T16793] bond79: (slave erspan0): making interface the new active one [ 1553.731980][T16793] bond79: (slave erspan0): Enslaving as an active interface with an up link [ 1554.408528][T16799] pim6reg: entered allmulticast mode [ 1554.414356][T16800] pim6reg: left allmulticast mode [ 1554.789810][T16819] netlink: 'syz.3.11228': attribute type 2 has an invalid length. [ 1554.876742][T16824] __nla_validate_parse: 4 callbacks suppressed [ 1554.876760][T16824] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11226'. [ 1554.969966][T16824] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11226'. [ 1555.785453][T12162] udevd[12162]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1556.177915][T16865] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11237'. [ 1556.207183][T16865] FAULT_INJECTION: forcing a failure. [ 1556.207183][T16865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1556.248569][T16865] CPU: 1 UID: 0 PID: 16865 Comm: syz.2.11237 Not tainted syzkaller #0 PREEMPT(full) [ 1556.248599][T16865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1556.248613][T16865] Call Trace: [ 1556.248621][T16865] [ 1556.248632][T16865] dump_stack_lvl+0xe8/0x150 [ 1556.248669][T16865] should_fail_ex+0x40c/0x560 [ 1556.248726][T16865] _copy_from_user+0x2d/0xb0 [ 1556.248759][T16865] kstrtouint_from_user+0xd6/0x180 [ 1556.248788][T16865] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1556.248833][T16865] proc_fail_nth_write+0x8e/0x210 [ 1556.248866][T16865] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1556.248905][T16865] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1556.248939][T16865] vfs_write+0x296/0xba0 [ 1556.248995][T16865] ? __pfx_vfs_write+0x10/0x10 [ 1556.249029][T16865] ? __fget_files+0x2a/0x420 [ 1556.249062][T16865] ? __fget_files+0x3a2/0x420 [ 1556.249088][T16865] ? __fget_files+0x2a/0x420 [ 1556.249125][T16865] ksys_write+0x150/0x270 [ 1556.249160][T16865] ? __pfx_ksys_write+0x10/0x10 [ 1556.249201][T16865] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1556.249226][T16865] do_syscall_64+0x174/0x580 [ 1556.249257][T16865] ? trace_irq_disable+0x3b/0x140 [ 1556.249284][T16865] ? clear_bhb_loop+0x70/0xc0 [ 1556.249311][T16865] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1556.249333][T16865] RIP: 0033:0x7f68c8b5e90e [ 1556.249354][T16865] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1556.249372][T16865] RSP: 002b:00007f68c9af5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1556.249396][T16865] RAX: ffffffffffffffda RBX: 00007f68c9af66c0 RCX: 00007f68c8b5e90e [ 1556.249412][T16865] RDX: 0000000000000001 RSI: 00007f68c9af60a0 RDI: 0000000000000005 [ 1556.249427][T16865] RBP: 00007f68c9af6090 R08: 0000000000000000 R09: 0000000000000000 [ 1556.249441][T16865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1556.249454][T16865] R13: 00007f68c8e26038 R14: 00007f68c8e25fa0 R15: 00007fffb89899c8 [ 1556.249490][T16865] [ 1556.961093][T16869] pim6reg: entered allmulticast mode [ 1557.005367][T16877] pim6reg: left allmulticast mode [ 1557.035184][T16875] Cannot find set identified by id 65534 to match [ 1557.078492][T16879] xt_bpf: check failed: parse error [ 1557.538600][T16888] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11245'. [ 1557.625080][T16888] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11245'. [ 1557.721780][T16898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11249'. [ 1557.799631][T16898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11249'. [ 1557.809612][T16898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11249'. [ 1557.816338][T16888] netlink: 296 bytes leftover after parsing attributes in process `syz.4.11245'. [ 1557.833789][T16898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11249'. [ 1558.453717][T11416] udevd[11416]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1558.584277][T16922] pim6reg: entered allmulticast mode [ 1558.622685][T16926] pim6reg: left allmulticast mode [ 1558.814225][T16935] netlink: 'syz.1.11260': attribute type 1 has an invalid length. [ 1558.891504][T12952] tipc: Subscription rejected, illegal request [ 1559.074338][T16935] 8021q: adding VLAN 0 to HW filter on device bond70 [ 1560.260757][T16972] __nla_validate_parse: 10 callbacks suppressed [ 1560.260783][T16972] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11269'. [ 1560.330633][T16967] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11272'. [ 1560.496000][T16979] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11271'. [ 1560.673085][T16985] xt_bpf: check failed: parse error [ 1560.890195][T16987] pim6reg: entered allmulticast mode [ 1560.960907][T16991] pim6reg: left allmulticast mode [ 1560.995573][T16996] netlink: 36 bytes leftover after parsing attributes in process `syz.3.11276'. [ 1561.027317][T12162] udevd[12162]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1561.247930][T17000] syzkaller0: entered promiscuous mode [ 1561.273712][T17000] syzkaller0: entered allmulticast mode [ 1561.339545][T17000] TC_ACT_REPEAT abuse ? [ 1562.155955][T17032] xt_l2tp: wrong L2TP version: 0 [ 1562.191084][T17038] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11286'. [ 1562.601686][T17047] pim6reg: entered allmulticast mode [ 1562.658715][T17047] pim6reg: left allmulticast mode [ 1562.737500][T17044] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11290'. [ 1562.783538][T17050] netlink: 196 bytes leftover after parsing attributes in process `syz.4.11290'. [ 1563.191700][T17066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11297'. [ 1563.214374][T17066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11297'. [ 1563.315110][T17066] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11297'. [ 1563.815188][T17087] pim6reg: entered allmulticast mode [ 1563.863511][T17090] FAULT_INJECTION: forcing a failure. [ 1563.863511][T17090] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1563.897043][T17087] pim6reg: left allmulticast mode [ 1563.927225][T17090] CPU: 1 UID: 0 PID: 17090 Comm: syz.2.11308 Not tainted syzkaller #0 PREEMPT(full) [ 1563.927256][T17090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1563.927271][T17090] Call Trace: [ 1563.927280][T17090] [ 1563.927291][T17090] dump_stack_lvl+0xe8/0x150 [ 1563.927329][T17090] should_fail_ex+0x40c/0x560 [ 1563.927367][T17090] _copy_to_user+0x31/0xb0 [ 1563.927402][T17090] simple_read_from_buffer+0xe1/0x170 [ 1563.927438][T17090] proc_fail_nth_read+0x1bb/0x230 [ 1563.927474][T17090] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1563.927521][T17090] ? rw_verify_area+0x24a/0x4c0 [ 1563.927556][T17090] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1563.927585][T17090] vfs_read+0x213/0xa80 [ 1563.927622][T17090] ? __pfx___mutex_lock+0x10/0x10 [ 1563.927655][T17090] ? __pfx_vfs_read+0x10/0x10 [ 1563.927688][T17090] ? __fget_files+0x2a/0x420 [ 1563.927721][T17090] ? __fget_files+0x3a2/0x420 [ 1563.927765][T17090] ? __fget_files+0x2a/0x420 [ 1563.927804][T17090] ksys_read+0x150/0x270 [ 1563.927839][T17090] ? __pfx_ksys_read+0x10/0x10 [ 1563.927870][T17090] ? __pfx_sock_ioctl+0x10/0x10 [ 1563.927906][T17090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1563.927932][T17090] do_syscall_64+0x174/0x580 [ 1563.927963][T17090] ? trace_irq_disable+0x3b/0x140 [ 1563.927991][T17090] ? clear_bhb_loop+0x70/0xc0 [ 1563.928019][T17090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1563.928043][T17090] RIP: 0033:0x7f68c8b5e90e [ 1563.928076][T17090] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1563.928094][T17090] RSP: 002b:00007f68c9af5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1563.928117][T17090] RAX: ffffffffffffffda RBX: 00007f68c9af66c0 RCX: 00007f68c8b5e90e [ 1563.928133][T17090] RDX: 000000000000000f RSI: 00007f68c9af60a0 RDI: 0000000000000004 [ 1563.928147][T17090] RBP: 00007f68c9af6090 R08: 0000000000000000 R09: 0000000000000000 [ 1563.928160][T17090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1563.928173][T17090] R13: 00007f68c8e26038 R14: 00007f68c8e25fa0 R15: 00007fffb89899c8 [ 1563.928210][T17090] [ 1564.702272][T17114] netlink: 'syz.3.11314': attribute type 1 has an invalid length. [ 1565.098908][T17114] 8021q: adding VLAN 0 to HW filter on device bond74 [ 1565.528351][T17147] FAULT_INJECTION: forcing a failure. [ 1565.528351][T17147] name failslab, interval 1, probability 0, space 0, times 0 [ 1565.572947][T17147] CPU: 0 UID: 0 PID: 17147 Comm: syz.3.11321 Not tainted syzkaller #0 PREEMPT(full) [ 1565.572977][T17147] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1565.572991][T17147] Call Trace: [ 1565.573000][T17147] [ 1565.573010][T17147] dump_stack_lvl+0xe8/0x150 [ 1565.573046][T17147] should_fail_ex+0x40c/0x560 [ 1565.573075][T17147] should_failslab+0xa8/0x100 [ 1565.573106][T17147] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1565.573130][T17147] ? preempt_schedule_common+0x82/0xd0 [ 1565.573163][T17147] ? preempt_schedule_thunk+0x16/0x40 [ 1565.573184][T17147] ? __alloc_skb+0x1d7/0x7a0 [ 1565.573204][T17147] ? __alloc_skb+0x1d7/0x7a0 [ 1565.573231][T17147] __alloc_skb+0x1d7/0x7a0 [ 1565.573256][T17147] netlink_sendmsg+0x5d4/0xb40 [ 1565.573294][T17147] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1565.573325][T17147] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1565.573363][T17147] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1565.573388][T17147] sock_sendmsg_nosec+0x13a/0x180 [ 1565.573421][T17147] ____sys_sendmsg+0x54e/0x850 [ 1565.573451][T17147] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1565.573485][T17147] ? import_iovec+0x73/0xa0 [ 1565.573519][T17147] ___sys_sendmsg+0x2a5/0x360 [ 1565.573541][T17147] ? __lock_acquire+0x683/0x2cf0 [ 1565.573575][T17147] ? __pfx____sys_sendmsg+0x10/0x10 [ 1565.573639][T17147] ? __fget_files+0x2a/0x420 [ 1565.573666][T17147] ? __fget_files+0x3a2/0x420 [ 1565.573710][T17147] __x64_sys_sendmsg+0x1b1/0x290 [ 1565.573737][T17147] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1565.573779][T17147] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.573802][T17147] do_syscall_64+0x174/0x580 [ 1565.573833][T17147] ? trace_irq_disable+0x3b/0x140 [ 1565.573858][T17147] ? clear_bhb_loop+0x70/0xc0 [ 1565.573885][T17147] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.573906][T17147] RIP: 0033:0x7f019fb9e0d9 [ 1565.573927][T17147] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1565.573945][T17147] RSP: 002b:00007f01a09da028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1565.573968][T17147] RAX: ffffffffffffffda RBX: 00007f019fe26090 RCX: 00007f019fb9e0d9 [ 1565.573984][T17147] RDX: 0000000004048814 RSI: 0000200000000380 RDI: 0000000000000005 [ 1565.573999][T17147] RBP: 00007f01a09da090 R08: 0000000000000000 R09: 0000000000000000 [ 1565.574012][T17147] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1565.574025][T17147] R13: 00007f019fe26128 R14: 00007f019fe26090 R15: 00007ffce250a038 [ 1565.574060][T17147] [ 1566.013029][T12162] udevd[12162]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1566.051764][T17154] __nla_validate_parse: 17 callbacks suppressed [ 1566.051783][T17154] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11325'. [ 1566.178370][T17154] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11325'. [ 1566.299316][T17162] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1566.441822][T17165] netlink: 'syz.0.11330': attribute type 3 has an invalid length. [ 1567.124042][T17185] FAULT_INJECTION: forcing a failure. [ 1567.124042][T17185] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1567.148455][T17183] netlink: 292 bytes leftover after parsing attributes in process `syz.0.11336'. [ 1567.159666][T17185] CPU: 1 UID: 0 PID: 17185 Comm: syz.1.11337 Not tainted syzkaller #0 PREEMPT(full) [ 1567.159694][T17185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1567.159707][T17185] Call Trace: [ 1567.159716][T17185] [ 1567.159726][T17185] dump_stack_lvl+0xe8/0x150 [ 1567.159761][T17185] should_fail_ex+0x40c/0x560 [ 1567.159791][T17185] _copy_from_user+0x2d/0xb0 [ 1567.159821][T17185] ___sys_sendmsg+0x1c6/0x360 [ 1567.159846][T17185] ? __lock_acquire+0x683/0x2cf0 [ 1567.159879][T17185] ? __pfx____sys_sendmsg+0x10/0x10 [ 1567.159943][T17185] ? __fget_files+0x2a/0x420 [ 1567.159976][T17185] ? __fget_files+0x3a2/0x420 [ 1567.160015][T17185] __x64_sys_sendmsg+0x1b1/0x290 [ 1567.160042][T17185] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1567.160091][T17185] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.160117][T17185] do_syscall_64+0x174/0x580 [ 1567.160149][T17185] ? trace_irq_disable+0x3b/0x140 [ 1567.160175][T17185] ? clear_bhb_loop+0x70/0xc0 [ 1567.160203][T17185] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.160224][T17185] RIP: 0033:0x7fe28099e0d9 [ 1567.160245][T17185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1567.160264][T17185] RSP: 002b:00007fe281873028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1567.160287][T17185] RAX: ffffffffffffffda RBX: 00007fe280c25fa0 RCX: 00007fe28099e0d9 [ 1567.160303][T17185] RDX: 0000000000080000 RSI: 0000200000000400 RDI: 0000000000000003 [ 1567.160317][T17185] RBP: 00007fe281873090 R08: 0000000000000000 R09: 0000000000000000 [ 1567.160330][T17185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1567.160343][T17185] R13: 00007fe280c26038 R14: 00007fe280c25fa0 R15: 00007ffd389d3778 [ 1567.160378][T17185] [ 1568.325443][T17204] netlink: 'syz.3.11342': attribute type 1 has an invalid length. [ 1568.348343][T17204] netlink: 220 bytes leftover after parsing attributes in process `syz.3.11342'. [ 1569.521427][T17231] netlink: 48 bytes leftover after parsing attributes in process `syz.1.11348'. [ 1570.114751][T17241] FAULT_INJECTION: forcing a failure. [ 1570.114751][T17241] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1570.190188][T17241] CPU: 1 UID: 0 PID: 17241 Comm: syz.0.11351 Not tainted syzkaller #0 PREEMPT(full) [ 1570.190218][T17241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1570.190231][T17241] Call Trace: [ 1570.190241][T17241] [ 1570.190251][T17241] dump_stack_lvl+0xe8/0x150 [ 1570.190288][T17241] should_fail_ex+0x40c/0x560 [ 1570.190318][T17241] _copy_from_iter+0x1d3/0x1660 [ 1570.190342][T17241] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 1570.190370][T17241] ? rcu_is_watching+0x15/0xb0 [ 1570.190403][T17241] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1570.190431][T17241] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1570.190456][T17241] ? __pfx__copy_from_iter+0x10/0x10 [ 1570.190481][T17241] ? __alloc_skb+0x276/0x7a0 [ 1570.190499][T17241] ? __alloc_skb+0x276/0x7a0 [ 1570.190526][T17241] ? netlink_sendmsg+0x650/0xb40 [ 1570.190552][T17241] ? skb_put+0x112/0x210 [ 1570.190576][T17241] netlink_sendmsg+0x6c0/0xb40 [ 1570.190613][T17241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1570.190643][T17241] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1570.190681][T17241] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1570.190706][T17241] sock_sendmsg_nosec+0x13a/0x180 [ 1570.190738][T17241] ____sys_sendmsg+0x54e/0x850 [ 1570.190769][T17241] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1570.190804][T17241] ? import_iovec+0x73/0xa0 [ 1570.190836][T17241] ___sys_sendmsg+0x2a5/0x360 [ 1570.190859][T17241] ? __lock_acquire+0x683/0x2cf0 [ 1570.190892][T17241] ? __pfx____sys_sendmsg+0x10/0x10 [ 1570.190956][T17241] ? __fget_files+0x2a/0x420 [ 1570.190982][T17241] ? __fget_files+0x3a2/0x420 [ 1570.191021][T17241] __x64_sys_sendmsg+0x1b1/0x290 [ 1570.191048][T17241] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1570.191094][T17241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1570.191118][T17241] do_syscall_64+0x174/0x580 [ 1570.191156][T17241] ? trace_irq_disable+0x3b/0x140 [ 1570.191183][T17241] ? clear_bhb_loop+0x70/0xc0 [ 1570.191212][T17241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1570.191235][T17241] RIP: 0033:0x7f7e9919e0d9 [ 1570.191255][T17241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1570.191273][T17241] RSP: 002b:00007f7e99ff4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1570.191297][T17241] RAX: ffffffffffffffda RBX: 00007f7e99425fa0 RCX: 00007f7e9919e0d9 [ 1570.191314][T17241] RDX: 0000000004048814 RSI: 0000200000000380 RDI: 0000000000000005 [ 1570.191329][T17241] RBP: 00007f7e99ff4090 R08: 0000000000000000 R09: 0000000000000000 [ 1570.191343][T17241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1570.191356][T17241] R13: 00007f7e99426038 R14: 00007f7e99425fa0 R15: 00007ffe41af20b8 [ 1570.191392][T17241] [ 1571.577360][T17254] netlink: 108 bytes leftover after parsing attributes in process `syz.1.11355'. [ 1571.630212][T17254] netlink: 44 bytes leftover after parsing attributes in process `syz.1.11355'. [ 1571.738533][T17257] netlink: 80 bytes leftover after parsing attributes in process `syz.1.11355'. [ 1571.805191][T17257] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11355'. [ 1571.819584][T17257] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11355'. [ 1571.850887][T17257] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1572.690181][T17280] syzkaller0: entered promiscuous mode [ 1572.715008][T17280] syzkaller0: entered allmulticast mode [ 1572.777670][ T25] block nbd1: Possible stuck request ffff888027135080: control (read@0,1024B). Runtime 240 seconds [ 1572.789152][ T25] block nbd1: Possible stuck request ffff888027135240: control (read@1024,1024B). Runtime 240 seconds [ 1572.800374][ T25] block nbd1: Possible stuck request ffff888027135400: control (read@2048,1024B). Runtime 240 seconds [ 1572.812074][ T25] block nbd1: Possible stuck request ffff8880271355c0: control (read@3072,1024B). Runtime 240 seconds [ 1577.014555][T17319] FAULT_INJECTION: forcing a failure. [ 1577.014555][T17319] name failslab, interval 1, probability 0, space 0, times 0 [ 1577.046208][T17319] CPU: 1 UID: 0 PID: 17319 Comm: syz.3.11374 Not tainted syzkaller #0 PREEMPT(full) [ 1577.046238][T17319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1577.046252][T17319] Call Trace: [ 1577.046261][T17319] [ 1577.046271][T17319] dump_stack_lvl+0xe8/0x150 [ 1577.046327][T17319] should_fail_ex+0x40c/0x560 [ 1577.046354][T17319] ? __rhashtable_init_noprof+0x545/0xaf0 [ 1577.046387][T17319] should_failslab+0xa8/0x100 [ 1577.046421][T17319] __kvmalloc_node_noprof+0x176/0x860 [ 1577.046458][T17319] ? __rhashtable_init_noprof+0x545/0xaf0 [ 1577.046494][T17319] __rhashtable_init_noprof+0x545/0xaf0 [ 1577.046527][T17319] __rhltable_init_noprof+0x26/0x70 [ 1577.046556][T17319] sta_info_init+0x62/0x130 [ 1577.046682][T17319] ieee80211_alloc_hw_nm+0x808/0x1f00 [ 1577.046741][T17319] ? __pfx_ieee80211_emulate_add_chanctx+0x10/0x10 [ 1577.046779][T17319] mac80211_hwsim_new_radio+0x1ea/0x56b0 [ 1577.046910][T17319] ? rcu_is_watching+0x15/0xb0 [ 1577.046952][T17319] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 1577.046985][T17319] ? __kmalloc_cache_noprof+0x150/0x660 [ 1577.047013][T17319] ? hwsim_new_radio_nl+0xcde/0xf90 [ 1577.047053][T17319] hwsim_new_radio_nl+0xd8b/0xf90 [ 1577.047104][T17319] genl_family_rcv_msg_doit+0x233/0x340 [ 1577.047148][T17319] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1577.047197][T17319] ? bpf_lsm_capable+0x9/0x20 [ 1577.047224][T17319] ? security_capable+0x7e/0x2c0 [ 1577.047265][T17319] genl_rcv_msg+0x614/0x7a0 [ 1577.047305][T17319] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1577.047337][T17319] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 1577.047371][T17319] ? __pfx_ref_tracker_free+0x10/0x10 [ 1577.047410][T17319] netlink_rcv_skb+0x226/0x4a0 [ 1577.047449][T17319] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1577.047481][T17319] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1577.047543][T17319] ? down_read+0x2be/0x330 [ 1577.047569][T17319] genl_rcv+0x28/0x40 [ 1577.047595][T17319] netlink_unicast+0x7bb/0x940 [ 1577.047629][T17319] netlink_sendmsg+0x813/0xb40 [ 1577.047664][T17319] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1577.047693][T17319] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1577.047729][T17319] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1577.047752][T17319] sock_sendmsg_nosec+0x13a/0x180 [ 1577.047784][T17319] ____sys_sendmsg+0x54e/0x850 [ 1577.047814][T17319] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1577.047848][T17319] ? import_iovec+0x73/0xa0 [ 1577.047886][T17319] ___sys_sendmsg+0x2a5/0x360 [ 1577.047908][T17319] ? __lock_acquire+0x683/0x2cf0 [ 1577.047940][T17319] ? __pfx____sys_sendmsg+0x10/0x10 [ 1577.048003][T17319] ? __fget_files+0x2a/0x420 [ 1577.048028][T17319] ? __fget_files+0x3a2/0x420 [ 1577.048064][T17319] __x64_sys_sendmsg+0x1b1/0x290 [ 1577.048089][T17319] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1577.048133][T17319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.048155][T17319] do_syscall_64+0x174/0x580 [ 1577.048183][T17319] ? trace_irq_disable+0x3b/0x140 [ 1577.048208][T17319] ? clear_bhb_loop+0x70/0xc0 [ 1577.048232][T17319] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.048251][T17319] RIP: 0033:0x7f019fb9e0d9 [ 1577.048269][T17319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1577.048285][T17319] RSP: 002b:00007f01a09fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1577.048306][T17319] RAX: ffffffffffffffda RBX: 00007f019fe25fa0 RCX: 00007f019fb9e0d9 [ 1577.048320][T17319] RDX: 0000000000080000 RSI: 0000200000000400 RDI: 0000000000000003 [ 1577.048332][T17319] RBP: 00007f01a09fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.048344][T17319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1577.048354][T17319] R13: 00007f019fe26038 R14: 00007f019fe25fa0 R15: 00007ffce250a038 [ 1577.048385][T17319] [ 1577.500455][T17321] bridge0: port 1(veth1) entered blocking state [ 1577.507534][T17321] bridge0: port 1(veth1) entered disabled state [ 1577.514022][T17321] veth1: entered allmulticast mode [ 1577.521227][T17321] veth1: entered promiscuous mode [ 1578.635758][T17348] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11384'. [ 1579.031048][T17364] netlink: 'syz.0.11389': attribute type 3 has an invalid length. [ 1579.045201][T17364] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11389'. [ 1579.289130][T17366] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11390'. [ 1579.345228][T17366] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11390'. [ 1579.363296][T17372] xt_bpf: check failed: parse error [ 1580.303134][T17382] netlink: 44 bytes leftover after parsing attributes in process `syz.1.11398'. [ 1580.445324][T17384] netlink: 'syz.4.11399': attribute type 1 has an invalid length. [ 1580.539721][T17388] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1580.567951][T17388] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1580.582992][T17388] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1580.594431][T17388] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1580.646879][T17388] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1580.763943][ T5610] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1580.779566][ T5610] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1580.796280][ T5610] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1580.817069][ T5610] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1580.834401][ T5610] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1581.088707][T17384] 8021q: adding VLAN 0 to HW filter on device bond80 [ 1581.169846][T17399] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11401'. [ 1581.238709][T17386] bond79: (slave erspan0): Releasing active interface [ 1581.331285][T17386] bond80: (slave erspan0): making interface the new active one [ 1581.383898][T17386] bond80: (slave erspan0): Enslaving as an active interface with an up link [ 1581.479963][T17403] pim6reg: entered allmulticast mode [ 1581.500790][T17408] pim6reg: left allmulticast mode [ 1581.824391][T17427] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1582.084476][T12962] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1582.111241][T12962] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.276015][T12962] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1582.291891][T12962] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.399672][T12962] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1582.410953][T12962] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.439249][T17385] netdevsim0 speed is unknown, defaulting to 1000 [ 1582.448158][T17385] lo speed is unknown, defaulting to 1000 [ 1582.455687][T17385] lo speed is unknown, defaulting to 1000 [ 1582.523147][T12962] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1582.534857][T12962] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1582.620804][ T8423] smbdirect: ib_dev[syz1] removed [ 1583.029238][ T5610] Bluetooth: hci5: command tx timeout [ 1583.815113][T12962] team0: Port device xfrm0 removed [ 1584.224295][T12962] bond0 (unregistering): Released all slaves [ 1584.243551][T12962] bond1 (unregistering): Released all slaves [ 1584.263825][T12962] bond2 (unregistering): Released all slaves [ 1584.288775][T12962] bond3 (unregistering): Released all slaves [ 1584.320180][T12962] bond4 (unregistering): Released all slaves [ 1584.341529][T12962] bond5 (unregistering): Released all slaves [ 1584.360679][T12962] bond6 (unregistering): Released all slaves [ 1584.389108][T12962] bond7 (unregistering): Released all slaves [ 1584.410849][T12962] bond8 (unregistering): Released all slaves [ 1584.448862][T12962] bond9 (unregistering): Released all slaves [ 1584.477080][T12962] bond10 (unregistering): Released all slaves [ 1584.503405][T12962] bond11 (unregistering): Released all slaves [ 1584.525442][T12962] bond12 (unregistering): Released all slaves [ 1584.565241][T12962] bond13 (unregistering): Released all slaves [ 1584.611831][T12962] bond14 (unregistering): Released all slaves [ 1584.633052][T12962] bond15 (unregistering): Released all slaves [ 1584.677749][T12962] bond16 (unregistering): Released all slaves [ 1584.704718][T12962] bond17 (unregistering): Released all slaves [ 1584.740649][T12962] bond18 (unregistering): Released all slaves [ 1584.787417][T12962] bond19 (unregistering): Released all slaves [ 1584.812166][T12962] bond20 (unregistering): Released all slaves [ 1584.842657][T12962] bond21 (unregistering): Released all slaves [ 1584.863916][T12962] bond22 (unregistering): Released all slaves [ 1584.899698][T12962] bond23 (unregistering): Released all slaves [ 1584.924100][T12962] bond24 (unregistering): Released all slaves [ 1584.945874][T12962] bond25 (unregistering): Released all slaves [ 1584.973992][T12962] bond26 (unregistering): Released all slaves [ 1585.009002][T12962] bond27 (unregistering): Released all slaves [ 1585.038162][T12962] bond28 (unregistering): Released all slaves [ 1585.059230][T12962] bond29 (unregistering): Released all slaves [ 1585.080885][T12962] bond30 (unregistering): Released all slaves [ 1585.110520][ T5610] Bluetooth: hci5: command tx timeout [ 1585.128689][T12962] bond31 (unregistering): Released all slaves [ 1585.149896][T12962] bond32 (unregistering): Released all slaves [ 1585.171224][T12962] bond33 (unregistering): Released all slaves [ 1585.193286][T12962] bond34 (unregistering): Released all slaves [ 1585.224050][T12962] bond35 (unregistering): Released all slaves [ 1585.260773][T12962] bond36 (unregistering): Released all slaves [ 1585.282184][T12962] bond37 (unregistering): Released all slaves [ 1585.307547][T12962] bond38 (unregistering): Released all slaves [ 1585.338283][T12962] bond39 (unregistering): Released all slaves [ 1585.381487][T12962] bond40 (unregistering): Released all slaves [ 1585.421060][T12962] bond41 (unregistering): Released all slaves [ 1585.457563][T12962] bond42 (unregistering): Released all slaves [ 1585.484117][T12962] bond43 (unregistering): Released all slaves [ 1585.510153][T12962] bond44 (unregistering): Released all slaves [ 1585.535771][T12962] bond45 (unregistering): Released all slaves [ 1585.571865][T12962] bond46 (unregistering): Released all slaves [ 1585.610173][T12962] bond47 (unregistering): Released all slaves [ 1585.632209][T12962] bond48 (unregistering): Released all slaves [ 1585.661402][T12962] bond49 (unregistering): Released all slaves [ 1585.685878][T12962] bond50 (unregistering): Released all slaves [ 1585.707961][T12962] bond51 (unregistering): Released all slaves [ 1585.731422][T12962] bond52 (unregistering): Released all slaves [ 1585.791091][T12962] bond53 (unregistering): Released all slaves [ 1585.831454][T12962] bond54 (unregistering): Released all slaves [ 1585.854899][T12962] bond55 (unregistering): Released all slaves [ 1585.903379][T12962] bond56 (unregistering): Released all slaves [ 1585.925736][T12962] bond57 (unregistering): Released all slaves [ 1585.950084][T12962] bond58 (unregistering): Released all slaves [ 1585.980276][T12962] bond59 (unregistering): Released all slaves [ 1586.008877][T12962] bond60 (unregistering): Released all slaves [ 1586.032607][T12962] bond61 (unregistering): Released all slaves [ 1586.060151][T12962] bond62 (unregistering): Released all slaves [ 1586.084873][T12962] bond63 (unregistering): Released all slaves [ 1586.118703][T12962] bond64 (unregistering): Released all slaves [ 1586.139981][T12962] bond65 (unregistering): Released all slaves [ 1586.162923][T12962] bond66 (unregistering): Released all slaves [ 1586.191492][T12962] bond67 (unregistering): Released all slaves [ 1586.225605][T12962] bond68 (unregistering): Released all slaves [ 1586.252711][T12962] bond69 (unregistering): Released all slaves [ 1586.279299][T12962] bond70 (unregistering): Released all slaves [ 1586.303102][T12962] bond71 (unregistering): Released all slaves [ 1586.347396][T12962] bond72 (unregistering): Released all slaves [ 1586.368242][T12962] bond73 (unregistering): Released all slaves [ 1586.394684][T12962] bond74 (unregistering): Released all slaves [ 1586.425546][T12952] tipc: Resetting bearer [ 1586.445871][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1586.515052][T12952] netdevsim netdevsim3 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 1586.661965][T17385] bridge0: port 1(bridge_slave_0) entered blocking state [ 1586.704405][T17385] bridge0: port 1(bridge_slave_0) entered disabled state [ 1586.722858][T17385] bridge_slave_0: entered allmulticast mode [ 1586.752621][T17385] bridge_slave_0: entered promiscuous mode [ 1586.796272][T12961] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1586.811133][T12961] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1586.840420][T12961] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1586.884878][T17385] bridge0: port 2(bridge_slave_1) entered blocking state [ 1586.916215][T17385] bridge0: port 2(bridge_slave_1) entered disabled state [ 1586.943756][T17385] bridge_slave_1: entered allmulticast mode [ 1586.960047][T17385] bridge_slave_1: entered promiscuous mode [ 1587.155343][T17385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1587.176604][ T5610] Bluetooth: hci5: command tx timeout [ 1587.232298][T17385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1587.462871][T17385] team0: Port device team_slave_0 added [ 1587.497730][T17385] team0: Port device team_slave_1 added [ 1587.667844][T17385] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1587.694467][T17385] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1587.804856][T17385] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1587.862386][T12962] tipc: Disabling bearer [ 1587.875386][T17385] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1587.882842][T12962] tipc: Left network mode [ 1587.914816][T17385] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1587.942459][T17385] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1588.552153][ T5268] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1588.603543][T17385] hsr_slave_0: entered promiscuous mode [ 1588.639281][T17385] hsr_slave_1: entered promiscuous mode [ 1589.269432][ T5610] Bluetooth: hci5: command tx timeout [ 1590.400701][ T5268] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1590.480115][T17385] netdevsim netdevsim3 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1590.659140][T17385] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1590.829899][T17385] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1591.155848][T17385] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1591.213388][T17494] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1591.460672][T12962] IPVS: stop unused estimator thread 0... [ 1591.767191][T17505] netlink: 'syz.0.11413': attribute type 4 has an invalid length. [ 1591.828540][T17505] netlink: 17 bytes leftover after parsing attributes in process `syz.0.11413'. [ 1591.910837][T17507] veth1_to_bond: entered allmulticast mode [ 1591.931772][T17507] veth1_to_bond: entered promiscuous mode [ 1591.991563][T17507] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11414'. [ 1592.221604][T17507] veth1_to_bond (unregistering): left allmulticast mode [ 1592.246235][T17507] veth1_to_bond (unregistering): left promiscuous mode [ 1592.268146][T17524] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1592.430428][T12954] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1592.664336][T17530] syzkaller0: entered promiscuous mode [ 1592.693294][T17530] syzkaller0: entered allmulticast mode [ 1592.912213][T17546] xt_bpf: check failed: parse error [ 1593.330494][T17564] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1594.488841][T17580] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1595.168540][T17529] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1595.199275][T17385] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1595.269603][T17385] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1595.303652][T17385] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1595.347566][T17385] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1595.386783][T17385] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1595.422201][T17385] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1595.448276][T17385] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1595.478050][T17385] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1595.839281][T17639] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1595.929140][T17385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1595.981003][T17385] 8021q: adding VLAN 0 to HW filter on device team0 [ 1595.994731][T12961] bridge0: port 1(bridge_slave_0) entered blocking state [ 1596.001970][T12961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1596.029243][T12954] bridge0: port 2(bridge_slave_1) entered blocking state [ 1596.036461][T12954] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1596.774860][T17385] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1596.845068][T17385] veth0_vlan: entered promiscuous mode [ 1596.861065][T17385] veth1_vlan: entered promiscuous mode [ 1596.914806][T17385] veth0_macvtap: entered promiscuous mode [ 1596.928590][T17385] veth1_macvtap: entered promiscuous mode [ 1596.955395][T17385] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1596.974900][T17385] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1597.011421][T12954] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1597.040467][T12954] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1597.089207][ T8423] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1597.146384][T12952] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1597.170579][T12952] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1597.202868][T12952] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1597.269229][ T8423] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1597.281279][ T8423] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1600.479686][T17668] FAULT_INJECTION: forcing a failure. [ 1600.479686][T17668] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1600.556010][T17668] CPU: 0 UID: 0 PID: 17668 Comm: syz.1.11444 Not tainted syzkaller #0 PREEMPT(full) [ 1600.556042][T17668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1600.556056][T17668] Call Trace: [ 1600.556066][T17668] [ 1600.556075][T17668] dump_stack_lvl+0xe8/0x150 [ 1600.556113][T17668] should_fail_ex+0x40c/0x560 [ 1600.556141][T17668] _copy_from_user+0x2d/0xb0 [ 1600.556171][T17668] ___sys_sendmsg+0x1c6/0x360 [ 1600.556197][T17668] ? __lock_acquire+0x683/0x2cf0 [ 1600.556230][T17668] ? __pfx____sys_sendmsg+0x10/0x10 [ 1600.556289][T17668] ? __fget_files+0x2a/0x420 [ 1600.556319][T17668] ? __fget_files+0x3a2/0x420 [ 1600.556357][T17668] __x64_sys_sendmsg+0x1b1/0x290 [ 1600.556384][T17668] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1600.556428][T17668] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1600.556453][T17668] do_syscall_64+0x174/0x580 [ 1600.556485][T17668] ? trace_irq_disable+0x3b/0x140 [ 1600.556513][T17668] ? clear_bhb_loop+0x70/0xc0 [ 1600.556540][T17668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1600.556562][T17668] RIP: 0033:0x7fe28099e0d9 [ 1600.556583][T17668] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1600.556602][T17668] RSP: 002b:00007fe281873028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1600.556626][T17668] RAX: ffffffffffffffda RBX: 00007fe280c25fa0 RCX: 00007fe28099e0d9 [ 1600.556641][T17668] RDX: 0000000000000000 RSI: 0000200000002a40 RDI: 0000000000000004 [ 1600.556654][T17668] RBP: 00007fe281873090 R08: 0000000000000000 R09: 0000000000000000 [ 1600.556667][T17668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1600.556679][T17668] R13: 00007fe280c26038 R14: 00007fe280c25fa0 R15: 00007ffd389d3778 [ 1600.556713][T17668] [ 1600.604953][T17672] FAULT_INJECTION: forcing a failure. [ 1600.604953][T17672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1600.791782][T17673] netlink: 48 bytes leftover after parsing attributes in process `syz.4.11447'. [ 1600.834015][T17672] CPU: 0 UID: 0 PID: 17672 Comm: syz.4.11447 Not tainted syzkaller #0 PREEMPT(full) [ 1600.834044][T17672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1600.834057][T17672] Call Trace: [ 1600.834065][T17672] [ 1600.834074][T17672] dump_stack_lvl+0xe8/0x150 [ 1600.834116][T17672] should_fail_ex+0x40c/0x560 [ 1600.834145][T17672] _copy_from_user+0x2d/0xb0 [ 1600.834175][T17672] ___sys_recvmsg+0x173/0x5a0 [ 1600.834207][T17672] ? __pfx____sys_recvmsg+0x10/0x10 [ 1600.834236][T17672] ? __fget_files+0x2a/0x420 [ 1600.834282][T17672] ? __fget_files+0x3a2/0x420 [ 1600.834319][T17672] __x64_sys_recvmsg+0x1ae/0x290 [ 1600.834347][T17672] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1600.834401][T17672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1600.834425][T17672] do_syscall_64+0x174/0x580 [ 1600.834456][T17672] ? trace_irq_disable+0x3b/0x140 [ 1600.834483][T17672] ? clear_bhb_loop+0x70/0xc0 [ 1600.834509][T17672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1600.834531][T17672] RIP: 0033:0x7fde1bf9e0d9 [ 1600.834550][T17672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1600.834569][T17672] RSP: 002b:00007fde1cee7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1600.834592][T17672] RAX: ffffffffffffffda RBX: 00007fde1c226090 RCX: 00007fde1bf9e0d9 [ 1600.834608][T17672] RDX: 00000000000000f0 RSI: 00002000000005c0 RDI: 0000000000000004 [ 1600.834622][T17672] RBP: 00007fde1cee7090 R08: 0000000000000000 R09: 0000000000000000 [ 1600.834636][T17672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1600.834648][T17672] R13: 00007fde1c226128 R14: 00007fde1c226090 R15: 00007ffc5c73eb28 [ 1600.834682][T17672] [ 1601.417982][T17388] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1601.435268][T17388] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1601.444941][T17388] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1601.479223][T17388] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1601.488582][T17388] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1601.659994][T17690] netlink: 'syz.4.11450': attribute type 3 has an invalid length. [ 1601.745805][T17690] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11450'. [ 1601.833443][T17693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11451'. [ 1601.878774][T17702] FAULT_INJECTION: forcing a failure. [ 1601.878774][T17702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1601.900897][T17702] CPU: 1 UID: 0 PID: 17702 Comm: syz.3.11452 Not tainted syzkaller #0 PREEMPT(full) [ 1601.900927][T17702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1601.900940][T17702] Call Trace: [ 1601.900949][T17702] [ 1601.900959][T17702] dump_stack_lvl+0xe8/0x150 [ 1601.900994][T17702] should_fail_ex+0x40c/0x560 [ 1601.901023][T17702] _copy_to_user+0x31/0xb0 [ 1601.901056][T17702] simple_read_from_buffer+0xe1/0x170 [ 1601.901090][T17702] proc_fail_nth_read+0x1bb/0x230 [ 1601.901124][T17702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1601.901161][T17702] ? rw_verify_area+0x24a/0x4c0 [ 1601.901193][T17702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1601.901221][T17702] vfs_read+0x213/0xa80 [ 1601.901257][T17702] ? __pfx___mutex_lock+0x10/0x10 [ 1601.901298][T17702] ? __pfx_vfs_read+0x10/0x10 [ 1601.901347][T17702] ? __fget_files+0x2a/0x420 [ 1601.901379][T17702] ? __fget_files+0x3a2/0x420 [ 1601.901405][T17702] ? __fget_files+0x2a/0x420 [ 1601.901443][T17702] ksys_read+0x150/0x270 [ 1601.901477][T17702] ? __pfx_ksys_read+0x10/0x10 [ 1601.901518][T17702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1601.901542][T17702] do_syscall_64+0x174/0x580 [ 1601.901572][T17702] ? trace_irq_disable+0x3b/0x140 [ 1601.901597][T17702] ? clear_bhb_loop+0x70/0xc0 [ 1601.901624][T17702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1601.901644][T17702] RIP: 0033:0x7fc3b195e90e [ 1601.901663][T17702] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1601.901680][T17702] RSP: 002b:00007fc3b27d4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1601.901703][T17702] RAX: ffffffffffffffda RBX: 00007fc3b27d56c0 RCX: 00007fc3b195e90e [ 1601.901719][T17702] RDX: 000000000000000f RSI: 00007fc3b27d50a0 RDI: 0000000000000004 [ 1601.901734][T17702] RBP: 00007fc3b27d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1601.901748][T17702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1601.901761][T17702] R13: 00007fc3b1c26128 R14: 00007fc3b1c26090 R15: 00007ffd146c7608 [ 1601.901797][T17702] [ 1602.210613][T17693] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11451'. [ 1602.274311][T17703] syzkaller0: entered promiscuous mode [ 1602.280060][T17703] syzkaller0: entered allmulticast mode [ 1602.571501][T17710] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11454'. [ 1603.025206][ T25] block nbd1: Possible stuck request ffff888027135080: control (read@0,1024B). Runtime 270 seconds [ 1603.037034][ T25] block nbd1: Possible stuck request ffff888027135240: control (read@1024,1024B). Runtime 270 seconds [ 1603.048566][ T25] block nbd1: Possible stuck request ffff888027135400: control (read@2048,1024B). Runtime 270 seconds [ 1603.060219][ T25] block nbd1: Possible stuck request ffff8880271355c0: control (read@3072,1024B). Runtime 270 seconds [ 1603.410773][T17724] FAULT_INJECTION: forcing a failure. [ 1603.410773][T17724] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1603.500049][T17392] udevd[17392]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1603.512388][T17724] CPU: 1 UID: 0 PID: 17724 Comm: syz.1.11456 Not tainted syzkaller #0 PREEMPT(full) [ 1603.512418][T17724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1603.512432][T17724] Call Trace: [ 1603.512442][T17724] [ 1603.512452][T17724] dump_stack_lvl+0xe8/0x150 [ 1603.512502][T17724] should_fail_ex+0x40c/0x560 [ 1603.512533][T17724] _copy_to_user+0x31/0xb0 [ 1603.512568][T17724] simple_read_from_buffer+0xe1/0x170 [ 1603.512603][T17724] proc_fail_nth_read+0x1bb/0x230 [ 1603.512639][T17724] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1603.512674][T17724] ? rw_verify_area+0x24a/0x4c0 [ 1603.512710][T17724] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1603.512740][T17724] vfs_read+0x213/0xa80 [ 1603.512778][T17724] ? __pfx___mutex_lock+0x10/0x10 [ 1603.512814][T17724] ? __pfx_vfs_read+0x10/0x10 [ 1603.512848][T17724] ? __fget_files+0x2a/0x420 [ 1603.512881][T17724] ? __fget_files+0x3a2/0x420 [ 1603.512909][T17724] ? __fget_files+0x2a/0x420 [ 1603.512947][T17724] ksys_read+0x150/0x270 [ 1603.512982][T17724] ? __pfx_ksys_read+0x10/0x10 [ 1603.513025][T17724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1603.513049][T17724] do_syscall_64+0x174/0x580 [ 1603.513081][T17724] ? trace_irq_disable+0x3b/0x140 [ 1603.513109][T17724] ? clear_bhb_loop+0x70/0xc0 [ 1603.513136][T17724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1603.513159][T17724] RIP: 0033:0x7fe28095e90e [ 1603.513180][T17724] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1603.513200][T17724] RSP: 002b:00007fe281872fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1603.513224][T17724] RAX: ffffffffffffffda RBX: 00007fe2818736c0 RCX: 00007fe28095e90e [ 1603.513240][T17724] RDX: 000000000000000f RSI: 00007fe2818730a0 RDI: 0000000000000004 [ 1603.513254][T17724] RBP: 00007fe281873090 R08: 0000000000000000 R09: 0000000000000000 [ 1603.513272][T17724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1603.513286][T17724] R13: 00007fe280c26038 R14: 00007fe280c25fa0 R15: 00007ffd389d3778 [ 1603.513322][T17724] [ 1603.804252][T17388] Bluetooth: hci2: command tx timeout [ 1603.815432][T12162] udevd[12162]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1603.943813][T17730] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11460'. [ 1604.014141][T17732] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 1605.825693][T17388] Bluetooth: hci2: command tx timeout [ 1607.147584][ T5606] tipc: Resetting bearer [ 1607.181427][ T5606] bond0: (slave syz_tun): Releasing backup interface [ 1607.191367][ T5606] tipc: Resetting bearer [ 1607.251965][ T5606] tipc: Disabling bearer [ 1607.290107][T17730] hsr_slave_0: left promiscuous mode [ 1607.298346][T17730] hsr_slave_1: left promiscuous mode [ 1607.897069][T17388] Bluetooth: hci2: command tx timeout [ 1607.942415][T12961] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1607.973367][T12961] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1608.565630][T12961] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1608.598013][T12961] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1608.639657][T17749] lo speed is unknown, defaulting to 1000 [ 1608.705795][T17749] lo speed is unknown, defaulting to 1000 [ 1609.037171][T17786] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11474'. [ 1609.293007][T12961] bond0: (slave netdevsim1): Releasing backup interface [ 1609.347201][T12961] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1609.373697][T12961] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1609.502353][T17682] lo speed is unknown, defaulting to 1000 [ 1609.623367][T12961] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1609.669149][T12961] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1609.723670][T17682] lo speed is unknown, defaulting to 1000 [ 1609.980635][T17388] Bluetooth: hci2: command tx timeout [ 1610.340746][T12963] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1610.484491][T12961] gretap0: left allmulticast mode [ 1610.548245][T12961] gretap0: left promiscuous mode [ 1610.597802][T12961] bridge0: port 1(gretap0) entered disabled state [ 1610.747243][T17808] Cannot find set identified by id 65534 to match [ 1611.020993][T17822] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11486'. [ 1612.144691][T12961] erspan0 (unregistering): left promiscuous mode [ 1612.392125][T12961] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1612.409814][T12961] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1612.421117][T12961] bond0 (unregistering): Released all slaves [ 1612.437271][T12961] bond1 (unregistering): Released all slaves [ 1612.458567][T12961] bond2 (unregistering): Released all slaves [ 1612.488564][T12961] bond3 (unregistering): Released all slaves [ 1612.511252][T12961] bond4 (unregistering): Released all slaves [ 1612.540262][T12961] bond5 (unregistering): Released all slaves [ 1612.562101][T12961] bond6 (unregistering): Released all slaves [ 1612.591208][T12961] bond7 (unregistering): Released all slaves [ 1612.613374][T12961] bond8 (unregistering): (slave veth7): Releasing active interface [ 1612.630009][T12961] batadv1: entered promiscuous mode [ 1612.640719][T12961] bond8 (unregistering): (slave batadv1): Releasing active interface [ 1612.651325][T12961] bond8 (unregistering): Released all slaves [ 1612.672147][T12961] bond9 (unregistering): Released all slaves [ 1612.701233][T12961] bond10 (unregistering): Released all slaves [ 1612.723646][T12961] bond11 (unregistering): (slave batadv3): Releasing active interface [ 1612.742107][T12961] bond11 (unregistering): (slave veth11): Releasing active interface [ 1612.752659][T12961] bond11 (unregistering): Released all slaves [ 1612.781653][T12961] bond12 (unregistering): Released all slaves [ 1612.809273][T12961] bond13 (unregistering): Released all slaves [ 1612.835080][T12961] bond14 (unregistering): Released all slaves [ 1612.860651][T12961] bond15 (unregistering): Released all slaves [ 1612.891873][T12961] bond16 (unregistering): Released all slaves [ 1612.918870][T12961] bond17 (unregistering): Released all slaves [ 1612.961134][T12961] bond18 (unregistering): Released all slaves [ 1612.984835][T12961] bond19 (unregistering): Released all slaves [ 1613.015263][T12961] bond20 (unregistering): Released all slaves [ 1613.047337][T12961] bond21 (unregistering): Released all slaves [ 1613.075965][T12961] bond22 (unregistering): Released all slaves [ 1613.113584][T12961] bond23 (unregistering): Released all slaves [ 1613.151363][T12961] bond24 (unregistering): Released all slaves [ 1613.182331][T12961] bond25 (unregistering): Released all slaves [ 1613.205428][T12961] bond26 (unregistering): Released all slaves [ 1613.248160][T12961] bond27 (unregistering): Released all slaves [ 1613.284751][T12961] bond28 (unregistering): Released all slaves [ 1613.314851][T12961] bond29 (unregistering): Released all slaves [ 1613.362778][T12961] bond30 (unregistering): Released all slaves [ 1613.394242][T12961] bond31 (unregistering): Released all slaves [ 1613.420700][T12961] bond32 (unregistering): Released all slaves [ 1613.462950][T12961] bond33 (unregistering): Released all slaves [ 1613.495467][T12961] bond34 (unregistering): Released all slaves [ 1613.527173][T12961] bond35 (unregistering): Released all slaves [ 1613.551548][T12961] bond36 (unregistering): Released all slaves [ 1613.582863][T12961] bond37 (unregistering): Released all slaves [ 1613.614970][T12961] bond38 (unregistering): Released all slaves [ 1613.637200][T12961] bond39 (unregistering): Released all slaves [ 1613.662074][T12961] bond40 (unregistering): Released all slaves [ 1613.705887][T12961] bond41 (unregistering): Released all slaves [ 1613.729482][T12961] bond42 (unregistering): Released all slaves [ 1613.763378][T12961] bond43 (unregistering): Released all slaves [ 1613.790739][T12961] bond44 (unregistering): Released all slaves [ 1613.820420][T12961] bond45 (unregistering): Released all slaves [ 1613.854641][T12961] bond46 (unregistering): Released all slaves [ 1613.881342][T12961] bond47 (unregistering): Released all slaves [ 1613.911767][T12961] bond48 (unregistering): Released all slaves [ 1613.940883][T12961] bond49 (unregistering): Released all slaves [ 1613.970514][T12961] bond50 (unregistering): Released all slaves [ 1613.998926][T12961] bond51 (unregistering): Released all slaves [ 1614.036186][T12961] bond52 (unregistering): Released all slaves [ 1614.066140][T12961] bond53 (unregistering): Released all slaves [ 1614.094476][T12961] bond54 (unregistering): Released all slaves [ 1614.128305][T12961] bond55 (unregistering): Released all slaves [ 1614.156414][T12961] bond56 (unregistering): Released all slaves [ 1614.178458][T12961] bond57 (unregistering): Released all slaves [ 1614.199545][T12961] bond58 (unregistering): Released all slaves [ 1614.220316][T12961] bond59 (unregistering): Released all slaves [ 1614.260105][T12961] bond60 (unregistering): Released all slaves [ 1614.282492][T12961] bond61 (unregistering): Released all slaves [ 1614.331595][T12961] bond62 (unregistering): Released all slaves [ 1614.360490][T12961] bond63 (unregistering): Released all slaves [ 1614.383213][T12961] bond64 (unregistering): Released all slaves [ 1614.404349][T12961] bond65 (unregistering): Released all slaves [ 1614.425223][T12961] bond66 (unregistering): Released all slaves [ 1614.452166][T12961] bond67 (unregistering): Released all slaves [ 1614.511922][T12961] bond68 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1614.523153][T12961] bond68 (unregistering): Released all slaves [ 1614.544795][T12961] bond69 (unregistering): Released all slaves [ 1614.572958][T12961] bond70 (unregistering): Released all slaves [ 1614.606939][T12961] bond71 (unregistering): Released all slaves [ 1614.656353][T17822] hsr_slave_0: left promiscuous mode [ 1614.673521][T17822] hsr_slave_1: left promiscuous mode [ 1614.837449][T12953] netdevsim netdevsim0 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 1614.891870][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1614.987043][T17839] netlink: 'syz.4.11487': attribute type 1 has an invalid length. [ 1615.132335][T17844] FAULT_INJECTION: forcing a failure. [ 1615.132335][T17844] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1615.224902][T17844] CPU: 1 UID: 0 PID: 17844 Comm: syz.3.11490 Not tainted syzkaller #0 PREEMPT(full) [ 1615.224932][T17844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1615.224946][T17844] Call Trace: [ 1615.224955][T17844] [ 1615.224965][T17844] dump_stack_lvl+0xe8/0x150 [ 1615.225003][T17844] should_fail_ex+0x40c/0x560 [ 1615.225033][T17844] _copy_from_iter+0x1d3/0x1660 [ 1615.225058][T17844] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 1615.225088][T17844] ? rcu_is_watching+0x15/0xb0 [ 1615.225120][T17844] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1615.225146][T17844] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1615.225171][T17844] ? __pfx__copy_from_iter+0x10/0x10 [ 1615.225195][T17844] ? __alloc_skb+0x276/0x7a0 [ 1615.225214][T17844] ? __alloc_skb+0x276/0x7a0 [ 1615.225240][T17844] ? netlink_sendmsg+0x650/0xb40 [ 1615.225267][T17844] ? skb_put+0x112/0x210 [ 1615.225292][T17844] netlink_sendmsg+0x6c0/0xb40 [ 1615.225328][T17844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1615.225358][T17844] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1615.225396][T17844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1615.225421][T17844] sock_sendmsg_nosec+0x13a/0x180 [ 1615.225453][T17844] ____sys_sendmsg+0x54e/0x850 [ 1615.225483][T17844] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1615.225517][T17844] ? import_iovec+0x73/0xa0 [ 1615.225549][T17844] ___sys_sendmsg+0x2a5/0x360 [ 1615.225572][T17844] ? __lock_acquire+0x683/0x2cf0 [ 1615.225605][T17844] ? __pfx____sys_sendmsg+0x10/0x10 [ 1615.225672][T17844] ? __fget_files+0x2a/0x420 [ 1615.225698][T17844] ? __fget_files+0x3a2/0x420 [ 1615.225736][T17844] __x64_sys_sendmsg+0x1b1/0x290 [ 1615.225764][T17844] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1615.225807][T17844] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1615.225832][T17844] do_syscall_64+0x174/0x580 [ 1615.225864][T17844] ? trace_irq_disable+0x3b/0x140 [ 1615.225890][T17844] ? clear_bhb_loop+0x70/0xc0 [ 1615.225916][T17844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1615.225941][T17844] RIP: 0033:0x7fc3b199e0d9 [ 1615.225961][T17844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1615.225980][T17844] RSP: 002b:00007fc3b27f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1615.226003][T17844] RAX: ffffffffffffffda RBX: 00007fc3b1c25fa0 RCX: 00007fc3b199e0d9 [ 1615.226019][T17844] RDX: 0000000000000000 RSI: 0000200000002a40 RDI: 0000000000000004 [ 1615.226032][T17844] RBP: 00007fc3b27f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1615.226044][T17844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1615.226056][T17844] R13: 00007fc3b1c26038 R14: 00007fc3b1c25fa0 R15: 00007ffd146c7608 [ 1615.226087][T17844] [ 1615.716753][T12953] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1615.727118][T12963] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1616.058853][T17839] 8021q: adding VLAN 0 to HW filter on device bond81 [ 1616.294565][T17853] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11489'. [ 1616.462272][T17853] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11489'. [ 1616.571467][T17853] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1616.701453][T17872] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11493'. [ 1617.208850][T12961] tipc: Left network mode [ 1617.699832][T17898] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11499'. [ 1617.761109][T17898] netlink: 'syz.4.11499': attribute type 5 has an invalid length. [ 1617.785673][T17900] netlink: 'syz.4.11499': attribute type 1 has an invalid length. [ 1617.826355][T17898] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11499'. [ 1617.863165][T17903] netlink: 'syz.1.11501': attribute type 3 has an invalid length. [ 1617.903107][T17903] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11501'. [ 1617.927228][T17906] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11502'. [ 1617.986456][T17908] ip_tables: iptables: counters copy to user failed while replacing table [ 1618.451071][T17920] netlink: 'syz.2.11503': attribute type 1 has an invalid length. [ 1618.650028][T17898] geneve6: entered promiscuous mode [ 1618.657512][T17898] geneve6: entered allmulticast mode [ 1618.744838][ T8423] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 34132 - 0 [ 1618.779648][T17916] netlink: 7 bytes leftover after parsing attributes in process `syz.2.11503'. [ 1618.838718][ T8423] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 34132 - 0 [ 1618.906531][T12952] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 34132 - 0 [ 1619.402650][T17949] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11505'. [ 1619.415547][T12954] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 34132 - 0 [ 1619.574940][T17954] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11505'. [ 1619.633509][T17932] syzkaller0: entered promiscuous mode [ 1619.668328][T17932] syzkaller0: entered allmulticast mode [ 1619.776445][T17961] netlink: 'syz.3.11508': attribute type 30 has an invalid length. [ 1620.150419][T17682] bridge0: port 1(bridge_slave_0) entered blocking state [ 1620.181535][T17682] bridge0: port 1(bridge_slave_0) entered disabled state [ 1620.204122][T17682] bridge_slave_0: entered allmulticast mode [ 1620.260307][T17682] bridge_slave_0: entered promiscuous mode [ 1620.302362][ T5268] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1620.393077][T17682] bridge0: port 2(bridge_slave_1) entered blocking state [ 1620.435758][T17682] bridge0: port 2(bridge_slave_1) entered disabled state [ 1620.472849][T17682] bridge_slave_1: entered allmulticast mode [ 1620.514602][T17682] bridge_slave_1: entered promiscuous mode [ 1620.804719][T17682] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1620.832868][T17682] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1621.025548][T12961] veth1: left promiscuous mode [ 1621.105528][T17392] block nbd64: NBD_DISCONNECT [ 1621.112270][T12961] veth0: left promiscuous mode [ 1621.135345][T12961] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1621.190437][T12961] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1621.255406][T12961] batman_adv: batadv0: Removing interface: vlan0 [ 1621.286684][T12961] batman_adv: batadv0: Removing interface: vlan1 [ 1621.398919][T17987] Cannot find set identified by id 65534 to match [ 1621.518641][T12162] udevd[12162]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1621.627642][T17990] __nla_validate_parse: 1 callbacks suppressed [ 1621.627665][T17990] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11517'. [ 1621.873430][T17996] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11518'. [ 1621.981835][T18000] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11519'. [ 1622.110529][T18004] netlink: 64 bytes leftover after parsing attributes in process `syz.1.11520'. [ 1622.205178][T18010] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11519'. [ 1622.301648][T12958] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1622.879559][T12962] smbdirect: ib_dev[syz0] removed [ 1622.945569][ T6744] lo speed is unknown, defaulting to 1000 [ 1622.960077][ T6744] infiniband syz0: ib_query_port failed (-19) [ 1623.046645][T18006] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11519'. [ 1623.049068][T18017] netlink: 'syz.4.11522': attribute type 1 has an invalid length. [ 1623.074491][T18006] netlink: 'syz.2.11519': attribute type 1 has an invalid length. [ 1623.091825][T18010] syz_tun: Device is already in use. [ 1623.115971][T17682] team0: Port device team_slave_0 added [ 1623.302054][T18017] 8021q: adding VLAN 0 to HW filter on device bond82 [ 1623.390473][T18023] netlink: 'syz.1.11523': attribute type 29 has an invalid length. [ 1623.471704][T18019] bond80: (slave erspan0): Releasing active interface [ 1623.510134][T18019] bond82: (slave erspan0): making interface the new active one [ 1623.541353][T18019] bond82: (slave erspan0): Enslaving as an active interface with an up link [ 1623.571861][T17682] team0: Port device team_slave_1 added [ 1623.739564][T17682] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1623.770842][T17682] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1623.852617][T17682] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1623.901935][T17682] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1623.923152][T17682] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1624.041444][T17682] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1624.227492][T12961] IPVS: stop unused estimator thread 0... [ 1624.440474][T17682] hsr_slave_0: entered promiscuous mode [ 1624.447532][T17682] hsr_slave_1: entered promiscuous mode [ 1624.483419][T18055] vlan1: entered promiscuous mode [ 1624.650563][ T5268] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1624.712901][T17682] netdevsim netdevsim0 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1624.862471][T17682] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1624.939704][T17682] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1625.054123][T17682] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1625.096850][T18012] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1625.518034][T18087] openvswitch: netlink: Key type 45 is out of range max 32 [ 1625.587830][T18091] netlink: 60 bytes leftover after parsing attributes in process `syz.1.11545'. [ 1625.641854][T18091] netlink: 60 bytes leftover after parsing attributes in process `syz.1.11545'. [ 1625.724726][T18096] netlink: 60 bytes leftover after parsing attributes in process `syz.1.11545'. [ 1626.018226][T17682] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1626.028373][T18109] openvswitch: netlink: Flow actions attr not present in new flow. [ 1626.061758][T17682] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1626.101341][T17682] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1626.148059][T17682] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1626.173714][T17682] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1626.214784][T17682] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1626.242029][T18118] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11554'. [ 1626.260609][T17682] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1626.333493][T17682] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1626.650914][T17682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1626.710623][T17682] 8021q: adding VLAN 0 to HW filter on device team0 [ 1626.755150][T18145] __nla_validate_parse: 1 callbacks suppressed [ 1626.755174][T18145] netlink: 140 bytes leftover after parsing attributes in process `syz.1.11562'. [ 1626.860856][T18152] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11563'. [ 1626.873599][T18153] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11565'. [ 1626.884061][T18152] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11563'. [ 1626.959433][T12961] bridge0: port 1(bridge_slave_0) entered blocking state [ 1626.966714][T12961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1627.042668][T12961] bridge0: port 2(bridge_slave_1) entered blocking state [ 1627.049931][T12961] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1627.503292][T18180] netlink: 'syz.4.11574': attribute type 2 has an invalid length. [ 1627.633105][T18186] netlink: 'syz.2.11576': attribute type 63 has an invalid length. [ 1627.869379][T18200] netlink: 'syz.2.11581': attribute type 10 has an invalid length. [ 1627.941420][T18200] bond0: (slave wg0): The slave device specified does not support setting the MAC address [ 1627.983340][T18200] bond0: (slave wg0): Error -95 calling set_mac_address [ 1628.232586][T18213] netlink: 60 bytes leftover after parsing attributes in process `syz.3.11585'. [ 1628.262040][T18218] netlink: 'syz.2.11587': attribute type 3 has an invalid length. [ 1628.291525][T18222] netlink: 60 bytes leftover after parsing attributes in process `syz.3.11585'. [ 1628.475019][T18231] netlink: 'syz.2.11590': attribute type 10 has an invalid length. [ 1628.504689][T18231] netlink: 2 bytes leftover after parsing attributes in process `syz.2.11590'. [ 1628.643745][T17682] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1628.782937][T18242] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11594'. [ 1628.909165][T17682] veth0_vlan: entered promiscuous mode [ 1628.997990][T17682] veth1_vlan: entered promiscuous mode [ 1629.253480][T17682] veth0_macvtap: entered promiscuous mode [ 1629.311297][T17682] veth1_macvtap: entered promiscuous mode [ 1629.520743][T17682] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1629.578845][T17682] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1629.678825][T18283] netlink: 60 bytes leftover after parsing attributes in process `syz.1.11607'. [ 1629.740792][T12962] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1629.752376][T18285] netlink: 60 bytes leftover after parsing attributes in process `syz.1.11607'. [ 1629.819320][T12962] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1629.878464][ T8423] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1629.914154][ T8423] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1630.023483][ T8421] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1630.055785][ T8421] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1630.160072][T12962] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1630.197887][T12962] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1631.069730][ T5610] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1631.080871][ T5610] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1631.092030][ T5610] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1631.101784][ T5610] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1631.111213][ T5610] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1631.681669][ T5619] tipc: Disabling bearer [ 1631.784252][T18367] __nla_validate_parse: 8 callbacks suppressed [ 1631.784270][T18367] netlink: 60 bytes leftover after parsing attributes in process `syz.3.11635'. [ 1631.859685][T18367] netlink: 60 bytes leftover after parsing attributes in process `syz.3.11635'. [ 1631.916737][T18372] netlink: 60 bytes leftover after parsing attributes in process `syz.3.11635'. [ 1632.035481][T18333] lo speed is unknown, defaulting to 1000 [ 1632.421159][T18398] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11645'. [ 1632.433883][T18394] bond1 (unregistering): Released all slaves [ 1632.580506][T18405] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11648'. [ 1632.952266][T18427] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11652'. [ 1633.045012][T12963] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 34132 - 0 [ 1633.141905][T18435] Bluetooth: MGMT ver 1.23 [ 1633.186928][T17388] Bluetooth: hci3: command tx timeout [ 1633.385252][T18446] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11659'. [ 1633.455526][T12963] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 34132 - 0 [ 1633.580275][ T25] block nbd1: Possible stuck request ffff888027135080: control (read@0,1024B). Runtime 300 seconds [ 1633.595143][ T25] block nbd1: Possible stuck request ffff888027135240: control (read@1024,1024B). Runtime 300 seconds [ 1633.607737][ T25] block nbd1: Possible stuck request ffff888027135400: control (read@2048,1024B). Runtime 300 seconds [ 1633.619063][ T25] block nbd1: Possible stuck request ffff8880271355c0: control (read@3072,1024B). Runtime 300 seconds [ 1633.738710][T12963] bond0: (slave netdevsim1): Releasing backup interface [ 1633.770256][T12963] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 34132 - 0 [ 1633.912636][T12963] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 34132 - 0 [ 1634.043869][T18333] bridge0: port 1(bridge_slave_0) entered blocking state [ 1634.062467][T18333] bridge0: port 1(bridge_slave_0) entered disabled state [ 1634.074866][T18333] bridge_slave_0: entered allmulticast mode [ 1634.090595][T18333] bridge_slave_0: entered promiscuous mode [ 1634.108595][T18333] bridge0: port 2(bridge_slave_1) entered blocking state [ 1634.122660][T18333] bridge0: port 2(bridge_slave_1) entered disabled state [ 1634.146603][T18333] bridge_slave_1: entered allmulticast mode [ 1634.163913][T18333] bridge_slave_1: entered promiscuous mode [ 1634.222116][T18333] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1634.238738][T18333] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1634.375799][T18333] team0: Port device team_slave_0 added [ 1634.416715][T18333] team0: Port device team_slave_1 added [ 1634.514484][T18333] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1634.521906][T18333] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1634.549900][T18333] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1634.567474][T12958] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1634.579275][T18333] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1634.593972][T18333] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1634.622991][T18333] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1634.766512][ T8423] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1634.777500][ T8423] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1634.815789][T18333] hsr_slave_0: entered promiscuous mode [ 1634.823182][T18333] hsr_slave_1: entered promiscuous mode [ 1634.829822][T18333] debugfs: 'hsr0' already exists in 'hsr' [ 1634.835822][T18333] Cannot create hsr debugfs directory [ 1635.258143][T17388] Bluetooth: hci3: command tx timeout [ 1635.387261][T18502] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11679'. [ 1635.473281][T12963] veth1: left allmulticast mode [ 1635.484342][T12963] veth1: left promiscuous mode [ 1635.500247][T12963] bridge0: port 2(veth1) entered disabled state [ 1635.542766][T12963] veth0: left allmulticast mode [ 1635.560289][T12963] veth0: left promiscuous mode [ 1635.594403][T12963] bridge0: port 1(veth0) entered disabled state [ 1636.126477][T12963] bond82 (unregistering): (slave erspan0): Releasing active interface [ 1636.240916][T12963] batman_adv: batadv0: Removing interface: gretap2 [ 1636.281705][T12963] bond15 (unregistering): (slave geneve4): Releasing active interface [ 1636.302426][T12963] bond12 (unregistering): (slave geneve3): Releasing active interface [ 1636.341331][T12963] team0: Port device bridge1 removed [ 1636.393361][T12963] bond17 (unregistering): (slave bridge4): Releasing backup interface [ 1636.423416][T12963] bond37 (unregistering): (slave bond0): Releasing active interface [ 1636.439577][T12963] bond0 (unregistering): Released all slaves [ 1636.451003][T12963] bond1 (unregistering): Released all slaves [ 1636.467567][T12963] bond2 (unregistering): Released all slaves [ 1636.484041][T12963] bond3 (unregistering): Released all slaves [ 1636.510658][T12963] bond4 (unregistering): Released all slaves [ 1636.526926][T12963] bond5 (unregistering): Released all slaves [ 1636.543388][T12963] bond6 (unregistering): Released all slaves [ 1636.562137][T12963] bond7 (unregistering): Released all slaves [ 1636.590731][T12963] bond8 (unregistering): Released all slaves [ 1636.609148][T12963] bond9 (unregistering): Released all slaves [ 1636.629451][T12963] bond10 (unregistering): Released all slaves [ 1636.651647][T12963] bond11 (unregistering): Released all slaves [ 1636.671788][T12963] bond12 (unregistering): Released all slaves [ 1636.690896][T12963] bond13 (unregistering): Released all slaves [ 1636.725450][T12963] bond14 (unregistering): (slave veth5): Releasing active interface [ 1636.735473][T12963] bond14 (unregistering): Released all slaves [ 1636.762509][T12963] bond15 (unregistering): Released all slaves [ 1636.779479][T12963] bond16 (unregistering): Released all slaves [ 1636.803361][T12963] bond17 (unregistering): Released all slaves [ 1636.819589][T12963] bond18 (unregistering): Released all slaves [ 1636.849870][T12963] bond19 (unregistering): Released all slaves [ 1636.865673][T12963] bond20 (unregistering): Released all slaves [ 1636.882907][T12963] bond21 (unregistering): (slave veth11): Releasing backup interface [ 1636.893266][T12963] bond21 (unregistering): Released all slaves [ 1636.915116][T12963] bond22 (unregistering): (slave bond23): Releasing backup interface [ 1636.929396][T12963] bond22 (unregistering): Released all slaves [ 1636.948779][T12963] bond23 (unregistering): Released all slaves [ 1636.964542][T12963] bond24 (unregistering): Released all slaves [ 1636.980717][T12963] bond25 (unregistering): Released all slaves [ 1636.996612][T12963] bond26 (unregistering): Released all slaves [ 1637.015856][T12963] bond27 (unregistering): Released all slaves [ 1637.036112][T12963] bond28 (unregistering): Released all slaves [ 1637.061561][T12963] bond29 (unregistering): Released all slaves [ 1637.081937][T12963] bond30 (unregistering): Released all slaves [ 1637.098103][T12963] bond31 (unregistering): Released all slaves [ 1637.115108][T12963] bond32 (unregistering): Released all slaves [ 1637.134157][T12963] bond33 (unregistering): Released all slaves [ 1637.154988][T12963] bond34 (unregistering): Released all slaves [ 1637.174328][T12963] bond35 (unregistering): Released all slaves [ 1637.192317][T12963] bond36 (unregistering): Released all slaves [ 1637.213080][T12963] bond37 (unregistering): Released all slaves [ 1637.229576][T12963] bond38 (unregistering): Released all slaves [ 1637.245126][T12963] bond39 (unregistering): Released all slaves [ 1637.265734][T12963] bond40 (unregistering): Released all slaves [ 1637.285016][T12963] bond41 (unregistering): Released all slaves [ 1637.301898][T12963] bond42 (unregistering): Released all slaves [ 1637.318359][T12963] bond43 (unregistering): Released all slaves [ 1637.334025][T12963] bond44 (unregistering): Released all slaves [ 1637.340731][T17388] Bluetooth: hci3: command tx timeout [ 1637.374854][T12963] bond45 (unregistering): Released all slaves [ 1637.392370][T12963] bond46 (unregistering): Released all slaves [ 1637.412668][T12963] bond47 (unregistering): Released all slaves [ 1637.432102][T12963] bond48 (unregistering): Released all slaves [ 1637.449266][T12963] bond49 (unregistering): Released all slaves [ 1637.468867][T12963] bond50 (unregistering): Released all slaves [ 1637.494243][T12963] bond51 (unregistering): Released all slaves [ 1637.510970][T12963] bond52 (unregistering): Released all slaves [ 1637.527489][T12963] bond53 (unregistering): Released all slaves [ 1637.545358][T12963] bond54 (unregistering): (slave team0): Releasing active interface [ 1637.554436][T12963] bond54 (unregistering): Released all slaves [ 1637.574926][T12963] bond55 (unregistering): Released all slaves [ 1637.591333][T12963] bond56 (unregistering): Released all slaves [ 1637.608856][T12963] bond57 (unregistering): Released all slaves [ 1637.632105][T12963] bond58 (unregistering): Released all slaves [ 1637.649751][T12963] bond59 (unregistering): Released all slaves [ 1637.665708][T12963] bond60 (unregistering): Released all slaves [ 1637.685543][T12963] bond61 (unregistering): Released all slaves [ 1637.703153][T12963] bond62 (unregistering): Released all slaves [ 1637.720257][T12963] bond63 (unregistering): Released all slaves [ 1637.742463][T12963] bond64 (unregistering): Released all slaves [ 1637.766187][T12963] bond65 (unregistering): Released all slaves [ 1637.782978][T12963] bond66 (unregistering): Released all slaves [ 1637.801851][T12963] bond67 (unregistering): Released all slaves [ 1637.819645][T12963] bond68 (unregistering): Released all slaves [ 1637.835496][T12963] bond69 (unregistering): Released all slaves [ 1637.855243][T12963] bond70 (unregistering): Released all slaves [ 1637.878757][T12963] bond71 (unregistering): Released all slaves [ 1637.894394][T12963] bond72 (unregistering): Released all slaves [ 1637.915211][T12963] bond73 (unregistering): Released all slaves [ 1637.931893][T12963] bond74 (unregistering): Released all slaves [ 1637.955556][T12963] bond75 (unregistering): Released all slaves [ 1637.972329][T12963] bond76 (unregistering): Released all slaves [ 1637.988325][T12963] bond77 (unregistering): Released all slaves [ 1638.003844][T12963] bond78 (unregistering): Released all slaves [ 1638.021355][T12963] bond79 (unregistering): Released all slaves [ 1638.046782][T12963] bond80 (unregistering): Released all slaves [ 1638.064968][T12963] bond81 (unregistering): Released all slaves [ 1638.088373][T12963] bond82 (unregistering): Released all slaves [ 1638.161662][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1638.297518][ T8423] netdevsim netdevsim4 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 1638.818246][T18333] netdevsim netdevsim4 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1638.971834][T12963] tipc: Disabling bearer [ 1638.994018][T12963] tipc: Left network mode [ 1639.069634][T18333] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1639.281583][T18333] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1639.381512][T18579] netlink: 108 bytes leftover after parsing attributes in process `syz.3.11704'. [ 1639.416923][T17388] Bluetooth: hci3: command tx timeout [ 1639.663086][T18587] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11705'. [ 1639.681581][T18333] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1640.083774][T18585] syzkaller0: entered promiscuous mode [ 1640.110712][T18585] syzkaller0: entered allmulticast mode [ 1640.309275][T18613] netlink: 'syz.0.11712': attribute type 11 has an invalid length. [ 1640.334654][T18613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11712'. [ 1643.034573][T18631] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11717'. [ 1643.338931][T18615] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1643.458455][T18333] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1643.515840][T18333] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1643.536799][T18333] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1643.559390][T18333] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1643.783991][T12963] batman_adv: batadv0: Removing interface: vlan2 [ 1644.117527][T18669] xt_hashlimit: size too large, truncated to 1048576 [ 1644.672452][T18333] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1644.685372][T18333] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1644.694601][T18662] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 1644.735830][T18333] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1644.791580][T18333] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1645.134793][T12963] IPVS: stop unused estimator thread 0... [ 1645.303194][T18333] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1645.358328][T18333] 8021q: adding VLAN 0 to HW filter on device team0 [ 1645.395049][ T8421] bridge0: port 1(bridge_slave_0) entered blocking state [ 1645.402264][ T8421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1645.442449][ T8421] bridge0: port 2(bridge_slave_1) entered blocking state [ 1645.449683][ T8421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1646.368747][T18333] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1646.943612][T18333] veth0_vlan: entered promiscuous mode [ 1646.963888][T18333] veth1_vlan: entered promiscuous mode [ 1647.005390][T18333] veth0_macvtap: entered promiscuous mode [ 1647.023330][T18333] veth1_macvtap: entered promiscuous mode [ 1647.051329][T18333] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1647.069285][T18786] syz_tun: entered allmulticast mode [ 1647.081100][T18333] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1647.110127][T18786] dvmrp8: entered allmulticast mode [ 1647.143512][T18785] syz_tun: left allmulticast mode [ 1647.158259][T12956] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.185457][T12956] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.250872][T18793] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11771'. [ 1647.406255][T12952] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.431174][T12952] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.500418][T12956] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1647.535434][T12956] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1647.624292][ T8421] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1647.649740][ T8421] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1648.452299][ T5610] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1648.472698][ T5610] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1648.482153][ T5610] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1648.493285][ T5610] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1648.503351][ T5610] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1649.261143][T18843] lo speed is unknown, defaulting to 1000 [ 1649.461146][T18886] netlink: 'syz.2.11807': attribute type 34 has an invalid length. [ 1649.469387][T18886] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11807'. [ 1649.549097][T18886] bond86: option lacp_strict: invalid value (64) [ 1649.589906][T18886] bond86 (unregistering): Released all slaves [ 1650.648508][T17388] Bluetooth: hci4: command tx timeout [ 1651.131525][T18843] bridge0: port 1(bridge_slave_0) entered blocking state [ 1651.164270][T18843] bridge0: port 1(bridge_slave_0) entered disabled state [ 1651.205715][T18843] bridge_slave_0: entered allmulticast mode [ 1651.246327][T18843] bridge_slave_0: entered promiscuous mode [ 1651.296738][T18843] bridge0: port 2(bridge_slave_1) entered blocking state [ 1651.311062][T18939] netlink: 'syz.0.11827': attribute type 11 has an invalid length. [ 1651.332058][T18843] bridge0: port 2(bridge_slave_1) entered disabled state [ 1651.381744][T18843] bridge_slave_1: entered allmulticast mode [ 1651.419276][T18843] bridge_slave_1: entered promiscuous mode [ 1651.591154][T18843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1651.640569][T18843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1651.904144][T18948] bond1: (slave wg0): Device is not bonding slave [ 1651.913316][T18948] bond1: option active_slave: invalid value (wg0) [ 1651.968035][T18948] bond1 (unregistering): Released all slaves [ 1652.114626][T18843] team0: Port device team_slave_0 added [ 1652.165711][T18843] team0: Port device team_slave_1 added [ 1652.383817][T18843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1652.409522][T18843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1652.524100][T18843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1652.585784][T18843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1652.611825][T18843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1652.698268][T17388] Bluetooth: hci4: command tx timeout [ 1652.737538][T18843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1652.967008][T18843] hsr_slave_0: entered promiscuous mode [ 1652.984215][T18843] hsr_slave_1: entered promiscuous mode [ 1653.003504][T18843] debugfs: 'hsr0' already exists in 'hsr' [ 1653.021998][T18843] Cannot create hsr debugfs directory [ 1654.144062][T18990] tipc: Started in network mode [ 1654.161199][T18990] tipc: Node identity eef6bced5a5f, cluster identity 4711 [ 1654.220588][T18990] tipc: Enabled bearer , priority 0 [ 1654.303121][T18988] tipc: Resetting bearer [ 1654.457704][T18994] syzkaller0: entered promiscuous mode [ 1654.469488][T18994] syzkaller0: entered allmulticast mode [ 1654.502095][T18985] tipc: Resetting bearer [ 1654.592516][T18985] tipc: Disabling bearer [ 1654.789096][T17388] Bluetooth: hci4: command tx timeout [ 1654.977758][T18843] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1655.454842][T19022] netlink: 'syz.0.11858': attribute type 12 has an invalid length. [ 1656.856430][T17388] Bluetooth: hci4: command tx timeout [ 1657.442266][T18843] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 3072 - 0 [ 1657.508628][T18843] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1657.572696][T18843] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1657.651734][T18843] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1658.346900][T19086] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11885'. [ 1660.509905][T19143] netlink: 'syz.2.11910': attribute type 24 has an invalid length. [ 1660.534662][T18843] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 3072 - 0 [ 1660.563106][T18843] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1660.599384][T18843] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1660.659995][T18843] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 1660.866798][T19150] netlink: 324 bytes leftover after parsing attributes in process `syz.3.11914'. [ 1660.894623][T19150] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11914'. [ 1661.067520][T19154] netlink: 'syz.2.11916': attribute type 61 has an invalid length. [ 1661.591467][T19168] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11923'. [ 1661.773411][T19174] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11926'. [ 1662.681383][ C1] sched: DL replenish lagged too much [ 1663.022400][T19197] netlink: 9 bytes leftover after parsing attributes in process `syz.2.11937'. [ 1663.041789][T19197] netlink: 9 bytes leftover after parsing attributes in process `syz.2.11937'. [ 1663.373240][T19207] netlink: 'syz.2.11942': attribute type 34 has an invalid length. [ 1663.381606][T19207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11942'. [ 1663.694102][ T25] block nbd1: Possible stuck request ffff888027135080: control (read@0,1024B). Runtime 330 seconds [ 1663.717391][ T25] block nbd1: Possible stuck request ffff888027135240: control (read@1024,1024B). Runtime 330 seconds [ 1663.741177][ T25] block nbd1: Possible stuck request ffff888027135400: control (read@2048,1024B). Runtime 330 seconds [ 1663.765530][ T25] block nbd1: Possible stuck request ffff8880271355c0: control (read@3072,1024B). Runtime 330 seconds [ 1663.804323][T19214] netlink: 'syz.2.11945': attribute type 4 has an invalid length. [ 1664.288711][T19224] netlink: 'syz.3.11950': attribute type 29 has an invalid length. [ 1664.322463][T19224] netlink: 'syz.3.11950': attribute type 29 has an invalid length. [ 1664.574457][T19232] netlink: 'syz.3.11954': attribute type 34 has an invalid length. [ 1664.606431][T19232] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11954'. [ 1665.437844][T19256] netlink: 'syz.3.11965': attribute type 61 has an invalid length. [ 1665.474083][T19256] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11965'. [ 1665.729500][T19262] netlink: 'syz.0.11968': attribute type 34 has an invalid length. [ 1665.757513][T19262] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11968'. [ 1667.469542][T19301] syzkaller0: entered promiscuous mode [ 1667.499728][T19301] syzkaller0: entered allmulticast mode [ 1667.802473][T18843] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1667.865328][T18843] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1667.892315][T18843] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1667.954255][T18843] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1667.988092][T18843] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1668.041322][T18843] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1668.073132][T18843] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1668.123628][T18843] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1668.658673][T18843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1668.793208][T18843] 8021q: adding VLAN 0 to HW filter on device team0 [ 1668.872116][T12961] bridge0: port 1(bridge_slave_0) entered blocking state [ 1668.879379][T12961] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1668.981802][T12963] bridge0: port 2(bridge_slave_1) entered blocking state [ 1668.989082][T12963] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1669.709840][T19353] netlink: 'syz.3.12005': attribute type 34 has an invalid length. [ 1669.758384][T19353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12005'. [ 1672.274345][T18843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1672.492651][T18843] veth0_vlan: entered promiscuous mode [ 1672.598445][T18843] veth1_vlan: entered promiscuous mode [ 1672.764058][T18843] veth0_macvtap: entered promiscuous mode [ 1672.829578][T18843] veth1_macvtap: entered promiscuous mode [ 1672.952103][T18843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1672.980763][T19431] netlink: 'syz.2.12036': attribute type 34 has an invalid length. [ 1673.039785][T18843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1673.101943][T19431] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12036'. [ 1673.402847][ T8421] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1673.591622][T12961] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1673.640333][T12961] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1673.706204][T12961] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1673.925801][T12956] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1673.954047][T12956] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1674.036722][T12958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1674.044749][T12958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1674.559739][T19456] netlink: 'syz.0.12046': attribute type 29 has an invalid length. [ 1674.578626][T19454] syzkaller0: entered promiscuous mode [ 1674.614024][T19454] syzkaller0: entered allmulticast mode [ 1674.675724][T19456] netlink: 'syz.0.12046': attribute type 29 has an invalid length. [ 1674.701659][T19460] tipc: Started in network mode [ 1674.731179][T19460] tipc: Node identity e2b16a3bd52a, cluster identity 4711 [ 1674.804124][T19460] tipc: Enabled bearer , priority 0 [ 1674.898665][T19453] tipc: Resetting bearer [ 1675.471335][T19468] netlink: 'syz.4.12051': attribute type 34 has an invalid length. [ 1675.497570][T19453] tipc: Disabling bearer [ 1675.520562][T19468] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12051'. [ 1675.978755][ T5610] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1676.047802][ T5610] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1676.081546][ T5610] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1676.148176][ T5610] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1676.204562][ T5610] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1677.410674][T19501] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12062'. [ 1678.308293][T17388] Bluetooth: hci0: command tx timeout [ 1679.152655][T19520] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12068'. [ 1679.372446][T12958] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1679.571803][T19474] lo speed is unknown, defaulting to 1000 [ 1680.409466][T17388] Bluetooth: hci0: command tx timeout [ 1681.063963][T12958] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1681.582157][T19474] bridge0: port 1(bridge_slave_0) entered blocking state [ 1681.621740][T19474] bridge0: port 1(bridge_slave_0) entered disabled state [ 1681.629662][T19474] bridge_slave_0: entered allmulticast mode [ 1681.637953][T19474] bridge_slave_0: entered promiscuous mode [ 1681.647505][T19474] bridge0: port 2(bridge_slave_1) entered blocking state [ 1681.656794][T19474] bridge0: port 2(bridge_slave_1) entered disabled state [ 1681.664109][T19474] bridge_slave_1: entered allmulticast mode [ 1681.672735][T19474] bridge_slave_1: entered promiscuous mode [ 1682.317494][T12958] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1682.459546][T17388] Bluetooth: hci0: command tx timeout [ 1682.921179][T19474] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1682.963655][T19474] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1683.895242][T12958] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1684.180093][T19474] team0: Port device team_slave_0 added [ 1684.184010][T19592] netlink: zone id is out of range [ 1684.202605][T19592] netlink: zone id is out of range [ 1684.228246][T19474] team0: Port device team_slave_1 added [ 1684.457898][T19474] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1684.486122][T19474] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1684.548331][T17388] Bluetooth: hci0: command tx timeout [ 1684.599564][T19474] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1684.632498][T19474] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1684.648115][T19474] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1684.724542][T19474] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1685.446521][T19474] hsr_slave_0: entered promiscuous mode [ 1685.492726][T19474] hsr_slave_1: entered promiscuous mode [ 1685.549754][T19474] debugfs: 'hsr0' already exists in 'hsr' [ 1685.600047][T19474] Cannot create hsr debugfs directory [ 1685.986249][T12952] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.238507][T12961] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.477518][ T8421] netdevsim netdevsim2 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.557251][ T8421] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.791650][T12958] veth1: left allmulticast mode [ 1686.817393][T12958] bridge0: port 2(veth1) entered disabled state [ 1686.982584][T12958] veth0: left allmulticast mode [ 1686.999500][T12958] veth0: left promiscuous mode [ 1687.019030][T12958] bridge0: port 1(veth0) entered disabled state [ 1687.109704][T12958] dvmrp8: left allmulticast mode [ 1688.994758][T12958] bond0 (unregistering): Released all slaves [ 1689.011095][T12958] bond1 (unregistering): Released all slaves [ 1689.042275][T12958] bond2 (unregistering): Released all slaves [ 1689.070625][T12958] bond3 (unregistering): Released all slaves [ 1689.106873][T12958] bond4 (unregistering): Released all slaves [ 1689.142142][T12958] bond5 (unregistering): Released all slaves [ 1689.190917][T12958] bond6 (unregistering): Released all slaves [ 1689.225689][T12958] bond7 (unregistering): Released all slaves [ 1689.256808][T12958] bond8 (unregistering): Released all slaves [ 1689.303800][T12958] bond9 (unregistering): Released all slaves [ 1689.332294][T12958] bond10 (unregistering): Released all slaves [ 1689.374299][T12958] bond11 (unregistering): Released all slaves [ 1689.401929][T12958] bond12 (unregistering): Released all slaves [ 1689.425391][T12958] bond13 (unregistering): Released all slaves [ 1689.455114][T12958] bond14 (unregistering): Released all slaves [ 1689.555453][T12958] bond15 (unregistering): Released all slaves [ 1689.608616][T12958] bond16 (unregistering): Released all slaves [ 1689.671404][T12958] bond17 (unregistering): Released all slaves [ 1689.719639][T12958] bond18 (unregistering): Released all slaves [ 1689.779274][T12958] bond19 (unregistering): Released all slaves [ 1689.803811][T12958] bond20 (unregistering): Released all slaves [ 1689.832227][T12958] bond21 (unregistering): Released all slaves [ 1689.861845][T12958] bond22 (unregistering): Released all slaves [ 1689.910633][T12958] bond23 (unregistering): Released all slaves [ 1689.975917][T12958] bond24 (unregistering): Released all slaves [ 1690.034367][T12958] bond25 (unregistering): Released all slaves [ 1690.063832][T12958] bond26 (unregistering): Released all slaves [ 1690.085735][T12958] bond27 (unregistering): Released all slaves [ 1690.125393][T12958] bond28 (unregistering): Released all slaves [ 1690.173430][T12958] bond29 (unregistering): Released all slaves [ 1690.201962][T12958] bond30 (unregistering): Released all slaves [ 1690.248421][T12958] bond31 (unregistering): Released all slaves [ 1690.272286][T12958] bond32 (unregistering): Released all slaves [ 1690.297614][T12958] bond33 (unregistering): Released all slaves [ 1690.320017][T12958] bond34 (unregistering): Released all slaves [ 1690.349620][T12958] bond35 (unregistering): Released all slaves [ 1690.413789][T12958] bond36 (unregistering): Released all slaves [ 1690.434882][T12958] bond37 (unregistering): Released all slaves [ 1690.464992][T12958] bond38 (unregistering): Released all slaves [ 1690.494496][T12958] bond39 (unregistering): Released all slaves [ 1690.523551][T12958] bond40 (unregistering): Released all slaves [ 1690.559275][T12958] bond41 (unregistering): Released all slaves [ 1690.589349][T12958] bond42 (unregistering): Released all slaves [ 1690.618035][T12958] bond43 (unregistering): Released all slaves [ 1690.644552][T12958] bond44 (unregistering): Released all slaves [ 1690.673782][T12958] bond45 (unregistering): Released all slaves [ 1690.700205][T12958] bond46 (unregistering): Released all slaves [ 1690.727095][T12958] bond47 (unregistering): Released all slaves [ 1690.756602][T12958] bond48 (unregistering): Released all slaves [ 1690.793728][T12958] bond49 (unregistering): Released all slaves [ 1690.847535][T12958] bond50 (unregistering): Released all slaves [ 1690.873442][T12958] bond51 (unregistering): Released all slaves [ 1690.900105][T12958] bond52 (unregistering): Released all slaves [ 1690.935420][T12958] bond53 (unregistering): Released all slaves [ 1690.976356][T12958] bond54 (unregistering): Released all slaves [ 1690.999589][T12958] bond55 (unregistering): Released all slaves [ 1691.025932][T12958] bond56 (unregistering): Released all slaves [ 1691.047607][T12958] bond57 (unregistering): Released all slaves [ 1691.075174][T12958] bond58 (unregistering): Released all slaves [ 1691.132625][T12958] bond59 (unregistering): Released all slaves [ 1691.162149][T12958] bond60 (unregistering): Released all slaves [ 1691.199133][T12958] bond61 (unregistering): Released all slaves [ 1691.233664][T12958] bond62 (unregistering): Released all slaves [ 1691.264467][T12958] bond63 (unregistering): Released all slaves [ 1691.296928][T12958] bond64 (unregistering): Released all slaves [ 1691.321554][T12958] bond65 (unregistering): Released all slaves [ 1691.361683][T12958] bond66 (unregistering): Released all slaves [ 1691.385268][T12958] bond67 (unregistering): Released all slaves [ 1691.429420][T12958] bond68 (unregistering): Released all slaves [ 1691.454126][T12958] bond69 (unregistering): Released all slaves [ 1691.484666][T12958] bond70 (unregistering): Released all slaves [ 1691.517934][T12958] bond71 (unregistering): Released all slaves [ 1691.550902][T12958] bond72 (unregistering): Released all slaves [ 1691.583621][T12958] bond73 (unregistering): Released all slaves [ 1691.605020][T12958] bond74 (unregistering): Released all slaves [ 1691.627338][T12958] bond75 (unregistering): Released all slaves [ 1691.654067][T12958] bond76 (unregistering): Released all slaves [ 1691.677290][T12958] bond77 (unregistering): Released all slaves [ 1691.712521][T12958] bond78 (unregistering): Released all slaves [ 1691.741276][T12958] bond79 (unregistering): Released all slaves [ 1691.770534][T12958] bond80 (unregistering): Released all slaves [ 1691.800705][T12958] bond81 (unregistering): Released all slaves [ 1691.878625][T12958] bond82 (unregistering): Released all slaves [ 1691.903839][T12958] bond83 (unregistering): Released all slaves [ 1691.930642][T12958] bond84 (unregistering): Released all slaves [ 1691.953041][T12958] bond85 (unregistering): Released all slaves [ 1691.989445][T12958] bond86 (unregistering): Released all slaves [ 1692.015226][T12958] bond87 (unregistering): Released all slaves [ 1692.895181][T19698] ip_tables: iptables: counters copy to user failed while replacing table [ 1693.208389][T19474] netdevsim netdevsim2 eth4 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1693.751800][ T5268] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1693.761907][ T25] block nbd1: Possible stuck request ffff888027135080: control (read@0,1024B). Runtime 360 seconds [ 1693.772781][ T25] block nbd1: Possible stuck request ffff888027135240: control (read@1024,1024B). Runtime 360 seconds [ 1693.808921][ T25] block nbd1: Possible stuck request ffff888027135400: control (read@2048,1024B). Runtime 360 seconds [ 1693.820666][ T25] block nbd1: Possible stuck request ffff8880271355c0: control (read@3072,1024B). Runtime 360 seconds [ 1694.393807][ T30] INFO: task udevd:11413 blocked in I/O wait for more than 143 seconds. [ 1694.428758][ T30] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1694.466215][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1694.509790][ T30] task:udevd state:D stack:26056 pid:11413 tgid:11413 ppid:4973 task_flags:0x400140 flags:0x00080002 [ 1694.597007][ T30] Call Trace: [ 1694.657381][ T30] [ 1694.693152][ T30] __schedule+0x17d9/0x56c0 [ 1694.754975][ T30] ? __lock_acquire+0x683/0x2cf0 [ 1694.825715][ T30] ? __pfx___schedule+0x10/0x10 [ 1694.882559][ T30] ? schedule+0x90/0x2b0 [ 1694.923982][ T30] schedule+0x164/0x2b0 [ 1694.964301][ T30] io_schedule+0x7f/0xd0 [ 1694.993864][ T30] folio_wait_bit_common+0x836/0xbc0 [ 1695.025279][ T30] ? filemap_get_entry+0xcd/0x3f0 [ 1695.041704][ T30] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 1695.063180][ T30] ? filemap_read_folio+0x234/0x3a0 [ 1695.076718][ T30] ? __pfx_wake_page_function+0x10/0x10 [ 1695.091143][ T30] ? __filemap_get_folio_mpol+0x7c8/0x1000 [ 1695.109153][ T30] do_read_cache_folio+0x1ac/0x590 [ 1695.121328][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1695.134900][ T30] read_part_sector+0xb6/0x2b0 [ 1695.151390][ T30] adfspart_check_POWERTEC+0x9a/0x7a0 [ 1695.162405][ T30] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 1695.179337][ T30] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 1695.196494][ T30] ? bdev_disk_changed+0x56c/0x17a0 [ 1695.201778][ T30] ? bdev_disk_changed+0x56c/0x17a0 [ 1695.216047][ T30] bdev_disk_changed+0x851/0x17a0 [ 1695.228634][ T30] ? __pfx_bdev_disk_changed+0x10/0x10 [ 1695.243679][ T30] blkdev_get_whole+0x372/0x510 [ 1695.263748][ T30] bdev_open+0x324/0xd70 [ 1695.272487][ T30] blkdev_open+0x461/0x600 [ 1695.286060][ T30] ? __pfx_blkdev_open+0x10/0x10 [ 1695.291089][ T30] do_dentry_open+0x816/0x1380 [ 1695.295907][ T30] vfs_open+0x3b/0x340 [ 1695.321473][ T30] ? path_openat+0x2e2d/0x3830 [ 1695.335661][ T30] path_openat+0x2e44/0x3830 [ 1695.350575][ T30] ? kasan_save_track+0x3e/0x80 [ 1695.371289][ T30] ? do_sys_openat2+0xcc/0x200 [ 1695.389102][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.426577][ T30] do_file_open+0x23e/0x4a0 [ 1695.443121][ T30] ? __pfx_do_file_open+0x10/0x10 [ 1695.470029][ T30] ? _raw_spin_unlock+0x28/0x50 [ 1695.509269][ T30] ? alloc_fd+0x651/0x6c0 [ 1695.525921][ T30] do_sys_openat2+0x115/0x200 [ 1695.541986][ T30] ? __pfx_do_sys_openat2+0x10/0x10 [ 1695.578326][ T30] ? __x64_sys_epoll_wait+0x1d7/0x230 [ 1695.618905][ T30] __x64_sys_openat+0x138/0x170 [ 1695.628746][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.649774][ T30] do_syscall_64+0x174/0x580 [ 1695.654673][ T30] ? clear_bhb_loop+0x70/0xc0 [ 1695.667451][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.686237][ T30] RIP: 0033:0x7f9659aa7407 [ 1695.692190][ T30] RSP: 002b:00007fff0c6caa00 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1695.716084][ T30] RAX: ffffffffffffffda RBX: 00007f965a214880 RCX: 00007f9659aa7407 [ 1695.730022][ T30] RDX: 00000000000a0800 RSI: 000055d59a31e780 RDI: ffffffffffffff9c [ 1695.750599][ T30] RBP: 000055d59a308910 R08: 0000000000000000 R09: 0000000000000000 [ 1695.763795][ T5268] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1695.770672][ T30] R10: 0000000000000000 R11: 0000000000000202 R12: 000055d59a30fc60 [ 1695.795157][ T30] R13: 000055d59a316190 R14: 0000000000000000 R15: 000055d59a30fc60 [ 1695.822603][ T30] [ 1695.853032][ T30] [ 1695.853032][ T30] Showing all locks held in the system: [ 1696.022083][ T30] 1 lock held by khungtaskd/30: [ 1696.027862][ T30] #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1696.044460][ T30] 1 lock held by syslogd/4955: [ 1696.049478][ T30] 2 locks held by getty/5360: [ 1696.054298][ T30] #0: ffff8880358a90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1696.065033][ T30] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1696.098100][ T30] 3 locks held by kworker/1:3/5714: [ 1696.130152][ T30] #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1696.182385][ T30] #1: ffffc90004d7fc40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1696.257625][ T30] #2: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 1696.311901][ T30] 2 locks held by kworker/0:0/25732: [ 1696.338965][ T30] 4 locks held by kworker/0:1/7624: [ 1696.367582][ T30] #0: ffff8880b863b360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 1696.411639][ T30] #1: ffff8880b8624440 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 [ 1696.451545][ T30] #2: ffff8880b8626058 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1a9/0xed0 [ 1696.507841][ T30] #3: ffffffff9a985528 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0xb7/0x420 [ 1696.562847][ T30] 1 lock held by udevd/11413: [ 1696.596708][ T30] #0: ffff88802693f350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 [ 1696.655136][ T30] 4 locks held by kworker/1:5/11916: [ 1696.683540][ T30] 3 locks held by kworker/u8:27/12958: [ 1696.714543][ T30] #0: ffff88801c296140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1696.773942][ T30] #1: ffffc9001d397c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1696.836979][ T30] #2: ffffffff90019308 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 1696.899104][ T30] 7 locks held by syz-executor/19474: [ 1696.927256][ T30] #0: ffff888035f02450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 1696.972915][ T30] #1: ffff88801c2da880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 1697.032203][ T30] #2: ffff888028fd73c8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 [ 1697.078287][ T30] #3: ffffffff8f8a3940 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 [ 1697.110301][ T30] #4: ffff8880292f5128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 [ 1697.422170][ T30] #5: ffff888029de8258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170 [ 1697.485748][ T30] #6: ffffffff8eb5fe38 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 [ 1697.508701][ T30] 1 lock held by syz.0.12108/19626: [ 1697.513957][ T30] #0: ffff888045724ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 [ 1697.566965][ T30] 5 locks held by rm/19752: [ 1697.583367][ T30] [ 1697.585759][ T30] ============================================= [ 1697.585759][ T30] [ 1697.614325][T12958] tipc: Disabling bearer [ 1697.642288][ T30] NMI backtrace for cpu 0 [ 1697.642312][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1697.642335][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1697.642348][ T30] Call Trace: [ 1697.642356][ T30] [ 1697.642366][ T30] dump_stack_lvl+0xe8/0x150 [ 1697.642402][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 1697.642435][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1697.642469][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 1697.642506][ T30] sys_info+0x135/0x170 [ 1697.642530][ T30] watchdog+0xfd7/0x1030 [ 1697.642583][ T30] ? watchdog+0x1c7/0x1030 [ 1697.642615][ T30] kthread+0x388/0x470 [ 1697.642643][ T30] ? __pfx_watchdog+0x10/0x10 [ 1697.642665][ T30] ? __pfx_kthread+0x10/0x10 [ 1697.642694][ T30] ret_from_fork+0x514/0xb70 [ 1697.642727][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1697.642756][ T30] ? __switch_to+0xc89/0x1420 [ 1697.642783][ T30] ? __pfx_kthread+0x10/0x10 [ 1697.642813][ T30] ret_from_fork_asm+0x1a/0x30 [ 1697.642860][ T30] [ 1697.759622][ T30] Sending NMI from CPU 0 to CPUs 1: [ 1697.764900][ C1] NMI backtrace for cpu 1 [ 1697.764922][ C1] CPU: 1 UID: 0 PID: 12952 Comm: kworker/u8:21 Not tainted syzkaller #0 PREEMPT(full) [ 1697.764943][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1697.764956][ C1] Workqueue: events_unbound nsim_dev_trap_report_work [ 1697.764983][ C1] RIP: 0010:rcu_is_watching+0x10/0xb0 [ 1697.765013][ C1] Code: 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 53 65 ff 05 a0 9f c0 11 cb 81 25 0a 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df [ 1697.765040][ C1] RSP: 0018:ffffc90000a088e0 EFLAGS: 00000286 [ 1697.765055][ C1] RAX: 0000000000000001 RBX: ffffffff818f2ffe RCX: ffff88804f719f00 [ 1697.765069][ C1] RDX: 00000000e8a11906 RSI: ffffffff8e4b137f RDI: ffffffff8c4bba80 [ 1697.765082][ C1] RBP: 1ffff9200014113c R08: ffffffff8177827f R09: 0000000000000000 [ 1697.765095][ C1] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: dffffc0000000000 [ 1697.765108][ C1] R13: ffffffff8177827f R14: ffffc90000a089a8 R15: 1ffff92000141135 [ 1697.765122][ C1] FS: 0000000000000000(0000) GS:ffff888125058000(0000) knlGS:0000000000000000 [ 1697.765137][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1697.765149][ C1] CR2: 00007fb3bba8d000 CR3: 000000007f082000 CR4: 00000000003526f0 [ 1697.765166][ C1] Call Trace: [ 1697.765174][ C1] [ 1697.765181][ C1] ? process_scheduled_works+0xa8e/0x14e0 [ 1697.765202][ C1] unwind_next_frame+0xbe/0x2550 [ 1697.765234][ C1] ? nsim_dev_trap_report_work+0x25f/0xb40 [ 1697.765254][ C1] ? unwind_next_frame+0x8f/0x2550 [ 1697.765282][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1697.765303][ C1] arch_stack_walk+0x11b/0x150 [ 1697.765334][ C1] ? process_scheduled_works+0xa8e/0x14e0 [ 1697.765355][ C1] stack_trace_save+0xa9/0x100 [ 1697.765374][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1697.765397][ C1] ? __lock_acquire+0x683/0x2cf0 [ 1697.765422][ C1] kasan_save_track+0x3e/0x80 [ 1697.765443][ C1] ? kasan_save_track+0x3e/0x80 [ 1697.765462][ C1] ? kasan_save_free_info+0x40/0x50 [ 1697.765478][ C1] ? __kasan_slab_free+0x5c/0x80 [ 1697.765499][ C1] ? kfree+0x1c5/0x640 [ 1697.765515][ C1] ? slab_free_after_rcu_debug+0x62/0x220 [ 1697.765540][ C1] ? rcu_core+0x78b/0x10a0 [ 1697.765561][ C1] ? handle_softirqs+0x225/0x840 [ 1697.765579][ C1] ? do_softirq+0x76/0xd0 [ 1697.765596][ C1] ? __local_bh_enable_ip+0xf8/0x130 [ 1697.765613][ C1] ? __alloc_skb+0x1ad/0x7a0 [ 1697.765629][ C1] ? nsim_dev_trap_report_work+0x25f/0xb40 [ 1697.765654][ C1] ? process_scheduled_works+0xa8e/0x14e0 [ 1697.765698][ C1] kasan_save_free_info+0x40/0x50 [ 1697.765734][ C1] __kasan_slab_free+0x5c/0x80 [ 1697.765757][ C1] kfree+0x1c5/0x640 [ 1697.765778][ C1] ? slab_free_after_rcu_debug+0x62/0x220 [ 1697.765808][ C1] slab_free_after_rcu_debug+0x62/0x220 [ 1697.765833][ C1] ? __pfx_slab_free_after_rcu_debug+0x10/0x10 [ 1697.765859][ C1] ? rcu_core+0x70d/0x10a0 [ 1697.765881][ C1] rcu_core+0x78b/0x10a0 [ 1697.765912][ C1] ? __pfx_rcu_core+0x10/0x10 [ 1697.765933][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1697.765964][ C1] handle_softirqs+0x225/0x840 [ 1697.765984][ C1] ? do_softirq+0x76/0xd0 [ 1697.766009][ C1] ? __alloc_skb+0x189/0x7a0 [ 1697.766024][ C1] ? __alloc_skb+0x189/0x7a0 [ 1697.766042][ C1] do_softirq+0x76/0xd0 [ 1697.766062][ C1] [ 1697.766068][ C1] [ 1697.766076][ C1] __local_bh_enable_ip+0xf8/0x130 [ 1697.766096][ C1] __alloc_skb+0x1ad/0x7a0 [ 1697.766118][ C1] nsim_dev_trap_report_work+0x25f/0xb40 [ 1697.766151][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 1697.766171][ C1] process_scheduled_works+0xa8e/0x14e0 [ 1697.766211][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 1697.766236][ C1] ? assign_work+0x3cf/0x5d0 [ 1697.766258][ C1] worker_thread+0xa47/0xfb0 [ 1697.766297][ C1] kthread+0x388/0x470 [ 1697.766323][ C1] ? __pfx_worker_thread+0x10/0x10 [ 1697.766344][ C1] ? __pfx_kthread+0x10/0x10 [ 1697.766371][ C1] ret_from_fork+0x514/0xb70 [ 1697.766399][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1697.766425][ C1] ? __switch_to+0xc89/0x1420 [ 1697.766449][ C1] ? __pfx_kthread+0x10/0x10 [ 1697.766476][ C1] ret_from_fork_asm+0x1a/0x30 [ 1697.766515][ C1] [ 1698.199096][T12958] tipc: Left network mode [ 1698.484293][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 1698.491245][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1698.500415][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1698.510500][ T30] Call Trace: [ 1698.513821][ T30] [ 1698.516796][ T30] vpanic+0x56c/0xa60 [ 1698.520822][ T30] ? __pfx___schedule+0x10/0x10 [ 1698.525708][ T30] ? __pfx_vpanic+0x10/0x10 [ 1698.530271][ T30] panic+0xc5/0xd0 [ 1698.534030][ T30] ? __pfx_panic+0x10/0x10 [ 1698.538486][ T30] ? preempt_schedule_common+0x82/0xd0 [ 1698.543988][ T30] ? preempt_schedule_thunk+0x16/0x40 [ 1698.549399][ T30] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 1698.555588][ T30] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 1698.561779][ T30] watchdog+0x1030/0x1030 [ 1698.566148][ T30] ? watchdog+0x1c7/0x1030 [ 1698.570619][ T30] kthread+0x388/0x470 [ 1698.574750][ T30] ? __pfx_watchdog+0x10/0x10 [ 1698.579472][ T30] ? __pfx_kthread+0x10/0x10 [ 1698.584118][ T30] ret_from_fork+0x514/0xb70 [ 1698.588754][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 1698.593936][ T30] ? __switch_to+0xc89/0x1420 [ 1698.598649][ T30] ? __pfx_kthread+0x10/0x10 [ 1698.603287][ T30] ret_from_fork_asm+0x1a/0x30 [ 1698.608112][ T30] [ 1698.611780][ T30] Kernel Offset: disabled [ 1698.616121][ T30] Rebooting in 86400 seconds..