last executing test programs: 5.185503823s ago: executing program 2 (id=5663): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@rand_addr=0x64010100, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x8000000000000000, 0x100000000, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@private=0xa010102, 0x4}}, 0xe8) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@rand_addr=0x64010102, 0x4e22, 0x0, 0x4e22, 0x48, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffc, 0xffffffffffffffff, 0xfff, 0x10001, 0x5, 0x5, 0x5, 0xfffffffffffffffd}, {0x58b6c42b, 0xffffffffffff90df, 0x0, 0x20000000000000}, 0x40, 0x0, 0x1, 0x0, 0x1}, {{@in=@empty, 0x4d4, 0x6c}, 0x2, @in=@broadcast, 0x3502, 0x4, 0x3, 0x0, 0x0, 0x0, 0x200000}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x17}}}, 0x1c) 4.759662212s ago: executing program 4 (id=5665): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x8, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4, 0xfff2}, {}, {0xc, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r2 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt(r2, 0x0, 0xc, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getqdisc={0x24, 0x26, 0x52e, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x3, 0x10}, {0x8, 0xf}, {0xf, 0xa}}}, 0x24}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x10c, 0xc0000001, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0x8}, {0x2, 0xf}, {0x8, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_TARGET={0x8, 0x3, 0x2}, @TCA_FQ_PIE_TUPDATE={0x8, 0x4, 0x400}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="03000000000000000f0012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_type(r4, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4000000010004b0400000000010000007a00edff", @ANYRES32=0x0, @ANYBLOB="129c000000000000200012800b0001006272696467650000100002800a0014000180c20000030000"], 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r7 = openat$cgroup_procs(r4, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a3000000000580000000000000900010073797a30000000000900020073797a31000000002c00038008000140000000000800024000008004180003801400010070696d3672656731000000000000000048000000160a0101000b000000000000010000000900020073797a31000000000900010073797a3000be53d95bb491d734661c7f175f76e8700000001c000380180003801400010070696d3672656731000000e00000000014000000"], 0xe8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) write$cgroup_pid(r7, &(0x7f0000000080), 0x12) r9 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r9, &(0x7f00000001c0)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @dev}, 0x10) r10 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000440)='cpuacct.stat\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000200)=0x1, 0x12) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 3.919208571s ago: executing program 2 (id=5670): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61106800000000006113740000000000bfa00000000000000700000008fffdffd50301000ee600c07b0000000000000069163a0000000000bf67000000000000350607000fff072017060000201900001603faff0ee60060bf050000000000407b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) 3.37445748s ago: executing program 2 (id=5672): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000380)={r1, &(0x7f0000000280)='syzkaller1\x00', 0x80, &(0x7f00000002c0)={@_ha_fsid={[0x80000000, 0x7fff]}, {0x401, 0x5, 0x6, 0x8}}, 0x3ff, &(0x7f0000000300)={@_ha_fsid}, &(0x7f0000000340)=0xfffffffd}) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f00000003c0)=r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) accept4$bt_l2cap(r5, &(0x7f0000000140), &(0x7f0000000240)=0xe, 0x800) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@ipv6_newrule={0x40, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x80, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FRA_SRC={0x14, 0x2, @local}, @FIB_RULE_POLICY=@FRA_PROTOCOL={0x5, 0x15, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008081}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) write$tun(r0, &(0x7f00000004c0)={@val, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x6}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x1c, 0xe4, 0x0, 0x8, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x29}, @loopback}, "3eda35701bfb0bc2"}}}}}, 0x36) 3.370556508s ago: executing program 4 (id=5673): r0 = socket$inet_sctp(0x2, 0x5f9305f767c7fbcd, 0x84) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000580)=0x1ff, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000002000000000000000100000d0000000000000000030000000000000000000001ff000000400000000000000000000003000000000200000002"], 0x0, 0x56, 0x0, 0x1}, 0x28) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x500, 0x0, 0x18c, 0x203, 0x340, 0x19030000, 0x430, 0x2e0, 0x2e0, 0x430, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x340, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8, 0x2000000}, {}, {}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x80}, {0x0, 0x0, 0x0, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {0x800}, {0x0, 0x0, 0x0, 0x9}, {0xfffc, 0x0, 0x0, 0x10}, {0x0, 0xfc}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04, 0x0, 0x0, 0xc}, {}, {}, {0x20, 0x6, 0x1}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0xb}, {0x4, 0x2}]}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x3, 0x9, 0x0, 0x3, '\x00', 'syz1\x00', {0xaf9}}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, [0x7f7fffff, 0xffffff00, 0xffffff00], [0xff, 0x1fffffffe, 0xffffffff, 0xffffff00], 'pimreg0\x00', 'pim6reg0\x00', {}, {0xff}, 0x73, 0xd, 0x2, 0x50}, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x560) 3.370159608s ago: executing program 3 (id=5674): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x34020d00) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, 0x0) 3.108723383s ago: executing program 4 (id=5676): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000001010000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000800000000000900000000000000200000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000002000000000000010001000000000084010500ac1414aa00000000000000000000000000000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c0000000200000000000800000000000000ffffe000000200000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac14144300000000000000000000000000000000330000000200000000000000000000000000ffffac1414aa000000000000000000000000000000000000000020010000000000000000000000000000000004d26c000000000000000000000000000000000000000000000100000000000000000c0000000000000000000000ac1e0101000000000000000000000000000004d26c000000d6000000e00000020000000000000000000000000000000005"], 0x23c}, 0x1, 0x0, 0x0, 0x11}, 0x4000) 2.992829067s ago: executing program 4 (id=5677): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x15, 0x13, &(0x7f0000000140)=ANY=[@ANYBLOB="18110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000000800007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000185a00000a0000000000000000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7910e0008000000b7030000040000008500000006000000"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0x8e, &(0x7f00000003c0)=""/142, 0x0, 0xb, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x5, 0x5}, 0x8, 0x10, &(0x7f00000004c0)={0x2, 0x8, 0x9, 0x7}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f0000000500)=[0x1, 0x1], &(0x7f0000000540)=[{0x1, 0x3, 0x6, 0x8}, {0x1, 0x4, 0x4, 0x6}, {0x3, 0x1, 0x6, 0xc}, {0x0, 0x3, 0xf, 0x2}, {0x2, 0x3, 0x3, 0xa}], 0x10, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r0, 0x0, 0x34, 0x0, &(0x7f00000006c0)="5eb62788ecd1fe7f42e4aef38559af2d395eb652c9f8b99a2dd70318b3f673a0903c71503aae9e9e010d095dd94bf0f8891180ce", &(0x7f0000000700), 0xa0, 0x0, 0xab, 0x80, &(0x7f0000000740)="24f2319e8da38ac1031aa8085e7b1f73bc5e2b04052f2ac22afc13d8ba595fda24cd5ab55e73a13c964e2d5d896de90be54fb6255d25ee329a8e4b1607f29abd27b7adc2ed30bf69a3b0630fe2a39af9b74558c3311e55f8991854dc866615442574cad5dbff6ae003c970e14e58d1e1be7c61cba92a49d0110989a24ee4908c7ffd406faac66ace0a40a1a56d5c8c0acdf1931485671cae03467246f523393d92766c44ede51de998bb55", &(0x7f0000000800)="b2aa2f37526cd6fb8f82581b6f1d9d90f6dffb3a71c5781adec5960424401c6cd7f67e0e96a9db7a529d3c70d6edad4028d72b7681958e097e02a58681239115d826fa5129f5c4f79dff426b9bcd12a95faf94fc94080e6833be6f22d25977449b869abfd4f1d63ce8126f8af945ed213aac68413429bdc164877e914a95f41d", 0x3, 0x0, 0x8}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r5, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x4c0c0}, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r8 = socket$netlink(0x10, 0x3, 0x14) preadv(r7, &(0x7f0000000280)=[{&(0x7f00000002c0)=""/12, 0xc}], 0x1, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e80), r12) ioctl$sock_SIOCGIFINDEX_802154(r12, 0x8933, &(0x7f0000001600)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r12, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010065bd7000ffdbdf252100000008000300", @ANYRES32=r14, @ANYBLOB="24002d80050001"], 0x40}, 0x1, 0x0, 0x0, 0x24880}, 0x4000880) sendmsg$NL802154_CMD_SET_CHANNEL(r11, &(0x7f0000000900)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000700)={&(0x7f0000000340)={0x38, r13, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x15}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x17}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000001}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040010}, 0x40000) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c00000010005f958a48ae5df5a501040800b000", @ANYRES32=0x0, @ANYBLOB="08000000000001002c00128009000100766c616e000000001c000280060001000200000006000100020000000600050088a8000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) r15 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$int_in(r15, 0x5452, &(0x7f0000000000)=0xf) r16 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000101000028"], 0x50) r17 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x9, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000ffffffff000000000000000018120000", @ANYRES32=r16, @ANYBLOB="0000000000000000b703000000052000850000001b000000b700000018000000850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r17, r16}, 0xc) 2.977421228s ago: executing program 1 (id=5678): unshare(0x20400) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x11e, 0x1, 0x0, 0x0) 2.747572182s ago: executing program 1 (id=5679): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7ff}, [@call={0x85, 0x0, 0x0, 0x2a}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0xffffffffffffffdf) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1af8ff00000000bfa100000000000007010000b8"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f0000009500000000000000"], 0x0, 0xfffffdfe, 0x0, 0x0, 0x727c45cd4283345, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xffffffffffffff50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.572025845s ago: executing program 3 (id=5681): bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) (async) r0 = socket$xdp(0x2c, 0x3, 0x0) getsockopt(r0, 0x7, 0x3, &(0x7f0000000480)=""/4096, &(0x7f0000001480)=0x1000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) r1 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r2 = socket$netlink(0x10, 0x3, 0x8) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r1) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r2, &(0x7f00000015c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001580)={&(0x7f0000001b00)=ANY=[@ANYBLOB="d4100000", @ANYRES16=r4, @ANYBLOB="08000000040000100000014b44d126775dbf6d7e0000001408000300", @ANYRES32=0x0, @ANYBLOB="940f1180900f0580340000800a00010008021100000100000a00010008021100000100000a00010008021100000100000a0001000802110000010000e00200800a000100ffffffffffff000070000380040002006800018038000180050006001a00000004000c00080002000400000008000200020000000500030000000000050003000800000008000200010000002c000180050007000a000000040009000500050000000000050003000e00000004000c000400010004000c00700003801400018010000180040009000500060013000000540001802800018005000700ff000000050007000600000004000100080002000100000004000a0004000c000800018004000b002000018005000500040000000400090004000100050003000400000004000100040002003c0002800800a100a90300000500190107000000050019010d0000000800270000000000080027000100000008002201a9030000080026007116000034000280080026006c09000008002700010000000800a0000200000008009f000400000005001901080000000500180126000000800103800400020004000200040002004800018018000180040008000400090004000900050006001e00000014000180050003000100000006000400080000000c0001800400010004000c000c00018005000300060000006c0001802000018004000b000800020004000000050007000600000005000700020000004800018004000a0008000200000000000800020003000000050005000a00000004000900050007000000000005000700020000000800020003000000050003000500000004000100bc0001802000018004000c0005000700050000000500030000000000050007000300000018000180050005000d000000050006000e00000004000800080001800400080038000180050003000b000000080002000400000004000b0005000500040000000500030007000000040009000400010004000100040009004000018005000300070000000500070001000000050006001c00000004000c00050006001100000005000300030000000400090004000c000500050005000000680200800a0001000802110000010000bc00038004000200b00001801400018004000a0004000c0006000400010000001c00018008000200010000000400090004000b0005000700030000002c000180050006000b0000000800020003000000050003000400000004000900050007000100000004000b0010000180050007000800000004000900180001800400090004000100040008000400010004000b002800018004000c0004000b00060004000700000004000100080002000200000004000900040008000400020010000380040002000400020004000200040003807c010380d80001800800018004000b000800018004000c001400018005000500040000000500060011000000040001803400018004000800060004007200000004000a0008000200000000000400080004000a0005000700090000000500070004000000380001800800020004000000040001000800020001000000060004000b000000050006001700000004000c00050005000700000004000100280001800800020001000000050006001f00000004000a00050003000400000004000100040008001800018005000500070000000600040006eb000004000b00040002000400020090000180200001800500030002000000080002000000000006000400ff00000004000900280001800400080004000a0004000a0004000900050003000d000000050005000600000004000b0024000180050007000200000005000300060000000400090004000c000500050001000000200001800800020001000000050005000e00000004000900050003000800000004000200040002000a000100ffffffffffff00002c0300807c02038004000200940001800c0001800600040072b2000024000180060004000400000004000c000600040001000000080002000000000004000a0018000180040009000600040000800000050006001800000020000180050005000b000000040009000500030003000000050007002b00000028000180040001000800020003000000050003000800000004000c000400010004000b0004000b001c0101803000018004000900060004000100000004000c00050005000200000004000800080002000300000005000500060000001c0001800500070005000000050006001900000006000400018000000c0001800800020001000000300001800400090004000c00060004000400000004000b0004000800040001000400010004000c0006000400070000002c0001800500060006000000040008000600040002000000050007000c0000000400090008000200030000003000018004000c00040001000500070009000000050006001200000004000800060004000400000005000300010000000800018004000b002c00018004000b00080002000300000004000a00040008000400010008000200040000000500030004000000040002000400020004000200040002000400020004000200ac00018018000180060004005106000005000700ce000000040001001800018004000b0004000c0004000a0004000a0004000a0028000180050005000800000006000400040000000800020000000000060004001000000004000a00340001800600040006000000040009000500050009000000050005000c00000006000400030000000400010005000700070000001c0001800400090008000200020000000400090004000b000400090034000280050019010b000000050018010f000000050019010e00000008009f000400000008009f00020000000800a000010000000a000100ffffffffffff00001c000280080022016f03000008009f000200000008002201110100000c00028008009f00070000000a00010008021100000100000a00010008021100000000002c0002800800a000fffbffff08009f0001000000050018012a00000008002201390200000500180126000000f40100800a00010008021100000000000a0001000802110000010000e0000380300001802c00018004000c0005000500070000000400090004000a00050003000d00000004000c00050007000100000004000180a4000180140001800500060015000000040009000400010020000180050007000700000004000100040001000400010008000200040000003000018008000200000000000500050001000000040009000400080004000b000400090004000c0008000200010000003400018005000700020000000400090004000a0004000100050003000800000006000400820b00000500030005000000040001000800018004000100040002000c0002800500180126000000140002800800a0000800000008002201840000004c000280080026000c170000080026006c0900000800a100ffff000008002600ee16000008009f000600000005001801390000000800a00001000000080026006c09000008002201d40000000a00010008021100000000004c0002800800a10002000000050019010b00000008002201e8000000080022014b02000008002700010000000800a00007000000050018012200000008009f000100000008009f0000000000340002800800a0003f0000000800a100030000000800a000000000800800a000040000000800a10001000000080026006c09000008000080040002801c0000800a00010008021100000100000a000100ffffffffffff0000100000800a00010008021100000000006c020080100003800400020004000180040002000a000100ffffffffffff00004c02038004000200d80001800800018004000800140001800400090004000b0008000200030000003c0001800400010004000b000800020004000000050005000e00000004000b000500070006000000050005000900000004000b0008000200030000003800018004000100050003000400000004000a00050006000600000004000b00060004000f0000000500060018000000060004000900000024000180080002000400000004000a0004000b000800020000000000050003000300000020000180050005000700000006000400030000000400010005000500030000000400020004000200600101800c0001800400010004000c0034000180040009000400090004000b00050006001d0000000600040002000000080002000000000004000b00050006001000000040000180050003000200000004000c000400010004000100080002000000000005000500070000000400010004000c000500030002000000050005000b000000100001800400010005000700070000000c0001800400080004000a0014000180050003000b0000000500070006000000280001800500070007000000040001000600040001000000050005000f0000000400010004000a003800018004000800050003000400000004000b0004000100060004000c00000004000100050003000100000004000c00050006000b0000002c0001800400080004000800050007000d00000004000c0004000c00050005000f00000008000200010000002000018004000900050003001000000005000700510000000800020003000000040002005002008028010380200001801c00018004000a0004000a000500030007000000050003000b00000004000200040002000400020004000200f4000180240001800400080004000a0004000a00060004009400000004000800050003000d00000008000180040009003c00018004000100050005000d00000004000a00050003000c000000050006000f0000000400090008000200020000000400080006000400ff0000001400018004000a000400010004000b0004000900100001800800020000000000040001003800018004000c000500050008000000050006000d00000004000b00040009000500030009000000050006000600000005000500020000001c000180050003000c000000050003000e00000004000c0004000100100001800400010004000b00040009000a00010008021100000100000a0001000802110000000000dc000380d80001801800018004000c00040009000400090004000a00040001000c0001800800020004000000480001800400090006000400000000000500070007000000050005000f000000050003000c00000004000a00050005000000000004000100050006000e000000050003000e0000000c00018005000500020000003c000180080002000400000005000300080000000400090004000a0005000600010000000500060016000000040008000400080006000400040000002000018004000c0004000800040009000800020002000000040009000400010024000280050019010a0000000800a0000100000008009f000000000005001801060000000a000100ffffffffffff00000a00060008021100000000001801118014010580640000800a0001000802110000000000540002800800a00001800000080026006c09000008002600b815000008009f000300000008002201ee0000000800220137010000080022012103000008009f000100000008002201ea020000080022017b030000ac000080a800038004000200040002000400020098000180300001800400090004000c000400080005000600c500000005000300020000000600040000080000060004007eff000014000180050005000a0000000400090004000b003800018004000b0004000900050007001e0000000800020000000000040009000500060014000000050003000f000000050003000a0000001800018008000200040000000400010004000b0004000b00"], 0x10d4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r5, 0x28, 0x0, 0x0, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000100001f500000000000000000000000a20000000000a010100000000000000000a0000000900010073797a300000000048000000030a010200000000000000000a0004000900010073797a30000000000900030073797a3100000000080007006e617400140004800800014000000003080002400000000014000000020a69eff1640000000000000000000114000000110001"], 0xa4}}, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) (async) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x13, r6, 0x0) (async) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r8, 0x0, 0x60, &(0x7f0000000640)={'filter\x00', 0x5, 0x4, 0x3f0, 0x110, 0x110, 0x110, 0x308, 0x308, 0x308, 0x4, 0x0, {[{{@arp={@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0xffffff00, 0x0, 0x4, 0x4, {@mac=@remote, {[0xff, 0xff, 0x0, 0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0x0, 0x0, 0x0, 0xff, 0xff]}}, 0x3, 0x8, 0x7, 0x9, 0x6, 0x4, 'veth0_to_batadv\x00', 'ipvlan0\x00', {0xff}, {0xff}, 0x0, 0x2}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private, @empty, 0xa}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @private=0x1000, 0x0, 0xffffffff}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) (async) mmap(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x1000009, 0x11, r7, 0xd371f000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) (async, rerun: 64) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) (rerun: 64) read$rfkill(r9, &(0x7f0000001780), 0x8) 2.503516503s ago: executing program 1 (id=5682): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x101801, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="12000000010000000400000002"], 0x50) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="12000000010000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r2, &(0x7f0000000040)}, 0x20) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'veth1_to_bridge\x00', 0x400}) ioctl$TUNSETDEBUG(r0, 0x400454c9, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x2000000000000286, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b705000000000000850000007500000095"], 0x0, 0xfffff924, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x2000000000000286, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b705000000000000850000007500000095"], 0x0, 0xfffff924, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1b, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r6) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r5}, 0xc) write$cgroup_subtree(r3, &(0x7f0000000200)=ANY=[], 0x10448) (async) write$cgroup_subtree(r3, &(0x7f0000000200)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) sendmsg$can_bcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ff0100fca2fc2d7ca5bee9e4", @ANYRES64=r7, @ANYRES64=r8/1000+60000, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000004001000000000000c0080700002a6b9e5bcdc95ce7"], 0x48}, 0x1, 0x0, 0x0, 0xc010}, 0x4c814) close(0xffffffffffffffff) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000c, 0x30, r0, 0xa7dcb000) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001440)=ANY=[@ANYBLOB="140000003000010300000000000000000101"], 0x114}], 0x1}, 0x0) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c010000", @ANYRES16, @ANYBLOB="000826bd7000fbdbdf25120000004c0002803400038008000200070000000800010001000000080002000000000008000100070000000800010007000000080002000200000008000200e50b00000c0003"], 0x14c}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYRES8=r5], 0x84}}, 0x4) socket(0x10, 0x803, 0x0) (async) socket(0x10, 0x803, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r10 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_int(r10, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r10, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) connect$inet(r10, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) 2.215917624s ago: executing program 3 (id=5684): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x83c, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {}, {0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0x810, 0x2, [@TCA_FW_POLICE={0x80c, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x401, 0xe, 0x80000001, 0x8, 0x200, 0x6, 0x8, 0x4, 0x10200000, 0x4, 0x2000003, 0x9, 0x3, 0xffffffff, 0xb, 0x9, 0x4, 0xd4ae, 0x5, 0x300000, 0xe1b5, 0xc5b, 0x6, 0x4, 0x9, 0x6, 0x9, 0x8, 0x3, 0x9, 0xd, 0x7f, 0x7, 0xce0, 0x1ff, 0x6, 0x6, 0x41, 0xff, 0x800, 0xfff, 0x7, 0x9, 0xd, 0x4, 0xffffff1f, 0xa, 0xc, 0x8, 0xfffffffa, 0x155, 0x7, 0x0, 0x18000, 0xc, 0x9, 0x40000, 0x101, 0x6, 0x3ff, 0x1, 0x3, 0x7554, 0x2, 0x4, 0x1, 0x4, 0xd, 0x8000, 0xff, 0x0, 0xeac2, 0x87, 0x3, 0xfe000000, 0x3, 0x8001, 0xff, 0xffff1cac, 0x2892, 0x6, 0x8c5e, 0x1, 0x5, 0xffffffff, 0x80, 0xffffffac, 0x3, 0xff1, 0x2, 0x2, 0x8, 0x2, 0x1, 0x8, 0x8, 0xfff, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x487, 0x6, 0x8, 0x1000, 0x1ff800, 0x6, 0xfffffffe, 0x3c78, 0xfa1, 0x3, 0x6, 0x9, 0xffffffff, 0x80000002, 0x2, 0xda, 0x9, 0x401, 0x6, 0x7, 0x2, 0x2, 0xe, 0x835, 0x4, 0x3, 0x6cc7, 0x6, 0x8, 0x8, 0x400, 0x8, 0x4, 0x3, 0x5, 0x5, 0xfffffffe, 0x9, 0x400, 0x3, 0x0, 0x4cc, 0xb, 0x0, 0xce, 0x6, 0x0, 0xc8, 0x4, 0x5, 0xc38, 0x1ff, 0x1ff, 0x968, 0x5, 0x68cff086, 0x2, 0xfff, 0x2, 0x7ff, 0x1000, 0x80000001, 0x9, 0x9, 0x0, 0x8001, 0x1000, 0x8b7f, 0xfe, 0xc, 0x8, 0x7, 0x8000000, 0x0, 0x7fff, 0xfffffffd, 0x5, 0x815d, 0x5, 0x44, 0x4, 0x6, 0x3, 0x1, 0x8, 0x0, 0x7ff, 0x3, 0x8, 0x1, 0x2, 0x800, 0x7, 0x5, 0x10, 0xfffffff7, 0x8, 0x40, 0x1, 0x10001, 0x1000, 0xe42c, 0x1, 0x101, 0x6, 0x8, 0x4, 0x9a14, 0x4, 0x81, 0x7, 0x0, 0x8, 0x8, 0xfffffffa, 0x0, 0x30000, 0x7ff, 0x4, 0x3, 0x5, 0x5, 0x0, 0xfff, 0x3, 0x7b0, 0x7, 0x9, 0xffff, 0x5, 0xff, 0x4, 0x0, 0x4, 0x9, 0x6, 0x100, 0x81, 0x0, 0x7fc, 0x2, 0x5, 0x80, 0x2, 0xe, 0x1, 0x40, 0x1ff, 0x3, 0x380, 0x6, 0x7, 0x8, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7, 0x8, 0x7, 0xffff, 0x2, 0x3, 0x7fff, 0x8, 0x0, 0x401, 0x4, 0x0, 0xf7b1, 0xa, 0x40, 0x200, 0x0, 0x1, 0x9, 0x9, 0x8, 0xbf2, 0x1, 0xffff9374, 0x9, 0x1, 0x5, 0x3ff, 0x3, 0x6, 0x5, 0x2, 0x7, 0xe, 0x5, 0x4, 0x9, 0x8, 0xf0, 0x5, 0x8000, 0x0, 0x7, 0xff, 0x2, 0x2, 0x400, 0x0, 0x5, 0x2, 0x401, 0x100, 0xf30, 0x8001, 0x9, 0x370, 0x3, 0x1, 0xfffffff9, 0x9, 0x3, 0x5, 0xb9b, 0x1, 0x5, 0x0, 0x4, 0x7, 0x6, 0x3ff, 0x3, 0x7, 0x76, 0x9, 0xffff, 0x8, 0xd, 0x80, 0x4, 0x9, 0x7ff, 0x7, 0x9, 0x6, 0x7f, 0x9, 0x7ff, 0x3, 0x8, 0x31, 0x1, 0x2d, 0x0, 0xf02, 0x15200, 0xa, 0x1, 0xe148, 0x7, 0x1, 0x3, 0x9, 0x6, 0xb, 0xfffffffa, 0x4, 0xdf, 0x80000000, 0x8001, 0x2, 0x3, 0x2971010e, 0x3b655406, 0x1, 0x8, 0x6, 0x6, 0x0, 0x4, 0x8, 0x80000001, 0x5dd, 0x2d3, 0x7, 0x8, 0x5, 0x79d5, 0x2, 0x800, 0x8d, 0x1, 0x2, 0x1, 0x5, 0x6, 0x338, 0x6, 0x2, 0x4, 0x1, 0x3, 0x0, 0x0, 0x8, 0x1, 0x3ff, 0x8, 0x56, 0x7, 0x401, 0x7, 0x0, 0x0, 0x0, 0xda, 0x5, 0x42, 0x18, 0xfffffff7, 0x5, 0xed2, 0x7, 0x211, 0x0, 0x2, 0xc9, 0x3, 0x8, 0x1, 0x9, 0x58, 0x8, 0x5e5, 0x5, 0x3, 0xfffffffb, 0x3, 0xff, 0x6, 0x10, 0xf7ee907a, 0xff, 0xc9, 0x9, 0x0, 0x400, 0x0, 0x7, 0x6, 0x9, 0x8, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x7, 0x2, 0x3, 0x9, 0x9, 0x0, 0x7, 0x4, 0x0, 0x4, 0x4, 0x4, 0x6f3, 0x6, 0x10, 0x0, 0x7, 0xfffffff9, 0xfffffffa, 0x9, 0x53a, 0x8, 0x1, 0x4, 0xb, 0x8, 0xfffffff9, 0x400, 0x461, 0x81, 0x8, 0x2, 0x7ff, 0x2, 0x8000, 0x7, 0x4, 0xba95, 0x4, 0x4706, 0x7ff, 0x4, 0xffffffff, 0xf7b1, 0x3, 0x2, 0x5, 0x9, 0x1fffc, 0x80000000, 0x2008001, 0x9, 0x4, 0x3, 0x3, 0x6, 0xce, 0x8]}]}]}}]}, 0x83c}, 0x1, 0x0, 0x0, 0x20000005}, 0x40) r0 = socket(0x2b, 0x1, 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000e00)=@raw={'raw\x00', 0x9, 0x3, 0x1c8, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0xffffff00, 0x0, 'vcan0\x00', 'vlan0\x00', {}, {0xff}, 0x8, 0x2bbe86e5b28b8fc5, 0x30}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4081}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x15, 0xa1, 0xfff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x228) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b23, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0xa, 0x300) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xf, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_key={0x3, 0x9, 0x80, 0x0, "1cdc0dca1d9f68846960e56de42944af"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e22, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x7, 0xc, 0x1}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}, @sadb_x_sa2={0x2, 0x13, 0x3, 0x0, 0x0, 0x70bd28, 0x3503}]}, 0x78}, 0x1, 0x7}, 0x0) write$tun(r4, &(0x7f0000000340)=ANY=[], 0x141) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r3, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f0000002980)=[{&(0x7f0000001580)=""/4096, 0x1000}], 0x1, &(0x7f0000002a00)}, 0x5}], 0x1, 0x23, 0x0) writev(r3, &(0x7f0000001540)=[{&(0x7f0000000300)="2ea6", 0x2}], 0x1) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x1, &(0x7f0000000280), 0x4) 2.146122453s ago: executing program 0 (id=5685): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000000), 0x4) (async) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000000), 0x4) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000010c0), r0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1806, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000100)=0x1806, 0x4) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000009c0)=ANY=[@ANYRES8, @ANYRES16=r1, @ANYRES32=r2, @ANYRES16, @ANYRES64=r1, @ANYRES32=r0], 0x48) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x9) (async) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x9) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r3}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x6, 0x10, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x800000e2, 0x0, 0x0, 0x0, 0x2000000}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8006}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r3}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x5c298795369ca04f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x13, &(0x7f0000000100)=ANY=[@ANYBLOB="18080000fcffffff000000000400000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf09000000000000550901001c0000d20f0000000000000018170000", @ANYRES32=r5, @ANYBLOB="000000000000000018160000", @ANYRES32=r5, @ANYBLOB="0000000000000000bf98000000000000b5080000000000008500000042000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x24, 0x1e, 0x21, 0x70bd2b, 0x0, {0x7}, [@typed={0x5, 0x12c, 0x0, 0x0, @str='\x00'}, @nested={0x8, 0xf, 0x0, 0x1, [@typed={0x4, 0xb6}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x2008800}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x2}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, r7, 0x34606000) write$cgroup_pressure(r7, &(0x7f0000000140)={'full'}, 0xfffffdef) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xee, 0xee, 0x2, [@datasec={0xa, 0x6, 0x0, 0xf, 0x2, [{0x4, 0x0, 0x2}, {0x2, 0x1000, 0x80}, {0x4, 0xfffffe01, 0x2}, {0x1, 0x0, 0x7}, {0x4, 0x0, 0xfffffbc6}, {0x5, 0x129, 0x413}], "681f"}, @ptr={0x2}, @func={0xe, 0x0, 0x0, 0xc, 0x1}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0xd, 0x1}]}, @enum={0x4, 0x1, 0x0, 0x6, 0x4, [{0x10, 0x8000}]}, @restrict={0x8, 0x0, 0x0, 0xb, 0x5}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x1, 0x2}, {}]}, @enum={0x6}, @enum={0x6, 0x3, 0x0, 0x6, 0x4, [{0xe, 0x5}, {0xc, 0x5c}, {0x399, 0xf21}]}]}}, &(0x7f0000000840)=""/183, 0x10a, 0xb7, 0x0, 0xa}, 0x28) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r4, r9, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x40) syz_emit_ethernet(0xfdef, &(0x7f00000004c0)={@multicast, @random="8d81e3403687", @val={@val={0x88a8, 0x4, 0x1, 0x2}}, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x2, 0x30, 0x2c, 0x65, 0x0, 0x9, 0x6, 0x0, @rand_addr=0x64010100, @multicast1, {[@end]}}, {{0x4e22, 0x4e20, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x25, 0x200, 0x0, 0x1ff}}}}}}, 0x0) (async) syz_emit_ethernet(0xfdef, &(0x7f00000004c0)={@multicast, @random="8d81e3403687", @val={@val={0x88a8, 0x4, 0x1, 0x2}}, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x2, 0x30, 0x2c, 0x65, 0x0, 0x9, 0x6, 0x0, @rand_addr=0x64010100, @multicast1, {[@end]}}, {{0x4e22, 0x4e20, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x25, 0x200, 0x0, 0x1ff}}}}}}, 0x0) socket(0x10, 0x803, 0x0) (async) r10 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r10) getsockname$packet(r10, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, r11, 0x0, 0x20040}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, r11, 0x201, 0x68320}}}}}}]}, 0x48}, 0x1, 0x2000, 0x0, 0x40}, 0x4048800) (async) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, r11, 0x0, 0x20040}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, r11, 0x201, 0x68320}}}}}}]}, 0x48}, 0x1, 0x2000, 0x0, 0x40}, 0x4048800) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r6, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x58, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1000}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r6, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x58, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1000}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x3}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x7}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x6}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r11}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 2.097883813s ago: executing program 1 (id=5686): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000003b00010324bd7022ffdbdf250d00000001a4bc094b2c1ed6239c5ec1b413a8d2ab308f43cd40050ab883684a5fc02dfe14fcc573b5b266c673ec0282303737cf0a067b9da4b55e30198bdca774a22fb303463c986e84ac30c3ee4335cd4a75b434c3180b732065f8adbd31f623b9d66208000000000000002ce6c7919e5afbfc45300a242eb8f66410599755097e6d07a2ace78687006028d30920c26b762172f3170d6a429299666a"], 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x20040000) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000003b00010324bd7022ffdbdf250d00000001a4bc094b2c1ed6239c5ec1b413a8d2ab308f43cd40050ab883684a5fc02dfe14fcc573b5b266c673ec0282303737cf0a067b9da4b55e30198bdca774a22fb303463c986e84ac30c3ee4335cd4a75b434c3180b732065f8adbd31f623b9d66208000000000000002ce6c7919e5afbfc45300a242eb8f66410599755097e6d07a2ace78687006028d30920c26b762172f3170d6a429299666a"], 0x14}, 0x1, 0x0, 0x0, 0x4008}, 0x20040000) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r0) (async) 1.996364183s ago: executing program 2 (id=5687): sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="28f80100", @ANYRES16, @ANYBLOB="04002abd7000fedbdf251200000014010180170001006574683a6261746164765f736c6176655f3100004c0002800800030009000000080002000c000000080002008a7b0000080002000500000008000400ff0000000800030000000000080002000104000008000300090000000800030000000100380004001400010002004e21ac1e01010000000000000000200002000a004e21"], 0x128}, 0x1, 0x0, 0x0, 0x4000}, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000090a010400000000000000000100000208000a400000000008000640ffffff000900010073797a3000000000080005400000001c0900020073797a3200000000080003400000008c38000980340002800c00018008000140000000090c00018008000140000000080c00018008000140000000040c0001800800014000000002"], 0xc0}, 0x1, 0x0, 0x0, 0x4404c810}, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) socket(0xa, 0x802, 0x0) (async) r2 = socket(0xa, 0x802, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0xd6, 0xa, 0x0, 0x0, 0xfffe, 0x61, 0x11, 0xa0}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0xd6, 0xa, 0x0, 0x0, 0xfffe, 0x61, 0x11, 0xa0}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x94) setsockopt$inet_int(r2, 0x0, 0x18, &(0x7f00000006c0)=0x7, 0x1) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000000)) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, r4, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) (async) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, r4, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) sendto(r1, &(0x7f00000005c0)="a1bfc48ba931fb1ceb70ba6de68925f84d607ce82b9339dda7f5adf00381be33ea1558c858be9d3a5b2aff8f4f59bd095d7034b500b19e0d0524e7bf37b4cec2aad04aacfac1eeca892aa86fe2f21df0a4619b459cb53e0cadf8e3486c5506c18326e1a39911052c19fee16f57ff67c91e3576d08cbca1dbfbdf03bc42498ba5fe9316ab4a80fdaab89a6461775b8f4f23b0f528e97eadd7ca6308c637", 0xfeca, 0x0, &(0x7f0000000700)=@ax25={{0x3, @bcast, 0x5}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x80) close(r3) 1.974153993s ago: executing program 4 (id=5688): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000001010000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000800000000000900000000000000000000000100000005000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000002000000000000010001000000000084010500ac1414aa00000000000000000000000000000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c0000000200000000000800000000000000ffffe000000200000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac14144300000000000000000000000000000000330000000200000000000000000000000000ffffac1414aa000000000000000000000000000000000000000020010000000000000000000000000000000004d26c000000000000000000000000000000000000000000000100000000000000000c0000000000000000000000ac1e0101000000000000000000000000000004d26c000000d6000000e00000020000000000000000000000000000000005"], 0x23c}, 0x1, 0x0, 0x0, 0x11}, 0x4000) 1.813500896s ago: executing program 4 (id=5689): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$SIOCX25GSUBSCRIP(0xffffffffffffffff, 0x89e0, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000000c0)={0x0, 0x1, 0xfc, 0xfffffff7, @vifc_lcl_addr=@rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c000980050001"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket(0x40000000015, 0x5, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006800e97800000000000000ea0900000000000000040004"], 0x1c}}, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x1}, 0x20) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000001040)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @multicast2}, 0x20000003}}, 0x2e) ioctl$PPPIOCGCHAN(r4, 0x80047437, &(0x7f0000001300)) readv(r4, &(0x7f0000001240)=[{&(0x7f0000000040)=""/4090, 0xffa}, {&(0x7f0000001080)=""/182, 0xb6}, {&(0x7f0000001340)=""/224, 0xe0}], 0x3) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x24044044, &(0x7f0000000540)={0xa, 0x4e22, 0x0, @mcast2, 0x4}, 0x1c) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) setsockopt$sock_timeval(r3, 0x1, 0x15, &(0x7f0000000080), 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) r6 = socket(0x40000000015, 0x5, 0x0) connect$inet(r6, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bind$inet(r6, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) sendmsg$inet(r6, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40) ioctl$PPPIOCGCHAN(r5, 0x80047437, &(0x7f0000019580)) getsockopt(r6, 0x200000000114, 0x2715, &(0x7f0000000580)=""/102393, &(0x7f0000000400)=0x18ff9) 1.728298711s ago: executing program 1 (id=5690): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r1, @ANYBLOB="80007f0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, 0x0, 0x20000000) unshare(0x8020900) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="40002000770005ff0000000800000000000000089488f96769aa1ee6eb064c00f0b4fb149b89ea3ae4a069d5ff984b0d683229cf546135837d8dbb487c0d4a1bc15648069362f5ecdfa1004b2fae2c28bac8c8697706488caf87f24f9374f161688906c95f281ea04306a3cd5981805b170972875b1634fed07e41ac8fd24fddba2fd681c6b111311c3ca710b2c082942a91b71fc1285ed2ae92af2e8d029e7be5a9ef23610db0034000307bff4d161ff649d5af24379fc74aa11624f4b1da7c7341bd565ea9bba9022d7b1740dd3eeea0be43dca7f404dda34f45c6d9b1bbdf18fa83e3e8bf27b0e10eb6bd019aa17e3db1e904e94a63cc4176da7cd533f222f86e93c9d491ce2396e3af51854e51e646358f13ce2411250ea01577f50fc64807d733aff825afb65f31782154a33b204da1e8e6f242506723b2def3de5cd2a73a3d", @ANYRES32=0x0, @ANYBLOB="c387b7f600000000140012800b0001006261746164760000040002800a0001000000000000000000"], 0x40}}, 0x20000840) bind$802154_dgram(r2, 0x0, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000200)={&(0x7f0000000080), 0x14, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) 1.721591754s ago: executing program 0 (id=5691): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000180)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x200000000000007}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) 1.515406932s ago: executing program 2 (id=5692): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xb, 0x1f, 0x402, 0x3ff, 0x1}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="d80000", 0x3}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4e22, 0xbee, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1}, 0x1c) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMRRU(r1, 0x4010744d, &(0x7f0000000080)=0xfff) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1f}, @in6=@mcast2, 0x4e20, 0x0, 0x4e24, 0x0, 0x2}, {0x0, 0x28c, 0x1, 0x0, 0x0, 0x4000000000}, {0x7}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in=@rand_addr=0x64010102, 0x2000000, 0x33}, 0x0, @in=@multicast2, 0x0, 0x3, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@local, @in6=@mcast1, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x2f}, {0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x400000000}, 0x3, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in6=@local, 0x4d4, 0x6c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x3d}, 0x0, 0x0, 0x0, 0xb7}}, 0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'veth1_vlan\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) close(0xffffffffffffffff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x28, 0xc, 0x6, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) r5 = socket(0x400000000010, 0x2, 0x0) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x38, 0x2c, 0xf3f, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xfff3, 0xffe0}, {}, {0x0, 0xfffa}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r7}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20041080}, 0x4880) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000002f00090027bd7000000000000400000004001900040018"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000700)=@newsa={0x184, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@remote, 0x0, 0x33}, @in=@loopback, {}, {}, {}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x20}, [@algo_crypt={0x48, 0x4, {{'ecb(cipher_null)\x00'}}}, @algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x184}}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) 1.35682737s ago: executing program 0 (id=5693): r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IEEE802154_DISASSOCIATE_REQ(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x441000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="380000b4f5d4213c638b85a7458dd274390947670f77ddebe5e5fb27ee18a905d1069200", @ANYRES16=r0, @ANYBLOB="00042cbd7000fedbdf250300000006000800a0aa00000c0009000200aaaaaaaaaaaa050012000200000006000800a2aa0000"], 0x38}, 0x1, 0x0, 0x0, 0x40000800}, 0x4000) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@newlink={0x40, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xc6da5938055fa6fd, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x1}, @IFLA_GTP_FD0={0x8}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x44}, 0x2000c000) 1.108069131s ago: executing program 0 (id=5694): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x4, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}, @qdisc_kind_options=@q_clsact={0xb}, @qdisc_kind_options=@q_clsact={0xb}, @qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_QUANTUM={0x8, 0x2, 0x2}]}}]}, 0x73}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd26, 0x25dfdafd, {0x0, 0x0, 0x0, r2, {0xc, 0xc}, {0x8, 0xfff1}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4041080) 941.263976ms ago: executing program 3 (id=5695): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61106800000000006113740000000000bfa00000000000000700000008fffdffd50301000ee600c07b0000000000000069163a0000000000bf67000000000000350607000fff072017060000201900001603faff0ee60060bf0500000000006c7b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) 736.428217ms ago: executing program 3 (id=5696): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x2c, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000100001002d390d00fedbdf2500000000", @ANYRES16=r0, @ANYBLOB="8121000000000000140003006e657464657673696d30000000000000b0001680ac00018010000600fa010000060000000900000018000c8014000100930a0000f602000005000000810000000c000700e60000000900000068000c8014000100ffffff7f"], 0xec}}, 0x4008841) 697.449549ms ago: executing program 0 (id=5697): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r1, 0x10e, 0x5, 0x0, &(0x7f0000000300)) (async) getsockopt$netlink(r1, 0x10e, 0x5, 0x0, &(0x7f0000000300)) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b000000000000000000000000800000000000004914fa1af5f039ad3a8088aa1886f7c59645aa9218b23147f2821313835adf68c25122d6a0d43903384564bb2d2497623eea2ea905ade275a5e388493745c74b2cf88be56085d0f3cc4712afe8979e811d9d3981ef6ac4359fe60feb79a41f643e1e0c2d43ba1e657f11503824b091670ca01bd88261c996d12b9422b795fbe4", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b000000000000000000000000800000000000004914fa1af5f039ad3a8088aa1886f7c59645aa9218b23147f2821313835adf68c25122d6a0d43903384564bb2d2497623eea2ea905ade275a5e388493745c74b2cf88be56085d0f3cc4712afe8979e811d9d3981ef6ac4359fe60feb79a41f643e1e0c2d43ba1e657f11503824b091670ca01bd88261c996d12b9422b795fbe4", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffc}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000}, 0x94) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) (async) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r4, &(0x7f0000001800)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000140)="2f045ee5fe9249ed05b0ec37a721ec81ab367c04eced1ffc7fbe3af84e19dbc6046b923619a06e0b6ae2ebf0ab657d32cff916f0e3da24e4f26306f1c4527a44d729802f3e43485391176c630b0880ed637f5d351048b4203d62b3d96114252d70b4dd8bad5a321aa399", 0x6a}, {&(0x7f00000001c0)="2cf70e049d7ca10c2baa62463c54f8109cb8795a3d7b326bb81c6bc290875437b4a5a3bcbd199c2cbdd4a149005a94946713c9081c76822a626d60fcfac2830c3f1d48ca7bdc14c329b2602e5bb1e920ceeb1a", 0x53}, {&(0x7f0000000380)="31d72a6285c9f0fd", 0x8}], 0x3}}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000500)="391adf0e4ffc9d2b4e6681c97cb814e1d683fd7065b082e42549b6aac265d8f06fc74d6d2b95f827098a17bbab52d616469f034f5d955822d906343ab344782016e80fd7adb151", 0x47}, {&(0x7f00000005c0)="eb8a7649f11eee0c8a704e458b76ad37e1361c43b4078ae926cbf9f823f27bdb489f6255019cad0e6f95137d3f", 0x2d}, {&(0x7f0000000780)="2fd4cf47433cc832f7b9287f69f290312b728f0301db30fe42e0111c154e4f1cc54bdb7ebc984a090c727b33abe6f725c536d2399324bd7638461683b158b64c52908231fcb154449b4b006264288e06b92515a685f214020f7500bc89ee18", 0x5f}, {&(0x7f0000000880)="fa8f73530bdc68", 0x7}], 0x4}}], 0x2, 0x4000000) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) (async) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r4, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)={0x18, 0x16, 0x107, 0x70bd2c, 0x25dfdbfe, {0x1c, 0x7c}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) (async) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)={0x18, 0x16, 0x107, 0x70bd2c, 0x25dfdbfe, {0x1c, 0x7c}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000001c0)=r3, 0x4) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0xffff, 0xfffffffe, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) r6 = socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r8) getsockopt$TIPC_IMPORTANCE(r8, 0x10f, 0x7f, &(0x7f0000000080), &(0x7f0000000180)=0x4) (async) getsockopt$TIPC_IMPORTANCE(r8, 0x10f, 0x7f, &(0x7f0000000080), &(0x7f0000000180)=0x4) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000001c0)={@mcast1, 0x79, r9}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r9, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) (async) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r9, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r6, 0x8936, &(0x7f0000000240)={@dev={0xfe, 0x80, '\x00', 0x43}, 0x7c, r9}) bind$rds(0xffffffffffffffff, &(0x7f0000000800)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$pppl2tp(0x18, 0x1, 0x1) syz_genetlink_get_family_id$ethtool(&(0x7f0000000ac0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) 349.792057ms ago: executing program 1 (id=5698): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000000)=@ethtool_cmd={0x16, 0x8, 0x1, 0x0, 0x8, 0x3, 0x4, 0x6, 0x0, 0x7, 0x80000003, 0x7fffffff, 0xfffb, 0xa, 0x5, 0x6, [0xe, 0xfd]}}) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000940)={&(0x7f0000000600)="e3632339faa3b2f53f251a6d62ea42c4ccbdbf3574231426e525fd9a15ed2e39a020e82f8ad17b9c1766fba264d49fbcc91e5dc1b93e55e1d198b1a5991d2bf6082656462621d2efd06a47995feee84ebf6b873f596c85a46879f0e60cad386bd183d1dfcb03670bf4767f4bdb7042454f34ec33789088072980f03836e11bdb166e331c7fad3da5fb30d0f6afb40428957c04b78f374b895917071ab92fb475d45009b3ec80188a9e732797543b232e42e63a218d20b3b005eb9f5ad7b66a03d84dc6ad4ed991d2c0", &(0x7f0000000700)=""/182, &(0x7f00000007c0)="e505bbea34b98c9de645b530255c59fa01097298dff54a59b598a59241a2ed2ab9b5b6a9847e4f2412cabd87585c8c19284d762781ff9ca609927129986c38f3b17d08914e8ee7ca1fd0613337ccbeaa1cd9e7b9cd996c1dd63a1fb46d752e2820e9e9f9aac514393d0d54f829d0e48ee13098627491e2c1df35c24825b4f4ae6a27e48f502533fe35c1f677787787c9fb15055e7186f75987dcdea73766b1", &(0x7f0000000880)="98ee5e5cbbf968eb700993bbdaec456d27ece8ec6b314b4af0aa9038bab462c9d5836dd03c5ee7df068b8cf4a0a00fa33b366fe8a7236597fbc24cd2ef0593e518f4e405338416ac0d50624efb869210c6bfe5495db55e07a3cc38d4d160fba3ee3be7317929b271a37d2ff62f841327f214c5d8c4b2abac2ec9c65051133a8496abb9f37de829f1daa724349b91630b39bd9a5f9f35751983e1ce5338c4f69da4a3b33aca1857a6bf8e59e821c62c543dc9", 0x2, 0xffffffffffffffff, 0x4}, 0x38) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_inet6_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f00000000c0)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x58}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1c, 0x3, &(0x7f0000000440)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000008c0)={'macvlan0\x00', &(0x7f00000007c0)=@ethtool_drvinfo={0x3, "6bd5cd02564f02baa6f0bebffdfae62afcb1fd7181456afb25ec29769ccfbab0", "3fd06d696e33edf2548c47a6ff34f2e528f318224e461f3782aae3d6a86be6b4", "168bc75f89267387dfe8f726649ab412c8ca4807008b540eccf6cbc20509a46a", "d010df955837f8ba675efba4d90d6941354f8b57b5e0f933bebd023dfd8556c7", "4c5138db1c62592d6f60fe50e538dc820105b16582d6dee0c3fd5fa47b3a23c0", "e9115c6266848f73be343ab4", 0x3, 0x9, 0x3, 0xfa, 0x5}}) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r3, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r5, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r5, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) getsockopt$inet_mreqn(r5, 0x0, 0x24, 0x0, 0x0) shutdown(r5, 0x1) sendmsg$TIPC_NL_BEARER_SET(0xffffffffffffffff, 0x0, 0x4040140) r6 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r6) 204.492429ms ago: executing program 3 (id=5699): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000160900010073797a30000000002c000000030a01020000000000000000010000000900030073797a31000000000900010073797a300000000070000000060a010400000000000000000100000008000b40000000000900010073797a300000000048000480200001800700010072740000140002800800014000000015080002400000000024000180090001"], 0xe4}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 44.053609ms ago: executing program 2 (id=5700): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0xffe, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0020001c0000001f000000060001000700000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a000100110070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 0s ago: executing program 0 (id=5701): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0xfffffffb}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getlink={0x20, 0x12, 0x1, 0x70bd25, 0x0, {0x7, 0x0, 0x0, 0x0, 0x6000}}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20080) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'bridge_slave_1\x00', 0x4000}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000e90000000000000000000a78000000060a0b040000000000000000020000034c000480240001800b0001"], 0xa0}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c00068008"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) kernel console output (not intermixed with test programs): [ 675.877568][T23020] dump_stack_lvl+0xe8/0x150 [ 675.877609][T23020] should_fail_ex+0x40c/0x560 [ 675.877642][T23020] _copy_to_user+0x31/0xb0 [ 675.877668][T23020] sk_getsockopt+0x1d7c/0x28b0 [ 675.877704][T23020] ? __pfx_sk_getsockopt+0x10/0x10 [ 675.877760][T23020] ? __might_fault+0xaf/0x130 [ 675.877790][T23020] ? __might_fault+0xaf/0x130 [ 675.877839][T23020] do_sock_getsockopt+0x2bd/0x7e0 [ 675.877874][T23020] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 675.877918][T23020] ? __fget_files+0x3a2/0x420 [ 675.877948][T23020] ? __fget_files+0x2a/0x420 [ 675.877987][T23020] __x64_sys_getsockopt+0x1a4/0x240 [ 675.878019][T23020] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.878044][T23020] do_syscall_64+0x174/0x580 [ 675.878071][T23020] ? trace_irq_disable+0x3b/0x140 [ 675.878102][T23020] ? clear_bhb_loop+0x40/0x90 [ 675.878130][T23020] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.878152][T23020] RIP: 0033:0x7ff07819e019 [ 675.878173][T23020] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.878193][T23020] RSP: 002b:00007ff078f8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 675.878219][T23020] RAX: ffffffffffffffda RBX: 00007ff078425fa0 RCX: 00007ff07819e019 [ 675.878235][T23020] RDX: 0000000000000023 RSI: 0000000000000001 RDI: 0000000000000003 [ 675.878250][T23020] RBP: 00007ff078f8e090 R08: 0000200000000080 R09: 0000000000000000 [ 675.878266][T23020] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 675.878281][T23020] R13: 00007ff078426038 R14: 00007ff078425fa0 R15: 00007ffcc146f5c8 [ 675.878315][T23020] [ 676.097109][T23022] netlink: 'syz.0.4502': attribute type 1 has an invalid length. [ 676.151141][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.367757][T23030] syzkaller0: entered promiscuous mode [ 676.407695][T23030] syzkaller0: entered allmulticast mode [ 676.427379][T23038] tipc: Enabled bearer , priority 0 [ 676.454646][T23028] tipc: Resetting bearer [ 676.534182][T23028] tipc: Disabling bearer [ 676.629502][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.672078][T23047] bond0: (slave wlan1): Opening slave failed [ 676.845748][T23055] bond6: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 676.873998][T23055] bond6 (unregistering): Released all slaves [ 676.917871][T23061] FAULT_INJECTION: forcing a failure. [ 676.917871][T23061] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 676.931429][T23061] CPU: 1 UID: 0 PID: 23061 Comm: syz.3.4515 Not tainted syzkaller #0 PREEMPT(full) [ 676.931459][T23061] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 676.931473][T23061] Call Trace: [ 676.931483][T23061] [ 676.931492][T23061] dump_stack_lvl+0xe8/0x150 [ 676.931531][T23061] should_fail_ex+0x40c/0x560 [ 676.931577][T23061] _copy_to_user+0x31/0xb0 [ 676.931601][T23061] simple_read_from_buffer+0xe1/0x170 [ 676.931638][T23061] proc_fail_nth_read+0x1bb/0x230 [ 676.931675][T23061] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 676.931709][T23061] ? rw_verify_area+0x24a/0x4c0 [ 676.931745][T23061] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 676.931776][T23061] vfs_read+0x213/0xa80 [ 676.931804][T23061] ? __pfx___mutex_lock+0x10/0x10 [ 676.931833][T23061] ? __pfx_vfs_read+0x10/0x10 [ 676.931857][T23061] ? __fget_files+0x2a/0x420 [ 676.931892][T23061] ? __fget_files+0x3a2/0x420 [ 676.931921][T23061] ? __fget_files+0x2a/0x420 [ 676.931960][T23061] ksys_read+0x150/0x270 [ 676.931985][T23061] ? __pfx_ksys_read+0x10/0x10 [ 676.932004][T23061] ? fput+0xa0/0xd0 [ 676.932041][T23061] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.932067][T23061] do_syscall_64+0x174/0x580 [ 676.932094][T23061] ? trace_irq_disable+0x3b/0x140 [ 676.932131][T23061] ? clear_bhb_loop+0x40/0x90 [ 676.932159][T23061] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.932182][T23061] RIP: 0033:0x7f1880d5e84e [ 676.932203][T23061] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 676.932222][T23061] RSP: 002b:00007f187eff5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 676.932246][T23061] RAX: ffffffffffffffda RBX: 00007f187eff66c0 RCX: 00007f1880d5e84e [ 676.932264][T23061] RDX: 000000000000000f RSI: 00007f187eff60a0 RDI: 0000000000000004 [ 676.932278][T23061] RBP: 00007f187eff6090 R08: 0000000000000000 R09: 0000000000000000 [ 676.932293][T23061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 676.932306][T23061] R13: 00007f1881026038 R14: 00007f1881025fa0 R15: 00007fff85b19848 [ 676.932343][T23061] [ 677.473171][T23073] sctp: [Deprecated]: syz.3.4520 (pid 23073) Use of int in max_burst socket option. [ 677.473171][T23073] Use struct sctp_assoc_value instead [ 677.503526][T23073] netlink: 'syz.3.4520': attribute type 1 has an invalid length. [ 677.518784][T23075] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 677.526772][T23075] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 677.540694][T23075] batman_adv: batadv0: Removing interface: ip6gretap1 [ 677.651263][T23073] bond3: entered promiscuous mode [ 677.673050][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.685067][T23073] bond3: entered allmulticast mode [ 677.701314][T23073] 8021q: adding VLAN 0 to HW filter on device bond3 [ 677.740628][T23085] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.778263][T23078] erspan1: entered allmulticast mode [ 677.834568][T23082] lo speed is unknown, defaulting to 1000 [ 677.921155][T23094] __nla_validate_parse: 3 callbacks suppressed [ 677.921173][T23094] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4529'. [ 678.200497][T23104] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4532'. [ 678.249882][T23104] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4532'. [ 678.267618][T23109] lo speed is unknown, defaulting to 1000 [ 678.443213][T23102] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 678.455381][T23102] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.527922][T23112] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4535'. [ 678.557116][T23112] netlink: 'syz.4.4535': attribute type 5 has an invalid length. [ 678.725466][T23102] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 678.764861][T23102] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.864600][T23125] netlink: 136 bytes leftover after parsing attributes in process `syz.2.4537'. [ 679.072710][T23102] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.100788][T23129] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 679.103317][T23102] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.114365][T23129] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 679.285756][T23102] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.298793][T23102] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.336196][T23131] pim6reg1: entered promiscuous mode [ 679.355636][T23131] pim6reg1: entered allmulticast mode [ 679.555944][ T1180] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.575043][ T1180] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.624546][ T1180] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.636858][ T1180] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.655020][T23137] net_ratelimit: 6 callbacks suppressed [ 679.655038][T23137] netlink: zone id is out of range [ 679.671840][ T1180] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.680821][ T1180] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.684093][T23137] netlink: zone id is out of range [ 679.729619][ T136] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.734466][T23137] netlink: zone id is out of range [ 679.744094][ T136] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 679.760114][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.786751][T23137] netlink: zone id is out of range [ 679.807595][T23137] netlink: zone id is out of range [ 679.830500][T23142] syzkaller0: entered promiscuous mode [ 679.841585][T23137] netlink: zone id is out of range [ 679.852317][T23142] syzkaller0: entered allmulticast mode [ 679.868232][T23137] netlink: zone id is out of range [ 679.880646][T23137] netlink: zone id is out of range [ 679.886554][T23137] netlink: zone id is out of range [ 679.937489][T23148] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4546'. [ 680.083974][T23154] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4549'. [ 680.162979][T23153] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 680.175985][T23153] bond4 (unregistering): Released all slaves [ 680.245633][T23165] netlink: 'syz.2.4550': attribute type 29 has an invalid length. [ 680.282528][T23167] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4549'. [ 680.468966][T23175] No such timeout policy "syz1" [ 680.484091][T23176] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 680.894449][T23191] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4559'. [ 680.936432][T23191] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4559'. [ 681.048948][T23198] veth0: entered promiscuous mode [ 681.175122][T23197] veth0: left promiscuous mode [ 681.430036][T23213] No such timeout policy "syz1" [ 681.742522][T23231] mac80211_hwsim hwsim35 wlan1: entered promiscuous mode [ 681.994932][T23235] syzkaller0: entered promiscuous mode [ 682.015755][T23235] syzkaller0: entered allmulticast mode [ 682.060706][T23246] No such timeout policy "syz1" [ 682.245763][T23254] tc_dump_action: action bad kind [ 682.297508][T23255] netlink: 'syz.2.4581': attribute type 29 has an invalid length. [ 682.648153][T23274] Cannot find add_set index 0 as target [ 683.046206][T23296] __nla_validate_parse: 13 callbacks suppressed [ 683.046227][T23296] netlink: 144 bytes leftover after parsing attributes in process `syz.0.4598'. [ 683.098267][T23297] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4600'. [ 683.100515][T23299] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4599'. [ 683.254895][T23301] lo speed is unknown, defaulting to 1000 [ 683.301449][T23305] lo speed is unknown, defaulting to 1000 [ 683.597115][T23317] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4608'. [ 683.938325][T23314] syzkaller0: entered promiscuous mode [ 683.955117][T23314] syzkaller0: entered allmulticast mode [ 684.029598][T23319] tipc: Enabled bearer , priority 0 [ 684.055089][T23313] tipc: Resetting bearer [ 684.092499][T23338] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4609'. [ 684.188195][T23313] tipc: Disabling bearer [ 684.963015][T11961] net_ratelimit: 893 callbacks suppressed [ 684.963038][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.123252][T23367] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4619'. [ 685.366033][T23371] syzkaller0: entered promiscuous mode [ 685.398017][T23371] syzkaller0: entered allmulticast mode [ 685.472918][T23371] tipc: Enabled bearer , priority 0 [ 685.520431][T23370] tipc: Resetting bearer [ 685.612481][T23370] tipc: Disabling bearer [ 685.752053][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.885138][T23387] lo speed is unknown, defaulting to 1000 [ 685.989555][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.121798][T23403] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4630'. [ 686.134101][T23403] Unsupported ieee802154 address type: 0 [ 686.161837][T23399] ip6gretap0: entered promiscuous mode [ 686.268587][T23409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4632'. [ 686.289967][T23408] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4632'. [ 686.391131][T23408] bond4: option broadcast_neighbor: invalid value (4) [ 686.403759][T23408] bond4 (unregistering): Released all slaves [ 686.460399][T23409] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 686.471713][T23416] mac80211_hwsim hwsim31 wlan1: Device is already in use. [ 686.702816][T23424] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4635'. [ 687.029394][T11962] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.044807][T23436] bond7: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 687.057395][T23436] bond7 (unregistering): Released all slaves [ 687.560612][T23461] netlink: 'syz.3.4646': attribute type 1 has an invalid length. [ 687.578553][T23461] 8021q: VLANs not supported on lo [ 687.590976][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.753274][T23463] lo speed is unknown, defaulting to 1000 [ 688.069417][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.775366][T23495] netlink: 'syz.1.4656': attribute type 1 has an invalid length. [ 688.825347][T23495] netlink: 'syz.1.4656': attribute type 6 has an invalid length. [ 688.861101][T23495] netlink: 'syz.1.4656': attribute type 3 has an invalid length. [ 689.126908][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.164712][ T8450] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.175282][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.185780][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.432821][T23522] __nla_validate_parse: 6 callbacks suppressed [ 689.432844][T23522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4665'. [ 689.460443][T23522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4665'. [ 689.577898][T23522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4665'. [ 689.610762][T23522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4665'. [ 689.886921][T23522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4665'. [ 689.916244][T23522] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4665'. [ 689.977267][T11953] net_ratelimit: 315 callbacks suppressed [ 689.977289][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.038889][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.080955][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.116332][T23535] netlink: 64467 bytes leftover after parsing attributes in process `syz.1.4667'. [ 690.127764][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.159885][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.186181][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.211433][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.227884][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.244915][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.263277][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.378144][T23541] syzkaller0: entered promiscuous mode [ 690.405710][T23541] syzkaller0: entered allmulticast mode [ 690.547033][T23547] lo speed is unknown, defaulting to 1000 [ 690.710542][T23553] erspan0: left allmulticast mode [ 690.727286][T23553] erspan0: left promiscuous mode [ 690.740247][T23553] bridge1: port 1(erspan0) entered disabled state [ 690.796170][T23553] bridge_slave_0: left allmulticast mode [ 690.814283][T23553] bridge_slave_0: left promiscuous mode [ 690.831967][T23553] bridge0: port 1(bridge_slave_0) entered disabled state [ 690.887230][T23553] bridge_slave_1: left allmulticast mode [ 690.905010][T23553] bridge_slave_1: left promiscuous mode [ 690.913262][T23553] bridge0: port 2(bridge_slave_1) entered disabled state [ 690.967928][T23553] bond0: (slave bond_slave_0): Releasing backup interface [ 691.007108][T23553] bond_slave_0: left promiscuous mode [ 691.057193][T23553] bond0: (slave bond_slave_1): Releasing backup interface [ 691.098421][T23553] bond_slave_1: left promiscuous mode [ 691.133420][T23571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4679'. [ 691.161596][T23553] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 691.191221][T23571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4679'. [ 691.205040][T23579] xt_hashlimit: size too large, truncated to 1048576 [ 691.211951][T23553] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 691.243080][T23553] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 691.273266][T23553] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 691.364684][T23555] batadv1: entered promiscuous mode [ 691.394523][T23555] batadv1: entered allmulticast mode [ 691.570994][T23590] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4682'. [ 691.604078][T23589] xt_hashlimit: size too large, truncated to 1048576 [ 691.916712][T23595] bond0: (slave syz_tun): Releasing backup interface [ 692.333897][T23613] syzkaller0: entered promiscuous mode [ 692.353558][T23613] syzkaller0: entered allmulticast mode [ 693.155466][T23655] veth9: entered allmulticast mode [ 693.283305][T23640] netlink: 'syz.4.4697': attribute type 3 has an invalid length. [ 693.308505][T23640] netlink: 'syz.4.4697': attribute type 2 has an invalid length. [ 693.332109][T23640] netlink: 'syz.4.4697': attribute type 2 has an invalid length. [ 693.356101][T23661] xt_hashlimit: size too large, truncated to 1048576 [ 693.502762][T23660] netlink: 'syz.1.4702': attribute type 1 has an invalid length. [ 693.556712][T23660] netlink: 'syz.1.4702': attribute type 2 has an invalid length. [ 693.645162][T23668] lo speed is unknown, defaulting to 1000 [ 693.961430][T23679] netlink: 'syz.2.4708': attribute type 3 has an invalid length. [ 693.971660][T23679] netlink: 'syz.2.4708': attribute type 1 has an invalid length. [ 693.980531][T23679] NCSI netlink: No device for ifindex 4294967295 [ 693.997973][T23678] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 694.046764][T23681] batadv_slave_1: entered allmulticast mode [ 694.063453][T23680] batadv_slave_1: left allmulticast mode [ 694.551912][T23701] xt_hashlimit: size too large, truncated to 1048576 [ 695.291946][T23733] __nla_validate_parse: 6 callbacks suppressed [ 695.291968][T23733] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4727'. [ 695.350637][T11954] net_ratelimit: 330 callbacks suppressed [ 695.350656][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.353104][T23738] No such timeout policy "syz1" [ 695.462380][T23745] xt_hashlimit: size too large, truncated to 1048576 [ 695.750835][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.867619][T23763] lo speed is unknown, defaulting to 1000 [ 695.918824][T23771] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4736'. [ 695.989288][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 696.580754][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.807029][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.356384][T23820] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4749'. [ 697.830479][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.913197][T23833] lo speed is unknown, defaulting to 1000 [ 697.970431][T23814] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 697.996863][T23814] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.022292][T23818] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4748'. [ 698.111683][T23844] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 698.329896][T23856] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4761'. [ 698.765374][T23874] FAULT_INJECTION: forcing a failure. [ 698.765374][T23874] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 698.812215][T23874] CPU: 1 UID: 0 PID: 23874 Comm: syz.2.4766 Not tainted syzkaller #0 PREEMPT(full) [ 698.812262][T23874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 698.812283][T23874] Call Trace: [ 698.812292][T23874] [ 698.812303][T23874] dump_stack_lvl+0xe8/0x150 [ 698.812343][T23874] should_fail_ex+0x40c/0x560 [ 698.812378][T23874] _copy_to_user+0x31/0xb0 [ 698.812403][T23874] bpf_test_finish+0x1cf/0x690 [ 698.812512][T23874] ? __pfx_bpf_test_finish+0x10/0x10 [ 698.812546][T23874] ? _copy_from_user+0x94/0xb0 [ 698.812568][T23874] ? bpf_test_init+0x113/0x150 [ 698.812597][T23874] bpf_prog_test_run_xdp+0x8bc/0x11d0 [ 698.812642][T23874] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 698.812676][T23874] ? __fget_files+0x2a/0x420 [ 698.812713][T23874] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 698.812762][T23874] bpf_prog_test_run+0x2c5/0x340 [ 698.812813][T23874] __sys_bpf+0xa22/0xd90 [ 698.812853][T23874] ? __pfx___sys_bpf+0x10/0x10 [ 698.812909][T23874] ? __fget_files+0x2a/0x420 [ 698.812958][T23874] ? ksys_write+0x242/0x270 [ 698.812983][T23874] ? __pfx_ksys_write+0x10/0x10 [ 698.813011][T23874] __x64_sys_bpf+0xba/0xd0 [ 698.813038][T23874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.813062][T23874] do_syscall_64+0x174/0x580 [ 698.813098][T23874] ? trace_irq_disable+0x3b/0x140 [ 698.813127][T23874] ? clear_bhb_loop+0x40/0x90 [ 698.813155][T23874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.813177][T23874] RIP: 0033:0x7ff07819e019 [ 698.813200][T23874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.813224][T23874] RSP: 002b:00007ff078f8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 698.813248][T23874] RAX: ffffffffffffffda RBX: 00007ff078425fa0 RCX: 00007ff07819e019 [ 698.813265][T23874] RDX: 000000000000001e RSI: 0000200000000340 RDI: 000000000000000a [ 698.813280][T23874] RBP: 00007ff078f8e090 R08: 0000000000000000 R09: 0000000000000000 [ 698.813295][T23874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 698.813308][T23874] R13: 00007ff078426038 R14: 00007ff078425fa0 R15: 00007ffcc146f5c8 [ 698.813344][T23874] [ 699.272209][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.516553][T23887] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4771'. [ 699.597601][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 699.871378][T23893] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4773'. [ 699.886467][T23893] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4773'. [ 700.046714][T23893] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4773'. [ 700.087122][T23893] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4773'. [ 700.123085][T23899] IPVS: set_ctl: invalid protocol: 43 172.20.20.170:20003 [ 700.400724][T23893] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4773'. [ 700.429135][T23893] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4773'. [ 700.470054][ T136] net_ratelimit: 97 callbacks suppressed [ 700.470076][ T136] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.489780][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.500575][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.611355][T23921] netlink: 'syz.2.4781': attribute type 4 has an invalid length. [ 700.663392][T23922] netlink: 'syz.2.4781': attribute type 4 has an invalid length. [ 700.695875][T23933] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4782'. [ 700.915991][T23940] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4786'. [ 701.036642][T23943] FAULT_INJECTION: forcing a failure. [ 701.036642][T23943] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 701.068637][T23943] CPU: 1 UID: 0 PID: 23943 Comm: syz.0.4787 Not tainted syzkaller #0 PREEMPT(full) [ 701.068668][T23943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 701.068682][T23943] Call Trace: [ 701.068692][T23943] [ 701.068702][T23943] dump_stack_lvl+0xe8/0x150 [ 701.068744][T23943] should_fail_ex+0x40c/0x560 [ 701.068780][T23943] _copy_to_user+0x31/0xb0 [ 701.068806][T23943] bpf_test_finish+0x52e/0x690 [ 701.068856][T23943] ? __pfx_bpf_test_finish+0x10/0x10 [ 701.068908][T23943] ? _copy_from_user+0x94/0xb0 [ 701.068932][T23943] ? bpf_test_init+0x113/0x150 [ 701.068964][T23943] bpf_prog_test_run_xdp+0x8bc/0x11d0 [ 701.069011][T23943] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 701.069047][T23943] ? __fget_files+0x2a/0x420 [ 701.069086][T23943] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 701.069117][T23943] bpf_prog_test_run+0x2c5/0x340 [ 701.069156][T23943] __sys_bpf+0xa22/0xd90 [ 701.069196][T23943] ? __pfx___sys_bpf+0x10/0x10 [ 701.069238][T23943] ? __fget_files+0x2a/0x420 [ 701.069288][T23943] ? ksys_write+0x242/0x270 [ 701.069315][T23943] ? __pfx_ksys_write+0x10/0x10 [ 701.069345][T23943] __x64_sys_bpf+0xba/0xd0 [ 701.069374][T23943] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.069400][T23943] do_syscall_64+0x174/0x580 [ 701.069429][T23943] ? trace_irq_disable+0x3b/0x140 [ 701.069460][T23943] ? clear_bhb_loop+0x40/0x90 [ 701.069489][T23943] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.069512][T23943] RIP: 0033:0x7fb93099e019 [ 701.069535][T23943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 701.069555][T23943] RSP: 002b:00007fb931802028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 701.069581][T23943] RAX: ffffffffffffffda RBX: 00007fb930c25fa0 RCX: 00007fb93099e019 [ 701.069598][T23943] RDX: 000000000000001e RSI: 0000200000000340 RDI: 000000000000000a [ 701.069614][T23943] RBP: 00007fb931802090 R08: 0000000000000000 R09: 0000000000000000 [ 701.069629][T23943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 701.069643][T23943] R13: 00007fb930c26038 R14: 00007fb930c25fa0 R15: 00007ffe410d53a8 [ 701.069680][T23943] [ 701.515010][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.584612][T23949] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4789'. [ 701.595158][T23949] 0·: renamed from hsr0 (while UP) [ 701.638408][T23949] 0·: entered allmulticast mode [ 701.656106][T23949] hsr_slave_0: entered allmulticast mode [ 701.680752][T23949] hsr_slave_1: entered allmulticast mode [ 701.696153][T23949] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 701.886030][T23946] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4788'. [ 701.917655][T23965] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4794'. [ 701.952729][T23965] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4794'. [ 701.971315][T23971] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4788'. [ 702.036155][T23971] bond4: entered promiscuous mode [ 702.131362][T23971] bond4: entered allmulticast mode [ 702.165232][T23965] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4794'. [ 702.193355][T23971] 8021q: adding VLAN 0 to HW filter on device bond4 [ 702.549343][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.671656][T23989] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.706583][T23989] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.782823][T23989] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.812477][T23986] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.458427][T24005] syzkaller0: entered promiscuous mode [ 703.479269][T24005] syzkaller0: entered allmulticast mode [ 703.500352][T24005] tipc: Enabled bearer , priority 0 [ 703.520872][T24008] žÿ: renamed from team_slave_1 (while UP) [ 703.559518][T24004] tipc: Resetting bearer [ 703.647839][T24004] tipc: Disabling bearer [ 704.428767][T24046] syzkaller0: entered promiscuous mode [ 704.440751][T24046] syzkaller0: entered allmulticast mode [ 704.562429][T24051] syzkaller0: entered promiscuous mode [ 704.570435][T24051] syzkaller0: entered allmulticast mode [ 704.604955][T24051] tipc: Enabled bearer , priority 0 [ 704.649383][T24050] tipc: Resetting bearer [ 704.741859][T24050] tipc: Disabling bearer [ 705.115886][T24066] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 705.149041][T24066] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 705.170049][T24066] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 705.191524][T24066] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 705.224186][T24066] batman_adv: batadv0: Removing interface: vlan3 [ 705.486922][T24075] syzkaller0: entered promiscuous mode [ 705.492969][T24075] syzkaller0: entered allmulticast mode [ 705.591442][ T34] net_ratelimit: 201 callbacks suppressed [ 705.591465][ T34] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.606601][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.631052][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.957483][T11955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.712010][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.769941][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.802200][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.968410][T24116] tipc: Enabling of bearer rejected, failed to enable media [ 709.031531][T11955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.094797][T24082] lo speed is unknown, defaulting to 1000 [ 709.829810][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.044844][T24157] __nla_validate_parse: 6 callbacks suppressed [ 710.044867][T24157] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4843'. [ 710.261583][T24161] netlink: 84 bytes leftover after parsing attributes in process `syz.2.4844'. [ 710.430951][T24167] syzkaller0: entered promiscuous mode [ 710.459261][T24167] syzkaller0: entered allmulticast mode [ 710.493265][T24167] tipc: Enabled bearer , priority 0 [ 710.571547][T24165] tipc: Resetting bearer [ 710.626572][T24179] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4850'. [ 710.659263][T24165] tipc: Disabling bearer [ 710.697029][T24177] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4849'. [ 710.710980][ T1180] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.720322][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.737151][T24177] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4849'. [ 710.748160][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 710.854058][T24184] netlink: 208 bytes leftover after parsing attributes in process `syz.2.4853'. [ 710.889480][T24184] netlink: 208 bytes leftover after parsing attributes in process `syz.2.4853'. [ 711.750783][T11961] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.908502][T24223] syzkaller1: entered promiscuous mode [ 711.935927][T24223] syzkaller1: entered allmulticast mode [ 712.070129][T24231] netlink: 'syz.1.4866': attribute type 4 has an invalid length. [ 712.079785][ T1180] nci: nci_rx_work: unknown MT 0x6 [ 712.106048][T24231] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4866'. [ 712.120877][T24231] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 712.226918][T24235] netlink: 'syz.3.4869': attribute type 8 has an invalid length. [ 712.292916][T24235] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4869'. [ 712.386707][T24242] No such timeout policy "syz1" [ 712.502755][T24250] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 712.789640][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.829628][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.549956][T11954] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.869465][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 714.938938][T24226] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 715.388512][T24297] netlink: 'syz.2.4885': attribute type 2 has an invalid length. [ 715.397928][T24294] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4887'. [ 715.608465][T24304] netlink: 'syz.4.4891': attribute type 1 has an invalid length. [ 715.690182][T24312] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4891'. [ 715.806562][T24304] 8021q: adding VLAN 0 to HW filter on device bond8 [ 715.816894][T24311] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4893'. [ 715.833589][T24316] netlink: 'syz.2.4894': attribute type 1 has an invalid length. [ 715.896819][T24318] net_ratelimit: 1 callbacks suppressed [ 715.896842][T24318] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 715.915214][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 715.944243][T24319] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 716.012644][T24324] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4896'. [ 716.100548][T24316] 8021q: adding VLAN 0 to HW filter on device bond4 [ 716.133642][T24325] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4896'. [ 716.182550][T24320] bond4: (slave veth11): Enslaving as an active interface with a down link [ 716.229837][T24322] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 716.254744][T24322] bond4: (slave batadv1): making interface the new active one [ 716.277926][T24322] batadv1: entered promiscuous mode [ 716.296174][T24322] bond4: (slave batadv1): Enslaving as an active interface with an up link [ 716.370222][T24326] bond4 (unregistering): (slave veth11): Releasing active interface [ 716.408038][T24326] bond4 (unregistering): (slave batadv1): Releasing active interface [ 716.438061][T24326] bond4 (unregistering): Released all slaves [ 716.473084][ T136] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.482198][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.495689][T11960] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.696217][T24330] bond6: entered promiscuous mode [ 716.716286][T24330] bond6: entered allmulticast mode [ 716.735088][T24330] 8021q: adding VLAN 0 to HW filter on device bond6 [ 716.857280][T24349] tipc: Enabled bearer , priority 0 [ 716.897074][T24349] syzkaller0: entered promiscuous mode [ 716.922186][T24357] xt_hashlimit: size too large, truncated to 1048576 [ 716.923302][T24349] syzkaller0: entered allmulticast mode [ 716.968356][T24349] tipc: Resetting bearer [ 716.996217][T24349] netlink: 'syz.2.4903': attribute type 3 has an invalid length. [ 717.089986][T24357] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 717.161360][T24347] tipc: Resetting bearer [ 717.225368][T24347] tipc: Disabling bearer [ 717.461672][T24373] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4909'. [ 717.474616][T24375] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4910'. [ 717.510038][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.514564][T24375] openvswitch: netlink: Missing key (keys=40, expected=80) [ 717.718920][T24382] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4913'. [ 717.826862][T24384] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4914'. [ 717.977661][T24390] FAULT_INJECTION: forcing a failure. [ 717.977661][T24390] name failslab, interval 1, probability 0, space 0, times 0 [ 718.001250][T24390] CPU: 1 UID: 0 PID: 24390 Comm: syz.2.4916 Not tainted syzkaller #0 PREEMPT(full) [ 718.001283][T24390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 718.001297][T24390] Call Trace: [ 718.001307][T24390] [ 718.001317][T24390] dump_stack_lvl+0xe8/0x150 [ 718.001358][T24390] should_fail_ex+0x40c/0x560 [ 718.001394][T24390] should_failslab+0xa8/0x100 [ 718.001431][T24390] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 718.001460][T24390] ? local_lock_release+0x9c/0x160 [ 718.001486][T24390] ? __alloc_skb+0x1d7/0x7a0 [ 718.001508][T24390] ? __alloc_skb+0x1d7/0x7a0 [ 718.001538][T24390] __alloc_skb+0x1d7/0x7a0 [ 718.001567][T24390] pfkey_sendmsg+0xddc/0x11d0 [ 718.001695][T24390] ? unwind_next_frame+0x8f/0x2550 [ 718.001731][T24390] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 718.001778][T24390] ? __pfx_aa_sk_perm+0x10/0x10 [ 718.001810][T24390] ? aa_sock_msg_perm+0xf1/0x1b0 [ 718.001843][T24390] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 718.001867][T24390] sock_sendmsg_nosec+0x13a/0x180 [ 718.001905][T24390] ____sys_sendmsg+0x54e/0x850 [ 718.001939][T24390] ? __pfx_____sys_sendmsg+0x10/0x10 [ 718.001984][T24390] ? import_iovec+0x73/0xa0 [ 718.002024][T24390] ___sys_sendmsg+0x2a5/0x360 [ 718.002051][T24390] ? __lock_acquire+0x683/0x2cf0 [ 718.002089][T24390] ? __pfx____sys_sendmsg+0x10/0x10 [ 718.002157][T24390] ? __fget_files+0x2a/0x420 [ 718.002188][T24390] ? __fget_files+0x3a2/0x420 [ 718.002231][T24390] __x64_sys_sendmsg+0x1b1/0x290 [ 718.002263][T24390] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 718.002312][T24390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.002339][T24390] do_syscall_64+0x174/0x580 [ 718.002366][T24390] ? trace_irq_disable+0x3b/0x140 [ 718.002398][T24390] ? clear_bhb_loop+0x40/0x90 [ 718.002426][T24390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.002450][T24390] RIP: 0033:0x7ff07819e019 [ 718.002473][T24390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 718.002494][T24390] RSP: 002b:00007ff078f8e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 718.002519][T24390] RAX: ffffffffffffffda RBX: 00007ff078425fa0 RCX: 00007ff07819e019 [ 718.002537][T24390] RDX: 0000000000000000 RSI: 0000200000003780 RDI: 0000000000000003 [ 718.002552][T24390] RBP: 00007ff078f8e090 R08: 0000000000000000 R09: 0000000000000000 [ 718.002573][T24390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 718.002587][T24390] R13: 00007ff078426038 R14: 00007ff078425fa0 R15: 00007ffcc146f5c8 [ 718.002625][T24390] [ 718.006466][T24391] netlink: 136 bytes leftover after parsing attributes in process `syz.1.4915'. [ 718.279476][T11953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.549490][ T5795] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.636638][T24403] No such timeout policy "syz1" [ 718.999401][T24398] syz_tun: left promiscuous mode [ 719.026627][T24398] pimreg1: left allmulticast mode [ 719.207232][T24418] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 719.261241][T24434] netlink: 'syz.3.4928': attribute type 1 has an invalid length. [ 719.327249][T24398] mac80211_hwsim hwsim35 wlan1: left promiscuous mode [ 719.335125][T24398] veth3: left allmulticast mode [ 719.340627][T24398] ip6erspan0: left allmulticast mode [ 719.346429][T24398] vlan0: left promiscuous mode [ 719.352505][T24398] veth5: left allmulticast mode [ 719.358489][T24398] vlan1: left promiscuous mode [ 719.373367][T24398] veth9: left allmulticast mode [ 719.686539][T24412] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.694074][T24412] bridge0: port 1(bridge_slave_0) entered disabled state [ 720.733902][T24434] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 720.737428][ T8458] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.780905][T24444] __nla_validate_parse: 2 callbacks suppressed [ 720.780927][T24444] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4930'. [ 720.810563][ T8458] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.816989][T24444] netlink: 'syz.2.4930': attribute type 10 has an invalid length. [ 720.839435][T24444] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4930'. [ 720.840660][ T8458] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.888260][ T8458] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 720.916989][ T8458] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.947251][ T8458] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.095402][T24432] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.204914][T24444] geneve2: entered promiscuous mode [ 721.221016][T24444] geneve2: entered allmulticast mode [ 721.248904][ T8458] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 721.285987][ T8458] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.306851][T24459] No such timeout policy "syz1" [ 721.315384][ T8458] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.343799][ T8458] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.485800][T24432] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.633903][ T8458] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 721.644394][T24471] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4935'. [ 721.682837][ T8458] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.720639][ T8458] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.756512][ T8458] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 721.934775][T24432] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.078125][T24432] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 722.324448][T24491] pim6reg1: entered promiscuous mode [ 722.339650][T24491] pim6reg1: entered allmulticast mode [ 722.617164][ T8450] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.709830][ T8450] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.810025][T24513] No such timeout policy "syz1" [ 722.821536][ T136] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 722.944057][ T144] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 723.199336][T24526] batadv_slave_1: entered allmulticast mode [ 723.373624][T24533] veth0_to_team: entered allmulticast mode [ 723.456000][T24520] batadv_slave_1: left allmulticast mode [ 723.924840][T24548] netlink: 'syz.1.4959': attribute type 1 has an invalid length. [ 723.968876][T24550] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4958'. [ 724.092617][T24550] bond9: option arp_interval: mode dependency failed, not supported in mode balance-alb(6) [ 724.104364][T24550] bond9 (unregistering): Released all slaves [ 724.127364][T24557] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4962'. [ 724.143203][T24557] geneve0: entered promiscuous mode [ 724.148546][T24557] geneve0: entered allmulticast mode [ 724.895079][T24581] net_ratelimit: 2 callbacks suppressed [ 724.895100][T24581] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 725.021978][T24581] syzkaller0: entered promiscuous mode [ 725.039216][T24581] syzkaller0: entered allmulticast mode [ 725.224838][T24587] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4973'. [ 725.235807][T24587] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4973'. [ 728.154475][ T8458] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.187815][ T8458] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.228545][ T8458] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.266144][ T8458] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.374485][T24605] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4977'. [ 728.621168][T24623] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4984'. [ 728.950683][T24642] syzkaller0: entered promiscuous mode [ 728.977048][T24642] syzkaller0: entered allmulticast mode [ 729.048586][T24646] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4992'. [ 729.392846][T24650] netlink: 136 bytes leftover after parsing attributes in process `syz.2.4993'. [ 729.403854][T24657] netlink: 'syz.4.4995': attribute type 10 has an invalid length. [ 729.482170][T24657] 8021q: adding VLAN 0 to HW filter on device team0 [ 729.501698][T24657] team0: entered promiscuous mode [ 729.510303][T24657] team_slave_0: entered promiscuous mode [ 729.526425][T24657] team_slave_1: entered promiscuous mode [ 729.544422][T24657] bond0: (slave team0): Enslaving as an active interface with an up link [ 729.568411][T24632] x_tables: duplicate underflow at hook 2 [ 729.758660][T24664] netlink: 'syz.4.4997': attribute type 8 has an invalid length. [ 729.791093][T24666] netlink: 'syz.0.4996': attribute type 3 has an invalid length. [ 729.887783][T24669] mac80211_hwsim hwsim35 wlan1: entered allmulticast mode [ 730.181177][T24686] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5002'. [ 730.288651][T24694] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5006'. [ 730.402871][T24702] FAULT_INJECTION: forcing a failure. [ 730.402871][T24702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 730.453242][T24702] CPU: 0 UID: 0 PID: 24702 Comm: syz.2.5008 Not tainted syzkaller #0 PREEMPT(full) [ 730.453273][T24702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 730.453297][T24702] Call Trace: [ 730.453307][T24702] [ 730.453317][T24702] dump_stack_lvl+0xe8/0x150 [ 730.453357][T24702] should_fail_ex+0x40c/0x560 [ 730.453392][T24702] _copy_to_user+0x31/0xb0 [ 730.453416][T24702] simple_read_from_buffer+0xe1/0x170 [ 730.453453][T24702] proc_fail_nth_read+0x1bb/0x230 [ 730.453489][T24702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 730.453524][T24702] ? rw_verify_area+0x24a/0x4c0 [ 730.453560][T24702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 730.453593][T24702] vfs_read+0x213/0xa80 [ 730.453621][T24702] ? __pfx___mutex_lock+0x10/0x10 [ 730.453652][T24702] ? __pfx_vfs_read+0x10/0x10 [ 730.453677][T24702] ? __fget_files+0x2a/0x420 [ 730.453714][T24702] ? __fget_files+0x3a2/0x420 [ 730.453745][T24702] ? __fget_files+0x2a/0x420 [ 730.453785][T24702] ksys_read+0x150/0x270 [ 730.453811][T24702] ? __pfx_ksys_read+0x10/0x10 [ 730.453843][T24702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.453869][T24702] do_syscall_64+0x174/0x580 [ 730.453896][T24702] ? trace_irq_disable+0x3b/0x140 [ 730.453927][T24702] ? clear_bhb_loop+0x40/0x90 [ 730.453956][T24702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.453980][T24702] RIP: 0033:0x7ff07815e84e [ 730.454002][T24702] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 730.454021][T24702] RSP: 002b:00007ff078f8dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 730.454057][T24702] RAX: ffffffffffffffda RBX: 00007ff078f8e6c0 RCX: 00007ff07815e84e [ 730.454074][T24702] RDX: 000000000000000f RSI: 00007ff078f8e0a0 RDI: 0000000000000004 [ 730.454087][T24702] RBP: 00007ff078f8e090 R08: 0000000000000000 R09: 0000000000000000 [ 730.454101][T24702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 730.454113][T24702] R13: 00007ff078426038 R14: 00007ff078425fa0 R15: 00007ffcc146f5c8 [ 730.454147][T24702] [ 730.685753][T24704] syzkaller0: entered promiscuous mode [ 730.745124][T24704] syzkaller0: entered allmulticast mode [ 730.778102][T24697] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5009'. [ 730.807532][T24711] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5011'. [ 730.832413][T24704] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5009'. [ 730.963011][T24697] team0: entered promiscuous mode [ 730.980400][T24697] team0: entered allmulticast mode [ 730.996787][T24697] 8021q: adding VLAN 0 to HW filter on device team0 [ 731.104710][T24704] team1: entered promiscuous mode [ 731.110851][T24704] team1: entered allmulticast mode [ 731.116902][T24704] 8021q: adding VLAN 0 to HW filter on device team1 [ 731.216646][T24725] netlink: 'syz.3.5014': attribute type 9 has an invalid length. [ 731.232689][T24723] lo: entered promiscuous mode [ 731.248137][T24723] tunl0: entered promiscuous mode [ 731.254885][T24723] gre0: entered promiscuous mode [ 731.261353][T24723] gretap0: entered promiscuous mode [ 731.267945][T24723] erspan0: entered promiscuous mode [ 731.276002][T24723] ip_vti0: entered promiscuous mode [ 731.295321][T24723] ip6_vti0: entered promiscuous mode [ 731.310181][T24723] sit0: entered promiscuous mode [ 731.325234][T24723] ip6tnl0: entered promiscuous mode [ 731.340500][T24723] ip6gre0: entered promiscuous mode [ 731.363250][T24723] ip6gretap0: entered promiscuous mode [ 731.381022][T24723] bridge0: entered promiscuous mode [ 731.387654][T24723] vcan0: entered promiscuous mode [ 731.407578][T24723] 8021q: adding VLAN 0 to HW filter on device bond0 [ 731.431364][T24723] dummy0: entered promiscuous mode [ 731.448053][T24723] nlmon0: entered promiscuous mode [ 731.461516][T24723] veth0: entered promiscuous mode [ 731.470842][T24723] veth1: entered promiscuous mode [ 731.481994][T24723] wg0: entered promiscuous mode [ 731.501456][T24723] wg1: entered promiscuous mode [ 731.516903][T24723] wg2: entered promiscuous mode [ 731.523866][T24723] veth0_to_bridge: entered promiscuous mode [ 731.540546][T24723] veth1_to_bridge: entered promiscuous mode [ 731.550332][T24723] veth0_to_bond: entered promiscuous mode [ 731.564089][T24723] veth1_to_bond: entered promiscuous mode [ 731.584656][T24723] veth0_to_team: entered promiscuous mode [ 731.593689][T24723] veth1_to_team: entered promiscuous mode [ 731.606766][T24723] veth1_to_batadv: entered promiscuous mode [ 731.617283][T24723] batadv_slave_1: entered promiscuous mode [ 731.624600][T24723] veth0_to_hsr: entered promiscuous mode [ 731.632451][T24723] veth1_to_hsr: entered promiscuous mode [ 731.641460][T24723] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 731.652104][T24723] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 731.663470][T24723] 0·: entered promiscuous mode [ 731.668364][T24723] 0·: left allmulticast mode [ 731.685218][T24723] hsr_slave_0: left allmulticast mode [ 731.691375][T24723] hsr_slave_1: left allmulticast mode [ 731.698607][T24723] veth1_virt_wifi: entered promiscuous mode [ 731.707458][T24723] veth0_virt_wifi: entered promiscuous mode [ 731.717025][T24723] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 731.732245][T24723] virt_wifi0: entered promiscuous mode [ 731.745425][T24723] veth1_vlan: left promiscuous mode [ 731.753814][T24723] veth1_vlan: entered promiscuous mode [ 731.760996][T24723] veth0_vlan: left promiscuous mode [ 731.766522][T24723] veth0_vlan: entered promiscuous mode [ 731.776370][T24723] vlan0: entered promiscuous mode [ 731.784167][T24723] vlan1: entered promiscuous mode [ 731.793518][T24723] macvlan1: entered promiscuous mode [ 731.801884][T24723] ipvlan0: entered promiscuous mode [ 731.810845][T24723] ipvlan1: entered promiscuous mode [ 731.818158][T24723] veth1_macvtap: left promiscuous mode [ 731.824400][T24723] veth1_macvtap: entered promiscuous mode [ 731.840986][T24723] veth0_macvtap: left promiscuous mode [ 731.846820][T24723] veth0_macvtap: entered promiscuous mode [ 731.855533][T24723] macvtap0: entered promiscuous mode [ 731.863199][T24723] macsec0: entered promiscuous mode [ 731.872311][T24723] geneve0: entered promiscuous mode [ 731.880693][T24723] geneve1: entered promiscuous mode [ 731.887774][T24723] mac80211_hwsim hwsim32 wlan0: entered promiscuous mode [ 731.897464][T24723] mac80211_hwsim hwsim33 wlan1: entered promiscuous mode [ 731.906575][T24723] ip6gretap1: entered promiscuous mode [ 731.914804][T24723] bond1: entered promiscuous mode [ 731.921056][T24723] 8021q: adding VLAN 0 to HW filter on device bond1 [ 731.939230][T24723] bridge1: entered promiscuous mode [ 731.945945][T24723] gre1: entered promiscuous mode [ 731.953983][T24723] netdevsim netdevsim4 eth0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 731.964809][T24723] netdevsim netdevsim4 eth0: entered promiscuous mode [ 731.973279][T24723] 8021q: adding VLAN 0 to HW filter on device eth0 [ 731.986874][T24723] netdevsim netdevsim4 eth1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 731.997361][T24723] netdevsim netdevsim4 eth1: entered promiscuous mode [ 732.006915][T24723] 8021q: adding VLAN 0 to HW filter on device eth1 [ 732.015419][T24723] netdevsim netdevsim4 eth2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 732.025580][T24723] netdevsim netdevsim4 eth2: entered promiscuous mode [ 732.049444][T24723] 8021q: adding VLAN 0 to HW filter on device eth2 [ 732.076165][T24723] netdevsim netdevsim4 eth3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 732.091409][T24723] netdevsim netdevsim4 eth3: entered promiscuous mode [ 732.098893][T24723] 8021q: adding VLAN 0 to HW filter on device eth3 [ 732.107442][T24723] 8021q: adding VLAN 0 to HW filter on device bond2 [ 732.116222][T24723] vlan2: left allmulticast mode [ 732.121331][T24723] bond2: left allmulticast mode [ 732.128144][T24723] batadv1: left allmulticast mode [ 732.136638][T24723] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 732.145794][T24723] bond3: entered promiscuous mode [ 732.151646][T24723] 8021q: adding VLAN 0 to HW filter on device bond3 [ 732.160118][T24723] bond4: entered promiscuous mode [ 732.165778][T24723] 8021q: adding VLAN 0 to HW filter on device bond4 [ 732.174237][T24723] bond5: entered promiscuous mode [ 732.179638][T24723] veth3: entered promiscuous mode [ 732.185398][T24723] 8021q: adding VLAN 0 to HW filter on device bond5 [ 732.193932][T24723] veth2: entered promiscuous mode [ 732.200376][T24723] veth3: left allmulticast mode [ 732.206962][T24723] bond6: entered promiscuous mode [ 732.212684][T24723] 8021q: adding VLAN 0 to HW filter on device bond6 [ 732.220459][T24723] veth4: entered promiscuous mode [ 732.226289][T24723] veth5: entered promiscuous mode [ 732.231479][T24723] veth5: left allmulticast mode [ 732.238489][T24723] mac80211_hwsim hwsim42 wlan2: entered promiscuous mode [ 732.246589][T24723] gtp0: entered promiscuous mode [ 732.252754][T24723] mac80211_hwsim hwsim49 wlan3: entered promiscuous mode [ 732.261173][T24723] 8021q: adding VLAN 0 to HW filter on device bond7 [ 732.269716][T24723] gre3: entered promiscuous mode [ 732.275311][T24723] veth6: entered promiscuous mode [ 732.281331][T24723] veth7: entered promiscuous mode [ 732.286996][T24723] geneve2: entered promiscuous mode [ 732.293062][T24723] mac80211_hwsim hwsim32 netpci0: entered promiscuous mode [ 732.300418][T24723] A link change request failed with some changes committed already. Interface netpci0 may have been left with an inconsistent configuration, please check. [ 732.318561][ T8458] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.325803][ T8458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 732.350614][ T8458] bridge0: port 2(bridge_slave_1) entered blocking state [ 732.357783][ T8458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 732.426352][T24748] mac80211_hwsim hwsim40 syzkaller0: entered promiscuous mode [ 732.439526][T24748] mac80211_hwsim hwsim40 syzkaller0: entered allmulticast mode [ 732.451815][ T144] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 732.476591][ T144] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 732.512282][ T144] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 732.572851][ T144] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 732.884180][T24782] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5029'. [ 732.904952][ T1180] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 732.917333][ T1180] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 732.974900][T24778] batman_adv: batadv0: Removing interface: macvtap1 [ 733.097524][T24777] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 733.151894][T24785] xt_CT: You must specify a L4 protocol and not use inversions on it [ 733.372478][T24793] netlink: 'syz.4.5032': attribute type 1 has an invalid length. [ 733.424674][T24800] __nla_validate_parse: 2 callbacks suppressed [ 733.424694][T24800] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5032'. [ 733.484001][T24793] bond9: entered promiscuous mode [ 733.492588][T24793] 8021q: adding VLAN 0 to HW filter on device bond9 [ 734.050699][T24813] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.134487][T24815] lo speed is unknown, defaulting to 1000 [ 734.155342][T24813] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.288616][T24813] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.398134][T24824] netlink: 'syz.1.5040': attribute type 1 has an invalid length. [ 734.414623][T24824] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5040'. [ 734.443128][T24813] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.489413][T24830] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5042'. [ 734.498531][T24830] netlink: 88 bytes leftover after parsing attributes in process `syz.3.5042'. [ 734.682349][T24832] nbd: socks must be embedded in a SOCK_ITEM attr [ 734.695071][T24832] block nbd3: shutting down sockets [ 734.846200][T24839] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5045'. [ 734.937117][T24841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5046'. [ 735.081630][T24846] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 735.303937][T24858] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5050'. [ 735.355631][T24852] xt_CT: No such helper "syz0" [ 735.760017][T24884] xt_TCPMSS: Only works on TCP SYN packets [ 735.788019][T24884] netlink: 'syz.1.5057': attribute type 1 has an invalid length. [ 735.815386][T24884] netlink: 232 bytes leftover after parsing attributes in process `syz.1.5057'. [ 735.845121][T24884] netlink: 'syz.1.5057': attribute type 1 has an invalid length. [ 735.877522][T24888] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5060'. [ 735.948498][T24891] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 735.971299][T24892] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5061'. [ 736.207601][T24902] netlink: 'syz.3.5065': attribute type 1 has an invalid length. [ 736.245594][T24902] bond6: option mode: invalid value (8) [ 736.253855][T24902] bond6 (unregistering): Released all slaves [ 736.296655][T24905] 8021q: adding VLAN 0 to HW filter on device bond4 [ 736.366486][T24902] netlink: 'syz.3.5065': attribute type 10 has an invalid length. [ 736.403788][T24905] 8021q: adding VLAN 0 to HW filter on device bond5 [ 736.412912][T24905] bond4: (slave bond5): Enslaving as an active interface with an up link [ 736.423764][T24902] : entered promiscuous mode [ 736.452700][T24909] bond4 (unregistering): (slave bond5): Releasing backup interface [ 736.480449][T24909] bond4 (unregistering): Released all slaves [ 736.732392][ T8458] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.800345][ T136] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 736.920040][ T1180] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.022164][ T1180] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.165283][T24942] xt_hashlimit: Unknown mode mask 3FFFF, kernel too old? [ 737.421658][T24948] batman_adv: batadv0: Adding interface: macvtap1 [ 737.431182][T24948] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 737.458614][T24948] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 737.568469][T24953] xt_socket: unknown flags 0x8 [ 737.584159][T24953] netlink: 'syz.4.5079': attribute type 11 has an invalid length. [ 737.636542][T24951] lo speed is unknown, defaulting to 1000 [ 737.695621][T24960] netlink: 'syz.1.5081': attribute type 1 has an invalid length. [ 737.748750][T24957] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 737.776457][T24957] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 737.994077][T24965] bond7: (slave geneve2): making interface the new active one [ 738.034950][T24965] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 738.123466][ T8450] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 738.142145][ T8450] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 738.184394][T24957] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 738.205942][T24957] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 738.450413][T24987] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 738.471832][T24987] netlink: 'syz.0.5088': attribute type 1 has an invalid length. [ 738.490469][T24987] __nla_validate_parse: 6 callbacks suppressed [ 738.490492][T24987] netlink: 200 bytes leftover after parsing attributes in process `syz.0.5088'. [ 738.533537][T24987] netlink: 'syz.0.5088': attribute type 1 has an invalid length. [ 738.542580][T24987] netlink: 29 bytes leftover after parsing attributes in process `syz.0.5088'. [ 738.796542][T24993] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5090'. [ 738.910431][T25000] No such timeout policy "syz1" [ 739.050238][T25003] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5095'. [ 739.074799][T25007] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5096'. [ 739.087855][T25009] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5097'. [ 739.097570][T25007] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5096'. [ 739.117281][T25003] syzkaller0: entered promiscuous mode [ 739.130470][T25003] syzkaller0: entered allmulticast mode [ 739.601282][T25028] syzkaller0: entered promiscuous mode [ 739.619178][T25028] syzkaller0: entered allmulticast mode [ 739.707258][T25028] batadv1: entered promiscuous mode [ 739.739062][T25028] batadv1: entered allmulticast mode [ 739.748116][T25028] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 739.816793][T24957] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 739.837212][T24957] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.874030][T24957] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 739.995380][T24957] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 740.031140][T24957] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.074200][T24957] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 740.253566][T25053] syzkaller1: entered promiscuous mode [ 740.265745][T25053] syzkaller1: entered allmulticast mode [ 740.667580][ T136] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 740.681272][ T136] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 740.692177][ T136] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 740.806810][T25063] bond0: (slave bond_slave_0): Releasing backup interface [ 740.846551][T25063] bond0: (slave bond_slave_1): Releasing backup interface [ 740.922741][T25063] team0: Port device team_slave_0 removed [ 740.968643][T25063] team0: Port device team_slave_1 removed [ 740.992248][T25063] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 741.012831][ T136] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 741.049462][ T136] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 741.058816][ T136] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 741.158912][ T34] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 741.187377][ T34] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 741.219046][ T34] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 741.323837][ T34] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 741.339420][ T34] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 741.360068][ T34] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 741.394514][T25068] macvtap1: entered promiscuous mode [ 741.400486][T25068] batadv0: entered promiscuous mode [ 741.406050][T25068] macvtap1: entered allmulticast mode [ 741.411678][T25068] batadv0: entered allmulticast mode [ 741.418850][T25068] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 741.445958][T25068] batadv0: left allmulticast mode [ 741.462124][T25068] batadv0: left promiscuous mode [ 741.531079][T25087] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 741.854939][T25102] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5125'. [ 741.864009][T25101] netlink: 'syz.3.5124': attribute type 22 has an invalid length. [ 741.864034][T25101] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5124'. [ 741.871770][T25101] netlink: 'syz.3.5124': attribute type 22 has an invalid length. [ 741.927890][T25101] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5124'. [ 742.198440][T25111] mac80211_hwsim hwsim35 syzkaller0: entered promiscuous mode [ 742.236351][T25111] mac80211_hwsim hwsim35 syzkaller0: entered allmulticast mode [ 742.852899][T25141] netlink: 'syz.0.5136': attribute type 1 has an invalid length. [ 743.027453][T25147] x_tables: duplicate underflow at hook 3 [ 743.334739][T25161] netlink: 'syz.1.5143': attribute type 2 has an invalid length. [ 743.392331][T25161] : entered promiscuous mode [ 743.963712][T25196] __nla_validate_parse: 6 callbacks suppressed [ 743.963734][T25196] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5153'. [ 744.064721][T25193] veth1_macvtap: left promiscuous mode [ 744.083963][T25193] macsec0: entered promiscuous mode [ 744.124364][T25197] lo speed is unknown, defaulting to 1000 [ 744.130794][T25202] veth1_macvtap: entered promiscuous mode [ 744.142931][T25202] macsec0: left promiscuous mode [ 744.761698][T25229] No such timeout policy "syz1" [ 744.781564][T25227] ipt_REJECT: TCP_RESET invalid for non-tcp [ 744.831736][T25227] gretap1: entered promiscuous mode [ 745.008809][T25235] lo speed is unknown, defaulting to 1000 [ 745.157078][T25244] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 745.365734][T25249] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5172'. [ 745.480623][T25257] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5175'. [ 745.696259][T25263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5178'. [ 745.716775][T25263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5178'. [ 745.857966][T25263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5178'. [ 745.889100][T25263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5178'. [ 746.034901][T25263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5178'. [ 746.047000][T25263] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5178'. [ 746.060549][T25270] lo speed is unknown, defaulting to 1000 [ 746.172797][T25284] netlink: 'syz.3.5183': attribute type 1 has an invalid length. [ 746.435482][T25293] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5184'. [ 746.611643][T25284] 8021q: adding VLAN 0 to HW filter on device bond6 [ 746.651771][T25288] bond6: (slave geneve4): making interface the new active one [ 746.670283][T25288] bond6: (slave geneve4): Enslaving as an active interface with an up link [ 747.522472][T25333] FAULT_INJECTION: forcing a failure. [ 747.522472][T25333] name failslab, interval 1, probability 0, space 0, times 0 [ 747.557324][T25333] CPU: 0 UID: 0 PID: 25333 Comm: syz.4.5196 Not tainted syzkaller #0 PREEMPT(full) [ 747.557356][T25333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 747.557371][T25333] Call Trace: [ 747.557380][T25333] [ 747.557391][T25333] dump_stack_lvl+0xe8/0x150 [ 747.557431][T25333] should_fail_ex+0x40c/0x560 [ 747.557467][T25333] should_failslab+0xa8/0x100 [ 747.557505][T25333] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 747.557535][T25333] ? skb_clone+0x212/0x3a0 [ 747.557562][T25333] ? skb_clone+0x212/0x3a0 [ 747.557602][T25333] skb_clone+0x212/0x3a0 [ 747.557635][T25333] __netlink_deliver_tap+0x413/0x860 [ 747.557678][T25333] ? netlink_deliver_tap+0x2e/0x1b0 [ 747.557708][T25333] netlink_deliver_tap+0x19c/0x1b0 [ 747.557739][T25333] netlink_unicast+0x77f/0x940 [ 747.557774][T25333] netlink_sendmsg+0x813/0xb40 [ 747.557800][T25333] ? __fget_files+0x2a/0x420 [ 747.557841][T25333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 747.557875][T25333] ? aa_sock_msg_perm+0xf1/0x1b0 [ 747.557905][T25333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 747.557933][T25333] sock_sendmsg_nosec+0x13a/0x180 [ 747.557970][T25333] __sys_sendto+0x408/0x5a0 [ 747.557995][T25333] ? ksys_write+0x1e6/0x270 [ 747.558021][T25333] ? __pfx___sys_sendto+0x10/0x10 [ 747.558043][T25333] ? __mutex_unlock_slowpath+0x731/0x900 [ 747.558114][T25333] ? __pfx_ksys_write+0x10/0x10 [ 747.558145][T25333] __x64_sys_sendto+0xde/0x100 [ 747.558172][T25333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.558195][T25333] do_syscall_64+0x174/0x580 [ 747.558224][T25333] ? trace_irq_disable+0x3b/0x140 [ 747.558254][T25333] ? clear_bhb_loop+0x40/0x90 [ 747.558284][T25333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 747.558307][T25333] RIP: 0033:0x7f832879e019 [ 747.558331][T25333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 747.558352][T25333] RSP: 002b:00007f83296c3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 747.558378][T25333] RAX: ffffffffffffffda RBX: 00007f8328a25fa0 RCX: 00007f832879e019 [ 747.558396][T25333] RDX: 0000000000010a18 RSI: 0000200000000000 RDI: 0000000000000003 [ 747.558412][T25333] RBP: 00007f83296c3090 R08: 0000000000000000 R09: 4b6ae4f95a5de35b [ 747.558428][T25333] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 747.558443][T25333] R13: 00007f8328a26038 R14: 00007f8328a25fa0 R15: 00007ffc19f74078 [ 747.558482][T25333] [ 748.706876][T25380] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 748.724725][T25380] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.745088][T25386] netlink: 'syz.0.5212': attribute type 1 has an invalid length. [ 748.836369][T25386] bond7: (slave geneve2): making interface the new active one [ 748.858453][T25386] bond7: (slave geneve2): Enslaving as an active interface with an up link [ 748.891567][T25380] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 748.911200][T25380] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.964085][ T152] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 748.981138][T25392] __nla_validate_parse: 3 callbacks suppressed [ 748.981157][T25392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5214'. [ 748.989915][ T152] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 749.014570][T25392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5214'. [ 749.033486][T25393] xt_socket: unknown flags 0x8 [ 749.189723][T25395] bond7: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 749.238428][T25395] bond7 (unregistering): Released all slaves [ 749.434668][T25403] lo speed is unknown, defaulting to 1000 [ 749.704901][T25428] Cannot find del_set index 4 as target [ 750.086275][T25446] No such timeout policy "syz1" [ 750.196744][T25450] netlink: 'syz.4.5232': attribute type 1 has an invalid length. [ 750.207332][T25450] netlink: 96 bytes leftover after parsing attributes in process `syz.4.5232'. [ 750.590344][T25460] mac80211_hwsim hwsim35 syzkaller0: left promiscuous mode [ 750.598542][T25460] mac80211_hwsim hwsim35 syzkaller0: left allmulticast mode [ 750.614640][T25462] openvswitch: netlink: IP tunnel dst address not specified [ 750.623385][T25462] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 750.710810][T25380] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.729605][T25380] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.756947][T25380] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 750.815317][T25471] netlink: 92 bytes leftover after parsing attributes in process `syz.4.5238'. [ 750.861677][T25380] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 750.882595][T25380] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.915599][T25380] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 751.179583][ T34] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.195352][ T34] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 751.216391][ T34] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 751.293786][T25488] netlink: 'syz.1.5240': attribute type 2 has an invalid length. [ 751.329625][ T8458] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.338276][ T8458] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 751.352283][ T8458] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 751.369281][ T8458] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.381209][T25495] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.5247'. [ 751.382049][ T8458] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 751.411053][ T8458] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 751.436107][T25488] þ: entered promiscuous mode [ 751.461165][T25498] netlink: 'syz.4.5248': attribute type 8 has an invalid length. [ 751.487453][ T8458] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.508135][ T8458] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 751.509635][T25498] netlink: 256 bytes leftover after parsing attributes in process `syz.4.5248'. [ 751.542795][ T8458] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 751.562150][T25498] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5248'. [ 751.696740][T25501] netlink: 'syz.4.5248': attribute type 23 has an invalid length. [ 751.979421][T25512] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 752.241743][T25518] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5254'. [ 752.472928][T25528] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5258'. [ 752.482661][T25528] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5258'. [ 752.494255][T25516] bond8: (slave bridge3): Enslaving as an active interface with an up link [ 752.554645][T25516] macvlan4: entered promiscuous mode [ 752.578054][T25516] macvlan4: entered allmulticast mode [ 752.602504][T25516] bond8: (slave macvlan4): Error -98 calling set_mac_address [ 753.394727][T25583] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 753.429543][T25583] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 753.450178][T25583] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 753.463180][T25586] netlink: 'syz.1.5276': attribute type 1 has an invalid length. [ 753.693923][T25576] netlink: 'syz.3.5273': attribute type 21 has an invalid length. [ 753.820157][T25583] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 753.830736][T25583] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 753.842755][T25583] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 753.951687][T25583] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 753.990460][T25583] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 754.026566][T25583] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 754.221881][T25583] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 754.255042][T25583] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 754.269818][T25583] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 754.323344][T25617] __nla_validate_parse: 8 callbacks suppressed [ 754.323366][T25617] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5284'. [ 754.348799][T25617] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5284'. [ 754.359614][T25617] tipc: Invalid UDP bearer configuration [ 754.359670][T25617] tipc: Enabling of bearer rejected, failed to enable media [ 754.481812][T25625] sctp: [Deprecated]: syz.4.5285 (pid 25625) Use of int in max_burst socket option. [ 754.481812][T25625] Use struct sctp_assoc_value instead [ 754.507556][T25623] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5286'. [ 754.509692][ T1180] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 754.530415][ T1180] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 754.549814][T25624] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5287'. [ 754.550790][ T1180] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 754.625486][ T1180] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 754.641519][ T1180] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 754.657678][ T1180] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 754.738886][ T136] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 754.761808][ T136] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 754.771400][ T136] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 754.783741][T25630] netlink: 120 bytes leftover after parsing attributes in process `syz.2.5289'. [ 754.848205][ T136] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 754.878246][ T136] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 754.887552][ T136] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 754.903891][T25634] netlink: 'syz.3.5291': attribute type 3 has an invalid length. [ 754.923868][T25634] netlink: 224 bytes leftover after parsing attributes in process `syz.3.5291'. [ 755.234816][T25650] netlink: 'syz.3.5297': attribute type 2 has an invalid length. [ 755.292602][T25650] : entered promiscuous mode [ 755.336987][T25660] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 755.370746][T25657] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 755.396429][T25657] mac80211_hwsim hwsim35 syzkaller0: entered promiscuous mode [ 755.420260][T25657] mac80211_hwsim hwsim35 syzkaller0: entered allmulticast mode [ 755.458187][T25663] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 756.465421][T25701] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5310'. [ 756.525251][T25700] syzkaller0: entered promiscuous mode [ 756.544686][T25700] syzkaller0: entered allmulticast mode [ 756.623881][T25708] No such timeout policy "syz1" [ 756.690431][T25704] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 756.785768][T25721] netlink: 236 bytes leftover after parsing attributes in process `syz.3.5315'. [ 756.796425][T25721] netlink: 236 bytes leftover after parsing attributes in process `syz.3.5315'. [ 757.075898][T25734] netlink: 136 bytes leftover after parsing attributes in process `syz.0.5318'. [ 757.278812][T25746] syzkaller1: entered promiscuous mode [ 757.284650][T25746] syzkaller1: entered allmulticast mode [ 757.638297][T25754] No such timeout policy "syz1" [ 757.676253][T25755] syzkaller0: entered promiscuous mode [ 757.689241][T25755] syzkaller0: entered allmulticast mode [ 758.012946][T25769] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 758.790991][ T5643] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 759.440081][T25700] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 759.685248][T25796] No such timeout policy "syz1" [ 759.805468][T25803] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 759.849778][T25799] lo speed is unknown, defaulting to 1000 [ 760.272044][T25814] virt_wifi0: left promiscuous mode [ 760.373825][T25814] geneve0: left promiscuous mode [ 760.430695][T25826] __nla_validate_parse: 1 callbacks suppressed [ 760.430718][T25826] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5346'. [ 760.451688][T25814] 8021q: adding VLAN 0 to HW filter on device bond1 [ 760.488220][T25814] bond2: left promiscuous mode [ 760.511716][T25814] bridge1: left promiscuous mode [ 760.536294][T25814] 8021q: adding VLAN 0 to HW filter on device bond3 [ 760.571980][T25814] xfrm1: left promiscuous mode [ 760.616303][T25814] 8021q: adding VLAN 0 to HW filter on device bond4 [ 760.668639][T25814] 8021q: adding VLAN 0 to HW filter on device bond5 [ 760.702996][T25814] 8021q: adding VLAN 0 to HW filter on device bond6 [ 760.719457][T25814] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 760.741164][T25814] mac80211_hwsim hwsim40 syzkaller0: left promiscuous mode [ 760.776247][T25814] 8021q: adding VLAN 0 to HW filter on device bond7 [ 760.787929][T25814] 8021q: adding VLAN 0 to HW filter on device eth0 [ 760.804883][T25814] 8021q: adding VLAN 0 to HW filter on device eth1 [ 760.817600][T25814] 8021q: adding VLAN 0 to HW filter on device eth2 [ 760.831777][T25814] 8021q: adding VLAN 0 to HW filter on device eth3 [ 760.861479][T25839] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5349'. [ 760.954471][T25842] No such timeout policy "syz1" [ 760.996644][ T8458] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 761.783391][T25876] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5360'. [ 761.796377][T25864] xt_hashlimit: size too large, truncated to 1048576 [ 761.803690][T25876] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5360'. [ 761.997171][T25885] No such timeout policy "syz1" [ 762.246737][T25888] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 762.405135][T25888] team0: Mode changed to "loadbalance" [ 762.445903][T25893] bond0: entered promiscuous mode [ 762.467229][T25893] batadv0: entered promiscuous mode [ 762.487280][T25893] debugfs: 'hsr1' already exists in 'hsr' [ 762.503596][T25893] Cannot create hsr debugfs directory [ 762.515332][T25893] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 762.545581][T25893] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 762.597136][T25893] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 762.637729][T25893] bond0: left promiscuous mode [ 762.655123][T25893] batadv0: left promiscuous mode [ 762.821076][T25902] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5367'. [ 762.939455][T25897] lo speed is unknown, defaulting to 1000 [ 762.985849][T25909] netlink: 'syz.0.5369': attribute type 1 has an invalid length. [ 763.270708][T25915] macvlan2: entered promiscuous mode [ 763.280039][T25915] macvlan2: entered allmulticast mode [ 763.289971][T25915] bond8: entered promiscuous mode [ 763.296649][T25915] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 763.317203][T25915] bond8: left promiscuous mode [ 763.380905][T25921] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5373'. [ 763.391886][T25921] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5373'. [ 763.684438][T25928] netlink: 140 bytes leftover after parsing attributes in process `syz.3.5376'. [ 763.735068][T25928] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5376'. [ 764.400947][T25951] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5382'. [ 764.666494][T25961] netlink: 'syz.4.5385': attribute type 1 has an invalid length. [ 764.789439][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 764.943229][T25972] openvswitch: netlink: IP tunnel dst address not specified [ 765.028902][T25976] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 765.515318][T25991] netlink: 'syz.2.5393': attribute type 1 has an invalid length. [ 766.250039][T25997] bond4: (slave geneve4): making interface the new active one [ 766.384954][T26017] No such timeout policy "syz1" [ 766.428748][T25997] bond4: (slave geneve4): Enslaving as an active interface with an up link [ 766.509524][ T136] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 766.542124][ T136] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 766.698888][T26022] vlan4: entered promiscuous mode [ 766.711397][T26022] bond0: entered promiscuous mode [ 766.786080][T26028] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 766.807314][T26028] __nla_validate_parse: 2 callbacks suppressed [ 766.807333][T26028] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5405'. [ 766.838066][T26026] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5404'. [ 766.975973][T26026] vlan4: entered promiscuous mode [ 767.006469][T26026] bridge0: entered promiscuous mode [ 767.012078][T26035] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5407'. [ 767.036740][T26033] tunl0: left allmulticast mode [ 767.146396][T26042] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5408'. [ 767.214975][T26033] bridge0: port 2(bridge_slave_1) entered disabled state [ 767.222801][T26033] bridge0: port 1(bridge_slave_0) entered disabled state [ 767.283938][T26033] : left promiscuous mode [ 767.500115][T26033] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 767.528254][T26033] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 767.791072][T26033] ip6tnl1: left allmulticast mode [ 767.866810][T26033] geneve3: left promiscuous mode [ 767.876757][T26033] geneve3: left allmulticast mode [ 767.892683][T26033] veth3: left allmulticast mode [ 767.903118][T26033] veth5: left allmulticast mode [ 767.914380][T26033] vlan2: left promiscuous mode [ 767.923398][T26033] bond0: left promiscuous mode [ 767.931710][T26033] bond_slave_0: left promiscuous mode [ 767.952236][T26033] bond_slave_1: left promiscuous mode [ 767.997238][T26033] bond3: left promiscuous mode [ 768.011839][T26033] bond3: left allmulticast mode [ 768.018052][T26033] erspan1: left allmulticast mode [ 768.025884][T26033] bond4: left promiscuous mode [ 768.033771][T26033] bond4: left allmulticast mode [ 768.071710][T26033] batadv1: left promiscuous mode [ 768.076854][T26033] batadv1: left allmulticast mode [ 768.097592][T26033] vlan4: left promiscuous mode [ 768.113437][T26033] bridge0: left promiscuous mode [ 768.132555][ T3382] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.149854][ T57] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.165599][T26055] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5412'. [ 768.254073][ T57] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.281240][ T57] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 768.504373][T26064] sch_fq: defrate 4294967293 ignored. [ 768.565712][T25990] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 768.701926][T25990] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 768.907747][ T136] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 768.970639][T26076] vlan4: entered promiscuous mode [ 769.034394][ T1180] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 769.077856][ T57] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 769.145101][ T136] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 769.379464][T26088] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5420'. [ 769.423105][T26088] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5420'. [ 769.734323][T26088] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5420'. [ 769.763087][T26088] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5420'. [ 769.788462][T26099] syzkaller1: tun_chr_ioctl cmd 3224918120 [ 769.871292][T26104] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 769.908808][T26105] syzkaller1: tun_chr_ioctl cmd 2147767521 [ 770.080666][T26088] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5420'. [ 770.863617][T26114] netlink: 'syz.2.5429': attribute type 12 has an invalid length. [ 771.274871][T26123] netlink: 'syz.0.5430': attribute type 1 has an invalid length. [ 771.565209][T26132] netlink: 'syz.1.5432': attribute type 4 has an invalid length. [ 772.149303][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 772.305671][T26144] __nla_validate_parse: 3 callbacks suppressed [ 772.305726][T26144] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5437'. [ 772.369590][T26147] netlink: 'syz.0.5437': attribute type 7 has an invalid length. [ 772.400840][T26147] netlink: 'syz.0.5437': attribute type 3 has an invalid length. [ 772.435890][T26147] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5437'. [ 772.473214][T26146] : (slave vlan3): Opening slave failed [ 772.901406][T26161] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 773.001940][T26168] siw: device registration error -23 [ 773.012779][T26168] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5444'. [ 773.026056][T26154] netlink: 164 bytes leftover after parsing attributes in process `syz.3.5439'. [ 773.048738][T26170] netlink: 'syz.1.5443': attribute type 1 has an invalid length. [ 773.059403][T26154] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5439'. [ 773.114229][T26164] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.181516][T26164] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 773.263896][T26164] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 773.284438][T26174] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5447'. [ 773.344214][T26177] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5447'. [ 773.484395][T26164] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.498494][T26164] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 773.510356][T26164] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 773.686135][T26164] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 773.723135][T26164] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 773.782062][T26164] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 773.813399][T26191] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5450'. [ 773.984549][T26164] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.032687][T26201] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5451'. [ 774.034081][T26164] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 774.107958][T26164] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 774.337405][T26206] netlink: 'syz.2.5453': attribute type 21 has an invalid length. [ 774.367583][T26206] netlink: 128 bytes leftover after parsing attributes in process `syz.2.5453'. [ 774.378816][ T8458] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.389036][ T8458] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 774.419396][ T8458] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 774.497385][T26206] netlink: 'syz.2.5453': attribute type 5 has an invalid length. [ 774.548145][T26206] netlink: 'syz.2.5453': attribute type 6 has an invalid length. [ 774.570791][ T8458] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.611263][ T8458] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 774.649238][ T8458] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 774.741714][ T57] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 774.754398][ T57] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 774.779426][ T57] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 774.915634][T26216] lo speed is unknown, defaulting to 1000 [ 774.988403][T26164] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.010385][T26164] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 775.029492][T26164] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 775.249761][T26224] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 775.417029][T26164] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.442286][T26164] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 775.465002][T26164] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 775.674158][T26164] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.706265][T26164] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 775.728725][T26164] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 777.909366][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 778.325231][T26314] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 778.365183][T26314] __nla_validate_parse: 4 callbacks suppressed [ 778.365236][T26314] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5489'. [ 778.429466][T26316] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5488'. [ 778.657403][T26323] : (slave vlan3): Opening slave failed [ 778.778629][T26331] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5496'. [ 779.152200][T26343] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5500'. [ 780.058213][T26360] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5504'. [ 781.473956][ T34] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 781.513186][ T34] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 781.550792][ T34] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 781.579849][ T34] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 781.614086][ T34] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 781.660099][ T34] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 781.700798][ T34] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 781.709050][T26368] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 781.739529][ T34] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 781.773614][ T34] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 781.844156][ T34] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 781.857636][ T34] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 781.867965][ T34] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 781.902069][T26370] syzkaller0: entered promiscuous mode [ 781.916221][T26370] syzkaller0: entered allmulticast mode [ 781.958825][T26367] tipc: Enabling of bearer rejected, failed to enable media [ 782.119847][T26370] netlink: 'syz.3.5507': attribute type 1 has an invalid length. [ 782.357888][T26397] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5511'. [ 782.497348][T26395] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5511'. [ 782.943894][T26410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5515'. [ 782.995433][T26410] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5515'. [ 783.016104][T26410] netlink: 'syz.0.5515': attribute type 6 has an invalid length. [ 783.026920][T26403] lo speed is unknown, defaulting to 1000 [ 783.315907][T26416] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5517'. [ 784.298660][T26448] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5525'. [ 784.625992][T26455] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5527'. [ 784.911649][T26462] bridge_slave_0: left allmulticast mode [ 784.954845][T26462] bridge_slave_0: left promiscuous mode [ 785.000280][T26462] bridge0: port 1(bridge_slave_0) entered disabled state [ 785.073935][T26462] bridge_slave_1: left allmulticast mode [ 785.124184][T26462] bridge_slave_1: left promiscuous mode [ 785.162296][T26462] bridge0: port 2(bridge_slave_1) entered disabled state [ 785.218399][T26462] bond0: (slave bond_slave_0): Releasing backup interface [ 785.248538][T26462] bond0: (slave bond_slave_1): Releasing backup interface [ 785.275391][T26462] team0: Port device team_slave_0 removed [ 785.300875][T26462] team0: Port device 76žÿ removed [ 785.311012][T26462] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 785.327522][T26462] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 785.346336][T26462] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 785.602273][T26490] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5536'. [ 785.632782][T26491] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5537'. [ 785.655070][T26493] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5536'. [ 785.680449][T26493] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5536'. [ 785.877039][T26493] veth11: entered allmulticast mode [ 785.916370][T26493] bond10: (slave veth11): Enslaving as an active interface with an up link [ 785.956871][T26498] bond10 (unregistering): (slave veth11): Releasing backup interface [ 786.011483][T26498] bond10 (unregistering): Released all slaves [ 786.244121][T26512] nbd3: detected capacity change from 0 to 63 [ 786.382628][T26513] nbd4: detected capacity change from 0 to 63 [ 786.409542][ T4952] block nbd4: Send control failed (result -32) [ 786.416644][T18481] block nbd4: Receive control failed (result -104) [ 786.420895][ T5643] block nbd3: Receive control failed (result -32) [ 786.433108][ T4952] block nbd4: Request send failed, requeueing [ 786.444732][ T4952] block nbd4: Dead connection, failed to find a fallback [ 786.459536][ T4952] block nbd4: shutting down sockets [ 786.465533][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 786.476736][ T4952] Buffer I/O error on dev nbd4, logical block 0, async page read [ 786.487874][ T4952] Buffer I/O error on dev nbd4, logical block 1, async page read [ 786.495742][ T4952] Buffer I/O error on dev nbd4, logical block 2, async page read [ 786.503794][ T4952] Buffer I/O error on dev nbd4, logical block 3, async page read [ 786.518025][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 786.528553][ T4952] Buffer I/O error on dev nbd4, logical block 0, async page read [ 786.536942][ T4952] Buffer I/O error on dev nbd4, logical block 1, async page read [ 786.545972][ T4952] Buffer I/O error on dev nbd4, logical block 2, async page read [ 786.554316][ T4952] Buffer I/O error on dev nbd4, logical block 3, async page read [ 786.568903][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 786.579768][ T4952] Buffer I/O error on dev nbd4, logical block 0, async page read [ 786.587534][ T4952] Buffer I/O error on dev nbd4, logical block 1, async page read [ 786.595685][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 786.605549][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 786.615372][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 786.625145][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 786.634936][ T4952] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 786.644705][ T4952] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 786.654848][ T4952] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 786.671718][T24122] ldm_validate_partition_table(): Disk read failed. [ 786.699296][T24122] Dev nbd4: unable to read RDB block 0 [ 786.717469][T24122] nbd4: unable to read partition table [ 786.752021][T24122] ldm_validate_partition_table(): Disk read failed. [ 786.763082][T24122] Dev nbd4: unable to read RDB block 0 [ 786.770452][T24122] nbd4: unable to read partition table [ 786.958191][T26533] IPVS: set_ctl: invalid protocol: 54 172.20.20.187:20002 [ 787.223727][T26544] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 787.268865][T26544] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 788.488201][T26578] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5559'. [ 788.530089][T26578] netlink: 'syz.3.5559': attribute type 5 has an invalid length. [ 788.552819][T26578] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5559'. [ 788.599854][T26581] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5559'. [ 788.655692][T26585] netlink: 'syz.3.5559': attribute type 6 has an invalid length. [ 788.678725][T26581] netlink: 'syz.3.5559': attribute type 5 has an invalid length. [ 788.746492][T26585] IPv6: NLM_F_CREATE should be specified when creating new route [ 788.792175][T26581] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5559'. [ 788.834152][T26583] bond0: (slave bond_slave_1): Error -28 calling ndo_bpf [ 788.868254][ T34] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.903539][ T34] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.949669][ T34] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.995409][ T34] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 789.463832][T26612] netlink: 'syz.4.5566': attribute type 1 has an invalid length. [ 789.828006][T26613] bond10: (slave geneve3): making interface the new active one [ 789.860762][T26613] bond10: (slave geneve3): Enslaving as an active interface with an up link [ 789.906804][T26606] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 789.966050][ T34] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 790.011177][ T136] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 790.047823][ T136] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 790.200302][T26632] __nla_validate_parse: 5 callbacks suppressed [ 790.200324][T26632] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5573'. [ 790.283863][T26630] lo speed is unknown, defaulting to 1000 [ 790.379886][T26638] netlink: 'syz.2.5575': attribute type 1 has an invalid length. [ 790.462684][T26638] 8021q: adding VLAN 0 to HW filter on device bond6 [ 790.465320][T26641] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5575'. [ 790.543241][T26641] veth13: entered allmulticast mode [ 790.562485][T26641] bond6: (slave veth13): Enslaving as an active interface with a down link [ 790.610516][T26638] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 790.655477][T26638] macvlan0: entered promiscuous mode [ 790.673171][T26638] macvlan0: entered allmulticast mode [ 790.692552][T26638] bond6: entered promiscuous mode [ 790.712997][T26638] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 790.721303][T26638] bond6: (slave macvlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 790.744536][T26638] bond6: left promiscuous mode [ 790.864144][T26648] netlink: 'syz.1.5577': attribute type 1 has an invalid length. [ 791.065578][T26630] netlink: 'syz.3.5572': attribute type 2 has an invalid length. [ 791.073587][T26630] netlink: 'syz.3.5572': attribute type 8 has an invalid length. [ 791.082034][T26630] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5572'. [ 791.097659][T26655] vlan4: entered promiscuous mode [ 791.123618][T26633] sit0: entered promiscuous mode [ 791.128843][T26633] netlink: 'syz.3.5572': attribute type 1 has an invalid length. [ 791.137328][T26633] netlink: 1 bytes leftover after parsing attributes in process `syz.3.5572'. [ 791.148585][ T148] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.175521][ T148] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 791.201573][ T148] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 791.268459][ T136] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.311712][ T136] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 791.352938][ T136] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 791.418377][ T136] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.440599][ T136] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 791.469488][ T136] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 791.682192][ T57] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 791.737445][ T57] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 791.761825][ T57] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 791.879856][T26669] netlink: 332 bytes leftover after parsing attributes in process `syz.1.5584'. [ 791.890598][T26669] netlink: 'syz.1.5584': attribute type 9 has an invalid length. [ 791.899817][T26669] netlink: 108 bytes leftover after parsing attributes in process `syz.1.5584'. [ 791.927326][T26672] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5583'. [ 791.972205][T26606] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.012313][T26606] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 792.063227][T26662] lo speed is unknown, defaulting to 1000 [ 792.080297][T26674] batadv1: entered promiscuous mode [ 792.115320][T26674] batadv1: entered allmulticast mode [ 792.140574][T26674] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 792.199202][T26606] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.232559][T26606] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 792.419554][T26606] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.454993][T26606] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 792.975207][ T34] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 792.996127][ T34] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 793.156999][ T34] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 793.208832][ T34] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 793.386831][ T57] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 793.434793][ T57] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 793.503878][T26703] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.528056][T26703] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 793.558829][T26703] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 793.570359][ T57] tipc: Subscription rejected, illegal request [ 793.615978][T26701] lo speed is unknown, defaulting to 1000 [ 793.698479][T26722] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5598'. [ 793.711826][T26722] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5598'. [ 793.751061][ T148] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 793.766229][ T148] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 793.791736][T26722] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5598'. [ 793.856902][T26703] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 793.905248][T26703] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 793.948305][T26703] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 794.012788][T26728] validate_nla: 1 callbacks suppressed [ 794.012880][T26728] netlink: 'syz.0.5600': attribute type 1 has an invalid length. [ 794.314320][T26737] FAULT_INJECTION: forcing a failure. [ 794.314320][T26737] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 794.329564][T26737] CPU: 1 UID: 0 PID: 26737 Comm: syz.2.5603 Not tainted syzkaller #0 PREEMPT(full) [ 794.329595][T26737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 794.329610][T26737] Call Trace: [ 794.329619][T26737] [ 794.329630][T26737] dump_stack_lvl+0xe8/0x150 [ 794.329696][T26737] should_fail_ex+0x40c/0x560 [ 794.329733][T26737] _copy_from_iter+0x1d3/0x1660 [ 794.329764][T26737] ? kmem_cache_alloc_node_noprof+0x111/0x610 [ 794.329797][T26737] ? rcu_is_watching+0x15/0xb0 [ 794.329859][T26737] ? trace_kmem_cache_alloc+0x29/0xe0 [ 794.329891][T26737] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 794.329920][T26737] ? __pfx__copy_from_iter+0x10/0x10 [ 794.329951][T26737] ? __alloc_skb+0x276/0x7a0 [ 794.329974][T26737] ? __alloc_skb+0x276/0x7a0 [ 794.330004][T26737] ? netlink_sendmsg+0x650/0xb40 [ 794.330033][T26737] ? skb_put+0x112/0x210 [ 794.330061][T26737] netlink_sendmsg+0x6c0/0xb40 [ 794.330100][T26737] ? __pfx_netlink_sendmsg+0x10/0x10 [ 794.330133][T26737] ? aa_sock_msg_perm+0xf1/0x1b0 [ 794.330167][T26737] ? __pfx_netlink_sendmsg+0x10/0x10 [ 794.330194][T26737] sock_sendmsg_nosec+0x13a/0x180 [ 794.330230][T26737] ____sys_sendmsg+0x54e/0x850 [ 794.330263][T26737] ? __pfx_____sys_sendmsg+0x10/0x10 [ 794.330301][T26737] ? import_iovec+0x73/0xa0 [ 794.330339][T26737] ___sys_sendmsg+0x2a5/0x360 [ 794.330364][T26737] ? __lock_acquire+0x683/0x2cf0 [ 794.330401][T26737] ? __pfx____sys_sendmsg+0x10/0x10 [ 794.330467][T26737] ? __fget_files+0x2a/0x420 [ 794.330511][T26737] ? __fget_files+0x3a2/0x420 [ 794.330551][T26737] __x64_sys_sendmsg+0x1b1/0x290 [ 794.330580][T26737] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 794.330624][T26737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 794.330650][T26737] do_syscall_64+0x174/0x580 [ 794.330698][T26737] ? trace_irq_disable+0x3b/0x140 [ 794.330726][T26737] ? clear_bhb_loop+0x40/0x90 [ 794.330753][T26737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 794.330792][T26737] RIP: 0033:0x7ff07819e019 [ 794.330815][T26737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 794.330835][T26737] RSP: 002b:00007ff0763f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 794.330860][T26737] RAX: ffffffffffffffda RBX: 00007ff078426090 RCX: 00007ff07819e019 [ 794.330877][T26737] RDX: 0000000004041080 RSI: 0000200000006040 RDI: 0000000000000004 [ 794.330893][T26737] RBP: 00007ff0763f6090 R08: 0000000000000000 R09: 0000000000000000 [ 794.330908][T26737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 794.330922][T26737] R13: 00007ff078426128 R14: 00007ff078426090 R15: 00007ffcc146f5c8 [ 794.330958][T26737] [ 794.643271][T26731] bond9: (slave bridge3): Enslaving as a backup interface with an up link [ 794.667444][T26728] macvlan2: entered promiscuous mode [ 794.674096][T26728] macvlan2: entered allmulticast mode [ 794.682096][T26728] bond9: entered promiscuous mode [ 794.687842][T26728] bridge3: entered promiscuous mode [ 794.696576][T26728] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 794.713653][T26728] bond9: left promiscuous mode [ 794.729249][T26728] bridge3: left promiscuous mode [ 794.783591][T26703] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 794.795225][T26703] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 794.809403][T26703] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 795.008711][T26703] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 795.061763][T26703] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 795.092082][T26703] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 795.176616][T26747] lo speed is unknown, defaulting to 1000 [ 795.494208][ T136] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.516743][ T136] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 795.550467][ T136] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 795.707730][ T136] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.716236][ T136] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 795.724831][ T136] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 795.744885][ T136] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.754505][ T136] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 795.765147][ T136] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 795.775306][ T136] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 795.785077][ T136] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 795.797462][ T136] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 796.222966][T26793] FAULT_INJECTION: forcing a failure. [ 796.222966][T26793] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 796.243006][T26790] netlink: 'syz.3.5616': attribute type 1 has an invalid length. [ 796.275004][T26793] CPU: 0 UID: 0 PID: 26793 Comm: syz.4.5617 Not tainted syzkaller #0 PREEMPT(full) [ 796.275039][T26793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 796.275054][T26793] Call Trace: [ 796.275064][T26793] [ 796.275074][T26793] dump_stack_lvl+0xe8/0x150 [ 796.275114][T26793] should_fail_ex+0x40c/0x560 [ 796.275149][T26793] _copy_from_iter+0x1d3/0x1660 [ 796.275182][T26793] ? kmem_cache_alloc_node_noprof+0x111/0x610 [ 796.275213][T26793] ? rcu_is_watching+0x15/0xb0 [ 796.275238][T26793] ? trace_kmem_cache_alloc+0x29/0xe0 [ 796.275270][T26793] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 796.275299][T26793] ? __pfx__copy_from_iter+0x10/0x10 [ 796.275332][T26793] ? __alloc_skb+0x276/0x7a0 [ 796.275354][T26793] ? __alloc_skb+0x276/0x7a0 [ 796.275384][T26793] ? netlink_sendmsg+0x650/0xb40 [ 796.275413][T26793] ? skb_put+0x112/0x210 [ 796.275441][T26793] netlink_sendmsg+0x6c0/0xb40 [ 796.275481][T26793] ? __pfx_netlink_sendmsg+0x10/0x10 [ 796.275515][T26793] ? aa_sock_msg_perm+0xf1/0x1b0 [ 796.275557][T26793] ? __pfx_netlink_sendmsg+0x10/0x10 [ 796.275584][T26793] sock_sendmsg_nosec+0x13a/0x180 [ 796.275621][T26793] ____sys_sendmsg+0x54e/0x850 [ 796.275656][T26793] ? __pfx_____sys_sendmsg+0x10/0x10 [ 796.275695][T26793] ? import_iovec+0x73/0xa0 [ 796.275734][T26793] ___sys_sendmsg+0x2a5/0x360 [ 796.275760][T26793] ? __lock_acquire+0x683/0x2cf0 [ 796.275799][T26793] ? __pfx____sys_sendmsg+0x10/0x10 [ 796.275867][T26793] ? __fget_files+0x2a/0x420 [ 796.275911][T26793] ? __fget_files+0x3a2/0x420 [ 796.275952][T26793] __x64_sys_sendmsg+0x1b1/0x290 [ 796.275982][T26793] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 796.276030][T26793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 796.276055][T26793] do_syscall_64+0x174/0x580 [ 796.276082][T26793] ? trace_irq_disable+0x3b/0x140 [ 796.276111][T26793] ? clear_bhb_loop+0x40/0x90 [ 796.276139][T26793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 796.276162][T26793] RIP: 0033:0x7f832879e019 [ 796.276182][T26793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 796.276202][T26793] RSP: 002b:00007f8329681028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 796.276226][T26793] RAX: ffffffffffffffda RBX: 00007f8328a26180 RCX: 00007f832879e019 [ 796.276242][T26793] RDX: 0000000004041080 RSI: 0000200000006040 RDI: 0000000000000004 [ 796.276256][T26793] RBP: 00007f8329681090 R08: 0000000000000000 R09: 0000000000000000 [ 796.276270][T26793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 796.276283][T26793] R13: 00007f8328a26218 R14: 00007f8328a26180 R15: 00007ffc19f74078 [ 796.276318][T26793] [ 796.277337][T26790] netlink: 'syz.3.5616': attribute type 2 has an invalid length. [ 796.704786][T26800] __nla_validate_parse: 3 callbacks suppressed [ 796.704809][T26800] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5618'. [ 797.019778][T26805] syzkaller1: tun_chr_ioctl cmd 1074025681 [ 797.033008][T26811] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5621'. [ 797.070800][T26806] syzkaller1: tun_chr_ioctl cmd 1074025681 [ 797.410345][T26819] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5623'. [ 797.656716][T26827] tipc: New replicast peer: 255.255.255.255 [ 797.721077][T26827] tipc: Enabled bearer , priority 10 [ 797.792435][T26836] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5627'. [ 797.847721][T26836] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5627'. [ 797.858370][T26834] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5628'. [ 797.909743][ T30] audit: type=1800 audit(1785458434.603:15): pid=26801 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.5618" name="memory.events" dev="tmpfs" ino=2711 res=0 errno=0 [ 797.945142][T26840] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5629'. [ 797.978328][T26840] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5629'. [ 798.053599][T26840] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5629'. [ 798.065859][T26840] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5629'. [ 798.505388][T26853] lo speed is unknown, defaulting to 1000 [ 798.711832][T10249] tipc: Node number set to 2044087359 [ 798.973374][T26873] syzkaller0: entered promiscuous mode [ 798.979450][T26873] syzkaller0: entered allmulticast mode [ 799.652350][ T34] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.681184][ T34] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.709183][ T34] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 799.783615][ T34] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 800.527327][T26921] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 800.933391][T26934] can: request_module (can-proto-0) failed. [ 800.987379][T26930] lo speed is unknown, defaulting to 1000 [ 801.460313][T26951] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 801.803964][ T30] audit: type=1804 audit(1785458438.493:16): pid=26958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.5660" name="/newroot/509/cgroup.controllers" dev="tmpfs" ino=2615 res=1 errno=0 [ 801.894204][ T30] audit: type=1800 audit(1785458438.503:17): pid=26958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5660" name="cgroup.controllers" dev="tmpfs" ino=2615 res=0 errno=0 [ 801.971336][T26954] lo speed is unknown, defaulting to 1000 [ 802.078001][T26960] netlink: 'syz.1.5661': attribute type 2 has an invalid length. [ 802.153091][T26963] __nla_validate_parse: 19 callbacks suppressed [ 802.153113][T26963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5662'. [ 802.212281][T26960] netlink: 144 bytes leftover after parsing attributes in process `syz.1.5661'. [ 802.225500][T26963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5662'. [ 802.521588][T26963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5662'. [ 802.531739][T26963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5662'. [ 802.559855][T26970] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5664'. [ 802.656084][T26963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5662'. [ 802.667897][T26963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5662'. [ 802.836496][T26977] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5665'. [ 802.875819][T26977] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5665'. [ 804.741089][T27046] netlink: 'syz.0.5680': attribute type 1 has an invalid length. [ 804.756799][T27035] bridge0: port 3(vlan5) entered blocking state [ 804.789397][T27035] bridge0: port 3(vlan5) entered disabled state [ 804.815807][T27035] vlan5: entered allmulticast mode [ 804.839203][T27035] geneve0: entered allmulticast mode [ 804.875773][T27035] vlan5: entered promiscuous mode [ 805.725259][T27084] lo speed is unknown, defaulting to 1000 [ 806.062673][T27089] lo speed is unknown, defaulting to 1000 [ 806.934526][T27084] dvmrp0: entered allmulticast mode [ 806.987408][T27086] netlink: 'syz.4.5689': attribute type 1 has an invalid length. [ 807.316960][T27115] __nla_validate_parse: 9 callbacks suppressed [ 807.316982][T27115] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5699'. [ 807.347186][T27113] [ 807.349567][T27113] ====================================================== [ 807.356713][T27113] WARNING: possible circular locking dependency detected [ 807.363877][T27113] syzkaller #0 Not tainted [ 807.368319][T27113] ------------------------------------------------------ [ 807.375403][T27113] syz.1.5698/27113 is trying to acquire lock: [ 807.381526][T27113] ffff888089e7f370 (&vma_lock->rw_sema){++++}-{4:4}, at: hugetlb_vma_lock_free+0xb7/0x1a0 [ 807.391608][T27113] [ 807.391608][T27113] but task is already holding lock: [ 807.399008][T27113] ffff888057ffcfb0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: hugetlbfs_file_mmap+0x2de/0x630 [ 807.409821][T27113] [ 807.409821][T27113] which lock already depends on the new lock. [ 807.409821][T27113] [ 807.420262][T27113] [ 807.420262][T27113] the existing dependency chain (in reverse order) is: [ 807.429306][T27113] [ 807.429306][T27113] -> #9 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}: [ 807.438149][T27113] down_write+0x96/0x200 [ 807.442959][T27113] hugetlbfs_file_mmap+0x2de/0x630 [ 807.448637][T27113] mmap_region+0x19e6/0x2310 [ 807.453783][T27113] do_mmap+0xc3b/0x10c0 [ 807.458496][T27113] vm_mmap_pgoff+0x272/0x4e0 [ 807.463714][T27113] ksys_mmap_pgoff+0x57d/0x760 [ 807.469039][T27113] do_syscall_64+0x174/0x580 [ 807.474207][T27113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.480658][T27113] [ 807.480658][T27113] -> #8 (&mm->mmap_lock){++++}-{4:4}: [ 807.488432][T27113] __might_fault+0xcb/0x130 [ 807.493527][T27113] _copy_from_user+0x28/0xb0 [ 807.498675][T27113] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 807.505219][T27113] ip_generic_getfrag+0x149/0x2d0 [ 807.510888][T27113] __ip6_append_data+0x3b26/0x40c0 [ 807.516644][T27113] ip6_append_data+0x108/0x270 [ 807.521985][T27113] rawv6_sendmsg+0x1298/0x18c0 [ 807.527348][T27113] sock_sendmsg_nosec+0x10e/0x180 [ 807.532950][T27113] ____sys_sendmsg+0x54e/0x850 [ 807.538273][T27113] ___sys_sendmsg+0x2a5/0x360 [ 807.543508][T27113] __x64_sys_sendmsg+0x1b1/0x290 [ 807.549007][T27113] do_syscall_64+0x174/0x580 [ 807.554173][T27113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.560655][T27113] [ 807.560655][T27113] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 807.568450][T27113] lock_sock_nested+0x41/0x100 [ 807.573874][T27113] inet_shutdown+0x6a/0x390 [ 807.579031][T27113] nbd_mark_nsock_dead+0x2cb/0x550 [ 807.584771][T27113] recv_work+0x1cee/0x1e10 [ 807.589747][T27113] process_scheduled_works+0xa8e/0x14e0 [ 807.595876][T27113] worker_thread+0xa47/0xfb0 [ 807.601055][T27113] kthread+0x388/0x470 [ 807.605692][T27113] ret_from_fork+0x514/0xb70 [ 807.610997][T27113] ret_from_fork_asm+0x1a/0x30 [ 807.616318][T27113] [ 807.616318][T27113] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 807.624018][T27113] __mutex_lock+0x19d/0x1550 [ 807.629205][T27113] nbd_queue_rq+0x373/0x1150 [ 807.634376][T27113] blk_mq_dispatch_rq_list+0x499/0x1990 [ 807.640601][T27113] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 807.647554][T27113] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 807.654099][T27113] blk_mq_run_work_fn+0x16c/0x300 [ 807.659687][T27113] process_scheduled_works+0xa8e/0x14e0 [ 807.665792][T27113] worker_thread+0xa47/0xfb0 [ 807.670956][T27113] kthread+0x388/0x470 [ 807.675594][T27113] ret_from_fork+0x514/0xb70 [ 807.680751][T27113] ret_from_fork_asm+0x1a/0x30 [ 807.686071][T27113] [ 807.686071][T27113] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 807.693328][T27113] __mutex_lock+0x19d/0x1550 [ 807.698493][T27113] nbd_queue_rq+0xc1/0x1150 [ 807.703555][T27113] blk_mq_dispatch_rq_list+0x499/0x1990 [ 807.709666][T27113] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 807.716564][T27113] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 807.723134][T27113] blk_mq_run_work_fn+0x16c/0x300 [ 807.728717][T27113] process_scheduled_works+0xa8e/0x14e0 [ 807.734922][T27113] worker_thread+0xa47/0xfb0 [ 807.740073][T27113] kthread+0x388/0x470 [ 807.744701][T27113] ret_from_fork+0x514/0xb70 [ 807.749851][T27113] ret_from_fork_asm+0x1a/0x30 [ 807.755194][T27113] [ 807.755194][T27113] -> #4 (set->srcu){.+.+}-{0:0}: [ 807.762364][T27113] __synchronize_srcu+0xc9/0x2f0 [ 807.767873][T27113] elevator_switch+0x1e8/0x7b0 [ 807.773248][T27113] elevator_change+0x2fa/0x480 [ 807.778579][T27113] elevator_set_default+0x375/0x440 [ 807.784340][T27113] blk_register_queue+0x3f3/0x4e0 [ 807.789985][T27113] __add_disk+0x6cb/0xe30 [ 807.794910][T27113] add_disk_fwnode+0x100/0x3a0 [ 807.800238][T27113] nbd_dev_add+0x733/0xb60 [ 807.805198][T27113] nbd_init+0x15f/0x1e0 [ 807.810020][T27113] do_one_initcall+0x250/0x870 [ 807.815351][T27113] do_initcall_level+0x10a/0x1a0 [ 807.820930][T27113] do_initcalls+0x59/0xa0 [ 807.825871][T27113] kernel_init_freeable+0x29d/0x3e0 [ 807.831634][T27113] kernel_init+0x1d/0x1d0 [ 807.836571][T27113] ret_from_fork+0x514/0xb70 [ 807.841752][T27113] ret_from_fork_asm+0x1a/0x30 [ 807.847074][T27113] [ 807.847074][T27113] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 807.854935][T27113] __mutex_lock+0x19d/0x1550 [ 807.860090][T27113] elevator_change+0x1af/0x480 [ 807.865411][T27113] elevator_set_none+0xb5/0x140 [ 807.870828][T27113] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 807.877188][T27113] nbd_start_device+0x189/0xb30 [ 807.882607][T27113] nbd_genl_connect+0x1597/0x1c10 [ 807.888367][T27113] genl_family_rcv_msg_doit+0x233/0x340 [ 807.894500][T27113] genl_rcv_msg+0x614/0x7a0 [ 807.899575][T27113] netlink_rcv_skb+0x226/0x4a0 [ 807.904898][T27113] genl_rcv+0x28/0x40 [ 807.909450][T27113] netlink_unicast+0x7bb/0x940 [ 807.914766][T27113] netlink_sendmsg+0x813/0xb40 [ 807.920087][T27113] sock_sendmsg_nosec+0x13a/0x180 [ 807.925676][T27113] ____sys_sendmsg+0x54e/0x850 [ 807.930996][T27113] ___sys_sendmsg+0x2a5/0x360 [ 807.936227][T27113] __x64_sys_sendmsg+0x1b1/0x290 [ 807.941728][T27113] do_syscall_64+0x174/0x580 [ 807.946882][T27113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 807.953334][T27113] [ 807.953334][T27113] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 807.961995][T27113] blk_alloc_queue+0x544/0x690 [ 807.967326][T27113] __blk_mq_alloc_disk+0x194/0x390 [ 807.972995][T27113] nbd_dev_add+0x494/0xb60 [ 807.977969][T27113] nbd_init+0x15f/0x1e0 [ 807.982728][T27113] do_one_initcall+0x250/0x870 [ 807.988059][T27113] do_initcall_level+0x10a/0x1a0 [ 807.993636][T27113] do_initcalls+0x59/0xa0 [ 807.998532][T27113] kernel_init_freeable+0x29d/0x3e0 [ 808.004301][T27113] kernel_init+0x1d/0x1d0 [ 808.009202][T27113] ret_from_fork+0x514/0xb70 [ 808.014380][T27113] ret_from_fork_asm+0x1a/0x30 [ 808.019697][T27113] [ 808.019697][T27113] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 808.026952][T27113] fs_reclaim_acquire+0x71/0x100 [ 808.032460][T27113] __kmalloc_cache_noprof+0x61/0x660 [ 808.038336][T27113] allocate_file_region_entries+0x1ef/0x5a0 [ 808.044787][T27113] __vma_reservation_common+0x7c2/0x9c0 [ 808.050885][T27113] alloc_hugetlb_folio+0x2de/0x1630 [ 808.056647][T27113] hugetlb_no_page+0xfdd/0x1fc0 [ 808.062055][T27113] hugetlb_fault+0x570/0x12c0 [ 808.067298][T27113] handle_mm_fault+0x1f42/0x3080 [ 808.072795][T27113] __get_user_pages+0x1678/0x2720 [ 808.078374][T27113] populate_vma_page_range+0x2be/0x3c0 [ 808.084387][T27113] __mm_populate+0x25f/0x390 [ 808.089539][T27113] vm_mmap_pgoff+0x353/0x4e0 [ 808.094713][T27113] ksys_mmap_pgoff+0x57d/0x760 [ 808.100033][T27113] do_syscall_64+0x174/0x580 [ 808.105188][T27113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.111640][T27113] [ 808.111640][T27113] -> #0 (&vma_lock->rw_sema){++++}-{4:4}: [ 808.119608][T27113] __lock_acquire+0x1520/0x2cf0 [ 808.125023][T27113] lock_acquire+0x106/0x350 [ 808.130095][T27113] down_write+0x96/0x200 [ 808.134903][T27113] hugetlb_vma_lock_free+0xb7/0x1a0 [ 808.140659][T27113] hugetlb_reserve_pages+0xce6/0x1140 [ 808.146593][T27113] hugetlbfs_file_mmap+0x475/0x630 [ 808.152269][T27113] mmap_region+0x19e6/0x2310 [ 808.157422][T27113] do_mmap+0xc3b/0x10c0 [ 808.162139][T27113] vm_mmap_pgoff+0x272/0x4e0 [ 808.167295][T27113] ksys_mmap_pgoff+0x57d/0x760 [ 808.172633][T27113] do_syscall_64+0x174/0x580 [ 808.177782][T27113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.184246][T27113] [ 808.184246][T27113] other info that might help us debug this: [ 808.184246][T27113] [ 808.194497][T27113] Chain exists of: [ 808.194497][T27113] &vma_lock->rw_sema --> &mm->mmap_lock --> &sb->s_type->i_mutex_key#24 [ 808.194497][T27113] [ 808.208815][T27113] Possible unsafe locking scenario: [ 808.208815][T27113] [ 808.216372][T27113] CPU0 CPU1 [ 808.221849][T27113] ---- ---- [ 808.227258][T27113] lock(&sb->s_type->i_mutex_key#24); [ 808.232794][T27113] lock(&mm->mmap_lock); [ 808.239682][T27113] lock(&sb->s_type->i_mutex_key#24); [ 808.247705][T27113] lock(&vma_lock->rw_sema); [ 808.252422][T27113] [ 808.252422][T27113] *** DEADLOCK *** [ 808.252422][T27113] [ 808.260589][T27113] 2 locks held by syz.1.5698/27113: [ 808.265826][T27113] #0: ffff8880369a69b8 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 [ 808.275480][T27113] #1: ffff888057ffcfb0 (&sb->s_type->i_mutex_key#24){+.+.}-{4:4}, at: hugetlbfs_file_mmap+0x2de/0x630 [ 808.286624][T27113] [ 808.286624][T27113] stack backtrace: [ 808.292557][T27113] CPU: 1 UID: 0 PID: 27113 Comm: syz.1.5698 Not tainted syzkaller #0 PREEMPT(full) [ 808.292605][T27113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 808.292631][T27113] Call Trace: [ 808.292649][T27113] [ 808.292665][T27113] dump_stack_lvl+0xe8/0x150 [ 808.292726][T27113] print_circular_bug+0x2e1/0x300 [ 808.292755][T27113] check_noncircular+0x12e/0x150 [ 808.292784][T27113] __lock_acquire+0x1520/0x2cf0 [ 808.292826][T27113] ? __lock_acquire+0x683/0x2cf0 [ 808.292862][T27113] ? hugetlb_vma_lock_free+0xb7/0x1a0 [ 808.292887][T27113] lock_acquire+0x106/0x350 [ 808.292919][T27113] ? hugetlb_vma_lock_free+0xb7/0x1a0 [ 808.292951][T27113] down_write+0x96/0x200 [ 808.292983][T27113] ? hugetlb_vma_lock_free+0xb7/0x1a0 [ 808.293006][T27113] ? __pfx_down_write+0x10/0x10 [ 808.293042][T27113] ? css_put+0x57/0x290 [ 808.293071][T27113] ? css_put+0x57/0x290 [ 808.293101][T27113] hugetlb_vma_lock_free+0xb7/0x1a0 [ 808.293129][T27113] hugetlb_reserve_pages+0xce6/0x1140 [ 808.293160][T27113] ? __pfx_hugetlb_reserve_pages+0x10/0x10 [ 808.293184][T27113] ? down_write+0x16d/0x200 [ 808.293217][T27113] ? touch_atime+0xf1/0x670 [ 808.293246][T27113] ? mas_preallocate+0x3ea/0x630 [ 808.293373][T27113] hugetlbfs_file_mmap+0x475/0x630 [ 808.293409][T27113] ? __pfx_hugetlbfs_file_mmap+0x10/0x10 [ 808.293441][T27113] ? __mas_set_range+0x11a/0x3a0 [ 808.293468][T27113] mmap_region+0x19e6/0x2310 [ 808.293504][T27113] ? __pfx_mmap_region+0x10/0x10 [ 808.293529][T27113] ? unwind_next_frame+0x8f/0x2550 [ 808.293622][T27113] ? apparmor_capable+0x126/0x170 [ 808.293687][T27113] ? bpf_lsm_capable+0x9/0x20 [ 808.293732][T27113] ? security_capable+0x7e/0x2c0 [ 808.293778][T27113] ? shmem_mapping+0xd/0x50 [ 808.293812][T27113] ? memfd_check_seals_mmap+0x165/0x200 [ 808.293848][T27113] do_mmap+0xc3b/0x10c0 [ 808.293882][T27113] ? __pfx_do_mmap+0x10/0x10 [ 808.293905][T27113] ? down_write_killable+0x180/0x240 [ 808.293941][T27113] ? __pfx_down_write_killable+0x10/0x10 [ 808.293974][T27113] ? apparmor_mmap_file+0x2da/0x3e0 [ 808.294012][T27113] vm_mmap_pgoff+0x272/0x4e0 [ 808.294053][T27113] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 808.294100][T27113] ? hugetlb_file_setup+0x42c/0x630 [ 808.294129][T27113] ksys_mmap_pgoff+0x57d/0x760 [ 808.294158][T27113] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.294184][T27113] do_syscall_64+0x174/0x580 [ 808.294213][T27113] ? trace_irq_disable+0x3b/0x140 [ 808.294251][T27113] ? clear_bhb_loop+0x40/0x90 [ 808.294278][T27113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 808.294302][T27113] RIP: 0033:0x7f722b99e019 [ 808.294324][T27113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 808.294344][T27113] RSP: 002b:00007f722c879028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 808.294370][T27113] RAX: ffffffffffffffda RBX: 00007f722bc25fa0 RCX: 00007f722b99e019 [ 808.294389][T27113] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: 0000200000000000 [ 808.294405][T27113] RBP: 00007f722ba3500c R08: ffffffffffffffff R09: 0000000000000000 [ 808.294421][T27113] R10: 0000000000042073 R11: 0000000000000246 R12: 0000000000000000 [ 808.294436][T27113] R13: 00007f722bc26038 R14: 00007f722bc25fa0 R15: 00007ffdff8df498 [ 808.294465][T27113] [ 808.636558][T27117] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 808.700774][T27115] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5699'. [ 808.981026][ T144] dvmrp0: left allmulticast mode [ 816.309267][ T4952] block nbd3: Possible stuck request ffff888026f50000: control (read@0,1024B). Runtime 30 seconds [ 816.320016][ T4952] block nbd3: Possible stuck request ffff888026f501c0: control (read@1024,1024B). Runtime 30 seconds [ 816.331048][ T4952] block nbd3: Possible stuck request ffff888026f50380: control (read@2048,1024B). Runtime 30 seconds [ 816.342132][ T4952] block nbd3: Possible stuck request ffff888026f50540: control (read@3072,1024B). Runtime 30 seconds