last executing test programs: 3.273349714s ago: executing program 2 (id=14947): socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @random="0000fc00", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x16, 0x7c, 0x0, @dev={0xac, 0x14, 0x14, 0x30}}}}}}, 0x0) sendmsg(r2, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) sendmsg$nl_route(r0, 0x0, 0x20040825) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x368, 0x0, 0x180, 0xffffffff, 0x228, 0x228, 0x2d0, 0x2d0, 0xffffffff, 0x2d0, 0x2d0, 0x5, 0x0, {[{{@uncond, 0x0, 0xa0, 0xd8, 0x48, {}, [@common=@addrtype={{0x30}, {0x1, 0x1c, 0x1}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x1, @rand_addr=0x64010100, @remote, @gre_key=0x7fff, @port=0x4e24}}}}, {{@ip={@remote, @empty, 0xff000000, 0xff, 'nicvf0\x00', 'pim6reg0\x00', {}, {0xff}, 0x6c}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x6, @rand_addr=0x64010100, @multicast1, @icmp_id=0x67, @port=0x4e23}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x2, @multicast2, @loopback, @icmp_id=0x67, @port=0x4e24}}}}, {{@ip={@empty, @empty, 0xffffff00, 0x0, 'veth0_to_team\x00', 'ip6gretap0\x00', {}, {0xff}, 0x62, 0x3, 0x8}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x1, @multicast1, @empty, @icmp_id=0x65, @port=0x4e24}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c8) writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 3.05618459s ago: executing program 4 (id=14949): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303}, "dfb5516107460997", "2eae2df56642cf47780664ad9eb3752d7903c8bf284eebe276f7b08633c27be7", "c0b74225", "3effd756896b59a1"}, 0x3) r1 = socket(0x2000000000000021, 0x2, 0x10000000000002) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, 0x0, 0x0) r2 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r2, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x800) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x4}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4008085}, 0x20040000) socket$inet6(0xa, 0x4, 0x40) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) writev(r0, &(0x7f00000039c0)=[{&(0x7f0000001140)="8a3deb7cc711", 0x6}], 0x1) pipe(&(0x7f0000000080)) 2.691984267s ago: executing program 3 (id=14952): socket$igmp6(0xa, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, 0x0, &(0x7f0000000280)=r1}, 0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r1, r3, 0x25, 0x2}, 0x3a) syz_emit_ethernet(0x3a, 0x0, 0x0) 2.378198044s ago: executing program 3 (id=14955): sendmsg$IEEE802154_LLSEC_ADD_KEY(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa0}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008000}, 0x100) (async) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000100)={0xffffffffffffffff, 0x3, 0x3, 0x4}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) bind$packet(r0, &(0x7f0000000180)={0x11, 0x17, r1, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x26}}, 0x14) (async) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x1, 0x6, @link_local}, 0x10) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r3, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f0000000280)=r2}, 0x20) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000300)=0xff, &(0x7f0000000340)=0x1) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000380)={r0}) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0xffffffffffffffff, 0x8, 0x8}, 0xc) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000440)=@generic={&(0x7f00000003c0)='./file0\x00', r6}, 0x18) r7 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000480)={r7, r2}) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_KEY(r8, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x50, r9, 0x2, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x8}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14, 0x30, "950097962a420b46259c80235ac844c9"}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x20004000}, 0x40) (async) ioctl$FS_IOC_GETFSUUID(r5, 0x80111500, &(0x7f0000000640)) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000980)={0x6, 0x1c, &(0x7f0000000680)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffa}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_val={0x18, 0x3, 0x2, 0x0, r4, 0x0, 0x0, 0x0, 0xfffffffb}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @generic={0x7, 0x0, 0x6, 0x5ccc, 0x2}]}, &(0x7f0000000780)='syzkaller\x00', 0x69f6, 0xac, &(0x7f00000007c0)=""/172, 0x40f00, 0x1, '\x00', r1, 0x25, r0, 0x8, &(0x7f0000000880)={0x2, 0x4}, 0x8, 0x10, &(0x7f00000008c0)={0x3, 0xc, 0x2, 0x53}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000900)=[r6, r2, r0], &(0x7f0000000940)=[{0x5, 0x4, 0x8, 0x2}, {0x2, 0x2, 0xe, 0x1}, {0x3, 0x5, 0x8, 0xb}], 0x10, 0xc}, 0x94) (async) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r8, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x28, r9, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x80) (async) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r2, 0x800442d2, &(0x7f0000000bc0)={0x3, &(0x7f0000000b40)=[{0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @broadcast}, {0x0, 0x0, 0x0, @remote}]}) (async) ioctl$BTRFS_IOC_QGROUP_CREATE(r5, 0x4010942a, &(0x7f0000000c00)={0x0, 0x8000000000000001}) (async, rerun: 64) ioctl$sock_SIOCGIFBR(r5, 0x8940, &(0x7f0000000c40)=@generic={0x1, 0x2, 0x6}) (async, rerun: 64) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000cc0), r3) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000d00)={'wlan1\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_STOP_NAN(r5, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x1c, r10, 0x100, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r11}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x200c0040}, 0x44800) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000e40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000f40)={&(0x7f0000000e00)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000f00)={&(0x7f0000000e80)={0x48, r10, 0x400, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8, 0x3, r12}, @val={0xc, 0x99, {0x9, 0x7c}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="4766dd4a4dde"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="c171fbef3577"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x4000080) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000fc0)={0x0, {0x2, 0x4e21, @broadcast}, {0x2, 0x4e23, @empty}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0xb8, 0x0, 0x0, 0x0, 0x379, &(0x7f0000000f80)='vlan1\x00', 0x105b, 0x0, 0x2}) (async, rerun: 64) getsockopt$IP_VS_SO_GET_SERVICE(r5, 0x0, 0x483, &(0x7f0000001040), &(0x7f00000010c0)=0x68) (rerun: 64) 2.208782795s ago: executing program 4 (id=14956): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r7, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) r11 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r11) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r11, r11, 0x19, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x9f1e}}, 0x40) 1.809742458s ago: executing program 3 (id=14959): connect$inet(0xffffffffffffffff, &(0x7f00000002c0)={0x2, 0x0, @loopback}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001c00110c0000006a00000f0007000000", @ANYRES32=r1, @ANYBLOB="800202000a000200577f0000aabb000020000e80050001008f000000050001000100000004000200050001"], 0x48}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x3, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f0000000100)=""/147}, 0x94) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getpeername(r2, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000400)={&(0x7f0000000040)={0xa, 0x4e20, 0x2000007a, @mcast2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="3000000000000000290000000400000084020004003000"], 0x30}, 0x0) 1.792252226s ago: executing program 4 (id=14960): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffbfff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040080) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r6, {0xb, 0x8}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0xfb55}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x5, 0xfffffffffffffff7, 0x81, 0x7ff}, 0x46}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x814}, 0x2) close(r4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000006c0)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r6, 0x10042}, 0x80, &(0x7f0000004600)=[{&(0x7f00000003c0)="27030200dc0f14000e0003feff14c1020000ff", 0x13}, {&(0x7f0000000580)="84db0b9ef1cafdab", 0xa888}, {&(0x7f0000000000)="f8dbb89bfc5f187cca4335143b54aedd2c3332", 0x13}], 0x3}, 0x24004015) 1.77248832s ago: executing program 2 (id=14961): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'lo\x00', 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, 0x14, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32}, @typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}, @typed={0x8, 0x3, 0x0, 0x0, @u32=0x1}]}, 0x2c}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, 0x15, 0x1, 0x0, 0x0, {0xa, 0x0, 0x60}, [@typed={0x8, 0x1, 0x0, 0x0, @u32}, @typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}, @typed={0x8, 0x3, 0x0, 0x0, @u32=0x1}]}, 0x2c}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, 0x16, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32}, @typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}, @typed={0x8, 0x3, 0x0, 0x0, @u32=0x1}]}, 0x2c}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, 0x17, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32}, @typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}, @typed={0x8, 0x3, 0x0, 0x0, @u32=0x1}]}, 0x2c}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, 0x18, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32}, @typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}, @typed={0x8, 0x3, 0x0, 0x0, @u32=0x1}]}, 0x2c}}, 0x0) 1.652391954s ago: executing program 2 (id=14962): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="200000007600110d0000000000000000030000000000000008000a00fe03ffff"], 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xf}, {}, {0x11, 0x10}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x80040000}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048084}, 0x2008c014) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @multicast1}, {0x3200, 0x88be, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xc, 0x17, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000000000000850000001d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7020000000000008500000017000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000400)='syzkaller\x00', 0x92a5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.623295763s ago: executing program 1 (id=14963): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000280), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) close(r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400001d000000850000001500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.396482691s ago: executing program 3 (id=14965): socket$igmp6(0xa, 0x3, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r0}, 0x0, &(0x7f0000000280)=r1}, 0x20) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r1, r3, 0x25, 0x2}, 0x3a) syz_emit_ethernet(0x3a, 0x0, 0x0) 1.39616707s ago: executing program 2 (id=14966): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001fff5000000000000000000000a34000000140a0703000000000000000002000009080003400000000a0900010073797a30000000000c00064000"], 0x70}}, 0x0) 1.310020838s ago: executing program 4 (id=14968): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x10, &(0x7f00000006c0)=ANY=[@ANYBLOB="18ffffff3f0000000000000000000000b7080000000000007b8af8ff00000000b7080000643200007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000551d91117e2b4fd7d6ec541ee5b4"], &(0x7f0000000080)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 1.302411651s ago: executing program 1 (id=14969): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, &(0x7f0000000040)=0x10, 0x800) writev(r3, &(0x7f0000000340)=[{&(0x7f0000000080)="c7f1c98eac6ea682eaf62e1575dbdbea7fc23a712c78b229c87d3c06de830a9d529612b69849521a44ea04100f4c086bbb81551dea5d6a9a7be1660907e3e4023bc9df95dfc8af490dd07b6bcd93d2c92f38db0534f03f2351cd0f6de0868f5d4f49a5db3fabd738656da284b4b976a5caec6c2a281f503d5e78b770dd9ba60658575f5dfa0de89e5e0093142563d3a530ababb49d10d9701a9b7f53f1d21aa7f029bb74cba8d0eb4ec06f19043cad78423ed8ba2b0f5b9e21f56762027f3c1c1cb14edcc43aa23ba361446b40ef800287c29879e4b1308ba28e95748bf57b27461437a09b65e3", 0xe7}, {&(0x7f0000000240)="440cea6dbedc177cef36e7bea8ec93f4d60c17fe6ef1d2d34bd8c0f92dd017d5ea9d37d852020983cd3f2067046fca1fa522739a70b4efa26e65760ffb8648a4c7a70e3cd7b44e61cd6ee64dd56528e682f0a6eb87a65440a903d6e2f2808ee921e90257e218aeb876106f8b25d58a204462dc37b1e4006272c1177ea63d1fb9523e09512e487324d35f4e3f432d4f0becbd681329dcf38210377251235d7ea1fb005149b62408a2ff9074be1dafb9ebdab99a1774a16f9fa4895dc87507c63614b5857280618e31652e99ab62afcfd2a94d37918dae9cc4cfc8eb", 0xdb}], 0x2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000180)={0x4c, r1, 0xb97534d5fe9704cf, 0x1, 0xffffffff, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0xd, 0x13, [{0x48, 0x1}, {0x60}, {0x30}, {0x3}, {0x12, 0x1}, {0xc}, {0x5}, {0x30, 0x1}, {0x53, 0x1}]}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x7fc}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2c9}, @NL80211_ATTR_STA_WME={0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x404c000}, 0x0) 1.205455668s ago: executing program 3 (id=14970): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="280000001a0201fa7cbe3e6c93192d00004358db3a3af03da7000000040001800400038004000280"], 0x28}}, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) connect$inet6(r2, 0x0, 0x0) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r5 = accept4$alg(r4, 0x0, 0x0, 0x0) sendmmsg$sock(r5, &(0x7f0000003380)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000002380)="fb", 0x1}], 0x1}}], 0x1, 0x20000000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20008050}, 0x4814) r7 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r7, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x44, 0x453, 0x4, 0x70bd27, 0x25dfdbfc, "d98b8d359ef78c9525e8cd0455fd41ca1181c3cbd9a0eb3005e40381991c6c8574bfdd952fd6ff208e1e36f28aa88ae79b"}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x50) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) read$alg(r5, &(0x7f00000012c0)=""/4109, 0x100d) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="a00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa140004004cff0100000000000000000000000000010c0002800500010000000000440002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c000280050001000000000006000340000000000800074000000000040006"], 0xa0}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="ac000000000101040000000000000000da59e2aab23d9654370a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000005400000000000000aa0c000280050001000000000008000740080000000000000014000400200100000000000000000000000000012ceb939e2fc44771a8df7e261c3565ec21f2e949b77075f7bfb3ae9e0c3d796015d754881a6ddce7e2b378eac613a72c74b3b5389ae870a607b4a08c092631aa12a516bd22b65a67b06138d2bf03cfaf6a148dc614e76213f3e824ea8f6b664c64a4d6277cd7f51b752dbcd2169ba9125abbc6e88764ed6051c3189fa65a115021924a51b950f72437e9182c038b8ec90fb9ba"], 0xac}}, 0x0) sendmsg$AUDIT_USER(r3, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000100)={0xdc, 0x3ed, 0x4, 0x70bd26, 0x25dfdbfd, "d6d30905eeca5c1c3b847851f615096032d1585b44ab50fb0a80fe1033f428a22a93689d842df2647757431905083bd94b0d300ae40cc283802c6f2721f64666195f0027f3255f87d312ebccb7e33c5478be723801b6a7ef67396a683f461a69a12a7b46504165149e1687f6b1149697e558bef73e2e9b441a0a89af153031e8eb4a777f05bc74c7b60a0ff434705bbb486c8b226758b1ecbed9da9a57fc2bb165d52565571617abcdb218e4a850422afd97ef09213ba73932f5cf899f82edeb63d09d1866a88c85a8", ["", "", ""]}, 0xdc}, 0x1, 0x0, 0x0, 0x24000040}, 0x90) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x40, 0x10, 0x401, 0x70bd2d, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x1b}}, @IFLA_IPTUN_6RD_RELAY_PREFIXLEN={0x6, 0xe, 0x200}]}}}]}, 0x40}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}}, 0x0, 0x5a, 0x0, 0x0, 0x80}, 0x28) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@setlink={0x28, 0x13, 0x5, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x102}, [@IFLA_TARGET_NETNSID={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 1.083509578s ago: executing program 2 (id=14971): syz_emit_ethernet(0x7a, 0x0, 0x0) openat$tun(0xffffff9c, 0x0, 0x300, 0x0) setsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x3, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={r3, &(0x7f0000000080), 0x0}, 0x20) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000080)={r5, 0x808000}, 0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000000c0)={0x6, 0x8, 0x6, 0x6, r5}, &(0x7f0000000140)=0x10) socket$netlink(0x10, 0x3, 0x6) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) listen(r6, 0x5) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000100)={0x6, @loopback, 0x15, 0x0, 'rr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) r7 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r7, &(0x7f0000000300)={0x2, 0x15, @loopback}, 0x10) write(r7, &(0x7f0000000400)='PASV\r\n', 0x6) r8 = accept4(r6, 0x0, 0x0, 0x0) write(r8, &(0x7f0000000500)="32323720456e746572696e672050617373697665204d6f646520283132372c302c30123a01800000000036290d", 0x2d) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x58, 0x10, 0x401, 0xfffffffd, 0x3, {0x0, 0x0, 0x0, 0x0, 0xd126a8577c57125b, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_PROXYARP={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044014}, 0x8c4) 1.05106609s ago: executing program 4 (id=14972): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x6c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r4, 0x64e89, 0x16ac1}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x34, 0x5, 0x0, 0x1, [@IFLA_BRPORT_LEARNING={0x5}, @IFLA_BRPORT_PROXYARP={0x5}, @IFLA_BRPORT_GUARD={0x5, 0x5, 0x1}, @IFLA_BRPORT_MCAST_TO_UCAST={0x5}, @IFLA_BRPORT_VLAN_TUNNEL={0x5, 0x1d, 0x1}, @IFLA_BRPORT_MULTICAST_ROUTER={0x5, 0x19, 0x1}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) (async) sendmsg$nl_route(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x6c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r4, 0x64e89, 0x16ac1}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x34, 0x5, 0x0, 0x1, [@IFLA_BRPORT_LEARNING={0x5}, @IFLA_BRPORT_PROXYARP={0x5}, @IFLA_BRPORT_GUARD={0x5, 0x5, 0x1}, @IFLA_BRPORT_MCAST_TO_UCAST={0x5}, @IFLA_BRPORT_VLAN_TUNNEL={0x5, 0x1d, 0x1}, @IFLA_BRPORT_MULTICAST_ROUTER={0x5, 0x19, 0x1}]}}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000002c40), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f0000002d00)={&(0x7f0000002c00)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x24, r6, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xa36}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x1) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0xfffffffd, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0x10, 0xf}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {}, {0x0, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4048000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000c00)={'batadv_slave_0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000c00)={'batadv_slave_0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001000)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001000)={'team0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000002980)={'syztnl2\x00', &(0x7f00000028c0)={'syztnl1\x00', 0x0, 0x7800, 0x40, 0x72e18d53, 0x9, {{0x27, 0x4, 0x2, 0x3, 0x9c, 0x65, 0x0, 0xe, 0x4, 0x0, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop, @generic={0x89, 0x3, "b8"}, @generic={0x89, 0xb, "6df33c61e38d0f1c49"}, @ra={0x94, 0x4, 0x1}, @ssrr={0x89, 0x2b, 0x44, [@dev={0xac, 0x14, 0x14, 0x31}, @multicast2, @private=0xa010101, @multicast2, @dev={0xac, 0x14, 0x14, 0x42}, @broadcast, @multicast1, @multicast1, @loopback, @remote]}, @timestamp_addr={0x44, 0x2c, 0x57, 0x1, 0x0, [{@broadcast, 0x95}, {@rand_addr=0x64010102, 0x2c000}, {@rand_addr=0x64010101, 0x9}, {@loopback, 0x7}, {@multicast1, 0x5}]}, @end, @generic={0x94, 0x3, "b3"}, @lsrr={0x83, 0x17, 0xea, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100, @local]}]}}}}}) sendmmsg$inet(r1, &(0x7f0000002a80)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast2}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000240)="42cf7cc1d430e6d75b04d3eedc39e3145cba07ad595ac352bd57ab56ff822f3bbeafbdbb18bf3ecea42a31ef6accba22a679b5bd712f2ddb895a343e3a53ed849c9eb1e9c13542f934310ea87fcd8ea4b7351f96745842b252bc6a043edb53d2cf0a0f264c25da96cac67dc340d9eb691c7b257ca29be89e91dcee7426fa3625d2e95d5b9aa066ab", 0x88}, {&(0x7f0000000380)="c80a7e6021110aeaf851ceff2e5ac166ea3a90a3323e54c01be031d5633d730c8cf59ff1ba5c17678077052dee932cdf605aa3ac456ea5ee00c8507c8783e517b11b1f1969b925e93572c50e5e662421f988286b599d8098a7469821", 0x5c}, {&(0x7f0000000400)="244c7560494c8180480ca17ebf780b0f4dae6bdc07fd02fa6b2addf3f12013b1921edc99389528a6de35579e0cc6e835b322076006f13cdecefedd08e7cf7dd25ceb637fa0fc1f52236ecd38a7b6d421068e85268575e463932a488c2892bb135128bf6aa389943260e50ece9f50214d100bd88a38f135336afea8167c21bbbab31580c70b8fd02fc9474b677e159f6f1de8c9d81ffa21fa6d49aedb1c2a21fe8df433b718e02f33a2eac88e262faaab8e3af61c5857bdf10023012790d9e5f3136645f3928d3d109b533443fca41e946daa", 0xd2}, {&(0x7f0000000500)="8625bd1db99480bd7955374df016fa117a71a45db95785b5c73a4211f683c338a90c50839cbb17ad5afd195daf9f3cd6776c79307c16ab3114bc99070a99d1a23ef898cbf67438f5d526a58e5fe89bf8cc11c8017ddfdfbebedc3479ea08dad462d6c8f10639bb78bb6f2e85ce20ab106c74f9adce7de058f2339d41735c42242c988b29a6c69464c2b33f8957b316dab1ee15fee69b4830180063422ade3cf3e65910f43516f5a5fa55f43bec45bc9f95ab3de0c3586b693a796710b397af03c93e8dea", 0xc4}], 0x4}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000640)="5f87b583fac574d7b7df79dbb7a685563cc747203cb57ee01d641f0b885a60b9530e0884c00f8cdc88757c43d9e29650f8514298c661984d36e7790edac66a9c58ae840ba1e1014a3ac0557c1e4e5643ac74eb4d20e463ce00f85abd30532c960a1c75e4e54ab3f749d56aba46071b63039740426f14cc2d9410aeeb0f6e88c826fda98a8cff565f1942fba12789010506e80394e16771ffc9cace5b6742a4f4e5940a21448d88bffd64cb4719dfdf91280df78b05aeec0ca0f3679fa96fc457eab6d4a68ea6ace198cb25850c70d101", 0xd0}], 0x1, &(0x7f0000000780)=[@ip_retopts={{0x60, 0x0, 0x7, {[@end, @timestamp={0x44, 0x1c, 0x8d, 0x0, 0x0, [0x0, 0xb, 0x955, 0x9e4, 0x9, 0x8000]}, @noop, @noop, @lsrr={0x83, 0x27, 0x70, [@loopback, @multicast2, @rand_addr=0x64010102, @multicast1, @remote, @private=0xa010102, @rand_addr=0x64010101, @empty, @broadcast]}, @generic={0x0, 0x8, "70c52b994175"}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @loopback, @empty}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}], 0x98}}, {{&(0x7f0000000840)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000000bc0)=[{&(0x7f0000000880)="7dd0df9488bab51d5355790c7a2179fe08e7f461780c3aa6b1523d0b6e790a740e425ef92e5263780c582a2f3f2140ae3bcf7271bf47b62844a2118aa5f7bcd283ff4a8cab1909b1a104f4ba80d2529e86dc974f3a28e4b90d109ffd459e475ececd538a1210afa9c94bde161ba0cd6b1729373b0c9621c7e210150d5ac1a4c097a93ba1946b5b8bbc49f51cae4bceac6734db967dc18d7014505f9d552cd3b114828408cacc0bbbc3d0f3d4ebf10c913d98177902fb49f69f36d2a6127540d5e7aacbd589333215605e1cafb6cc04ab49364917a84637436ebce658534c9c24394f15b9f7c0", 0xe6}, {&(0x7f0000000980)="589bf1f0275a2fa9b51a24bba090437b9bfe9bba0077a8b361bec3a8a34f1532e05ff7f41c372d9d05386b5b3de8441e474a6fbab1623fdea3855da69459e750979c8d923c806613f31a81dfb6904608b5261edbeffd609ba1fbd6b7048de0f2641dcf7a7fc8b11683aeb5ff11c7e05b5617d80b3ebf6647b929a517824bcdadde904bb8b44dcbebc12eb308a283dcafc73765a44be51f9fc5f32280a378048b3a5ec7b73e77d83b9e", 0xa9}, {&(0x7f0000000a40)="37f0c274cf4ac686b85a3cb8def58b351ac75c1900ae69cd13a99ec65543f9e508785b56d326272e9ac7572b876f41447f3d332dce6f5f070136843ae9714e6e47d9a2e33e5e866656f1f18342ae661bd00039", 0x53}, {&(0x7f0000000ac0)="ce88aab7ceb1ba90fd8657cf41e4a7977bb6ee97ea414ac5be810e2c169e2756ec84688821af567022948662e34ce1abc52300df0c24ecd6ad3d29db9bf6445dcaaaff3a406285703319c2fff04472bdf5c376664a03f7a07a0276a077cbb19f0852d2da8892036592bce334aaf0e5b697dba8654681f617366fb42e1a36d56391fa853cc84e3b1aa1b15228fc1feae9ffc5c3295b0d49bb5c066c1b8f35daf67787e5f920ef1236b36a36cbbca69cc403bf7311fbd8852baeed5de892c7698acb98d956e0184f2e2fb319d4d46cb9fef4081572", 0xd4}], 0x4, &(0x7f0000000c40)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @private=0xa010101, @multicast2}}}], 0x20}}, {{&(0x7f0000000c80)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000f80)=[{&(0x7f0000000cc0)="95ebd85a0cd1340258255ed82c28a941148a253129fb5b5ccb5036c35ac991139212d77c836dc37fd58358c4c7bacb05cc4c71ce6961c43d6fcb7a2cf955c79cc2426890629227ab28426d037ef4756c4957dd9db1174723738f773e68f3541ca848e064ae1c1ea50f001e1b5b1a92b91b13ca4d5a09c97a8dea51c60e350bf9678b50ddabb413d5034bba61727358f94d6181451e435dc41b6bd399c1360a3a7993bc787c3b462a3c4f27cb9b1296b223455bf9d167844695c2ebe8edb7f717be21c36b3f838724277e863a2bbfb43e44e8de", 0xd3}, {&(0x7f0000000dc0)="583f9e9942f446b2fe", 0x9}, {&(0x7f0000000e00)="fd05b7a955e05d3a99cde7f88d716108de9a8e8dad1ba6a37485421f506ad25aa20a93089884fd6d314ade3daa8d4864369fe1c52c70ba371be90e46ef055b15398fff3da4f92320932fa96342ec6a6639ffaa1e341aab5df29a0847f7fe329abcd0d56a984878593dc99a412e697f01a0eef6b884182f6af0d41f4ff4af32dd2cab255cce15d52e1f75c4c0c2960050e05b1a9db408e65ac5dd9d6a47a8584369b7d1c292eb29e45a735b9597ef4548361500", 0xb3}, {&(0x7f0000000ec0)="faef21679f9c4ff4ef92bf4cf01d7d9d27a0dc07b38335fb7feb51b23cf2a2", 0x1f}, {&(0x7f0000000f00)="efa1cd12b30e7ed4e4644ca3410cd898287da4d1eca207a4d85b47e7e9cda61e95bdaadfeecf74194c703d1b46208edab4e4a698", 0x34}, {&(0x7f0000000f40)="6c9cfcca7ad2", 0x6}], 0x6, &(0x7f0000001040)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x5}}, @ip_retopts={{0x70, 0x0, 0x7, {[@timestamp_addr={0x44, 0x1c, 0x6d, 0x1, 0x0, [{@dev={0xac, 0x14, 0x14, 0x27}, 0x7f}, {@remote, 0xffffff81}, {@rand_addr=0x64010102, 0x7f}]}, @timestamp_prespec={0x44, 0x24, 0xab, 0x3, 0x1, [{@loopback, 0x9}, {@remote, 0x9}, {@dev={0xac, 0x14, 0x14, 0x1d}, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xd56}]}, @cipso={0x86, 0x1e, 0xffffffffffffffff, [{0x5, 0x9, "56a681b89a650c"}, {0x2, 0x5, "d8cc63"}, {0x7, 0x2}, {0x1, 0x8, "11d218950001"}]}, @noop]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r11, @dev={0xac, 0x14, 0x14, 0x13}, @multicast2}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}], 0x108}}, {{&(0x7f0000001180)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000012c0)=[{&(0x7f00000011c0)="49213e6e161ecff72a5e37b3b0ca532d5781830f5bbdec18617f083103d83c31f6", 0x21}, {&(0x7f0000001200)="9ae0618c6173751ab1d3548ec3e5193810a50e00147191086a0637610234d1bda6b91c90f7a1c8dee791a92ed4da5e29502c4212e3bdc49fec796a2533f4840b90fabaa6cbffabfd9b0e9c776f1acad6ecf40c57fe0be8e2c6af768c7139de0974c2cbb61094628dc2d96171e47f0a8f890529d4a838c2812ef25d288cf83c73ec9c75145a775163ecceec1f72e70e934b7adbbbf93b9bdd81423dbbe1d77781fcf8c8e67eda27d48f66a2aeb299e63db0dd78", 0xb3}], 0x2}}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000001300)="b15bd29cd0502b418726523c12f050c43b76787955cd324c171f4c14a304bd9ea02e24bb6a9d83637e0c5629edb5040924118b00f301000147b4519dbacc4b9f0f9c646c822fa37bb7dc3ac81ea481f7c8cef1424e8830370701696926f850ac523fe075210bdba1d242f0b63fa3bc79850c46678074feb392b4b8744599cb8a984d06302245131ed260a7a0", 0x8c}, {&(0x7f00000013c0)="bcee8472a3319f52b188945aafa644d8961509146ce445a99ee2b24df3df3cf6e355b28cc75a529042cd84903784dc78cfeacf908a4912aa1d62ac6d8870fda76b460f178d30f78ff925807aa514797eb1400033a07e224369df19bce275d9f205d5dc0b5d9f1da60f94d606ec4b9663a7a91725398b67691754673f38f211abbbe109b7805cfb0b087f156a6f39", 0x8e}, {&(0x7f0000001480)="fe9386ce1fd786cdb22311c654fad8124678fb888348ba0ceebe2be4c0552418feed235d19880102b9ecc4a666dcfea5d0bd75fc14aa885fdd20cfda2433ad1a4396fe62a686ca2164a6e0ad632e972ef0b28fe0447ba28d321e", 0x5a}, {&(0x7f0000001500)="9f6f8a9bcf2e85d59692ceaabc12ef28f6631eb7f0cf8a3f7d02ff3734dfb0d26a7ccaede5e3dc57cc80b33eea08cfc957172d24d8ee2da5f5eab79ff624defc4a432d4458e65d84010cacd2c42558166c6d21febfaaeeb4993eec30466931275c77129079039c99c0f14a9ff07f26a2af881a29b01afe776b174fc0dd24a4c53c8868924715ea6613df72c5a46a697a0e70c4188e9730c9146d93ebfca001ba200308e46d01f4f34997811dd98cbbd226aa6d79717a94616b516289ac5fada4d53c15ce2850730a804183f36d9852b950bcc7c6b087099aca667a5dae5a703c5d68af01a359454d3feb0f85305de2ca75f7e991bb0f542fd9d2e141b1bb84b221cd375d156df97ec7de219989477ff076a8939c26d02186d598da82fb5accbc739573ba1c5d51bae3f8badc71fdfd5453624599de273265880487b5a7532ec71904696d054d10398096bdfa8fad6382b8c3c8398bbf67d183b49e608b396bf1e1f6066f04efcc34c8b8114cd7e6d1d5b5196696021d353ceb7279dffa9f256a7b459e243e1dff432009f9020ed104e0bb1fde1a1e0f703cf656adf655dcef46f2dd5a94a919e0427332d03f598410ff618b4a17fcfb31eb8242bc01977ea13550d8eb6dac11f9b7a4d4307b458fd48696da12f2da85ef90b08fd55afa5ae4e91cf765dfecea127104e1bae29de64c81e7194ab8b823b64159486b24f09f97be4bcff67c17892f2bb6a7850453780f7f8a3413b0599df04139d3cde0c56e08d5158ea780bf84e9a987d751c747a2c0a9ba196630301871fb4242d6daab4c2131026da5db9741ceb82faa692e9654b65d5f48f41bfce6918bdc0dc9db8dca1f03f1435e98671094fe64525e5b737b61615400aef63e8e2f4936c7ef452b87b93c5280064b7adf7502bc9fb063e7c9687d81a96a76136cc2f42ed8a8f027edcd4e23e96436017b947149a328721badf35bb414db193e97cd7a815f6216a98bac6d77741cc41b9895f2dccde1ad81bd2150bd6b029b88aa8864cff4950da0e954100fff6d5a08c4eb037023547ac564d4f25ae110f3771db327df97cdb7829fa06d85effeb7baac16ffd9da6545b1ac71bd68b84967f7aceb9a7d18303163001ce4bca0023b01cca77183bcc73b7817275891dc555808c91fb3100235ff21b7de1e11691a098a7666b1e751c806378e179729ebff60eaec71a88b10eb1ae91b06d82b96a50a89f664586afda653230dbb96ab85e0856889966a973fd45ab54037d5f6c7bbca5390491242f1a3614229dc0c9e9819e573ac44fd06445557b716918281eb1670c423a5428aebd3389d8b6f8612ec22eff5694d1825e703b4ac879fd551ba83e0090acc953292ab3afd7a616187dd0b1fe251d4806456acdc4ca6289d965c8f40b887eea96ec8f7a3dea4c91030ed198b697801e2591e19a956b4aac7d0b475b90c5760265aafd7273b939e02f9d007fab3eb97994296dbfcc452e1c1965326f679f063906fae9375c03887b2bfce92ddc0f15d58005816c2955d014450f7bc42421a3b2395cae4d2e66e38c6385b22d22c41b7bff95276b8a5ce4c62671f6716ea1a18274f10153f92f89a910c3e47fea779389d2c38dd6bc12be2d1255305a00952331e42e9061bfc76e9f1ee5cf8ebe3c48b8b5419cb4fad645ade7a4373b126426474a86f72ebac6e74f0cb7607135655af814f54c76003bd8e61ca71848aff8a68b26a8443772f0ee8f4d500b0c26f3854025d22d7d7c2b6b6b3e28d2985fe5753912015ba93a5b524aa4601d2a2ac7a7c1d8117b91e90acf3edf994231b06fdea4a85829135574a0f5edbacceb451dad2e186bdc580b2e70116761594229248de746624435cbae5a39f2c98eeafa10155328404bc345f144897b12c299aa1acf4ce7b55d3db2669505b2560eb3360f5421bbb6381677186dbbeb63613dc7f434091995e972764168cb41bb0875fc2d5b4963f7f417840aedd56310e7a48cb4eebbb5af4735683e88474ae7aab0e692905432078e828d3db95fb5b08668261497573dd1c1f03dec4fb84c979a45e9e98eaef8494895c07b3469f8770809009bbae197ef6a7eb6dbe533ae6aaf6ed1396f400f13fdef9b766e3dfbc90ca0452b84a97f401831a019ec3544bfb739c32435559d5756d71a93737a5955c7196c651bd0709544f56a9003305d91c8319855416103289363ebcf61f61185f8cd7be1d70047432f7c3fa134988f48234777467c943ca13008f03e2833afbbcd8a73690aac3fb7ba79bd929257984cbb89313a38e4eed94ff2990d03120109b19f78bc01c9cca928abdfa1089d48ebd30c7c816dc8327755b5b7946d8220742a7005026652344d3f502b1c8619d25c3eb3b3928a6ec1471b608b3852cd46b6abdee29a54c9b0e044acf960ca1cd577ddb92c319086fc553d5c5d22b2762a3318f8e78b6bf390099d31c55a24452ddcf6f280a4159db525c626817508f798dec4a003f47b437e9f85ada6fa158d13cb47badc9de449fb0bf51307e5c7d3d98bfac9ade96b8fdc948611adf1d28021c9d6fc8ec75d30c5bd0b452143761fd775da783a3ed0680947600664da5ebf561c922fb0f1320ce274c09b979b1c72b161d0733cec7f9ea5984a6a545288dc93bce5e8522b3ad2cdbb49a3848cc161e0da8e6bf91fdee14d17eca56749f2f0dccdf4f6bd25da2a25990133da4fc2700ea23e0c310a78b43a76bd216411de604bbf6f14902a558ea2800075517fa5f12ca4f5e8de82ef62241e74ddd7203e15135569d1de46bc008fe906cbc5671ca57036b595ad504aaa1cd5d7a3adc5edf42132a9052642d4cffb9421213cb32f8756158173a76f5fdb3cfc5b3e6519bc43ef439fab429458ad4afd2202eb6059cb3daa237ddf63f5121bcd0c330f47ae046b63c1e4a32c8863c9252a468cd25bdb0739d2e79839b8f520303bc2210677247a76e4bbb1998eef8bf726fb7cc3084a7862cce75b45aab14cfaa660b583c05132789b939772421cf5fc6f650dd7dce2326ad6525d7dfbab6802a0a43387bd2ef3a91c26c13a70e219d08bd864d9300486c59b60e89436216d551530d50ee851b821f9a542bd9ea5556a7fbd5f9c457e1c1939d28d9ad695366d09be17e3c73e3de82e27131777de3b64011ddaea424f1ed4e4e29dd00088b9a894d66cddf46591534322270b287d21729b8f480b481e784bb2be178ca5191d2af44c4db2cd01e394c9351631de1112486ce676c7d702fa8b127235a76e198d9faa1b63a57d2f430b535fbf6ffae17749195955b1cdc847846ca9701f20287d6656ff90b12779a7fe3c538bbdc76e1af656bd372a0e10034f26e8a02cdcfd7f01a4ddf592402c05c02d99754f8fa5bd421dbe567d5799dd3d32497d02f22ea17c1e0d56e057feac09676519aaaeb1587357c1e7b99784a4de115665a1a27a2979d6e0a2c398962128f55c621a9118962de0acdbe18199b388952691c24c443dafc4d40fd868e93b01f19c0db86d944080008e3ad955a808cc541736f1f8b4e628197857cddb1f0d13cba21867fa3611cadc6f263f4df307cf5f742c9fcf52e3de93ffa1166b93cdd76042d86d1b47991d9045cbe3a3e9a6d98da7b805a3f23f87263416a4dcfa58646cf0b8f1a7edf2845b7f72804afd65f8a0f0a00a0a17c74efcb72f43a5ef0af09992fc54ef1bcc9e9793a2c0388d8f3971d3b2eb89046a7624bbd6f37ded5392ea798d08ca27fa9104803e4f6d8dd6293dfd0d6a619b62c9751d05f481c30daf21e5660576cb43dbc2aaefa2bb5f387ee10f9ed2afdee1843578d86eee120b8989c2efe4812e71507553a3bb0e00f8ee0040921ccbde033c8ea6309c42b4025f1c3ca8e3df3230ad04d2abdcca9b5411545f09f953d596e1344405f808595124e31551a7e4028562008e5197d251d49874a4364e89678b26fbb17e0e810624f174a231cb3514bd638bf38be69487ad07b9edddaf0251b492dba8398311e1d1d4f0a0cf2fd3df6640a4f11e58f3fbcf4d56fad0c97a6196976ac84d76e5dc40a91ac80bd8773b8a52de34c267622e3abdaea11f916dfc36c0ead5566fc22c12587e8815910cab5cd76c9b83ae06787866152010eb1247c794bc7825bb7ea0892978ed5d085bd8e48c22dacec3ccc9577a58a204863de4319acb535c072c635d64c27cbd6640bac548417ca2e67ee161327239efcce1f020162e6af5f3d713c11687758021b2892020fad52388362ff14498994fab0280be5eaa6bc303db66a4bb767df9b8babc58feb32bfdad8cbd27627b58b6f4120d8c6c52a341ea2e038ad9e4e6cec7571f857bd3d7a2ffa8348eca2816647e0f72c482379bdbe4dfcf89ae93b7964b3352d1b51116818f3b2abe25ec2792b7e4ca078fb8fccef967f10f9aef6f52daff8c2c72f680f79b69edaba02d4757cb2b6b0a1e427f5b3e0b30059b00771e3ad90719d706a6b90a5968f59000369db9933c32731b734050a85edcd566ce11c8d904dc13042ef870a8d4992a2a28f767101327d143422e74a2c7b9e10d44f6e391fa82d93e6e239484abaccf488558366aab30ea04186010c3d2745babff32a9f4ec9134a66cba5381ad4d0f0394efe1cd1552a53df0c9a55b43cf1339feaec676465c70f98a0e7e5303e585cb154099879c408e778b9adbcf8836b1356b3d4812935df1cff66e5ffb16f18b1a86f38aa56a5c04121473f5b3ba93aaf6d0fa33b0401fd964d368968023e0edfdadb0fa20da440609271e99d88c4fa13b4ddf86ca7a2c080e1a94a15b4c99843f25adec327ab32834649f88919eef20425f029cefe8ce9601de65efb5a837cf78de16108c9d99f58f4039dafc2b3df630cf666199097cd76429dc345c77ac33d037978c2a6f9c46eb51a5de5cf97db3f225f16e929a66060605b98092ed8568922cd664dfd8bb6dae84dde5b097041b575e2654e1c7829d7587c666894c48997bccea44f1bc714dacdc1828f40ad6c5ec609d3bcaa1a1757ffcb4967ea2be17b53e84dcbaa7e127d445913ae1b078a802788b81544ce4920b1a6219cd20caa8fb15382f3842a98c6cb5fa3563bc2d88f0aab8a613c58b46e935acaa15a4ff2c34467bfcb46e9eca3527d743fd24ef575bf7566bb679c8f72206c49b470ffecaf9f231f18446d67ebb4ff4b2a4d6168e6b0ded050bb7f696ffd76437bd20590736b6cd120fb46af631edb335bf4f56db771f2959735e52bb0c10cf74f5aa412a2dd3874b2b908935d4332334255c029b933302871846d292c7d2fd1fcc08a9aafb59f12cd9acb8b8756143b4c0987885dfa057bf6bf9afc214678f275eb6370441e517b991143a9e10b5e87ec56621af679d85b359dddf857c954cc10d9d34f0eed3d7bd4ef282e4c7ae61576e3893cb6cac2226c73d711f95f7da15e68e7fc13d6abef63c8526e8ba6b3b35ec417c76983dcf3d0bd9775fe927097be2a0bb311dd09c75cb667ab937b2eaf7fde4b8392ad30ce24310ef984443a63a57e2baaa7c9c90ee0807083082cce284238dc12426373a5484e248a675199fffd9a65131155e98926f67cc08ab63dd17f240cb4fd830ea8d622f8ddfd99a743359902d448938094a23b7645bd21abaa801454b8c77fd5a41b557a8874068d47e80cee041b1411f3501db7f16f7676b9eaeab28fbfa0de6d105a842ca86eb41096cf857f163f5c0d44d05ef2f025e327b529cac77d3a856a0c30debaec7ecea34e67199f1d6ff29a012f614bae71273a9ca7b413726e0427a47a4f888fa713ef444e39", 0x1000}, {&(0x7f0000002500)="31101ff82ab2f9463ed8abcea99d72f53bf90bdbf22ac7080d1c48224dae8337282c0e98d27142c01400d86c966a791bb0c67277cebfab5fc4959aabc0c7d77afbfc79a2438b3edd57e87eac08abd22f81de52aeca9035ae4d6afb4ee26cc496e6672973e7eb55c7f5f03abf72f51dbce04ac67eaaea54e481df2bcf17cff96543daef", 0x83}, {&(0x7f00000025c0)="2f7b0ee716848e7794bef93cfc3fcae9652a6a601b80000457ea9eeee989bd663d7451b8944975d4b5fae461afcf8626efe6baf18bef7b26fa2c72ff68570ae74a83a110048b3d3df008d4f3432afb0eb4fd1c33825a3c6ca5b5af372414c43bfe1eb211f90f90d3d24e97631f6f598ec9dd4223fa264264c81180d2c17006d7dea3e35ff9cbd7970d64ff27cfbaf54bf97239b3c30f3feebbc371d5", 0x9c}, {&(0x7f0000002680)="d435258ffa72aa3c43285b935ecaec91293b978c24d9acbba558b69685b59aa51b3992743a7923e77691999d686f51b43cebbb7fb55166a91c817d1ee4a7a51d5537e862ab2e12154cefa189b724c1e8e57dc65fb41b467284d227833d012d2a3e65839400be7752a97d2a34670bfdb992e069deb365412e36415dccd9bc6cc2d2153353", 0x84}, {&(0x7f0000002740)="924367cb90e73d0e1325b7d7734e53fa5d862a9e840b572b9010dd2cb7391697a379aa09d4482161340781f1c7d7a9075f86d0719d762fba6fb9305fa79c47d71203ec7b5aca8d9e9d38418b659b1ee714ace7e442e881d660c9053f962d0eadb60105a67e912d469cae4693b3792f7e4bedd66a7243f72dade571dc9aefdd8ed6bc28412e7d06e809715204c9de618b4a5ab21af5948e2b383f9b63d229cc8ebf2d145dde3b00052335c34c81b989b23646fac2a9bc609a04ae8329942a84fa031b11bd772abf9acfe45d4404aace7cc1998417cd984ff7332aa692c63820b2b1ec9f83edf5b4d0ecd69d2a192eab7e3e29247926ae0a", 0xf7}], 0x8, &(0x7f00000029c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x7}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xe}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xe8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6d}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r12, @multicast2, @multicast2}}}], 0x98}}], 0x6, 0x1944a2b501eb7640) write$tun(r0, &(0x7f0000000300)={@void, @void, @eth={@multicast, @multicast, @val={@void, {0x8100, 0x6, 0x0, 0x6}}, {@ipv6={0x86dd, @tipc_packet={0xb, 0x6, "5a1b6c", 0x18, 0x6, 0xff, @mcast2, @private2, {[], @payload_conn={{{0x18, 0x0, 0x1, 0x0, 0x0, 0x6, 0x1, 0x2, 0x7, 0x0, 0x0, 0xf, 0x3, 0x0, 0x3, 0x4, 0x3, 0x4e22, 0x4e21}}}}}}}}}, 0x52) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e22, 0x9c, 0x0, @wg}}}}}, 0x0) syz_emit_ethernet(0x9e, &(0x7f0000002d40)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800450000900000000000119078000000000000000000004e22007c90780400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8cca206f12e026593f5a134aa03ffff01eb32ffeb65b0bf41b30b95790611f82ebd265de647b422958c20dbfad04e1fad1d3de2a5243b57dabaacbae6108012000d005838575b2cd7986a83b5c309d3cb9f039f657203eaac04c3bd20bcd2945c842ea3096c66817109a8b28faf72eacbee4487d9f0936c7e4231046c0f9d471a729ec7259c0cf5ae667e93893a79e58fdc4821aa4c6ac6fb554eae6db008f6848295a56de9458fbbfdbb648bdea581b70b499884fb5deec05f3f4aba33161fbea3d4838d302bf202704d1ca68644d31e0764916838cccb4bd05c6a79ceef5de3bc5bf1517561a0322d0e39884901"], 0x0) (async) syz_emit_ethernet(0x9e, &(0x7f0000002d40)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800450000900000000000119078000000000000000000004e22007c90780400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8cca206f12e026593f5a134aa03ffff01eb32ffeb65b0bf41b30b95790611f82ebd265de647b422958c20dbfad04e1fad1d3de2a5243b57dabaacbae6108012000d005838575b2cd7986a83b5c309d3cb9f039f657203eaac04c3bd20bcd2945c842ea3096c66817109a8b28faf72eacbee4487d9f0936c7e4231046c0f9d471a729ec7259c0cf5ae667e93893a79e58fdc4821aa4c6ac6fb554eae6db008f6848295a56de9458fbbfdbb648bdea581b70b499884fb5deec05f3f4aba33161fbea3d4838d302bf202704d1ca68644d31e0764916838cccb4bd05c6a79ceef5de3bc5bf1517561a0322d0e39884901"], 0x0) 1.039542787s ago: executing program 0 (id=14973): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000006a00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x10) 988.547265ms ago: executing program 1 (id=14974): r0 = socket$nl_rdma(0x10, 0x3, 0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000044c0)={0x18, 0xf, &(0x7f00000040c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x20}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0xcf593f5817d5adb3}}}, &(0x7f0000004280)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x5, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 884.547388ms ago: executing program 0 (id=14975): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="50000000020601080011000000000000000000040900020073797a31000000000500040000003209f23f0300686173683a6970000c00078008000640ffffff8f6aa47c00020000000500010006000000"], 0x50}}, 0x0) 779.490083ms ago: executing program 0 (id=14976): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="020300030c0000004007000000000000020009001800000053bb46970000000003000600000000000200100000000000000000000000000002000100000000000000030b00000000030005000000000002"], 0x60}, 0x1, 0x7}, 0x0) 644.625553ms ago: executing program 3 (id=14977): socket$packet(0x11, 0x2, 0x300) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000180)=""/111, 0x6f}], 0x1, &(0x7f0000000280)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18, 0x40080}, 0x4000000) recvmmsg(r0, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000002c40)=""/216, 0xd8}, 0x10001}], 0x2, 0x40010000, 0x0) 644.382752ms ago: executing program 0 (id=14978): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffbfff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040080) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2002, {0x0, 0x0, 0x0, r6, {0xb, 0x8}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0xfb55}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x5, 0xfffffffffffffff7, 0x81, 0x7ff}, 0x46}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x814}, 0x2) close(r4) socket(0x40000000015, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r7, &(0x7f00000006c0)={&(0x7f0000000440)=@xdp={0x2c, 0x0, r6, 0x10042}, 0x80, &(0x7f0000004600)=[{&(0x7f00000003c0)="27030200dc0f14000e0003feff14c1020000ff", 0x13}, {&(0x7f0000000580)="84db0b9ef1cafdab", 0xa888}, {&(0x7f0000000000)="f8dbb89bfc5f187cca4335143b54aedd2c3332", 0x13}], 0x3}, 0x24004015) 342.916554ms ago: executing program 1 (id=14979): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000280), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0) close(r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400001d000000850000001500000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 320.08162ms ago: executing program 4 (id=14980): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvmsg(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1}, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000e00)=[{&(0x7f0000000dc0)="3f2a6a1bc4", 0x5}], 0x1) recvfrom(0xffffffffffffffff, &(0x7f00000015c0)=""/4059, 0xfdb, 0x17, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 252.717097ms ago: executing program 0 (id=14981): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000100001f5ff000000000000000000000a34000000140a0703000000000000000002000009080003400000000a0900010073797a30000000000c00064000"], 0x70}}, 0x0) 177.154272ms ago: executing program 1 (id=14982): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120920040044000000a80016000a0003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084) 168.955038ms ago: executing program 0 (id=14983): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c8, &(0x7f0000000100)) 85.202µs ago: executing program 2 (id=14984): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendto(r0, &(0x7f0000000000)="240000003f0005000a0000000000400002020000000000000c0001006f76732d64703000", 0x24, 0x0, 0x0, 0x0) 0s ago: executing program 1 (id=14985): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000006a00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x10) kernel console output (not intermixed with test programs): [ T5391] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1174.832221][ T5391] ? import_iovec+0x73/0xa0 [ 1174.832250][ T5391] ___sys_sendmsg+0x2a5/0x360 [ 1174.832276][ T5391] ? __lock_acquire+0x747/0x2de0 [ 1174.832302][ T5391] ? __pfx____sys_sendmsg+0x10/0x10 [ 1174.832369][ T5391] ? __fget_files+0x2a/0x420 [ 1174.832395][ T5391] ? __fget_files+0x3a2/0x420 [ 1174.832435][ T5391] __x64_sys_sendmsg+0x1b1/0x290 [ 1174.832467][ T5391] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1174.832520][ T5391] do_syscall_64+0x166/0x520 [ 1174.832546][ T5391] ? trace_irq_disable+0x3b/0x140 [ 1174.832571][ T5391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1174.832591][ T5391] ? clear_bhb_loop+0x70/0xc0 [ 1174.832617][ T5391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1174.832637][ T5391] RIP: 0033:0x7f971499e159 [ 1174.832657][ T5391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1174.832674][ T5391] RSP: 002b:00007f9715842028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1174.832697][ T5391] RAX: ffffffffffffffda RBX: 00007f9714c25fa0 RCX: 00007f971499e159 [ 1174.832711][ T5391] RDX: 0000000060044084 RSI: 0000200000000000 RDI: 0000000000000003 [ 1174.832725][ T5391] RBP: 00007f9715842090 R08: 0000000000000000 R09: 0000000000000000 [ 1174.832738][ T5391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1174.832759][ T5391] R13: 00007f9714c26038 R14: 00007f9714c25fa0 R15: 00007ffdaf6d6ff8 [ 1174.832794][ T5391] [ 1174.902066][ T5389] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14068'. [ 1175.354361][ T5389] netlink: 4 bytes leftover after parsing attributes in process `syz.0.14068'. [ 1175.485698][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1175.496493][ T3563] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 1175.875699][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1175.956156][ T5772] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1175.956528][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1176.066173][ T3563] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 1176.440621][ T5427] netlink: 'syz.0.14080': attribute type 1 has an invalid length. [ 1177.764872][ T5453] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1177.879428][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.160477][ T5465] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14092'. [ 1178.442455][ T5473] netlink: 576 bytes leftover after parsing attributes in process `syz.3.14095'. [ 1178.598687][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1178.599036][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1178.599323][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1178.599602][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1178.599876][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1178.600150][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1178.600785][ T5484] netlink: 'syz.0.14096': attribute type 4 has an invalid length. [ 1178.600807][ T5484] netlink: 152 bytes leftover after parsing attributes in process `syz.0.14096'. [ 1179.059068][ T5494] netlink: 'syz.1.14103': attribute type 1 has an invalid length. [ 1179.695210][ T5512] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1179.901423][ T5515] syzkaller0: left promiscuous mode [ 1179.901449][ T5515] syzkaller0: left allmulticast mode [ 1180.353469][ T5528] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14113'. [ 1180.353515][ T5528] netlink: 'syz.2.14113': attribute type 7 has an invalid length. [ 1180.353539][ T5528] netlink: 'syz.2.14113': attribute type 8 has an invalid length. [ 1180.353552][ T5528] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14113'. [ 1180.430291][ T5528] ip6gretap0: entered promiscuous mode [ 1180.453131][ T5528] gretap0: entered promiscuous mode [ 1180.454267][ T5528] hsr1: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 1180.454288][ T5528] hsr1: Slave B (ip6gretap0) is not up; please bring it up to get a fully working HSR network [ 1180.454329][ T5528] hsr1: Interlink (gretap0) is not up; please bring it up to get a fully working HSR network [ 1181.351596][ T5551] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 1181.351843][ T5551] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 1181.461228][ T5555] netlink: 'syz.3.14124': attribute type 4 has an invalid length. [ 1181.491796][ T5555] openvswitch: netlink: Key type 197 is out of range max 32 [ 1181.598652][ T5558] FAULT_INJECTION: forcing a failure. [ 1181.598652][ T5558] name failslab, interval 1, probability 0, space 0, times 0 [ 1181.598690][ T5558] CPU: 0 UID: 0 PID: 5558 Comm: syz.0.14126 Not tainted syzkaller #0 PREEMPT(full) [ 1181.598731][ T5558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1181.598743][ T5558] Call Trace: [ 1181.598752][ T5558] [ 1181.598760][ T5558] dump_stack_lvl+0xe8/0x150 [ 1181.598795][ T5558] should_fail_ex+0x410/0x560 [ 1181.598822][ T5558] ? alloc_vmap_area+0x21c/0x1420 [ 1181.598849][ T5558] should_failslab+0xa8/0x100 [ 1181.598874][ T5558] ? alloc_vmap_area+0x21c/0x1420 [ 1181.598896][ T5558] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1181.598928][ T5558] ? alloc_vmap_area+0x21c/0x1420 [ 1181.598961][ T5558] alloc_vmap_area+0x21c/0x1420 [ 1181.599002][ T5558] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1181.599026][ T5558] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 1181.599051][ T5558] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 1181.599071][ T5558] ? __get_vm_area_node+0x155/0x2f0 [ 1181.599102][ T5558] __get_vm_area_node+0x200/0x2f0 [ 1181.599137][ T5558] __vmalloc_node_range_noprof+0x343/0x1540 [ 1181.599165][ T5558] ? bpf_prog_calc_tag+0x51/0x370 [ 1181.599190][ T5558] ? __x64_sys_bpf+0xba/0xd0 [ 1181.599207][ T5558] ? do_syscall_64+0x166/0x520 [ 1181.599237][ T5558] ? __kasan_kmalloc+0x93/0xb0 [ 1181.599259][ T5558] ? bpf_prog_load+0x14d6/0x1c20 [ 1181.599279][ T5558] ? __sys_bpf+0xd0d/0xd90 [ 1181.599298][ T5558] ? __x64_sys_bpf+0xba/0xd0 [ 1181.599330][ T5558] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1181.599370][ T5558] ? bpf_prog_calc_tag+0x51/0x370 [ 1181.599391][ T5558] __vmalloc_noprof+0xd2/0x120 [ 1181.599418][ T5558] ? bpf_prog_calc_tag+0x51/0x370 [ 1181.599443][ T5558] bpf_prog_calc_tag+0x51/0x370 [ 1181.599465][ T5558] ? __pfx_cmp_subprogs+0x10/0x10 [ 1181.599492][ T5558] check_and_resolve_insns+0xbb/0x21d0 [ 1181.599563][ T5558] ? add_subprog+0x2e2/0x3f0 [ 1181.599589][ T5558] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 1181.599622][ T5558] bpf_check+0x18f9/0x2ef0 [ 1181.599663][ T5558] ? __pfx_bpf_check+0x10/0x10 [ 1181.599688][ T5558] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1181.599759][ T5558] bpf_prog_load+0x14d6/0x1c20 [ 1181.599795][ T5558] ? __pfx_bpf_prog_load+0x10/0x10 [ 1181.599844][ T5558] __sys_bpf+0xd0d/0xd90 [ 1181.599875][ T5558] ? __pfx___sys_bpf+0x10/0x10 [ 1181.599910][ T5558] ? __fget_files+0x2a/0x420 [ 1181.599954][ T5558] ? ksys_write+0x242/0x270 [ 1181.599985][ T5558] ? __pfx_ksys_write+0x10/0x10 [ 1181.600075][ T5558] __x64_sys_bpf+0xba/0xd0 [ 1181.600107][ T5558] do_syscall_64+0x166/0x520 [ 1181.600131][ T5558] ? trace_irq_disable+0x3b/0x140 [ 1181.600149][ T5558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.600169][ T5558] ? clear_bhb_loop+0x70/0xc0 [ 1181.600194][ T5558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.600213][ T5558] RIP: 0033:0x7fbb51b9e159 [ 1181.600235][ T5558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1181.600251][ T5558] RSP: 002b:00007fbb4fdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1181.600274][ T5558] RAX: ffffffffffffffda RBX: 00007fbb51e25fa0 RCX: 00007fbb51b9e159 [ 1181.600289][ T5558] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1181.600301][ T5558] RBP: 00007fbb4fdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1181.600314][ T5558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1181.600325][ T5558] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1181.600359][ T5558] [ 1181.656225][ T5558] syz.0.14126: vmalloc error: size 32, align 0x1, vm_struct allocation failed, mode:0x400cc0(GFP_KERNEL_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1181.656296][ T5558] CPU: 0 UID: 0 PID: 5558 Comm: syz.0.14126 Not tainted syzkaller #0 PREEMPT(full) [ 1181.656316][ T5558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1181.656327][ T5558] Call Trace: [ 1181.656335][ T5558] [ 1181.656342][ T5558] dump_stack_lvl+0xe8/0x150 [ 1181.656374][ T5558] warn_alloc+0x24d/0x270 [ 1181.656395][ T5558] ? lockdep_hardirqs_on+0x7b/0x110 [ 1181.656422][ T5558] ? __pfx_warn_alloc+0x10/0x10 [ 1181.656439][ T5558] ? kfree+0x1c5/0x650 [ 1181.656470][ T5558] ? __get_vm_area_node+0x219/0x2f0 [ 1181.656503][ T5558] __vmalloc_node_range_noprof+0x36b/0x1540 [ 1181.656530][ T5558] ? __x64_sys_bpf+0xba/0xd0 [ 1181.656556][ T5558] ? do_syscall_64+0x166/0x520 [ 1181.656583][ T5558] ? __kasan_kmalloc+0x93/0xb0 [ 1181.656603][ T5558] ? bpf_prog_load+0x14d6/0x1c20 [ 1181.656621][ T5558] ? __sys_bpf+0xd0d/0xd90 [ 1181.656638][ T5558] ? __x64_sys_bpf+0xba/0xd0 [ 1181.656668][ T5558] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1181.656705][ T5558] ? bpf_prog_calc_tag+0x51/0x370 [ 1181.656725][ T5558] __vmalloc_noprof+0xd2/0x120 [ 1181.656749][ T5558] ? bpf_prog_calc_tag+0x51/0x370 [ 1181.656773][ T5558] bpf_prog_calc_tag+0x51/0x370 [ 1181.656792][ T5558] ? __pfx_cmp_subprogs+0x10/0x10 [ 1181.656817][ T5558] check_and_resolve_insns+0xbb/0x21d0 [ 1181.656842][ T5558] ? add_subprog+0x2e2/0x3f0 [ 1181.656865][ T5558] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 1181.656896][ T5558] bpf_check+0x18f9/0x2ef0 [ 1181.656940][ T5558] ? __pfx_bpf_check+0x10/0x10 [ 1181.656962][ T5558] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1181.656990][ T5558] bpf_prog_load+0x14d6/0x1c20 [ 1181.657022][ T5558] ? __pfx_bpf_prog_load+0x10/0x10 [ 1181.657068][ T5558] __sys_bpf+0xd0d/0xd90 [ 1181.657097][ T5558] ? __pfx___sys_bpf+0x10/0x10 [ 1181.657128][ T5558] ? __fget_files+0x2a/0x420 [ 1181.657169][ T5558] ? ksys_write+0x242/0x270 [ 1181.657197][ T5558] ? __pfx_ksys_write+0x10/0x10 [ 1181.657228][ T5558] __x64_sys_bpf+0xba/0xd0 [ 1181.657249][ T5558] do_syscall_64+0x166/0x520 [ 1181.657269][ T5558] ? trace_irq_disable+0x3b/0x140 [ 1181.657287][ T5558] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.657305][ T5558] ? clear_bhb_loop+0x70/0xc0 [ 1181.657327][ T5558] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.657344][ T5558] RIP: 0033:0x7fbb51b9e159 [ 1181.657363][ T5558] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1181.657377][ T5558] RSP: 002b:00007fbb4fdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1181.657396][ T5558] RAX: ffffffffffffffda RBX: 00007fbb51e25fa0 RCX: 00007fbb51b9e159 [ 1181.657408][ T5558] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1181.657420][ T5558] RBP: 00007fbb4fdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1181.657431][ T5558] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1181.657442][ T5558] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1181.657472][ T5558] [ 1181.658206][ T5558] Mem-Info: [ 1181.658216][ T5558] active_anon:5579 inactive_anon:0 isolated_anon:0 [ 1181.658216][ T5558] active_file:3 inactive_file:43941 isolated_file:0 [ 1181.658216][ T5558] unevictable:0 dirty:190 writeback:0 [ 1181.658216][ T5558] slab_reclaimable:11839 slab_unreclaimable:113274 [ 1181.658216][ T5558] mapped:29437 shmem:581 pagetables:3459 [ 1181.658216][ T5558] sec_pagetables:0 bounce:0 [ 1181.658216][ T5558] kernel_misc_reclaimable:0 [ 1181.658216][ T5558] free:1301554 free_pcp:10860 free_cma:0 [ 1181.659160][ T5558] Node 0 active_anon:22316kB inactive_anon:0kB active_file:12kB inactive_file:175568kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:117748kB dirty:756kB writeback:0kB shmem:2324kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14728kB pagetables:13668kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1181.659211][ T5558] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:168kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1181.659253][ T5558] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1181.659329][ T5558] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1181.659364][ T5558] Node 0 DMA32 free:1252424kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22316kB inactive_anon:0kB active_file:12kB inactive_file:175568kB unevictable:0kB writepending:756kB zspages:0kB present:3129332kB managed:2546900kB mlocked:0kB bounce:0kB free_pcp:36132kB local_pcp:21124kB free_cma:0kB [ 1181.659415][ T5558] lowmem_reserve[]: 0 0 0 0 0 [ 1181.659447][ T5558] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1181.659492][ T5558] lowmem_reserve[]: 0 0 0 0 0 [ 1181.659524][ T5558] Node 1 Normal free:3938432kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:7304kB local_pcp:7304kB free_cma:0kB [ 1181.659582][ T5558] lowmem_reserve[]: 0 0 0 0 0 [ 1181.659614][ T5558] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1181.661762][ T5558] Node 0 DMA32: 184*4kB (UM) 77*8kB (UM) 130*16kB (ME) 395*32kB (UM) 483*64kB (UM) 489*128kB (UM) 372*256kB (UME) 256*512kB (UM) 109*1024kB (UM) 11*2048kB (UM) 191*4096kB (UM) = 1252360kB [ 1181.661909][ T5558] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1181.661998][ T5558] Node 1 Normal: 2*4kB (UM) 1*8kB (M) 1*16kB (M) 1*32kB (M) 1*64kB (M) 2*128kB (UM) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3938432kB [ 1181.662140][ T5558] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1181.662155][ T5558] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1181.662169][ T5558] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1181.662183][ T5558] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1181.662198][ T5558] 44521 total pagecache pages [ 1181.662205][ T5558] 0 pages in swap cache [ 1181.662212][ T5558] Free swap = 124996kB [ 1181.662219][ T5558] Total swap = 124996kB [ 1181.662226][ T5558] 2097051 pages RAM [ 1181.662233][ T5558] 0 pages HighMem/MovableOnly [ 1181.662239][ T5558] 428710 pages reserved [ 1181.662245][ T5558] 0 pages cma reserved [ 1181.718595][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1181.783129][ T5561] pimreg: entered allmulticast mode [ 1181.783525][ T5564] netlink: 'syz.1.14128': attribute type 1 has an invalid length. [ 1182.357703][ T52] block nbd1: Receive control failed (result -32) [ 1182.360545][ T52] block nbd1: Receive control failed (result -32) [ 1182.429482][ T5560] pimreg: left allmulticast mode [ 1182.563052][ T5573] netlink: 'syz.0.14131': attribute type 21 has an invalid length. [ 1182.563079][ T5573] netlink: 128 bytes leftover after parsing attributes in process `syz.0.14131'. [ 1182.695052][ T5573] netlink: 3 bytes leftover after parsing attributes in process `syz.0.14131'. [ 1182.748696][ T5576] netlink: 'syz.2.14132': attribute type 21 has an invalid length. [ 1182.748721][ T5576] netlink: 128 bytes leftover after parsing attributes in process `syz.2.14132'. [ 1182.780212][ T5574] macsec1: entered promiscuous mode [ 1182.861122][ T5576] netlink: 3 bytes leftover after parsing attributes in process `syz.2.14132'. [ 1182.975185][ T5579] macsec3: entered promiscuous mode [ 1183.098392][ T5586] netlink: 40 bytes leftover after parsing attributes in process `syz.3.14133'. [ 1183.227493][ T5580] syzkaller1: entered promiscuous mode [ 1183.227517][ T5580] syzkaller1: entered allmulticast mode [ 1183.493666][ T5589] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 1183.493695][ T5589] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 1183.524978][ T5591] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 1183.525006][ T5591] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 1183.697597][ T5596] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14137'. [ 1183.765632][ T5602] net_ratelimit: 5 callbacks suppressed [ 1183.765656][ T5602] openvswitch: netlink: Flow key attr not present in new flow. [ 1184.098329][ T5626] netlink: 'syz.3.14145': attribute type 21 has an invalid length. [ 1184.098357][ T5626] netlink: 128 bytes leftover after parsing attributes in process `syz.3.14145'. [ 1184.098440][ T5626] netlink: 3 bytes leftover after parsing attributes in process `syz.3.14145'. [ 1184.143030][ T5626] macsec1: entered promiscuous mode [ 1184.393429][ T5635] netlink: 'syz.4.14148': attribute type 1 has an invalid length. [ 1184.429280][ T5637] netlink: 32 bytes leftover after parsing attributes in process `syz.1.14146'. [ 1184.792739][ T5645] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 1184.792986][ T5645] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 1184.845650][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1184.845915][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1184.846158][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1185.536022][ T5664] netlink: 'syz.0.14159': attribute type 21 has an invalid length. [ 1185.536047][ T5664] netlink: 128 bytes leftover after parsing attributes in process `syz.0.14159'. [ 1185.568772][ T5664] macsec1: entered promiscuous mode [ 1185.918738][ T5670] netlink: 'syz.3.14161': attribute type 4 has an invalid length. [ 1186.326358][ T5693] FAULT_INJECTION: forcing a failure. [ 1186.326358][ T5693] name failslab, interval 1, probability 0, space 0, times 0 [ 1186.326393][ T5693] CPU: 0 UID: 0 PID: 5693 Comm: syz.2.14168 Not tainted syzkaller #0 PREEMPT(full) [ 1186.326415][ T5693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1186.326427][ T5693] Call Trace: [ 1186.326435][ T5693] [ 1186.326444][ T5693] dump_stack_lvl+0xe8/0x150 [ 1186.326479][ T5693] should_fail_ex+0x410/0x560 [ 1186.326507][ T5693] should_failslab+0xa8/0x100 [ 1186.326534][ T5693] __kmalloc_node_noprof+0x100/0x720 [ 1186.326554][ T5693] ? __get_vm_area_node+0x200/0x2f0 [ 1186.326580][ T5693] ? __get_vm_area_node+0x283/0x2f0 [ 1186.326604][ T5693] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1186.326629][ T5693] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1186.326664][ T5693] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1186.326705][ T5693] ? bpf_prog_load+0x14d6/0x1c20 [ 1186.326727][ T5693] ? __sys_bpf+0xd0d/0xd90 [ 1186.326761][ T5693] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1186.326800][ T5693] ? bpf_prog_calc_tag+0x51/0x370 [ 1186.326821][ T5693] __vmalloc_noprof+0xd2/0x120 [ 1186.326848][ T5693] ? bpf_prog_calc_tag+0x51/0x370 [ 1186.326873][ T5693] bpf_prog_calc_tag+0x51/0x370 [ 1186.326895][ T5693] ? __pfx_cmp_subprogs+0x10/0x10 [ 1186.326921][ T5693] check_and_resolve_insns+0xbb/0x21d0 [ 1186.326949][ T5693] ? add_subprog+0x2e2/0x3f0 [ 1186.326974][ T5693] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 1186.327007][ T5693] bpf_check+0x18f9/0x2ef0 [ 1186.327048][ T5693] ? __pfx_bpf_check+0x10/0x10 [ 1186.327073][ T5693] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1186.327103][ T5693] bpf_prog_load+0x14d6/0x1c20 [ 1186.327151][ T5693] ? __pfx_bpf_prog_load+0x10/0x10 [ 1186.327202][ T5693] __sys_bpf+0xd0d/0xd90 [ 1186.327233][ T5693] ? __pfx___sys_bpf+0x10/0x10 [ 1186.327267][ T5693] ? __fget_files+0x2a/0x420 [ 1186.327312][ T5693] ? ksys_write+0x242/0x270 [ 1186.327342][ T5693] ? __pfx_ksys_write+0x10/0x10 [ 1186.327375][ T5693] __x64_sys_bpf+0xba/0xd0 [ 1186.327398][ T5693] do_syscall_64+0x166/0x520 [ 1186.327422][ T5693] ? trace_irq_disable+0x3b/0x140 [ 1186.327442][ T5693] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.327462][ T5693] ? clear_bhb_loop+0x70/0xc0 [ 1186.327486][ T5693] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1186.327505][ T5693] RIP: 0033:0x7f971499e159 [ 1186.327525][ T5693] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1186.327540][ T5693] RSP: 002b:00007f9715842028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1186.327562][ T5693] RAX: ffffffffffffffda RBX: 00007f9714c25fa0 RCX: 00007f971499e159 [ 1186.327577][ T5693] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1186.327589][ T5693] RBP: 00007f9715842090 R08: 0000000000000000 R09: 0000000000000000 [ 1186.327602][ T5693] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1186.327613][ T5693] R13: 00007f9714c26038 R14: 00007f9714c25fa0 R15: 00007ffdaf6d6ff8 [ 1186.327644][ T5693] [ 1186.737396][ T5732] netlink: 'syz.1.14173': attribute type 21 has an invalid length. [ 1186.790932][ T5732] macsec1: entered promiscuous mode [ 1187.027814][ T5752] syzkaller0: entered promiscuous mode [ 1187.027840][ T5752] syzkaller0: entered allmulticast mode [ 1187.471381][ T5769] netlink: 'syz.0.14183': attribute type 4 has an invalid length. [ 1187.471572][ T5769] FAULT_INJECTION: forcing a failure. [ 1187.471572][ T5769] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1187.472808][ T5769] CPU: 0 UID: 0 PID: 5769 Comm: syz.0.14183 Not tainted syzkaller #0 PREEMPT(full) [ 1187.472832][ T5769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1187.472844][ T5769] Call Trace: [ 1187.472853][ T5769] [ 1187.472862][ T5769] dump_stack_lvl+0xe8/0x150 [ 1187.472897][ T5769] should_fail_ex+0x410/0x560 [ 1187.472927][ T5769] _copy_from_user+0x2d/0xb0 [ 1187.472953][ T5769] kstrtouint_from_user+0xd6/0x180 [ 1187.473031][ T5769] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1187.473063][ T5769] ? lock_acquire+0x115/0x350 [ 1187.473090][ T5769] proc_fail_nth_write+0x8e/0x210 [ 1187.473111][ T5769] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1187.473140][ T5769] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1187.473160][ T5769] vfs_write+0x296/0xba0 [ 1187.473198][ T5769] ? __pfx_vfs_write+0x10/0x10 [ 1187.473233][ T5769] ? __fget_files+0x2a/0x420 [ 1187.473264][ T5769] ? __fget_files+0x3a2/0x420 [ 1187.473287][ T5769] ? __fget_files+0x2a/0x420 [ 1187.473324][ T5769] ksys_write+0x150/0x270 [ 1187.473355][ T5769] ? __pfx_ksys_write+0x10/0x10 [ 1187.473397][ T5769] do_syscall_64+0x166/0x520 [ 1187.473421][ T5769] ? trace_irq_disable+0x3b/0x140 [ 1187.473440][ T5769] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.473460][ T5769] ? clear_bhb_loop+0x70/0xc0 [ 1187.473493][ T5769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1187.473512][ T5769] RIP: 0033:0x7fbb51b5e98e [ 1187.473532][ T5769] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1187.473548][ T5769] RSP: 002b:00007fbb4fdf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1187.473570][ T5769] RAX: ffffffffffffffda RBX: 00007fbb4fdf66c0 RCX: 00007fbb51b5e98e [ 1187.473584][ T5769] RDX: 0000000000000001 RSI: 00007fbb4fdf60a0 RDI: 0000000000000004 [ 1187.473596][ T5769] RBP: 00007fbb4fdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1187.473609][ T5769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1187.473620][ T5769] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1187.473655][ T5769] [ 1187.479183][ T60] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1187.481160][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1187.595869][ T5776] __nla_validate_parse: 8 callbacks suppressed [ 1187.595892][ T5776] netlink: 648 bytes leftover after parsing attributes in process `syz.1.14182'. [ 1187.922639][ T5785] netlink: 'syz.0.14188': attribute type 21 has an invalid length. [ 1187.922667][ T5785] netlink: 128 bytes leftover after parsing attributes in process `syz.0.14188'. [ 1187.922754][ T5785] netlink: 3 bytes leftover after parsing attributes in process `syz.0.14188'. [ 1187.955656][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1187.955919][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1187.956190][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1187.956422][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1187.967782][ T5785] macsec1: entered promiscuous mode [ 1188.003673][ T5782] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14187'. [ 1188.327284][ T5790] syzkaller0: entered promiscuous mode [ 1188.327529][ T5790] syzkaller0: entered allmulticast mode [ 1188.752515][ T5799] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1188.752613][ T5799] gretap3: entered promiscuous mode [ 1188.752630][ T5799] gretap3: entered allmulticast mode [ 1189.095884][ T5812] netlink: 'syz.2.14200': attribute type 6 has an invalid length. [ 1189.095908][ T5812] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14200'. [ 1189.185045][ T5809] 8021q: adding VLAN 0 to HW filter on device bond15 [ 1189.485361][ T5824] netlink: 'syz.3.14202': attribute type 21 has an invalid length. [ 1189.485388][ T5824] netlink: 128 bytes leftover after parsing attributes in process `syz.3.14202'. [ 1189.485448][ T5824] netlink: 3 bytes leftover after parsing attributes in process `syz.3.14202'. [ 1189.809613][ T5837] FAULT_INJECTION: forcing a failure. [ 1189.809613][ T5837] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1189.809647][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: syz.2.14205 Not tainted syzkaller #0 PREEMPT(full) [ 1189.809670][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1189.809682][ T5837] Call Trace: [ 1189.809690][ T5837] [ 1189.809699][ T5837] dump_stack_lvl+0xe8/0x150 [ 1189.809734][ T5837] should_fail_ex+0x410/0x560 [ 1189.809764][ T5837] _copy_to_user+0x31/0xb0 [ 1189.809792][ T5837] bpf_verifier_vlog+0x496/0x900 [ 1189.809825][ T5837] verbose+0x11d/0x1a0 [ 1189.809845][ T5837] ? verbose+0x11d/0x1a0 [ 1189.809867][ T5837] ? __pfx_verbose+0x10/0x10 [ 1189.809894][ T5837] ? ktime_get+0x45/0x220 [ 1189.809919][ T5837] print_verification_stats+0x658/0x800 [ 1189.809945][ T5837] ? ktime_get+0x45/0x220 [ 1189.809962][ T5837] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1189.809984][ T5837] ? ktime_get+0x1f5/0x220 [ 1189.810007][ T5837] bpf_check+0x1ce8/0x2ef0 [ 1189.810048][ T5837] ? __pfx_bpf_check+0x10/0x10 [ 1189.810075][ T5837] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1189.810109][ T5837] bpf_prog_load+0x14d6/0x1c20 [ 1189.810146][ T5837] ? __pfx_bpf_prog_load+0x10/0x10 [ 1189.810199][ T5837] __sys_bpf+0xd0d/0xd90 [ 1189.810231][ T5837] ? __pfx___sys_bpf+0x10/0x10 [ 1189.810267][ T5837] ? __fget_files+0x2a/0x420 [ 1189.810320][ T5837] ? ksys_write+0x242/0x270 [ 1189.810352][ T5837] ? __pfx_ksys_write+0x10/0x10 [ 1189.810387][ T5837] __x64_sys_bpf+0xba/0xd0 [ 1189.810411][ T5837] do_syscall_64+0x166/0x520 [ 1189.810437][ T5837] ? trace_irq_disable+0x3b/0x140 [ 1189.810457][ T5837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.810479][ T5837] ? clear_bhb_loop+0x70/0xc0 [ 1189.810504][ T5837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.810524][ T5837] RIP: 0033:0x7f971499e159 [ 1189.810553][ T5837] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1189.810569][ T5837] RSP: 002b:00007f9715842028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1189.810591][ T5837] RAX: ffffffffffffffda RBX: 00007f9714c25fa0 RCX: 00007f971499e159 [ 1189.810606][ T5837] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1189.810619][ T5837] RBP: 00007f9715842090 R08: 0000000000000000 R09: 0000000000000000 [ 1189.810631][ T5837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1189.810643][ T5837] R13: 00007f9714c26038 R14: 00007f9714c25fa0 R15: 00007ffdaf6d6ff8 [ 1189.810675][ T5837] [ 1189.812124][ T5838] netlink: 'syz.1.14206': attribute type 21 has an invalid length. [ 1190.533088][ T5844] syzkaller0: entered promiscuous mode [ 1190.533114][ T5844] syzkaller0: entered allmulticast mode [ 1191.025006][ T5859] netlink: 'syz.3.14214': attribute type 21 has an invalid length. [ 1191.025035][ T5859] netlink: 128 bytes leftover after parsing attributes in process `syz.3.14214'. [ 1191.025100][ T5859] netlink: 3 bytes leftover after parsing attributes in process `syz.3.14214'. [ 1191.085620][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1191.085956][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1191.086239][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1191.086533][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1191.092518][ T5863] netlink: 36 bytes leftover after parsing attributes in process `syz.1.14216'. [ 1191.093045][ T5863] netlink: 'syz.1.14216': attribute type 4 has an invalid length. [ 1191.195042][ T5865] syzkaller0: left promiscuous mode [ 1191.195067][ T5865] syzkaller0: left allmulticast mode [ 1191.427427][ T5870] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1191.793689][ T5885] FAULT_INJECTION: forcing a failure. [ 1191.793689][ T5885] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1191.793724][ T5885] CPU: 0 UID: 0 PID: 5885 Comm: syz.1.14226 Not tainted syzkaller #0 PREEMPT(full) [ 1191.793747][ T5885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1191.793759][ T5885] Call Trace: [ 1191.793768][ T5885] [ 1191.793777][ T5885] dump_stack_lvl+0xe8/0x150 [ 1191.793814][ T5885] should_fail_ex+0x410/0x560 [ 1191.793844][ T5885] prepare_alloc_pages+0x223/0x600 [ 1191.793875][ T5885] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1191.793903][ T5885] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1191.793941][ T5885] ? __pfx_policy_nodemask+0x10/0x10 [ 1191.793972][ T5885] ? __lock_acquire+0x747/0x2de0 [ 1191.793997][ T5885] alloc_pages_mpol+0x21e/0x390 [ 1191.794029][ T5885] folio_alloc_mpol_noprof+0x39/0x160 [ 1191.794059][ T5885] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1191.794088][ T5885] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1191.794124][ T5885] ? lock_acquire+0x115/0x350 [ 1191.794163][ T5885] do_pte_missing+0x173a/0x34b0 [ 1191.794206][ T5885] handle_mm_fault+0x1a53/0x3750 [ 1191.794246][ T5885] ? handle_mm_fault+0xf1/0x3750 [ 1191.794286][ T5885] ? __pfx_handle_mm_fault+0x10/0x10 [ 1191.794333][ T5885] ? __lock_acquire+0x747/0x2de0 [ 1191.794359][ T5885] ? lock_mm_and_find_vma+0xa7/0x340 [ 1191.794393][ T5885] do_user_addr_fault+0x746/0x1340 [ 1191.794433][ T5885] exc_page_fault+0x6a/0xc0 [ 1191.794460][ T5885] asm_exc_page_fault+0x26/0x30 [ 1191.794480][ T5885] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 1191.794501][ T5885] Code: 67 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 67 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1191.794518][ T5885] RSP: 0018:ffffc900050276d8 EFLAGS: 00050206 [ 1191.794537][ T5885] RAX: ffffffff84df4c01 RBX: 0000000000000062 RCX: 0000000000000026 [ 1191.794551][ T5885] RDX: 0000000000000000 RSI: ffff8880691a08e8 RDI: 000020000000d000 [ 1191.794564][ T5885] RBP: dffffc0000000000 R08: ffff8880691a090d R09: 1ffff1100d234121 [ 1191.794578][ T5885] R10: dffffc0000000000 R11: ffffed100d234122 R12: 000020000000d026 [ 1191.794591][ T5885] R13: 00007ffffffff000 R14: ffff8880691a08ac R15: 000020000000cfc4 [ 1191.794614][ T5885] ? _copy_to_user+0x1/0xb0 [ 1191.794647][ T5885] _copy_to_user+0x8a/0xb0 [ 1191.794674][ T5885] bpf_verifier_vlog+0x496/0x900 [ 1191.794708][ T5885] verbose+0x11d/0x1a0 [ 1191.794736][ T5885] ? verbose+0x11d/0x1a0 [ 1191.794759][ T5885] ? __pfx_verbose+0x10/0x10 [ 1191.794788][ T5885] ? ktime_get+0x45/0x220 [ 1191.794814][ T5885] print_verification_stats+0x658/0x800 [ 1191.794838][ T5885] ? ktime_get+0x45/0x220 [ 1191.794855][ T5885] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1191.794878][ T5885] ? ktime_get+0x1f5/0x220 [ 1191.794901][ T5885] bpf_check+0x1ce8/0x2ef0 [ 1191.794945][ T5885] ? __pfx_bpf_check+0x10/0x10 [ 1191.794971][ T5885] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1191.795002][ T5885] bpf_prog_load+0x14d6/0x1c20 [ 1191.795038][ T5885] ? __pfx_bpf_prog_load+0x10/0x10 [ 1191.795090][ T5885] __sys_bpf+0xd0d/0xd90 [ 1191.795130][ T5885] ? __pfx___sys_bpf+0x10/0x10 [ 1191.795165][ T5885] ? __fget_files+0x2a/0x420 [ 1191.795211][ T5885] ? ksys_write+0x242/0x270 [ 1191.795242][ T5885] ? __pfx_ksys_write+0x10/0x10 [ 1191.795277][ T5885] __x64_sys_bpf+0xba/0xd0 [ 1191.795299][ T5885] do_syscall_64+0x166/0x520 [ 1191.795322][ T5885] ? trace_irq_disable+0x3b/0x140 [ 1191.795341][ T5885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1191.795361][ T5885] ? clear_bhb_loop+0x70/0xc0 [ 1191.795386][ T5885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1191.795406][ T5885] RIP: 0033:0x7f72ef59e159 [ 1191.795424][ T5885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1191.795440][ T5885] RSP: 002b:00007f72f03d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1191.795460][ T5885] RAX: ffffffffffffffda RBX: 00007f72ef825fa0 RCX: 00007f72ef59e159 [ 1191.795474][ T5885] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 1191.795486][ T5885] RBP: 00007f72f03d0090 R08: 0000000000000000 R09: 0000000000000000 [ 1191.795498][ T5885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1191.795510][ T5885] R13: 00007f72ef826038 R14: 00007f72ef825fa0 R15: 00007ffe5095abb8 [ 1191.795543][ T5885] [ 1192.531082][ T5895] netlink: 'syz.4.14229': attribute type 21 has an invalid length. [ 1192.592770][ T5899] netlink: 'syz.1.14231': attribute type 4 has an invalid length. [ 1192.695943][ T5899] __nla_validate_parse: 4 callbacks suppressed [ 1192.695967][ T5899] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14231'. [ 1192.735495][ T5903] syzkaller1: entered allmulticast mode [ 1192.760648][ T5905] netlink: 'syz.3.14236': attribute type 10 has an invalid length. [ 1192.764127][ T5905] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1192.774063][ T5903] bond0: (slave veth1_to_hsr): Device is not bonding slave [ 1192.774087][ T5903] bond0: option active_slave: invalid value (veth1_to_hsr) [ 1192.851410][ T5905] netlink: NAT attribute type 1 has unexpected length (3 != 0) [ 1192.851453][ T5905] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1193.241236][ T1156] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1193.241663][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1193.840918][ T5936] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1193.840966][ T5936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1193.867606][ T5936] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1193.867685][ T5936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1193.915411][ T5936] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1193.915459][ T5936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1193.959443][ T5942] netlink: 'syz.4.14249': attribute type 4 has an invalid length. [ 1193.959467][ T5942] netlink: 152 bytes leftover after parsing attributes in process `syz.4.14249'. [ 1194.028841][ T5936] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1194.028898][ T5936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14246'. [ 1194.161747][ T5951] netlink: 'syz.1.14250': attribute type 7 has an invalid length. [ 1194.161770][ T5951] netlink: 'syz.1.14250': attribute type 8 has an invalid length. [ 1194.200375][ T5951] bridge0: entered promiscuous mode [ 1194.204053][ T5951] ip6gretap0: entered promiscuous mode [ 1194.221486][ T5951] 0XD: entered promiscuous mode [ 1194.224637][ T5951] debugfs: 'hsr0' already exists in 'hsr' [ 1194.224662][ T5951] Cannot create hsr debugfs directory [ 1194.224723][ T5951] hsr0: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 1194.890862][ T5962] syzkaller0: entered promiscuous mode [ 1194.890888][ T5962] syzkaller0: entered allmulticast mode [ 1195.031365][ T5970] netlink: 'syz.3.14257': attribute type 21 has an invalid length. [ 1195.405828][ T5987] bond0: (slave bond_slave_1): Device is not bonding slave [ 1195.405853][ T5987] bond0: option active_slave: invalid value (bond_slave_1) [ 1196.318297][ T6010] net_ratelimit: 6 callbacks suppressed [ 1196.318320][ T6010] netlink: Conntrack attr has 8 unknown bytes [ 1196.318350][ T6010] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1197.475640][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1197.475929][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1197.476210][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1198.286646][ T1158] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1198.287014][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1198.355149][ T6072] __nla_validate_parse: 116 callbacks suppressed [ 1198.355173][ T6072] netlink: 292 bytes leftover after parsing attributes in process `syz.0.14292'. [ 1198.355945][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1198.420527][ T6075] netlink: 4108 bytes leftover after parsing attributes in process `syz.4.14294'. [ 1198.493720][ T6069] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1198.841413][ T6089] netlink: 'syz.3.14297': attribute type 2 has an invalid length. [ 1198.841439][ T6089] netlink: 40 bytes leftover after parsing attributes in process `syz.3.14297'. [ 1198.927918][ T6098] netlink: 'syz.1.14299': attribute type 1 has an invalid length. [ 1198.927942][ T6098] netlink: 'syz.1.14299': attribute type 2 has an invalid length. [ 1198.927954][ T6098] netlink: 'syz.1.14299': attribute type 3 has an invalid length. [ 1198.927965][ T6098] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14299'. [ 1199.021724][ T6100] netlink: 260 bytes leftover after parsing attributes in process `syz.1.14299'. [ 1199.156913][ T6104] netlink: 'syz.1.14299': attribute type 1 has an invalid length. [ 1199.156938][ T6104] netlink: 'syz.1.14299': attribute type 2 has an invalid length. [ 1199.156950][ T6104] netlink: 'syz.1.14299': attribute type 3 has an invalid length. [ 1199.156963][ T6104] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14299'. [ 1199.183969][ T6106] netlink: 260 bytes leftover after parsing attributes in process `syz.1.14299'. [ 1199.260693][ T6114] syzkaller0: entered promiscuous mode [ 1199.260717][ T6114] syzkaller0: entered allmulticast mode [ 1199.644225][ T6125] A link change request failed with some changes committed already. Interface 00XD may have been left with an inconsistent configuration, please check. [ 1200.271819][ T6144] netlink: 12 bytes leftover after parsing attributes in process `syz.4.14311'. [ 1200.445129][ T6144] netlink: 68 bytes leftover after parsing attributes in process `syz.4.14311'. [ 1200.461691][ T6144] netlink: 36 bytes leftover after parsing attributes in process `syz.4.14311'. [ 1200.474830][ T6150] netlink: 'syz.1.14314': attribute type 17 has an invalid length. [ 1200.741425][ T6157] sctp: [Deprecated]: syz.3.14315 (pid 6157) Use of int in maxseg socket option. [ 1200.741425][ T6157] Use struct sctp_assoc_value instead [ 1201.354604][ T6177] bridge_slave_1: entered promiscuous mode [ 1201.444248][ T6177] bridge_slave_1 (unregistering): left promiscuous mode [ 1201.659210][ T6185] net_ratelimit: 5 callbacks suppressed [ 1201.659234][ T6185] A link change request failed with some changes committed already. Interface 00XD may have been left with an inconsistent configuration, please check. [ 1202.582797][ T6211] syzkaller0: entered allmulticast mode [ 1202.631238][ T6212] netlink: 'syz.4.14333': attribute type 4 has an invalid length. [ 1203.252659][ T6226] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1203.396183][T30909] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1203.396565][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1203.479572][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 1203.798671][ T6241] __nla_validate_parse: 10 callbacks suppressed [ 1203.798697][ T6241] netlink: 64985 bytes leftover after parsing attributes in process `syz.0.14343'. [ 1203.956711][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1203.956975][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1203.957234][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1204.051266][ T6243] bond12: entered promiscuous mode [ 1204.051870][ T6243] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1204.078624][ T6256] FAULT_INJECTION: forcing a failure. [ 1204.078624][ T6256] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1204.078660][ T6256] CPU: 0 UID: 0 PID: 6256 Comm: syz.1.14350 Not tainted syzkaller #0 PREEMPT(full) [ 1204.078682][ T6256] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1204.078694][ T6256] Call Trace: [ 1204.078703][ T6256] [ 1204.078712][ T6256] dump_stack_lvl+0xe8/0x150 [ 1204.078746][ T6256] should_fail_ex+0x410/0x560 [ 1204.078775][ T6256] _copy_from_iter+0x1d3/0x1660 [ 1204.078808][ T6256] ? __alloc_skb+0x27a/0x7a0 [ 1204.078835][ T6256] ? __alloc_skb+0x27a/0x7a0 [ 1204.078860][ T6256] ? __alloc_skb+0x27a/0x7a0 [ 1204.078883][ T6256] ? __pfx__copy_from_iter+0x10/0x10 [ 1204.078903][ T6256] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1204.078932][ T6256] ? __alloc_skb+0x27a/0x7a0 [ 1204.078952][ T6256] ? __alloc_skb+0x27a/0x7a0 [ 1204.078981][ T6256] ? netlink_sendmsg+0x650/0xb40 [ 1204.079000][ T6256] ? skb_put+0x112/0x210 [ 1204.079027][ T6256] netlink_sendmsg+0x6c0/0xb40 [ 1204.079056][ T6256] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1204.079085][ T6256] ? apparmor_socket_sendmsg+0x98/0x360 [ 1204.079110][ T6256] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1204.079128][ T6256] sock_sendmsg_nosec+0x13a/0x180 [ 1204.079153][ T6256] ____sys_sendmsg+0x54e/0x850 [ 1204.079186][ T6256] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1204.079226][ T6256] ? import_iovec+0x73/0xa0 [ 1204.079253][ T6256] ___sys_sendmsg+0x2a5/0x360 [ 1204.079277][ T6256] ? __lock_acquire+0x747/0x2de0 [ 1204.079303][ T6256] ? __pfx____sys_sendmsg+0x10/0x10 [ 1204.079367][ T6256] ? __fget_files+0x2a/0x420 [ 1204.079392][ T6256] ? __fget_files+0x3a2/0x420 [ 1204.079428][ T6256] __x64_sys_sendmsg+0x1b1/0x290 [ 1204.079458][ T6256] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1204.079507][ T6256] do_syscall_64+0x166/0x520 [ 1204.079531][ T6256] ? trace_irq_disable+0x3b/0x140 [ 1204.079550][ T6256] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1204.079570][ T6256] ? clear_bhb_loop+0x70/0xc0 [ 1204.079594][ T6256] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1204.079613][ T6256] RIP: 0033:0x7f72ef59e159 [ 1204.079633][ T6256] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1204.079649][ T6256] RSP: 002b:00007f72f03d0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1204.079671][ T6256] RAX: ffffffffffffffda RBX: 00007f72ef825fa0 RCX: 00007f72ef59e159 [ 1204.079685][ T6256] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1204.079697][ T6256] RBP: 00007f72f03d0090 R08: 0000000000000000 R09: 0000000000000000 [ 1204.079709][ T6256] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1204.079720][ T6256] R13: 00007f72ef826038 R14: 00007f72ef825fa0 R15: 00007ffe5095abb8 [ 1204.079752][ T6256] [ 1204.091149][ T6254] Bluetooth: hci0: invalid length 0, exp 1 for type 31 [ 1204.331321][ T6249] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1204.338153][ T6249] bond12: (slave wireguard1): The slave device specified does not support setting the MAC address [ 1204.352216][ T6249] bond12: (slave wireguard1): Error -95 calling set_mac_address [ 1204.776768][ T6275] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14354'. [ 1204.776807][ T6275] netlink: 'syz.1.14354': attribute type 7 has an invalid length. [ 1204.776821][ T6275] netlink: 'syz.1.14354': attribute type 8 has an invalid length. [ 1204.776834][ T6275] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14354'. [ 1205.345195][ T6259] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1205.718970][ T6281] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1205.734095][ T6284] FAULT_INJECTION: forcing a failure. [ 1205.734095][ T6284] name failslab, interval 1, probability 0, space 0, times 0 [ 1205.734129][ T6284] CPU: 1 UID: 0 PID: 6284 Comm: syz.0.14358 Not tainted syzkaller #0 PREEMPT(full) [ 1205.734148][ T6284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1205.734159][ T6284] Call Trace: [ 1205.734166][ T6284] [ 1205.734175][ T6284] dump_stack_lvl+0xe8/0x150 [ 1205.734207][ T6284] should_fail_ex+0x410/0x560 [ 1205.734233][ T6284] ? alloc_vmap_area+0x21c/0x1420 [ 1205.734257][ T6284] should_failslab+0xa8/0x100 [ 1205.734279][ T6284] ? alloc_vmap_area+0x21c/0x1420 [ 1205.734300][ T6284] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1205.734330][ T6284] ? alloc_vmap_area+0x21c/0x1420 [ 1205.734360][ T6284] alloc_vmap_area+0x21c/0x1420 [ 1205.734399][ T6284] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1205.734420][ T6284] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 1205.734439][ T6284] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 1205.734469][ T6284] ? __get_vm_area_node+0x155/0x2f0 [ 1205.734498][ T6284] __get_vm_area_node+0x200/0x2f0 [ 1205.734529][ T6284] __vmalloc_node_range_noprof+0x343/0x1540 [ 1205.734555][ T6284] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.734575][ T6284] ? __lock_acquire+0x747/0x2de0 [ 1205.734623][ T6284] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1205.734658][ T6284] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.734676][ T6284] __vmalloc_noprof+0xd2/0x120 [ 1205.734701][ T6284] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.734724][ T6284] bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.734747][ T6284] ? bpf_prog_alloc+0x2a/0x1a0 [ 1205.734769][ T6284] bpf_prog_alloc+0x3c/0x1a0 [ 1205.734792][ T6284] bpf_prog_load+0x7f8/0x1c20 [ 1205.734826][ T6284] ? __pfx_bpf_prog_load+0x10/0x10 [ 1205.734876][ T6284] __sys_bpf+0xd0d/0xd90 [ 1205.734905][ T6284] ? __pfx___sys_bpf+0x10/0x10 [ 1205.734937][ T6284] ? __fget_files+0x2a/0x420 [ 1205.734980][ T6284] ? ksys_write+0x242/0x270 [ 1205.735008][ T6284] ? __pfx_ksys_write+0x10/0x10 [ 1205.735039][ T6284] __x64_sys_bpf+0xba/0xd0 [ 1205.735061][ T6284] do_syscall_64+0x166/0x520 [ 1205.735083][ T6284] ? trace_irq_disable+0x3b/0x140 [ 1205.735101][ T6284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1205.735120][ T6284] ? clear_bhb_loop+0x70/0xc0 [ 1205.735142][ T6284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1205.735161][ T6284] RIP: 0033:0x7fbb51b9e159 [ 1205.735179][ T6284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1205.735194][ T6284] RSP: 002b:00007fbb4fdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1205.735215][ T6284] RAX: ffffffffffffffda RBX: 00007fbb51e25fa0 RCX: 00007fbb51b9e159 [ 1205.735228][ T6284] RDX: 0000000000000094 RSI: 00002000000044c0 RDI: 0000000000000005 [ 1205.735240][ T6284] RBP: 00007fbb4fdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1205.735251][ T6284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1205.735262][ T6284] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1205.735294][ T6284] [ 1205.745388][ T6284] warn_alloc: 1 callbacks suppressed [ 1205.745405][ T6284] syz.0.14358: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1205.745472][ T6284] CPU: 1 UID: 0 PID: 6284 Comm: syz.0.14358 Not tainted syzkaller #0 PREEMPT(full) [ 1205.745491][ T6284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1205.745502][ T6284] Call Trace: [ 1205.745509][ T6284] [ 1205.745517][ T6284] dump_stack_lvl+0xe8/0x150 [ 1205.745546][ T6284] warn_alloc+0x24d/0x270 [ 1205.745567][ T6284] ? lockdep_hardirqs_on+0x7b/0x110 [ 1205.745593][ T6284] ? __pfx_warn_alloc+0x10/0x10 [ 1205.745610][ T6284] ? kfree+0x1c5/0x650 [ 1205.745634][ T6284] ? __get_vm_area_node+0x219/0x2f0 [ 1205.745667][ T6284] __vmalloc_node_range_noprof+0x36b/0x1540 [ 1205.745693][ T6284] ? __lock_acquire+0x747/0x2de0 [ 1205.745736][ T6284] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1205.745771][ T6284] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.745790][ T6284] __vmalloc_noprof+0xd2/0x120 [ 1205.745815][ T6284] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.745837][ T6284] bpf_prog_alloc_no_stats+0x47/0x560 [ 1205.745856][ T6284] ? bpf_prog_alloc+0x2a/0x1a0 [ 1205.745877][ T6284] bpf_prog_alloc+0x3c/0x1a0 [ 1205.745900][ T6284] bpf_prog_load+0x7f8/0x1c20 [ 1205.745932][ T6284] ? __pfx_bpf_prog_load+0x10/0x10 [ 1205.745979][ T6284] __sys_bpf+0xd0d/0xd90 [ 1205.746007][ T6284] ? __pfx___sys_bpf+0x10/0x10 [ 1205.746038][ T6284] ? __fget_files+0x2a/0x420 [ 1205.746080][ T6284] ? ksys_write+0x242/0x270 [ 1205.746109][ T6284] ? __pfx_ksys_write+0x10/0x10 [ 1205.746140][ T6284] __x64_sys_bpf+0xba/0xd0 [ 1205.746162][ T6284] do_syscall_64+0x166/0x520 [ 1205.746183][ T6284] ? trace_irq_disable+0x3b/0x140 [ 1205.746201][ T6284] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1205.746220][ T6284] ? clear_bhb_loop+0x70/0xc0 [ 1205.746242][ T6284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1205.746259][ T6284] RIP: 0033:0x7fbb51b9e159 [ 1205.746278][ T6284] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1205.746292][ T6284] RSP: 002b:00007fbb4fdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1205.746311][ T6284] RAX: ffffffffffffffda RBX: 00007fbb51e25fa0 RCX: 00007fbb51b9e159 [ 1205.746324][ T6284] RDX: 0000000000000094 RSI: 00002000000044c0 RDI: 0000000000000005 [ 1205.746335][ T6284] RBP: 00007fbb4fdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1205.746347][ T6284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1205.746358][ T6284] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1205.746389][ T6284] [ 1205.746396][ T6284] Mem-Info: [ 1205.746406][ T6284] active_anon:5467 inactive_anon:0 isolated_anon:0 [ 1205.746406][ T6284] active_file:3 inactive_file:43951 isolated_file:0 [ 1205.746406][ T6284] unevictable:0 dirty:151 writeback:0 [ 1205.746406][ T6284] slab_reclaimable:11878 slab_unreclaimable:113200 [ 1205.746406][ T6284] mapped:29415 shmem:530 pagetables:3472 [ 1205.746406][ T6284] sec_pagetables:0 bounce:0 [ 1205.746406][ T6284] kernel_misc_reclaimable:0 [ 1205.746406][ T6284] free:1302431 free_pcp:10099 free_cma:0 [ 1205.746449][ T6284] Node 0 active_anon:21868kB inactive_anon:0kB active_file:12kB inactive_file:175608kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:117660kB dirty:604kB writeback:0kB shmem:2120kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14700kB pagetables:13720kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1205.746504][ T6284] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:168kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1205.746547][ T6284] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1205.746595][ T6284] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 1205.746630][ T6284] Node 0 DMA32 free:1253916kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:21868kB inactive_anon:0kB active_file:12kB inactive_file:175608kB unevictable:0kB writepending:604kB zspages:0kB present:3129332kB managed:2546900kB mlocked:0kB bounce:0kB free_pcp:35108kB local_pcp:20012kB free_cma:0kB [ 1205.746682][ T6284] lowmem_reserve[]: 0 0 0 0 0 [ 1205.746713][ T6284] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1205.746760][ T6284] lowmem_reserve[]: 0 0 0 0 0 [ 1205.746791][ T6284] Node 1 Normal free:3940448kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:5288kB local_pcp:0kB free_cma:0kB [ 1205.746841][ T6284] lowmem_reserve[]: 0 0 0 0 0 [ 1205.746872][ T6284] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1205.746977][ T6284] Node 0 DMA32: 935*4kB (UM) 62*8kB (UM) 55*16kB (UME) 383*32kB (UME) 489*64kB (UM) 490*128kB (UM) 371*256kB (UM) 256*512kB (UM) 109*1024kB (UM) 11*2048kB (UM) 191*4096kB (UM) = 1253916kB [ 1205.747123][ T6284] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1205.747213][ T6284] Node 1 Normal: 2*4kB (UM) 1*8kB (M) 1*16kB (M) 2*32kB (UM) 2*64kB (UM) 1*128kB (M) 3*256kB (UM) 2*512kB (M) 2*1024kB (UM) 0*2048kB 961*4096kB (UM) = 3940448kB [ 1205.747348][ T6284] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1205.747363][ T6284] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1205.747377][ T6284] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1205.747391][ T6284] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1205.759902][ T6284] 44480 total pagecache pages [ 1205.759916][ T6284] 0 pages in swap cache [ 1205.759922][ T6284] Free swap = 124996kB [ 1205.759929][ T6284] Total swap = 124996kB [ 1205.759938][ T6284] 2097051 pages RAM [ 1205.759945][ T6284] 0 pages HighMem/MovableOnly [ 1205.759953][ T6284] 428710 pages reserved [ 1205.759960][ T6284] 0 pages cma reserved [ 1206.606280][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1206.808892][ T6285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14356'. [ 1207.085670][ C1] net_ratelimit: 1 callbacks suppressed [ 1207.085697][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.085972][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.086231][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.086498][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.086741][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1207.269004][ T6298] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14363'. [ 1207.864092][ T6319] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14373'. [ 1207.887541][ T6319] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1208.062539][ T6333] FAULT_INJECTION: forcing a failure. [ 1208.062539][ T6333] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1208.062574][ T6333] CPU: 0 UID: 0 PID: 6333 Comm: syz.4.14377 Not tainted syzkaller #0 PREEMPT(full) [ 1208.062598][ T6333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1208.062611][ T6333] Call Trace: [ 1208.062620][ T6333] [ 1208.062630][ T6333] dump_stack_lvl+0xe8/0x150 [ 1208.062665][ T6333] should_fail_ex+0x410/0x560 [ 1208.062694][ T6333] prepare_alloc_pages+0x223/0x600 [ 1208.062724][ T6333] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1208.062752][ T6333] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1208.062781][ T6333] ? __pfx_policy_nodemask+0x10/0x10 [ 1208.062819][ T6333] alloc_pages_mpol+0x21e/0x390 [ 1208.062850][ T6333] alloc_pages_noprof+0xb1/0x2b0 [ 1208.062878][ T6333] get_free_pages_noprof+0xf/0x80 [ 1208.062911][ T6333] __kasan_populate_vmalloc+0x38/0x1c0 [ 1208.062931][ T6333] ? do_raw_spin_unlock+0xf5/0x200 [ 1208.062964][ T6333] alloc_vmap_area+0xd1a/0x1420 [ 1208.063008][ T6333] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1208.063033][ T6333] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 1208.063056][ T6333] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 1208.063078][ T6333] ? __get_vm_area_node+0x155/0x2f0 [ 1208.063111][ T6333] __get_vm_area_node+0x200/0x2f0 [ 1208.063148][ T6333] __vmalloc_node_range_noprof+0x343/0x1540 [ 1208.063178][ T6333] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1208.063201][ T6333] ? __lock_acquire+0x747/0x2de0 [ 1208.063249][ T6333] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1208.063292][ T6333] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1208.063315][ T6333] __vmalloc_noprof+0xd2/0x120 [ 1208.063342][ T6333] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 1208.063368][ T6333] bpf_prog_alloc_no_stats+0x47/0x560 [ 1208.063390][ T6333] ? bpf_prog_alloc+0x2a/0x1a0 [ 1208.063415][ T6333] bpf_prog_alloc+0x3c/0x1a0 [ 1208.063441][ T6333] bpf_prog_load+0x7f8/0x1c20 [ 1208.063478][ T6333] ? __pfx_bpf_prog_load+0x10/0x10 [ 1208.063528][ T6333] __sys_bpf+0xd0d/0xd90 [ 1208.063560][ T6333] ? __pfx___sys_bpf+0x10/0x10 [ 1208.063594][ T6333] ? __fget_files+0x2a/0x420 [ 1208.063640][ T6333] ? ksys_write+0x242/0x270 [ 1208.063670][ T6333] ? __pfx_ksys_write+0x10/0x10 [ 1208.063704][ T6333] __x64_sys_bpf+0xba/0xd0 [ 1208.063728][ T6333] do_syscall_64+0x166/0x520 [ 1208.063753][ T6333] ? trace_irq_disable+0x3b/0x140 [ 1208.063773][ T6333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1208.063793][ T6333] ? clear_bhb_loop+0x70/0xc0 [ 1208.063818][ T6333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1208.063837][ T6333] RIP: 0033:0x7feabef9e159 [ 1208.063858][ T6333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1208.063874][ T6333] RSP: 002b:00007feabd1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1208.063906][ T6333] RAX: ffffffffffffffda RBX: 00007feabf225fa0 RCX: 00007feabef9e159 [ 1208.063920][ T6333] RDX: 0000000000000094 RSI: 00002000000044c0 RDI: 0000000000000005 [ 1208.063933][ T6333] RBP: 00007feabd1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1208.063946][ T6333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1208.063958][ T6333] R13: 00007feabf226038 R14: 00007feabf225fa0 R15: 00007ffd87d9a3f8 [ 1208.063991][ T6333] [ 1208.194589][ T6334] netlink: 28 bytes leftover after parsing attributes in process `syz.3.14374'. [ 1208.194627][ T6334] netlink: 'syz.3.14374': attribute type 7 has an invalid length. [ 1208.194640][ T6334] netlink: 'syz.3.14374': attribute type 8 has an invalid length. [ 1208.194652][ T6334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14374'. [ 1208.545783][ T6339] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14379'. [ 1209.245065][ T1156] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1209.245502][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1209.360386][ T6364] : renamed from bond_slave_0 (while UP) [ 1209.483126][ T6383] 8021q: adding VLAN 0 to HW filter on device .` [ 1209.523900][ T6380] netlink: 'syz.0.14392': attribute type 4 has an invalid length. [ 1209.557143][ T6383] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1209.602288][ T6383] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1209.714711][ T6384] bond12: entered promiscuous mode [ 1209.719895][ T6384] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1209.787067][ T6386] 0XD: left allmulticast mode [ 1209.807324][ T6386] .`: left allmulticast mode [ 1209.830464][ T6386] bond_slave_0: left allmulticast mode [ 1209.863402][ T6386] vlan0: left allmulticast mode [ 1209.863428][ T6386] veth0_vlan: left allmulticast mode [ 1210.022406][ T6386] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1210.089130][ T6389] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1210.094382][ T6389] bond12: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1210.130007][ T6389] bond12: (slave wireguard0): Error -95 calling set_mac_address [ 1210.261465][ T6392] syzkaller1: entered promiscuous mode [ 1210.261494][ T6392] syzkaller1: entered allmulticast mode [ 1210.491895][ T6406] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14397'. [ 1210.491938][ T6406] netlink: 'syz.1.14397': attribute type 7 has an invalid length. [ 1210.491953][ T6406] netlink: 'syz.1.14397': attribute type 8 has an invalid length. [ 1210.491967][ T6406] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14397'. [ 1210.807420][ T6418] ip6t_hbh: too many supported opts specified [ 1211.095214][ T6420] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1211.227325][ T6422] netlink: 8 bytes leftover after parsing attributes in process `syz.3.14404'. [ 1211.752339][ T6446] FAULT_INJECTION: forcing a failure. [ 1211.752339][ T6446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1211.752376][ T6446] CPU: 0 UID: 0 PID: 6446 Comm: syz.3.14413 Not tainted syzkaller #0 PREEMPT(full) [ 1211.752398][ T6446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1211.752410][ T6446] Call Trace: [ 1211.752420][ T6446] [ 1211.752430][ T6446] dump_stack_lvl+0xe8/0x150 [ 1211.752464][ T6446] should_fail_ex+0x410/0x560 [ 1211.752494][ T6446] _copy_from_user+0x2d/0xb0 [ 1211.752521][ T6446] do_sock_getsockopt+0x200/0x7e0 [ 1211.752556][ T6446] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1211.752605][ T6446] ? __fget_files+0x3a2/0x420 [ 1211.752632][ T6446] ? __fget_files+0x2a/0x420 [ 1211.752665][ T6446] __x64_sys_getsockopt+0x1a4/0x240 [ 1211.752702][ T6446] do_syscall_64+0x166/0x520 [ 1211.752727][ T6446] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1211.752748][ T6446] ? clear_bhb_loop+0x70/0xc0 [ 1211.752773][ T6446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1211.752792][ T6446] RIP: 0033:0x7f97eab9e159 [ 1211.752812][ T6446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1211.752830][ T6446] RSP: 002b:00007f97eb9ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1211.752852][ T6446] RAX: ffffffffffffffda RBX: 00007f97eae25fa0 RCX: 00007f97eab9e159 [ 1211.752868][ T6446] RDX: 000000000000271c RSI: 0000200000000114 RDI: 0000000000000003 [ 1211.752880][ T6446] RBP: 00007f97eb9ca090 R08: 0000200000000000 R09: 0000000000000000 [ 1211.752893][ T6446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1211.752906][ T6446] R13: 00007f97eae26038 R14: 00007f97eae25fa0 R15: 00007ffda30d2da8 [ 1211.752939][ T6446] [ 1212.260015][ T6457] FAULT_INJECTION: forcing a failure. [ 1212.260015][ T6457] name failslab, interval 1, probability 0, space 0, times 0 [ 1212.260052][ T6457] CPU: 1 UID: 0 PID: 6457 Comm: syz.2.14418 Not tainted syzkaller #0 PREEMPT(full) [ 1212.260076][ T6457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1212.260088][ T6457] Call Trace: [ 1212.260096][ T6457] [ 1212.260106][ T6457] dump_stack_lvl+0xe8/0x150 [ 1212.260144][ T6457] should_fail_ex+0x410/0x560 [ 1212.260175][ T6457] should_failslab+0xa8/0x100 [ 1212.260201][ T6457] ? skb_clone+0x212/0x3a0 [ 1212.260268][ T6457] kmem_cache_alloc_noprof+0xa1/0x600 [ 1212.260302][ T6457] ? skb_clone+0x212/0x3a0 [ 1212.260338][ T6457] skb_clone+0x212/0x3a0 [ 1212.260372][ T6457] __netlink_deliver_tap+0x413/0x860 [ 1212.260406][ T6457] ? netlink_deliver_tap+0x2e/0x1b0 [ 1212.260434][ T6457] netlink_deliver_tap+0x19c/0x1b0 [ 1212.260456][ T6457] netlink_unicast+0x781/0x940 [ 1212.260500][ T6457] netlink_sendmsg+0x813/0xb40 [ 1212.260532][ T6457] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1212.260563][ T6457] ? apparmor_socket_sendmsg+0x98/0x360 [ 1212.260590][ T6457] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1212.260609][ T6457] sock_sendmsg_nosec+0x13a/0x180 [ 1212.260636][ T6457] __sys_sendto+0x408/0x5a0 [ 1212.260661][ T6457] ? ksys_write+0x1e6/0x270 [ 1212.260696][ T6457] ? __pfx___sys_sendto+0x10/0x10 [ 1212.260718][ T6457] ? __mutex_unlock_slowpath+0x731/0x900 [ 1212.260778][ T6457] ? __pfx_ksys_write+0x10/0x10 [ 1212.260815][ T6457] __x64_sys_sendto+0xde/0x100 [ 1212.260845][ T6457] do_syscall_64+0x166/0x520 [ 1212.260870][ T6457] ? trace_irq_disable+0x3b/0x140 [ 1212.260891][ T6457] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.260913][ T6457] ? clear_bhb_loop+0x70/0xc0 [ 1212.260939][ T6457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.260957][ T6457] RIP: 0033:0x7f971499e159 [ 1212.260977][ T6457] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1212.260995][ T6457] RSP: 002b:00007f9715842028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1212.261018][ T6457] RAX: ffffffffffffffda RBX: 00007f9714c25fa0 RCX: 00007f971499e159 [ 1212.261033][ T6457] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000003 [ 1212.261046][ T6457] RBP: 00007f9715842090 R08: 0000000000000000 R09: 0000000000000000 [ 1212.261059][ T6457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1212.261072][ T6457] R13: 00007f9714c26038 R14: 00007f9714c25fa0 R15: 00007ffdaf6d6ff8 [ 1212.261108][ T6457] [ 1212.389132][ T6462] FAULT_INJECTION: forcing a failure. [ 1212.389132][ T6462] name failslab, interval 1, probability 0, space 0, times 0 [ 1212.389165][ T6462] CPU: 0 UID: 0 PID: 6462 Comm: syz.3.14420 Not tainted syzkaller #0 PREEMPT(full) [ 1212.389188][ T6462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1212.389200][ T6462] Call Trace: [ 1212.389209][ T6462] [ 1212.389218][ T6462] dump_stack_lvl+0xe8/0x150 [ 1212.389253][ T6462] should_fail_ex+0x410/0x560 [ 1212.389286][ T6462] should_failslab+0xa8/0x100 [ 1212.389315][ T6462] __kmalloc_noprof+0xfe/0x720 [ 1212.389333][ T6462] ? __mutex_trylock_common+0x15f/0x270 [ 1212.389358][ T6462] ? ioctl_standard_iw_point+0x542/0xdc0 [ 1212.389610][ T6462] ? ioctl_standard_iw_point+0x542/0xdc0 [ 1212.389640][ T6462] ioctl_standard_iw_point+0x542/0xdc0 [ 1212.389662][ T6462] ? trace_contention_end+0x3d/0x140 [ 1212.389698][ T6462] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1212.389766][ T6462] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 1212.389785][ T6462] ? wext_ioctl_dispatch+0xa2/0x410 [ 1212.389807][ T6462] ? __pfx___mutex_lock+0x10/0x10 [ 1212.389844][ T6462] ioctl_standard_call+0xa6/0x160 [ 1212.389863][ T6462] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1212.389887][ T6462] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1212.389907][ T6462] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1212.389931][ T6462] wext_ioctl_dispatch+0xee/0x410 [ 1212.389948][ T6462] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1212.389971][ T6462] wext_handle_ioctl+0x110/0x1d0 [ 1212.389993][ T6462] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1212.390011][ T6462] ? hook_file_ioctl+0x1f2/0x600 [ 1212.390078][ T6462] sock_ioctl+0x159/0x7e0 [ 1212.390101][ T6462] ? __pfx_sock_ioctl+0x10/0x10 [ 1212.390120][ T6462] ? __fget_files+0x2a/0x420 [ 1212.390144][ T6462] ? __fget_files+0x3a2/0x420 [ 1212.390167][ T6462] ? __fget_files+0x2a/0x420 [ 1212.390201][ T6462] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1212.390226][ T6462] ? __pfx_sock_ioctl+0x10/0x10 [ 1212.390246][ T6462] __se_sys_ioctl+0xfc/0x170 [ 1212.390270][ T6462] do_syscall_64+0x166/0x520 [ 1212.390291][ T6462] ? trace_irq_disable+0x3b/0x140 [ 1212.390310][ T6462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.390329][ T6462] ? clear_bhb_loop+0x70/0xc0 [ 1212.390353][ T6462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1212.390371][ T6462] RIP: 0033:0x7f97eab9e159 [ 1212.390391][ T6462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1212.390406][ T6462] RSP: 002b:00007f97eb9ca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1212.390428][ T6462] RAX: ffffffffffffffda RBX: 00007f97eae25fa0 RCX: 00007f97eab9e159 [ 1212.390451][ T6462] RDX: 0000200000000040 RSI: 0000000000008b1a RDI: 0000000000000003 [ 1212.390463][ T6462] RBP: 00007f97eb9ca090 R08: 0000000000000000 R09: 0000000000000000 [ 1212.390475][ T6462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1212.390487][ T6462] R13: 00007f97eae26038 R14: 00007f97eae25fa0 R15: 00007ffda30d2da8 [ 1212.390520][ T6462] [ 1212.942010][ T6475] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14426'. [ 1213.216828][ T6487] net_ratelimit: 6 callbacks suppressed [ 1213.216852][ T6487] openvswitch: netlink: IPv4 tun info is not correct [ 1213.395688][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1213.395990][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1213.396231][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1213.396465][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1213.462715][ T6494] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14434'. [ 1213.462741][ T6494] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14434'. [ 1213.463719][ T6494] netlink: 'syz.2.14434': attribute type 4 has an invalid length. [ 1213.463737][ T6494] netlink: 152 bytes leftover after parsing attributes in process `syz.2.14434'. [ 1213.774768][ T6507] netlink: 'syz.3.14440': attribute type 1 has an invalid length. [ 1213.774797][ T6507] netlink: 'syz.3.14440': attribute type 2 has an invalid length. [ 1213.807638][ T6508] netlink: 'syz.3.14440': attribute type 17 has an invalid length. [ 1213.807975][ T6507] netlink: 'syz.3.14440': attribute type 4 has an invalid length. [ 1214.089570][ T6519] netlink: 'syz.2.14444': attribute type 58 has an invalid length. [ 1214.089595][ T6519] netlink: 20 bytes leftover after parsing attributes in process `syz.2.14444'. [ 1214.288592][ T1158] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1214.288963][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1214.618305][ T6528] A link change request failed with some changes committed already. Interface 00XD may have been left with an inconsistent configuration, please check. [ 1215.171743][ T6550] FAULT_INJECTION: forcing a failure. [ 1215.171743][ T6550] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1215.171778][ T6550] CPU: 1 UID: 0 PID: 6550 Comm: syz.0.14453 Not tainted syzkaller #0 PREEMPT(full) [ 1215.171802][ T6550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1215.171814][ T6550] Call Trace: [ 1215.171824][ T6550] [ 1215.171835][ T6550] dump_stack_lvl+0xe8/0x150 [ 1215.171892][ T6550] should_fail_ex+0x410/0x560 [ 1215.171922][ T6550] _copy_to_user+0x31/0xb0 [ 1215.171954][ T6550] do_sock_getsockopt+0x6ea/0x7e0 [ 1215.171988][ T6550] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1215.172034][ T6550] ? __fget_files+0x3a2/0x420 [ 1215.172063][ T6550] ? __fget_files+0x2a/0x420 [ 1215.172098][ T6550] __x64_sys_getsockopt+0x1a4/0x240 [ 1215.172135][ T6550] do_syscall_64+0x166/0x520 [ 1215.172161][ T6550] ? trace_irq_disable+0x3b/0x140 [ 1215.172183][ T6550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1215.172204][ T6550] ? clear_bhb_loop+0x70/0xc0 [ 1215.172229][ T6550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1215.172249][ T6550] RIP: 0033:0x7fbb51b9e159 [ 1215.172269][ T6550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1215.172285][ T6550] RSP: 002b:00007fbb4fdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1215.172309][ T6550] RAX: ffffffffffffffda RBX: 00007fbb51e25fa0 RCX: 00007fbb51b9e159 [ 1215.172324][ T6550] RDX: 000000000000271c RSI: 0000200000000114 RDI: 0000000000000003 [ 1215.172337][ T6550] RBP: 00007fbb4fdf6090 R08: 0000200000000000 R09: 0000000000000000 [ 1215.172350][ T6550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1215.172363][ T6550] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1215.172398][ T6550] [ 1216.133528][ T6581] netlink: 20 bytes leftover after parsing attributes in process `syz.1.14464'. [ 1216.409655][ T25] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 1216.525686][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1217.005106][ T6600] netlink: 'syz.3.14470': attribute type 4 has an invalid length. [ 1217.005133][ T6600] netlink: 152 bytes leftover after parsing attributes in process `syz.3.14470'. [ 1217.702896][ T6616] netlink: 292 bytes leftover after parsing attributes in process `syz.2.14477'. [ 1218.114134][ T6632] netlink: 'syz.0.14485': attribute type 1 has an invalid length. [ 1218.261615][ T6632] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1218.282891][ T6632] bond10: (slave bond11): making interface the new active one [ 1218.309954][ T6632] bond10: (slave bond11): Enslaving as an active interface with an up link [ 1218.396645][ T6640] bond10: (slave gretap4): Enslaving as a backup interface with an up link [ 1218.473473][ T31] audit: type=1804 audit(1790294927.394:21): pid=6647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.14487" name="/newroot/2947/cgroup.controllers" dev="tmpfs" ino=14843 res=1 errno=0 [ 1218.473536][ T31] audit: type=1800 audit(1790294927.394:22): pid=6647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.14487" name="cgroup.controllers" dev="tmpfs" ino=14843 res=0 errno=0 [ 1218.675091][ T6653] FAULT_INJECTION: forcing a failure. [ 1218.675091][ T6653] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1218.675125][ T6653] CPU: 0 UID: 0 PID: 6653 Comm: syz.1.14490 Not tainted syzkaller #0 PREEMPT(full) [ 1218.675148][ T6653] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1218.675160][ T6653] Call Trace: [ 1218.675169][ T6653] [ 1218.675178][ T6653] dump_stack_lvl+0xe8/0x150 [ 1218.675213][ T6653] should_fail_ex+0x410/0x560 [ 1218.675243][ T6653] _copy_to_user+0x31/0xb0 [ 1218.675272][ T6653] simple_read_from_buffer+0xe1/0x170 [ 1218.675309][ T6653] proc_fail_nth_read+0x1bb/0x230 [ 1218.675328][ T6653] ? common_file_perm+0x20e/0x2b0 [ 1218.675356][ T6653] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1218.675389][ T6653] ? rw_verify_area+0x24a/0x4c0 [ 1218.675419][ T6653] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1218.675438][ T6653] vfs_read+0x213/0xa80 [ 1218.675475][ T6653] ? __pfx_vfs_read+0x10/0x10 [ 1218.675506][ T6653] ? do_sys_openat2+0x14e/0x200 [ 1218.675529][ T6653] ? kmem_cache_free+0x182/0x650 [ 1218.675567][ T6653] ksys_read+0x150/0x270 [ 1218.675599][ T6653] ? __pfx_ksys_read+0x10/0x10 [ 1218.675640][ T6653] do_syscall_64+0x166/0x520 [ 1218.675664][ T6653] ? trace_irq_disable+0x3b/0x140 [ 1218.675685][ T6653] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.675706][ T6653] ? clear_bhb_loop+0x70/0xc0 [ 1218.675730][ T6653] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1218.675751][ T6653] RIP: 0033:0x7f72ef55e98e [ 1218.675771][ T6653] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1218.675786][ T6653] RSP: 002b:00007f72f03cffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1218.675808][ T6653] RAX: ffffffffffffffda RBX: 00007f72f03d06c0 RCX: 00007f72ef55e98e [ 1218.675822][ T6653] RDX: 000000000000000f RSI: 00007f72f03d00a0 RDI: 0000000000000005 [ 1218.675835][ T6653] RBP: 00007f72f03d0090 R08: 0000000000000000 R09: 0000000000000000 [ 1218.675847][ T6653] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1218.675860][ T6653] R13: 00007f72ef826038 R14: 00007f72ef825fa0 R15: 00007ffe5095abb8 [ 1218.675891][ T6653] [ 1218.965967][ T6656] netlink: 292 bytes leftover after parsing attributes in process `syz.1.14494'. [ 1218.966069][ T6656] tunl0: Caught tx_queue_len zero misconfig [ 1219.283757][ T6667] netlink: 'syz.4.14497': attribute type 15 has an invalid length. [ 1219.285136][ T6667] netlink: 24 bytes leftover after parsing attributes in process `syz.4.14497'. [ 1219.580296][ T6673] net_ratelimit: 6 callbacks suppressed [ 1219.580323][ T6673] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1219.635934][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1219.636210][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1219.636455][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1219.757306][ T6683] 0: reclassify loop, rule prio 0, protocol 03 [ 1220.202907][ T6690] bond13: Unable to set peer notification delay as MII monitoring is disabled [ 1220.219397][ T6690] bond13 (unregistering): Released all slaves [ 1220.437576][ T6695] tipc: Bearer : already 2 bearers with priority 10 [ 1220.437602][ T6695] tipc: Bearer : trying with adjusted priority [ 1220.437632][ T6695] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1221.070021][ T6719] xt_hashlimit: size too large, truncated to 1048576 [ 1221.171827][ T6722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14516'. [ 1221.184800][ T6722] netlink: 168 bytes leftover after parsing attributes in process `syz.2.14516'. [ 1221.422515][ T6723] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1221.751996][ T6740] ip6t_hbh: too many supported opts specified [ 1222.589752][ T6757] netlink: 12 bytes leftover after parsing attributes in process `syz.4.14528'. [ 1222.765658][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1222.765927][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1222.766172][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1222.766412][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1223.174511][ T6768] netlink: 'syz.0.14533': attribute type 3 has an invalid length. [ 1223.781988][ T6786] mac80211_hwsim hwsim4 syzkaller0: left promiscuous mode [ 1223.782295][ T6786] mac80211_hwsim hwsim4 syzkaller0: left allmulticast mode [ 1223.974159][ T6784] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14539'. [ 1224.890008][ T6827] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 1224.890039][ T6827] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 1225.344073][ T6850] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14558'. [ 1225.564805][ T6854] netlink: 68 bytes leftover after parsing attributes in process `syz.1.14560'. [ 1225.875751][ C1] net_ratelimit: 4 callbacks suppressed [ 1225.875777][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1225.876065][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1225.876316][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1225.918396][ T6866] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1226.208099][ T6874] Bluetooth: hci0: invalid length 0, exp 1 for type 31 [ 1226.731346][ T6894] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14573'. [ 1227.303230][ T6901] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1303 [ 1227.325109][ T6912] netlink: 16 bytes leftover after parsing attributes in process `syz.2.14580'. [ 1228.359100][ T6935] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14587'. [ 1228.391065][ T31] audit: type=1804 audit(1790294937.314:23): pid=6933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.14588" name="/newroot/2967/cgroup.controllers" dev="tmpfs" ino=14947 res=1 errno=0 [ 1228.392846][ T31] audit: type=1800 audit(1790294937.314:24): pid=6933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.14588" name="cgroup.controllers" dev="tmpfs" ino=14947 res=0 errno=0 [ 1228.944601][ T6944] netlink: 60 bytes leftover after parsing attributes in process `syz.3.14593'. [ 1228.995676][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.996000][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.996289][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.996557][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1228.996834][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1229.111094][ T31] audit: type=1804 audit(1790294938.034:25): pid=6948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.14596" name="/newroot/2917/cgroup.controllers" dev="tmpfs" ino=14713 res=1 errno=0 [ 1229.111375][ T31] audit: type=1800 audit(1790294938.034:26): pid=6948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.14596" name="cgroup.controllers" dev="tmpfs" ino=14713 res=0 errno=0 [ 1229.114298][ T6944] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14593'. [ 1229.172642][ T6948] FAULT_INJECTION: forcing a failure. [ 1229.172642][ T6948] name failslab, interval 1, probability 0, space 0, times 0 [ 1229.172677][ T6948] CPU: 0 UID: 0 PID: 6948 Comm: syz.1.14596 Not tainted syzkaller #0 PREEMPT(full) [ 1229.172700][ T6948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1229.172712][ T6948] Call Trace: [ 1229.172721][ T6948] [ 1229.172730][ T6948] dump_stack_lvl+0xe8/0x150 [ 1229.172767][ T6948] should_fail_ex+0x410/0x560 [ 1229.172797][ T6948] should_failslab+0xa8/0x100 [ 1229.172822][ T6948] ? mas_alloc_nodes+0x291/0x350 [ 1229.172914][ T6948] kmem_cache_alloc_noprof+0xa1/0x600 [ 1229.172947][ T6948] ? mas_alloc_nodes+0x291/0x350 [ 1229.172979][ T6948] mas_alloc_nodes+0x291/0x350 [ 1229.173008][ T6948] mas_preallocate+0x42a/0x840 [ 1229.173032][ T6948] ? rcu_is_watching+0x16/0xb0 [ 1229.173057][ T6948] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1229.173090][ T6948] ? __pfx_mas_preallocate+0x10/0x10 [ 1229.173125][ T6948] ? anon_vma_name+0x61/0x210 [ 1229.173150][ T6948] ? __mas_set_range+0x11a/0x3a0 [ 1229.173179][ T6948] __split_vma+0x2fb/0xa60 [ 1229.173215][ T6948] ? __pfx___split_vma+0x10/0x10 [ 1229.173248][ T6948] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1229.173268][ T6948] ? arch_stack_walk+0xfb/0x150 [ 1229.173312][ T6948] ? look_up_lock_class+0x57/0x110 [ 1229.173344][ T6948] vms_gather_munmap_vmas+0x322/0x1370 [ 1229.173375][ T6948] ? mtree_range_walk+0x707/0x8b0 [ 1229.173410][ T6948] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1229.173441][ T6948] ? mas_walk+0x37e/0x490 [ 1229.173476][ T6948] mmap_region+0x928/0x2270 [ 1229.173517][ T6948] ? __pfx_mmap_region+0x10/0x10 [ 1229.173547][ T6948] ? __lock_acquire+0x747/0x2de0 [ 1229.173577][ T6948] ? __lock_acquire+0x747/0x2de0 [ 1229.173615][ T6948] ? lock_acquire+0x115/0x350 [ 1229.173707][ T6948] ? kstrtoull+0x137/0x1d0 [ 1229.173729][ T6948] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 1229.173788][ T6948] ? apparmor_capable+0x126/0x170 [ 1229.173843][ T6948] ? bpf_lsm_capable+0x9/0x20 [ 1229.173861][ T6948] ? security_capable+0x7e/0x2c0 [ 1229.173894][ T6948] do_mmap+0xe0a/0x1300 [ 1229.173929][ T6948] ? __pfx_do_mmap+0x10/0x10 [ 1229.173968][ T6948] ? vm_mmap_pgoff+0x1dd/0x4e0 [ 1229.173998][ T6948] ? down_write_killable+0x17e/0x240 [ 1229.174030][ T6948] ? __pfx_down_write_killable+0x10/0x10 [ 1229.174059][ T6948] ? __fget_files+0x2a/0x420 [ 1229.174084][ T6948] ? apparmor_mmap_file+0xbe/0xe0 [ 1229.174110][ T6948] vm_mmap_pgoff+0x272/0x4e0 [ 1229.174157][ T6948] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1229.174179][ T6948] ? ksys_write+0x242/0x270 [ 1229.174211][ T6948] ? __pfx_ksys_write+0x10/0x10 [ 1229.174242][ T6948] ? ksys_mmap_pgoff+0xf3/0x760 [ 1229.174268][ T6948] ? __x64_sys_mmap+0x7f/0x140 [ 1229.174301][ T6948] do_syscall_64+0x166/0x520 [ 1229.174323][ T6948] ? trace_irq_disable+0x3b/0x140 [ 1229.174343][ T6948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.174364][ T6948] ? clear_bhb_loop+0x70/0xc0 [ 1229.174389][ T6948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.174409][ T6948] RIP: 0033:0x7f72ef59e159 [ 1229.174429][ T6948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1229.174446][ T6948] RSP: 002b:00007f72f03d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1229.174468][ T6948] RAX: ffffffffffffffda RBX: 00007f72ef825fa0 RCX: 00007f72ef59e159 [ 1229.174483][ T6948] RDX: 0000000000000005 RSI: 0000000000c00000 RDI: 0000200000001000 [ 1229.174496][ T6948] RBP: 00007f72f03d0090 R08: ffffffffffffffff R09: 0000000000000000 [ 1229.174509][ T6948] R10: 0000000000003032 R11: 0000000000000246 R12: 0000000000000001 [ 1229.174522][ T6948] R13: 00007f72ef826038 R14: 00007f72ef825fa0 R15: 00007ffe5095abb8 [ 1229.174556][ T6948] [ 1229.877265][ T6959] netlink: 32 bytes leftover after parsing attributes in process `syz.4.14602'. [ 1229.924663][ T6960] netlink: 'syz.2.14600': attribute type 1 has an invalid length. [ 1230.508636][ T31] audit: type=1804 audit(1790294939.434:27): pid=6987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.14608" name="/newroot/2921/cgroup.controllers" dev="tmpfs" ino=14738 res=1 errno=0 [ 1230.510051][ T31] audit: type=1800 audit(1790294939.434:28): pid=6987 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.14608" name="cgroup.controllers" dev="tmpfs" ino=14738 res=0 errno=0 [ 1230.592956][ T6987] FAULT_INJECTION: forcing a failure. [ 1230.592956][ T6987] name failslab, interval 1, probability 0, space 0, times 0 [ 1230.592986][ T6987] CPU: 1 UID: 0 PID: 6987 Comm: syz.1.14608 Not tainted syzkaller #0 PREEMPT(full) [ 1230.593006][ T6987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1230.593016][ T6987] Call Trace: [ 1230.593023][ T6987] [ 1230.593030][ T6987] dump_stack_lvl+0xe8/0x150 [ 1230.593061][ T6987] should_fail_ex+0x410/0x560 [ 1230.593088][ T6987] should_failslab+0xa8/0x100 [ 1230.593108][ T6987] ? anon_vma_clone+0x3f3/0x9f0 [ 1230.593132][ T6987] kmem_cache_alloc_noprof+0xa1/0x600 [ 1230.593160][ T6987] ? anon_vma_clone+0x3f3/0x9f0 [ 1230.593189][ T6987] anon_vma_clone+0x3f3/0x9f0 [ 1230.593223][ T6987] __split_vma+0x3e0/0xa60 [ 1230.593254][ T6987] ? __pfx___split_vma+0x10/0x10 [ 1230.593283][ T6987] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1230.593300][ T6987] ? arch_stack_walk+0xfb/0x150 [ 1230.593321][ T6987] ? look_up_lock_class+0x57/0x110 [ 1230.593348][ T6987] vms_gather_munmap_vmas+0x322/0x1370 [ 1230.593375][ T6987] ? mtree_range_walk+0x707/0x8b0 [ 1230.593405][ T6987] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1230.593431][ T6987] ? mas_walk+0x37e/0x490 [ 1230.593461][ T6987] mmap_region+0x928/0x2270 [ 1230.593497][ T6987] ? __pfx_mmap_region+0x10/0x10 [ 1230.593521][ T6987] ? __lock_acquire+0x747/0x2de0 [ 1230.593547][ T6987] ? __lock_acquire+0x747/0x2de0 [ 1230.593579][ T6987] ? lock_acquire+0x115/0x350 [ 1230.593672][ T6987] ? kstrtoull+0x137/0x1d0 [ 1230.593691][ T6987] ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10 [ 1230.593725][ T6987] ? apparmor_capable+0x126/0x170 [ 1230.593752][ T6987] ? bpf_lsm_capable+0x9/0x20 [ 1230.593767][ T6987] ? security_capable+0x7e/0x2c0 [ 1230.593805][ T6987] do_mmap+0xe0a/0x1300 [ 1230.593837][ T6987] ? __pfx_do_mmap+0x10/0x10 [ 1230.593872][ T6987] ? vm_mmap_pgoff+0x1dd/0x4e0 [ 1230.593895][ T6987] ? down_write_killable+0x17e/0x240 [ 1230.593926][ T6987] ? __pfx_down_write_killable+0x10/0x10 [ 1230.593953][ T6987] ? __fget_files+0x2a/0x420 [ 1230.593974][ T6987] ? apparmor_mmap_file+0xbe/0xe0 [ 1230.593995][ T6987] vm_mmap_pgoff+0x272/0x4e0 [ 1230.594024][ T6987] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 1230.594042][ T6987] ? ksys_write+0x242/0x270 [ 1230.594071][ T6987] ? __pfx_ksys_write+0x10/0x10 [ 1230.594099][ T6987] ? ksys_mmap_pgoff+0xf3/0x760 [ 1230.594123][ T6987] ? __x64_sys_mmap+0x7f/0x140 [ 1230.594144][ T6987] do_syscall_64+0x166/0x520 [ 1230.594163][ T6987] ? trace_irq_disable+0x3b/0x140 [ 1230.594181][ T6987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.594199][ T6987] ? clear_bhb_loop+0x70/0xc0 [ 1230.594220][ T6987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.594238][ T6987] RIP: 0033:0x7f72ef59e159 [ 1230.594256][ T6987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1230.594271][ T6987] RSP: 002b:00007f72f03d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1230.594293][ T6987] RAX: ffffffffffffffda RBX: 00007f72ef825fa0 RCX: 00007f72ef59e159 [ 1230.594305][ T6987] RDX: 0000000000000005 RSI: 0000000000c00000 RDI: 0000200000001000 [ 1230.594317][ T6987] RBP: 00007f72f03d0090 R08: ffffffffffffffff R09: 0000000000000000 [ 1230.594329][ T6987] R10: 0000000000003032 R11: 0000000000000246 R12: 0000000000000001 [ 1230.594341][ T6987] R13: 00007f72ef826038 R14: 00007f72ef825fa0 R15: 00007ffe5095abb8 [ 1230.594373][ T6987] [ 1231.296838][ T31] audit: type=1804 audit(1790294940.224:29): pid=7000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.14613" name="/newroot/2974/cgroup.controllers" dev="tmpfs" ino=14985 res=1 errno=0 [ 1231.296896][ T31] audit: type=1800 audit(1790294940.224:30): pid=7000 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.14613" name="cgroup.controllers" dev="tmpfs" ino=14985 res=0 errno=0 [ 1231.445931][ T7005] netlink: 44 bytes leftover after parsing attributes in process `syz.0.14614'. [ 1231.445963][ T7005] netlink: 43 bytes leftover after parsing attributes in process `syz.0.14614'. [ 1231.445979][ T7005] netlink: 'syz.0.14614': attribute type 6 has an invalid length. [ 1231.445993][ T7005] netlink: 'syz.0.14614': attribute type 5 has an invalid length. [ 1231.446005][ T7005] netlink: 43 bytes leftover after parsing attributes in process `syz.0.14614'. [ 1231.518189][ T7008] netlink: 68 bytes leftover after parsing attributes in process `syz.2.14616'. [ 1231.533013][ T7018] netlink: 'syz.0.14614': attribute type 6 has an invalid length. [ 1231.533039][ T7018] netlink: 'syz.0.14614': attribute type 5 has an invalid length. [ 1232.115719][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1232.116026][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1232.158431][ T31] audit: type=1804 audit(1790294941.084:31): pid=7039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.14622" name="/newroot/2916/cgroup.controllers" dev="tmpfs" ino=14702 res=1 errno=0 [ 1232.161102][ T31] audit: type=1800 audit(1790294941.084:32): pid=7039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.14622" name="cgroup.controllers" dev="tmpfs" ino=14702 res=0 errno=0 [ 1232.400708][ T7049] __nla_validate_parse: 4 callbacks suppressed [ 1232.400733][ T7049] netlink: 48 bytes leftover after parsing attributes in process `syz.1.14623'. [ 1233.594823][ T7088] openvswitch: netlink: Missing key (keys=c0, expected=20100) [ 1234.151052][ T7107] netlink: 'syz.1.14648': attribute type 1 has an invalid length. [ 1234.267075][ T7107] bond20: entered promiscuous mode [ 1234.267674][ T7107] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1234.268465][ T7103] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 1234.268487][ T7103] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 1234.351844][ T7112] macvtap2: entered allmulticast mode [ 1234.526994][ T7107] bond20: (slave bridge7): making interface the new active one [ 1234.527020][ T7107] bridge7: entered promiscuous mode [ 1234.532699][ T7107] bond20: (slave bridge7): Enslaving as an active interface with an up link [ 1235.210744][ T7149] ip6t_frag: unknown flags 6 [ 1235.245596][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1235.245880][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1235.620690][ T7162] ip6t_hbh: too many supported opts specified [ 1235.844336][ T31] audit: type=1804 audit(1790294944.764:33): pid=7169 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.14671" name="/newroot/2986/cgroup.controllers" dev="tmpfs" ino=15049 res=1 errno=0 [ 1235.853846][ T31] audit: type=1800 audit(1790294944.774:34): pid=7169 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.14671" name="cgroup.controllers" dev="tmpfs" ino=15049 res=0 errno=0 [ 1235.921185][ T7172] netlink: 'syz.3.14672': attribute type 11 has an invalid length. [ 1236.271214][ T7186] FAULT_INJECTION: forcing a failure. [ 1236.271214][ T7186] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1236.271249][ T7186] CPU: 0 UID: 0 PID: 7186 Comm: syz.2.14679 Not tainted syzkaller #0 PREEMPT(full) [ 1236.271276][ T7186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1236.271288][ T7186] Call Trace: [ 1236.271297][ T7186] [ 1236.271306][ T7186] dump_stack_lvl+0xe8/0x150 [ 1236.271340][ T7186] should_fail_ex+0x410/0x560 [ 1236.271370][ T7186] _copy_from_user+0x2d/0xb0 [ 1236.271397][ T7186] do_sock_getsockopt+0x200/0x7e0 [ 1236.271431][ T7186] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1236.271475][ T7186] ? __fget_files+0x3a2/0x420 [ 1236.271502][ T7186] ? __fget_files+0x2a/0x420 [ 1236.271536][ T7186] __x64_sys_getsockopt+0x1a4/0x240 [ 1236.271572][ T7186] do_syscall_64+0x166/0x520 [ 1236.271597][ T7186] ? trace_irq_disable+0x3b/0x140 [ 1236.271617][ T7186] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1236.271637][ T7186] ? clear_bhb_loop+0x70/0xc0 [ 1236.271662][ T7186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1236.271689][ T7186] RIP: 0033:0x7f971499e159 [ 1236.271708][ T7186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1236.271725][ T7186] RSP: 002b:00007f9715842028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1236.271747][ T7186] RAX: ffffffffffffffda RBX: 00007f9714c25fa0 RCX: 00007f971499e159 [ 1236.271762][ T7186] RDX: 000000000000271b RSI: 0000200000000114 RDI: 0000000000000003 [ 1236.271775][ T7186] RBP: 00007f9715842090 R08: 0000200000000000 R09: 0000000000000000 [ 1236.271788][ T7186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1236.271800][ T7186] R13: 00007f9714c26038 R14: 00007f9714c25fa0 R15: 00007ffdaf6d6ff8 [ 1236.271834][ T7186] [ 1236.670815][ T7195] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1236.694625][ T7195] bond0: (slave bond_slave_1): Device is not bonding slave [ 1236.694650][ T7195] bond0: option active_slave: invalid value (bond_slave_1) [ 1237.020835][ T31] audit: type=1804 audit(1790294945.944:35): pid=7206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.14688" name="/newroot/2903/cgroup.controllers" dev="tmpfs" ino=14627 res=1 errno=0 [ 1237.020892][ T31] audit: type=1800 audit(1790294945.944:36): pid=7206 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.14688" name="cgroup.controllers" dev="tmpfs" ino=14627 res=0 errno=0 [ 1237.062464][ T7209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14686'. [ 1237.156627][ T9639] IPVS: ip_vs_send_async error -1 [ 1237.446709][ T7222] netlink: 24 bytes leftover after parsing attributes in process `syz.1.14694'. [ 1237.735887][ T7226] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14696'. [ 1237.969411][ T7230] netlink: 4 bytes leftover after parsing attributes in process `syz.2.14698'. [ 1238.232409][ T7230] ip6gretap0 (unregistering): left promiscuous mode [ 1238.324865][ T7248] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 1238.324897][ T7248] syzkaller1: group set to 0 [ 1238.378701][ T7238] syzkaller1: tun_chr_ioctl cmd 1342215231 [ 1238.379024][ T7238] bond0: (slave bond_slave_1): Device is not bonding slave [ 1238.379044][ T7238] bond0: option active_slave: invalid value (bond_slave_1) [ 1238.667322][ T7256] netlink: 8 bytes leftover after parsing attributes in process `syz.4.14706'. [ 1238.667349][ T7256] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14706'. [ 1238.991431][ T7267] netlink: 96 bytes leftover after parsing attributes in process `syz.4.14711'. [ 1239.006792][ T7266] bridge0: port 1(syzkaller0) entered blocking state [ 1239.007010][ T7266] bridge0: port 1(syzkaller0) entered disabled state [ 1239.007171][ T7266] syzkaller0: entered allmulticast mode [ 1239.016709][ T7266] syzkaller0: entered promiscuous mode [ 1239.017238][ T7266] bridge0: port 1(syzkaller0) entered blocking state [ 1239.017376][ T7266] bridge0: port 1(syzkaller0) entered forwarding state [ 1239.259214][ T7275] netlink: 8 bytes leftover after parsing attributes in process `syz.2.14712'. [ 1239.274949][ T7275] netlink: 28 bytes leftover after parsing attributes in process `syz.2.14712'. [ 1239.313861][ T7263] bridge0: port 1(syzkaller0) entered disabled state [ 1239.339317][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.412539][ T7263] syzkaller0 (unregistering): left allmulticast mode [ 1239.412571][ T7263] syzkaller0 (unregistering): left promiscuous mode [ 1239.412664][ T7263] bridge0: port 1(syzkaller0) entered disabled state [ 1239.417605][ T7279] x_tables: unsorted underflow at hook 4 [ 1239.573035][ T7275] x_tables: duplicate underflow at hook 3 [ 1239.861332][ T7288] tipc: Bearer : already 2 bearers with priority 10 [ 1239.861357][ T7288] tipc: Bearer : trying with adjusted priority [ 1239.861368][ T7288] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1239.920995][ T7292] netlink: 'syz.1.14715': attribute type 4 has an invalid length. [ 1239.921022][ T7292] netlink: 152 bytes leftover after parsing attributes in process `syz.1.14715'. [ 1240.029950][ T7294] netlink: 224 bytes leftover after parsing attributes in process `syz.2.14716'. [ 1240.435588][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1240.435869][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1240.436131][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1240.441651][ T7301] bond0: (slave bond_slave_1): Device is not bonding slave [ 1240.441677][ T7301] bond0: option active_slave: invalid value (bond_slave_1) [ 1240.554477][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1240.554909][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1240.575305][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1240.575728][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1240.576204][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1240.576636][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1240.577052][ T7304] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1241.057877][ T7321] pim6reg1: entered promiscuous mode [ 1241.057903][ T7321] pim6reg1: entered allmulticast mode [ 1241.714483][ T7343] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1241.932074][ T7350] ip6tnl2: entered promiscuous mode [ 1242.032615][ T7354] veth0: Caught tx_queue_len zero misconfig [ 1242.178594][ T7358] FAULT_INJECTION: forcing a failure. [ 1242.178594][ T7358] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1242.178630][ T7358] CPU: 1 UID: 0 PID: 7358 Comm: syz.0.14738 Not tainted syzkaller #0 PREEMPT(full) [ 1242.178654][ T7358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1242.178666][ T7358] Call Trace: [ 1242.178676][ T7358] [ 1242.178694][ T7358] dump_stack_lvl+0xe8/0x150 [ 1242.178731][ T7358] should_fail_ex+0x410/0x560 [ 1242.178763][ T7358] _copy_to_user+0x31/0xb0 [ 1242.178794][ T7358] simple_read_from_buffer+0xe1/0x170 [ 1242.178830][ T7358] proc_fail_nth_read+0x1bb/0x230 [ 1242.178850][ T7358] ? common_file_perm+0x20e/0x2b0 [ 1242.178880][ T7358] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1242.178906][ T7358] ? rw_verify_area+0x24a/0x4c0 [ 1242.178939][ T7358] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1242.178958][ T7358] vfs_read+0x213/0xa80 [ 1242.178995][ T7358] ? __pfx___mutex_lock+0x10/0x10 [ 1242.179025][ T7358] ? __pfx_vfs_read+0x10/0x10 [ 1242.179057][ T7358] ? __fget_files+0x2a/0x420 [ 1242.179091][ T7358] ? __fget_files+0x3a2/0x420 [ 1242.179118][ T7358] ? __fget_files+0x2a/0x420 [ 1242.179157][ T7358] ksys_read+0x150/0x270 [ 1242.179190][ T7358] ? __pfx_ksys_read+0x10/0x10 [ 1242.179217][ T7358] ? fput+0xa0/0xd0 [ 1242.179257][ T7358] do_syscall_64+0x166/0x520 [ 1242.179282][ T7358] ? trace_irq_disable+0x3b/0x140 [ 1242.179303][ T7358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1242.179325][ T7358] ? clear_bhb_loop+0x70/0xc0 [ 1242.179356][ T7358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1242.179377][ T7358] RIP: 0033:0x7fbb51b5e98e [ 1242.179398][ T7358] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1242.179416][ T7358] RSP: 002b:00007fbb4fdf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1242.179439][ T7358] RAX: ffffffffffffffda RBX: 00007fbb4fdf66c0 RCX: 00007fbb51b5e98e [ 1242.179455][ T7358] RDX: 000000000000000f RSI: 00007fbb4fdf60a0 RDI: 0000000000000004 [ 1242.179468][ T7358] RBP: 00007fbb4fdf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1242.179482][ T7358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1242.179495][ T7358] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1242.179532][ T7358] [ 1242.638707][ T7360] bond14: Unable to set up delay as MII monitoring is disabled [ 1242.659316][ T7360] bond14 (unregistering): Released all slaves [ 1243.312168][ T7389] FAULT_INJECTION: forcing a failure. [ 1243.312168][ T7389] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1243.312202][ T7389] CPU: 0 UID: 0 PID: 7389 Comm: syz.1.14748 Not tainted syzkaller #0 PREEMPT(full) [ 1243.312225][ T7389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1243.312237][ T7389] Call Trace: [ 1243.312246][ T7389] [ 1243.312255][ T7389] dump_stack_lvl+0xe8/0x150 [ 1243.312290][ T7389] should_fail_ex+0x410/0x560 [ 1243.312319][ T7389] _copy_from_user+0x2d/0xb0 [ 1243.312346][ T7389] do_sock_getsockopt+0x200/0x7e0 [ 1243.312380][ T7389] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1243.312425][ T7389] ? __fget_files+0x3a2/0x420 [ 1243.312451][ T7389] ? __fget_files+0x2a/0x420 [ 1243.312485][ T7389] __x64_sys_getsockopt+0x1a4/0x240 [ 1243.312521][ T7389] do_syscall_64+0x166/0x520 [ 1243.312546][ T7389] ? trace_irq_disable+0x3b/0x140 [ 1243.312566][ T7389] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1243.312587][ T7389] ? clear_bhb_loop+0x70/0xc0 [ 1243.312611][ T7389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1243.312631][ T7389] RIP: 0033:0x7f72ef59e159 [ 1243.312650][ T7389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1243.312667][ T7389] RSP: 002b:00007f72f03d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1243.312688][ T7389] RAX: ffffffffffffffda RBX: 00007f72ef825fa0 RCX: 00007f72ef59e159 [ 1243.312703][ T7389] RDX: 0000000000002717 RSI: 0000200000000114 RDI: 0000000000000003 [ 1243.312716][ T7389] RBP: 00007f72f03d0090 R08: 0000200000000400 R09: 0000000000000000 [ 1243.312729][ T7389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1243.312741][ T7389] R13: 00007f72ef826038 R14: 00007f72ef825fa0 R15: 00007ffe5095abb8 [ 1243.312775][ T7389] [ 1243.314062][ T7387] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1243.439534][ T7387] tap0: tun_chr_ioctl cmd 1074025672 [ 1243.439556][ T7387] tap0: ignored: set checksum disabled [ 1243.443822][ T7391] netlink: 'syz.2.14750': attribute type 11 has an invalid length. [ 1243.580798][ T7396] __nla_validate_parse: 4 callbacks suppressed [ 1243.580823][ T7396] netlink: 12 bytes leftover after parsing attributes in process `syz.1.14752'. [ 1243.764971][ T31] audit: type=1804 audit(1790294952.684:37): pid=7399 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.14752" name="/newroot/2950/cgroup.controllers" dev="tmpfs" ino=14888 res=1 errno=0 [ 1243.765045][ T31] audit: type=1800 audit(1790294952.684:38): pid=7399 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.14752" name="cgroup.controllers" dev="tmpfs" ino=14888 res=0 errno=0 [ 1244.226682][ T7414] netlink: 'syz.0.14758': attribute type 1 has an invalid length. [ 1244.500925][ T7414] veth11: entered allmulticast mode [ 1244.541695][ T7414] bond12: (slave veth11): Enslaving as an active interface with a down link [ 1244.622999][ T7421] bond12: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1245.137063][ T7443] netlink: 68 bytes leftover after parsing attributes in process `syz.3.14767'. [ 1245.411227][ T7450] xt_CT: No such helper "pptp" [ 1245.457629][ T7453] syzkaller0: entered promiscuous mode [ 1245.457654][ T7453] syzkaller0: entered allmulticast mode [ 1245.555712][ C0] net_ratelimit: 26 callbacks suppressed [ 1245.555737][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1245.556031][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1245.556346][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1246.026568][ T7478] netlink: 292 bytes leftover after parsing attributes in process `syz.2.14780'. [ 1246.273325][ T7484] netlink: 9 bytes leftover after parsing attributes in process `syz.3.14783'. [ 1246.282384][ T7484] netlink: 5 bytes leftover after parsing attributes in process `syz.3.14783'. [ 1246.282524][ T7484] 0{X: renamed from gretap0 [ 1246.314289][ T7484] 0{X: left promiscuous mode [ 1246.314315][ T7484] 0{X: entered allmulticast mode [ 1246.327521][ T7484] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 1246.350059][ T7487] mac80211_hwsim hwsim4 syzkaller0: entered promiscuous mode [ 1246.350089][ T7487] mac80211_hwsim hwsim4 syzkaller0: entered allmulticast mode [ 1246.892627][ T7499] syzkaller0: entered promiscuous mode [ 1246.892653][ T7499] syzkaller0: entered allmulticast mode [ 1247.191840][ T7514] netlink: 28 bytes leftover after parsing attributes in process `syz.0.14796'. [ 1248.074863][ T7547] netlink: 4400 bytes leftover after parsing attributes in process `syz.1.14805'. [ 1248.077547][ T7547] netlink: 'syz.1.14805': attribute type 21 has an invalid length. [ 1248.124406][ T7549] x_tables: duplicate underflow at hook 2 [ 1248.217386][ T7549] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14808'. [ 1248.564435][ T7558] syzkaller1: entered promiscuous mode [ 1248.564462][ T7558] syzkaller1: entered allmulticast mode [ 1248.734389][ T7569] FAULT_INJECTION: forcing a failure. [ 1248.734389][ T7569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1248.734424][ T7569] CPU: 1 UID: 0 PID: 7569 Comm: syz.2.14815 Not tainted syzkaller #0 PREEMPT(full) [ 1248.734447][ T7569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1248.734459][ T7569] Call Trace: [ 1248.734468][ T7569] [ 1248.734478][ T7569] dump_stack_lvl+0xe8/0x150 [ 1248.734517][ T7569] should_fail_ex+0x410/0x560 [ 1248.734548][ T7569] _copy_from_user+0x2d/0xb0 [ 1248.734576][ T7569] ___sys_sendmsg+0x1c6/0x360 [ 1248.734605][ T7569] ? __lock_acquire+0x747/0x2de0 [ 1248.734633][ T7569] ? __pfx____sys_sendmsg+0x10/0x10 [ 1248.734695][ T7569] ? __fget_files+0x2a/0x420 [ 1248.734726][ T7569] ? __fget_files+0x3a2/0x420 [ 1248.734759][ T7569] __x64_sys_sendmsg+0x1b1/0x290 [ 1248.734789][ T7569] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1248.734842][ T7569] do_syscall_64+0x166/0x520 [ 1248.734871][ T7569] ? trace_irq_disable+0x3b/0x140 [ 1248.734893][ T7569] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1248.734916][ T7569] ? clear_bhb_loop+0x70/0xc0 [ 1248.734940][ T7569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1248.734960][ T7569] RIP: 0033:0x7f971499e159 [ 1248.734980][ T7569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1248.735006][ T7569] RSP: 002b:00007f9715842028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1248.735029][ T7569] RAX: ffffffffffffffda RBX: 00007f9714c25fa0 RCX: 00007f971499e159 [ 1248.735044][ T7569] RDX: 0000000000000042 RSI: 0000200000000c80 RDI: 0000000000000003 [ 1248.735058][ T7569] RBP: 00007f9715842090 R08: 0000000000000000 R09: 0000000000000000 [ 1248.735071][ T7569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1248.735084][ T7569] R13: 00007f9714c26038 R14: 00007f9714c25fa0 R15: 00007ffdaf6d6ff8 [ 1248.735119][ T7569] [ 1248.790226][ T7571] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14813'. [ 1248.841344][ T7574] netlink: 88 bytes leftover after parsing attributes in process `syz.0.14814'. [ 1248.841398][ T7574] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14814'. [ 1248.841415][ T7574] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14814'. [ 1248.879917][ T7574] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1248.882770][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1249.202255][ T31] audit: type=1804 audit(1790294958.124:39): pid=7577 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.14817" name="/newroot/2946/cgroup.controllers" dev="tmpfs" ino=14842 res=1 errno=0 [ 1249.202315][ T31] audit: type=1800 audit(1790294958.124:40): pid=7577 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.14817" name="cgroup.controllers" dev="tmpfs" ino=14842 res=0 errno=0 [ 1249.754158][ T7600] netlink: 'syz.1.14826': attribute type 4 has an invalid length. [ 1249.754186][ T7600] netlink: 152 bytes leftover after parsing attributes in process `syz.1.14826'. [ 1249.770536][ T7601] netlink: 40 bytes leftover after parsing attributes in process `syz.4.14827'. [ 1250.033624][ T7606] netlink: 12 bytes leftover after parsing attributes in process `syz.3.14829'. [ 1250.168082][ T7609] netlink: 28 bytes leftover after parsing attributes in process `syz.1.14831'. [ 1250.588192][ T7619] sctp: [Deprecated]: syz.3.14836 (pid 7619) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1250.588192][ T7619] Use struct sctp_sack_info instead [ 1250.765587][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1250.765873][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1250.766141][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1251.025184][ T7630] syzkaller1: entered promiscuous mode [ 1251.025211][ T7630] syzkaller1: entered allmulticast mode [ 1251.071483][ T7630] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1251.141608][ T7640] netlink: 'syz.1.14843': attribute type 4 has an invalid length. [ 1251.141635][ T7640] netlink: 152 bytes leftover after parsing attributes in process `syz.1.14843'. [ 1251.186227][ T7632] syzkaller0: entered promiscuous mode [ 1251.186466][ T7632] syzkaller0: entered allmulticast mode [ 1251.229178][ T7630] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1251.229204][ T7630] syzkaller1: Linktype set failed because interface is up [ 1251.255221][ T7630] syzkaller1: tun_chr_ioctl cmd 1074025688 [ 1251.383752][ T7647] netlink: 'syz.1.14845': attribute type 1 has an invalid length. [ 1251.385012][ T7645] netlink: 292 bytes leftover after parsing attributes in process `syz.4.14846'. [ 1251.765254][ T7647] bond21: entered promiscuous mode [ 1251.772027][ T7647] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1251.917043][ T7656] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1251.933464][ T7656] bond21: (slave wireguard5): The slave device specified does not support setting the MAC address [ 1251.933491][ T7656] bond21: (slave wireguard5): Setting fail_over_mac to active for active-backup mode [ 1252.004983][ T7656] bond21: (slave wireguard5): making interface the new active one [ 1252.005012][ T7656] wireguard5: entered promiscuous mode [ 1252.030876][ T7656] bond21: (slave wireguard5): Enslaving as an active interface with an up link [ 1252.218567][ T7666] tipc: Enabling of bearer rejected, already enabled [ 1252.515712][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.516035][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.516320][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.516604][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.516890][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.517322][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1252.893479][ T7695] syzkaller1: entered promiscuous mode [ 1252.893715][ T7695] syzkaller1: entered allmulticast mode [ 1253.505011][ T7713] sctp: [Deprecated]: syz.0.14866 (pid 7713) Use of int in maxseg socket option. [ 1253.505011][ T7713] Use struct sctp_assoc_value instead [ 1253.746022][ T7728] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1254.219749][ T7744] FAULT_INJECTION: forcing a failure. [ 1254.219749][ T7744] name failslab, interval 1, probability 0, space 0, times 0 [ 1254.219786][ T7744] CPU: 1 UID: 0 PID: 7744 Comm: syz.4.14876 Not tainted syzkaller #0 PREEMPT(full) [ 1254.219809][ T7744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1254.219822][ T7744] Call Trace: [ 1254.219831][ T7744] [ 1254.219842][ T7744] dump_stack_lvl+0xe8/0x150 [ 1254.219879][ T7744] should_fail_ex+0x410/0x560 [ 1254.219909][ T7744] ? __alloc_skb+0x1db/0x7a0 [ 1254.219935][ T7744] should_failslab+0xa8/0x100 [ 1254.219964][ T7744] ? __alloc_skb+0x1db/0x7a0 [ 1254.219987][ T7744] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1254.220019][ T7744] ? __alloc_skb+0x18d/0x7a0 [ 1254.220051][ T7744] ? __alloc_skb+0x1db/0x7a0 [ 1254.220085][ T7744] __alloc_skb+0x1db/0x7a0 [ 1254.220117][ T7744] ethnl_default_notify+0x5b8/0xb00 [ 1254.220237][ T7744] ? __pfx_ethnl_default_notify+0x10/0x10 [ 1254.220282][ T7744] ? ethnl_notify+0x1a3/0x300 [ 1254.220311][ T7744] ethnl_default_set_doit+0xae0/0x1080 [ 1254.220351][ T7744] genl_family_rcv_msg_doit+0x233/0x340 [ 1254.220389][ T7744] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1254.220431][ T7744] ? bpf_lsm_capable+0x9/0x20 [ 1254.220452][ T7744] ? security_capable+0x7e/0x2c0 [ 1254.220485][ T7744] genl_rcv_msg+0x614/0x7a0 [ 1254.220519][ T7744] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1254.220554][ T7744] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 1254.220597][ T7744] netlink_rcv_skb+0x226/0x4a0 [ 1254.220632][ T7744] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1254.220660][ T7744] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1254.220711][ T7744] ? down_read+0x2be/0x330 [ 1254.220747][ T7744] genl_rcv+0x28/0x40 [ 1254.220771][ T7744] netlink_unicast+0x7bd/0x940 [ 1254.220816][ T7744] netlink_sendmsg+0x813/0xb40 [ 1254.220850][ T7744] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1254.220884][ T7744] ? apparmor_socket_sendmsg+0x98/0x360 [ 1254.220912][ T7744] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1254.220933][ T7744] sock_sendmsg_nosec+0x13a/0x180 [ 1254.220960][ T7744] ____sys_sendmsg+0x54e/0x850 [ 1254.220997][ T7744] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1254.221039][ T7744] ? import_iovec+0x73/0xa0 [ 1254.221072][ T7744] ___sys_sendmsg+0x2a5/0x360 [ 1254.221101][ T7744] ? __lock_acquire+0x747/0x2de0 [ 1254.221130][ T7744] ? __pfx____sys_sendmsg+0x10/0x10 [ 1254.221202][ T7744] ? __fget_files+0x2a/0x420 [ 1254.221231][ T7744] ? __fget_files+0x3a2/0x420 [ 1254.221273][ T7744] __x64_sys_sendmsg+0x1b1/0x290 [ 1254.221305][ T7744] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1254.221360][ T7744] do_syscall_64+0x166/0x520 [ 1254.221385][ T7744] ? trace_irq_disable+0x3b/0x140 [ 1254.221406][ T7744] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1254.221428][ T7744] ? clear_bhb_loop+0x70/0xc0 [ 1254.221454][ T7744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1254.221475][ T7744] RIP: 0033:0x7feabef9e159 [ 1254.221496][ T7744] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1254.221513][ T7744] RSP: 002b:00007feabd1f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1254.221546][ T7744] RAX: ffffffffffffffda RBX: 00007feabf225fa0 RCX: 00007feabef9e159 [ 1254.221562][ T7744] RDX: 0000000000040054 RSI: 0000200000000540 RDI: 0000000000000003 [ 1254.221577][ T7744] RBP: 00007feabd1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1254.221590][ T7744] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1254.221605][ T7744] R13: 00007feabf226038 R14: 00007feabf225fa0 R15: 00007ffd87d9a3f8 [ 1254.221641][ T7744] [ 1254.312314][ T7750] __nla_validate_parse: 1 callbacks suppressed [ 1254.312334][ T7750] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14880'. [ 1254.658089][ T7760] netlink: 292 bytes leftover after parsing attributes in process `syz.4.14883'. [ 1255.024261][ T7776] netlink: 'syz.2.14888': attribute type 4 has an invalid length. [ 1255.024287][ T7776] netlink: 152 bytes leftover after parsing attributes in process `syz.2.14888'. [ 1255.188048][ T7778] netlink: 8 bytes leftover after parsing attributes in process `syz.0.14889'. [ 1255.352064][ T7787] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14892'. [ 1255.364988][ T7784] netlink: 'syz.3.14893': attribute type 21 has an invalid length. [ 1255.365011][ T7784] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14893'. [ 1256.097578][ T7813] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1256.151558][ T7813] net_ratelimit: 31 callbacks suppressed [ 1256.151580][ T7813] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1256.154179][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1256.222728][ T7818] netlink: 292 bytes leftover after parsing attributes in process `syz.1.14902'. [ 1256.515762][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1256.516029][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1256.516263][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1256.656872][ T7830] netlink: 'syz.4.14906': attribute type 4 has an invalid length. [ 1256.656897][ T7830] netlink: 152 bytes leftover after parsing attributes in process `syz.4.14906'. [ 1256.926575][ T7839] ip_tables: iptables: counters copy to user failed while replacing table [ 1258.172468][ T31] audit: type=1804 audit(1790294967.094:41): pid=7887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.14926" name="/newroot/2967/cgroup.controllers" dev="tmpfs" ino=14951 res=1 errno=0 [ 1258.172533][ T31] audit: type=1800 audit(1790294967.094:42): pid=7887 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.14926" name="cgroup.controllers" dev="tmpfs" ino=14951 res=0 errno=0 [ 1258.379025][ T7892] veth0_to_bond: entered allmulticast mode [ 1258.709799][ T7911] netlink: 8 bytes leftover after parsing attributes in process `syz.1.14933'. [ 1258.980659][ T7922] netlink: 'syz.3.14934': attribute type 4 has an invalid length. [ 1258.980723][ T7922] netlink: 152 bytes leftover after parsing attributes in process `syz.3.14934'. [ 1259.906620][ T31] audit: type=1804 audit(1790294968.834:43): pid=7952 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.14945" name="/newroot/2992/cgroup.controllers" dev="tmpfs" ino=15102 res=1 errno=0 [ 1259.906888][ T31] audit: type=1800 audit(1790294968.834:44): pid=7952 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.14945" name="cgroup.controllers" dev="tmpfs" ino=15102 res=0 errno=0 [ 1260.332385][ T7965] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1260.352933][ T7965] openvswitch: netlink: IP tunnel TTL not specified. [ 1260.393438][ T7970] netlink: 28 bytes leftover after parsing attributes in process `syz.4.14949'. [ 1260.393480][ T7970] netlink: 'syz.4.14949': attribute type 7 has an invalid length. [ 1260.393496][ T7970] netlink: 'syz.4.14949': attribute type 8 has an invalid length. [ 1260.393509][ T7970] netlink: 4 bytes leftover after parsing attributes in process `syz.4.14949'. [ 1260.499618][ T7970] ip6gretap0: entered promiscuous mode [ 1260.603745][ T7970] ip6gretap0: left promiscuous mode [ 1260.714316][ T7977] nbd2: detected capacity change from 0 to 63 [ 1260.727390][ T7977] netlink: 24 bytes leftover after parsing attributes in process `syz.0.14954'. [ 1260.842480][T31325] block nbd2: Receive control failed (result -104) [ 1261.131811][ T7995] x9: renamed from bridge_slave_0 (while UP) [ 1261.158949][ T7995] netlink: 48 bytes leftover after parsing attributes in process `syz.1.14958'. [ 1261.286337][ T7998] netlink: 27 bytes leftover after parsing attributes in process `syz.1.14958'. [ 1262.172607][ T31] audit: type=1107 audit(1790294971.094:45): pid=8025 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='ً5%UA٠0ltݕ/ 6򊨊' [ 1262.275725][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.276017][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.276282][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.342851][ T8039] netlink: 40 bytes leftover after parsing attributes in process `syz.0.14975'. [ 1262.675688][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.676141][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.676512][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.676883][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.677263][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.677599][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1262.677942][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1263.063123][ T8064] netlink: 176 bytes leftover after parsing attributes in process `syz.1.14982'. [ 1263.187782][ T8066] [ 1263.190382][ T8066] ====================================================== [ 1263.197519][ T8066] WARNING: possible circular locking dependency detected [ 1263.204697][ T8066] syzkaller #0 Not tainted [ 1263.209153][ T8066] ------------------------------------------------------ [ 1263.216256][ T8066] syz.0.14983/8066 is trying to acquire lock: [ 1263.222349][ T8066] ffffffff8ee904e0 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x149/0x600 [ 1263.231652][ T8066] [ 1263.231652][ T8066] but task is already holding lock: [ 1263.239051][ T8066] ffff88802854f678 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 1263.248593][ T8066] [ 1263.248593][ T8066] which lock already depends on the new lock. [ 1263.248593][ T8066] [ 1263.259016][ T8066] [ 1263.259016][ T8066] the existing dependency chain (in reverse order) is: [ 1263.268062][ T8066] [ 1263.268062][ T8066] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 1263.275848][ T8066] __might_fault+0xcb/0x130 [ 1263.280912][ T8066] _copy_from_iter+0x100/0x1660 [ 1263.286498][ T8066] tcp_sendmsg_locked+0x20cf/0x5400 [ 1263.292564][ T8066] tcp_sendmsg+0x2f/0x50 [ 1263.297367][ T8066] sock_sendmsg_nosec+0x10e/0x180 [ 1263.302940][ T8066] sock_write_iter+0x2de/0x3e0 [ 1263.308322][ T8066] vfs_write+0x612/0xba0 [ 1263.313230][ T8066] ksys_write+0x150/0x270 [ 1263.318372][ T8066] do_syscall_64+0x166/0x520 [ 1263.323867][ T8066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1263.330291][ T8066] [ 1263.330291][ T8066] -> #6 (sk_lock-AF_INET){+.+.}-{0:0}: [ 1263.338042][ T8066] lock_sock_nested+0x41/0x100 [ 1263.343378][ T8066] inet_shutdown+0x6a/0x390 [ 1263.348409][ T8066] nbd_mark_nsock_dead+0x2cb/0x550 [ 1263.354207][ T8066] recv_work+0x1cee/0x1e10 [ 1263.359165][ T8066] process_scheduled_works+0xc3d/0x1630 [ 1263.365254][ T8066] worker_thread+0xa47/0xfb0 [ 1263.370415][ T8066] kthread+0x38b/0x480 [ 1263.375025][ T8066] ret_from_fork+0x514/0xb70 [ 1263.380138][ T8066] ret_from_fork_asm+0x1a/0x30 [ 1263.385438][ T8066] [ 1263.385438][ T8066] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 1263.393204][ T8066] __mutex_lock+0x19d/0x1550 [ 1263.398347][ T8066] nbd_queue_rq+0x373/0xff0 [ 1263.403501][ T8066] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1263.409864][ T8066] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1263.416763][ T8066] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1263.423284][ T8066] blk_mq_run_work_fn+0x16c/0x300 [ 1263.428932][ T8066] process_scheduled_works+0xc3d/0x1630 [ 1263.435114][ T8066] worker_thread+0xa47/0xfb0 [ 1263.440235][ T8066] kthread+0x38b/0x480 [ 1263.444833][ T8066] ret_from_fork+0x514/0xb70 [ 1263.449958][ T8066] ret_from_fork_asm+0x1a/0x30 [ 1263.455263][ T8066] [ 1263.455263][ T8066] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 1263.462937][ T8066] __mutex_lock+0x19d/0x1550 [ 1263.468095][ T8066] nbd_queue_rq+0xc1/0xff0 [ 1263.473507][ T8066] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1263.479776][ T8066] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1263.486651][ T8066] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1263.493257][ T8066] blk_mq_run_work_fn+0x16c/0x300 [ 1263.498842][ T8066] process_scheduled_works+0xc3d/0x1630 [ 1263.504928][ T8066] worker_thread+0xa47/0xfb0 [ 1263.510138][ T8066] kthread+0x38b/0x480 [ 1263.514825][ T8066] ret_from_fork+0x514/0xb70 [ 1263.519942][ T8066] ret_from_fork_asm+0x1a/0x30 [ 1263.525250][ T8066] [ 1263.525250][ T8066] -> #3 (set->srcu){.+.+}-{0:0}: [ 1263.532444][ T8066] __synchronize_srcu+0xc9/0x2f0 [ 1263.537921][ T8066] elevator_switch+0x1e8/0x7b0 [ 1263.543269][ T8066] elevator_change+0x2fa/0x480 [ 1263.548645][ T8066] elevator_set_default+0x375/0x440 [ 1263.554368][ T8066] blk_register_queue+0x3f3/0x4e0 [ 1263.559981][ T8066] __add_disk+0x6b8/0xdb0 [ 1263.564852][ T8066] add_disk_fwnode+0x100/0x3a0 [ 1263.570148][ T8066] nbd_dev_add+0x733/0xb60 [ 1263.575093][ T8066] nbd_init+0x168/0x1f0 [ 1263.579871][ T8066] do_one_initcall+0x250/0x870 [ 1263.585165][ T8066] do_initcall_level+0x10a/0x1a0 [ 1263.590672][ T8066] do_initcalls+0x59/0xa0 [ 1263.595616][ T8066] kernel_init_freeable+0x29d/0x3e0 [ 1263.601548][ T8066] kernel_init+0x22/0x1d0 [ 1263.606403][ T8066] ret_from_fork+0x514/0xb70 [ 1263.611518][ T8066] ret_from_fork_asm+0x1a/0x30 [ 1263.616820][ T8066] [ 1263.616820][ T8066] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 1263.624644][ T8066] __mutex_lock+0x19d/0x1550 [ 1263.629768][ T8066] elevator_change+0x1af/0x480 [ 1263.635066][ T8066] elevator_set_none+0xb5/0x140 [ 1263.640444][ T8066] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1263.646877][ T8066] nbd_start_device+0x189/0xb30 [ 1263.652257][ T8066] nbd_genl_connect+0x167d/0x1cd0 [ 1263.657904][ T8066] genl_family_rcv_msg_doit+0x233/0x340 [ 1263.665407][ T8066] genl_rcv_msg+0x614/0x7a0 [ 1263.670602][ T8066] netlink_rcv_skb+0x226/0x4a0 [ 1263.675947][ T8066] genl_rcv+0x28/0x40 [ 1263.680484][ T8066] netlink_unicast+0x7bd/0x940 [ 1263.685803][ T8066] netlink_sendmsg+0x813/0xb40 [ 1263.691106][ T8066] sock_sendmsg_nosec+0x13a/0x180 [ 1263.696663][ T8066] ____sys_sendmsg+0x54e/0x850 [ 1263.702043][ T8066] ___sys_sendmsg+0x2a5/0x360 [ 1263.707337][ T8066] __x64_sys_sendmsg+0x1b1/0x290 [ 1263.712947][ T8066] do_syscall_64+0x166/0x520 [ 1263.718290][ T8066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1263.724869][ T8066] [ 1263.724869][ T8066] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 1263.733589][ T8066] blk_alloc_queue+0x544/0x690 [ 1263.738891][ T8066] __blk_mq_alloc_disk+0x194/0x390 [ 1263.744551][ T8066] nbd_dev_add+0x494/0xb60 [ 1263.749498][ T8066] nbd_init+0x168/0x1f0 [ 1263.754361][ T8066] do_one_initcall+0x250/0x870 [ 1263.759660][ T8066] do_initcall_level+0x10a/0x1a0 [ 1263.765146][ T8066] do_initcalls+0x59/0xa0 [ 1263.770000][ T8066] kernel_init_freeable+0x29d/0x3e0 [ 1263.775729][ T8066] kernel_init+0x22/0x1d0 [ 1263.780588][ T8066] ret_from_fork+0x514/0xb70 [ 1263.785708][ T8066] ret_from_fork_asm+0x1a/0x30 [ 1263.791075][ T8066] [ 1263.791075][ T8066] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 1263.798339][ T8066] __lock_acquire+0x164c/0x2de0 [ 1263.803738][ T8066] lock_acquire+0x115/0x350 [ 1263.808852][ T8066] fs_reclaim_acquire+0x71/0x100 [ 1263.814320][ T8066] prepare_alloc_pages+0x149/0x600 [ 1263.819961][ T8066] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1263.826412][ T8066] alloc_pages_mpol+0x21e/0x390 [ 1263.831883][ T8066] alloc_pages_noprof+0xb1/0x2b0 [ 1263.837350][ T8066] __pud_alloc+0x3a/0x460 [ 1263.842385][ T8066] handle_mm_fault+0x2519/0x3750 [ 1263.847854][ T8066] do_user_addr_fault+0x746/0x1340 [ 1263.853754][ T8066] exc_page_fault+0x6a/0xc0 [ 1263.858788][ T8066] asm_exc_page_fault+0x26/0x30 [ 1263.864167][ T8066] rep_movs_alternative+0x30/0xa0 [ 1263.869720][ T8066] _copy_from_user+0x7a/0xb0 [ 1263.874928][ T8066] rfcomm_dev_ioctl+0x28c/0x21c0 [ 1263.880522][ T8066] sock_do_ioctl+0x101/0x320 [ 1263.885780][ T8066] sock_ioctl+0x57a/0x7e0 [ 1263.890637][ T8066] __se_sys_ioctl+0xfc/0x170 [ 1263.895759][ T8066] do_syscall_64+0x166/0x520 [ 1263.901054][ T8066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1263.907471][ T8066] [ 1263.907471][ T8066] other info that might help us debug this: [ 1263.907471][ T8066] [ 1263.917875][ T8066] Chain exists of: [ 1263.917875][ T8066] fs_reclaim --> sk_lock-AF_INET --> &mm->mmap_lock [ 1263.917875][ T8066] [ 1263.930423][ T8066] Possible unsafe locking scenario: [ 1263.930423][ T8066] [ 1263.938163][ T8066] CPU0 CPU1 [ 1263.943587][ T8066] ---- ---- [ 1263.949069][ T8066] rlock(&mm->mmap_lock); [ 1263.953494][ T8066] lock(sk_lock-AF_INET); [ 1263.960537][ T8066] lock(&mm->mmap_lock); [ 1263.967488][ T8066] lock(fs_reclaim); [ 1263.971658][ T8066] [ 1263.971658][ T8066] *** DEADLOCK *** [ 1263.971658][ T8066] [ 1263.980220][ T8066] locks held by syz.0.14983/8066: 2, last CPU#1: [ 1263.986678][ T8066] #0: ffffffff904039a0 (rfcomm_ioctl_mutex){+.+.}-{4:4}, at: rfcomm_dev_ioctl+0x25f/0x21c0 [ 1263.996934][ T8066] #1: ffff88802854f678 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 1264.006886][ T8066] [ 1264.006886][ T8066] stack backtrace: [ 1264.012809][ T8066] CPU: 1 UID: 0 PID: 8066 Comm: syz.0.14983 Not tainted syzkaller #0 PREEMPT(full) [ 1264.022184][ T8066] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1264.032248][ T8066] Call Trace: [ 1264.035536][ T8066] [ 1264.038482][ T8066] dump_stack_lvl+0xe8/0x150 [ 1264.043206][ T8066] print_circular_bug+0x2e2/0x300 [ 1264.048332][ T8066] check_noncircular+0x12f/0x150 [ 1264.053283][ T8066] __lock_acquire+0x164c/0x2de0 [ 1264.058141][ T8066] ? do_raw_spin_lock+0x12b/0x2f0 [ 1264.063179][ T8066] lock_acquire+0x115/0x350 [ 1264.067704][ T8066] ? prepare_alloc_pages+0x149/0x600 [ 1264.073002][ T8066] fs_reclaim_acquire+0x71/0x100 [ 1264.077954][ T8066] ? prepare_alloc_pages+0x149/0x600 [ 1264.083249][ T8066] prepare_alloc_pages+0x149/0x600 [ 1264.089352][ T8066] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1264.095205][ T8066] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1264.101552][ T8066] ? __pfx_policy_nodemask+0x10/0x10 [ 1264.106861][ T8066] alloc_pages_mpol+0x21e/0x390 [ 1264.111743][ T8066] alloc_pages_noprof+0xb1/0x2b0 [ 1264.116762][ T8066] __pud_alloc+0x3a/0x460 [ 1264.121127][ T8066] handle_mm_fault+0x2519/0x3750 [ 1264.126084][ T8066] ? __pfx_mt_find+0x10/0x10 [ 1264.130694][ T8066] ? handle_mm_fault+0xf1/0x3750 [ 1264.135653][ T8066] ? __pfx_handle_mm_fault+0x10/0x10 [ 1264.140964][ T8066] ? __lock_acquire+0x747/0x2de0 [ 1264.145908][ T8066] ? lock_mm_and_find_vma+0xa7/0x340 [ 1264.151299][ T8066] do_user_addr_fault+0x746/0x1340 [ 1264.156420][ T8066] exc_page_fault+0x6a/0xc0 [ 1264.160933][ T8066] asm_exc_page_fault+0x26/0x30 [ 1264.165891][ T8066] RIP: 0010:rep_movs_alternative+0x30/0xa0 [ 1264.171796][ T8066] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 3d 67 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 1264.191412][ T8066] RSP: 0018:ffffc900040d7ab8 EFLAGS: 00050202 [ 1264.197666][ T8066] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 1264.205732][ T8066] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc900040d7c10 [ 1264.214061][ T8066] RBP: ffffc900040d7cb0 R08: ffffc900040d7c27 R09: 1ffff9200081af84 [ 1264.222050][ T8066] R10: dffffc0000000000 R11: fffff5200081af85 R12: ffff8880212f7000 [ 1264.230030][ T8066] R13: dffffc0000000000 R14: ffffc900040d7c10 R15: 0000200000000100 [ 1264.238047][ T8066] _copy_from_user+0x7a/0xb0 [ 1264.242672][ T8066] rfcomm_dev_ioctl+0x28c/0x21c0 [ 1264.247641][ T8066] ? kasan_quarantine_put+0xbb/0x1f0 [ 1264.252968][ T8066] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 1264.258371][ T8066] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1264.264090][ T8066] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1264.269759][ T8066] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1264.274807][ T8066] sock_do_ioctl+0x101/0x320 [ 1264.279423][ T8066] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1264.284543][ T8066] ? hook_file_ioctl+0x1f2/0x600 [ 1264.289544][ T8066] sock_ioctl+0x57a/0x7e0 [ 1264.293985][ T8066] ? __pfx_sock_ioctl+0x10/0x10 [ 1264.298846][ T8066] ? __fget_files+0x2a/0x420 [ 1264.303491][ T8066] ? __fget_files+0x3a2/0x420 [ 1264.308174][ T8066] ? __fget_files+0x2a/0x420 [ 1264.312826][ T8066] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1264.317873][ T8066] ? __pfx_sock_ioctl+0x10/0x10 [ 1264.322727][ T8066] __se_sys_ioctl+0xfc/0x170 [ 1264.327325][ T8066] do_syscall_64+0x166/0x520 [ 1264.331928][ T8066] ? trace_irq_disable+0x3b/0x140 [ 1264.337143][ T8066] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1264.343403][ T8066] ? clear_bhb_loop+0x70/0xc0 [ 1264.348099][ T8066] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1264.353997][ T8066] RIP: 0033:0x7fbb51b9e159 [ 1264.358423][ T8066] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1264.378394][ T8066] RSP: 002b:00007fbb4fdf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1264.386904][ T8066] RAX: ffffffffffffffda RBX: 00007fbb51e25fa0 RCX: 00007fbb51b9e159 [ 1264.395010][ T8066] RDX: 0000200000000100 RSI: 00000000400452c8 RDI: 0000000000000004 [ 1264.403272][ T8066] RBP: 00007fbb51c3506b R08: 0000000000000000 R09: 0000000000000000 [ 1264.411352][ T8066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1264.419349][ T8066] R13: 00007fbb51e26038 R14: 00007fbb51e25fa0 R15: 00007ffffa8d66c8 [ 1264.427517][ T8066] [ 1268.035527][ C0] net_ratelimit: 26 callbacks suppressed [ 1268.035552][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1268.035750][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1268.035931][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1273.155537][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1273.155743][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1273.155918][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog