last executing test programs: 2m56.346740226s ago: executing program 0 (id=11081): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) socket(0x2, 0x3, 0xff) 2m55.94906925s ago: executing program 0 (id=11083): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="02142000110000000040000000000000030005000000000002000000ffffffff0000000000000000080012000000010000000000000340000600000000000027b20e97a6a9ecae000000ee00000000000000000000000000fc020000000000000000000000000000030006000000000002000000e00000010000000000000000010018"], 0x88}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x2, 0xf, 0x0, 0x0, 0x10, 0x0, 0x700, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x1, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@empty, @in6=@private2={0xfc, 0x2, '\x00', 0xff}}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x80}}, 0x0) 2m55.141944039s ago: executing program 0 (id=11087): r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000004c0)}], 0x1, &(0x7f0000000580)=ANY=[@ANYRES16=r0, @ANYRES32=r0], 0x38, 0x2000c080}, 0x2c0408d0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x94}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000240)={0x0, 0xf5, "9145580d3bfeffb0c4e5149f3d830a5921b48a241243106daea1a4d8faa73c23e7b5f0236ed22d04a8e497d13fba461f1e5f093b2b686253e696cb11546b5fe76ff2674ab18b8091095003cfa58b775a067d0bc1fd8b72f10c4a84848d202b2565d5ae6a33e2885141534c54ee9d1baf555aafc458512f0aa3eb61d009246b787d033f8d2428f62ca9616c12301fc2c1e6e24a7cbb6b82dcf7dbec8ff004b1c92293f6f80506a3667c81d9ba3183790e18d4a2b4d790d71340bbebc4e4a8314f145b074db5dba7058ed5538803139aa1bbbc5e89b507baec9ee3e82c2d3feee43bcf35768c04645548352dfbbc1775900b8345c682"}, &(0x7f0000000340)=0xfd) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) socket$kcm(0x2, 0xa, 0x2) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x3, 0x7) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, '\x00', 0x14}, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r6, 0x29, 0x24, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r7, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e1e, 0x80000, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="120000000000000029", @ANYRES8=r7], 0x18}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYRESDEC=r6, @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r5, @ANYBLOB="0c000b0003000060020000c0"], 0x30}, 0x1, 0x0, 0x0, 0x4008840}, 0x30004016) socket$can_bcm(0x1d, 0x2, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000003c0)={r2, 0x10001}, &(0x7f0000000440)=0x8) sendmsg$sock(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="2e00000013000500000000000000000003010000100002007664706173696d5f626c6b000a000400766470613000", 0x2e}], 0x1}, 0x0) 2m52.884212934s ago: executing program 0 (id=11098): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0xa1}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 2m52.63765737s ago: executing program 0 (id=11103): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40009}, 0x94) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x23}}}}, 0x0, 0x0, 0x34, 0x0, "f1f7882eade7f9ed59dd754ed3fa9513bc8d9662eaae6a87ea17d19cced73fca9d00b370eaefb2ecab4c20fb0d62c726cc3cb83d211da63fb4007c81ad7a2edac7859b8988028702e2027b84c554f86f"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x4c, 0x0, "01deaba05ccc4fa00711be66bd584ecd190428efc9e569f4b222158b227692cebc00924f2deea371bafa061b8f2959b4b696b22e4881f40a0d8f4c2fdea78893bc2c160df3e41db4153cfd9221d01c79"}, 0xd8) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64=0x8}, @typed={0x14, 0x4, 0x0, 0x0, @ipv6=@mcast2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cdaec58754734be31d750351dc076eb43f9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad7481d8cc1bea8dc978402a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8b06c29be82fd3f", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000300000ac4010000060a030400000000000000000a0000010900010073797a310000000098010480940101800a0001006d61746368000000840102800d000100636f6e6e6d61726b000000000800010065636e00d60003007de07aa1d9457d3465659105c960ca0e6e8deff8f79545b5afd7dec3f7ebee93b85f45d7a500e458ab36eb3d3019611ae20e3dc3f68201e51a71b89baf153dd8be74cdc1b9a4a474cb86c50718b1f09a7f77ca386a6bbb9e31a12bc990f0f6191463fcc500ded459c723a8bb5a20832b90f6c1bd05cab23f8f2509b93c58cb56ad0eb15508bd9e8d90362d1a908130970c2c276b878155a244b15e220cceefca9879c77d00cd71542c1a3e3699b81c5a1d09adf4ce12615da115594efb253eab2d72a7e5b6065fb8999d51da2ac0d1ee43d800008f000300e6963db2967c13499c1185601f727ed56838d4137b07bf278e552138a39d86884fc6a21c37ba80a2ca4351db5c0c07e8a1a7b121b1881f0af38d7e25e8fc32000080efd88ec8180e4e8075318824ef492936c2b8f61c21988df0f7595ab4f56019af4fb4f78b6ffb136fb3f31aee68b54f8f16872be6793874f8b5956895c65c54fe866b5f79aa44f16409000900020073797a3200000000140000001100010000000000000000000a00000a"], 0x1ec}, 0x1, 0x0, 0x0, 0x11}, 0x20040040) connect$can_bcm(r3, &(0x7f00000001c0), 0x5d) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000700)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0x8c, 0x2, 0x1, 0x5, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_ZONE={0x6}, @CTA_SEQ_ADJ_REPLY={0x1c, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x6b5c}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x8ee0}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x8}]}, @CTA_SEQ_ADJ_REPLY={0x44, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x4af6e072}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xff}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x12}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}]}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x40}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20008844}, 0x20048050) sendmsg$can_bcm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x80) sendmsg$can_bcm(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB="0500000000e0ffffffffffff", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000008001"], 0x48}}, 0x40000) sendmsg$can_bcm(r4, &(0x7f00000002c0)={&(0x7f0000000000)={0x1d, r5}, 0x10, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYRES32=r4], 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r6, &(0x7f0000000440), 0x10) listen(r6, 0x0) accept4$vsock_stream(r6, &(0x7f0000000180)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x80000) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r7, 0x84, 0x7b, &(0x7f0000000000)={r9, 0x4}, &(0x7f0000000040)=0x8) r10 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000800)="2e00008b7cc29af9aa22fd74ddefb6951605feefe4b4f9b7c0ac0f439287530500000000000000000f80ec19acbc0413a1f8481100000097d1bd0ecd75f783df66bb9d29b57624be0362a9892d30d7cc79235a61db01042d8014ade318d01a7e11100896171be73c02ca6e6148da3681381da7f4f1641ded76d15bed2b14944decfb7f6ed1d6d5551b5681000000009f9eaf016906d61cbfb8f9add4b0ecb0452cc91de7c077b4e03a", 0xa9}], 0x1}, 0x8084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, {0x0, 0xe}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x884) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) 2m51.592948822s ago: executing program 0 (id=11113): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'bond0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000000000000054edadf639a6d8514d23cd96118fde75d1db6b4db4886c98ae566db8e20a54f1b948cbe9ca25212fc87b38da2e8464c8a02926"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x49, 0x4, 0x2, 0x0, 0x1}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x72, 0xffffffffffffffff, 0x2bebc000) unshare(0x22020400) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "399421fe8a4c9563", "00b147fbbfc100", "d6dc09ff", "16de86d67a8426bd"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) ppoll(&(0x7f0000000280)=[{r5, 0x4b0}], 0x1, 0x0, 0x0, 0x0) socketpair(0x1, 0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r4, &(0x7f00000003c0), &(0x7f0000000200)=@tcp}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r4, &(0x7f00000003c0), &(0x7f0000000300)=@tcp, 0x1}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)={0x64, 0x0, 0x10, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x1af}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x200}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x31c}], @chandef_params, @chandef_params, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xb}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x2}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x97}]}, 0x64}, 0x1, 0x0, 0x0, 0x44000054}, 0x20004004) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x40, r8, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x41, 0x5f}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16fd}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]]}, 0x40}}, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000480)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f040000004801001000045cf004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}, {&(0x7f0000000340)="fd94cf68da718d2eff4b7bc235f5efd294204825dcf181e5b04340369193952fcbf61b740179b74658b745f61aad2c26fef6bfd8ce83d8c811db83125726a44a6b1dcffa0bc756e5427be9845480c2304fc9407313f31201e5393f30b77c30b79635dbb6e9338aa4845dd75e820e520753aeaca064a0c1d48ca1b9cb8230ba0d3ecc", 0x82}], 0x2) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0xb0, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'batadv0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team_slave_0\x00'}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x800}, 0x240008a0) socket$inet_icmp(0x2, 0x2, 0x1) 2m36.408185553s ago: executing program 32 (id=11113): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'bond0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x4, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000000000000054edadf639a6d8514d23cd96118fde75d1db6b4db4886c98ae566db8e20a54f1b948cbe9ca25212fc87b38da2e8464c8a02926"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x49, 0x4, 0x2, 0x0, 0x1}, 0x50) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x72, 0xffffffffffffffff, 0x2bebc000) unshare(0x22020400) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "399421fe8a4c9563", "00b147fbbfc100", "d6dc09ff", "16de86d67a8426bd"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) ppoll(&(0x7f0000000280)=[{r5, 0x4b0}], 0x1, 0x0, 0x0, 0x0) socketpair(0x1, 0x2, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r4, &(0x7f00000003c0), &(0x7f0000000200)=@tcp}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r4, &(0x7f00000003c0), &(0x7f0000000300)=@tcp, 0x1}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)={0x64, 0x0, 0x10, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0x1af}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x200}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x31c}], @chandef_params, @chandef_params, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xb}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x2}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x97}]}, 0x64}, 0x1, 0x0, 0x0, 0x44000054}, 0x20004004) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x40, r8, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x41, 0x5f}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16fd}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x9}], @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}]]}, 0x40}}, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000000480)=[{&(0x7f0000000280)="390000001300090468fe0700000000001000ff3f040000004801001000045cf004002b000a00010014a4ee1ee438d2fd000000000000007208", 0x39}, {&(0x7f0000000340)="fd94cf68da718d2eff4b7bc235f5efd294204825dcf181e5b04340369193952fcbf61b740179b74658b745f61aad2c26fef6bfd8ce83d8c811db83125726a44a6b1dcffa0bc756e5427be9845480c2304fc9407313f31201e5393f30b77c30b79635dbb6e9338aa4845dd75e820e520753aeaca064a0c1d48ca1b9cb8230ba0d3ecc", 0x82}], 0x2) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)={0xb0, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0_vlan\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'batadv0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'team_slave_0\x00'}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x800}, 0x240008a0) socket$inet_icmp(0x2, 0x2, 0x1) 4.881080225s ago: executing program 5 (id=11998): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x48, r3, 0x1, 0xfffbff80, 0x0, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5, 0x3, 0x80}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}]}, 0x48}}, 0x4080) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000008c0)=@can_delroute={0x1c, 0x19, 0x5, 0x70bd2d, 0x25dfdbff, {}, [@CGW_LIM_HOPS={0x5, 0xd, 0x8}]}, 0x1c}}, 0x4040850) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x20) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz0\x00', 0x200002, 0x0) unshare(0x20400) socket$inet(0x2, 0x2, 0x0) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x101880, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000d80)=@o_path={&(0x7f0000000d40)='.\x00', 0x0, 0x4000, r5}, 0x18) socket$netlink(0x10, 0x3, 0x7) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x130, 0x1c8, 0xffffffff, 0xffffffff, 0x98, 0x130, 0x1c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf, 0x7, 0x5b4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) syz_emit_ethernet(0xbd, &(0x7f00000002c0)={@broadcast, @remote, @val={@void, {0x8100, 0x6, 0x0, 0x4}}, {@generic={0x1213, "f8f6af9a40b3aca278cb830cef220e38d51ce592ff1ee59e0fef26951b02d3359111b1413f08886d3620202cce3eae7bfdcfefe4220f459ff02cca155771d0f8014da1fca7d4db1a5c82727454fe3df232b8579384972c4c9d89f059f0fb640612b1a64f253e3c01b0e7b01da4a404308b87e25384c2ca702c05270ad38fdd67e6a0455bdc708c9fa7d22707fd2f6d104b97e13bff1c505e263fd0f8d6d708f8a8ad2a4cc07ab25a979313"}}}, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r7, 0x84, 0x23, 0x0, 0x0) r8 = socket(0x23, 0x5, 0x0) write(r8, 0x0, 0x4d) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) r9 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$inet_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f0000000440), 0x3) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000003900250825bd7000fadbdf250f0000001c0007800800028004"], 0x30}, 0x1, 0x0, 0x0, 0x4050}, 0x0) r11 = socket$kcm(0x1e, 0x5, 0x0) setsockopt$sock_attach_bpf(r11, 0x10f, 0x87, &(0x7f00000008c0), 0x43) 4.611064734s ago: executing program 1 (id=12000): syz_emit_ethernet(0x46, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000000000103afffc020000000000000000000000000001ff020000000000000000000000000001860090780100000000000000000000007f0ef235d0a0bda46ee2c5636d79a25e768e2928140b4c0d7b272909200325736da5a85d6a22680e23ac1796c47b5ba539a1197aa45860b715179afc0559c27a88a8a514a5d91008b17e137c407c4aaa62d7bfd962876b2bde48e4c3fc7ef77154a7efa1b64b4df2c0f58daa25a14aef9d027cca53a7a606d681a2b7cdeb6205653914c2326333c8c2ea6c68efc6d3ae8eff5fe5ff7e18423ec98b04dd0d26f50fa159a0985b7c1ea7a12d98a7e1f645a255a74f21265da5202253ce77d6db9123c4d841f1249b1d4467d2afa935ad3663902cd6eb2a54713fdd3f4046627c22aa88e7e5d7da7f200bcedc15f5721b8c07bbf7c727d929e8bc7471dfd4843cea2943dd3c3bf6ff6c8839d98eb5f7b364"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x6, 0x3d832047, 0xfff, 0x7, 0x1b8e, 0x0, 0x9, 0x5}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) r6 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r6, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) sendto$packet(r6, &(0x7f0000000400)="f1c4f14ee0df661e1cc82685e0d9bd06dbc86f020c7ef4a9f0f97bb627e6a55e626d0a10fca7d771cb0144daee0e98b3367dc494357151b3efe410432a56343f80b30c309dfc7fc90d0c8377fa7e2dc10fd67b51e108cc67db8453547a440af7de4e399f450f542d", 0x68, 0x2000c080, &(0x7f0000000480)={0x11, 0xf3, r5, 0x1, 0x5c, 0x6, @local}, 0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r3, {0xf000, 0xffff}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x0, 0xfff3}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001200000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x8, &(0x7f0000000200)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x2000000, 0x0, 0x0, 0x41000, 0x54, '\x00', 0x0, @fallback=0x23, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.220685833s ago: executing program 5 (id=12001): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'bridge0\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000140)={'bridge_slave_0\x00', 0x1}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@RTM_NEWMDB={0x38, 0x54, 0x401, 0x0, 0x0, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x0, 0x0, {@in6_addr=@mcast2, 0x86dd}}}]}, 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000054000104000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES32=r3, @ANYBLOB="01000000ef01010100000000000000000000000008000000"], 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@setlink={0x28, 0x13, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=@dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}}, 0x20}}, 0x0) 4.043878556s ago: executing program 2 (id=12003): socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x4020600) unshare(0x800) r0 = socket$inet_smc(0x2b, 0x1, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_mreq(r3, 0xff00, 0x24, &(0x7f00000005c0)={@empty, @empty}, 0x8) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000000906010800000000000000210200ffec0900020073797a3100000000050001000700000004000880"], 0x2c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002cbd700000100000010000000c0002000400000000020000100007800c00018008000100", @ANYRES32=r1, @ANYBLOB="0c0005001e"], 0x3c}}, 0x4000004) bind$packet(r1, &(0x7f0000000000)={0x11, 0x1b, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r7, &(0x7f00000000c0)={0x1d, r8}, 0x10) sendmsg$can_bcm(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="0100000081000000008e24ca5f24f52a31c27869b408000000000000", @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000030000e0020200005e3dba8ae862e81c"], 0x48}, 0x1, 0x0, 0x0, 0x8004}, 0x0) sendmsg$can_bcm(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="0100000044090000efffffff00000000", @ANYRES64=0xea60, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001000000000000602f030000f1b68c3e70a5d4bb02ab9dd1826faf62d4bcfd6c350a928a417ccf61f72b6378965ff4776ad1e8e0b6d8bc529caeb5e8ff90381a02e9b1826bd45bc45cb2"], 0x80}, 0x1, 0x0, 0x0, 0x20000040}, 0x8050) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r11 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r11, &(0x7f00000000c0)="080211000000cbc2ed40000188", 0xd, 0x0, &(0x7f0000000700)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @random="080208486f57"}, 0x14) ioctl(r6, 0x8b2a, &(0x7f0000000040)) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) getsockopt$inet_tcp_int(r0, 0x11e, 0x5, 0x0, 0x0) 3.776475784s ago: executing program 3 (id=12004): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000100001000000000f000000000500000a54000000060a010400000007000000000a0000010900010073797a3100000000200004801c000180090001006d617371000000000c000280080003400000000006000740bee100000900020073797a32"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) 3.731970298s ago: executing program 1 (id=12005): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000140)=ANY=[], 0x0, 0x6, 0x0, 0x0, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a000000000000d74619edc70000", @ANYRESOCT=r0], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd000005000500000000000a"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x81, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001380)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x4}, {}, {0x1, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x98, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x0, 0x6, 0x8, 0x101, 0x4, 0xe, 0x7, 0x2, [{0x8e5, 0x8b39, 0x3a, 0x40}, {0x8, 0x7, 0x9, 0x2d}, {0xffffff89, 0x9d2, 0x2, 0x10000}, {0x9, 0x3, 0x8, 0x8}, {0x0, 0x8, 0x3b7, 0x5}, {0x553e3387, 0x3, 0x8000, 0x2}, {0x8001, 0x4, 0x1}, {0xffffffff, 0xa8c, 0xfffffff8, 0xd}]}}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r4, {0xd, 0xc}, {0x0, 0xfff1}, {0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4049080) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="58bc0d25", @ANYRES16, @ANYBLOB="080029bd7000fddbdf2508000000440003800800030003000000080003000b00000008000300165d0000080003000000000008000100001000000800030000000000080002"], 0x58}, 0x1, 0x0, 0x0, 0x4008010}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x403, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1e8f7, 0x14}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_PORT={0x6, 0x2, 0x1, 0x0, 0x4e22}]}}}, @IFLA_IFNAME={0x14, 0x3, 'macsec0\x00'}]}, 0x50}}, 0x0) r6 = socket(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x3, &(0x7f0000000140)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x5, 0x72, &(0x7f00000002c0)=""/209, 0x0, 0x21, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x1c}, 0x94) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x28) socket(0x21, 0x2, 0x5) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000003980)={r7, 0x20, &(0x7f00000002c0)={0x0, 0x0, 0x0, &(0x7f0000002b00)=""/171, 0xab}}, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$F2FS_IOC_DEFRAGMENT(r9, 0xc010f508, &(0x7f00000003c0)={0xe041, 0x5}) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r8, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 3.514648984s ago: executing program 2 (id=12006): socket$packet(0x11, 0x2, 0x300) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000003340)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xfffffffb, @remote, 0x5}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000140)='.', 0x1}], 0x1, 0x0, 0x0, 0xf000000}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x218}}], 0x2, 0x0) 3.416076326s ago: executing program 3 (id=12007): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x4, 0x0, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000840)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3b8, 0x0, 0x98, 0x130, 0x1c8, 0x288, 0x0, 0x98, 0x130, 0x288, 0x320, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@inet=@length={{0x28}, {0x0, 0xffff}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x450) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000180)={'NETMAP\x00'}, &(0x7f00000001c0)=0x1e) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000440), 0x10) listen(r2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x43, &(0x7f0000000040)={0x0, 0x2710}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000008060001080006"], 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local}, 0x14) 3.299435819s ago: executing program 5 (id=12008): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x40000000, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0x5, 0x4, 0x0, 0x32, 0xe, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @local}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e22}, 0x1}, 0x3}, 0x1}}}}}}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 3.231342809s ago: executing program 2 (id=12009): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB='\x00'], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$PPPIOCSMRU(0xffffffffffffffff, 0x40047452, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={0x0, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080040"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x40002, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r4, &(0x7f0000000440)={&(0x7f0000000040), 0xc, &(0x7f0000000400)={&(0x7f0000000240)={0x19c, r5, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x188, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0x4}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0xa, 0x1, 0x2}]}]}]}, 0x19c}, 0x1, 0x0, 0x0, 0x80}, 0x800) socket$kcm(0x10, 0x2, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r6, 0x1, 0x4d, 0x0, &(0x7f0000cab000)=0x2) ioctl$RFKILL_IOCTL_NOINPUT(r3, 0x5202) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) r8 = accept$alg(r7, 0x0, 0x0) recvmmsg(r8, &(0x7f0000006100), 0x49f, 0x0, 0x0) r9 = socket$inet6(0xa, 0x2, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x4c, 0x0, 0x205, 0xfffffffc, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x1}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x5}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x6}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0xfff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x13fea3995e811172}, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000001c0)={0x4, 0x1, 0x4, 0xfffffffe, 0x7, 0x5646, 0x151, 0x10000101}, 0x20) sendmsg$nl_generic(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYRESHEX=r2], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) recvmmsg(r9, 0x0, 0x0, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 2.858071911s ago: executing program 1 (id=12010): syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000000b00), 0xff97, 0x0, &(0x7f0000000c00)={0xa, 0x1f90, 0x0, @local}, 0x1c) 2.851904056s ago: executing program 5 (id=12011): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x13, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@printk={@lx, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x5}, {}, {0x85, 0x0, 0x0, 0x73}}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r2 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x9, 0x1}}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x93, 0xfc}, [{0xd0000000, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0xfffffffc}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8, 0x5, 0x0, 0xfffffffc, 0x5}, {0x0, 0x0, 0x3d, 0x0, 0x20000}, {0x0, 0x0, 0x0, 0x0, 0x6, 0xffffffff}, {0x0, 0xc3}, {0x0, 0x5}, {0x5, 0x8000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x10}, {0x0, 0x404, 0x0, 0x8000000}, {0x0, 0xffffffff, 0x0, 0x0, 0xfffffffd}, {0x42, 0x0, 0x400000, 0x4000, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x20, 0xfffffffc}, {0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x15}, {}, {0x4000, 0x7, 0x0, 0x1, 0xffffffff}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x80000003}, {0x0, 0xffffffff, 0x0, 0x3, 0x5, 0xfffffffd}, {0xffffffff, 0x10000000}, {}, {0x0, 0x0, 0xc, 0x7, 0x0, 0x6}, {0xffffffff}, {0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {0xffffffff, 0x0, 0x0, 0x0, 0x5, 0xfffffffc}, {0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x29, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x1, 0x3, 0xfffffffe}, {0x80, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {0x0, 0x28e, 0x2, 0x5}, {0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x8, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x9}, {0x800, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x6, 0x3}, {0x0, 0x12, 0x0, 0x48510}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xcb}, {0x0, 0x0, 0x0, 0x0, 0x10000, 0x4000}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xd, 0xffffffff}, {0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x26, 0x2}, {0x0, 0xfffefffd}, {0x0, 0x0, 0x0, 0x1, 0xfffffffd}, {0x0, 0x2, 0x0, 0x88}, {0x5}, {}, {0x0, 0xfffffffc, 0x0, 0x3ff, 0x40000000, 0x200000}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x400000}, {0x4, 0x0, 0x200, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x5}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x4000, 0x0, 0x4e}, {0x0, 0x54e4}, {0x0, 0x101, 0x0, 0x4, 0x0, 0xffffffff}, {0x1, 0x0, 0x0, 0x0, 0x8000}, {0x2f, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x4, 0x9}, {0xfffffffe, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x402}, {}, {0x0, 0x2, 0xfffffffd, 0x80000, 0x3}, {}, {0x800000, 0x9, 0x5, 0x0, 0x0, 0x56}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffefffff}, {0x0, 0xfffffffe}, {0x0, 0x0, 0x6, 0x0, 0x8000004}, {0x0, 0x80}, {}, {0x0, 0xfffffffd}, {0x6, 0x0, 0x0, 0x0, 0x8}, {0x7f, 0x0, 0xfffffffe, 0xfffffffe}, {0xfff}, {}, {0xffffffff, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x2, 0x8, 0x20000000}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x2000000}, {0x0, 0x80000000, 0x0, 0x7619, 0x0, 0x6}, {0x5, 0x5, 0x0, 0x0, 0x1}, {0x0, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x80}, {0x10000000, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x2e9c, 0x0, 0x0, 0x7, 0x7f53}, {0x0, 0x0, 0x0, 0x0, 0x2}, {0x3, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x4, 0x7fffffff}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x1}, {}, {0xfffffffe, 0x0, 0x0, 0x0, 0x8000, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {0x0, 0x8000, 0x3, 0x0, 0x0, 0x80}, {0x0, 0x0, 0x10000, 0x0, 0xfffffffc, 0x2}, {0x0, 0x80000000, 0x0, 0x7dff800}, {0x3, 0x0, 0x0, 0x0, 0xffffffff, 0x40}, {0xfffffffe}, {0x0, 0x8, 0x2000000}], [{0x3}, {}, {}, {}, {}, {0x3}, {}, {0x3, 0x1}, {0x2, 0x1}, {}, {}, {0x1}, {0x4, 0x1}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {0x4}, {0x2}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {0x0, 0x1}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {0x1, 0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x2}, {0x3}, {}, {0x1}, {}, {}, {}, {0x3}, {0x0, 0x1}, {}, {0x8, 0x1}, {}, {0x1, 0x1}, {0x4}, {}, {0x0, 0x1}, {}, {}, {0x3}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {0x5}, {}, {}, {0x7}, {}, {0x3}, {}, {0x5}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x5}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {0x1}, {}, {0x0, 0x1}, {0x1}, {}, {0x5}, {}, {0x3}, {}, {}, {}, {}, {0x6}, {0x2, 0x1}, {}, {}, {}, {0x3, 0x1}, {0x0, 0x1}, {}, {}, {0x2}, {0x2}, {}, {}, {0x4}, {0x1}, {}, {}, {0x0, 0x1}, {0x2}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x1e01, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x7fffffffffffffff}]}, 0x108) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x20000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r2, 0x58, &(0x7f0000000600)}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061044c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x13, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@printk={@lx, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x5}, {}, {0x85, 0x0, 0x0, 0x73}}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x9, 0x1}}, 0x40) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0xe68, 0x30, 0x871a15abc695fa3d, 0x70bd27, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{}, 0x93, 0xfc}, [{0xd0000000, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0xfffffffc}, {0x1, 0x0, 0x0, 0x4000000, 0x7, 0x80000}, {0x8, 0x5, 0x0, 0xfffffffc, 0x5}, {0x0, 0x0, 0x3d, 0x0, 0x20000}, {0x0, 0x0, 0x0, 0x0, 0x6, 0xffffffff}, {0x0, 0xc3}, {0x0, 0x5}, {0x5, 0x8000}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x10}, {0x0, 0x404, 0x0, 0x8000000}, {0x0, 0xffffffff, 0x0, 0x0, 0xfffffffd}, {0x42, 0x0, 0x400000, 0x4000, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x8000000}, {}, {0x0, 0x0, 0x0, 0x0, 0x20, 0xfffffffc}, {0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x15}, {}, {0x4000, 0x7, 0x0, 0x1, 0xffffffff}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x80000003}, {0x0, 0xffffffff, 0x0, 0x3, 0x5, 0xfffffffd}, {0xffffffff, 0x10000000}, {}, {0x0, 0x0, 0xc, 0x7, 0x0, 0x6}, {0xffffffff}, {0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {0xffffffff, 0x0, 0x0, 0x0, 0x5, 0xfffffffc}, {0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x29, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x1, 0x3, 0xfffffffe}, {0x80, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {0x0, 0x28e, 0x2, 0x5}, {0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x8, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x9}, {0x800, 0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x6, 0x3}, {0x0, 0x12, 0x0, 0x48510}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xcb}, {0x0, 0x0, 0x0, 0x0, 0x10000, 0x4000}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0xd, 0xffffffff}, {0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x0, 0x26, 0x2}, {0x0, 0xfffefffd}, {0x0, 0x0, 0x0, 0x1, 0xfffffffd}, {0x0, 0x2, 0x0, 0x88}, {0x5}, {}, {0x0, 0xfffffffc, 0x0, 0x3ff, 0x40000000, 0x200000}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x400000}, {0x4, 0x0, 0x200, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0xffffffff}, {0x5}, {0x0, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x4000, 0x0, 0x4e}, {0x0, 0x54e4}, {0x0, 0x101, 0x0, 0x4, 0x0, 0xffffffff}, {0x1, 0x0, 0x0, 0x0, 0x8000}, {0x2f, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x4, 0x9}, {0xfffffffe, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x402}, {}, {0x0, 0x2, 0xfffffffd, 0x80000, 0x3}, {}, {0x800000, 0x9, 0x5, 0x0, 0x0, 0x56}, {0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffefffff}, {0x0, 0xfffffffe}, {0x0, 0x0, 0x6, 0x0, 0x8000004}, {0x0, 0x80}, {}, {0x0, 0xfffffffd}, {0x6, 0x0, 0x0, 0x0, 0x8}, {0x7f, 0x0, 0xfffffffe, 0xfffffffe}, {0xfff}, {}, {0xffffffff, 0x2, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, {0x2, 0x8, 0x20000000}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x292}, {0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x2000000}, {0x0, 0x80000000, 0x0, 0x7619, 0x0, 0x6}, {0x5, 0x5, 0x0, 0x0, 0x1}, {0x0, 0x5}, {0x0, 0x0, 0x0, 0x0, 0x80}, {0x10000000, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x2e9c, 0x0, 0x0, 0x7, 0x7f53}, {0x0, 0x0, 0x0, 0x0, 0x2}, {0x3, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x4, 0x7fffffff}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x1}, {}, {0xfffffffe, 0x0, 0x0, 0x0, 0x8000, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {0x0, 0x8000, 0x3, 0x0, 0x0, 0x80}, {0x0, 0x0, 0x10000, 0x0, 0xfffffffc, 0x2}, {0x0, 0x80000000, 0x0, 0x7dff800}, {0x3, 0x0, 0x0, 0x0, 0xffffffff, 0x40}, {0xfffffffe}, {0x0, 0x8, 0x2000000}], [{0x3}, {}, {}, {}, {}, {0x3}, {}, {0x3, 0x1}, {0x2, 0x1}, {}, {}, {0x1}, {0x4, 0x1}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {0x4}, {0x2}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {0x0, 0x1}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {0x1, 0x1}, {}, {}, {}, {0x0, 0x1}, {}, {0x2}, {0x3}, {}, {0x1}, {}, {}, {}, {0x3}, {0x0, 0x1}, {}, {0x8, 0x1}, {}, {0x1, 0x1}, {0x4}, {}, {0x0, 0x1}, {}, {}, {0x3}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {0x5}, {}, {}, {0x7}, {}, {0x3}, {}, {0x5}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x5}, {}, {0x0, 0x1}, {}, {0x0, 0x1}, {}, {}, {0x1}, {}, {0x0, 0x1}, {0x1}, {}, {0x5}, {}, {0x3}, {}, {}, {}, {}, {0x6}, {0x2, 0x1}, {}, {}, {}, {0x3, 0x1}, {0x0, 0x1}, {}, {}, {0x2}, {0x2}, {}, {}, {0x4}, {0x1}, {}, {}, {0x0, 0x1}, {0x2}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x1e01, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x7fffffffffffffff}]}, 0x108) (async) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x20000) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r2, 0x58, &(0x7f0000000600)}, 0x10) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000061044c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x1, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd8b, 0xffffffffffffffff}, 0x48) (async) 2.646673739s ago: executing program 2 (id=12012): socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x2, 0x4) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x10000000}, 0x1c) (async) r2 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r2, &(0x7f00000008c0)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536002d346c6b0ce4840c4e5ad94a461cdbfee9bdb942352359a351d1ec", 0x4c, 0x810, 0x0, 0x0) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r4 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000540)=ANY=[@ANYBLOB="58e1cd4135395c991de85eccd20e7f2651d9c1731a43d7fd99176d94f18f035f837b41b854b86f22f36c6c2ba368856854b93c70d056f6030000000000000042ecb0542eecd86e97263183eac0ff574a2e5060eca6d1155d91eaf29a2bfb075f4cf76904198a32a1774a4be03f670a2ea9e1df9fb6bb9e19d624b4f1e1e2a85b453d3c6cee82ab12f27c843b6532bec26fff7f57657e072b0c66c4e04824"], 0x9) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000900260001fc28bd1a0e0000000000000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1d, 0xc, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x6b}}]}, &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @lsm=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x1000007, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r5) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x16, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000b5000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000008900000095"], &(0x7f00000001c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcc85}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000300)=ANY=[@ANYBLOB="c3aa00fe5000000071101a00000094e9e8d169cc01800000950000000000fd00"], &(0x7f0000000480)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x48}, 0x94) (async) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000180)=@gcm_128={{0x304}, "a4c51a4d1bc77a24", "245586e7cae61db3a53c3b701d5a3efe", "0a1ad2f4", "63fd2e1ecc22a424"}, 0x28) setsockopt$inet6_tcp_TLS_RX(r3, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x304}, "3b4ab2c1144068b2", "963e11e0be5f9fd4fa47d22055202c7b", "9df00001", "b327c6e40e868fa2"}, 0x28) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xa}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x12, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@map=r7, r6, 0x26}, 0x10) 2.598571991s ago: executing program 3 (id=12013): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000280)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x68, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x68}}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000ff", @ANYRES16=r1, @ANYBLOB="050001000000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="34005080140001000102030405060708090a0b0c0d0e0f1005000200060000000800030006ac0f000a0004000000000000000000"], 0x50}}, 0x0) r4 = syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f0000000340)=0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r6, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r6, 0x0, 0x28, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000380)=0x0) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000", @ANYRES16, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r10], 0x1c}}, 0x840) sendmsg$NFC_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, r4, 0x20, 0x70bd27, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r10}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000000}, 0x800) r11 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f00000004c0)) connect$inet6(r11, &(0x7f0000000500)={0xa, 0x4e22, 0x20, @remote, 0xfffffffe}, 0x1c) sendmsg$NL80211_CMD_SET_KEY(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050002000000000000000a00000008000300", @ANYRES32=r2, @ANYBLOB="10005080050002000600000004000a00"], 0x2c}}, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r8, 0x114, 0xa, &(0x7f0000000480)={0x1, "f3"}, 0x2) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) 2.552761043s ago: executing program 4 (id=12014): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x7) sendmsg$inet(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)="e4", 0x1}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 2.535390041s ago: executing program 1 (id=12015): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000060a010400000000090000000a0000010900010073797a31"], 0x6c}, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6111b712000011ff00000000000000120000000000000001ff02000000000000000000000000000134ca5305caaebc"], 0xfdef) 2.391644941s ago: executing program 4 (id=12016): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000002c0)={0x18, 0x0, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40}, 0x804) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="60000000100005040100000000000000000000000003000000000000000000000a00030076657468300000003400128009000100766574680000000024000280200001"], 0x60}}, 0x0) r2 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x24, r5, 0x300, 0x1070bc2d, 0x21dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0xc}, @NL80211_ATTR_TXQ_QUANTUM={0x8, 0x10c, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480c1}, 0x40000) sendmsg$NL80211_CMD_SET_COALESCE(r4, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r5, 0x1, 0x14, 0x0, {{0x2}, {@val={0x8, 0x3, r6}, @void}}}, 0x28}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x88, 0x1403, 0x1, 0x70bd2a, 0x25dfdc01, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth1_to_bond\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'wg2\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macvlan1\x00'}}]}, 0x88}, 0x1, 0x0, 0x0, 0x20000040}, 0x24008080) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01080000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000040c0001800800014000000004540000000c0a01010000000000000000020000000900020073797a31000000000900010073797a30000000002800038024000080100001800c0001000000e4ff0000000010000a"], 0x100}}, 0x0) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@bridge_delneigh={0x28, 0x1d, 0x200, 0x70bd26, 0x25dfdbfc, {0x2, 0x0, 0x0, 0x0, 0x4, 0x4a, 0x5}, [@NDA_FDB_EXT_ATTRS={0xc, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000084}, 0xc090) sendmsg$nl_generic(r8, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="a80000002d0007012bbd7000fedbdf25047c0000080001800400dd808c0003"], 0xa8}, 0x1, 0x0, 0x0, 0x14008084}, 0x0) close(0x3) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000100)=""/4096, &(0x7f0000001100)=0x1000) 2.242237819s ago: executing program 2 (id=12017): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0xe22, 0x0, @empty, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000200), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "00001f880000dbaa", "a504eb69a751e9d7e9fb434d1665e900000000ffffff7f00", '\x00\t\x00', "a301fbcf1fe65504"}, 0x38) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000580)="21b68dd8f2efee5201eb058f5111d1773cbdf6e858a29031951643083331aaa136d27077eac2bef180611597d3e9efdefcf019ee246b43af6334cafac3a56f3c03487bef0e030043cbb6ea6173aac0b2c88b45af8cf0e49d771e88374d289f48c91bdd41ea107748fda60ae8e9259bb65e112705b5fc853870297ddc5a05742a4cc94e3851ddf0fd97e04fe4b83f3d639c029ec4ccaf16cbd795429f8c586a5b7309f7a10be55f4370a724ddf09cfe67410e792b47985e601f7e493093383fe4c0e096f788c70a18c2a2f1040b17137daec0dc60fd8fc4f5585dfc91b72d6445423910c8420b0cb63648260901e9a05a3b25779003451581a54ecbcea7eaeb4550947b57ec96d685ca2898a2e547e69ba5c5fdcfdddfeeebcf463c573a89b7f0a97c8a246723e05f16d13553970d0b", 0x12f}], 0x1) 2.196522716s ago: executing program 5 (id=12018): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x9, 0x4, 0x4, 0x100, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0100000004000000040000000001"], 0x48) close(0x3) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x1c, 0x0, 0x5, 0x0, 0x25dfdbff, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r7, 0x1, 0x4000, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000050}, 0x0) r9 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newqdisc={0x40, 0x24, 0xf0b, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x0, 0xa}, {0xffff, 0xffff}, {0xffff, 0xfff3}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0xb}}}}]}, 0x40}}, 0x4000010) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000780)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80620}, 0xc, &(0x7f0000000740)={&(0x7f0000000680)={0xa4, r7, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40804}, 0x8c0) connect$can_bcm(r5, &(0x7f0000000140), 0x10) sendmmsg$sock(r5, &(0x7f0000003180)=[{{&(0x7f0000000240)=@hci={0x1d, 0x1, 0x2}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000480)="024468f75872dcc35c4a865167ce141180f86d6d2d2b667592a3c33936463143e7bb6e42171be6f3bb2c71676866c351e658a3e643566881df0577a462feffaafa974e3e86995e3ae7dbd8b6bc88af335ebe083ced9a2b1f3b847103b7af298aabf2f341cf7c9d27d81972b94be151e7a3c9487c087f8a25000000000000", 0x7e}, {&(0x7f0000000bc0)="da653e6368ca3086947a7cd9f675fec207fa0522eb427678a26306d4d58e3174157055bad9d94baf2b8a476ed0798d94173e4d6a8c03e3ad87f36f69e2d254f2fc17dc5260b177829e93e8de0efe7be1837255949efb5d662b4b", 0x5a}], 0x2}}], 0x1, 0x200000c1) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001400010028bd7000fcdbdf25022001c8", @ANYRES32=r4, @ANYBLOB="0800020096"], 0x20}}, 0x40000c0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3816}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r4}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x40}}, 0x440b0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x7ff, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000280)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @map_fd={0x18, 0x1, 0x1, 0x0, r0}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x3}]}, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r11, 0x0, 0xe, 0x0, &(0x7f00000003c0)='\x00'/14, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.058087245s ago: executing program 2 (id=12019): bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={0x1, 0xffffffffffffffff}, 0x4) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r0, 0x40109441, &(0x7f00000002c0)={0x200, 0x3, 0x3}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="180000002f00090028bd70000000000004000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x20000004) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x21031, 0xffffffffffffffff, 0x21d63000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r2, 0x80010040) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3d, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000640)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0xfffe, 0x0, 0x95, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x40, 0xb}}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1000, 0x89}, 0x50) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000380)=@filter={'filter\x00', 0x42, 0x4, 0x311, 0xffffffff, 0x1d8, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x2a8, 0x2a8, 0x2a8, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'netpci0\x00', 'nr0\x00', {0xff}}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@ip={@private=0xa010101, @multicast2, 0xff, 0x0, 'netpci0\x00', 'team_slave_1\x00'}, 0x287, 0xe0, 0x140, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x4}}, @common=@unspec=@limit={{0x48}, {0xfffffffa, 0xb, 0x0, 0x0, 0x0, 0xfffffffc}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x1278]}, {0xffff, [0x5]}}}}, {{@ip={@dev, @remote, 0x0, 0xff000000, 'veth1_to_team\x00', 'veth1_to_batadv\x00'}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x0, 0x3, 0x1, 0x2, 0x0, 0x5], 0x1, 0x4}, {0xffffffffffffffff, [0x7, 0x4, 0x4, 0x5], 0x6, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x16, &(0x7f0000000180)=""/171, &(0x7f0000000240)=0xab) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) epoll_create1(0x0) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000180003801400020000007468305f746f5f68737200000000080002"], 0xe8}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$tun(r5, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x36) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, &(0x7f00000000c0)="170000000200010400ffbe8c5ee17688a20032e80101000a000002a257fc5ad90200bb6a880000d6c8db000000df018002000000fc0607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dfc060115003901000000000000eaffff00000000000062068f5ee50ce5af9b1c5683ffffff02ff030000ba000840024f0298e9e90539062a80e605007f71174aa951f3c63e5a1b47b63a6323ded2231454668492f9c681a6a9fc", 0xb8) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) 2.007729853s ago: executing program 4 (id=12020): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffd}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x40000000, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x4e, &(0x7f00000002c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0x5, 0x4, 0x0, 0x32, 0xe, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @local}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e22}, 0x1}, 0x3}, 0x1}}}}}}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 1.798492838s ago: executing program 3 (id=12021): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xa, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={0x2, 0x3, 0x0, 0x2, 0xc, 0x0, 0x4000000, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_sa={0x2, 0x1, 0x0, 0x5, 0x0, 0x7, 0x7, 0xffffff7f}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}, @sadb_key={0x2, 0x8, 0x8, 0x0, '4'}]}, 0x60}, 0x1, 0x7}, 0x0) 1.795641041s ago: executing program 1 (id=12022): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x0, 0x3, 0x1}, 0x10) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000000000200000800040001000000", 0x24) 1.595902467s ago: executing program 3 (id=12023): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000001680)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @empty, 0x5}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000002080)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x2, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000740)=[{&(0x7f0000000a40)="fb", 0x1}], 0x1}}, {{&(0x7f0000000200)={0xa, 0x4e24, 0x7, @remote, 0xf17c}, 0x1c, 0x0}}], 0x2, 0x20080058) (fail_nth: 8) 953.636502ms ago: executing program 3 (id=12024): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000580)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) recvmmsg$unix(r1, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}, 0x200000}], 0x600, 0x0, 0x0) sendmsg$unix(r1, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000080)="d60f", 0x2}], 0x1, 0x0, 0x0, 0x4000}, 0x40000) 667.980568ms ago: executing program 5 (id=12026): socket$unix(0x1, 0x2, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) connect(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000001a40)={{0xffffffffffffffff, &(0x7f0000000000)='/proc/sys/net/ip]\x11tiox_control\x00'/42, 0x200, 0x0, 0x7ff, 0x0, 0x0}, 0x0, 0x0}) write$tun(r1, &(0x7f0000000000)=ANY=[], 0x38) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000700)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000c00)="29000000010001", 0x404) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x1ff) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$l2tp(0x2, 0x2, 0x73) syz_emit_ethernet(0x5a, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004e00004c0000000000059078ac1414320a01010444140513ffffffff000000006401010100000000890bce0a0101010000000083034a000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c40fffd90780000bd4f868c3fd710a1fbadbbadbbf282c25b7cff44f6c3050560d662f6cc79ee62904af4b37d28b114917e6d72bd5ea9d59688f665ac0def3b769e851ff09bfdd2863361b17891b71e604f2cd4a6a5cfbf9d516c7bf08dd8cb8b62f0a8485b2871a174a5f9afd8b2b9faca5d9f5c31e24473e0b056e1a8"], 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, &(0x7f00000023c0)=[{{&(0x7f0000000300)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xa}, 0x1c, &(0x7f0000000000)=[{&(0x7f00000002c0)="474d107a", 0x4}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x7, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000001300)="1f", 0x1}], 0x1}}], 0x2, 0x880) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_MAXSEG(r5, 0x84, 0xd, &(0x7f0000000100), 0x4) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0xffffffff, '\x00', 0x0, r1, 0x0, 0x3}, 0x50) ioctl$NILFS_IOCTL_SYNC(r6, 0x80086e8a, &(0x7f0000000440)) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000040)={0x0, 0x8000, "c441b2", 0x6, 0x6}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r7, 0x84, 0x13, &(0x7f0000000240)={0x0, 0x5}, &(0x7f0000000280)=0x8) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) 628.230487ms ago: executing program 1 (id=12027): socketpair(0x0, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x4a, 0x2, 0xfe, 0x9, 0x0, 0x82, 0x60, 0xa, 0x9, 0x3d, [0x4, 0x1, 0xd, 0xfff, 0x2, 0x9, 0x8001, 0x7]}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r3 = epoll_create(0x4) epoll_pwait(r3, &(0x7f0000000080)=[{}], 0x1, 0x7, &(0x7f0000000340)={[0x8]}, 0x8) sendto$packet(r1, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$can_raw(r0, &(0x7f0000000300)={&(0x7f0000000040), 0x10, &(0x7f0000000200)={&(0x7f0000000180)=@canfd={{0x2}, 0x36, 0x2, 0x0, 0x0, "0b2c88347aa19fcc77943b96f750bad69c87a4e700db1668b87c63b99790f465d5b6433cb4360c2b390b540b416ce74241879584ea6eb04b57858951084d146e"}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x40) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400"], 0x48) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x3, &(0x7f0000000040)=@framed={{}, [], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="600000000206010800000000000000000700000114000780080011400000208b050015000c39a7000500010006000000050005000200000005000400020000000900020073797a300000000011000300686173683a6e65742c6e6574"], 0x60}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r8}, 0x94) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f00000007c0)={{r5, &(0x7f00000003c0)=')-,,^.+{}!\x00', 0x101040, &(0x7f0000000400)={@_ha_fsid={[0xfffffff7, 0xb]}, {0x2935, 0x4, 0x94c, 0x1}}, 0x1, &(0x7f0000000580), &(0x7f00000005c0)=0x5}, {[0x7, 0x6c0f1039, 0xa3, 0x4]}, 0xfff, 0xd1, &(0x7f00000006c0)=""/209}) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="030000000400960500", @ANYRES32=r9, @ANYBLOB='\x00'/20, @ANYRES32, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB, @ANYRES32=r9, @ANYBLOB], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r10, &(0x7f00000001c0)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r10, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r10}, &(0x7f0000000080), &(0x7f00000000c0)=r6}, 0x20) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000008000000040000000200000000020200", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b7040000020000008500000033000000850000000700000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r13, 0x2000012, 0xe, 0x0, &(0x7f0000000600)="63ec33658f9fb9000000002c3b7f2a53c3e4f5aba0e8d3e1e9c210a7123f0f9cf3198405e67bb698822db60f97e05f826e45a312a8678956d9bafda24effc68ae565e397711de64712e86457e42d0ccfebf5e13fc71c0ffcc4502015a1ecd2d72d17f1fb32deca8dc8eef5ad69c172d3420a7231cf81dcc64d3f50b2534cf38018eb90865c98287edc61082888f4ee001b4a86b506fbdff94c35dd1a84b2829a5e6c164100"/189, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x40) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r14, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a80000000060a010400000000000000000a0000010900010073797a310000000054000480500001800b00010074617267657400004000028008000240000000012c0003007339f2f10455afb9fdd672bad09dffff000000000000a0c70000000000000000000000000000000008000100544545000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r11, 0x2000320, 0xe, 0x0, &(0x7f0000000cc0)="63eced8e46dc3f0adf3389f7b982", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 627.347734ms ago: executing program 4 (id=12028): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0xd, 0x4, 0x4, 0x10000, 0x0, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) (fail_nth: 32) 341.956261ms ago: executing program 4 (id=12029): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0xe22, 0x0, @empty, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000200), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000040)=@gcm_256={{0x304, 0x36}, "00001f880000dbaa", "a504eb69a751e9d7e9fb434d1665e900000000ffffff7f00", '\x00\t\x00', "a301fbcf1fe65504"}, 0x38) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000580)="21b68dd8f2efee5201eb058f5111d1773cbdf6e858a29031951643083331aaa136d27077eac2bef180611597d3e9efdefcf019ee246b43af6334cafac3a56f3c03487bef0e030043cbb6ea6173aac0b2c88b45af8cf0e49d771e88374d289f48c91bdd41ea107748fda60ae8e9259bb65e112705b5fc853870297ddc5a05742a4cc94e3851ddf0fd97e04fe4b83f3d639c029ec4ccaf16cbd795429f8c586a5b7309f7a10be55f4370a724ddf09cfe67410e792b47985e601f7e493093383fe4c0e096f788c70a18c2a2f1040b17137daec0dc60fd8fc4f5585dfc91b72d6445423910c8420b0cb63648260901e9a05a3b25779003451581a54ecbcea7eaeb4550947b57ec96d685ca2898a2e547e69ba5c5fdcfdddfeeebcf463c573a89b7f0a97c8a246723e05f16d13553970d0b", 0x12f}], 0x1) 0s ago: executing program 4 (id=12030): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000840000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c20098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) kernel console output (not intermixed with test programs): 16 bytes leftover after parsing attributes in process `syz.5.11331'. [ 1656.840120][T11779] netlink: 'syz.5.11331': attribute type 1 has an invalid length. [ 1656.840142][T11779] netlink: 228 bytes leftover after parsing attributes in process `syz.5.11331'. [ 1656.875238][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1656.986305][T11788] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11336'. [ 1657.107859][T11797] netlink: 'syz.1.11338': attribute type 4 has an invalid length. [ 1657.107881][T11797] netlink: 152 bytes leftover after parsing attributes in process `syz.1.11338'. [ 1657.109791][T11797] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1657.350317][T11805] FAULT_INJECTION: forcing a failure. [ 1657.350317][T11805] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1657.350348][T11805] CPU: 1 UID: 0 PID: 11805 Comm: syz.5.11340 Not tainted syzkaller #0 PREEMPT(full) [ 1657.350370][T11805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1657.350382][T11805] Call Trace: [ 1657.350390][T11805] [ 1657.350399][T11805] dump_stack_lvl+0xe8/0x150 [ 1657.350432][T11805] should_fail_ex+0x410/0x560 [ 1657.350460][T11805] _copy_from_user+0x2d/0xb0 [ 1657.350494][T11805] do_sys_poll+0x258/0x1110 [ 1657.350534][T11805] ? __lock_acquire+0x747/0x2de0 [ 1657.350555][T11805] ? __pfx_do_sys_poll+0x10/0x10 [ 1657.350586][T11805] ? lock_acquire+0x115/0x350 [ 1657.350701][T11805] ? set_user_sigmask+0xcd/0x1c0 [ 1657.350728][T11805] ? __pfx_set_user_sigmask+0x10/0x10 [ 1657.350756][T11805] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1657.350794][T11805] __se_sys_ppoll+0x209/0x2b0 [ 1657.350818][T11805] ? fput+0xa0/0xd0 [ 1657.350843][T11805] ? __pfx___se_sys_ppoll+0x10/0x10 [ 1657.350867][T11805] ? __pfx_ksys_write+0x10/0x10 [ 1657.350901][T11805] ? __x64_sys_ppoll+0x20/0xc0 [ 1657.350927][T11805] do_syscall_64+0x166/0x520 [ 1657.350952][T11805] ? trace_irq_disable+0x3b/0x140 [ 1657.350971][T11805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.350990][T11805] ? clear_bhb_loop+0x70/0xc0 [ 1657.351012][T11805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.351030][T11805] RIP: 0033:0x7fd49799e159 [ 1657.351047][T11805] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1657.351063][T11805] RSP: 002b:00007fd4987fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 1657.351085][T11805] RAX: ffffffffffffffda RBX: 00007fd497c25fa0 RCX: 00007fd49799e159 [ 1657.351099][T11805] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000200000000080 [ 1657.351113][T11805] RBP: 00007fd4987fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1657.351125][T11805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1657.351137][T11805] R13: 00007fd497c26038 R14: 00007fd497c25fa0 R15: 00007ffc71b31a18 [ 1657.351169][T11805] [ 1657.631786][T11808] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11342'. [ 1657.655428][T11808] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11342'. [ 1657.656500][T11808] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 1657.771109][T11810] IPVS: persistence engine module ip_vs_pe_À not found [ 1657.915125][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1658.442320][T11829] bridge0: port 3(macvlan2) entered blocking state [ 1658.442514][T11829] bridge0: port 3(macvlan2) entered disabled state [ 1658.442651][T11829] macvlan2: entered allmulticast mode [ 1658.442666][T11829] ip6gretap0: entered allmulticast mode [ 1658.497036][T11829] macvlan2: entered promiscuous mode [ 1658.497803][T11829] bridge0: port 3(macvlan2) entered blocking state [ 1658.497923][T11829] bridge0: port 3(macvlan2) entered forwarding state [ 1658.502291][T11835] netlink: 'syz.4.11350': attribute type 3 has an invalid length. [ 1658.771428][T11839] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11353'. [ 1658.771453][T11839] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1658.771470][T11839] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1658.897570][T11839] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1658.897717][T11839] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1658.955193][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1659.077633][T11846] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11355'. [ 1659.318912][T11851] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 1659.856101][T11870] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 1659.964532][T11863] IPVS: persistence engine module ip_vs_pe_À not found [ 1659.995173][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1660.028634][T11875] netlink: 'syz.2.11367': attribute type 1 has an invalid length. [ 1660.078367][T11875] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1660.294660][T11885] FAULT_INJECTION: forcing a failure. [ 1660.294660][T11885] name failslab, interval 1, probability 0, space 0, times 0 [ 1660.294692][T11885] CPU: 0 UID: 0 PID: 11885 Comm: syz.2.11369 Not tainted syzkaller #0 PREEMPT(full) [ 1660.294712][T11885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1660.294723][T11885] Call Trace: [ 1660.294741][T11885] [ 1660.294750][T11885] dump_stack_lvl+0xe8/0x150 [ 1660.294783][T11885] should_fail_ex+0x410/0x560 [ 1660.294811][T11885] should_failslab+0xa8/0x100 [ 1660.294838][T11885] __kvmalloc_node_noprof+0x176/0x820 [ 1660.294862][T11885] ? __kvmalloc_node_noprof+0x345/0x820 [ 1660.294882][T11885] ? analyze_subprog+0x882/0x9e00 [ 1660.294903][T11885] ? analyze_subprog+0x882/0x9e00 [ 1660.294931][T11885] analyze_subprog+0x882/0x9e00 [ 1660.294953][T11885] ? is_bpf_text_address+0x292/0x2b0 [ 1660.294981][T11885] ? kernel_text_address+0xa5/0xe0 [ 1660.295006][T11885] ? arch_stack_walk+0xfb/0x150 [ 1660.295041][T11885] ? __pfx_stack_trace_save+0x10/0x10 [ 1660.295076][T11885] ? call_instance+0x263/0x560 [ 1660.295095][T11885] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 1660.295116][T11885] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 1660.295137][T11885] ? __pfx_analyze_subprog+0x10/0x10 [ 1660.295157][T11885] ? __x64_sys_bpf+0xba/0xd0 [ 1660.295173][T11885] ? do_syscall_64+0x166/0x520 [ 1660.295196][T11885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1660.295252][T11885] ? call_instance+0x263/0x560 [ 1660.295271][T11885] ? rcu_is_watching+0x16/0xb0 [ 1660.295293][T11885] ? call_instance+0x263/0x560 [ 1660.295311][T11885] ? trace_kmalloc+0x2a/0xf0 [ 1660.295331][T11885] ? call_instance+0x263/0x560 [ 1660.295350][T11885] ? __kvmalloc_node_noprof+0x52f/0x820 [ 1660.295373][T11885] ? __kvmalloc_node_noprof+0x345/0x820 [ 1660.295393][T11885] ? call_instance+0x263/0x560 [ 1660.295411][T11885] ? call_instance+0x263/0x560 [ 1660.295439][T11885] ? call_instance+0x42e/0x560 [ 1660.295467][T11885] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 1660.295511][T11885] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1660.295535][T11885] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1660.295556][T11885] ? trace_kmalloc+0x2a/0xf0 [ 1660.295573][T11885] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1660.295602][T11885] ? __kvmalloc_node_noprof+0x345/0x820 [ 1660.295622][T11885] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1660.295642][T11885] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1660.295670][T11885] bpf_compute_live_registers+0x8d3/0x1ff0 [ 1660.295709][T11885] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1660.295746][T11885] bpf_check+0x2746/0x2ef0 [ 1660.295785][T11885] ? __pfx_bpf_check+0x10/0x10 [ 1660.295808][T11885] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1660.295838][T11885] bpf_prog_load+0x14d6/0x1c20 [ 1660.295871][T11885] ? __pfx_bpf_prog_load+0x10/0x10 [ 1660.295916][T11885] __sys_bpf+0xd0d/0xd90 [ 1660.295944][T11885] ? __pfx___sys_bpf+0x10/0x10 [ 1660.295975][T11885] ? __fget_files+0x2a/0x420 [ 1660.296018][T11885] ? ksys_write+0x242/0x270 [ 1660.296048][T11885] ? __pfx_ksys_write+0x10/0x10 [ 1660.296081][T11885] __x64_sys_bpf+0xba/0xd0 [ 1660.296104][T11885] do_syscall_64+0x166/0x520 [ 1660.296128][T11885] ? trace_irq_disable+0x3b/0x140 [ 1660.296147][T11885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1660.296166][T11885] ? clear_bhb_loop+0x70/0xc0 [ 1660.296189][T11885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1660.296207][T11885] RIP: 0033:0x7f1f1919e159 [ 1660.296225][T11885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1660.296239][T11885] RSP: 002b:00007f1f1a0af028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1660.296259][T11885] RAX: ffffffffffffffda RBX: 00007f1f19425fa0 RCX: 00007f1f1919e159 [ 1660.296273][T11885] RDX: 0000000000000094 RSI: 0000200000000400 RDI: 0000000000000005 [ 1660.296284][T11885] RBP: 00007f1f1a0af090 R08: 0000000000000000 R09: 0000000000000000 [ 1660.296297][T11885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1660.296307][T11885] R13: 00007f1f19426038 R14: 00007f1f19425fa0 R15: 00007ffdfeef0fd8 [ 1660.296337][T11885] [ 1660.832721][T11892] __nla_validate_parse: 4 callbacks suppressed [ 1660.832743][T11892] netlink: 67 bytes leftover after parsing attributes in process `syz.2.11371'. [ 1661.036150][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1661.167304][T11892] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1661.271831][T11897] netlink: 72 bytes leftover after parsing attributes in process `syz.5.11373'. [ 1661.271869][T11897] netlink: 336 bytes leftover after parsing attributes in process `syz.5.11373'. [ 1661.271883][T11897] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11373'. [ 1661.358678][T11897] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1662.075199][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1662.187206][T11920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11378'. [ 1662.188248][T11921] syzkaller1: entered promiscuous mode [ 1662.188430][T11921] syzkaller1: entered allmulticast mode [ 1662.218745][T11913] IPVS: persistence engine module ip_vs_pe_À not found [ 1662.938661][T11916] netlink: 'syz.5.11380': attribute type 10 has an invalid length. [ 1663.118792][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1663.137477][T11943] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11380'. [ 1663.665153][T11948] netlink: 67 bytes leftover after parsing attributes in process `syz.4.11386'. [ 1663.866882][T11948] bridge0: port 4(macvlan0) entered blocking state [ 1663.867006][T11948] bridge0: port 4(macvlan0) entered listening state [ 1663.900251][T11948] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1663.922241][T11948] 8021q: adding VLAN 0 to HW filter on device team0 [ 1664.070622][T11955] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1664.154676][T11959] FAULT_INJECTION: forcing a failure. [ 1664.154676][T11959] name failslab, interval 1, probability 0, space 0, times 0 [ 1664.154708][T11959] CPU: 0 UID: 0 PID: 11959 Comm: syz.5.11390 Not tainted syzkaller #0 PREEMPT(full) [ 1664.154729][T11959] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1664.154741][T11959] Call Trace: [ 1664.154749][T11959] [ 1664.154758][T11959] dump_stack_lvl+0xe8/0x150 [ 1664.154791][T11959] should_fail_ex+0x410/0x560 [ 1664.154817][T11959] ? __alloc_skb+0x1db/0x7a0 [ 1664.154841][T11959] should_failslab+0xa8/0x100 [ 1664.154867][T11959] ? __alloc_skb+0x1db/0x7a0 [ 1664.154894][T11959] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1664.154923][T11959] ? __alloc_skb+0x18d/0x7a0 [ 1664.154944][T11959] ? __alloc_skb+0x1db/0x7a0 [ 1664.154975][T11959] __alloc_skb+0x1db/0x7a0 [ 1664.155002][T11959] create_monitor_ctrl_event+0x38/0x470 [ 1664.155152][T11959] mgmt_cmd_status+0x1cd/0x570 [ 1664.155169][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1664.155183][T11959] hci_sock_sendmsg+0x6e8/0xfb0 [ 1664.155236][T11959] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1664.155261][T11959] ? apparmor_socket_sendmsg+0x98/0x360 [ 1664.155282][T11959] ? lock_acquire+0x115/0x350 [ 1664.155304][T11959] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 1664.155321][T11959] sock_sendmsg_nosec+0x13a/0x180 [ 1664.155344][T11959] sock_write_iter+0x2de/0x3e0 [ 1664.155364][T11959] ? __pfx_sock_write_iter+0x10/0x10 [ 1664.155389][T11959] ? bpf_lsm_file_permission+0x9/0x20 [ 1664.155415][T11959] ? security_file_permission+0x75/0x260 [ 1664.155445][T11959] vfs_write+0x612/0xba0 [ 1664.155484][T11959] ? __pfx_vfs_write+0x10/0x10 [ 1664.155523][T11959] ? __fget_files+0x2a/0x420 [ 1664.155559][T11959] ksys_write+0x150/0x270 [ 1664.155589][T11959] ? __pfx_ksys_write+0x10/0x10 [ 1664.155630][T11959] do_syscall_64+0x166/0x520 [ 1664.155655][T11959] ? trace_irq_disable+0x3b/0x140 [ 1664.155674][T11959] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1664.155694][T11959] ? clear_bhb_loop+0x70/0xc0 [ 1664.155718][T11959] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1664.155736][T11959] RIP: 0033:0x7fd49799e159 [ 1664.155755][T11959] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1664.155770][T11959] RSP: 002b:00007fd4987fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1664.155791][T11959] RAX: ffffffffffffffda RBX: 00007fd497c25fa0 RCX: 00007fd49799e159 [ 1664.155805][T11959] RDX: 0000000000000017 RSI: 0000200000000200 RDI: 0000000000000004 [ 1664.155817][T11959] RBP: 00007fd4987fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1664.155829][T11959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1664.155840][T11959] R13: 00007fd497c26038 R14: 00007fd497c25fa0 R15: 00007ffc71b31a18 [ 1664.155874][T11959] [ 1664.201203][T11948] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1664.483478][T11948] veth1_macvtap: left promiscuous mode [ 1664.484675][T11948] veth0_macvtap: left promiscuous mode [ 1664.497842][T11948] veth0_macvtap: entered promiscuous mode [ 1664.499122][T11948] veth1_macvtap: entered promiscuous mode [ 1664.520186][T11948] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1664.521326][T11948] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1664.522385][T11948] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1664.523426][T11948] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1664.573227][T11948] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1664.586884][T26895] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1664.634124][T11964] xt_bpf: check failed: parse error [ 1664.658558][ T8705] bridge0: port 1(bridge_slave_0) entered blocking state [ 1664.658683][ T8705] bridge0: port 1(bridge_slave_0) entered listening state [ 1664.676018][ T8705] bridge0: port 2(bridge_slave_1) entered blocking state [ 1664.676131][ T8705] bridge0: port 2(bridge_slave_1) entered listening state [ 1664.762210][T11967] netlink: 56 bytes leftover after parsing attributes in process `syz.4.11393'. [ 1664.762265][T11967] netlink: 56 bytes leftover after parsing attributes in process `syz.4.11393'. [ 1664.793399][T11967] netlink: 56 bytes leftover after parsing attributes in process `syz.4.11393'. [ 1664.836198][ T8705] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1664.836462][ T8705] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1664.836595][ T8705] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1665.091314][T11972] vlan0: entered allmulticast mode [ 1665.091341][T11972] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 1665.195198][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1665.411564][T11978] lo speed is unknown, defaulting to 1000 [ 1666.235144][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1666.390343][T11993] syzkaller0: entered promiscuous mode [ 1666.390366][T11993] syzkaller0: entered allmulticast mode [ 1666.691914][T12000] __nla_validate_parse: 5 callbacks suppressed [ 1666.691932][T12000] netlink: 67 bytes leftover after parsing attributes in process `syz.5.11403'. [ 1667.173939][T12008] xt_bpf: check failed: parse error [ 1667.275211][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1667.386601][T12016] x_tables: ip6_tables: rpfilter.0 match: invalid size 8 (kernel) != (user) 48 [ 1668.315199][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1668.336799][T12022] lo speed is unknown, defaulting to 1000 [ 1668.351096][T12037] netlink: 'syz.1.11414': attribute type 1 has an invalid length. [ 1668.351113][T12037] netlink: 116 bytes leftover after parsing attributes in process `syz.1.11414'. [ 1668.711501][T12041] netlink: 67 bytes leftover after parsing attributes in process `syz.1.11416'. [ 1668.951134][T12041] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 1668.974160][ T6845] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1668.997269][T12045] xt_bpf: check failed: parse error [ 1669.206047][T12047] vcan0: tx address claim with different name [ 1669.355384][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1669.841572][ T6840] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1670.152075][T12071] netlink: 64 bytes leftover after parsing attributes in process `syz.1.11426'. [ 1670.395158][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1670.507234][T12077] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11429'. [ 1670.530093][T12083] xt_bpf: check failed: parse error [ 1670.696010][T12088] netlink: 76 bytes leftover after parsing attributes in process `syz.3.11433'. [ 1671.348741][T12112] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11442'. [ 1671.435215][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1671.493043][T12116] FAULT_INJECTION: forcing a failure. [ 1671.493043][T12116] name failslab, interval 1, probability 0, space 0, times 0 [ 1671.493072][T12116] CPU: 0 UID: 0 PID: 12116 Comm: syz.2.11444 Not tainted syzkaller #0 PREEMPT(full) [ 1671.493094][T12116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1671.493105][T12116] Call Trace: [ 1671.493113][T12116] [ 1671.493122][T12116] dump_stack_lvl+0xe8/0x150 [ 1671.493154][T12116] should_fail_ex+0x410/0x560 [ 1671.493182][T12116] should_failslab+0xa8/0x100 [ 1671.493208][T12116] __kmalloc_noprof+0xfe/0x720 [ 1671.493228][T12116] ? bpf_test_init+0x9f/0x150 [ 1671.493246][T12116] ? bpf_test_init+0x9f/0x150 [ 1671.493270][T12116] bpf_test_init+0x9f/0x150 [ 1671.493293][T12116] bpf_prog_test_run_xdp+0x4cc/0x11d0 [ 1671.493329][T12116] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1671.493354][T12116] ? __fget_files+0x2a/0x420 [ 1671.493385][T12116] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1671.493407][T12116] bpf_prog_test_run+0x2c5/0x340 [ 1671.493435][T12116] __sys_bpf+0xa22/0xd90 [ 1671.493465][T12116] ? __pfx___sys_bpf+0x10/0x10 [ 1671.493498][T12116] ? __fget_files+0x2a/0x420 [ 1671.493541][T12116] ? ksys_write+0x242/0x270 [ 1671.493572][T12116] ? __pfx_ksys_write+0x10/0x10 [ 1671.493604][T12116] __x64_sys_bpf+0xba/0xd0 [ 1671.493628][T12116] do_syscall_64+0x166/0x520 [ 1671.493653][T12116] ? trace_irq_disable+0x3b/0x140 [ 1671.493672][T12116] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.493692][T12116] ? clear_bhb_loop+0x70/0xc0 [ 1671.493724][T12116] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1671.493743][T12116] RIP: 0033:0x7f1f1919e159 [ 1671.493761][T12116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1671.493777][T12116] RSP: 002b:00007f1f1a0af028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1671.493798][T12116] RAX: ffffffffffffffda RBX: 00007f1f19425fa0 RCX: 00007f1f1919e159 [ 1671.493812][T12116] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 1671.493825][T12116] RBP: 00007f1f1a0af090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.493838][T12116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.493850][T12116] R13: 00007f1f19426038 R14: 00007f1f19425fa0 R15: 00007ffdfeef0fd8 [ 1671.493883][T12116] [ 1671.914344][T12121] xt_bpf: check failed: parse error [ 1671.915333][ C1] bridge0: port 1(macvlan2) entered forwarding state [ 1671.915354][ C1] bridge0: topology change detected, propagating [ 1672.121344][T12132] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11447'. [ 1672.124527][T12133] netlink: 67 bytes leftover after parsing attributes in process `syz.2.11446'. [ 1672.277497][T12122] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1672.475156][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1673.515218][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1674.557084][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1675.602478][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1675.853033][T12169] netlink: Conntrack attr has 4 unknown bytes [ 1675.853075][T12169] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1676.637546][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1677.677011][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1677.812058][T12178] bridge_slave_0: left allmulticast mode [ 1677.812084][T12178] bridge_slave_0: left promiscuous mode [ 1677.812295][T12178] bridge0: port 1(bridge_slave_0) entered disabled state [ 1678.079906][T12185] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1678.300160][T12194] C: renamed from veth1_to_team (while UP) [ 1678.345915][T12194] netlink: 'syz.1.11468': attribute type 4 has an invalid length. [ 1678.345935][T12194] netlink: 116 bytes leftover after parsing attributes in process `syz.1.11468'. [ 1678.346444][T12194] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1678.715233][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1678.954770][T12218] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11476'. [ 1679.755235][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1679.827613][T12232] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1679.898248][T12242] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 1680.027854][T12232] bond6: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1680.057536][T12232] bond6 (unregistering): Released all slaves [ 1680.456266][T12255] netlink: 47 bytes leftover after parsing attributes in process `syz.2.11490'. [ 1680.795251][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1680.913412][T12262] netlink: 48 bytes leftover after parsing attributes in process `syz.5.11492'. [ 1681.811844][T12286] netlink: 108 bytes leftover after parsing attributes in process `syz.4.11499'. [ 1681.835302][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1682.418913][T12301] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 1682.471113][T12297] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11503'. [ 1682.878873][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1683.681449][T12343] netlink: 5 bytes leftover after parsing attributes in process `syz.2.11514'. [ 1683.811554][T12350] netlink: 280 bytes leftover after parsing attributes in process `syz.1.11513'. [ 1683.822106][T12344] xt_CT: No such helper "snmp" [ 1683.917700][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1684.694659][T12361] FAULT_INJECTION: forcing a failure. [ 1684.694659][T12361] name failslab, interval 1, probability 0, space 0, times 0 [ 1684.694690][T12361] CPU: 1 UID: 0 PID: 12361 Comm: syz.5.11519 Not tainted syzkaller #0 PREEMPT(full) [ 1684.694711][T12361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1684.694722][T12361] Call Trace: [ 1684.694730][T12361] [ 1684.694738][T12361] dump_stack_lvl+0xe8/0x150 [ 1684.694771][T12361] should_fail_ex+0x410/0x560 [ 1684.694797][T12361] should_failslab+0xa8/0x100 [ 1684.694822][T12361] __kvmalloc_node_noprof+0x176/0x820 [ 1684.694846][T12361] ? __kvmalloc_node_noprof+0x345/0x820 [ 1684.694864][T12361] ? analyze_subprog+0x8ac/0x9e00 [ 1684.694884][T12361] ? analyze_subprog+0x8ac/0x9e00 [ 1684.694913][T12361] analyze_subprog+0x8ac/0x9e00 [ 1684.694933][T12361] ? is_bpf_text_address+0x292/0x2b0 [ 1684.694963][T12361] ? kernel_text_address+0xa5/0xe0 [ 1684.695006][T12361] ? __pfx_stack_trace_save+0x10/0x10 [ 1684.695040][T12361] ? __pfx___css_rstat_updated+0x10/0x10 [ 1684.695098][T12361] ? call_instance+0x263/0x560 [ 1684.695118][T12361] ? bpf_compute_subprog_arg_access+0x2a3/0x14d0 [ 1684.695140][T12361] ? bpf_compute_live_registers+0x8d3/0x1ff0 [ 1684.695162][T12361] ? __pfx_analyze_subprog+0x10/0x10 [ 1684.695179][T12361] ? __x64_sys_bpf+0xba/0xd0 [ 1684.695196][T12361] ? do_syscall_64+0x166/0x520 [ 1684.695220][T12361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1684.695274][T12361] ? call_instance+0x263/0x560 [ 1684.695294][T12361] ? rcu_is_watching+0x16/0xb0 [ 1684.695316][T12361] ? call_instance+0x263/0x560 [ 1684.695334][T12361] ? trace_kmalloc+0x2a/0xf0 [ 1684.695353][T12361] ? call_instance+0x263/0x560 [ 1684.695372][T12361] ? __kvmalloc_node_noprof+0x52f/0x820 [ 1684.695393][T12361] ? __kvmalloc_node_noprof+0x345/0x820 [ 1684.695411][T12361] ? call_instance+0x263/0x560 [ 1684.695429][T12361] ? call_instance+0x263/0x560 [ 1684.695454][T12361] ? call_instance+0x42e/0x560 [ 1684.695482][T12361] bpf_compute_subprog_arg_access+0x2c9/0x14d0 [ 1684.695526][T12361] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1684.695549][T12361] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1684.695569][T12361] ? trace_kmalloc+0x2a/0xf0 [ 1684.695586][T12361] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 1684.695614][T12361] ? __kvmalloc_node_noprof+0x345/0x820 [ 1684.695632][T12361] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1684.695651][T12361] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 1684.695678][T12361] bpf_compute_live_registers+0x8d3/0x1ff0 [ 1684.695717][T12361] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 1684.695750][T12361] bpf_check+0x2746/0x2ef0 [ 1684.695788][T12361] ? __pfx_bpf_check+0x10/0x10 [ 1684.695812][T12361] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1684.695842][T12361] bpf_prog_load+0x14d6/0x1c20 [ 1684.695877][T12361] ? __pfx_bpf_prog_load+0x10/0x10 [ 1684.695922][T12361] __sys_bpf+0xd0d/0xd90 [ 1684.695950][T12361] ? __pfx___sys_bpf+0x10/0x10 [ 1684.695981][T12361] ? __fget_files+0x2a/0x420 [ 1684.696022][T12361] ? ksys_write+0x242/0x270 [ 1684.696059][T12361] ? __pfx_ksys_write+0x10/0x10 [ 1684.696092][T12361] __x64_sys_bpf+0xba/0xd0 [ 1684.696114][T12361] do_syscall_64+0x166/0x520 [ 1684.696136][T12361] ? trace_irq_disable+0x3b/0x140 [ 1684.696155][T12361] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1684.696173][T12361] ? clear_bhb_loop+0x70/0xc0 [ 1684.696195][T12361] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1684.696213][T12361] RIP: 0033:0x7fd49799e159 [ 1684.696232][T12361] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1684.696247][T12361] RSP: 002b:00007fd4987fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1684.696269][T12361] RAX: ffffffffffffffda RBX: 00007fd497c25fa0 RCX: 00007fd49799e159 [ 1684.696283][T12361] RDX: 0000000000000094 RSI: 0000200000000400 RDI: 0000000000000005 [ 1684.696296][T12361] RBP: 00007fd4987fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1684.696307][T12361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1684.696319][T12361] R13: 00007fd497c26038 R14: 00007fd497c25fa0 R15: 00007ffc71b31a18 [ 1684.696349][T12361] [ 1684.959167][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1685.351113][T12371] Bluetooth: MGMT ver 1.23 [ 1685.351149][T12371] Bluetooth: hci1: too big key_count value 29096 [ 1685.375942][T12374] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11521'. [ 1685.380271][T12371] netlink: 3 bytes leftover after parsing attributes in process `syz.1.11526'. [ 1685.380289][T12371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11526'. [ 1685.380305][T12371] netlink: 3 bytes leftover after parsing attributes in process `syz.1.11526'. [ 1685.380318][T12371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11526'. [ 1685.380332][T12371] netlink: 3 bytes leftover after parsing attributes in process `syz.1.11526'. [ 1685.635319][T12380] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1685.827192][T12395] netlink: 45349 bytes leftover after parsing attributes in process `syz.3.11530'. [ 1685.866595][T12395] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 1685.873856][T12398] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11531'. [ 1685.875374][T12395] 0ªX¹¦Dö»: entered allmulticast mode [ 1685.996157][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1686.151321][T12389] netlink: 'syz.4.11527': attribute type 1 has an invalid length. [ 1686.151341][T12389] netlink: 'syz.4.11527': attribute type 2 has an invalid length. [ 1686.312710][T12409] netlink: 'syz.1.11534': attribute type 21 has an invalid length. [ 1686.400115][T12409] netlink: 'syz.1.11534': attribute type 21 has an invalid length. [ 1686.435885][ T2138] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.439177][ T2138] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.439214][ T2138] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.439246][ T2138] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1686.832468][T12425] netlink: 'syz.2.11540': attribute type 2 has an invalid length. [ 1687.010327][T12422] batadv_slave_1: entered promiscuous mode [ 1687.036081][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1687.125227][T12422] tipc: Started in network mode [ 1687.125256][T12422] tipc: Node identity ac14140f, cluster identity 4711 [ 1687.126550][T12422] tipc: New replicast peer: 255.255.255.255 [ 1687.158199][T12422] tipc: Enabled bearer , priority 10 [ 1687.275604][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1687.339477][T12420] batadv_slave_1: left promiscuous mode [ 1687.383443][T12440] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1688.075165][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1688.263256][ T9] tipc: Node number set to 2886997007 [ 1688.339103][T12459] FAULT_INJECTION: forcing a failure. [ 1688.339103][T12459] name failslab, interval 1, probability 0, space 0, times 0 [ 1688.339134][T12459] CPU: 1 UID: 0 PID: 12459 Comm: syz.3.11548 Not tainted syzkaller #0 PREEMPT(full) [ 1688.339156][T12459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1688.339168][T12459] Call Trace: [ 1688.339175][T12459] [ 1688.339184][T12459] dump_stack_lvl+0xe8/0x150 [ 1688.339216][T12459] should_fail_ex+0x410/0x560 [ 1688.339245][T12459] should_failslab+0xa8/0x100 [ 1688.339271][T12459] __kmalloc_cache_noprof+0xa3/0x600 [ 1688.339292][T12459] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1688.339311][T12459] ? sctp_add_bind_addr+0x8c/0x370 [ 1688.339331][T12459] ? sctp_add_bind_addr+0x8c/0x370 [ 1688.339358][T12459] sctp_add_bind_addr+0x8c/0x370 [ 1688.339383][T12459] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1688.339407][T12459] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1688.339430][T12459] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1688.339453][T12459] ? sctp_v6_is_any+0x64/0x80 [ 1688.339477][T12459] ? sctp_copy_one_addr+0x93/0x360 [ 1688.339501][T12459] sctp_bind_addr_copy+0xb3/0x3c0 [ 1688.339523][T12459] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1688.339555][T12459] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1688.339583][T12459] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1688.339616][T12459] ? __local_bh_enable_ip+0xd6/0x140 [ 1688.339640][T12459] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1688.339666][T12459] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1688.339690][T12459] sctp_sendmsg+0x159b/0x2d00 [ 1688.339730][T12459] ? kstrtouint+0x6e/0xe0 [ 1688.339752][T12459] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1688.339772][T12459] ? lock_acquire+0x115/0x350 [ 1688.339791][T12459] ? get_pid_task+0x20/0x1f0 [ 1688.339824][T12459] ? aa_sock_msg_perm+0xf5/0x210 [ 1688.339847][T12459] ? sock_rps_record_flow+0x19/0x350 [ 1688.339875][T12459] ? inet_sendmsg+0x298/0x320 [ 1688.339897][T12459] ? __pfx_inet_sendmsg+0x10/0x10 [ 1688.339917][T12459] sock_sendmsg_nosec+0x10e/0x180 [ 1688.339941][T12459] __sys_sendto+0x408/0x5a0 [ 1688.339966][T12459] ? ksys_write+0x1e6/0x270 [ 1688.339997][T12459] ? __pfx___sys_sendto+0x10/0x10 [ 1688.340018][T12459] ? __mutex_unlock_slowpath+0x731/0x900 [ 1688.340074][T12459] ? __pfx_ksys_write+0x10/0x10 [ 1688.340105][T12459] __x64_sys_sendto+0xde/0x100 [ 1688.340132][T12459] do_syscall_64+0x166/0x520 [ 1688.340155][T12459] ? trace_irq_disable+0x3b/0x140 [ 1688.340173][T12459] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.340193][T12459] ? clear_bhb_loop+0x70/0xc0 [ 1688.340216][T12459] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.340235][T12459] RIP: 0033:0x7fc55ad9e159 [ 1688.340253][T12459] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1688.340267][T12459] RSP: 002b:00007fc55bcd7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1688.340287][T12459] RAX: ffffffffffffffda RBX: 00007fc55b025fa0 RCX: 00007fc55ad9e159 [ 1688.340300][T12459] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000003 [ 1688.340313][T12459] RBP: 00007fc55bcd7090 R08: 00002000000001c0 R09: 000000000000001c [ 1688.340326][T12459] R10: 0000000000065055 R11: 0000000000000246 R12: 0000000000000002 [ 1688.340337][T12459] R13: 00007fc55b026038 R14: 00007fc55b025fa0 R15: 00007ffed33a43f8 [ 1688.340369][T12459] [ 1688.366608][T12456] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 1688.747500][T12461] FAULT_INJECTION: forcing a failure. [ 1688.747500][T12461] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1688.747533][T12461] CPU: 1 UID: 0 PID: 12461 Comm: syz.5.11547 Not tainted syzkaller #0 PREEMPT(full) [ 1688.747555][T12461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1688.747566][T12461] Call Trace: [ 1688.747576][T12461] [ 1688.747585][T12461] dump_stack_lvl+0xe8/0x150 [ 1688.747618][T12461] should_fail_ex+0x410/0x560 [ 1688.747647][T12461] _copy_from_iter+0x1d3/0x1660 [ 1688.747681][T12461] ? __mutex_lock+0x5d4/0x1550 [ 1688.747714][T12461] ? __pfx__copy_from_iter+0x10/0x10 [ 1688.747737][T12461] ? __pfx___mutex_lock+0x10/0x10 [ 1688.747763][T12461] ? aa_file_perm+0x18b/0x15f0 [ 1688.747796][T12461] ? alloc_pages_mpol+0x256/0x390 [ 1688.747825][T12461] copy_page_from_iter+0x219/0x2d0 [ 1688.747853][T12461] anon_pipe_write+0xdb2/0x1a30 [ 1688.747899][T12461] ? __pfx_anon_pipe_write+0x10/0x10 [ 1688.747930][T12461] ? common_file_perm+0x20e/0x2b0 [ 1688.747958][T12461] ? bpf_lsm_file_permission+0x9/0x20 [ 1688.747984][T12461] ? security_file_permission+0x75/0x260 [ 1688.748013][T12461] vfs_write+0x612/0xba0 [ 1688.748051][T12461] ? __pfx_vfs_write+0x10/0x10 [ 1688.748089][T12461] ? __fget_files+0x2a/0x420 [ 1688.748124][T12461] ksys_write+0x150/0x270 [ 1688.748151][T12461] ? __pfx_ksys_write+0x10/0x10 [ 1688.748190][T12461] do_syscall_64+0x166/0x520 [ 1688.748215][T12461] ? trace_irq_disable+0x3b/0x140 [ 1688.748235][T12461] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.748255][T12461] ? clear_bhb_loop+0x70/0xc0 [ 1688.748280][T12461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.748299][T12461] RIP: 0033:0x7fd49799e159 [ 1688.748316][T12461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1688.748331][T12461] RSP: 002b:00007fd4987da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1688.748350][T12461] RAX: ffffffffffffffda RBX: 00007fd497c26090 RCX: 00007fd49799e159 [ 1688.748365][T12461] RDX: 0000000000032600 RSI: 0000200000000140 RDI: 0000000000000006 [ 1688.748377][T12461] RBP: 00007fd4987da090 R08: 0000000000000000 R09: 0000000000000000 [ 1688.748388][T12461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1688.748399][T12461] R13: 00007fd497c26128 R14: 00007fd497c26090 R15: 00007ffc71b31a18 [ 1688.748430][T12461] [ 1689.115120][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1689.231444][T12475] __nla_validate_parse: 10 callbacks suppressed [ 1689.231463][T12475] netlink: 48 bytes leftover after parsing attributes in process `syz.5.11552'. [ 1689.282767][T12478] netlink: 'syz.3.11551': attribute type 1 has an invalid length. [ 1689.563031][T12490] netlink: NAT attribute has 8 unknown bytes [ 1689.563065][T12490] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1689.644414][T12488] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11557'. [ 1689.789514][T12494] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11560'. [ 1689.790376][T12495] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1689.818571][T12501] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1689.852608][T12503] netlink: 48 bytes leftover after parsing attributes in process `syz.4.11562'. [ 1689.968410][T12501] tipc: Enabled bearer , priority 0 [ 1689.968552][T12497] syzkaller0: entered promiscuous mode [ 1689.968570][T12497] syzkaller0: entered allmulticast mode [ 1690.051925][T12496] tipc: Resetting bearer [ 1690.154796][T12496] tipc: Disabling bearer [ 1690.155176][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1690.331128][T12515] netlink: 72 bytes leftover after parsing attributes in process `syz.3.11564'. [ 1690.731502][T12529] netlink: 67 bytes leftover after parsing attributes in process `syz.1.11568'. [ 1690.791551][T12522] netlink: 48 bytes leftover after parsing attributes in process `syz.4.11566'. [ 1690.859348][T12529] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1690.967155][T12531] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11569'. [ 1691.195183][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1691.362907][T12542] ipvlan2: entered promiscuous mode [ 1691.363028][T12542] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1691.363045][T12542] bond0: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1691.363163][T12542] bond0: (slave ipvlan2): Error -95 calling set_mac_address [ 1691.669372][T12555] netlink: 'syz.1.11578': attribute type 1 has an invalid length. [ 1691.968898][T12558] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1692.235190][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1692.260262][T12558] netlink: 48 bytes leftover after parsing attributes in process `syz.4.11577'. [ 1692.290774][T12567] netlink: 48 bytes leftover after parsing attributes in process `syz.5.11580'. [ 1692.734003][T12579] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1693.137963][T12593] FAULT_INJECTION: forcing a failure. [ 1693.137963][T12593] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1693.137997][T12593] CPU: 1 UID: 0 PID: 12593 Comm: syz.1.11590 Not tainted syzkaller #0 PREEMPT(full) [ 1693.138019][T12593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1693.138031][T12593] Call Trace: [ 1693.138042][T12593] [ 1693.138051][T12593] dump_stack_lvl+0xe8/0x150 [ 1693.138084][T12593] should_fail_ex+0x410/0x560 [ 1693.138113][T12593] prepare_alloc_pages+0x223/0x600 [ 1693.138142][T12593] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1693.138168][T12593] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1693.138189][T12593] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 1693.138214][T12593] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1693.138241][T12593] ? __pfx_policy_nodemask+0x10/0x10 [ 1693.138271][T12593] __alloc_pages_noprof+0x10/0x100 [ 1693.138293][T12593] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 1693.138324][T12593] ? alloc_pages_noprof+0x140/0x2b0 [ 1693.138353][T12593] __kasan_populate_vmalloc+0xb7/0x1c0 [ 1693.138380][T12593] alloc_vmap_area+0xd1a/0x1420 [ 1693.138422][T12593] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1693.138445][T12593] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 1693.138468][T12593] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 1693.138488][T12593] ? __get_vm_area_node+0x155/0x2f0 [ 1693.138519][T12593] __get_vm_area_node+0x200/0x2f0 [ 1693.138553][T12593] ? xdp_umem_create+0x6dc/0x8b0 [ 1693.138578][T12593] vmap+0x158/0x300 [ 1693.138606][T12593] ? xdp_umem_create+0x6dc/0x8b0 [ 1693.138636][T12593] xdp_umem_create+0x6dc/0x8b0 [ 1693.138670][T12593] xsk_setsockopt+0x82f/0x960 [ 1693.138696][T12593] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1693.138727][T12593] ? aa_sock_opt_perm+0x142/0x1e0 [ 1693.138757][T12593] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1693.138783][T12593] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1693.138808][T12593] do_sock_setsockopt+0x17c/0x1b0 [ 1693.138841][T12593] __x64_sys_setsockopt+0x13d/0x1b0 [ 1693.138874][T12593] do_syscall_64+0x166/0x520 [ 1693.138900][T12593] ? trace_irq_disable+0x3b/0x140 [ 1693.138926][T12593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.138947][T12593] ? clear_bhb_loop+0x70/0xc0 [ 1693.138972][T12593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1693.138992][T12593] RIP: 0033:0x7fda9b79e159 [ 1693.139011][T12593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1693.139028][T12593] RSP: 002b:00007fda9c5bd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1693.139051][T12593] RAX: ffffffffffffffda RBX: 00007fda9ba26090 RCX: 00007fda9b79e159 [ 1693.139066][T12593] RDX: 0000000000000004 RSI: 000000000000011b RDI: 0000000000000003 [ 1693.139078][T12593] RBP: 00007fda9c5bd090 R08: 0000000000000020 R09: 0000000000000000 [ 1693.139091][T12593] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 1693.139105][T12593] R13: 00007fda9ba26128 R14: 00007fda9ba26090 R15: 00007fffe4682c38 [ 1693.139139][T12593] [ 1693.278235][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1693.625249][T12596] netlink: 'syz.1.11591': attribute type 1 has an invalid length. [ 1693.625272][T12596] netlink: 'syz.1.11591': attribute type 1 has an invalid length. [ 1693.634388][T12595] netlink: 'syz.1.11591': attribute type 1 has an invalid length. [ 1693.634407][T12595] netlink: 'syz.1.11591': attribute type 1 has an invalid length. [ 1693.681899][T12598] netlink: 'syz.2.11592': attribute type 1 has an invalid length. [ 1693.789403][T12601] netlink: 'syz.1.11593': attribute type 2 has an invalid length. [ 1694.249634][T12606] __nla_validate_parse: 6 callbacks suppressed [ 1694.249654][T12606] netlink: 48 bytes leftover after parsing attributes in process `syz.5.11594'. [ 1694.318291][ C1] bridge0: port 4(macvlan0) entered learning state [ 1694.318679][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1694.955931][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 1694.956114][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 1695.070684][T12633] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11605'. [ 1695.355203][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1695.450054][T12649] netlink: 'syz.3.11606': attribute type 1 has an invalid length. [ 1695.696508][T12651] FAULT_INJECTION: forcing a failure. [ 1695.696508][T12651] name failslab, interval 1, probability 0, space 0, times 0 [ 1695.696541][T12651] CPU: 1 UID: 0 PID: 12651 Comm: syz.5.11608 Not tainted syzkaller #0 PREEMPT(full) [ 1695.696561][T12651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1695.696573][T12651] Call Trace: [ 1695.696581][T12651] [ 1695.696589][T12651] dump_stack_lvl+0xe8/0x150 [ 1695.696622][T12651] should_fail_ex+0x410/0x560 [ 1695.696651][T12651] should_failslab+0xa8/0x100 [ 1695.696674][T12651] ? skb_clone+0x212/0x3a0 [ 1695.696702][T12651] kmem_cache_alloc_noprof+0xa1/0x600 [ 1695.696734][T12651] ? skb_clone+0x212/0x3a0 [ 1695.696767][T12651] skb_clone+0x212/0x3a0 [ 1695.696797][T12651] bpf_clone_redirect+0x170/0x4b0 [ 1695.696828][T12651] ? bpf_test_run+0x1d1/0x830 [ 1695.696848][T12651] bpf_prog_2f59963de350c2d2+0x5e/0x67 [ 1695.696870][T12651] ? __kernel_text_address+0xd/0x30 [ 1695.696895][T12651] ? arch_stack_walk+0xfb/0x150 [ 1695.696922][T12651] ? __pfx___schedule+0x10/0x10 [ 1695.696960][T12651] ? preempt_schedule_thunk+0x16/0x40 [ 1695.696983][T12651] ? preempt_schedule_common+0x7f/0xd0 [ 1695.697007][T12651] ? bpf_test_run+0x1d1/0x830 [ 1695.697028][T12651] ? bpf_test_timer_continue+0x10c/0x320 [ 1695.697060][T12651] bpf_test_run+0x354/0x830 [ 1695.697101][T12651] ? __pfx_bpf_test_run+0x10/0x10 [ 1695.697134][T12651] ? __kasan_krealloc+0xec/0x110 [ 1695.697164][T12651] ? skb_dst_set+0x72/0x140 [ 1695.697185][T12651] bpf_prog_test_run_skb+0xe35/0x2230 [ 1695.697236][T12651] ? __fget_files+0x3a2/0x420 [ 1695.697262][T12651] ? __fget_files+0x2a/0x420 [ 1695.697292][T12651] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1695.697323][T12651] bpf_prog_test_run+0x2c5/0x340 [ 1695.697353][T12651] __sys_bpf+0xa22/0xd90 [ 1695.697383][T12651] ? __pfx___sys_bpf+0x10/0x10 [ 1695.697417][T12651] ? __fget_files+0x2a/0x420 [ 1695.697460][T12651] ? ksys_write+0x242/0x270 [ 1695.697491][T12651] ? __pfx_ksys_write+0x10/0x10 [ 1695.697524][T12651] __x64_sys_bpf+0xba/0xd0 [ 1695.697547][T12651] do_syscall_64+0x166/0x520 [ 1695.697571][T12651] ? trace_irq_disable+0x3b/0x140 [ 1695.697590][T12651] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.697610][T12651] ? clear_bhb_loop+0x70/0xc0 [ 1695.697634][T12651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.697654][T12651] RIP: 0033:0x7fd49799e159 [ 1695.697671][T12651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1695.697687][T12651] RSP: 002b:00007fd4987fb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1695.697708][T12651] RAX: ffffffffffffffda RBX: 00007fd497c25fa0 RCX: 00007fd49799e159 [ 1695.697722][T12651] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 000000000000000a [ 1695.697735][T12651] RBP: 00007fd4987fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1695.697746][T12651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1695.697757][T12651] R13: 00007fd497c26038 R14: 00007fd497c25fa0 R15: 00007ffc71b31a18 [ 1695.697789][T12651] [ 1696.052339][T12658] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11611'. [ 1696.120483][T12659] netlink: 'syz.3.11612': attribute type 1 has an invalid length. [ 1696.183102][T12663] FAULT_INJECTION: forcing a failure. [ 1696.183102][T12663] name failslab, interval 1, probability 0, space 0, times 0 [ 1696.183133][T12663] CPU: 1 UID: 0 PID: 12663 Comm: syz.4.11613 Not tainted syzkaller #0 PREEMPT(full) [ 1696.183154][T12663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1696.183166][T12663] Call Trace: [ 1696.183174][T12663] [ 1696.183182][T12663] dump_stack_lvl+0xe8/0x150 [ 1696.183216][T12663] should_fail_ex+0x410/0x560 [ 1696.183245][T12663] should_failslab+0xa8/0x100 [ 1696.183272][T12663] __kmalloc_cache_noprof+0xa3/0x600 [ 1696.183294][T12663] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1696.183312][T12663] ? sctp_add_bind_addr+0x8c/0x370 [ 1696.183332][T12663] ? sctp_add_bind_addr+0x8c/0x370 [ 1696.183359][T12663] sctp_add_bind_addr+0x8c/0x370 [ 1696.183384][T12663] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1696.183409][T12663] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1696.183431][T12663] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1696.183453][T12663] ? sctp_v6_is_any+0x64/0x80 [ 1696.183476][T12663] ? sctp_copy_one_addr+0x93/0x360 [ 1696.183500][T12663] sctp_bind_addr_copy+0xb3/0x3c0 [ 1696.183522][T12663] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1696.183554][T12663] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1696.183583][T12663] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1696.183615][T12663] ? __local_bh_enable_ip+0xd6/0x140 [ 1696.183638][T12663] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1696.183665][T12663] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1696.183690][T12663] sctp_sendmsg+0x159b/0x2d00 [ 1696.183726][T12663] ? kstrtouint+0x6e/0xe0 [ 1696.183746][T12663] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1696.183769][T12663] ? lock_acquire+0x115/0x350 [ 1696.183788][T12663] ? get_pid_task+0x20/0x1f0 [ 1696.183823][T12663] ? aa_sock_msg_perm+0xf5/0x210 [ 1696.183849][T12663] ? sock_rps_record_flow+0x19/0x350 [ 1696.183872][T12663] ? inet_sendmsg+0x298/0x320 [ 1696.183894][T12663] ? __pfx_inet_sendmsg+0x10/0x10 [ 1696.183913][T12663] sock_sendmsg_nosec+0x10e/0x180 [ 1696.183937][T12663] __sys_sendto+0x408/0x5a0 [ 1696.183960][T12663] ? ksys_write+0x1e6/0x270 [ 1696.183990][T12663] ? __pfx___sys_sendto+0x10/0x10 [ 1696.184018][T12663] ? __mutex_unlock_slowpath+0x731/0x900 [ 1696.184073][T12663] ? __pfx_ksys_write+0x10/0x10 [ 1696.184105][T12663] __x64_sys_sendto+0xde/0x100 [ 1696.184132][T12663] do_syscall_64+0x166/0x520 [ 1696.184156][T12663] ? trace_irq_disable+0x3b/0x140 [ 1696.184175][T12663] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1696.184195][T12663] ? clear_bhb_loop+0x70/0xc0 [ 1696.184219][T12663] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1696.184238][T12663] RIP: 0033:0x7fb13859e159 [ 1696.184256][T12663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1696.184271][T12663] RSP: 002b:00007fb1393b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1696.184291][T12663] RAX: ffffffffffffffda RBX: 00007fb138825fa0 RCX: 00007fb13859e159 [ 1696.184305][T12663] RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000003 [ 1696.184318][T12663] RBP: 00007fb1393b6090 R08: 00002000000001c0 R09: 000000000000001c [ 1696.184338][T12663] R10: 0000000000065055 R11: 0000000000000246 R12: 0000000000000002 [ 1696.184350][T12663] R13: 00007fb138826038 R14: 00007fb138825fa0 R15: 00007fffca080ce8 [ 1696.184383][T12663] [ 1696.399755][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1696.400991][ T6073] Bluetooth: hci2: command 0x0405 tx timeout [ 1696.487518][T12659] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1696.610011][T12673] FAULT_INJECTION: forcing a failure. [ 1696.610011][T12673] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1696.610043][T12673] CPU: 1 UID: 0 PID: 12673 Comm: syz.4.11617 Not tainted syzkaller #0 PREEMPT(full) [ 1696.610065][T12673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1696.610077][T12673] Call Trace: [ 1696.610086][T12673] [ 1696.610095][T12673] dump_stack_lvl+0xe8/0x150 [ 1696.610128][T12673] should_fail_ex+0x410/0x560 [ 1696.610157][T12673] prepare_alloc_pages+0x223/0x600 [ 1696.610186][T12673] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1696.610212][T12673] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1696.610240][T12673] ? __pfx_policy_nodemask+0x10/0x10 [ 1696.610269][T12673] ? __lock_acquire+0x747/0x2de0 [ 1696.610292][T12673] alloc_pages_mpol+0x21e/0x390 [ 1696.610322][T12673] folio_alloc_mpol_noprof+0x39/0x160 [ 1696.610349][T12673] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1696.610376][T12673] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1696.610403][T12673] ? lock_acquire+0x115/0x350 [ 1696.610430][T12673] do_pte_missing+0x173a/0x34b0 [ 1696.610468][T12673] handle_mm_fault+0x1a53/0x3750 [ 1696.610506][T12673] ? handle_mm_fault+0xf1/0x3750 [ 1696.610543][T12673] ? __pfx_handle_mm_fault+0x10/0x10 [ 1696.610567][T12673] ? lock_vma_under_rcu+0x45a/0x500 [ 1696.610593][T12673] ? __fget_files+0x2a/0x420 [ 1696.610646][T12673] do_user_addr_fault+0xa4f/0x1340 [ 1696.610678][T12673] ? trace_page_fault_user+0x84/0x1e0 [ 1696.610700][T12673] exc_page_fault+0x6a/0xc0 [ 1696.610727][T12673] asm_exc_page_fault+0x26/0x30 [ 1696.610746][T12673] RIP: 0033:0x7fb13845f6cb [ 1696.610764][T12673] Code: 00 00 00 48 8d 3d 5d b1 1a 00 48 89 c1 31 c0 e8 0b 2e ff ff eb d2 66 0f 1f 84 00 00 00 00 00 55 31 c0 53 48 81 ec 68 10 00 00 <48> 89 7c 24 08 48 8d 3d 91 b1 1a 00 48 89 34 24 48 8b 14 24 48 8b [ 1696.610783][T12673] RSP: 002b:00007fb1393b4fa0 EFLAGS: 00010206 [ 1696.610802][T12673] RAX: 0000000000000000 RBX: 00007fb138825fa0 RCX: 0000000000000000 [ 1696.610814][T12673] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000200000000180 [ 1696.610826][T12673] RBP: 00007fb1393b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1696.610838][T12673] R10: 0000200000000180 R11: 0000000000000000 R12: 0000000000000001 [ 1696.610851][T12673] R13: 00007fb138826038 R14: 00007fb138825fa0 R15: 00007fffca080ce8 [ 1696.610884][T12673] [ 1696.610907][T12673] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF [ 1696.870364][T12661] bond6: (slave veth0_to_bond): making interface the new active one [ 1696.871820][T12661] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1697.039255][T12680] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 1697.133042][T12683] IPVS: stopping master sync thread 12680 ... [ 1697.377774][T12685] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11619'. [ 1697.377801][T12685] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11619'. [ 1697.435138][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1697.707955][T12695] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1698.232724][T12705] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11624'. [ 1698.332020][T12696] syzkaller1: entered promiscuous mode [ 1698.332043][T12696] syzkaller1: entered allmulticast mode [ 1698.379087][T12708] syzkaller0: entered promiscuous mode [ 1698.379108][T12708] syzkaller0: entered allmulticast mode [ 1698.476902][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1698.942969][T12717] netlink: 'syz.4.11628': attribute type 1 has an invalid length. [ 1699.086583][T12714] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11627'. [ 1699.114412][T12719] FAULT_INJECTION: forcing a failure. [ 1699.114412][T12719] name failslab, interval 1, probability 0, space 0, times 0 [ 1699.114441][T12719] CPU: 0 UID: 0 PID: 12719 Comm: syz.5.11630 Not tainted syzkaller #0 PREEMPT(full) [ 1699.114462][T12719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1699.114474][T12719] Call Trace: [ 1699.114482][T12719] [ 1699.114490][T12719] dump_stack_lvl+0xe8/0x150 [ 1699.114524][T12719] should_fail_ex+0x410/0x560 [ 1699.114553][T12719] should_failslab+0xa8/0x100 [ 1699.114579][T12719] __kmalloc_cache_noprof+0xa3/0x600 [ 1699.114599][T12719] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1699.114617][T12719] ? sctp_add_bind_addr+0x8c/0x370 [ 1699.114636][T12719] ? sctp_add_bind_addr+0x8c/0x370 [ 1699.114663][T12719] sctp_add_bind_addr+0x8c/0x370 [ 1699.114688][T12719] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1699.114711][T12719] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1699.114733][T12719] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1699.114756][T12719] ? sctp_v6_is_any+0x64/0x80 [ 1699.114779][T12719] ? sctp_copy_one_addr+0x93/0x360 [ 1699.114803][T12719] sctp_bind_addr_copy+0xb3/0x3c0 [ 1699.114824][T12719] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1699.114854][T12719] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1699.114881][T12719] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1699.114907][T12719] ? __ipv6_addr_type+0x23d/0x2f0 [ 1699.114940][T12719] ? sctp_inet6_send_verify+0x6e/0x300 [ 1699.114958][T12719] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 1699.114985][T12719] __sctp_connect+0x5cb/0xdc0 [ 1699.115019][T12719] ? __pfx___sctp_connect+0x10/0x10 [ 1699.115040][T12719] ? sctp_inet_connect+0xa0/0x210 [ 1699.115063][T12719] ? __local_bh_enable_ip+0xd6/0x140 [ 1699.115091][T12719] sctp_inet_connect+0x12e/0x210 [ 1699.115116][T12719] __sys_connect+0x316/0x450 [ 1699.115143][T12719] ? __pfx___sys_connect+0x10/0x10 [ 1699.115180][T12719] ? __pfx_ksys_write+0x10/0x10 [ 1699.115214][T12719] __x64_sys_connect+0x7a/0x90 [ 1699.115239][T12719] do_syscall_64+0x166/0x520 [ 1699.115263][T12719] ? trace_irq_disable+0x3b/0x140 [ 1699.115282][T12719] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1699.115310][T12719] ? clear_bhb_loop+0x70/0xc0 [ 1699.115334][T12719] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1699.115353][T12719] RIP: 0033:0x7fd49799e159 [ 1699.115371][T12719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1699.115387][T12719] RSP: 002b:00007fd4987fb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1699.115408][T12719] RAX: ffffffffffffffda RBX: 00007fd497c25fa0 RCX: 00007fd49799e159 [ 1699.115422][T12719] RDX: 000000000000001c RSI: 0000200000000080 RDI: 0000000000000003 [ 1699.115435][T12719] RBP: 00007fd4987fb090 R08: 0000000000000000 R09: 0000000000000000 [ 1699.115447][T12719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1699.115459][T12719] R13: 00007fd497c26038 R14: 00007fd497c25fa0 R15: 00007ffc71b31a18 [ 1699.115491][T12719] [ 1699.207406][T12721] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1699.515107][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1699.562661][T12722] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11629'. [ 1700.165947][T12748] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11638'. [ 1700.300708][T12756] netlink: 36 bytes leftover after parsing attributes in process `syz.3.11641'. [ 1700.555228][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1700.624335][T12767] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11644'. [ 1700.624357][T12767] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11644'. [ 1700.624371][T12767] tc_dump_action: action bad kind [ 1700.790997][T12767] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11644'. [ 1700.867050][T12777] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1700.871868][T12766] syzkaller1: entered promiscuous mode [ 1700.871888][T12766] syzkaller1: entered allmulticast mode [ 1701.165963][T12781] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11637'. [ 1701.381185][T12786] netlink: 28 bytes leftover after parsing attributes in process `syz.5.11647'. [ 1701.399989][T12786] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11647'. [ 1701.400903][T12786] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 1701.403554][T12786] bond_slave_0: entered promiscuous mode [ 1701.403573][T12786] bond_slave_0: entered allmulticast mode [ 1701.595137][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1701.833234][T12808] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1701.947903][T12811] FAULT_INJECTION: forcing a failure. [ 1701.947903][T12811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1701.947936][T12811] CPU: 1 UID: 0 PID: 12811 Comm: syz.2.11656 Not tainted syzkaller #0 PREEMPT(full) [ 1701.947959][T12811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1701.947971][T12811] Call Trace: [ 1701.947980][T12811] [ 1701.947988][T12811] dump_stack_lvl+0xe8/0x150 [ 1701.948021][T12811] should_fail_ex+0x410/0x560 [ 1701.948057][T12811] _copy_from_user+0x2d/0xb0 [ 1701.948092][T12811] ___sys_recvmsg+0x173/0x5a0 [ 1701.948128][T12811] ? __pfx____sys_recvmsg+0x10/0x10 [ 1701.948161][T12811] ? lock_acquire+0x115/0x350 [ 1701.948212][T12811] do_recvmmsg+0x31a/0x7f0 [ 1701.948247][T12811] ? __pfx_do_recvmmsg+0x10/0x10 [ 1701.948287][T12811] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1701.948318][T12811] ? __fget_files+0x3a2/0x420 [ 1701.948356][T12811] __x64_sys_recvmmsg+0x198/0x250 [ 1701.948387][T12811] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1701.948426][T12811] do_syscall_64+0x166/0x520 [ 1701.948451][T12811] ? trace_irq_disable+0x3b/0x140 [ 1701.948471][T12811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1701.948491][T12811] ? clear_bhb_loop+0x70/0xc0 [ 1701.948515][T12811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1701.948534][T12811] RIP: 0033:0x7f1f1919e159 [ 1701.948552][T12811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1701.948568][T12811] RSP: 002b:00007f1f1a0af028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1701.948590][T12811] RAX: ffffffffffffffda RBX: 00007f1f19425fa0 RCX: 00007f1f1919e159 [ 1701.948604][T12811] RDX: 0000000000000600 RSI: 0000200000003700 RDI: 0000000000000004 [ 1701.948617][T12811] RBP: 00007f1f1a0af090 R08: 0000000000000000 R09: 0000000000000000 [ 1701.948630][T12811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1701.948642][T12811] R13: 00007f1f19426038 R14: 00007f1f19425fa0 R15: 00007ffdfeef0fd8 [ 1701.948674][T12811] [ 1702.361993][T12817] FAULT_INJECTION: forcing a failure. [ 1702.361993][T12817] name failslab, interval 1, probability 0, space 0, times 0 [ 1702.362025][T12817] CPU: 1 UID: 0 PID: 12817 Comm: syz.3.11658 Not tainted syzkaller #0 PREEMPT(full) [ 1702.362046][T12817] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1702.362058][T12817] Call Trace: [ 1702.362066][T12817] [ 1702.362074][T12817] dump_stack_lvl+0xe8/0x150 [ 1702.362106][T12817] should_fail_ex+0x410/0x560 [ 1702.362134][T12817] should_failslab+0xa8/0x100 [ 1702.362160][T12817] __kmalloc_cache_noprof+0xa3/0x600 [ 1702.362182][T12817] ? resv_map_alloc+0x51/0x2c0 [ 1702.362199][T12817] ? resv_map_alloc+0x51/0x2c0 [ 1702.362218][T12817] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1702.362250][T12817] resv_map_alloc+0x51/0x2c0 [ 1702.362271][T12817] hugetlbfs_get_inode+0x5f/0x660 [ 1702.362414][T12817] ? fput+0xa0/0xd0 [ 1702.362449][T12817] hugetlb_file_setup+0x21d/0x630 [ 1702.362477][T12817] ksys_mmap_pgoff+0x1ec/0x760 [ 1702.362504][T12817] do_syscall_64+0x166/0x520 [ 1702.362527][T12817] ? trace_irq_disable+0x3b/0x140 [ 1702.362544][T12817] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.362562][T12817] ? clear_bhb_loop+0x70/0xc0 [ 1702.362584][T12817] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.362602][T12817] RIP: 0033:0x7fc55ad9e159 [ 1702.362620][T12817] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1702.362634][T12817] RSP: 002b:00007fc55bcd7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 1702.362655][T12817] RAX: ffffffffffffffda RBX: 00007fc55b025fa0 RCX: 00007fc55ad9e159 [ 1702.362669][T12817] RDX: 0000000000000001 RSI: 0000000000c00000 RDI: 0000200000000000 [ 1702.362682][T12817] RBP: 00007fc55bcd7090 R08: ffffffffffffffff R09: 0000000020000000 [ 1702.362696][T12817] R10: 0000000000042072 R11: 0000000000000246 R12: 0000000000000001 [ 1702.362708][T12817] R13: 00007fc55b026038 R14: 00007fc55b025fa0 R15: 00007ffed33a43f8 [ 1702.362737][T12817] [ 1702.635373][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1703.008723][T12821] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x7 [ 1703.675135][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1703.833234][T12846] FAULT_INJECTION: forcing a failure. [ 1703.833234][T12846] name failslab, interval 1, probability 0, space 0, times 0 [ 1703.833265][T12846] CPU: 1 UID: 0 PID: 12846 Comm: syz.1.11668 Not tainted syzkaller #0 PREEMPT(full) [ 1703.833286][T12846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1703.833297][T12846] Call Trace: [ 1703.833306][T12846] [ 1703.833315][T12846] dump_stack_lvl+0xe8/0x150 [ 1703.833348][T12846] should_fail_ex+0x410/0x560 [ 1703.833377][T12846] should_failslab+0xa8/0x100 [ 1703.833403][T12846] __kmalloc_noprof+0xfe/0x720 [ 1703.833421][T12846] ? rcu_is_watching+0x16/0xb0 [ 1703.833444][T12846] ? tomoyo_realpath_from_path+0xef/0x640 [ 1703.833471][T12846] ? tomoyo_realpath_from_path+0xef/0x640 [ 1703.833504][T12846] tomoyo_realpath_from_path+0xef/0x640 [ 1703.833540][T12846] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1703.833564][T12846] tomoyo_path_number_perm+0x246/0x5f0 [ 1703.833589][T12846] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1703.833611][T12846] ? __lock_acquire+0x747/0x2de0 [ 1703.833647][T12846] ? hook_file_ioctl+0x1f2/0x600 [ 1703.833692][T12846] ? __fget_files+0x2a/0x420 [ 1703.833720][T12846] ? __fget_files+0x2a/0x420 [ 1703.833743][T12846] ? __fget_files+0x3a2/0x420 [ 1703.833766][T12846] ? __fget_files+0x2a/0x420 [ 1703.833801][T12846] security_file_ioctl+0xc3/0x2a0 [ 1703.833824][T12846] __se_sys_ioctl+0x47/0x170 [ 1703.833848][T12846] do_syscall_64+0x166/0x520 [ 1703.833874][T12846] ? trace_irq_disable+0x3b/0x140 [ 1703.833893][T12846] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.833913][T12846] ? clear_bhb_loop+0x70/0xc0 [ 1703.833937][T12846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1703.833956][T12846] RIP: 0033:0x7fda9b79e159 [ 1703.833975][T12846] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1703.833991][T12846] RSP: 002b:00007fda9c5de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1703.834011][T12846] RAX: ffffffffffffffda RBX: 00007fda9ba25fa0 RCX: 00007fda9b79e159 [ 1703.834024][T12846] RDX: 0000200000000280 RSI: 00000000000089f3 RDI: 0000000000000003 [ 1703.834036][T12846] RBP: 00007fda9c5de090 R08: 0000000000000000 R09: 0000000000000000 [ 1703.834048][T12846] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1703.834059][T12846] R13: 00007fda9ba26038 R14: 00007fda9ba25fa0 R15: 00007fffe4682c38 [ 1703.834089][T12846] [ 1703.834221][T12846] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1704.525164][T12860] netlink: 28 bytes leftover after parsing attributes in process `syz.5.11672'. [ 1704.612464][T12866] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 1704.715325][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1705.755401][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1706.069042][T12903] netlink: 'syz.5.11683': attribute type 2 has an invalid length. [ 1706.271786][T12911] __nla_validate_parse: 1 callbacks suppressed [ 1706.271804][T12911] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11688'. [ 1706.304191][T12911] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 1706.314090][T12911] gretap0: entered promiscuous mode [ 1706.330238][T12911] debugfs: 'hsr1' already exists in 'hsr' [ 1706.330259][T12911] Cannot create hsr debugfs directory [ 1706.540272][T12924] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11691'. [ 1706.540297][T12924] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11691'. [ 1706.636570][ T6073] Bluetooth: hci1: command 0x0406 tx timeout [ 1706.688834][T12926] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1706.795228][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1706.919198][T12934] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1707.367942][T12950] FAULT_INJECTION: forcing a failure. [ 1707.367942][T12950] name failslab, interval 1, probability 0, space 0, times 0 [ 1707.367975][T12950] CPU: 1 UID: 0 PID: 12950 Comm: syz.2.11702 Not tainted syzkaller #0 PREEMPT(full) [ 1707.367997][T12950] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1707.368008][T12950] Call Trace: [ 1707.368017][T12950] [ 1707.368025][T12950] dump_stack_lvl+0xe8/0x150 [ 1707.368060][T12950] should_fail_ex+0x410/0x560 [ 1707.368090][T12950] should_failslab+0xa8/0x100 [ 1707.368117][T12950] __kvmalloc_node_noprof+0x176/0x820 [ 1707.368142][T12950] ? __kvmalloc_node_noprof+0x345/0x820 [ 1707.368164][T12950] ? bpf_compute_postorder+0xda/0x970 [ 1707.368185][T12950] ? bpf_compute_postorder+0xda/0x970 [ 1707.368212][T12950] bpf_compute_postorder+0xda/0x970 [ 1707.368234][T12950] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 1707.368260][T12950] ? add_kfuncs+0x251/0x2e0 [ 1707.368287][T12950] bpf_check+0x261f/0x2ef0 [ 1707.368327][T12950] ? __pfx_bpf_check+0x10/0x10 [ 1707.368351][T12950] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1707.368383][T12950] bpf_prog_load+0x14d6/0x1c20 [ 1707.368418][T12950] ? __pfx_bpf_prog_load+0x10/0x10 [ 1707.368468][T12950] __sys_bpf+0xd0d/0xd90 [ 1707.368504][T12950] ? __pfx___sys_bpf+0x10/0x10 [ 1707.368527][T12950] ? clockevents_program_event+0x491/0x630 [ 1707.368595][T12950] __x64_sys_bpf+0xba/0xd0 [ 1707.368618][T12950] do_syscall_64+0x166/0x520 [ 1707.368643][T12950] ? trace_irq_disable+0x3b/0x140 [ 1707.368662][T12950] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1707.368682][T12950] ? clear_bhb_loop+0x70/0xc0 [ 1707.368706][T12950] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1707.368726][T12950] RIP: 0033:0x7f1f1919e159 [ 1707.368743][T12950] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1707.368759][T12950] RSP: 002b:00007f1f1a0af028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1707.368780][T12950] RAX: ffffffffffffffda RBX: 00007f1f19425fa0 RCX: 00007f1f1919e159 [ 1707.368795][T12950] RDX: 0000000000000094 RSI: 0000200000000400 RDI: 0000000000000005 [ 1707.368807][T12950] RBP: 00007f1f1a0af090 R08: 0000000000000000 R09: 0000000000000000 [ 1707.368819][T12950] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1707.368831][T12950] R13: 00007f1f19426038 R14: 00007f1f19425fa0 R15: 00007ffdfeef0fd8 [ 1707.368863][T12950] [ 1707.701842][T12955] FAULT_INJECTION: forcing a failure. [ 1707.701842][T12955] name failslab, interval 1, probability 0, space 0, times 0 [ 1707.701944][T12955] CPU: 1 UID: 0 PID: 12955 Comm: syz.2.11704 Not tainted syzkaller #0 PREEMPT(full) [ 1707.701974][T12955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1707.701987][T12955] Call Trace: [ 1707.701995][T12955] [ 1707.702003][T12955] dump_stack_lvl+0xe8/0x150 [ 1707.702037][T12955] should_fail_ex+0x410/0x560 [ 1707.702071][T12955] should_failslab+0xa8/0x100 [ 1707.702097][T12955] __kvmalloc_node_noprof+0x176/0x820 [ 1707.702122][T12955] ? __kvmalloc_node_noprof+0x345/0x820 [ 1707.702142][T12955] ? bpf_compute_scc+0xa26/0xb10 [ 1707.702161][T12955] ? bpf_compute_scc+0xa26/0xb10 [ 1707.702186][T12955] bpf_compute_scc+0xa26/0xb10 [ 1707.702226][T12955] bpf_check+0x2720/0x2ef0 [ 1707.702266][T12955] ? __pfx_bpf_check+0x10/0x10 [ 1707.702290][T12955] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1707.702321][T12955] bpf_prog_load+0x14d6/0x1c20 [ 1707.702355][T12955] ? __pfx_bpf_prog_load+0x10/0x10 [ 1707.702403][T12955] __sys_bpf+0xd0d/0xd90 [ 1707.702433][T12955] ? __pfx___sys_bpf+0x10/0x10 [ 1707.702465][T12955] ? __fget_files+0x2a/0x420 [ 1707.702508][T12955] ? ksys_write+0x242/0x270 [ 1707.702539][T12955] ? __pfx_ksys_write+0x10/0x10 [ 1707.702572][T12955] __x64_sys_bpf+0xba/0xd0 [ 1707.702595][T12955] do_syscall_64+0x166/0x520 [ 1707.702621][T12955] ? trace_irq_disable+0x3b/0x140 [ 1707.702640][T12955] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1707.702660][T12955] ? clear_bhb_loop+0x70/0xc0 [ 1707.702684][T12955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1707.702703][T12955] RIP: 0033:0x7f1f1919e159 [ 1707.702721][T12955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1707.702737][T12955] RSP: 002b:00007f1f1a0af028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1707.702757][T12955] RAX: ffffffffffffffda RBX: 00007f1f19425fa0 RCX: 00007f1f1919e159 [ 1707.702771][T12955] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005 [ 1707.702784][T12955] RBP: 00007f1f1a0af090 R08: 0000000000000000 R09: 0000000000000000 [ 1707.702796][T12955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1707.702808][T12955] R13: 00007f1f19426038 R14: 00007f1f19425fa0 R15: 00007ffdfeef0fd8 [ 1707.702845][T12955] [ 1707.836495][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1708.453135][T12973] netlink: 'syz.2.11706': attribute type 1 has an invalid length. [ 1708.875171][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1708.962979][T12982] xt_CT: No such helper "snmp" [ 1709.243846][T12993] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1709.324344][T12993] syzkaller0: entered promiscuous mode [ 1709.324367][T12993] syzkaller0: entered allmulticast mode [ 1709.373256][T12993] tipc: Enabled bearer , priority 0 [ 1709.518254][T12991] tipc: Resetting bearer [ 1709.586366][T12991] tipc: Disabling bearer [ 1709.657809][T13005] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11720'. [ 1709.657833][T13005] netlink: 36 bytes leftover after parsing attributes in process `syz.1.11720'. [ 1709.734217][T13005] vlan0: entered promiscuous mode [ 1709.915177][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1709.969333][T13013] netlink: 'syz.3.11723': attribute type 1 has an invalid length. [ 1710.054592][T13016] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11724'. [ 1710.955771][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1711.071085][T13043] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1711.084453][T13047] netlink: 'syz.2.11734': attribute type 1 has an invalid length. [ 1711.099849][T13043] syzkaller0: entered promiscuous mode [ 1711.100026][T13043] syzkaller0: entered allmulticast mode [ 1711.129041][T13043] tipc: Enabled bearer , priority 0 [ 1711.230715][T13042] tipc: Resetting bearer [ 1711.790872][T13048] netlink: 'syz.3.11733': attribute type 10 has an invalid length. [ 1711.942287][T13042] tipc: Disabling bearer [ 1711.970369][T13060] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11733'. [ 1711.995138][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1712.761638][T13079] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11741'. [ 1712.761673][T13079] netlink: 'syz.5.11741': attribute type 30 has an invalid length. [ 1712.787326][T13079] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11741'. [ 1712.787357][T13079] netlink: 'syz.5.11741': attribute type 30 has an invalid length. [ 1712.896681][T26892] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1712.896736][T26892] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1712.896765][T26892] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1712.896792][T26892] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1713.035174][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1714.075189][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1714.874867][T13091] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11744'. [ 1715.008874][T13096] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11745'. [ 1715.008898][T13096] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11745'. [ 1715.062512][T13097] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11744'. [ 1715.062534][T13097] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11744'. [ 1715.115215][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1715.615364][T13102] netlink: 'syz.5.11746': attribute type 1 has an invalid length. [ 1715.863069][T13111] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1715.893513][T13111] syzkaller0: entered promiscuous mode [ 1715.893692][T13111] syzkaller0: entered allmulticast mode [ 1716.155494][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1716.261353][T13123] tipc: New replicast peer: 127.0.0.1 [ 1716.261730][T13123] tipc: Enabled bearer , priority 10 [ 1716.980407][T13147] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11761'. [ 1717.078339][T13148] netlink: 'syz.3.11760': attribute type 1 has an invalid length. [ 1717.133644][T13157] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11762'. [ 1717.133666][T13157] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11762'. [ 1717.140041][T13147] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1717.190253][T13147] bond10 (unregistering): Released all slaves [ 1717.195557][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1717.253872][T13165] netlink: 67 bytes leftover after parsing attributes in process `syz.1.11763'. [ 1717.428056][T13165] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1717.451392][ T6840] tipc: Node number set to 3167258035 [ 1718.182725][T13191] x_tables: unsorted entry at hook 3 [ 1718.238235][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1718.546823][T13200] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11775'. [ 1718.569204][T13199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11774'. [ 1718.569355][T13199] netlink: 15 bytes leftover after parsing attributes in process `syz.4.11774'. [ 1718.571041][T13199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11774'. [ 1718.578047][T13199] netlink: 15 bytes leftover after parsing attributes in process `syz.4.11774'. [ 1718.657263][T13205] netlink: 'syz.5.11777': attribute type 1 has an invalid length. [ 1718.904663][T13207] netlink: 67 bytes leftover after parsing attributes in process `syz.2.11778'. [ 1718.994794][T13207] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1719.262700][T13221] vlan0: entered promiscuous mode [ 1719.262724][T13221] team0: entered promiscuous mode [ 1719.277086][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1719.310796][T13222] netlink: 'syz.1.11783': attribute type 18 has an invalid length. [ 1719.977044][T13246] netlink: 'syz.1.11791': attribute type 10 has an invalid length. [ 1720.315680][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1720.628168][T13258] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1721.081622][T13266] ip_tables: iptables: counters copy to user failed while replacing table [ 1721.355312][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1722.031671][T13300] __nla_validate_parse: 7 callbacks suppressed [ 1722.031690][T13300] netlink: 48 bytes leftover after parsing attributes in process `syz.5.11804'. [ 1722.314913][T13308] x_tables: ip6_tables: string.1 match: invalid size 160 (kernel) != (user) 4304 [ 1722.489086][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1722.626370][ T6073] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1722.644217][ T6073] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1722.659081][ T6073] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1722.672116][ T6073] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1722.673365][ T6073] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1722.687827][T13310] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11809'. [ 1722.687850][T13310] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11809'. [ 1723.478183][T13311] lo speed is unknown, defaulting to 1000 [ 1723.498159][T13336] FAULT_INJECTION: forcing a failure. [ 1723.498159][T13336] name failslab, interval 1, probability 0, space 0, times 0 [ 1723.498189][T13336] CPU: 1 UID: 0 PID: 13336 Comm: syz.4.11815 Not tainted syzkaller #0 PREEMPT(full) [ 1723.498211][T13336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1723.498223][T13336] Call Trace: [ 1723.498231][T13336] [ 1723.498240][T13336] dump_stack_lvl+0xe8/0x150 [ 1723.498274][T13336] should_fail_ex+0x410/0x560 [ 1723.498302][T13336] should_failslab+0xa8/0x100 [ 1723.498330][T13336] __kmalloc_noprof+0xfe/0x720 [ 1723.498350][T13336] ? tomoyo_encode+0x2ad/0x570 [ 1723.498373][T13336] ? tomoyo_encode+0x2ad/0x570 [ 1723.498403][T13336] tomoyo_encode+0x2ad/0x570 [ 1723.498434][T13336] tomoyo_realpath_from_path+0x5fa/0x640 [ 1723.498470][T13336] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1723.498493][T13336] tomoyo_path_number_perm+0x246/0x5f0 [ 1723.498519][T13336] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1723.498540][T13336] ? __lock_acquire+0x747/0x2de0 [ 1723.498577][T13336] ? hook_file_ioctl+0x1f2/0x600 [ 1723.498621][T13336] ? __fget_files+0x2a/0x420 [ 1723.498651][T13336] ? __fget_files+0x2a/0x420 [ 1723.498676][T13336] ? __fget_files+0x3a2/0x420 [ 1723.498700][T13336] ? __fget_files+0x2a/0x420 [ 1723.498730][T13336] security_file_ioctl+0xc3/0x2a0 [ 1723.498754][T13336] __se_sys_ioctl+0x47/0x170 [ 1723.498778][T13336] do_syscall_64+0x166/0x520 [ 1723.498804][T13336] ? trace_irq_disable+0x3b/0x140 [ 1723.498825][T13336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1723.498844][T13336] ? clear_bhb_loop+0x70/0xc0 [ 1723.498869][T13336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1723.498888][T13336] RIP: 0033:0x7fb13859e159 [ 1723.498906][T13336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1723.498922][T13336] RSP: 002b:00007fb1393b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1723.498946][T13336] RAX: ffffffffffffffda RBX: 00007fb138825fa0 RCX: 00007fb13859e159 [ 1723.498959][T13336] RDX: 0000200000000280 RSI: 00000000000089f3 RDI: 0000000000000003 [ 1723.498972][T13336] RBP: 00007fb1393b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1723.498985][T13336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1723.498997][T13336] R13: 00007fb138826038 R14: 00007fb138825fa0 R15: 00007fffca080ce8 [ 1723.499031][T13336] [ 1723.499066][T13336] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1723.501201][T13335] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11814'. [ 1723.516026][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1724.057890][T13340] dvmrp0: entered allmulticast mode [ 1724.169099][T13347] dvmrp1: entered allmulticast mode [ 1724.169848][T13349] dvmrp0: left allmulticast mode [ 1724.170408][T13349] dvmrp1: left allmulticast mode [ 1724.399336][ C1] bridge0: port 4(macvlan0) entered forwarding state [ 1724.399361][ C1] bridge0: topology change detected, propagating [ 1724.513218][T13360] FAULT_INJECTION: forcing a failure. [ 1724.513218][T13360] name failslab, interval 1, probability 0, space 0, times 0 [ 1724.513249][T13360] CPU: 1 UID: 0 PID: 13360 Comm: syz.4.11821 Not tainted syzkaller #0 PREEMPT(full) [ 1724.513271][T13360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1724.513283][T13360] Call Trace: [ 1724.513291][T13360] [ 1724.513300][T13360] dump_stack_lvl+0xe8/0x150 [ 1724.513333][T13360] should_fail_ex+0x410/0x560 [ 1724.513361][T13360] should_failslab+0xa8/0x100 [ 1724.513385][T13360] ? __pmd_alloc+0xc1/0x5c0 [ 1724.513411][T13360] kmem_cache_alloc_noprof+0xa1/0x600 [ 1724.513448][T13360] ? alloc_pages_mpol+0x256/0x390 [ 1724.513471][T13360] ? __pmd_alloc+0xc1/0x5c0 [ 1724.513503][T13360] __pmd_alloc+0xc1/0x5c0 [ 1724.513533][T13360] handle_mm_fault+0xe9d/0x3750 [ 1724.513571][T13360] ? handle_mm_fault+0xf1/0x3750 [ 1724.513608][T13360] ? __pfx_handle_mm_fault+0x10/0x10 [ 1724.513650][T13360] ? __lock_acquire+0x747/0x2de0 [ 1724.513675][T13360] ? lock_mm_and_find_vma+0xa7/0x340 [ 1724.513711][T13360] do_user_addr_fault+0x746/0x1340 [ 1724.513748][T13360] exc_page_fault+0x6a/0xc0 [ 1724.513777][T13360] asm_exc_page_fault+0x26/0x30 [ 1724.513795][T13360] RIP: 0010:__get_user_4+0x14/0x30 [ 1724.513817][T13360] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 01 cb <8b> 10 31 c0 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 [ 1724.513833][T13360] RSP: 0018:ffffc9000dc77e78 EFLAGS: 00050287 [ 1724.513851][T13360] RAX: 0000000000000000 RBX: ffff88807f251220 RCX: 0000000000000046 [ 1724.513864][T13360] RDX: 00007ffffffff000 RSI: ffffffff8e69edb7 RDI: ffffffff8c6dac80 [ 1724.513879][T13360] RBP: 0000000000005202 R08: ffffffff821ec27f R09: 0000000000000000 [ 1724.513891][T13360] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000002 [ 1724.513903][T13360] R13: dffffc0000000000 R14: ffff88807f251200 R15: 0000000000000000 [ 1724.513924][T13360] ? __might_fault+0xaf/0x130 [ 1724.513966][T13360] rfkill_fop_ioctl+0xa8/0x240 [ 1724.514076][T13360] ? __pfx_rfkill_fop_ioctl+0x10/0x10 [ 1724.514103][T13360] __se_sys_ioctl+0xfc/0x170 [ 1724.514128][T13360] do_syscall_64+0x166/0x520 [ 1724.514152][T13360] ? trace_irq_disable+0x3b/0x140 [ 1724.514172][T13360] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1724.514192][T13360] ? clear_bhb_loop+0x70/0xc0 [ 1724.514215][T13360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1724.514234][T13360] RIP: 0033:0x7fb13859e159 [ 1724.514252][T13360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1724.514268][T13360] RSP: 002b:00007fb1393b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1724.514288][T13360] RAX: ffffffffffffffda RBX: 00007fb138825fa0 RCX: 00007fb13859e159 [ 1724.514302][T13360] RDX: 0000000000000000 RSI: 0000000000005202 RDI: 0000000000000003 [ 1724.514314][T13360] RBP: 00007fb1393b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1724.514327][T13360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1724.514339][T13360] R13: 00007fb138826038 R14: 00007fb138825fa0 R15: 00007fffca080ce8 [ 1724.514372][T13360] [ 1724.555127][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1724.806734][ T51] Bluetooth: hci0: command tx timeout [ 1725.025542][T13364] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11822'. [ 1725.035046][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1725.035067][ C0] bridge0: topology change detected, propagating [ 1725.035198][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1725.035211][ C0] bridge0: topology change detected, propagating [ 1725.494170][T13374] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11824'. [ 1725.596696][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1725.680259][T13374] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1725.688987][T13375] netlink: 56 bytes leftover after parsing attributes in process `syz.5.11826'. [ 1726.032656][T13394] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11829'. [ 1726.549731][T13416] netlink: 'syz.4.11832': attribute type 21 has an invalid length. [ 1726.549753][T13416] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11832'. [ 1726.635118][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1726.717455][T13416] netlink: 'syz.4.11832': attribute type 21 has an invalid length. [ 1726.717511][T13416] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11832'. [ 1726.876630][ T51] Bluetooth: hci0: command tx timeout [ 1727.321425][T13311] bridge0: port 1(bridge_slave_0) entered blocking state [ 1727.321532][T13311] bridge0: port 1(bridge_slave_0) entered disabled state [ 1727.321665][T13311] bridge_slave_0: entered allmulticast mode [ 1727.330921][T13311] bridge_slave_0: entered promiscuous mode [ 1727.340084][T13311] bridge0: port 2(bridge_slave_1) entered blocking state [ 1727.341800][T13311] bridge0: port 2(bridge_slave_1) entered disabled state [ 1727.341927][T13311] bridge_slave_1: entered allmulticast mode [ 1727.353047][T13311] bridge_slave_1: entered promiscuous mode [ 1727.578372][T13445] FAULT_INJECTION: forcing a failure. [ 1727.578372][T13445] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1727.578404][T13445] CPU: 1 UID: 0 PID: 13445 Comm: syz.4.11842 Not tainted syzkaller #0 PREEMPT(full) [ 1727.578426][T13445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1727.578438][T13445] Call Trace: [ 1727.578446][T13445] [ 1727.578455][T13445] dump_stack_lvl+0xe8/0x150 [ 1727.578489][T13445] should_fail_ex+0x410/0x560 [ 1727.578517][T13445] _copy_from_user+0x2d/0xb0 [ 1727.578544][T13445] ___sys_recvmsg+0x173/0x5a0 [ 1727.578579][T13445] ? __pfx____sys_recvmsg+0x10/0x10 [ 1727.578612][T13445] ? lock_acquire+0x115/0x350 [ 1727.578663][T13445] do_recvmmsg+0x31a/0x7f0 [ 1727.578706][T13445] ? __pfx_do_recvmmsg+0x10/0x10 [ 1727.578746][T13445] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1727.578775][T13445] ? __fget_files+0x3a2/0x420 [ 1727.578812][T13445] __x64_sys_recvmmsg+0x198/0x250 [ 1727.578843][T13445] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1727.578883][T13445] do_syscall_64+0x166/0x520 [ 1727.578909][T13445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1727.578929][T13445] ? clear_bhb_loop+0x70/0xc0 [ 1727.578953][T13445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1727.578972][T13445] RIP: 0033:0x7fb13859e159 [ 1727.578990][T13445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1727.579005][T13445] RSP: 002b:00007fb1393b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1727.579027][T13445] RAX: ffffffffffffffda RBX: 00007fb138825fa0 RCX: 00007fb13859e159 [ 1727.579041][T13445] RDX: 015cbc1ab4c0933f RSI: 0000200000001980 RDI: 0000000000000003 [ 1727.579054][T13445] RBP: 00007fb1393b6090 R08: 0000000000000000 R09: 0000000000000000 [ 1727.579067][T13445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1727.579079][T13445] R13: 00007fb138826038 R14: 00007fb138825fa0 R15: 00007fffca080ce8 [ 1727.579114][T13445] [ 1727.610356][T13311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1727.610621][T13437] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11840'. [ 1727.631194][T13311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1727.662328][T13437] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11840'. [ 1727.675493][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1727.864394][T13450] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1727.894244][T13311] team0: Port device team_slave_0 added [ 1728.153549][T13456] x_tables: ip6_tables: SET.1 target: invalid size 8 (kernel) != (user) 0 [ 1728.421800][T13311] team0: Port device team_slave_1 added [ 1728.530594][T13451] syzkaller0: entered promiscuous mode [ 1728.530617][T13451] syzkaller0: entered allmulticast mode [ 1728.572184][T13463] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 1728.607846][T13311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1728.607862][T13311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1728.607886][T13311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1728.712920][T13464] netlink: 12 bytes leftover after parsing attributes in process `syz.5.11849'. [ 1728.715206][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1728.718520][T13464] netlink: 28 bytes leftover after parsing attributes in process `syz.5.11849'. [ 1728.718550][T13464] netlink: 60 bytes leftover after parsing attributes in process `syz.5.11849'. [ 1728.763910][T13311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1728.763924][T13311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1728.763949][T13311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1728.959539][ T51] Bluetooth: hci0: command tx timeout [ 1729.058488][T13311] hsr_slave_0: entered promiscuous mode [ 1729.059624][T13311] hsr_slave_1: entered promiscuous mode [ 1729.062208][T13311] debugfs: 'hsr0' already exists in 'hsr' [ 1729.062228][T13311] Cannot create hsr debugfs directory [ 1729.282631][T13479] netlink: 56 bytes leftover after parsing attributes in process `syz.3.11854'. [ 1729.282689][T13479] netlink: 56 bytes leftover after parsing attributes in process `syz.3.11854'. [ 1729.328296][T13479] netlink: 56 bytes leftover after parsing attributes in process `syz.3.11854'. [ 1729.328349][T13479] netlink: 56 bytes leftover after parsing attributes in process `syz.3.11854'. [ 1729.333343][T13477] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11853'. [ 1729.388254][T13482] netlink: 'syz.5.11855': attribute type 10 has an invalid length. [ 1729.488423][T13482] team0 (unregistering): Port device team_slave_0 removed [ 1729.532432][T13482] team0 (unregistering): Port device team_slave_1 removed [ 1729.755519][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1730.066498][T13499] tipc: Enabled bearer , priority 0 [ 1730.083147][T13498] tipc: Resetting bearer [ 1730.152140][T13502] block nbd0: reconnected socket [ 1730.176811][T13487] tipc: Disabling bearer [ 1730.247784][ T51] block nbd0: Receive control failed (result -32) [ 1730.412725][T13506] netlink: Unknown conntrack attr (0) [ 1730.649162][T13311] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1730.674441][T13524] netlink: NAT attributes may be specified only when CT COMMIT flag is also specified. [ 1730.674473][T13524] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1730.780632][T13514] veth1_to_team: entered promiscuous mode [ 1730.784912][T13514] gretap0: entered promiscuous mode [ 1730.795754][T13514] debugfs: 'hsr1' already exists in 'hsr' [ 1730.795774][T13514] Cannot create hsr debugfs directory [ 1730.795944][T13514] hsr1: entered promiscuous mode [ 1730.798118][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1730.968821][T13530] netlink: 'syz.1.11868': attribute type 1 has an invalid length. [ 1731.037057][ T51] Bluetooth: hci0: command tx timeout [ 1731.207102][T13311] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1731.503554][T13311] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1731.686514][T13311] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1731.746387][T13550] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1731.835495][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1731.872508][T13554] xt_hashlimit: size too large, truncated to 1048576 [ 1731.934293][T13555] xt_hashlimit: size too large, truncated to 1048576 [ 1732.704090][T13311] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1732.800233][T13311] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1732.821079][T13311] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1732.858224][T13311] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1732.860485][T13311] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1732.879422][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1732.894022][T13311] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1732.903909][T13311] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1732.992406][T13311] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1733.566040][T13311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1733.700443][T13311] 8021q: adding VLAN 0 to HW filter on device team0 [ 1733.736352][ T8712] bridge0: port 1(bridge_slave_0) entered blocking state [ 1733.736458][ T8712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1733.790470][ T8720] bridge0: port 2(bridge_slave_1) entered blocking state [ 1733.790583][ T8720] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1733.894735][T13601] netlink: 'syz.1.11887': attribute type 1 has an invalid length. [ 1733.915517][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1734.009246][T13598] lo: entered promiscuous mode [ 1734.023093][T13598] tunl0: entered promiscuous mode [ 1734.036309][T13598] gre0: entered promiscuous mode [ 1734.068957][T13606] ip_tables: iptables: counters copy to user failed while replacing table [ 1734.073439][T13598] erspan0: entered promiscuous mode [ 1734.098487][T13598] ip_vti0: entered promiscuous mode [ 1734.110780][T13598] ip6_vti0: entered promiscuous mode [ 1734.126200][T13598] sit0: entered promiscuous mode [ 1734.143687][T13598] ip6tnl0: entered promiscuous mode [ 1734.153745][T13598] ip6gre0: entered promiscuous mode [ 1734.321421][T13598] syz_tun: entered promiscuous mode [ 1734.424552][T13598] ip6gretap0: entered promiscuous mode [ 1734.468387][T13598] vcan0: entered promiscuous mode [ 1734.507224][T13598] bond0: entered promiscuous mode [ 1734.507454][T13598] bond_slave_1: entered promiscuous mode [ 1734.539891][T13598] team0: entered promiscuous mode [ 1734.539911][T13598] team_slave_0: entered promiscuous mode [ 1734.540092][T13598] team_slave_1: entered promiscuous mode [ 1734.580193][T13598] dummy0: entered promiscuous mode [ 1734.613743][T13598] nlmon0: entered promiscuous mode [ 1734.744362][T13311] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1734.744386][T13311] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1734.955126][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1735.112350][T13622] bridge0: port 4(bond0) entered blocking state [ 1735.113214][T13622] bridge0: port 4(bond0) entered disabled state [ 1735.113367][T13622] bond0: entered allmulticast mode [ 1735.113386][T13622] bond_slave_1: entered allmulticast mode [ 1735.156651][T13622] bond0: entered promiscuous mode [ 1735.156830][T13622] bond_slave_1: entered promiscuous mode [ 1735.190750][T13622] bridge0: port 4(bond0) entered blocking state [ 1735.190840][T13622] bridge0: port 4(bond0) entered forwarding state [ 1735.310575][T13629] syz_tun: entered allmulticast mode [ 1735.395344][T13632] Bluetooth: MGMT ver 1.23 [ 1735.523508][T13640] netlink: 'syz.3.11896': attribute type 4 has an invalid length. [ 1735.621250][T13640] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1735.644690][T13640] netlink: 'syz.3.11896': attribute type 4 has an invalid length. [ 1735.732221][T13645] ip_tables: iptables: counters copy to user failed while replacing table [ 1735.995537][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1736.144321][T13628] syz_tun: left allmulticast mode [ 1736.625009][T13663] netlink: 'syz.3.11903': attribute type 10 has an invalid length. [ 1736.635226][T13663] syz_tun: entered promiscuous mode [ 1736.729030][T13663] bond5: (slave syz_tun): Removing an active aggregator [ 1736.788164][T26895] bond5: Warning: Found an uninitialized port [ 1736.814187][T13663] bond5: (slave syz_tun): Releasing backup interface [ 1736.857464][T13663] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1736.891739][T13311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1737.035270][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1737.289308][T13311] veth0_vlan: entered promiscuous mode [ 1737.324233][T13311] veth1_vlan: entered promiscuous mode [ 1737.479178][T13670] xt_ecn: cannot match TCP bits for non-tcp packets [ 1737.533771][T13686] vcan0: tx address claim with dlc 0 [ 1737.556755][T13311] veth0_macvtap: entered promiscuous mode [ 1737.572057][T13311] veth1_macvtap: entered promiscuous mode [ 1737.666980][T13311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1737.729333][T13311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1737.841905][T26895] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1737.842613][ T8722] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1737.842648][ T8722] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1737.842680][ T8722] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1738.075742][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1738.519433][ T8712] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1738.519455][ T8712] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1738.802518][ T8712] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1738.802540][ T8712] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1738.981732][T13720] ip_tables: iptables: counters copy to user failed while replacing table [ 1739.103228][T13723] __nla_validate_parse: 9 callbacks suppressed [ 1739.103256][T13723] netlink: 67 bytes leftover after parsing attributes in process `syz.2.11806'. [ 1739.115347][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1739.521239][T13731] vcan0: tx address claim with dlc 0 [ 1739.649080][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1739.660157][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1739.672389][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1739.693889][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1739.703488][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1739.929841][T13739] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11922'. [ 1740.143840][T13739] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1740.155455][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1741.194332][T13769] netlink: 67 bytes leftover after parsing attributes in process `syz.3.11929'. [ 1741.195151][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1741.457890][ T8708] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1741.474094][T13732] lo speed is unknown, defaulting to 1000 [ 1741.835712][ T51] Bluetooth: hci4: command tx timeout [ 1742.232682][T13763] lo speed is unknown, defaulting to 1000 [ 1742.235441][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1743.275152][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1743.511324][T13732] bridge0: port 1(bridge_slave_0) entered blocking state [ 1743.511434][T13732] bridge0: port 1(bridge_slave_0) entered disabled state [ 1743.511572][T13732] bridge_slave_0: entered allmulticast mode [ 1743.520891][T13732] bridge_slave_0: entered promiscuous mode [ 1743.529640][T13732] bridge0: port 2(bridge_slave_1) entered blocking state [ 1743.529738][T13732] bridge0: port 2(bridge_slave_1) entered disabled state [ 1743.529939][T13732] bridge_slave_1: entered allmulticast mode [ 1743.544832][T13732] bridge_slave_1: entered promiscuous mode [ 1743.733331][T13732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1743.771535][T13732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1743.916967][ T51] Bluetooth: hci4: command tx timeout [ 1743.954412][T13732] team0: Port device team_slave_0 added [ 1743.973345][T13732] team0: Port device team_slave_1 added [ 1744.149081][T13732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1744.149097][T13732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1744.149119][T13732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1744.159652][T13732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1744.159666][T13732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1744.159688][T13732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1744.315402][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1744.457732][T13732] hsr_slave_0: entered promiscuous mode [ 1744.458870][T13732] hsr_slave_1: entered promiscuous mode [ 1744.478231][T13732] debugfs: 'hsr0' already exists in 'hsr' [ 1744.478251][T13732] Cannot create hsr debugfs directory [ 1744.667181][T13798] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11935'. [ 1744.960438][T13804] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11938'. [ 1744.960461][T13804] netlink: 36 bytes leftover after parsing attributes in process `syz.2.11938'. [ 1745.068414][T13804] vlan0: entered promiscuous mode [ 1745.355180][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1745.436229][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1745.547711][T13816] netlink: 67 bytes leftover after parsing attributes in process `syz.1.11942'. [ 1745.825481][T13732] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1745.825517][T13732] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1745.997734][ T51] Bluetooth: hci4: command tx timeout [ 1746.049484][T13816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1746.052486][T13816] 8021q: adding VLAN 0 to HW filter on device team0 [ 1746.119449][T13816] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 1746.140677][ T6843] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1746.387288][T13732] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1746.387323][T13732] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1746.395483][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1746.535291][ T6843] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1746.593704][T13826] RDS: rds_bind could not find a transport for ::ffff:172.30.0.6, load rds_tcp or rds_rdma? [ 1746.648128][T13732] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1746.648162][T13732] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1746.927938][T13732] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1746.927973][T13732] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1747.098185][T13845] netlink: 'syz.2.11950': attribute type 4 has an invalid length. [ 1747.098205][T13845] netlink: 152 bytes leftover after parsing attributes in process `syz.2.11950'. [ 1747.112252][T13845] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1747.269361][T13851] FAULT_INJECTION: forcing a failure. [ 1747.269361][T13851] name failslab, interval 1, probability 0, space 0, times 0 [ 1747.269394][T13851] CPU: 1 UID: 0 PID: 13851 Comm: syz.1.11952 Not tainted syzkaller #0 PREEMPT(full) [ 1747.269416][T13851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1747.269429][T13851] Call Trace: [ 1747.269437][T13851] [ 1747.269446][T13851] dump_stack_lvl+0xe8/0x150 [ 1747.269479][T13851] should_fail_ex+0x410/0x560 [ 1747.269506][T13851] ? __alloc_skb+0x1db/0x7a0 [ 1747.269541][T13851] should_failslab+0xa8/0x100 [ 1747.269568][T13851] ? __alloc_skb+0x1db/0x7a0 [ 1747.269589][T13851] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1747.269619][T13851] ? __alloc_skb+0x18d/0x7a0 [ 1747.269642][T13851] ? __alloc_skb+0x1db/0x7a0 [ 1747.269672][T13851] __alloc_skb+0x1db/0x7a0 [ 1747.269700][T13851] netlink_sendmsg+0x5d4/0xb40 [ 1747.269732][T13851] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1747.269760][T13851] ? apparmor_socket_sendmsg+0x98/0x360 [ 1747.269785][T13851] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1747.269803][T13851] sock_sendmsg_nosec+0x13a/0x180 [ 1747.269827][T13851] ____sys_sendmsg+0x54e/0x850 [ 1747.269858][T13851] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1747.269894][T13851] ? import_iovec+0x73/0xa0 [ 1747.269923][T13851] ___sys_sendmsg+0x2a5/0x360 [ 1747.269948][T13851] ? __lock_acquire+0x747/0x2de0 [ 1747.269975][T13851] ? __pfx____sys_sendmsg+0x10/0x10 [ 1747.270037][T13851] ? __fget_files+0x2a/0x420 [ 1747.270062][T13851] ? __fget_files+0x3a2/0x420 [ 1747.270099][T13851] __x64_sys_sendmsg+0x1b1/0x290 [ 1747.270128][T13851] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1747.270176][T13851] do_syscall_64+0x166/0x520 [ 1747.270203][T13851] ? trace_irq_disable+0x3b/0x140 [ 1747.270223][T13851] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1747.270244][T13851] ? clear_bhb_loop+0x70/0xc0 [ 1747.270268][T13851] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1747.270290][T13851] RIP: 0033:0x7fda9b79e159 [ 1747.270308][T13851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1747.270323][T13851] RSP: 002b:00007fda9c5de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1747.270345][T13851] RAX: ffffffffffffffda RBX: 00007fda9ba25fa0 RCX: 00007fda9b79e159 [ 1747.270359][T13851] RDX: 0000000004004000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1747.270372][T13851] RBP: 00007fda9c5de090 R08: 0000000000000000 R09: 0000000000000000 [ 1747.270385][T13851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1747.270396][T13851] R13: 00007fda9ba26038 R14: 00007fda9ba25fa0 R15: 00007fffe4682c38 [ 1747.270429][T13851] [ 1747.437049][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1747.709992][T13858] netlink: 67 bytes leftover after parsing attributes in process `syz.1.11956'. [ 1747.894196][T13858] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 1747.918355][T13692] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1748.078507][ T6073] Bluetooth: hci4: command tx timeout [ 1748.308253][T13732] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1748.311196][T13870] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1748.383335][T13873] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 1748.475645][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1748.955989][ T6843] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1748.999566][T13732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1749.000439][T13732] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1749.029326][T13732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1749.031915][T13732] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1749.054890][T13732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1749.073360][T13878] syzkaller0: entered promiscuous mode [ 1749.073381][T13878] syzkaller0: entered allmulticast mode [ 1749.093616][T13879] tipc: Started in network mode [ 1749.093644][T13879] tipc: Node identity 86e73d3780b3, cluster identity 4711 [ 1749.116698][T13879] tipc: Enabled bearer , priority 0 [ 1749.122018][T13732] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1749.176666][T13732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1749.193458][T13869] tipc: Resetting bearer [ 1749.414623][T13869] tipc: Disabling bearer [ 1749.516591][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1749.800725][T13903] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11969'. [ 1749.977314][T13732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1750.067164][T13732] 8021q: adding VLAN 0 to HW filter on device team0 [ 1750.180626][T13913] netlink: 67 bytes leftover after parsing attributes in process `syz.1.11970'. [ 1750.184700][ T2138] bridge0: port 1(bridge_slave_0) entered blocking state [ 1750.184804][ T2138] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1750.411704][T13923] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11973'. [ 1750.411735][T13923] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11973'. [ 1750.413898][T13924] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11973'. [ 1750.482046][T13913] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 1750.509689][ T6844] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1750.555976][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1750.635859][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1750.702981][T13923] 0ªX¹¦Dö»: entered promiscuous mode [ 1750.733945][T13923] 0ªX¹¦Dö»: left promiscuous mode [ 1750.864533][T13937] netlink: Conntrack attr type has unexpected length (type=0, length=8, expected=0) [ 1750.901589][ T8705] bridge0: port 2(bridge_slave_1) entered blocking state [ 1750.901694][ T8705] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1750.932654][T13931] netlink: 5 bytes leftover after parsing attributes in process `syz.5.11976'. [ 1751.198074][T13692] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1751.530216][T13953] net_ratelimit: 1 callbacks suppressed [ 1751.530313][T13953] ip_tables: iptables: counters copy to user failed while replacing table [ 1751.595405][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1751.725769][T13958] ip_vti0: left promiscuous mode [ 1751.731104][T13958] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 1751.940450][T13963] ip_tables: iptables: counters copy to user failed while replacing table [ 1752.029842][T13967] netlink: 67 bytes leftover after parsing attributes in process `syz.2.11984'. [ 1752.204843][T13963] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11983'. [ 1752.473736][T13979] netlink: 20 bytes leftover after parsing attributes in process `syz.2.11987'. [ 1752.568610][T13732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1752.635418][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1752.825808][T13988] netlink: 'syz.5.11988': attribute type 1 has an invalid length. [ 1752.932812][T13995] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11991'. [ 1752.932893][T13995] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1752.932905][T13995] IPv6: NLM_F_CREATE should be set when creating new route [ 1752.932934][T13995] IPv6: NLM_F_CREATE should be set when creating new route [ 1753.184861][T13988] bridge2: entered promiscuous mode [ 1753.198081][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1753.238825][T13988] bond1: (slave bridge2): making interface the new active one [ 1753.241615][T13988] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 1753.272233][T13994] bridge3: entered promiscuous mode [ 1753.280284][T13994] bond1: (slave bridge3): Enslaving as a backup interface with an up link [ 1753.444139][T13732] veth0_vlan: entered promiscuous mode [ 1753.516622][T13732] veth1_vlan: entered promiscuous mode [ 1753.604782][T14009] ip_tables: iptables: counters copy to user failed while replacing table [ 1753.676005][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1753.952955][T14011] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 1753.965380][T13692] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1754.032711][T13732] veth0_macvtap: entered promiscuous mode [ 1754.059535][T13732] veth1_macvtap: entered promiscuous mode [ 1754.190311][T13732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1754.231033][T13732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1754.288619][T14021] ip_tables: iptables: counters copy to user failed while replacing table [ 1754.296984][ T8720] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1754.297026][ T8720] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1754.297059][ T8720] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1754.297090][ T8720] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1754.303624][T14019] syzkaller1: entered promiscuous mode [ 1754.303641][T14019] syzkaller1: entered allmulticast mode [ 1754.638612][T13692] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1754.715608][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1754.941566][T14028] bridge_slave_0: left allmulticast mode [ 1754.941592][T14028] bridge_slave_0: left promiscuous mode [ 1754.941815][T14028] bridge0: port 1(bridge_slave_0) entered disabled state [ 1755.021613][T14030] nbd22: detected capacity change from 0 to 4294967296 [ 1755.045553][T14034] bond0: left allmulticast mode [ 1755.045578][T14034] bond_slave_1: left allmulticast mode [ 1755.045673][T14034] bond0: left promiscuous mode [ 1755.045864][T14034] bond_slave_1: left promiscuous mode [ 1755.046285][T14034] bridge0: port 4(bond0) entered disabled state [ 1755.094031][T14034] macvlan2: left allmulticast mode [ 1755.094051][T14034] ip6gretap0: left allmulticast mode [ 1755.099796][T14034] macvlan2: left promiscuous mode [ 1755.100105][T14034] bridge0: port 3(macvlan2) entered disabled state [ 1755.108883][T14034] bridge_slave_1: left allmulticast mode [ 1755.108903][T14034] bridge_slave_1: left promiscuous mode [ 1755.109083][T14034] bridge0: port 2(bridge_slave_1) entered disabled state [ 1755.177056][ T51] block nbd22: Receive control failed (result -104) [ 1755.525740][ T2138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1755.525759][ T2138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1755.748408][ T8720] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1755.748431][ T8720] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1755.850823][T14056] __nla_validate_parse: 2 callbacks suppressed [ 1755.850842][T14056] netlink: 67 bytes leftover after parsing attributes in process `syz.2.12009'. [ 1756.290661][T14074] netlink: 36 bytes leftover after parsing attributes in process `syz.3.12013'. [ 1756.425523][T14085] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12016'. [ 1756.425890][T14085] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12016'. [ 1756.430927][T14084] netlink: 36 bytes leftover after parsing attributes in process `syz.1.12015'. [ 1756.497917][T14085] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12016'. [ 1756.795954][ C1] net_ratelimit: 2 callbacks suppressed [ 1756.795974][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1756.874777][T14090] netlink: 'syz.5.12018': attribute type 1 has an invalid length. [ 1757.008997][T14090] bond3: entered promiscuous mode [ 1757.014204][T14090] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1757.266961][T14109] FAULT_INJECTION: forcing a failure. [ 1757.266961][T14109] name failslab, interval 1, probability 0, space 0, times 0 [ 1757.266993][T14109] CPU: 1 UID: 0 PID: 14109 Comm: syz.3.12023 Not tainted syzkaller #0 PREEMPT(full) [ 1757.267014][T14109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1757.267026][T14109] Call Trace: [ 1757.267043][T14109] [ 1757.267052][T14109] dump_stack_lvl+0xe8/0x150 [ 1757.267086][T14109] should_fail_ex+0x410/0x560 [ 1757.267113][T14109] ? __alloc_skb+0x1db/0x7a0 [ 1757.267137][T14109] should_failslab+0xa8/0x100 [ 1757.267164][T14109] ? __alloc_skb+0x1db/0x7a0 [ 1757.267185][T14109] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1757.267216][T14109] ? tcp_fastopen_cache_get+0x2f/0x4c0 [ 1757.267328][T14109] ? __alloc_skb+0x1db/0x7a0 [ 1757.267358][T14109] __alloc_skb+0x1db/0x7a0 [ 1757.267387][T14109] tcp_stream_alloc_skb+0x3f/0x580 [ 1757.267460][T14109] ? skb_page_frag_refill+0x119/0x460 [ 1757.267493][T14109] tcp_connect+0x25a1/0x54e0 [ 1757.267562][T14109] ? lock_acquire+0x115/0x350 [ 1757.267590][T14109] ? __pfx_tcp_connect+0x10/0x10 [ 1757.267617][T14109] ? ktime_get_with_offset+0x93/0x2d0 [ 1757.267636][T14109] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1757.267665][T14109] ? __asan_memset+0x22/0x50 [ 1757.267690][T14109] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 1757.267727][T14109] ? inet6_hash_connect+0xeb/0x170 [ 1757.267754][T14109] tcp_v6_connect+0x14ed/0x1cf0 [ 1757.267808][T14109] ? tcp_sendmsg_locked+0x4b02/0x5400 [ 1757.267829][T14109] ? tcp_sendmsg+0x2f/0x50 [ 1757.267867][T14109] ? __pfx_tcp_v6_connect+0x10/0x10 [ 1757.267900][T14109] __inet_stream_connect+0x258/0xe00 [ 1757.267935][T14109] ? __pfx___inet_stream_connect+0x10/0x10 [ 1757.267958][T14109] ? __kasan_kmalloc+0x93/0xb0 [ 1757.267982][T14109] ? __kmalloc_cache_noprof+0x321/0x600 [ 1757.268002][T14109] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1757.268021][T14109] ? tcp_sendmsg_fastopen+0x1e7/0x5f0 [ 1757.268058][T14109] tcp_sendmsg_fastopen+0x3af/0x5f0 [ 1757.268089][T14109] tcp_sendmsg_locked+0x4b02/0x5400 [ 1757.268140][T14109] ? __lock_acquire+0x747/0x2de0 [ 1757.268168][T14109] ? __lock_acquire+0x747/0x2de0 [ 1757.268200][T14109] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1757.268233][T14109] ? tcp_sendmsg+0x21/0x50 [ 1757.268259][T14109] ? __local_bh_enable_ip+0xd6/0x140 [ 1757.268290][T14109] tcp_sendmsg+0x2f/0x50 [ 1757.268313][T14109] ? __pfx_inet6_sendmsg+0x10/0x10 [ 1757.268332][T14109] sock_sendmsg_nosec+0x90/0x180 [ 1757.268356][T14109] ____sys_sendmsg+0x54e/0x850 [ 1757.268389][T14109] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1757.268425][T14109] ? import_iovec+0x73/0xa0 [ 1757.268455][T14109] ___sys_sendmsg+0x2a5/0x360 [ 1757.268480][T14109] ? __lock_acquire+0x747/0x2de0 [ 1757.268505][T14109] ? __pfx____sys_sendmsg+0x10/0x10 [ 1757.268537][T14109] ? kstrtouint+0x6e/0xe0 [ 1757.268586][T14109] ? __fget_files+0x2a/0x420 [ 1757.268611][T14109] ? __fget_files+0x3a2/0x420 [ 1757.268647][T14109] __sys_sendmmsg+0x273/0x4d0 [ 1757.268680][T14109] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1757.268716][T14109] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1757.268759][T14109] ? ksys_write+0x242/0x270 [ 1757.268790][T14109] ? __pfx_ksys_write+0x10/0x10 [ 1757.268825][T14109] __x64_sys_sendmmsg+0xa0/0xc0 [ 1757.268854][T14109] do_syscall_64+0x166/0x520 [ 1757.268880][T14109] ? trace_irq_disable+0x3b/0x140 [ 1757.268899][T14109] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1757.268919][T14109] ? clear_bhb_loop+0x70/0xc0 [ 1757.268943][T14109] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1757.268962][T14109] RIP: 0033:0x7fc55ad9e159 [ 1757.268981][T14109] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1757.268997][T14109] RSP: 002b:00007fc55bcd7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1757.269018][T14109] RAX: ffffffffffffffda RBX: 00007fc55b025fa0 RCX: 00007fc55ad9e159 [ 1757.269038][T14109] RDX: 0000000000000002 RSI: 0000200000002080 RDI: 0000000000000003 [ 1757.269050][T14109] RBP: 00007fc55bcd7090 R08: 0000000000000000 R09: 0000000000000000 [ 1757.269062][T14109] R10: 0000000020080058 R11: 0000000000000246 R12: 0000000000000001 [ 1757.269074][T14109] R13: 00007fc55b026038 R14: 00007fc55b025fa0 R15: 00007ffed33a43f8 [ 1757.269107][T14109] [ 1757.835156][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1757.861270][T14099] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1757.862274][T14099] bond3: (slave gre2): The slave device specified does not support setting the MAC address [ 1757.862294][T14099] bond3: (slave gre2): Setting fail_over_mac to active for active-backup mode [ 1757.891690][T14099] bond3: (slave gre2): making interface the new active one [ 1757.891711][T14099] gre2: entered promiscuous mode [ 1757.910353][T14099] bond3: (slave gre2): Enslaving as an active interface with an up link [ 1757.914513][T14101] syzkaller1: entered promiscuous mode [ 1757.914533][T14101] syzkaller1: entered allmulticast mode [ 1758.292251][T14120] sctp: [Deprecated]: syz.5.12026 (pid 14120) Use of int in maxseg socket option. [ 1758.292251][T14120] Use struct sctp_assoc_value instead [ 1758.855595][ T6073] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1758.864603][ T6073] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1758.876122][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1758.888914][ T6073] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1758.906648][ T6073] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1758.915414][ T6073] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1758.939747][ T51] [ 1758.942090][ T51] ====================================================== [ 1758.949127][ T51] WARNING: possible circular locking dependency detected [ 1758.956225][ T51] syzkaller #0 Not tainted [ 1758.960632][ T51] ------------------------------------------------------ [ 1758.967696][ T51] kworker/u9:0/51 is trying to acquire lock: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1758.973664][ T51] ffff88801c2d4a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_link_sibling+0x4c7/0x5a0 [ 1758.984188][ T51] [ 1758.984188][ T51] but task is already holding lock: [ 1758.991545][ T51] ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 [ 1759.000947][ T51] [ 1759.000947][ T51] which lock already depends on the new lock. [ 1759.000947][ T51] [ 1759.011347][ T51] [ 1759.011347][ T51] the existing dependency chain (in reverse order) is: [ 1759.020352][ T51] [ 1759.020352][ T51] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 1759.028427][ T51] down_write+0x96/0x200 [ 1759.033226][ T51] kernfs_add_one+0x41/0x6f0 [ 1759.038340][ T51] kernfs_create_dir_ns+0x1a1/0x230 [ 1759.044062][ T51] internal_create_group+0x440/0x1180 [ 1759.049946][ T51] cpuhp_invoke_callback+0x434/0x810 [ 1759.055788][ T51] cpuhp_issue_call+0x3f0/0x750 [ 1759.061164][ T51] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 1759.067753][ T51] __cpuhp_setup_state+0x3f/0x60 [ 1759.073204][ T51] do_one_initcall+0x250/0x870 [ 1759.078481][ T51] do_initcall_level+0x10a/0x1a0 [ 1759.084035][ T51] do_initcalls+0x59/0xa0 [ 1759.088872][ T51] kernel_init_freeable+0x29d/0x3e0 [ 1759.094575][ T51] kernel_init+0x22/0x1d0 [ 1759.099413][ T51] ret_from_fork+0x514/0xb70 [ 1759.104509][ T51] ret_from_fork_asm+0x1a/0x30 [ 1759.109787][ T51] [ 1759.109787][ T51] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 1759.117598][ T51] [ 1759.117598][ T51] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 1759.125311][ T51] cpus_read_lock+0x42/0x160 [ 1759.130410][ T51] static_key_slow_inc+0x12/0x30 [ 1759.135875][ T51] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 1759.142177][ T51] nbd_genl_foreach_sock+0x265/0x450 [ 1759.147968][ T51] nbd_genl_reconfigure+0xbbb/0x1040 [ 1759.153762][ T51] genl_family_rcv_msg_doit+0x233/0x340 [ 1759.159871][ T51] genl_rcv_msg+0x614/0x7a0 [ 1759.164889][ T51] netlink_rcv_skb+0x226/0x4a0 [ 1759.170164][ T51] genl_rcv+0x28/0x40 [ 1759.174659][ T51] netlink_unicast+0x7bd/0x940 [ 1759.179933][ T51] netlink_sendmsg+0x813/0xb40 [ 1759.185203][ T51] sock_sendmsg_nosec+0x13a/0x180 [ 1759.190734][ T51] ____sys_sendmsg+0x54e/0x850 [ 1759.196006][ T51] ___sys_sendmsg+0x2a5/0x360 [ 1759.201200][ T51] __x64_sys_sendmsg+0x1b1/0x290 [ 1759.206645][ T51] do_syscall_64+0x166/0x520 [ 1759.211745][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.218147][ T51] [ 1759.218147][ T51] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 1759.225781][ T51] __mutex_lock+0x19d/0x1550 [ 1759.230888][ T51] nbd_queue_rq+0x373/0xff0 [ 1759.235897][ T51] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1759.242032][ T51] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1759.248896][ T51] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1759.255387][ T51] blk_mq_run_work_fn+0x16c/0x300 [ 1759.260927][ T51] process_scheduled_works+0xc3d/0x1630 [ 1759.266983][ T51] worker_thread+0xa47/0xfb0 [ 1759.272092][ T51] kthread+0x38b/0x480 [ 1759.276669][ T51] ret_from_fork+0x514/0xb70 [ 1759.281764][ T51] ret_from_fork_asm+0x1a/0x30 [ 1759.287045][ T51] [ 1759.287045][ T51] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 1759.294267][ T51] __mutex_lock+0x19d/0x1550 [ 1759.299370][ T51] nbd_queue_rq+0xc1/0xff0 [ 1759.304294][ T51] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1759.310350][ T51] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1759.317192][ T51] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1759.323692][ T51] blk_mq_run_work_fn+0x16c/0x300 [ 1759.329251][ T51] process_scheduled_works+0xc3d/0x1630 [ 1759.335310][ T51] worker_thread+0xa47/0xfb0 [ 1759.340412][ T51] kthread+0x38b/0x480 [ 1759.344994][ T51] ret_from_fork+0x514/0xb70 [ 1759.350113][ T51] ret_from_fork_asm+0x1a/0x30 [ 1759.355396][ T51] [ 1759.355396][ T51] -> #4 (set->srcu){.+.+}-{0:0}: [ 1759.362508][ T51] __synchronize_srcu+0xc9/0x2f0 [ 1759.367956][ T51] elevator_switch+0x1e8/0x7b0 [ 1759.373299][ T51] elevator_change+0x2fa/0x480 [ 1759.378572][ T51] elevator_set_default+0x375/0x440 [ 1759.384282][ T51] blk_register_queue+0x3f3/0x4e0 [ 1759.389885][ T51] __add_disk+0x6b8/0xdb0 [ 1759.394759][ T51] add_disk_fwnode+0x100/0x3a0 [ 1759.400042][ T51] nbd_dev_add+0x733/0xb60 [ 1759.404965][ T51] nbd_init+0x168/0x1f0 [ 1759.409716][ T51] do_one_initcall+0x250/0x870 [ 1759.414992][ T51] do_initcall_level+0x10a/0x1a0 [ 1759.420440][ T51] do_initcalls+0x59/0xa0 [ 1759.425273][ T51] kernel_init_freeable+0x29d/0x3e0 [ 1759.430981][ T51] kernel_init+0x22/0x1d0 [ 1759.435817][ T51] ret_from_fork+0x514/0xb70 [ 1759.440916][ T51] ret_from_fork_asm+0x1a/0x30 [ 1759.446193][ T51] [ 1759.446193][ T51] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 1759.454037][ T51] __mutex_lock+0x19d/0x1550 [ 1759.459151][ T51] elevator_change+0x1af/0x480 [ 1759.464464][ T51] elevator_set_none+0xb5/0x140 [ 1759.469829][ T51] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1759.476157][ T51] nbd_start_device+0x189/0xb30 [ 1759.481514][ T51] nbd_genl_connect+0x167d/0x1cd0 [ 1759.487043][ T51] genl_family_rcv_msg_doit+0x233/0x340 [ 1759.493100][ T51] genl_rcv_msg+0x614/0x7a0 [ 1759.498115][ T51] netlink_rcv_skb+0x226/0x4a0 [ 1759.503384][ T51] genl_rcv+0x28/0x40 [ 1759.507873][ T51] netlink_unicast+0x7bd/0x940 [ 1759.513148][ T51] netlink_sendmsg+0x813/0xb40 [ 1759.518425][ T51] sock_sendmsg_nosec+0x13a/0x180 [ 1759.523960][ T51] ____sys_sendmsg+0x54e/0x850 [ 1759.529235][ T51] ___sys_sendmsg+0x2a5/0x360 [ 1759.534432][ T51] __x64_sys_sendmsg+0x1b1/0x290 [ 1759.539881][ T51] do_syscall_64+0x166/0x520 [ 1759.544992][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.551402][ T51] [ 1759.551402][ T51] -> #2 (&q->q_usage_counter(io)#73){++++}-{0:0}: [ 1759.559998][ T51] blk_alloc_queue+0x544/0x690 [ 1759.565273][ T51] __blk_mq_alloc_disk+0x194/0x390 [ 1759.570900][ T51] nbd_dev_add+0x494/0xb60 [ 1759.575822][ T51] nbd_genl_connect+0x96c/0x1cd0 [ 1759.581268][ T51] genl_family_rcv_msg_doit+0x233/0x340 [ 1759.587363][ T51] genl_rcv_msg+0x614/0x7a0 [ 1759.592376][ T51] netlink_rcv_skb+0x226/0x4a0 [ 1759.597645][ T51] genl_rcv+0x28/0x40 [ 1759.602139][ T51] netlink_unicast+0x7bd/0x940 [ 1759.607413][ T51] netlink_sendmsg+0x813/0xb40 [ 1759.612683][ T51] sock_sendmsg_nosec+0x13a/0x180 [ 1759.618213][ T51] ____sys_sendmsg+0x54e/0x850 [ 1759.623489][ T51] ___sys_sendmsg+0x2a5/0x360 [ 1759.628676][ T51] __x64_sys_sendmsg+0x1b1/0x290 [ 1759.634127][ T51] do_syscall_64+0x166/0x520 [ 1759.639228][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.645632][ T51] [ 1759.645632][ T51] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1759.652832][ T51] fs_reclaim_acquire+0x71/0x100 [ 1759.658283][ T51] kmem_cache_alloc_noprof+0x5f/0x600 [ 1759.664182][ T51] __kernfs_iattrs+0xdd/0x380 [ 1759.669366][ T51] kernfs_iop_setattr+0xe6/0x3f0 [ 1759.674815][ T51] notify_change+0xbba/0xea0 [ 1759.679913][ T51] do_truncate+0x1c2/0x250 [ 1759.684841][ T51] path_openat+0x15b5/0x1d60 [ 1759.689934][ T51] do_file_open+0x23e/0x4a0 [ 1759.694943][ T51] do_sys_openat2+0x115/0x200 [ 1759.700136][ T51] __x64_sys_openat+0x138/0x170 [ 1759.705501][ T51] do_syscall_64+0x166/0x520 [ 1759.710602][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1759.717001][ T51] [ 1759.717001][ T51] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 1759.725497][ T51] __lock_acquire+0x164c/0x2de0 [ 1759.730854][ T51] lock_acquire+0x115/0x350 [ 1759.735871][ T51] down_write+0x96/0x200 [ 1759.740657][ T51] kernfs_link_sibling+0x4c7/0x5a0 [ 1759.746288][ T51] kernfs_add_one+0x2db/0x6f0 [ 1759.751470][ T51] kernfs_create_dir_ns+0x1a1/0x230 [ 1759.757174][ T51] sysfs_create_dir_ns+0x12f/0x2a0 [ 1759.762797][ T51] kobject_add_internal+0x622/0xcd0 [ 1759.768580][ T51] kobject_add+0x163/0x240 [ 1759.773536][ T51] device_add+0x3fa/0xb80 [ 1759.778403][ T51] hci_conn_add_sysfs+0xd5/0x210 [ 1759.783852][ T51] hci_conn_complete_evt+0x8a8/0x1350 [ 1759.789779][ T51] hci_event_packet+0x6cd/0xf10 [ 1759.795145][ T51] hci_rx_work+0x3ee/0x1020 [ 1759.800226][ T51] process_scheduled_works+0xc3d/0x1630 [ 1759.806290][ T51] worker_thread+0xa47/0xfb0 [ 1759.811395][ T51] kthread+0x38b/0x480 [ 1759.815972][ T51] ret_from_fork+0x514/0xb70 [ 1759.821076][ T51] ret_from_fork_asm+0x1a/0x30 [ 1759.826406][ T51] [ 1759.826406][ T51] other info that might help us debug this: [ 1759.826406][ T51] [ 1759.836622][ T51] Chain exists of: [ 1759.836622][ T51] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 1759.836622][ T51] [ 1759.851089][ T51] Possible unsafe locking scenario: [ 1759.851089][ T51] [ 1759.858605][ T51] CPU0 CPU1 [ 1759.864030][ T51] ---- ---- [ 1759.869387][ T51] lock(&root->kernfs_rwsem); [ 1759.874140][ T51] lock(cpuhp_state_mutex); [ 1759.881237][ T51] lock(&root->kernfs_rwsem); [ 1759.888517][ T51] lock(&root->kernfs_iattr_rwsem); [ 1759.893789][ T51] [ 1759.893789][ T51] *** DEADLOCK *** [ 1759.893789][ T51] [ 1759.901960][ T51] locks held by kworker/u9:0/51: 4, last CPU#1: [ 1759.908230][ T51] #0: ffff888063aac940 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1759.919242][ T51] #1: ffffc90000bc7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1759.931240][ T51] #2: ffff88805344c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_conn_complete_evt+0xba/0x1350 [ 1759.941066][ T51] #3: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 [ 1759.950912][ T51] [ 1759.950912][ T51] stack backtrace: [ 1759.956789][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) [ 1759.966064][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1759.976115][ T51] Workqueue: hci3 hci_rx_work [ 1759.980785][ T51] Call Trace: [ 1759.984050][ T51] [ 1759.986967][ T51] dump_stack_lvl+0xe8/0x150 [ 1759.991550][ T51] print_circular_bug+0x2e2/0x300 [ 1759.996569][ T51] check_noncircular+0x12f/0x150 [ 1760.001504][ T51] __lock_acquire+0x164c/0x2de0 [ 1760.006351][ T51] ? __lock_acquire+0x747/0x2de0 [ 1760.011282][ T51] lock_acquire+0x115/0x350 [ 1760.015781][ T51] ? kernfs_link_sibling+0x4c7/0x5a0 [ 1760.021059][ T51] down_write+0x96/0x200 [ 1760.025297][ T51] ? kernfs_link_sibling+0x4c7/0x5a0 [ 1760.030573][ T51] ? __pfx_down_write+0x10/0x10 [ 1760.035414][ T51] ? kernfs_root+0x1c/0x230 [ 1760.039911][ T51] ? kernfs_root+0x1c/0x230 [ 1760.044429][ T51] ? kernfs_root+0x1c/0x230 [ 1760.048931][ T51] ? kernfs_root+0x1ea/0x230 [ 1760.053507][ T51] kernfs_link_sibling+0x4c7/0x5a0 [ 1760.058610][ T51] kernfs_add_one+0x2db/0x6f0 [ 1760.063304][ T51] kernfs_create_dir_ns+0x1a1/0x230 [ 1760.068490][ T51] sysfs_create_dir_ns+0x12f/0x2a0 [ 1760.073596][ T51] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1760.079234][ T51] ? do_raw_spin_unlock+0xf5/0x200 [ 1760.084338][ T51] kobject_add_internal+0x622/0xcd0 [ 1760.089539][ T51] kobject_add+0x163/0x240 [ 1760.093953][ T51] ? __pfx_kobject_add+0x10/0x10 [ 1760.098887][ T51] ? get_device_parent+0x366/0x3a0 [ 1760.103997][ T51] device_add+0x3fa/0xb80 [ 1760.108315][ T51] hci_conn_add_sysfs+0xd5/0x210 [ 1760.113243][ T51] hci_conn_complete_evt+0x8a8/0x1350 [ 1760.118605][ T51] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1760.124587][ T51] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 1760.130382][ T51] ? skb_pull_data+0xf0/0x200 [ 1760.135048][ T51] hci_event_packet+0x6cd/0xf10 [ 1760.139886][ T51] ? __pfx_hci_conn_complete_evt+0x10/0x10 [ 1760.145680][ T51] ? __pfx_hci_event_packet+0x10/0x10 [ 1760.151040][ T51] ? audit_filter_rules+0x45f0/0x5d10 [ 1760.156401][ T51] ? hci_send_to_monitor+0xe2/0x590 [ 1760.161672][ T51] hci_rx_work+0x3ee/0x1020 [ 1760.166166][ T51] ? process_scheduled_works+0x97a/0x1630 [ 1760.171885][ T51] process_scheduled_works+0xc3d/0x1630 [ 1760.177433][ T51] ? __pfx_process_scheduled_works+0x10/0x10 [ 1760.183408][ T51] ? assign_work+0x3cf/0x5d0 [ 1760.188000][ T51] worker_thread+0xa47/0xfb0 [ 1760.192590][ T51] kthread+0x38b/0x480 [ 1760.196662][ T51] ? __pfx_worker_thread+0x10/0x10 [ 1760.201765][ T51] ? __pfx_kthread+0x10/0x10 [ 1760.206341][ T51] ret_from_fork+0x514/0xb70 [ 1760.210917][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 1760.216013][ T51] ? __switch_to+0xc89/0x1420 [ 1760.220707][ T51] ? __pfx_kthread+0x10/0x10 [ 1760.225286][ T51] ret_from_fork_asm+0x1a/0x30 [ 1760.230050][ T51] [ 1760.240747][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1760.425275][T14131] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12030'. [ 1760.746943][ T4540] bond0: (slave syz_tun): Releasing backup interface [ 1760.955821][ T6073] Bluetooth: hci3: command tx timeout [ 1761.131641][ T8720] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.271569][ T8720] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.277162][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1761.376193][ T8720] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.536978][ T8720] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1761.655044][ T8712] netdevsim netdevsim3 eth7: set [1, 0] type 2 family 0 port 6081 - 0 [ 1761.831776][ T8720] bond1 (unregistering): (slave erspan1): Releasing active interface [ 1761.831801][ T8720] erspan1 (unregistering): left promiscuous mode [ 1761.869559][ T8720] bond4 (unregistering): (slave gretap1): Releasing active interface [ 1761.910695][ T8720] bond3 (unregistering): (slave geneve2): Releasing active interface [ 1762.238689][ T8720] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1762.240462][ T8720] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1762.241679][ T8720] bond0 (unregistering): Released all slaves [ 1762.244718][ T8720] bond1 (unregistering): Released all slaves [ 1762.286974][ T8720] bond2 (unregistering): Released all slaves [ 1762.292291][ T8720] bond3 (unregistering): Released all slaves [ 1762.314233][ T8720] bond4 (unregistering): Released all slaves [ 1762.315215][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1762.344578][ T8720] bond5 (unregistering): Released all slaves [ 1762.358681][ T8720] bond6 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1762.359997][ T8720] bond6 (unregistering): Released all slaves [ 1762.375194][ T5281] 8021q: adding VLAN 0 to HW filter on device eth5 [ 1762.376597][ T41] netdevsim netdevsim3 eth5: set [1, 0] type 2 family 0 port 6081 - 0 [ 1762.376638][ T41] netdevsim netdevsim3 eth6: set [1, 0] type 2 family 0 port 6081 - 0 [ 1762.376666][ T41] netdevsim netdevsim3 eth8: set [1, 0] type 2 family 0 port 6081 - 0 [ 1762.481564][ T8720] tipc: Left network mode [ 1762.905871][ T5281] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1763.355262][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1763.476083][ T8720] hsr_slave_0: left promiscuous mode [ 1763.476518][ T8720] hsr_slave_1: left promiscuous mode [ 1763.479468][ T8720] veth0_macvtap: left promiscuous mode [ 1763.479593][ T8720] veth1_vlan: left promiscuous mode [ 1763.752825][ T8720] team0 (unregistering): Port device team_slave_1 removed [ 1763.771366][ T8720] team0 (unregistering): Port device team_slave_0 removed [ 1763.899048][ T5281] 8021q: adding VLAN 0 to HW filter on device eth7 [ 1764.097486][ T8720] IPVS: stop unused estimator thread 0... [ 1764.353326][ T8720] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.395236][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1764.420406][ T8720] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.489735][ T8720] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.532095][ T8720] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.560686][ T5281] 8021q: adding VLAN 0 to HW filter on device eth8 [ 1764.629374][T26892] netdevsim netdevsim4 eth11: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.636047][ T8712] netdevsim netdevsim4 eth10: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.652686][T26892] netdevsim netdevsim4 eth12: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.652720][T26892] netdevsim netdevsim4 eth9: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.679661][ T8720] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1764.679693][ T8720] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.741534][ T8720] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1764.741569][ T8720] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.774387][ T8720] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1764.774420][ T8720] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.861678][ T8720] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1764.861714][ T8720] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1764.950444][ T8712] netdevsim netdevsim5 eth13: set [1, 0] type 2 family 0 port 6081 - 0 [ 1764.981230][ T8712] netdevsim netdevsim5 eth15: set [1, 0] type 2 family 0 port 6081 - 0 [ 1765.002284][ T8720] bridge_slave_1: left allmulticast mode [ 1765.002304][ T8720] bridge_slave_1: left promiscuous mode [ 1765.002437][ T8720] bridge0: port 2(bridge_slave_1) entered disabled state [ 1765.036358][ T8720] bridge_slave_0: left allmulticast mode [ 1765.036622][ T8720] bridge_slave_0: left promiscuous mode [ 1765.037237][ T8720] bridge0: port 1(bridge_slave_0) entered disabled state [ 1765.386214][ T8720] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1765.388539][ T8720] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1765.389752][ T8720] bond0 (unregistering): Released all slaves [ 1765.435295][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1765.461553][ T8720] bond3 (unregistering): (slave gre2): Releasing backup interface [ 1765.461573][ T8720] gre2 (unregistering): left promiscuous mode [ 1765.552371][ T8720] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 1765.552391][ T8720] bond1 (unregistering): (slave bridge2): the permanent HWaddr of slave - ea:aa:df:d0:f4:f5 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1765.552418][ T8720] bond1 (unregistering): (slave bridge3): making interface the new active one [ 1765.552510][ T8720] bond1 (unregistering): (slave bridge3): Error 16 setting MAC of new active slave [ 1765.618435][ T8720] bond1 (unregistering): (slave bridge3): Releasing backup interface [ 1765.653223][ T8720] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1765.654330][ T8720] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1765.674541][ T8720] bond0 (unregistering): Released all slaves [ 1765.683987][ T8720] bond1 (unregistering): Released all slaves [ 1765.695817][ T8720] bond2 (unregistering): Released all slaves [ 1765.701103][ T8720] bond3 (unregistering): Released all slaves [ 1765.720978][ T5281] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1765.741758][T26892] netdevsim netdevsim5 eth16: set [1, 0] type 2 family 0 port 6081 - 0 [ 1765.741799][T26892] netdevsim netdevsim5 eth14: set [1, 0] type 2 family 0 port 6081 - 0 [ 1765.809651][ T8720] tipc: Disabling bearer [ 1765.809742][ T8720] tipc: Left network mode [ 1766.311187][ T8720] hsr_slave_0: left promiscuous mode [ 1766.311666][ T8720] hsr_slave_1: left promiscuous mode [ 1766.312155][ T8720] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1766.312172][ T8720] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1766.312671][ T8720] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1766.312685][ T8720] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.382420][ T8720] hsr_slave_0: left promiscuous mode [ 1766.384530][ T8720] hsr_slave_1: left promiscuous mode [ 1766.399607][ T8720] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1766.399626][ T8720] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1766.400134][ T8720] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1766.400149][ T8720] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1766.441907][ T8720] veth1_macvtap: left promiscuous mode [ 1766.441935][ T8720] veth0_macvtap: left promiscuous mode [ 1766.441998][ T8720] veth1_vlan: left promiscuous mode [ 1766.442054][ T8720] veth0_vlan: left promiscuous mode [ 1766.444232][ T8720] veth1_macvtap: left promiscuous mode [ 1766.444255][ T8720] veth0_macvtap: left promiscuous mode [ 1766.444327][ T8720] veth1_vlan: left promiscuous mode [ 1766.444368][ T8720] veth0_vlan: left promiscuous mode [ 1766.479925][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1766.800800][ T8720] team0 (unregistering): Port device team_slave_1 removed [ 1766.830247][ T8720] team0 (unregistering): Port device team_slave_0 removed [ 1767.164510][ T5281] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1767.515279][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1767.613826][ T5281] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1768.058651][ T5281] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1768.414620][ T5281] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1768.555368][ C1] IPVS: ovf: UDP 224.0.0.2:0 - no destination available [ 1768.816985][ T5281] 8021q: adding VLAN 0 to HW filter on device eth14