last executing test programs: 1m54.259111822s ago: executing program 1 (id=3988): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'ipvlan0\x00', 0x0}) (async, rerun: 32) r2 = socket$igmp(0x2, 0x3, 0x2) (async, rerun: 32) r3 = socket(0x400000000010, 0x2, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000040)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl1\x00', 0x0, 0x29, 0x2, 0x0, 0x3, 0x22, @private2={0xfc, 0x2, '\x00', 0x1}, @local, 0x80, 0x8, 0x100, 0x2}}) (async) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@mcast1, @in=@broadcast}}, {{@in=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000200)=0xe8) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xe0000000, 0x5, 0xb7, 0x2, 0x2, 0x1, 0x4, 0x3, 0x1}}}}]}, 0x58}}, 0x4000) setsockopt$MRT_DEL_VIF(r2, 0x0, 0xcb, &(0x7f0000000480)={0x1, 0x0, 0xe, 0x3, @vifc_lcl_ifindex=r5, @broadcast}, 0x10) (async, rerun: 32) setsockopt$inet_int(r2, 0x0, 0x5, 0x0, 0x0) (async, rerun: 32) ioctl$int_in(r2, 0x5421, &(0x7f0000000000)=0xf) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newlink={0x3c, 0x10, 0x400, 0xfffffffc, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, 0x1703}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xfffffffd}]}, 0x3c}, 0x1, 0x200000000000000, 0x0, 0x2004d808}, 0x0) (rerun: 32) 1m53.642538154s ago: executing program 1 (id=3990): r0 = socket(0x10, 0x3, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f0000000580)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000000600)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000680)=""/4096, 0x1000}], 0x1}, 0x10000}], 0x1, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), 0xffffffffffffffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=ANY=[@ANYBLOB="540065efe505d190b93f0000000000000400ffff0c00078005001500080000000500010006000000050005000a00000005000400000000000d000300686173683a6e6574000000000900020073797a3000000000"], 0x54}, 0x1, 0x0, 0x0, 0x20044090}, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000400)={0x1, 0x4, 0x3, 0x9}, &(0x7f0000001980)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000019c0)={r6, 0xdd9f, 0x0, 0x5b}, 0x10) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001780)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000fcdbdf251700100054000680140003002d3973353a5f2d5d382ee5364c4323843c00040067636d286165732900e8feffff0000000000000000000000000000000000000014"], 0x68}, 0x1, 0x0, 0x0, 0x400c841}, 0x0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x10000008ebc, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000001840)={0x38, 0x1412, 0x1, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x1}]}, 0x6d}, 0x1, 0x0, 0x0, 0x80}, 0x10) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x25a5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a03000000000000000000000000000c00024000000000000000010900010073797a300000000020000000030a01020000000000000000020000020900030073797a320000000018000000120a010100000000000000000000000904000480140000001100010000000000000000000000000a206d33384503d78b8014ed424d8c3ba87790eafd522dceb2be52f225bdf0da089dd428242e8d119e30bc3e9a32024ec363756d5799b55c5162e956b53d2cb7ee84c833f1e74c3c97f8af82ec5217b3618ee8a51c413ff923a50473bcc1d65f33a3dcd80bbfdf1bc0e7b55e2889bcf8ee"], 0x8c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x4000}}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x16, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x64}}, 0x20000000) socket$inet6(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc20001180"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b000100627269646765000018000280050019008400"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, &(0x7f0000000440)={0x2, @in6={{0xa, 0x4e22, 0x9, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xffffff00}}}, 0x84) r9 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r9, 0x114, 0xa, &(0x7f0000000500)=ANY=[], 0x4) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1m50.084531507s ago: executing program 0 (id=4007): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socket$rds(0x15, 0x5, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2a0140, 0x0) socket$unix(0x1, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000001400b59500000c00000000000ac0"], 0x18}}, 0x0) r0 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000180)={r1}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @broadcast}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000003fa000000880000", @ANYRES32], 0x50) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000280)={0x0, {0x2, 0x4e20, @rand_addr=0x64010100}, {0x2, 0x4a24, @remote}, {0x2, 0x4e25, @multicast2}, 0x204, 0x0, 0x0, 0x0, 0x2008, 0x0, 0x200003, 0x2, 0x2}) write$tun(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="080000fa"], 0xdc) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x40000) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) ioctl$sock_ifreq(r7, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) 1m49.278187785s ago: executing program 2 (id=4008): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x3c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x401}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfff}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x200088c1) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4c, 0x4c, 0x2, [@const={0x0, 0x0, 0x0, 0x9, 0x4}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x2, 0x9b94}}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2, 0xffffffff}}]}}, 0x0, 0x66}, 0x28) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x34, r1, 0x205, 0x70bd2d, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x1}]}, 0x34}}, 0x0) 1m49.100306546s ago: executing program 1 (id=4011): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_PACKETS_PER_SLAVE={0x8, 0x14, 0x52}, @IFLA_BOND_MODE={0x5, 0x1, 0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) (async) r1 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000040)=0x10, 0x800) ppoll(&(0x7f0000000100)=[{r0, 0x2}, {r1, 0x4140}, {r0, 0x2600}, {r0, 0x80}], 0x4, &(0x7f0000000140)={0x77359400}, &(0x7f0000000180)={[0x1]}, 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x13, 0x6, &(0x7f00000002c0)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x73, 0x11, 0x9c}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xc4}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000300)='GPL\x00', 0x5, 0x29e, &(0x7f0000000340)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r5, @ANYBLOB="05005b"], 0x24}}, 0x240008d0) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x20, 0x3, &(0x7f0000000840)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000880)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r9, 0x0, 0x2d, 0x20, @val=@netfilter={0xa, 0x1, 0x0, 0x1}}, 0x20) (async) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000640)={'wlan1\x00', 0x0}) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r11, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)={0x28, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) (async) sendmmsg(r2, &(0x7f0000000780), 0x4000000000000d2, 0x8048848) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) 1m49.000700029s ago: executing program 2 (id=4012): socket$can_j1939(0x1d, 0x2, 0x7) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x400ed80, &(0x7f0000000200)={0xa, 0x4c24, 0x78a2, @local}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000240)=[{{0x0, 0x0, 0x0}, 0xb00}], 0x1, 0x2400c891) r1 = socket(0x40000000015, 0x5, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000000)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6gre0\x00', 0x0, 0x29, 0x8, 0x0, 0x2, 0x19, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, 0x7800, 0x40, 0x3, 0x8001}}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x2e, @rand_addr=0x64010101, 0x4e20, 0x0, 'lblc\x00', 0x1, 0x12c, 0xffffffff}, 0x2c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='cgroup.kill\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f00000001c0), 0x12) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000340)={0x0, 0x2, 0x100000000, 0x1}) ioctl$FS_IOC_RESVSP(r4, 0x40305829, &(0x7f00000005c0)={0x0, 0x2, 0x461d0ffc, 0x20b7ee}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=@newlink={0x20, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32844, 0xc1}}, 0x20}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r10, 0x29, 0x1b, &(0x7f0000000080)={@private0}, 0x14) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000140)={'ipvlan0\x00', 0x0}) setsockopt$inet6_mreq(r10, 0x29, 0x1b, &(0x7f0000000180)={@remote, r11}, 0x14) sendmsg$nl_route_sched(r9, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=@newtfilter={0x24, 0x11, 0x1, 0x70bd24, 0x2000, {0x0, 0x0, 0x74, r11, {0x5, 0x1}, {0x1, 0xfff2}, {0xfff2, 0x10}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x840) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000a40)=@nat={'nat\x00', 0x1b, 0x5, 0x678, 0x238, 0x350, 0xffffffff, 0x0, 0x238, 0x5a8, 0x5a8, 0xffffffff, 0x5a8, 0x5a8, 0x5, &(0x7f0000000480), {[{{@uncond, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x40, 0xffff, 0xe8e, 0x1}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x1, {0x9}}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@mh={{0x28}, {"dbd7", 0x1}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0xe, @ipv4=@broadcast, @ipv4=@remote, @gre_key, @port=0x4e20}}}, {{@uncond, 0x0, 0xd0, 0x118, 0x0, {}, [@common=@eui64={{0x28}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x2, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @ipv6=@mcast2, @gre_key=0x1, @port=0x4e24}}}, {{@uncond, 0x0, 0x210, 0x258, 0x0, {}, [@common=@frag={{0x30}, {[0x1, 0xffffff81], 0x7, 0xd, 0x2}}, @common=@rt={{0x138}, {0x2, [0x6, 0x80000000], 0x6, 0x8, 0x2, [@local, @empty, @private0, @mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @private2, @dev={0xfe, 0x80, '\x00', 0x23}, @local, @loopback, @private0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, @private1, @rand_addr=' \x01\x00', @private2], 0x1}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0xb, @ipv4=@private=0xa010102, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @icmp_id=0x67, @port=0x4e23}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6d8) getpeername$inet6(r3, &(0x7f0000000300)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000580)=0x1c) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000940)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)={0x1c, r6, 0xb97534d5fe9704cf, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r12}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8141ba5ccf7ef84}, 0x0) r13 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r13, &(0x7f0000000540)={0x2, 0x4e20, @local}, 0x10) 1m47.478133849s ago: executing program 3 (id=4015): r0 = socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000002b00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002bc0)={'veth0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000002c00)=0x19ca, 0x4) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000002c40)=0xf3f, 0x4) sendto$packet(r0, &(0x7f0000002c80)="3f03fe7f0312140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000002d00)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) r2 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000180)={0xa, 0x4e20, 0xffffffff, @loopback, 0x4}, 0x1c) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) close(0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x20000000) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000002ec0)={0x11, 0xc, &(0x7f0000002f80)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000080000008500000011000000850000005000000095"], &(0x7f0000003000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000003040)={r4}, 0xc) recvmmsg(r3, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000009c0)=""/138, 0x8a}, {&(0x7f0000000a80)=""/4078, 0xfee}, {&(0x7f0000001a80)=""/4096, 0x1000}, {&(0x7f0000002a80)=""/7, 0x7}, {&(0x7f0000002ac0)=""/55, 0x37}], 0x5}, 0x2}, {{0x0, 0x0, 0x0}, 0x3}], 0x2, 0x0, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'veth1_vlan\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000140), 0x4) sendmsg$kcm(r5, &(0x7f00000001c0)={&(0x7f0000000240)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000300)="27030200d1fd14000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) r8 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r8, &(0x7f0000002d40)={0x0, 0x0, &(0x7f0000002d80)=[{&(0x7f0000002dc0)="020b070102000000e4a17c455b3a89e0", 0x10}], 0x1}, 0x81) sendmsg$inet(r8, &(0x7f0000002e00)={0x0, 0x0, &(0x7f0000002e40)=[{&(0x7f0000002e80)="020a030002000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={0xffffffffffffffff, 0x0, 0x6, 0x0, &(0x7f00000003c0)="e0b9547e841f", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x4e1d, 0x9, @local, 0x2}, 0x1c) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000400)={0x0, 0x4, 0x2}) 1m47.346888424s ago: executing program 3 (id=4016): ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x1, 0x3, 0x4, 0x1000000000001}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x14, 0x1, 0x2, 0x101, 0x0, 0x0, {0x7, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x804) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x1d, 0x2, 0x6) recvfrom$packet(r2, 0x0, 0x0, 0x10122, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0x1, 0x2}, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_pauseparam={0x3d}}) 1m47.130398296s ago: executing program 3 (id=4018): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0xf, &(0x7f0000001180)=ANY=[@ANYBLOB="7a0af8ff000000007a0af0ff000000007a0ae8ff000000007a0ae0ff000000007a0ad8ff000000007a0ad0ff000000007a0ac8ff000000007a0ac0ff00000000bfa100000000000007010000d8ffffffbfa200000000000007020000c0ffffff85000000ce000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001300)={r0, 0xffff0000, 0xe, 0x0, &(0x7f00000012c0)="ddff00001a748296f3d62a7200d7", 0x0, 0x20f000, 0x720e, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0xf, &(0x7f0000001180)=ANY=[@ANYBLOB="7a0af8ff000000007a0af0ff000000007a0ae8ff000000007a0ae0ff000000007a0ad8ff000000007a0ad0ff000000007a0ac8ff000000007a0ac0ff00000000bfa100000000000007010000d8ffffffbfa200000000000007020000c0ffffff85000000ce000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001300)={r0, 0xffff0000, 0xe, 0x0, &(0x7f00000012c0)="ddff00001a748296f3d62a7200d7", 0x0, 0x20f000, 0x720e, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) 1m46.063209516s ago: executing program 3 (id=4019): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="4400000013000500fefffbff0000000000000000", @ANYRES32=0x0, @ANYBLOB="090000000000000000000300676501010d002476c483afd5fb639c478f0000000b12cc1a3bfe3bbffcdb650e5a1999191b96ad37ba009ba70f6015d21a48944715aaced0d5b30fce5174a20a7867c7edb8fa4ba474462d7d81b4f4397d9ac4d1b8534f5893fcd705a6a41b1b19ad7165b0bd0732f4c697fd2a4da6170934e97c7c1edbf8b56a9fbcf588112d3f4aaba18eed463bc283a1629cbe6a0c7a3da3600000000000000000547edd9fccab6cf52c572e8544c184207c80c3c2cacb2e5f9318be48508d7b0b0a8e29c3ae2fe0ee53b768bacb0daf1e28a80272b2254748d2056324474a71740cf3a6f6f3b38aece4e470f47c318761418ca507939ec6558a26f3b27a5d0bb6b0"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1m46.014732811s ago: executing program 0 (id=4020): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="04000000040000000400000010"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)='%+9llu \x00'}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001a40)={0xffffffffffffffff, 0x20, &(0x7f0000001a00)={&(0x7f00000000c0)=""/172, 0xac, 0x0, &(0x7f0000000a00)=""/4096, 0x1000}}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000867000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000500)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x2000000, 0x13, r5, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r6, 0x1000) ioctl$FS_IOC_RESVSP(r2, 0x40305829, &(0x7f00000005c0)={0x1100, 0x0, 0x52, 0x11000}) bpf$TOKEN_CREATE(0x24, &(0x7f00000002c0)={0x0, r0}, 0x8) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0xb, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x29}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @generic={0x6, 0x8, 0x6, 0xcfe8, 0x6}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x10}]}, &(0x7f00000009c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = openat$nci(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f0000000400)) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000200)={{r7}, &(0x7f0000000180), &(0x7f00000001c0)='%pS \x00'}, 0x20) 1m45.721276867s ago: executing program 3 (id=4022): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x40900, 0x0) close(r1) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xf0, 0x5, 0x0, 0x80000000, 0x6cb3, 0xd97, 0x26e, 0x4, 0x9}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x81}, 0x4000818) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000003c0)={'syzkaller0\x00', @multicast}) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000400)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r6, &(0x7f0000000640)="bad386ddc7180869ab2b83b48ae15386fe9a03", 0x13, 0x24004095, &(0x7f0000000680)={0x11, 0x88a8, r5, 0x1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xb}}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x3, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = epoll_create1(0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001d0001002abd7000fcfc2d00a6a25c15371d17046bdbdf250a000000", @ANYRES32=0x0, @ANYBLOB="0400800a0a000100aaaaaaaaaabb0000"], 0x28}, 0x1, 0x0, 0x0, 0x30}, 0x80c0) socket(0x40000000015, 0x5, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) pselect6(0x40, &(0x7f0000000940)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x4}, 0x0, &(0x7f0000000980)={0x3ff, 0xfffffffffffffffd, 0x0, 0x9, 0xfffffffffffffffc, 0x0, 0x7fffffff}, 0x0, 0x0) epoll_pwait(r7, &(0x7f00000009c0)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="08000000040000000400000007"], 0x48) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r9, &(0x7f0000000a40)={0x1}) socket(0x10, 0x3, 0x0) 1m45.580156981s ago: executing program 4 (id=4023): unshare(0x8040480) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000009c0)={'syzkaller0\x00', 0x7101}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f0000000bc0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0x40, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xf, 0x100], [0xfff1, 0x5, 0xffff, 0x3, 0x4, 0x8, 0x9, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$VFAT_IOCTL_READDIR_SHORT(r5, 0x82307202, &(0x7f0000000600)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x24, 0x29, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xffff}, {0xffff}, {0x2, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x40400dc}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01880000000000000000020000000900010073797a300000000064000000090a010400000000000000000200000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000040c0001800800014000000004500000000c0a01010000000000000000020000030900020073797a31000000000900010073797a30000000002400038020000080100001800c000100fff50000000000000c0004"], 0xfc}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xc, &(0x7f0000000840)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000072000000850000005000000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=@base={0x1, 0xd, 0x7, 0x8, 0x40}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000000a00), 0xce, r7}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000d80)={r7, &(0x7f0000000dc0), &(0x7f0000000e00)=""/201}, 0x20) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x5, &(0x7f00000001c0)=[{0x4d, 0x1, 0x3, 0x80000000}, {0x61, 0x4}, {0x45}, {0x2}, {0x6}]}) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000200)='vegas', 0x5) sendmsg$NL80211_CMD_ADD_TX_TS(r2, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000040)=ANY=[@ANYRES32=r6, @ANYRES32=r2, @ANYRES16=r0], 0x50}, 0x1, 0x0, 0x0, 0x40001}, 0x40400d8) getsockopt$inet_tcp_buf(r8, 0x6, 0x1a, 0x0, &(0x7f0000000240)) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000000)=0xffffffffffffffff) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xd, 0x12, 0xffffffffffffffff, 0x1f4d2000) 1m45.495435183s ago: executing program 0 (id=4024): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400100001000010028bd7000ffdbdf25ac1414aa00"/32, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc000000000000000000000000000000000000206c000000e0000001000000000000000000000000feffffffffffffff000000000000000000000000000000000100000000000008c802000000000100060000000000000000000000000004000000000000000000ffffffffff1f000008"], 0x140}, 0x1, 0x0, 0x0, 0x4075}, 0x4800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000001c0), 0x318, 0x0) recvmmsg(r0, &(0x7f0000000200), 0x10106, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r2) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@polexpire={0xd8, 0x1b, 0x1, 0x0, 0x0, {{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x72, 0x5}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}}, [@sec_ctx={0xc, 0x8, {0x6b}}, @mark={0xc, 0x15, {0x0, 0xfffffffd}}]}, 0xd8}}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r2, &(0x7f000000ed40)={0x0, 0x0, &(0x7f000000ed00)={&(0x7f000000ec80)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48410}, 0x4004040) 1m44.460586228s ago: executing program 2 (id=4025): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000100)) (async) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) r1 = socket$kcm(0x29, 0x5, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) (async) write$cgroup_pressure(r1, &(0x7f00000001c0)={'full'}, 0xfffffdef) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newlink={0x208, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b, 0x4e23}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_OKEY={0x8, 0x5, 0x9}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MAP={0x24, 0xe, {0x9, 0x80000000, 0x5, 0xfffa, 0x57, 0x9}}, @IFLA_VF_PORTS={0x120, 0x18, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0xf5}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "757fcd17899d9b607202526a3998fa9f"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "ce26579e6388a72e9965645e0562740f"}]}, {0x8c, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "448ef7e8e45bc98460e263d86c45cbfc"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "dfb568a3790ba992ecfaab36a318dd24"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "697e8cb1a08c7f78278c435938fe04c7"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "a914677b1d179b6034d3d1d90af2ffe0"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "464fd70dcc3dfb6ec10fe9c2e2ccfc33"}, @IFLA_PORT_PROFILE={0xe, 0x2, 'ip6erspan\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xb7}, @IFLA_PORT_PROFILE={0xb, 0x2, '(/{+@.\x00'}]}, {0x5c, 0x1, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "3f41c33e0e5c7bf3763b564feba09767"}, @IFLA_PORT_VF={0x8, 0x1, 0xffff1c7b}, @IFLA_PORT_PROFILE={0xe, 0x2, 'ip6erspan\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xe}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x5}, @IFLA_PORT_PROFILE={0x9, 0x2, '\xa8:]-\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xb6}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x1}]}]}, @IFLA_PORT_SELF={0x74, 0x19, 0x0, 0x1, [@IFLA_PORT_VF={0x8}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "3e4f2e25a48dfe601d66eba18ef3c840"}, @IFLA_PORT_VF={0x8, 0x1, 0x4}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x98}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "8709eadea266d48cb78ec6e49ea9ab70"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "923d25f7cf7df7e3b5761cddee3dbe37"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x33}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "c48541820d5dac27647138bbc59c75d0"}]}, @IFLA_BROADCAST={0xa}]}, 0x208}, 0x1, 0x0, 0x0, 0x800}, 0x40000) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="780000001000ffff25bd7000fbdadf2500000000", @ANYRES32=0x0, @ANYBLOB="137c0300231a0500580012800e00010069703667726574617002000044000280140007000000000000000000fffffffffffffffe060013004e230000060010004e230000050016000120ff0700000600ff01"], 0x78}, 0x1, 0x0, 0x0, 0x40000}, 0x24000490) (async, rerun: 32) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f00000004c0)={0x0, 0x6, 0x54ab}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f00000008c0)={{r0}, 0x0, 0x10, @unused=[0x7, 0xb, 0x6], @devid=r2}) 1m44.293632322s ago: executing program 1 (id=4026): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000240)={@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x20) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, @loopback, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2000000, 0x0, 0x7d, 0x200, 0xfffffffffffffffd, 0x9b0318}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000180)={@loopback, @ipv4={'\x00', '\xff\xff', @multicast1}, @loopback, 0x10000006, 0x0, 0x4, 0x100, 0x4000000010000009, 0x10200}) socket$packet(0x11, 0x2, 0x300) (async) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0x7, &(0x7f0000000280)=0x4000200, 0x4) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'gre0\x00', 0x0}) (async) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'gre0\x00', 0x0}) setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f0000000300)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffd8f}, 0x90) syz_emit_ethernet(0x36, &(0x7f0000001840)={@multicast, @random="e01b08d55e8f", @val={@void, {0x8100, 0x7, 0x1, 0x4}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0xfffc, 0x0, 0x40, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x17c1, 0x10, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}, "d482449a"}}}}}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000540)=ANY=[], &(0x7f0000000580)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={r4, 0x5, 0xb68, 0x0, &(0x7f0000000640)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x2, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b70000000c000000bca30000000000002403000020feffff620af8fff8ffffff71a4f8ff000000001f03000000000000e5000300000000002604fdffff02000014000000033800001d130000000000007a0af8ff0000001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb"], &(0x7f00000014c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xf8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001500), 0x8, 0x10, &(0x7f0000001540)={0x0, 0xfffffffe}, 0x10}, 0x24) bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x6, 0x5, &(0x7f0000001880)=ANY=[@ANYBLOB="1802000009000000000000000000000085000000410000008500000011000000950000000000000050b8e302db3f8a6992bba759527bbc39ef46d10b73fee8b48d0bbb8fd219442c9a7d3deed65ba902688fe38e580797416839e68807b8dca252972412168a4f"], &(0x7f0000001680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x6, 0x5, &(0x7f0000001880)=ANY=[@ANYBLOB="1802000009000000000000000000000085000000410000008500000011000000950000000000000050b8e302db3f8a6992bba759527bbc39ef46d10b73fee8b48d0bbb8fd219442c9a7d3deed65ba902688fe38e580797416839e68807b8dca252972412168a4f"], &(0x7f0000001680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000016c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000001740)="e1ff46bd3bf574b7c1f6f585862b", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000000080)={0x10, 0x0, 0x1}, 0xc) (async) bind$netlink(r6, &(0x7f0000000080)={0x10, 0x0, 0x1}, 0xc) write(r6, &(0x7f0000000540)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r6, &(0x7f0000001780)=@proc={0x10, 0x0, 0x1, 0x200}, 0xc) setsockopt$sock_int(r6, 0x1, 0x21, &(0x7f00000017c0)=0x10, 0x4) (async) setsockopt$sock_int(r6, 0x1, 0x21, &(0x7f00000017c0)=0x10, 0x4) write(r6, &(0x7f0000001800)='\"', 0x1) recvmmsg(r6, &(0x7f0000001840), 0x3ffffffffffff81, 0x2, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) setsockopt$inet6_mreq(r7, 0x29, 0x1c, &(0x7f0000000040)={@remote}, 0x14) 1m44.166371914s ago: executing program 0 (id=4027): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0xfffe}, 0xe) bind$bt_l2cap(r0, &(0x7f00000000c0)={0x1f, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x0, 0x2}, 0xe) 1m43.922226534s ago: executing program 0 (id=4028): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000090000040000000000000000000000000a20000000000a0102bfb101ddff01ece9010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d300000000050d389630000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014", @ANYRESOCT=r1], 0xfc}}, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e24, 0x1, @rand_addr=' \x01\x00', 0x8}}, 0x7fffffff, 0x6, 0x7ff, 0x7fff}, &(0x7f0000000400)=0x98) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000440)={r3, 0xc}, &(0x7f0000000480)=0x8) write$tun(r0, &(0x7f00000004c0)={@val, @void, @eth={@multicast, @multicast, @val={@val={0x88a8, 0x5, 0x1, 0x4}, {0x8100, 0x6, 0x0, 0x4}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x6, 0x1c, 0xe4, 0x0, 0x8, 0x11, 0x0, @loopback, @dev={0xac, 0x14, 0x14, 0x1f}}, "3eda35701bfb0bc2"}}}}}, 0xfffffffffffffc42) 1m43.32176733s ago: executing program 2 (id=4029): socket$kcm(0x29, 0x7, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x4076cbba9945d516, &(0x7f00000002c0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001e40)={&(0x7f0000000d40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xac, 0xac, 0x8, [@union={0xf, 0x6, 0x0, 0x5, 0x1, 0xe2b5, [{0x9, 0x2, 0x5}, {0x4, 0x5, 0x17000000}, {0xe, 0x5, 0x6}, {0x10, 0x5, 0xe6af}, {0x6, 0x5, 0x8001}, {0xe, 0x3, 0x80000000}]}, @enum64={0x2, 0x5, 0x0, 0x13, 0x0, 0xd, [{0x7, 0x77, 0xfb6}, {0x10, 0x8, 0x9}, {0xe, 0x4, 0x7}, {0x2, 0x1, 0x300}, {0xb, 0x80000001, 0x4}]}, @decl_tag={0xe, 0x0, 0x0, 0x11, 0x4, 0x3}]}, {0x0, [0x2e, 0xe, 0x61, 0x30, 0x7ebd12d8efd7e062, 0x5f]}}, &(0x7f0000000e40)=""/4096, 0xcc, 0x1000, 0x0, 0x9}, 0x28) write(r3, &(0x7f0000001e80)="42f0fd5ca687bd579450033d7c5ec0a5b374eb846e9b092bec0415eb8b11c06e09d57a3aaaf2fc4b1298992533ce821f825e2159af595ac195fd0a854059483f97ded1245bd5f1a453f305772500537ed539b3fab6be265bccd6b1ecbd82dae856ac6b35c36a444ac0583fc122de8c27c83653edf7d59a1538df72997fdd0acac30ff26cac01aa7a05bff98a8958febb04327968c12d811f8a5c095e03cffa2209c8e2efdfe98ba361dab619795918c39d075d3a88bc597965f3cd3b96eda20b5b1859", 0xc3) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x2, [@int={0x0, 0x0, 0x0, 0x1, 0x5, 0x24}, @func={0x8, 0x0, 0x0, 0xc, 0x5}]}}, 0x0, 0x36}, 0x28) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r2, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="700000001000010400000000ff00dbdf25000000", @ANYRES32=r2, @ANYBLOB="262d030035cd0100500012800e00010069703665727370616e0000003c00028005001600020000000400120014000700fc020000000000000000000000000000060010004e210000060011004e23000008000d0000000000"], 0x70}, 0x1, 0x0, 0x0, 0x4040014}, 0x200440d4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000700)=ANY=[@ANYBLOB="9c8b0000008500004eadc6b200a020000002000000039ca48fce1ab40d97b8ba44e97d85306649fa92d3f1804132ad9072d926a467d9127f0ed14cd89cc5a89fdcf9ffffffffffffffb54d84dd78962b104ac6275b8bbde95c06de7b1b7233afcb7a6e4e3f5e26033cc5d06a13e85ce31f77ae21cfc8596a89"], &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x53, &(0x7f0000000200)=""/83, 0x41100, 0x5, '\x00', r2, 0x25, r0, 0x8, &(0x7f0000000580)={0x0, 0x5}, 0x8, 0x10, &(0x7f00000005c0)={0x5, 0xb, 0x5, 0x8}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r0, r0, r0, r0, r0], 0x0, 0x10, 0x3}, 0x94) write$tun(r0, &(0x7f0000000000)=ANY=[], 0x38) ioctl$NILFS_IOCTL_CLEAN_SEGMENTS(r0, 0x40786e88, &(0x7f0000000ac0)={{&(0x7f0000000880)=[{0xb75f, 0x4, 0x2, {0x3}, 0x3, 0x14000000000000}, {0x0, 0xfffffffffffffffe, 0x7f, {0x101, 0xfffffffffffffffd}, 0x4, 0x1ff, 0xff}, {0xf, 0x5, 0xd, {0x9, 0xffffffffffffffff}, 0x5, 0x5, 0xfffffff9}], 0x3, 0x40, 0x5, 0x9}, {&(0x7f0000000940)=[{0x5, 0xc0000000000}, {0x1, 0x7}], 0x2, 0x10, 0x4}, {&(0x7f0000000980)=[0xffffffffffffffb6, 0xfffffffffffffffe, 0x5, 0x3f], 0x4, 0x8, 0x7, 0x2}, {&(0x7f00000009c0)=[{0x3ff, 0x80, 0x3ff, 0xfffffffffffffffe, 0x7}, {0xffff, 0x6, 0x35bd, 0x7f3c, 0x3}], 0x2, 0x28, 0x1, 0x5}, {&(0x7f0000000a40)=[0x3, 0x6a2, 0x8000, 0x2, 0x3, 0x2d4, 0xffff, 0x2, 0x14], 0x9, 0x8, 0x3, 0xe}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000c80)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) getsockname$packet(r5, &(0x7f0000000cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000d00)=0x14) socket(0x1d, 0x2, 0x6) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000c80), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000001f80)) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000001fc0)={0x18, 0x0, {0x3, @remote, 'ip6_vti0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r7, 0x80047437, &(0x7f0000002000)) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) ioctl(r8, 0x40047438, &(0x7f0000002080)) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000020c0)={'hsr0\x00', 0x0}) sendto$packet(r9, &(0x7f0000002100)="ce91bda883e815ca8263224318d2", 0xe, 0x4, &(0x7f0000002140)={0x11, 0x0, r10, 0x1, 0x4, 0x6, @multicast}, 0x14) 1m43.112256285s ago: executing program 1 (id=4030): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000023c0)=@newlink={0x38, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x1}, [@IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x10000}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x877e}]}, 0x38}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000) 1m42.308685747s ago: executing program 4 (id=4031): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x80, 0x2, 0x80, 0x1, 0x0, 0x0, 0x0, 0x2, 0x5, 0x9, 0x0, 0x9, 0x8, 0x22}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x10, &(0x7f0000000440)=[@in={0x2, 0x4e22, @local}]}, &(0x7f0000000480)=0x10) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000004c0)={r1}, &(0x7f0000000500)=0x8) unshare(0x20000400) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000540), r3) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x44, r4, 0x1, 0x70bd2c, 0x25dfdc03, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @loopback}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0200000004000400"/20, @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="0100000003"], 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2000000004000000080000000000000001"], 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000400)={r5, &(0x7f0000000440), 0x0, 0x4}, 0x20) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000080)=@base={0x12, 0x1, 0x8, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x15, 0xc, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000280)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41000}, 0x94) 1m42.01438666s ago: executing program 4 (id=4032): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0200"], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r1, 0x58, &(0x7f0000000200)}, 0x55) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x14, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000002e0000001e000000000000005c000000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b}, 0x94) 1m41.330364102s ago: executing program 4 (id=4033): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r0, 0x0, 0xea, 0x0, &(0x7f0000000000)={0x23, 0x1, 0x8}, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000001240)=[{&(0x7f0000001280)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 1m41.00457934s ago: executing program 1 (id=4034): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) (async) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) bind(r2, &(0x7f0000000100)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) (async) bind(r2, &(0x7f0000000100)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c"], 0x4a) (async) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c"], 0x4a) 1m40.954452833s ago: executing program 2 (id=4035): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="09000000060000000800000008"], 0x48) unshare(0x22020400) (async) unshare(0x22020400) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="5c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00200400020000003c0012800b00010067656e65766500002c00028014001200fc01000000000000000000000000000014000700000000000000000098"], 0x5c}, 0x1, 0x0, 0x0, 0x40680c5}, 0x40) 1m40.95396681s ago: executing program 4 (id=4036): ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(0xffffffffffffffff, 0x40109441, &(0x7f0000000080)={0x7, 0x2, 0x1ff}) r0 = socket(0x400000000010, 0x3, 0x0) write(r0, &(0x7f0000000000)="3a03000019002551075c0165ff0ffc02802000030011000500e1000c0400070080000f00", 0x33a) recvmmsg$unix(r0, &(0x7f0000001f80)=[{{&(0x7f00000000c0), 0x6e, &(0x7f0000000480)=[{&(0x7f0000000140)=""/73, 0x49}, {&(0x7f00000001c0)=""/62, 0x3e}, {&(0x7f0000002180)=""/235, 0xeb}, {&(0x7f0000000d80)=""/133, 0x85}, {&(0x7f0000000380)=""/238, 0xee}], 0x5, &(0x7f0000000500)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb0}}, {{&(0x7f00000005c0), 0x6e, &(0x7f0000000ac0)=[{&(0x7f0000000640)=""/236, 0xec}, {&(0x7f0000000740)=""/99, 0x63}, {&(0x7f00000007c0)=""/183, 0xb7}, {&(0x7f0000000880)=""/167, 0xa7}, {&(0x7f0000000940)=""/148, 0x94}, {&(0x7f0000000a00)=""/158, 0x9e}], 0x6, &(0x7f0000000b40)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000000bc0)=""/143, 0x8f}, {&(0x7f0000000c80)=""/244, 0xf4}, {&(0x7f0000002080)=""/216, 0xd8}, {&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f0000001e80)=""/47, 0x2f}], 0x5, &(0x7f0000001f40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x30}}], 0x3, 0x40000000, &(0x7f0000002040)={0x77359400}) r1 = socket$inet6(0xa, 0x80000, 0x101) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)={0x5e, 0x1, '\x00', [@ra={0x5, 0x2, 0x8}, @ra={0x5, 0x2, 0x6}]}, 0x10) 1m40.714688782s ago: executing program 2 (id=4037): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x81040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) syz_emit_ethernet(0x0, 0x0, 0x0) (async) close(0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@newqdisc={0x54, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1e, 0x2}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x24, 0x2, [@TCA_FQ_PIE_ALPHA={0x8, 0x5, 0x1c}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x8bb9}, @TCA_FQ_PIE_BETA={0x8, 0x6, 0x18}, @TCA_FQ_PIE_ALPHA={0x8, 0x5, 0x1d}]}}]}, 0x54}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=@newtclass={0x24, 0x29, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x1, 0xfff1}, {0xfff2, 0xfff1}}}, 0x24}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) (async) socket(0x28, 0x5, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xfe82}, 0x1, 0x0, 0x0, 0x40080}, 0xc0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r8], 0x90}}, 0x0) (async) r9 = socket(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f0000000840), 0x400000000000235, 0x0) (async) socket$rds(0x15, 0x5, 0x0) (async) syz_emit_ethernet(0xca, &(0x7f0000000440)=ANY=[@ANYBLOB="0000000000000180c200000208050220a9b5803b0d86490c0e264113198a76a24f8f9890628e2d05c8637af675d6b510bc1692a48317cf1d0af0def35c2faa00e9a3861b0d8d1bc813bc1f84216905414226b673054c3f3c35d6b2c50bb7e322b8b5839968b33c99f9390ba429fec79c4fb01e4a7370238ed6b783ebbf057a892120be7467ce0bf50ef7177ab2a6bfd835491758d2e4bb98340f5fce0401"], 0x0) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x80, 0x0) close(r10) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="1b000000000000000000000000800000280553570dddd5ae5f83388b3483ec14852f6e77f2a25dce82", @ANYBLOB="217eb31e429bbf6f2f5ce557dfb817f6b7d243179064cfc20126a12e8191bfdab98221a06fcecd26bcb110dc02aa5d605ba528f7c04e64df6380409526d1175f1830d8bee11f8fff931eeea9a10f7ea1", @ANYBLOB="fcff00"/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000400"/28], 0x50) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) (async) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000640)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r11, 0x40086602, &(0x7f0000000680)=0x20) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000006c0)='cgroup.controllers\x00', 0xb00000000065808, 0x0) 1m39.974207836s ago: executing program 4 (id=4038): syz_emit_ethernet(0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000086dd606ff1af000c2f00fce7662f3ccab9000000000000000000000000000000ff0100000000000000000000000000010000883e000c"], 0x0) r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000340)=[{{&(0x7f0000000380)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000400)="8dbe9de29a1823474186f72aea11678235a71ee4828c75d76df69110ae2b2baa4ca3f238a147af68c7999e831fc3594436dea27d", 0x34}], 0x18, &(0x7f0000000440)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}], 0x20}}], 0x1, 0x20044000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_GET(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0xd0, r2, 0x200, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x5c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "a12454d65cdfe5fbc7eef1aeef37e9621b26736ac24e06901f38000cb809b6110bdfc20b"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_LINK={0x60, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffeffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}]}, 0xd0}, 0x1, 0x0, 0x0, 0x10}, 0x40000) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00'}, 0x80) syz_emit_ethernet(0xbe, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaabb0800450000b00000000000119078000000000009000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14e"], 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000005c0)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000680)={'syzkaller1\x00', @random="2b0436d23321"}) write$tun(r4, &(0x7f00000006c0)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008003c00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x739, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) ioctl$sock_inet_sctp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000080)) 1m39.833861044s ago: executing program 0 (id=4039): r0 = socket$inet(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x5, 0xc48, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000640], 0x0, 0x0, &(0x7f0000000640)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{0x11, 0x0, 0xaa2b970d70a9fe00, 'veth0_virt_wifi\x00', 'wg0\x00', 'dvmrp1\x00', 'lo\x00', @broadcast, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0xff, 0x0, 0xff], 0x0, 0x8b8, 0x8b8, 0x8e8, [@among={{'among\x00', 0x0, 0x820}, {{@zero=0x414, @zero=0x600, 0x1, {[0x35, 0xebc4, 0x80000001, 0x6, 0x6, 0x6, 0x1, 0x9, 0x6, 0x7, 0x0, 0x3, 0x3ff, 0x4, 0x85, 0xc, 0xfff, 0x1, 0x1, 0x4, 0x5, 0x7, 0xffffff70, 0x404, 0x4ca0, 0x7f, 0x78, 0x0, 0x4, 0xc, 0xa, 0x81, 0x1, 0x22d, 0x8001, 0x3000, 0x0, 0xee, 0x0, 0x227, 0x80, 0x9, 0x7, 0xb, 0x80, 0x9, 0x59cb, 0x9, 0xae, 0xa, 0x3ff, 0x4, 0x8, 0x9, 0x5, 0x0, 0x3, 0x9, 0x100, 0x4, 0x1, 0xffff, 0x65, 0xfd, 0x2, 0x8, 0xffffffff, 0x80000001, 0x8, 0x6, 0x6, 0x4b1a, 0x1, 0x6, 0x6, 0xb, 0x80, 0xfffffff7, 0x4, 0x1, 0x10001, 0x7, 0x10001, 0xc, 0x2, 0x8, 0x4, 0x7, 0x7c, 0x6, 0xe4, 0x7f, 0x70, 0x3f4, 0xf, 0xb, 0x6, 0x401, 0x9, 0x3, 0x3, 0x7, 0xfffffffe, 0x7, 0xfffffffc, 0xc34a, 0x0, 0x4, 0x1, 0xbc0, 0x9, 0x1, 0x80000000, 0xf6d0, 0xe8, 0xffff, 0x80000000, 0x8, 0xa02f, 0x3, 0x1, 0x1, 0x5, 0x6, 0x200, 0x9, 0xff, 0x4, 0x3, 0x7, 0x0, 0xd, 0x5, 0xafa, 0x6, 0xfffffff9, 0xf39f, 0x7, 0x401, 0xa2, 0x3d, 0xfffffea0, 0x29, 0x4, 0xc, 0x3, 0x6, 0x4, 0xce0, 0x0, 0xfffffc00, 0x2ec3, 0xce, 0x2, 0x0, 0x2, 0x7, 0xffffffff, 0x5, 0x1200, 0x925, 0xfffffff7, 0x6084b885, 0x40, 0x6, 0x7d62, 0xff, 0x4, 0x9, 0x4, 0x8, 0x5, 0x3, 0x9ae, 0x8, 0x5, 0x400, 0x4, 0x5a46, 0x9, 0x3, 0xfffffffd, 0xffffffff, 0x45d, 0x9, 0x3, 0xfffffffc, 0x58, 0x1, 0x2, 0x1, 0x8f, 0x2, 0x55, 0xd9a5, 0x6, 0x3, 0x0, 0x401, 0x0, 0x9, 0x6, 0xff8, 0x2, 0x9919, 0x5, 0x8000, 0x7, 0x80000000, 0x1, 0x9, 0x28, 0xb362, 0x5, 0x3, 0xa, 0x400, 0x10, 0x6, 0x0, 0xffff8108, 0x5, 0x9, 0x9, 0x5, 0xb1ae, 0x2, 0xff, 0x0, 0x2, 0x8, 0x4, 0x3, 0x80, 0x2d1873d, 0x4, 0x80000000, 0x4, 0xf, 0x0, 0x4, 0x95, 0xb, 0x9, 0x101, 0x2e, 0x0, 0x800, 0x9, 0x7e17, 0xa0c, 0x7, 0x6, 0xfffffffc, 0x40, 0x0, 0x8]}, {[0x7, 0x4, 0x9, 0x10000, 0x6, 0x6, 0x1, 0x2, 0x8, 0x7fff, 0x3, 0x7, 0x5, 0x7, 0x4, 0xe, 0x63c, 0x80000000, 0x40, 0x3, 0x7, 0x400, 0xfa, 0x4, 0x4, 0x4, 0x600, 0x3, 0x5, 0xe55e, 0x7ff, 0x80000001, 0x2, 0x4, 0x40, 0x9, 0xa, 0x2, 0xb3, 0x8d, 0x0, 0x3, 0x2, 0x1, 0x8, 0x7, 0x1f0, 0xb, 0xc, 0x3, 0x6, 0x9, 0x64d, 0xdb8c, 0x1, 0x6, 0xd, 0xf44c, 0x6, 0x7f, 0x3, 0x3, 0x9, 0xb, 0x2, 0x0, 0x1000, 0xcf, 0x5, 0x101, 0x8, 0x0, 0x5, 0x5, 0x3, 0x0, 0xb, 0xe8, 0x6, 0x3, 0x7, 0xb, 0xfffffff8, 0xcf78, 0x45, 0x8ec, 0x0, 0x200, 0x8, 0x7, 0x6, 0x8, 0x6, 0x2, 0x3, 0x7, 0xffff, 0x7, 0xe, 0x7f, 0x10001, 0x7b18, 0x7, 0x4, 0x7c, 0x0, 0x83, 0x5, 0xffffffff, 0x4, 0x1, 0x0, 0xa, 0x4, 0x10000, 0x4, 0x3, 0x1, 0x9acd, 0x800, 0x2bdc, 0x8, 0x80000000, 0x3, 0x56, 0x2a, 0x2, 0x3, 0x6, 0x200, 0xf, 0xfa, 0x1, 0x80000000, 0x101, 0x5, 0x8, 0x8000, 0x6, 0x8, 0xd, 0xc, 0x0, 0x6, 0x2, 0x1, 0x4, 0x9, 0x1, 0xffff, 0xa0000, 0x7fff, 0x6, 0xffff3b77, 0xd, 0xaf16, 0xfffffffa, 0xfffffff9, 0x6, 0x8, 0xc, 0x0, 0xc, 0x51, 0xc, 0xd, 0xc, 0x7, 0x561, 0xffffe9ce, 0xfffff000, 0x80000001, 0x1, 0x1, 0x8, 0x1, 0x0, 0x8, 0x9, 0x401, 0x1, 0x3fe28645, 0xffff7fff, 0x904b2ae9, 0xf, 0x8000, 0x1, 0xe905, 0x9, 0x3ff, 0x1, 0x10001, 0x10001, 0x80000000, 0xffff3723, 0x5, 0xdc, 0x7, 0x3, 0x81, 0x800, 0x8, 0x2, 0xfffffffd, 0x5, 0x8c, 0x80000001, 0x400, 0x5, 0xf23, 0x2, 0x8, 0xffffff61, 0x5, 0xdd9, 0x7fffffff, 0x1ff, 0x0, 0x4, 0x80000000, 0x8, 0xfff, 0x7, 0x81, 0x6, 0xfffffbff, 0x5, 0x3, 0x7, 0x2, 0x3, 0xfffffffa, 0x0, 0x9, 0x1, 0xfffffff3, 0x9, 0x7, 0x8, 0xf, 0x4a57, 0x2, 0x80000001, 0x80, 0x80000000, 0x401, 0xfffffffe, 0x9, 0x6, 0x3, 0x4, 0xd, 0x5, 0x8, 0x5, 0x7, 0x9]}}}}], [], @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x9}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x2, [{0x3, 0x0, 0x200, 'ip6erspan0\x00', 'bridge0\x00', 'veth1\x00', 'vxcan1\x00', @remote, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa8, [], [], @common=@dnat={'dnat\x00', 0x10, {{@empty, 0xffffffffffffffff}}}}, {0x3, 0x31, 0x18, 'batadv0\x00', 'macvlan1\x00', 'pim6reg0\x00', 'veth0_to_bridge\x00', @remote, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @local, [0xff, 0xff, 0xff, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffe}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x2, [{0x11, 0x0, 0x9100, 'team_slave_0\x00', 'veth0_to_bond\x00', 'ip6tnl0\x00', 'syzkaller1\x00', @remote, [0xff, 0xff, 0xff, 0xff], @broadcast, [0xff, 0x1fe, 0x0, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xb8, [], [], @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x8, 0x1, {0xdf9}}}}}, {0x3, 0x5, 0x8914, 'netdevsim0\x00', 'veth1_to_bond\x00', 'gre0\x00', 'veth0_to_bond\x00', @local, [0x0, 0xff, 0x0, 0x0, 0x0, 0xff], @broadcast, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0xffff0000}}}}]}]}, 0xcc0) 1m39.831110529s ago: executing program 3 (id=4040): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f000000015000000000000000000000061656769733132382d67656e65726963"], 0xe0}}, 0x0) sendmsg$nl_crypto(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="e8000000110001"], 0xe8}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f00000006c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="01000000000000000000490000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008007300000000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030002000000"], 0x64}}, 0x0) bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000240)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'ip6erspan0\x00', 0x2000}) (async) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'ip6erspan0\x00', 0x2000}) socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{}, &(0x7f00000004c0), &(0x7f0000000580)='%+9llu \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000580)='%+9llu \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000640)={r6, &(0x7f0000000600)="6754c0ad231fccd6cf"}, 0x20) (async) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000640)={r6, &(0x7f0000000600)="6754c0ad231fccd6cf"}, 0x20) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) connect$netlink(r5, &(0x7f0000000800)=@kern={0x10, 0x0, 0x0, 0x4000}, 0xc) sendmsg$netlink(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="1400000013000104000000000000000002"], 0x14}], 0x1}, 0x20000000) (async) sendmsg$netlink(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="1400000013000104000000000000000002"], 0x14}], 0x1}, 0x20000000) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, 0x1403, 0x4, 0x70bd29, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'team_slave_0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48001}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000120021030000000000bc61682a00968008001d001d"], 0x1c}], 0x1}, 0x0) sendto$inet(r2, &(0x7f0000000440), 0xffffffffffffff94, 0x34, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000500)='bbr', 0x3) socket$packet(0x11, 0x3, 0x300) (async) r9 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000840)={'bond0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000840)={'bond0\x00', 0x0}) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="20000000000200001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r10, @ANYBLOB='\b\x00C'], 0x4c}}, 0x0) 0s ago: executing program 32 (id=4039): r0 = socket$inet(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x5, 0xc48, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000640], 0x0, 0x0, &(0x7f0000000640)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{0x11, 0x0, 0xaa2b970d70a9fe00, 'veth0_virt_wifi\x00', 'wg0\x00', 'dvmrp1\x00', 'lo\x00', @broadcast, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @empty, [0xff, 0xff, 0xff, 0x0, 0xff], 0x0, 0x8b8, 0x8b8, 0x8e8, [@among={{'among\x00', 0x0, 0x820}, {{@zero=0x414, @zero=0x600, 0x1, {[0x35, 0xebc4, 0x80000001, 0x6, 0x6, 0x6, 0x1, 0x9, 0x6, 0x7, 0x0, 0x3, 0x3ff, 0x4, 0x85, 0xc, 0xfff, 0x1, 0x1, 0x4, 0x5, 0x7, 0xffffff70, 0x404, 0x4ca0, 0x7f, 0x78, 0x0, 0x4, 0xc, 0xa, 0x81, 0x1, 0x22d, 0x8001, 0x3000, 0x0, 0xee, 0x0, 0x227, 0x80, 0x9, 0x7, 0xb, 0x80, 0x9, 0x59cb, 0x9, 0xae, 0xa, 0x3ff, 0x4, 0x8, 0x9, 0x5, 0x0, 0x3, 0x9, 0x100, 0x4, 0x1, 0xffff, 0x65, 0xfd, 0x2, 0x8, 0xffffffff, 0x80000001, 0x8, 0x6, 0x6, 0x4b1a, 0x1, 0x6, 0x6, 0xb, 0x80, 0xfffffff7, 0x4, 0x1, 0x10001, 0x7, 0x10001, 0xc, 0x2, 0x8, 0x4, 0x7, 0x7c, 0x6, 0xe4, 0x7f, 0x70, 0x3f4, 0xf, 0xb, 0x6, 0x401, 0x9, 0x3, 0x3, 0x7, 0xfffffffe, 0x7, 0xfffffffc, 0xc34a, 0x0, 0x4, 0x1, 0xbc0, 0x9, 0x1, 0x80000000, 0xf6d0, 0xe8, 0xffff, 0x80000000, 0x8, 0xa02f, 0x3, 0x1, 0x1, 0x5, 0x6, 0x200, 0x9, 0xff, 0x4, 0x3, 0x7, 0x0, 0xd, 0x5, 0xafa, 0x6, 0xfffffff9, 0xf39f, 0x7, 0x401, 0xa2, 0x3d, 0xfffffea0, 0x29, 0x4, 0xc, 0x3, 0x6, 0x4, 0xce0, 0x0, 0xfffffc00, 0x2ec3, 0xce, 0x2, 0x0, 0x2, 0x7, 0xffffffff, 0x5, 0x1200, 0x925, 0xfffffff7, 0x6084b885, 0x40, 0x6, 0x7d62, 0xff, 0x4, 0x9, 0x4, 0x8, 0x5, 0x3, 0x9ae, 0x8, 0x5, 0x400, 0x4, 0x5a46, 0x9, 0x3, 0xfffffffd, 0xffffffff, 0x45d, 0x9, 0x3, 0xfffffffc, 0x58, 0x1, 0x2, 0x1, 0x8f, 0x2, 0x55, 0xd9a5, 0x6, 0x3, 0x0, 0x401, 0x0, 0x9, 0x6, 0xff8, 0x2, 0x9919, 0x5, 0x8000, 0x7, 0x80000000, 0x1, 0x9, 0x28, 0xb362, 0x5, 0x3, 0xa, 0x400, 0x10, 0x6, 0x0, 0xffff8108, 0x5, 0x9, 0x9, 0x5, 0xb1ae, 0x2, 0xff, 0x0, 0x2, 0x8, 0x4, 0x3, 0x80, 0x2d1873d, 0x4, 0x80000000, 0x4, 0xf, 0x0, 0x4, 0x95, 0xb, 0x9, 0x101, 0x2e, 0x0, 0x800, 0x9, 0x7e17, 0xa0c, 0x7, 0x6, 0xfffffffc, 0x40, 0x0, 0x8]}, {[0x7, 0x4, 0x9, 0x10000, 0x6, 0x6, 0x1, 0x2, 0x8, 0x7fff, 0x3, 0x7, 0x5, 0x7, 0x4, 0xe, 0x63c, 0x80000000, 0x40, 0x3, 0x7, 0x400, 0xfa, 0x4, 0x4, 0x4, 0x600, 0x3, 0x5, 0xe55e, 0x7ff, 0x80000001, 0x2, 0x4, 0x40, 0x9, 0xa, 0x2, 0xb3, 0x8d, 0x0, 0x3, 0x2, 0x1, 0x8, 0x7, 0x1f0, 0xb, 0xc, 0x3, 0x6, 0x9, 0x64d, 0xdb8c, 0x1, 0x6, 0xd, 0xf44c, 0x6, 0x7f, 0x3, 0x3, 0x9, 0xb, 0x2, 0x0, 0x1000, 0xcf, 0x5, 0x101, 0x8, 0x0, 0x5, 0x5, 0x3, 0x0, 0xb, 0xe8, 0x6, 0x3, 0x7, 0xb, 0xfffffff8, 0xcf78, 0x45, 0x8ec, 0x0, 0x200, 0x8, 0x7, 0x6, 0x8, 0x6, 0x2, 0x3, 0x7, 0xffff, 0x7, 0xe, 0x7f, 0x10001, 0x7b18, 0x7, 0x4, 0x7c, 0x0, 0x83, 0x5, 0xffffffff, 0x4, 0x1, 0x0, 0xa, 0x4, 0x10000, 0x4, 0x3, 0x1, 0x9acd, 0x800, 0x2bdc, 0x8, 0x80000000, 0x3, 0x56, 0x2a, 0x2, 0x3, 0x6, 0x200, 0xf, 0xfa, 0x1, 0x80000000, 0x101, 0x5, 0x8, 0x8000, 0x6, 0x8, 0xd, 0xc, 0x0, 0x6, 0x2, 0x1, 0x4, 0x9, 0x1, 0xffff, 0xa0000, 0x7fff, 0x6, 0xffff3b77, 0xd, 0xaf16, 0xfffffffa, 0xfffffff9, 0x6, 0x8, 0xc, 0x0, 0xc, 0x51, 0xc, 0xd, 0xc, 0x7, 0x561, 0xffffe9ce, 0xfffff000, 0x80000001, 0x1, 0x1, 0x8, 0x1, 0x0, 0x8, 0x9, 0x401, 0x1, 0x3fe28645, 0xffff7fff, 0x904b2ae9, 0xf, 0x8000, 0x1, 0xe905, 0x9, 0x3ff, 0x1, 0x10001, 0x10001, 0x80000000, 0xffff3723, 0x5, 0xdc, 0x7, 0x3, 0x81, 0x800, 0x8, 0x2, 0xfffffffd, 0x5, 0x8c, 0x80000001, 0x400, 0x5, 0xf23, 0x2, 0x8, 0xffffff61, 0x5, 0xdd9, 0x7fffffff, 0x1ff, 0x0, 0x4, 0x80000000, 0x8, 0xfff, 0x7, 0x81, 0x6, 0xfffffbff, 0x5, 0x3, 0x7, 0x2, 0x3, 0xfffffffa, 0x0, 0x9, 0x1, 0xfffffff3, 0x9, 0x7, 0x8, 0xf, 0x4a57, 0x2, 0x80000001, 0x80, 0x80000000, 0x401, 0xfffffffe, 0x9, 0x6, 0x3, 0x4, 0xd, 0x5, 0x8, 0x5, 0x7, 0x9]}}}}], [], @common=@NFQUEUE0={'NFQUEUE\x00', 0x8, {{0x9}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffc, 0x2, [{0x3, 0x0, 0x200, 'ip6erspan0\x00', 'bridge0\x00', 'veth1\x00', 'vxcan1\x00', @remote, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], @multicast, [0x0, 0x0, 0x0, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa8, [], [], @common=@dnat={'dnat\x00', 0x10, {{@empty, 0xffffffffffffffff}}}}, {0x3, 0x31, 0x18, 'batadv0\x00', 'macvlan1\x00', 'pim6reg0\x00', 'veth0_to_bridge\x00', @remote, [0x0, 0xff, 0x0, 0x0, 0xff, 0xff], @local, [0xff, 0xff, 0xff, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffe}}}]}, {0x0, '\x00', 0x3, 0xffffffffffffffff, 0x2, [{0x11, 0x0, 0x9100, 'team_slave_0\x00', 'veth0_to_bond\x00', 'ip6tnl0\x00', 'syzkaller1\x00', @remote, [0xff, 0xff, 0xff, 0xff], @broadcast, [0xff, 0x1fe, 0x0, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xb8, [], [], @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x8, 0x1, {0xdf9}}}}}, {0x3, 0x5, 0x8914, 'netdevsim0\x00', 'veth1_to_bond\x00', 'gre0\x00', 'veth0_to_bond\x00', @local, [0x0, 0xff, 0x0, 0x0, 0x0, 0xff], @broadcast, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0xffff0000}}}}]}]}, 0xcc0) kernel console output (not intermixed with test programs): TU to 1532 would solve the problem. [ 647.751712][T19049] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 647.753811][T19049] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 647.753828][T19049] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 647.753856][T19049] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 647.895039][T19049] hsr_slave_0: entered promiscuous mode [ 647.902199][T19049] hsr_slave_1: entered promiscuous mode [ 647.903069][T19049] debugfs: 'hsr0' already exists in 'hsr' [ 647.903106][T19049] Cannot create hsr debugfs directory [ 648.198569][T19244] FAULT_INJECTION: forcing a failure. [ 648.198569][T19244] name failslab, interval 1, probability 0, space 0, times 1 [ 648.198621][T19244] CPU: 1 UID: 0 PID: 19244 Comm: syz.3.3142 Not tainted syzkaller #0 PREEMPT(full) [ 648.198647][T19244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 648.198663][T19244] Call Trace: [ 648.198672][T19244] [ 648.198683][T19244] dump_stack_lvl+0xe8/0x150 [ 648.198725][T19244] should_fail_ex+0x410/0x560 [ 648.198767][T19244] should_failslab+0xa8/0x100 [ 648.198805][T19244] __kmalloc_cache_noprof+0x9e/0x600 [ 648.198837][T19244] ? bpf_diag_init+0x87/0x140 [ 648.198868][T19244] ? bpf_diag_init+0x87/0x140 [ 648.198907][T19244] bpf_diag_init+0x87/0x140 [ 648.198946][T19244] bpf_check+0x5dc/0x2ef0 [ 648.198995][T19244] ? __pfx_bpf_check+0x10/0x10 [ 648.199027][T19244] ? bpf_obj_name_cpy+0x194/0x1e0 [ 648.199053][T19244] bpf_prog_load+0x14d1/0x1c20 [ 648.199098][T19244] ? __pfx_bpf_prog_load+0x10/0x10 [ 648.199159][T19244] __sys_bpf+0xd0d/0xd90 [ 648.199200][T19244] ? __pfx___sys_bpf+0x10/0x10 [ 648.199243][T19244] ? __fget_files+0x2a/0x420 [ 648.199289][T19244] ? ksys_write+0x242/0x270 [ 648.199320][T19244] ? __pfx_ksys_write+0x10/0x10 [ 648.199353][T19244] __x64_sys_bpf+0xba/0xd0 [ 648.199385][T19244] do_syscall_64+0x166/0x520 [ 648.199408][T19244] ? trace_irq_disable+0x3b/0x140 [ 648.199435][T19244] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.199458][T19244] ? clear_bhb_loop+0x70/0xc0 [ 648.199487][T19244] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.199509][T19244] RIP: 0033:0x7ff58f59f559 [ 648.199531][T19244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 648.199551][T19244] RSP: 002b:00007ff5903b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 648.199576][T19244] RAX: ffffffffffffffda RBX: 00007ff58f825fa0 RCX: 00007ff58f59f559 [ 648.199600][T19244] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 648.199615][T19244] RBP: 00007ff5903b4090 R08: 0000000000000000 R09: 0000000000000000 [ 648.199630][T19244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 648.199643][T19244] R13: 00007ff58f826038 R14: 00007ff58f825fa0 R15: 00007ffcea538988 [ 648.199681][T19244] [ 648.827644][ T54] Bluetooth: hci0: command tx timeout [ 648.831429][T19260] can: request_module (can-proto-0) failed. [ 649.171441][T19277] ip_tables: iptables: counters copy to user failed while replacing table [ 649.174083][T19278] ip_tables: iptables: counters copy to user failed while replacing table [ 649.175029][T19277] xt_TCPMSS: Only works on TCP SYN packets [ 649.519826][T19049] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 649.773840][T19288] FAULT_INJECTION: forcing a failure. [ 649.773840][T19288] name failslab, interval 1, probability 0, space 0, times 0 [ 649.773925][T19288] CPU: 0 UID: 0 PID: 19288 Comm: syz.1.3153 Not tainted syzkaller #0 PREEMPT(full) [ 649.773952][T19288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 649.773967][T19288] Call Trace: [ 649.773976][T19288] [ 649.773987][T19288] dump_stack_lvl+0xe8/0x150 [ 649.774031][T19288] should_fail_ex+0x410/0x560 [ 649.774073][T19288] should_failslab+0xa8/0x100 [ 649.774112][T19288] __kmalloc_cache_node_noprof+0xa5/0x620 [ 649.774143][T19288] ? kasan_save_track+0x4f/0x80 [ 649.774171][T19288] ? kasan_save_track+0x3e/0x80 [ 649.774199][T19288] ? __kasan_kmalloc+0x93/0xb0 [ 649.774227][T19288] ? __get_vm_area_node+0x155/0x2f0 [ 649.774250][T19288] ? __get_vm_area_node+0x155/0x2f0 [ 649.774275][T19288] ? __x64_sys_bpf+0xba/0xd0 [ 649.774307][T19288] __get_vm_area_node+0x155/0x2f0 [ 649.774343][T19288] __vmalloc_node_range_noprof+0x343/0x1540 [ 649.774372][T19288] ? bpf_check+0x115b/0x2ef0 [ 649.774441][T19288] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 649.774469][T19288] ? __kasan_kmalloc+0x93/0xb0 [ 649.774501][T19288] ? __kmalloc_cache_noprof+0x31c/0x600 [ 649.774531][T19288] ? __kmalloc_cache_noprof+0x148/0x600 [ 649.774558][T19288] ? bpf_diag_init+0x87/0x140 [ 649.774590][T19288] ? bpf_diag_init+0x87/0x140 [ 649.774624][T19288] ? bpf_check+0x115b/0x2ef0 [ 649.774650][T19288] __vmalloc_noprof+0xd2/0x120 [ 649.774676][T19288] ? bpf_check+0x115b/0x2ef0 [ 649.774708][T19288] bpf_check+0x115b/0x2ef0 [ 649.774759][T19288] ? __pfx_bpf_check+0x10/0x10 [ 649.774791][T19288] ? bpf_obj_name_cpy+0x194/0x1e0 [ 649.774820][T19288] bpf_prog_load+0x14d1/0x1c20 [ 649.774865][T19288] ? __pfx_bpf_prog_load+0x10/0x10 [ 649.774926][T19288] __sys_bpf+0xd0d/0xd90 [ 649.774967][T19288] ? __pfx___sys_bpf+0x10/0x10 [ 649.775011][T19288] ? __fget_files+0x2a/0x420 [ 649.775056][T19288] ? ksys_write+0x242/0x270 [ 649.775088][T19288] ? __pfx_ksys_write+0x10/0x10 [ 649.775121][T19288] __x64_sys_bpf+0xba/0xd0 [ 649.775151][T19288] do_syscall_64+0x166/0x520 [ 649.775175][T19288] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.775198][T19288] ? clear_bhb_loop+0x70/0xc0 [ 649.775227][T19288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 649.775249][T19288] RIP: 0033:0x7f614f99f559 [ 649.775271][T19288] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 649.775291][T19288] RSP: 002b:00007f6150885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 649.775316][T19288] RAX: ffffffffffffffda RBX: 00007f614fc25fa0 RCX: 00007f614f99f559 [ 649.775333][T19288] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 649.775349][T19288] RBP: 00007f6150885090 R08: 0000000000000000 R09: 0000000000000000 [ 649.775364][T19288] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 649.775376][T19288] R13: 00007f614fc26038 R14: 00007f614fc25fa0 R15: 00007fff63151808 [ 649.775418][T19288] [ 650.027760][T19288] syz.1.3153: vmalloc error: size 2176, align 0x1, vm_struct allocation failed, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 650.028063][T19288] CPU: 1 UID: 0 PID: 19288 Comm: syz.1.3153 Not tainted syzkaller #0 PREEMPT(full) [ 650.028134][T19288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 650.028175][T19288] Call Trace: [ 650.028198][T19288] [ 650.028229][T19288] dump_stack_lvl+0xe8/0x150 [ 650.028344][T19288] warn_alloc+0x24d/0x270 [ 650.028422][T19288] ? __kasan_kmalloc+0x22/0xb0 [ 650.028543][T19288] ? __pfx_warn_alloc+0x10/0x10 [ 650.028614][T19288] ? __kasan_kmalloc+0x93/0xb0 [ 650.028692][T19288] ? __get_vm_area_node+0x155/0x2f0 [ 650.028764][T19288] ? __x64_sys_bpf+0xba/0xd0 [ 650.028840][T19288] ? __get_vm_area_node+0x2a9/0x2f0 [ 650.028941][T19288] __vmalloc_node_range_noprof+0x36b/0x1540 [ 650.029101][T19288] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 650.029166][T19288] ? __kasan_kmalloc+0x93/0xb0 [ 650.029260][T19288] ? __kmalloc_cache_noprof+0x31c/0x600 [ 650.029343][T19288] ? __kmalloc_cache_noprof+0x148/0x600 [ 650.029414][T19288] ? bpf_diag_init+0x87/0x140 [ 650.029498][T19288] ? bpf_diag_init+0x87/0x140 [ 650.029592][T19288] ? bpf_check+0x115b/0x2ef0 [ 650.029659][T19288] __vmalloc_noprof+0xd2/0x120 [ 650.029731][T19288] ? bpf_check+0x115b/0x2ef0 [ 650.029822][T19288] bpf_check+0x115b/0x2ef0 [ 650.029977][T19288] ? __pfx_bpf_check+0x10/0x10 [ 650.030060][T19288] ? bpf_obj_name_cpy+0x194/0x1e0 [ 650.030133][T19288] bpf_prog_load+0x14d1/0x1c20 [ 650.030256][T19288] ? __pfx_bpf_prog_load+0x10/0x10 [ 650.030407][T19288] __sys_bpf+0xd0d/0xd90 [ 650.030505][T19288] ? __pfx___sys_bpf+0x10/0x10 [ 650.030621][T19288] ? __fget_files+0x2a/0x420 [ 650.030737][T19288] ? ksys_write+0x242/0x270 [ 650.030813][T19288] ? __pfx_ksys_write+0x10/0x10 [ 650.030907][T19288] __x64_sys_bpf+0xba/0xd0 [ 650.030994][T19288] do_syscall_64+0x166/0x520 [ 650.031056][T19288] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.031119][T19288] ? clear_bhb_loop+0x70/0xc0 [ 650.031200][T19288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 650.031278][T19288] RIP: 0033:0x7f614f99f559 [ 650.031340][T19288] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 650.031393][T19288] RSP: 002b:00007f6150885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 650.031442][T19288] RAX: ffffffffffffffda RBX: 00007f614fc25fa0 RCX: 00007f614f99f559 [ 650.031486][T19288] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 650.031520][T19288] RBP: 00007f6150885090 R08: 0000000000000000 R09: 0000000000000000 [ 650.031559][T19288] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 650.031593][T19288] R13: 00007f614fc26038 R14: 00007f614fc25fa0 R15: 00007fff63151808 [ 650.031720][T19288] [ 650.074405][T19288] Mem-Info: [ 650.074474][T19288] active_anon:8990 inactive_anon:0 isolated_anon:0 [ 650.074474][T19288] active_file:0 inactive_file:43662 isolated_file:0 [ 650.074474][T19288] unevictable:0 dirty:161 writeback:0 [ 650.074474][T19288] slab_reclaimable:12388 slab_unreclaimable:120700 [ 650.074474][T19288] mapped:29348 shmem:528 pagetables:3369 [ 650.074474][T19288] sec_pagetables:0 bounce:0 [ 650.074474][T19288] kernel_misc_reclaimable:0 [ 650.074474][T19288] free:1238172 free_pcp:26049 free_cma:0 [ 650.074709][T19288] Node 0 active_anon:35960kB inactive_anon:0kB active_file:0kB inactive_file:174444kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:117392kB dirty:644kB writeback:0kB shmem:2112kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15428kB pagetables:13320kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 650.074981][T19288] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 650.075120][T19288] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 650.075360][T19288] lowmem_reserve[]: 0 2467 2467 2467 2467 [ 650.083374][T19288] Node 0 DMA32 free:1011120kB boost:0kB min:33980kB low:42472kB high:50964kB reserved_highatomic:0kB free_highatomic:0kB active_anon:35960kB inactive_anon:0kB active_file:0kB inactive_file:174444kB unevictable:0kB writepending:644kB zspages:0kB present:3129332kB managed:2526416kB mlocked:0kB bounce:0kB free_pcp:99416kB local_pcp:17872kB free_cma:0kB [ 650.091147][T19288] lowmem_reserve[]: 0 0 0 0 0 [ 650.091283][T19288] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 650.091439][T19288] lowmem_reserve[]: 0 0 0 0 0 [ 650.091544][T19288] Node 1 Normal free:3926144kB boost:0kB min:55920kB low:69900kB high:83880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:4780kB local_pcp:4780kB free_cma:0kB [ 650.091713][T19288] lowmem_reserve[]: 0 0 0 0 0 [ 650.091813][T19288] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 650.098374][T19288] Node 0 DMA32: 8*4kB (ME) 26*8kB (UME) 18*16kB (UM) 379*32kB (UM) 132*64kB (UME) 65*128kB (UME) 140*256kB (UME) 249*512kB (UME) 177*1024kB (UM) 7*2048kB (UM) 152*4096kB (UM) = 1010928kB [ 650.101161][T19288] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 650.101438][T19288] Node 1 Normal: 4*4kB (UM) 2*8kB (UM) 2*16kB (UM) 2*32kB (UM) 2*64kB (UM) 3*128kB (UM) 4*256kB (UM) 3*512kB (UM) 3*1024kB (UM) 0*2048kB 957*4096kB (UM) = 3926144kB [ 650.113505][T19288] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 650.113571][T19288] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 650.113624][T19288] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 650.113708][T19288] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 650.113760][T19288] 44186 total pagecache pages [ 650.113782][T19288] 0 pages in swap cache [ 650.145047][T19288] Free swap = 124996kB [ 650.145091][T19288] Total swap = 124996kB [ 650.145123][T19288] 2097051 pages RAM [ 650.145145][T19288] 0 pages HighMem/MovableOnly [ 650.145174][T19288] 433831 pages reserved [ 650.145195][T19288] 0 pages cma reserved [ 650.342928][T19049] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 650.390299][T19049] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 650.577066][T19049] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 650.603095][T19049] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 650.769057][T19049] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 650.801793][T19049] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 650.875818][T19049] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 650.975109][T19300] Bluetooth: MGMT ver 1.23 [ 650.983907][T19299] ip_tables: iptables: counters copy to user failed while replacing table [ 651.185900][T19049] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.245050][T19049] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.282126][ T7565] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.282237][ T7565] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.332847][ T6522] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.332967][ T6522] bridge0: port 2(bridge_slave_1) entered forwarding state [ 651.600927][T19309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3158'. [ 651.876925][T19336] FAULT_INJECTION: forcing a failure. [ 651.876925][T19336] name failslab, interval 1, probability 0, space 0, times 0 [ 651.876967][T19336] CPU: 1 UID: 0 PID: 19336 Comm: syz.3.3164 Not tainted syzkaller #0 PREEMPT(full) [ 651.876993][T19336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 651.877007][T19336] Call Trace: [ 651.877016][T19336] [ 651.877027][T19336] dump_stack_lvl+0xe8/0x150 [ 651.877071][T19336] should_fail_ex+0x410/0x560 [ 651.877111][T19336] should_failslab+0xa8/0x100 [ 651.877153][T19336] __kmalloc_cache_node_noprof+0xa5/0x620 [ 651.877184][T19336] ? kasan_save_track+0x4f/0x80 [ 651.877213][T19336] ? kasan_save_track+0x3e/0x80 [ 651.877240][T19336] ? __kasan_kmalloc+0x93/0xb0 [ 651.877270][T19336] ? __get_vm_area_node+0x155/0x2f0 [ 651.877293][T19336] ? __get_vm_area_node+0x155/0x2f0 [ 651.877317][T19336] ? __x64_sys_bpf+0xba/0xd0 [ 651.877345][T19336] __get_vm_area_node+0x155/0x2f0 [ 651.877377][T19336] __vmalloc_node_range_noprof+0x343/0x1540 [ 651.877405][T19336] ? bpf_check+0x115b/0x2ef0 [ 651.877463][T19336] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 651.877490][T19336] ? __kasan_kmalloc+0x93/0xb0 [ 651.877523][T19336] ? __kmalloc_cache_noprof+0x31c/0x600 [ 651.877553][T19336] ? __kmalloc_cache_noprof+0x148/0x600 [ 651.877580][T19336] ? bpf_diag_init+0x87/0x140 [ 651.877611][T19336] ? bpf_diag_init+0x87/0x140 [ 651.877644][T19336] ? bpf_check+0x115b/0x2ef0 [ 651.877671][T19336] __vmalloc_noprof+0xd2/0x120 [ 651.877698][T19336] ? bpf_check+0x115b/0x2ef0 [ 651.877730][T19336] bpf_check+0x115b/0x2ef0 [ 651.877779][T19336] ? __pfx_bpf_check+0x10/0x10 [ 651.877812][T19336] ? bpf_obj_name_cpy+0x194/0x1e0 [ 651.877855][T19336] bpf_prog_load+0x14d1/0x1c20 [ 651.877899][T19336] ? __pfx_bpf_prog_load+0x10/0x10 [ 651.877960][T19336] __sys_bpf+0xd0d/0xd90 [ 651.877999][T19336] ? __pfx___sys_bpf+0x10/0x10 [ 651.878042][T19336] ? __fget_files+0x2a/0x420 [ 651.878088][T19336] ? ksys_write+0x242/0x270 [ 651.878118][T19336] ? __pfx_ksys_write+0x10/0x10 [ 651.878151][T19336] __x64_sys_bpf+0xba/0xd0 [ 651.878182][T19336] do_syscall_64+0x166/0x520 [ 651.878206][T19336] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.878230][T19336] ? clear_bhb_loop+0x70/0xc0 [ 651.878259][T19336] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.878282][T19336] RIP: 0033:0x7ff58f59f559 [ 651.878304][T19336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 651.878323][T19336] RSP: 002b:00007ff5903b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 651.878348][T19336] RAX: ffffffffffffffda RBX: 00007ff58f825fa0 RCX: 00007ff58f59f559 [ 651.878364][T19336] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 651.878379][T19336] RBP: 00007ff5903b4090 R08: 0000000000000000 R09: 0000000000000000 [ 651.878394][T19336] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 651.878408][T19336] R13: 00007ff58f826038 R14: 00007ff58f825fa0 R15: 00007ffcea538988 [ 651.878444][T19336] [ 651.878732][T19333] vlan2: entered promiscuous mode [ 651.878760][T19333] mac80211_hwsim hwsim27 wlan1: entered promiscuous mode [ 651.878998][T19333] vlan2: entered allmulticast mode [ 651.879018][T19333] mac80211_hwsim hwsim27 wlan1: entered allmulticast mode [ 652.649006][T19049] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 652.813502][T19049] veth0_vlan: entered promiscuous mode [ 652.856690][T19049] veth1_vlan: entered promiscuous mode [ 652.967474][T19049] veth0_macvtap: entered promiscuous mode [ 652.982555][T19049] veth1_macvtap: entered promiscuous mode [ 653.018684][T19049] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 653.042021][T19049] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 653.091719][T19322] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.091961][T19322] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.117739][T16281] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.118177][T16281] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.449002][T16281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 653.449032][T16281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 653.494273][T19381] FAULT_INJECTION: forcing a failure. [ 653.494273][T19381] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 653.494315][T19381] CPU: 1 UID: 0 PID: 19381 Comm: syz.3.3175 Not tainted syzkaller #0 PREEMPT(full) [ 653.494340][T19381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 653.494354][T19381] Call Trace: [ 653.494363][T19381] [ 653.494373][T19381] dump_stack_lvl+0xe8/0x150 [ 653.494415][T19381] should_fail_ex+0x410/0x560 [ 653.494456][T19381] prepare_alloc_pages+0x21e/0x5f0 [ 653.494494][T19381] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 653.494529][T19381] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 653.494559][T19381] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 653.494592][T19381] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 653.494627][T19381] ? __pfx_policy_nodemask+0x10/0x10 [ 653.494659][T19381] ? __get_vm_area_node+0x155/0x2f0 [ 653.494681][T19381] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 653.494706][T19381] ? __vmalloc_noprof+0xd2/0x120 [ 653.494734][T19381] __alloc_pages_noprof+0x10/0x100 [ 653.494765][T19381] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 653.494803][T19381] ? alloc_pages_noprof+0x140/0x2b0 [ 653.494834][T19381] __kasan_populate_vmalloc+0xb7/0x1c0 [ 653.494870][T19381] alloc_vmap_area+0xd10/0x1410 [ 653.494908][T19381] ? __pfx_alloc_vmap_area+0x10/0x10 [ 653.494929][T19381] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 653.494960][T19381] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 653.494988][T19381] ? __get_vm_area_node+0x155/0x2f0 [ 653.495017][T19381] __get_vm_area_node+0x200/0x2f0 [ 653.495048][T19381] __vmalloc_node_range_noprof+0x343/0x1540 [ 653.495076][T19381] ? bpf_check+0x115b/0x2ef0 [ 653.495139][T19381] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 653.495167][T19381] ? __kasan_kmalloc+0x93/0xb0 [ 653.495200][T19381] ? __kmalloc_cache_noprof+0x31c/0x600 [ 653.495230][T19381] ? __kmalloc_cache_noprof+0x148/0x600 [ 653.495256][T19381] ? bpf_diag_init+0x87/0x140 [ 653.495287][T19381] ? bpf_diag_init+0x87/0x140 [ 653.495321][T19381] ? bpf_check+0x115b/0x2ef0 [ 653.495348][T19381] __vmalloc_noprof+0xd2/0x120 [ 653.495373][T19381] ? bpf_check+0x115b/0x2ef0 [ 653.495401][T19381] bpf_check+0x115b/0x2ef0 [ 653.495447][T19381] ? __pfx_bpf_check+0x10/0x10 [ 653.495478][T19381] ? bpf_obj_name_cpy+0x194/0x1e0 [ 653.495506][T19381] bpf_prog_load+0x14d1/0x1c20 [ 653.495552][T19381] ? __pfx_bpf_prog_load+0x10/0x10 [ 653.495611][T19381] __sys_bpf+0xd0d/0xd90 [ 653.495647][T19381] ? __pfx___sys_bpf+0x10/0x10 [ 653.495688][T19381] ? __fget_files+0x2a/0x420 [ 653.495733][T19381] ? ksys_write+0x242/0x270 [ 653.495764][T19381] ? __pfx_ksys_write+0x10/0x10 [ 653.495796][T19381] __x64_sys_bpf+0xba/0xd0 [ 653.495827][T19381] do_syscall_64+0x166/0x520 [ 653.495849][T19381] ? trace_irq_disable+0x3b/0x140 [ 653.495876][T19381] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.495900][T19381] ? clear_bhb_loop+0x70/0xc0 [ 653.495928][T19381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.495951][T19381] RIP: 0033:0x7ff58f59f559 [ 653.495973][T19381] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 653.495993][T19381] RSP: 002b:00007ff5903b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 653.496019][T19381] RAX: ffffffffffffffda RBX: 00007ff58f825fa0 RCX: 00007ff58f59f559 [ 653.496036][T19381] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 653.496051][T19381] RBP: 00007ff5903b4090 R08: 0000000000000000 R09: 0000000000000000 [ 653.496066][T19381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 653.496079][T19381] R13: 00007ff58f826038 R14: 00007ff58f825fa0 R15: 00007ffcea538988 [ 653.496124][T19381] [ 653.970808][ T7565] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 653.970835][ T7565] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.117093][T19392] netlink: 'syz.3.3176': attribute type 1 has an invalid length. [ 654.117122][T19392] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3176'. [ 654.118674][T19390] netlink: 'syz.3.3176': attribute type 1 has an invalid length. [ 654.118693][T19390] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3176'. [ 654.239404][T19393] netlink: 'syz.0.3177': attribute type 1 has an invalid length. [ 654.355939][T19406] netlink: 136 bytes leftover after parsing attributes in process `syz.2.3097'. [ 654.473663][T19403] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3177'. [ 654.540226][T19393] veth11: entered promiscuous mode [ 654.573554][T19404] syzkaller0: entered promiscuous mode [ 654.573595][T19404] syzkaller0: entered allmulticast mode [ 655.012610][T19416] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3182'. [ 655.145706][ C1] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 655.277829][ T5641] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 655.282319][ T5641] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 655.283639][ T5641] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 655.314329][ T5641] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 655.315231][ T5641] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 655.530546][T19431] FAULT_INJECTION: forcing a failure. [ 655.530546][T19431] name failslab, interval 1, probability 0, space 0, times 0 [ 655.530586][T19431] CPU: 0 UID: 0 PID: 19431 Comm: syz.2.3185 Not tainted syzkaller #0 PREEMPT(full) [ 655.530609][T19431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 655.530623][T19431] Call Trace: [ 655.530631][T19431] [ 655.530640][T19431] dump_stack_lvl+0xe8/0x150 [ 655.530679][T19431] should_fail_ex+0x410/0x560 [ 655.530715][T19431] should_failslab+0xa8/0x100 [ 655.530749][T19431] __kmalloc_node_noprof+0xfb/0x720 [ 655.530774][T19431] ? __get_vm_area_node+0x200/0x2f0 [ 655.530795][T19431] ? __get_vm_area_node+0x283/0x2f0 [ 655.530814][T19431] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 655.530836][T19431] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 655.530866][T19431] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 655.530929][T19431] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 655.530952][T19431] ? __kasan_kmalloc+0x93/0xb0 [ 655.530982][T19431] ? __kmalloc_cache_noprof+0x31c/0x600 [ 655.531007][T19431] ? __kmalloc_cache_noprof+0x148/0x600 [ 655.531030][T19431] ? bpf_diag_init+0x87/0x140 [ 655.531058][T19431] ? bpf_diag_init+0x87/0x140 [ 655.531087][T19431] ? bpf_check+0x115b/0x2ef0 [ 655.531111][T19431] __vmalloc_noprof+0xd2/0x120 [ 655.531134][T19431] ? bpf_check+0x115b/0x2ef0 [ 655.531166][T19431] bpf_check+0x115b/0x2ef0 [ 655.531209][T19431] ? __pfx_bpf_check+0x10/0x10 [ 655.531238][T19431] ? bpf_obj_name_cpy+0x194/0x1e0 [ 655.531263][T19431] bpf_prog_load+0x14d1/0x1c20 [ 655.531302][T19431] ? __pfx_bpf_prog_load+0x10/0x10 [ 655.531355][T19431] __sys_bpf+0xd0d/0xd90 [ 655.531390][T19431] ? __pfx___sys_bpf+0x10/0x10 [ 655.531437][T19431] ? __fget_files+0x2a/0x420 [ 655.531477][T19431] ? ksys_write+0x242/0x270 [ 655.531504][T19431] ? __pfx_ksys_write+0x10/0x10 [ 655.531533][T19431] __x64_sys_bpf+0xba/0xd0 [ 655.531560][T19431] do_syscall_64+0x166/0x520 [ 655.531580][T19431] ? trace_irq_disable+0x3b/0x140 [ 655.531603][T19431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.531624][T19431] ? clear_bhb_loop+0x70/0xc0 [ 655.531649][T19431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.531668][T19431] RIP: 0033:0x7f439bb9f559 [ 655.531687][T19431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 655.531705][T19431] RSP: 002b:00007f439ca42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 655.531728][T19431] RAX: ffffffffffffffda RBX: 00007f439be25fa0 RCX: 00007f439bb9f559 [ 655.531743][T19431] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 655.531755][T19431] RBP: 00007f439ca42090 R08: 0000000000000000 R09: 0000000000000000 [ 655.531768][T19431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 655.531779][T19431] R13: 00007f439be26038 R14: 00007f439be25fa0 R15: 00007ffe66436648 [ 655.531812][T19431] [ 656.034751][T19436] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3187'. [ 656.051673][T19438] can: request_module (can-proto-0) failed. [ 656.235653][T19448] ip_tables: iptables: counters copy to user failed while replacing table [ 656.607138][T19463] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3192'. [ 656.653292][T19460] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3193'. [ 657.127807][T19424] wg0 speed is unknown, defaulting to 1000 [ 657.382509][ T6522] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 657.400098][ T54] Bluetooth: hci4: command tx timeout [ 657.598618][ T6522] batman_adv: batadv0: Removing interface: ip6gretap1 [ 657.958421][T19483] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3196'. [ 658.755020][ T6522] bond0 (unregistering): (slave 17ÿ): Releasing backup interface [ 658.768371][ T6522] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 658.770777][ T6522] bond0 (unregistering): Released all slaves [ 658.801795][ T6522] bond1 (unregistering): Released all slaves [ 658.827774][ T6522] bond2 (unregistering): Released all slaves [ 658.859108][ T6522] bond3 (unregistering): Released all slaves [ 658.893944][ T6522] bond4 (unregistering): Released all slaves [ 658.921139][ T6522] bond5 (unregistering): Released all slaves [ 658.944603][ T6522] bond6 (unregistering): Released all slaves [ 658.971131][ T6522] bond7 (unregistering): Released all slaves [ 659.006451][ T6522] bond8 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 659.007652][ T6522] bond8 (unregistering): Released all slaves [ 659.047408][ T6522] bond9 (unregistering): Released all slaves [ 659.078248][ T6522] bond10 (unregistering): Released all slaves [ 659.102539][ T6522] bond11 (unregistering): Released all slaves [ 659.132186][ T6522] bond12 (unregistering): Released all slaves [ 659.163559][ T6522] bond13 (unregistering): Released all slaves [ 659.299064][T19497] geneve2: entered promiscuous mode [ 659.317084][ T5295] 8021q: adding VLAN 0 to HW filter on device eth3 [ 659.317851][ T1018] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.318603][ T1018] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.318686][ T1018] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.319267][T16386] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 659.439199][ T6522] tipc: Left network mode [ 659.466325][ T54] Bluetooth: hci4: command tx timeout [ 659.741274][T19424] lo speed is unknown, defaulting to 1000 [ 660.455224][T19488] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 661.190085][T19547] tc_dump_action: action bad kind [ 661.546357][ T54] Bluetooth: hci4: command tx timeout [ 661.631291][T19563] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3206'. [ 661.711200][T19568] FAULT_INJECTION: forcing a failure. [ 661.711200][T19568] name failslab, interval 1, probability 0, space 0, times 0 [ 661.711242][T19568] CPU: 1 UID: 0 PID: 19568 Comm: syz.4.3207 Not tainted syzkaller #0 PREEMPT(full) [ 661.711268][T19568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 661.711282][T19568] Call Trace: [ 661.711292][T19568] [ 661.711301][T19568] dump_stack_lvl+0xe8/0x150 [ 661.711345][T19568] should_fail_ex+0x410/0x560 [ 661.711386][T19568] should_failslab+0xa8/0x100 [ 661.711425][T19568] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 661.711458][T19568] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 661.711488][T19568] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 661.711527][T19568] ? kvrealloc_node_align_noprof+0x7b/0xf0 [ 661.711559][T19568] krealloc_node_align_noprof+0x19a/0x390 [ 661.711589][T19568] ? __kmalloc_cache_noprof+0x148/0x600 [ 661.711615][T19568] ? bpf_diag_init+0x87/0x140 [ 661.711645][T19568] ? bpf_diag_init+0x87/0x140 [ 661.711680][T19568] kvrealloc_node_align_noprof+0x7b/0xf0 [ 661.711717][T19568] bpf_iarray_realloc+0x34/0xa0 [ 661.711745][T19568] bpf_check+0x148b/0x2ef0 [ 661.711798][T19568] ? __pfx_bpf_check+0x10/0x10 [ 661.711831][T19568] ? bpf_obj_name_cpy+0x194/0x1e0 [ 661.711861][T19568] bpf_prog_load+0x14d1/0x1c20 [ 661.711915][T19568] ? __pfx_bpf_prog_load+0x10/0x10 [ 661.711975][T19568] __sys_bpf+0xd0d/0xd90 [ 661.712015][T19568] ? __pfx___sys_bpf+0x10/0x10 [ 661.712057][T19568] ? __fget_files+0x2a/0x420 [ 661.712102][T19568] ? ksys_write+0x242/0x270 [ 661.712131][T19568] ? __pfx_ksys_write+0x10/0x10 [ 661.712158][T19568] __x64_sys_bpf+0xba/0xd0 [ 661.712186][T19568] do_syscall_64+0x166/0x520 [ 661.712208][T19568] ? trace_irq_disable+0x3b/0x140 [ 661.712235][T19568] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.712259][T19568] ? clear_bhb_loop+0x70/0xc0 [ 661.712286][T19568] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 661.712309][T19568] RIP: 0033:0x7f2b3399f559 [ 661.712332][T19568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 661.712352][T19568] RSP: 002b:00007f2b348da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 661.712379][T19568] RAX: ffffffffffffffda RBX: 00007f2b33c25fa0 RCX: 00007f2b3399f559 [ 661.712396][T19568] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 661.712411][T19568] RBP: 00007f2b348da090 R08: 0000000000000000 R09: 0000000000000000 [ 661.712425][T19568] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 661.712439][T19568] R13: 00007f2b33c26038 R14: 00007f2b33c25fa0 R15: 00007ffce91d1358 [ 661.712474][T19568] [ 662.394440][T19590] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3211'. [ 662.491055][T19424] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.491379][T19424] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.491610][T19424] bridge_slave_0: entered allmulticast mode [ 662.523128][T19424] bridge_slave_0: entered promiscuous mode [ 662.561283][ T5295] 8021q: adding VLAN 0 to HW filter on device eth4 [ 662.751576][T19424] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.751782][T19424] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.754460][T19424] bridge_slave_1: entered allmulticast mode [ 662.790253][T19424] bridge_slave_1: entered promiscuous mode [ 662.894954][T19603] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3212'. [ 662.917746][T19603] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3212'. [ 663.083794][T19424] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 663.191121][T19424] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 663.320790][ T6522] hsr_slave_0: left promiscuous mode [ 663.323199][ T6522] hsr_slave_1: left promiscuous mode [ 663.324327][ T6522] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 663.346756][ T6522] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 663.366474][T19611] netlink: 'syz.2.3214': attribute type 4 has an invalid length. [ 663.465044][T19615] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3216'. [ 663.566074][T19624] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 663.567271][T19620] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 663.645647][ T54] Bluetooth: hci4: command tx timeout [ 663.693781][ T6522] smc: removing net device macvtap0 with user defined pnetid SYZ0 [ 664.048891][ T1018] smc: removing ib device syz1 [ 664.140943][ T1018] smbdirect: ib_dev[syz1] removed [ 664.370388][T19622] kthread_run failed with err -4 [ 664.398712][T19424] team0: Port device team_slave_0 added [ 664.435349][T19424] team0: Port device team_slave_1 added [ 664.678912][T19635] syz_tun: left allmulticast mode [ 664.678952][T19635] syz_tun: left promiscuous mode [ 664.679232][T19635] bridge0: port 1(syz_tun) entered disabled state [ 664.804354][T19635] bond0: (slave team0): Releasing backup interface [ 664.971730][T19635] team0: Port device xfrm0 removed [ 665.026689][T19652] x_tables: duplicate underflow at hook 2 [ 665.159126][T19635] bond10: (slave gretap3): Releasing active interface [ 665.315311][T19424] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 665.315335][T19424] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 665.316047][T19424] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 665.366321][T19424] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 665.366346][T19424] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 665.366379][T19424] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 665.640385][T19666] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3225'. [ 665.640420][T19666] sch_tbf: burst 0 is lower than device ip6tnl0 mtu (1452) ! [ 665.923379][T19424] hsr_slave_0: entered promiscuous mode [ 665.929963][T19424] hsr_slave_1: entered promiscuous mode [ 666.435114][T19685] bond1: up delay (7) is not a multiple of miimon (100), value rounded to 0 ms [ 666.435152][T19685] bond1: down delay (1) is not a multiple of miimon (100), value rounded to 0 ms [ 666.464215][T19685] bond1: entered allmulticast mode [ 666.728543][T19688] bond0: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 666.748502][T19691] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3231'. [ 666.749668][ T5295] 8021q: adding VLAN 0 to HW filter on device eth5 [ 667.539741][T19722] block nbd3: server does not support multiple connections per device. [ 667.540129][T19722] block nbd3: shutting down sockets [ 667.617830][T19725] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3238'. [ 668.104840][T19737] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3241'. [ 668.104881][T19737] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3241'. [ 668.326238][T19747] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3243'. [ 668.326478][T19749] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3243'. [ 668.493638][T19745] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3242'. [ 668.493702][T19745] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3242'. [ 669.954703][T19785] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3248'. [ 670.160211][T19787] bond1: option arp_all_targets: invalid value (3) [ 670.191773][T19787] bond1 (unregistering): Released all slaves [ 670.460309][T19794] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3249'. [ 670.547792][T19787] bond1: option arp_all_targets: invalid value (3) [ 670.550766][T19787] bond1 (unregistering): Released all slaves [ 670.851872][T19806] Bluetooth: ISO socket layer initialized [ 670.879606][T19424] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 670.937276][T19424] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 670.938528][T19424] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 670.960437][T19424] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 670.962211][T19424] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 671.004879][T19424] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 671.008721][T19424] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 671.115245][T19424] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 671.202165][ T6522] IPVS: stop unused estimator thread 0... [ 671.408715][T19815] bond2: Unable to set peer notification delay as MII monitoring is disabled [ 671.419914][T19815] bond2 (unregistering): Released all slaves [ 671.550136][T19832] tipc: Can't bind to reserved service type 0 [ 671.905078][T19842] __nla_validate_parse: 1 callbacks suppressed [ 671.905105][T19842] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3256'. [ 672.020501][T19424] 8021q: adding VLAN 0 to HW filter on device bond0 [ 672.079026][T19851] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 672.104742][T19424] 8021q: adding VLAN 0 to HW filter on device team0 [ 672.131372][ T6522] bridge0: port 1(bridge_slave_0) entered blocking state [ 672.131486][ T6522] bridge0: port 1(bridge_slave_0) entered forwarding state [ 672.234339][ T7565] bridge0: port 2(bridge_slave_1) entered blocking state [ 672.234500][ T7565] bridge0: port 2(bridge_slave_1) entered forwarding state [ 672.538132][T19867] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3262'. [ 672.606351][T19874] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3264'. [ 672.613982][T19874] xfrm1: entered promiscuous mode [ 672.614012][T19874] xfrm1: entered allmulticast mode [ 672.614560][T19874] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3264'. [ 673.831527][T19924] syzkaller0: entered promiscuous mode [ 673.831558][T19924] syzkaller0: entered allmulticast mode [ 673.919187][T19424] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 674.294005][T19939] openvswitch: netlink: Message has -1 unknown bytes. [ 674.350068][T19424] veth0_vlan: entered promiscuous mode [ 674.421374][T19424] veth1_vlan: entered promiscuous mode [ 674.505230][T19948] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3278'. [ 674.543683][T19424] veth0_macvtap: entered promiscuous mode [ 674.567093][T19424] veth1_macvtap: entered promiscuous mode [ 674.599519][T19424] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 674.639854][T19424] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 674.676571][ T1018] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.677129][ T1018] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.677306][ T1018] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.696092][ T1018] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.831561][T19957] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3280'. [ 674.831610][T19957] netlink: 'syz.4.3280': attribute type 30 has an invalid length. [ 674.831627][T19957] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3280'. [ 675.740784][T16281] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.740811][T16281] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.855006][T19981] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3286'. [ 675.888386][ T1018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.888413][ T1018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.997663][T19989] netlink: 'syz.4.3288': attribute type 1 has an invalid length. [ 676.120743][T19989] bond2: option mode: invalid value (8) [ 676.138133][T19989] bond2 (unregistering): Released all slaves [ 676.190376][T19995] netlink: 'syz.4.3288': attribute type 10 has an invalid length. [ 676.190407][T19995] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3288'. [ 676.289456][T20010] mac80211_hwsim hwsim27 ..ãc¤±: renamed from wlan1 [ 676.352996][T19995] dummy0: entered promiscuous mode [ 676.629712][T19985] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 676.629748][T19985] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 676.729061][T19985] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 676.729096][T19985] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 676.796978][T20027] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3181'. [ 676.799764][T19985] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 676.799793][T19985] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 676.800753][T20027] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 676.803934][T20027] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 676.951709][T19985] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 676.951739][T19985] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 677.414132][T20037] bridge0: port 2(bridge_slave_1) entered disabled state [ 677.414936][T20037] bridge0: port 1(bridge_slave_0) entered disabled state [ 677.567797][ T5641] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 677.571869][ T5641] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 677.573836][ T5641] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 677.600687][ T5641] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 677.603371][ T5641] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 677.692679][ T54] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 677.695476][ T54] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 677.709846][ T54] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 677.729866][ T54] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 677.733479][ T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 678.020145][T20037] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 678.044674][T20037] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 678.556051][ T6522] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.556139][ T6522] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.556187][ T6522] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.556231][ T6522] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 678.851477][T20084] FAULT_INJECTION: forcing a failure. [ 678.851477][T20084] name failslab, interval 1, probability 0, space 0, times 0 [ 678.851522][T20084] CPU: 0 UID: 0 PID: 20084 Comm: syz.1.3297 Not tainted syzkaller #0 PREEMPT(full) [ 678.851552][T20084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 678.851569][T20084] Call Trace: [ 678.851578][T20084] [ 678.851591][T20084] dump_stack_lvl+0xe8/0x150 [ 678.851638][T20084] should_fail_ex+0x410/0x560 [ 678.851685][T20084] should_failslab+0xa8/0x100 [ 678.851723][T20084] __kmalloc_node_noprof+0xfb/0x720 [ 678.851753][T20084] ? __get_vm_area_node+0x200/0x2f0 [ 678.851778][T20084] ? __get_vm_area_node+0x283/0x2f0 [ 678.851802][T20084] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 678.851828][T20084] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 678.851865][T20084] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 678.851906][T20084] ? vsnprintf+0xe42/0xef0 [ 678.852064][T20084] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 678.852102][T20084] ? bpf_verifier_vlog+0x3d1/0x900 [ 678.852143][T20084] ? bpf_prog_calc_tag+0x51/0x370 [ 678.852177][T20084] __vmalloc_noprof+0xd2/0x120 [ 678.852205][T20084] ? bpf_prog_calc_tag+0x51/0x370 [ 678.852240][T20084] bpf_prog_calc_tag+0x51/0x370 [ 678.852278][T20084] check_and_resolve_insns+0xbb/0x21d0 [ 678.852319][T20084] ? add_subprog+0x2e2/0x3f0 [ 678.852355][T20084] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 678.852401][T20084] bpf_check+0x18f7/0x2ef0 [ 678.852454][T20084] ? __pfx_bpf_check+0x10/0x10 [ 678.852488][T20084] ? bpf_obj_name_cpy+0x194/0x1e0 [ 678.852517][T20084] bpf_prog_load+0x14d1/0x1c20 [ 678.852563][T20084] ? __pfx_bpf_prog_load+0x10/0x10 [ 678.852623][T20084] __sys_bpf+0xd0d/0xd90 [ 678.852664][T20084] ? __pfx___sys_bpf+0x10/0x10 [ 678.852710][T20084] ? __fget_files+0x2a/0x420 [ 678.852758][T20084] ? ksys_write+0x242/0x270 [ 678.852791][T20084] ? __pfx_ksys_write+0x10/0x10 [ 678.852826][T20084] __x64_sys_bpf+0xba/0xd0 [ 678.852860][T20084] do_syscall_64+0x166/0x520 [ 678.852885][T20084] ? trace_irq_disable+0x3b/0x140 [ 678.852912][T20084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.852939][T20084] ? clear_bhb_loop+0x70/0xc0 [ 678.852969][T20084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.852994][T20084] RIP: 0033:0x7f614f99f559 [ 678.853018][T20084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.853040][T20084] RSP: 002b:00007f6150885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 678.853069][T20084] RAX: ffffffffffffffda RBX: 00007f614fc25fa0 RCX: 00007f614f99f559 [ 678.853098][T20084] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 678.853114][T20084] RBP: 00007f6150885090 R08: 0000000000000000 R09: 0000000000000000 [ 678.853129][T20084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 678.853144][T20084] R13: 00007f614fc26038 R14: 00007f614fc25fa0 R15: 00007fff63151808 [ 678.853185][T20084] [ 678.871628][T20084] warn_alloc: 3 callbacks suppressed [ 678.871696][T20084] syz.1.3297: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 678.871937][T20084] CPU: 0 UID: 0 PID: 20084 Comm: syz.1.3297 Not tainted syzkaller #0 PREEMPT(full) [ 678.872021][T20084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 678.872059][T20084] Call Trace: [ 678.872101][T20084] [ 678.872127][T20084] dump_stack_lvl+0xe8/0x150 [ 678.872254][T20084] warn_alloc+0x24d/0x270 [ 678.872361][T20084] ? __pfx_warn_alloc+0x10/0x10 [ 678.872466][T20084] ? __kmalloc_node_noprof+0x4d2/0x720 [ 678.872548][T20084] ? __get_vm_area_node+0x200/0x2f0 [ 678.872621][T20084] ? __get_vm_area_node+0x283/0x2f0 [ 678.872682][T20084] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 678.872761][T20084] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 678.872857][T20084] __vmalloc_node_range_noprof+0x969/0x1540 [ 678.873032][T20084] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 678.873116][T20084] ? bpf_verifier_vlog+0x3d1/0x900 [ 678.873239][T20084] ? bpf_prog_calc_tag+0x51/0x370 [ 678.873338][T20084] __vmalloc_noprof+0xd2/0x120 [ 678.873417][T20084] ? bpf_prog_calc_tag+0x51/0x370 [ 678.873519][T20084] bpf_prog_calc_tag+0x51/0x370 [ 678.873609][T20084] check_and_resolve_insns+0xbb/0x21d0 [ 678.873717][T20084] ? add_subprog+0x2e2/0x3f0 [ 678.873813][T20084] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 678.873945][T20084] bpf_check+0x18f7/0x2ef0 [ 678.874087][T20084] ? __pfx_bpf_check+0x10/0x10 [ 678.874191][T20084] ? bpf_obj_name_cpy+0x194/0x1e0 [ 678.874272][T20084] bpf_prog_load+0x14d1/0x1c20 [ 678.874441][T20084] ? __pfx_bpf_prog_load+0x10/0x10 [ 678.874617][T20084] __sys_bpf+0xd0d/0xd90 [ 678.874750][T20084] ? __pfx___sys_bpf+0x10/0x10 [ 678.874881][T20084] ? __fget_files+0x2a/0x420 [ 678.875010][T20084] ? ksys_write+0x242/0x270 [ 678.875217][T20084] ? __pfx_ksys_write+0x10/0x10 [ 678.875328][T20084] __x64_sys_bpf+0xba/0xd0 [ 678.875449][T20084] do_syscall_64+0x166/0x520 [ 678.875516][T20084] ? trace_irq_disable+0x3b/0x140 [ 678.875595][T20084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.875661][T20084] ? clear_bhb_loop+0x70/0xc0 [ 678.875741][T20084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.875817][T20084] RIP: 0033:0x7f614f99f559 [ 678.875978][T20084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.876066][T20084] RSP: 002b:00007f6150885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 678.876149][T20084] RAX: ffffffffffffffda RBX: 00007f614fc25fa0 RCX: 00007f614f99f559 [ 678.876195][T20084] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 678.876253][T20084] RBP: 00007f6150885090 R08: 0000000000000000 R09: 0000000000000000 [ 678.876300][T20084] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 678.876344][T20084] R13: 00007f614fc26038 R14: 00007f614fc25fa0 R15: 00007fff63151808 [ 678.876445][T20084] [ 678.914140][T20084] Mem-Info: [ 678.914278][T20084] active_anon:6072 inactive_anon:0 isolated_anon:0 [ 678.914278][T20084] active_file:0 inactive_file:43678 isolated_file:0 [ 678.914278][T20084] unevictable:0 dirty:114 writeback:0 [ 678.914278][T20084] slab_reclaimable:12381 slab_unreclaimable:119743 [ 678.914278][T20084] mapped:30493 shmem:629 pagetables:3449 [ 678.914278][T20084] sec_pagetables:0 bounce:0 [ 678.914278][T20084] kernel_misc_reclaimable:0 [ 678.914278][T20084] free:1254987 free_pcp:10033 free_cma:0 [ 678.914505][T20084] Node 0 active_anon:24288kB inactive_anon:0kB active_file:0kB inactive_file:174508kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:121972kB dirty:452kB writeback:0kB shmem:2516kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15716kB pagetables:13640kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 678.914660][T20084] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:156kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 678.914836][T20084] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 678.915020][T20084] lowmem_reserve[]: 0 2467 2467 2467 2467 [ 678.915128][T20084] Node 0 DMA32 free:1075924kB boost:0kB min:33980kB low:42472kB high:50964kB reserved_highatomic:0kB free_highatomic:0kB active_anon:24288kB inactive_anon:0kB active_file:0kB inactive_file:174508kB unevictable:0kB writepending:452kB zspages:0kB present:3129332kB managed:2526416kB mlocked:0kB bounce:0kB free_pcp:37872kB local_pcp:20008kB free_cma:0kB [ 678.915293][T20084] lowmem_reserve[]: 0 0 0 0 0 [ 678.941206][T20084] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 678.941367][T20084] lowmem_reserve[]: 0 0 0 0 0 [ 678.941575][T20084] Node 1 Normal free:3928664kB boost:0kB min:55920kB low:69900kB high:83880kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:2260kB local_pcp:0kB free_cma:0kB [ 678.941750][T20084] lowmem_reserve[]: 0 0 0 0 0 [ 678.941854][T20084] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 678.943436][T20084] Node 0 DMA32: 23*4kB (UME) 781*8kB (UME) 479*16kB (UME) 211*32kB (UME) 204*64kB (UME) 223*128kB (UME) 313*256kB (UME) 247*512kB (UME) 176*1024kB (UM) 4*2048kB (UM) 151*4096kB (UM) = 1075860kB [ 678.943606][T20084] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 678.957030][T20084] Node 1 Normal: 4*4kB (UM) 3*8kB (UM) 3*16kB (UM) 2*32kB (UM) 3*64kB (UM) 2*128kB (UM) 4*256kB (UM) 4*512kB (UM) 3*1024kB (UM) 1*2048kB (U) 957*4096kB (UM) = 3928664kB [ 678.957538][T20084] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 678.957588][T20084] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 678.960546][T20084] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 678.960609][T20084] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 678.960654][T20084] 44303 total pagecache pages [ 678.960683][T20084] 0 pages in swap cache [ 678.960704][T20084] Free swap = 124996kB [ 678.960726][T20084] Total swap = 124996kB [ 678.960750][T20084] 2097051 pages RAM [ 678.960771][T20084] 0 pages HighMem/MovableOnly [ 678.960793][T20084] 433831 pages reserved [ 678.960814][T20084] 0 pages cma reserved [ 679.792441][ T54] Bluetooth: hci1: command tx timeout [ 680.186888][T20100] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 680.326909][T20105] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 681.101563][T20052] lo speed is unknown, defaulting to 1000 [ 681.440822][T20148] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3310'. [ 681.544275][T20151] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3309'. [ 681.544325][T20151] openvswitch: netlink: Missing key (keys=40, expected=100) [ 681.752197][T20162] xt_hashlimit: size too large, truncated to 1048576 [ 681.852351][T20168] netlink: 360 bytes leftover after parsing attributes in process `syz.4.3313'. [ 681.854079][T20168] sctp: [Deprecated]: syz.4.3313 (pid 20168) Use of struct sctp_assoc_value in delayed_ack socket option. [ 681.854079][T20168] Use struct sctp_sack_info instead [ 681.865905][ T54] Bluetooth: hci1: command tx timeout [ 682.078650][T20172] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3314'. [ 682.078688][T20172] block nbd3: Unsupported socket: should be TCP or UNIX. [ 682.154665][T20172] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3314'. [ 682.893746][T20209] bond1: Unable to set down delay as MII monitoring is disabled [ 682.906895][T20209] bond1 (unregistering): Released all slaves [ 683.218143][T20052] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.218380][T20052] bridge0: port 1(bridge_slave_0) entered disabled state [ 683.218552][T20052] bridge_slave_0: entered allmulticast mode [ 683.220928][T20052] bridge_slave_0: entered promiscuous mode [ 683.229846][T20052] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.230035][T20052] bridge0: port 2(bridge_slave_1) entered disabled state [ 683.230216][T20052] bridge_slave_1: entered allmulticast mode [ 683.232750][T20052] bridge_slave_1: entered promiscuous mode [ 683.314879][T20227] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3323'. [ 683.369550][T20052] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 683.372493][T20227] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3323'. [ 683.377567][T20052] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 683.412989][T20227] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3323'. [ 683.528162][T20052] team0: Port device team_slave_0 added [ 683.545942][T20052] team0: Port device team_slave_1 added [ 683.615935][T20238] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3325'. [ 683.689647][T20052] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 683.689671][T20052] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.689703][T20052] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 683.808554][T20052] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 683.808578][T20052] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.808607][T20052] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 683.886645][T20245] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3327'. [ 683.947383][ T5641] Bluetooth: hci1: command tx timeout [ 684.040562][T20052] hsr_slave_0: entered promiscuous mode [ 684.043538][T20052] hsr_slave_1: entered promiscuous mode [ 684.046097][T20052] debugfs: 'hsr0' already exists in 'hsr' [ 684.046197][T20052] Cannot create hsr debugfs directory [ 684.576869][T20052] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 684.579794][T20052] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.579836][T20052] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 57929 - 0 [ 684.742772][T20052] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 684.742819][T20052] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.742848][T20052] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 57929 - 0 [ 684.853854][T20052] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 684.853902][T20052] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 684.853931][T20052] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 57929 - 0 [ 686.025694][ T54] Bluetooth: hci1: command tx timeout [ 686.337276][T20230] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 686.412465][T20052] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 686.451215][T20052] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 686.466764][T20052] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 686.491541][T20052] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 686.492554][T20052] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 686.550567][T20296] IPVS: lc: FWM 3 0x00000003 - no destination available [ 686.572577][T20052] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 686.579430][T20052] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 686.597811][T16281] IPVS: starting estimator thread 0... [ 686.630798][T20052] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 686.687142][T20297] IPVS: using max 30 ests per chain, 72000 per kthread [ 686.727453][T20304] ip_tables: iptables: counters copy to user failed while replacing table [ 686.731367][T20304] __nla_validate_parse: 1 callbacks suppressed [ 686.731395][T20304] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3336'. [ 686.732349][T20294] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3332'. [ 686.810283][T20304] hsr_slave_0 (unregistering): left promiscuous mode [ 686.811287][T20306] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3333'. [ 686.869637][T20316] dummy0: entered allmulticast mode [ 686.973786][T20312] dummy0: left allmulticast mode [ 687.102259][T20052] 8021q: adding VLAN 0 to HW filter on device bond0 [ 687.158733][T20052] 8021q: adding VLAN 0 to HW filter on device team0 [ 687.185134][T16386] bridge0: port 1(bridge_slave_0) entered blocking state [ 687.185237][T16386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 687.215916][T16283] bridge0: port 2(bridge_slave_1) entered blocking state [ 687.216009][T16283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 687.772873][T20348] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3340'. [ 688.313469][T20375] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3348'. [ 688.314235][T20375] netlink: 'syz.2.3348': attribute type 1 has an invalid length. [ 688.362778][T20375] bond1: entered promiscuous mode [ 688.363287][T20375] 8021q: adding VLAN 0 to HW filter on device bond1 [ 688.409009][T20378] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 688.409047][T20378] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 688.409068][T20378] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 688.509148][T20380] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 688.511868][T20380] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 688.617551][T20375] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 688.617586][T20375] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 689.129706][T20407] netlink: 'syz.1.3354': attribute type 21 has an invalid length. [ 689.129741][T20407] IPv6: NLM_F_CREATE should be specified when creating new route [ 689.198027][T20413] netlink: 'syz.2.3353': attribute type 3 has an invalid length. [ 689.198492][T20413] netlink: 'syz.2.3353': attribute type 3 has an invalid length. [ 689.228018][T20052] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 689.342605][T20417] netlink: 'syz.4.3356': attribute type 30 has an invalid length. [ 689.482744][T20429] netlink: 'syz.4.3356': attribute type 30 has an invalid length. [ 689.556277][T20433] block nbd3: server does not support multiple connections per device. [ 689.556673][T20433] block nbd3: shutting down sockets [ 689.698469][T20433] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 689.803567][T20052] veth0_vlan: entered promiscuous mode [ 689.833771][T20052] veth1_vlan: entered promiscuous mode [ 689.865327][T20442] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3359'. [ 689.931542][T20442] batadv_slave_1: entered promiscuous mode [ 690.012307][T20442] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3359'. [ 690.019166][T20052] veth0_macvtap: entered promiscuous mode [ 690.046759][T20052] veth1_macvtap: entered promiscuous mode [ 690.114484][T20052] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 690.163120][T20052] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 690.494236][T20449] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3360'. [ 690.528282][T20456] syzkaller1: entered promiscuous mode [ 690.528314][T20456] syzkaller1: entered allmulticast mode [ 691.091669][T16281] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.276889][T19322] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.300514][T19322] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 691.300544][T19322] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.383645][ T1018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 691.383674][ T1018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.407357][T20467] netlink: 'syz.4.3364': attribute type 31 has an invalid length. [ 691.407698][ T6522] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.407750][ T6522] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 691.556691][T20473] 8021q: adding VLAN 0 to HW filter on device bond0 [ 691.561743][T20473] 8021q: adding VLAN 0 to HW filter on device team0 [ 691.599897][T20473] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 691.710219][T20473] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 691.723174][T20473] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 691.748333][T20473] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 691.748365][T20473] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 691.760585][T20473] veth1_vlan: left promiscuous mode [ 691.765060][T20473] veth0_vlan: left promiscuous mode [ 691.778191][T20473] veth0_vlan: entered promiscuous mode [ 691.788895][T20473] veth1_vlan: entered promiscuous mode [ 691.812256][T20473] veth1_macvtap: left promiscuous mode [ 691.822887][T20473] veth0_macvtap: left promiscuous mode [ 691.827145][T20473] veth0_macvtap: entered promiscuous mode [ 691.837802][T20473] veth1_macvtap: entered promiscuous mode [ 691.867890][T20473] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 691.872525][T20473] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 691.873593][T20473] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 691.898146][T20473] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 692.053888][ T7583] bridge0: port 1(bridge_slave_0) entered blocking state [ 692.054023][ T7583] bridge0: port 1(bridge_slave_0) entered forwarding state [ 692.081567][ T7583] bridge0: port 2(bridge_slave_1) entered blocking state [ 692.081681][ T7583] bridge0: port 2(bridge_slave_1) entered forwarding state [ 692.274500][T20483] syzkaller1: entered promiscuous mode [ 692.274533][T20483] syzkaller1: entered allmulticast mode [ 692.476707][ T6522] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.479654][ T6522] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.505099][ T1018] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.505156][ T1018] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.544966][T20522] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3375'. [ 692.571527][T20522] netlink: 'syz.4.3375': attribute type 1 has an invalid length. [ 692.790545][T20531] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3378'. [ 693.005888][T20537] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3380'. [ 693.119255][T20545] netlink: 'syz.2.3382': attribute type 4 has an invalid length. [ 693.119284][T20545] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3382'. [ 693.163318][T20545] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 693.817761][T20579] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3389'. [ 693.885577][T20579] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3389'. [ 694.282591][T20593] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 694.318134][T20600] xt_l2tp: v2 doesn't support IP mode [ 694.844530][T20617] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3397'. [ 694.912947][T20621] netlink: 180 bytes leftover after parsing attributes in process `syz.2.3399'. [ 694.943276][T20622] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3397'. [ 695.277583][T20630] ip_tables: iptables: counters copy to user failed while replacing table [ 695.279539][T20627] syzkaller0: entered promiscuous mode [ 695.279571][T20627] syzkaller0: entered allmulticast mode [ 695.650023][T20627] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3400'. [ 697.629888][T20704] __nla_validate_parse: 4 callbacks suppressed [ 697.629915][T20704] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3412'. [ 700.901711][T20671] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 700.911722][T20674] : renamed from bond0 (while UP) [ 701.234926][T20725] ±ÿ†ˆ¬hËdtÍ: renamed from lo (while UP) [ 701.372327][T20724] netlink: 'syz.2.3418': attribute type 2 has an invalid length. [ 701.511643][T20729] syzkaller0: entered promiscuous mode [ 701.511674][T20729] syzkaller0: entered allmulticast mode [ 701.633123][T20737] FAULT_INJECTION: forcing a failure. [ 701.633123][T20737] name failslab, interval 1, probability 0, space 0, times 0 [ 701.633165][T20737] CPU: 0 UID: 0 PID: 20737 Comm: syz.1.3423 Not tainted syzkaller #0 PREEMPT(full) [ 701.633191][T20737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 701.633206][T20737] Call Trace: [ 701.633215][T20737] [ 701.633225][T20737] dump_stack_lvl+0xe8/0x150 [ 701.633267][T20737] should_fail_ex+0x410/0x560 [ 701.633306][T20737] should_failslab+0xa8/0x100 [ 701.633344][T20737] __kvmalloc_node_noprof+0x171/0x820 [ 701.633379][T20737] ? __kvmalloc_node_noprof+0x340/0x820 [ 701.633408][T20737] ? bpf_compute_scc+0xd2/0xb10 [ 701.633433][T20737] ? bpf_compute_scc+0xd2/0xb10 [ 701.633468][T20737] bpf_compute_scc+0xd2/0xb10 [ 701.633517][T20737] bpf_check+0x271e/0x2ef0 [ 701.633561][T20737] ? __pfx_bpf_check+0x10/0x10 [ 701.633589][T20737] ? bpf_obj_name_cpy+0x194/0x1e0 [ 701.633613][T20737] bpf_prog_load+0x14d1/0x1c20 [ 701.633652][T20737] ? __pfx_bpf_prog_load+0x10/0x10 [ 701.633712][T20737] __sys_bpf+0xd0d/0xd90 [ 701.633750][T20737] ? __pfx___sys_bpf+0x10/0x10 [ 701.633791][T20737] ? __fget_files+0x2a/0x420 [ 701.633838][T20737] ? ksys_write+0x242/0x270 [ 701.633867][T20737] ? __pfx_ksys_write+0x10/0x10 [ 701.633901][T20737] __x64_sys_bpf+0xba/0xd0 [ 701.633932][T20737] do_syscall_64+0x166/0x520 [ 701.633956][T20737] ? trace_irq_disable+0x3b/0x140 [ 701.633984][T20737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.634008][T20737] ? clear_bhb_loop+0x70/0xc0 [ 701.634034][T20737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 701.634055][T20737] RIP: 0033:0x7f614f99f559 [ 701.634076][T20737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 701.634096][T20737] RSP: 002b:00007f6150885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 701.634129][T20737] RAX: ffffffffffffffda RBX: 00007f614fc25fa0 RCX: 00007f614f99f559 [ 701.634146][T20737] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 701.634161][T20737] RBP: 00007f6150885090 R08: 0000000000000000 R09: 0000000000000000 [ 701.634175][T20737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 701.634189][T20737] R13: 00007f614fc26038 R14: 00007f614fc25fa0 R15: 00007fff63151808 [ 701.634226][T20737] [ 702.492635][T20761] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3428'. [ 702.869223][T20774] netlink: 'syz.2.3429': attribute type 4 has an invalid length. [ 702.907598][T20774] netlink: 'syz.2.3429': attribute type 4 has an invalid length. [ 703.367332][T20790] FAULT_INJECTION: forcing a failure. [ 703.367332][T20790] name failslab, interval 1, probability 0, space 0, times 0 [ 703.367375][T20790] CPU: 1 UID: 0 PID: 20790 Comm: syz.1.3434 Not tainted syzkaller #0 PREEMPT(full) [ 703.367400][T20790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 703.367415][T20790] Call Trace: [ 703.367424][T20790] [ 703.367434][T20790] dump_stack_lvl+0xe8/0x150 [ 703.367480][T20790] should_fail_ex+0x410/0x560 [ 703.367519][T20790] should_failslab+0xa8/0x100 [ 703.367557][T20790] __kvmalloc_node_noprof+0x171/0x820 [ 703.367591][T20790] ? __kvmalloc_node_noprof+0x340/0x820 [ 703.367621][T20790] ? bpf_compute_scc+0x106/0xb10 [ 703.367648][T20790] ? bpf_compute_scc+0x106/0xb10 [ 703.367683][T20790] bpf_compute_scc+0x106/0xb10 [ 703.367734][T20790] bpf_check+0x271e/0x2ef0 [ 703.367787][T20790] ? __pfx_bpf_check+0x10/0x10 [ 703.367820][T20790] ? bpf_obj_name_cpy+0x194/0x1e0 [ 703.367849][T20790] bpf_prog_load+0x14d1/0x1c20 [ 703.367895][T20790] ? __pfx_bpf_prog_load+0x10/0x10 [ 703.367956][T20790] __sys_bpf+0xd0d/0xd90 [ 703.367996][T20790] ? __pfx___sys_bpf+0x10/0x10 [ 703.368041][T20790] ? __fget_files+0x2a/0x420 [ 703.368085][T20790] ? ksys_write+0x242/0x270 [ 703.368116][T20790] ? __pfx_ksys_write+0x10/0x10 [ 703.368149][T20790] __x64_sys_bpf+0xba/0xd0 [ 703.368181][T20790] do_syscall_64+0x166/0x520 [ 703.368204][T20790] ? trace_irq_disable+0x3b/0x140 [ 703.368231][T20790] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.368254][T20790] ? clear_bhb_loop+0x70/0xc0 [ 703.368283][T20790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.368316][T20790] RIP: 0033:0x7f614f99f559 [ 703.368338][T20790] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.368359][T20790] RSP: 002b:00007f6150885028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 703.368385][T20790] RAX: ffffffffffffffda RBX: 00007f614fc25fa0 RCX: 00007f614f99f559 [ 703.368402][T20790] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 703.368417][T20790] RBP: 00007f6150885090 R08: 0000000000000000 R09: 0000000000000000 [ 703.368431][T20790] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 703.368445][T20790] R13: 00007f614fc26038 R14: 00007f614fc25fa0 R15: 00007fff63151808 [ 703.368482][T20790] [ 703.524349][T20791] netlink: 'syz.2.3433': attribute type 30 has an invalid length. [ 703.753182][T20791] bond0: option arp_missed_max: invalid value (0) [ 703.753217][T20791] bond0: option arp_missed_max: allowed values 1 - 255 [ 703.827738][T20791] bond0 (unregistering): Released all slaves [ 705.319835][T20810] pimreg0: tun_chr_ioctl cmd 1074025677 [ 705.319997][T20810] pimreg0: linktype set to 776 [ 707.230444][ T5295] veth0_macvtap: left promiscuous mode [ 707.263755][T20874] syzkaller1: entered promiscuous mode [ 707.263788][T20874] syzkaller1: entered allmulticast mode [ 708.459941][T20829] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 708.697168][T20886] veth1_to_bond: entered promiscuous mode [ 708.702096][T20886] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3454'. [ 708.733443][T20886] veth1_to_bond (unregistering): left promiscuous mode [ 708.800541][T20886] : (slave bond_slave_1): Releasing backup interface [ 708.802231][T20897] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3458'. [ 708.903499][T20905] x_tables: duplicate underflow at hook 3 [ 708.932141][T20908] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3458'. [ 708.933464][T20897] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3458'. [ 708.984132][T20908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3458'. [ 709.066717][T20908] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3458'. [ 709.067865][T20909] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3458'. [ 709.125167][T20918] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3459'. [ 709.179873][T20920] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3460'. [ 709.628122][T20918] bridge_slave_0: left allmulticast mode [ 709.628156][T20918] bridge_slave_0: left promiscuous mode [ 709.628434][T20918] bridge0: port 1(bridge_slave_0) entered disabled state [ 709.633662][T20944] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3462'. [ 709.689986][T20918] bridge_slave_1: left allmulticast mode [ 709.690019][T20918] bridge_slave_1: left promiscuous mode [ 709.690252][T20918] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.734392][T20918] bond0: (slave bond_slave_0): Releasing backup interface [ 709.772295][T20918] bond0: (slave bond_slave_1): Releasing backup interface [ 709.832676][T20918] team0: Port device team_slave_0 removed [ 709.871481][T20918] team0: Port device team_slave_1 removed [ 709.884265][T20918] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 709.884299][T20918] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 709.906749][T20918] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 709.906783][T20918] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 709.946036][T20918] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 710.604254][T20971] ip_tables: iptables: counters copy to user failed while replacing table [ 710.689679][T20974] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 710.692124][T20973] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 710.793200][T20979] tipc: MTU too low for tipc bearer [ 711.751492][T21021] xt_hashlimit: size too large, truncated to 1048576 [ 711.911631][T21033] netlink: 'syz.2.3484': attribute type 10 has an invalid length. [ 712.335143][T21033] team0 (unregistering): Port device team_slave_0 removed [ 712.392280][T21033] team0 (unregistering): Port device team_slave_1 removed [ 712.927462][T21063] veth5: entered allmulticast mode [ 713.166633][T16385] IPVS: starting estimator thread 0... [ 713.255611][T21077] IPVS: using max 35 ests per chain, 84000 per kthread [ 714.022467][T21123] __nla_validate_parse: 73 callbacks suppressed [ 714.022507][T21123] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3520'. [ 714.024480][T21126] netlink: 'syz.4.3518': attribute type 1 has an invalid length. [ 714.144901][T21121] netlink: 'syz.1.3517': attribute type 16 has an invalid length. [ 714.144928][T21121] netlink: 'syz.1.3517': attribute type 17 has an invalid length. [ 714.174976][T21126] 8021q: adding VLAN 0 to HW filter on device bond4 [ 714.287991][T21140] x_tables: duplicate underflow at hook 1 [ 714.309458][T21136] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3521'. [ 714.397514][T21131] netlink: 192 bytes leftover after parsing attributes in process `syz.3.3521'. [ 714.397560][T21131] ksmbd: Unknown IPC event: 0, ignore. [ 714.404985][T21121] 8021q: adding VLAN 0 to HW filter on device bond0 [ 714.451445][T21121] 8021q: adding VLAN 0 to HW filter on device team0 [ 714.502106][T21121] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 714.504413][T21151] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3524'. [ 714.734332][T21121] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 714.762046][T21121] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 714.781905][T21121] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 714.848524][T21121] veth1_vlan: left promiscuous mode [ 714.868635][T21121] veth0_vlan: left promiscuous mode [ 714.883155][T21121] veth0_vlan: entered promiscuous mode [ 714.894336][T21121] veth1_vlan: entered promiscuous mode [ 714.921786][T21121] veth1_macvtap: left promiscuous mode [ 714.935986][T21121] veth0_macvtap: left promiscuous mode [ 714.944352][T21121] veth0_macvtap: entered promiscuous mode [ 714.957809][T21121] veth1_macvtap: entered promiscuous mode [ 715.013450][T21121] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 715.028984][T21121] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 715.051260][T21121] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 715.069604][T21121] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 715.100426][T21121] geneve2: left promiscuous mode [ 715.162691][T21121] veth5: left allmulticast mode [ 715.199028][T16283] bridge0: port 1(bridge_slave_0) entered blocking state [ 715.199113][T16283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 715.203091][T16283] bridge0: port 2(bridge_slave_1) entered blocking state [ 715.203177][T16283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 715.398909][T21119] lo speed is unknown, defaulting to 1000 [ 715.414482][T21164] syzkaller1: entered promiscuous mode [ 715.414529][T21164] syzkaller1: entered allmulticast mode [ 715.701561][T21184] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3528'. [ 715.781533][T21185] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3530'. [ 715.840048][T21185] tipc: Enabling of bearer rejected, media not registered [ 715.845031][T21185] netlink: 'syz.0.3530': attribute type 1 has an invalid length. [ 715.845061][T21185] nbd: error processing sock list [ 715.859460][T21186] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3528'. [ 715.932510][T21185] block nbd3: shutting down sockets [ 716.014728][T21187] geneve0: entered promiscuous mode [ 716.148308][T21191] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3532'. [ 716.148341][T21191] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3532'. [ 716.325787][T21197] syzkaller0: entered promiscuous mode [ 716.325818][T21197] syzkaller0: entered allmulticast mode [ 716.378636][T21196] Set syz1 is full, maxelem 6117 reached [ 716.479371][T21201] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3536'. [ 716.514641][T21184] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 716.643522][T21207] netlink: 'syz.1.3537': attribute type 6 has an invalid length. [ 716.660669][T21202] bond0: (slave ip6tnl1): The slave device specified does not support setting the MAC address [ 716.661675][T21202] bond0: (slave ip6tnl1): Error -95 calling set_mac_address [ 717.374370][T21221] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 717.432511][T21221] netlink: 'syz.0.3542': attribute type 1 has an invalid length. [ 717.498387][T21221] 8021q: adding VLAN 0 to HW filter on device bond1 [ 717.611093][T21229] bond1: (slave gretap1): making interface the new active one [ 717.624435][T21229] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 718.639688][T16388] IPVS: starting estimator thread 0... [ 718.724115][T21271] Bluetooth: hci0: unsupported parameter 5134 [ 718.724143][T21271] Bluetooth: hci0: unsupported parameter 8192 [ 718.724170][T21271] Bluetooth: hci0: unsupported parameter 5134 [ 718.724259][T21271] Bluetooth: hci0: unsupported parameter 8192 [ 718.726002][T21266] IPVS: using max 24 ests per chain, 57600 per kthread [ 720.238163][T21283] __nla_validate_parse: 3 callbacks suppressed [ 720.238189][T21283] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3556'. [ 721.065000][T21281] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 721.081498][T21284] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 721.082202][T21282] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 721.522341][T21283] bridge_slave_1: left allmulticast mode [ 721.522377][T21283] bridge_slave_1: left promiscuous mode [ 721.522648][T21283] bridge0: port 2(bridge_slave_1) entered disabled state [ 721.561250][T21283] bridge_slave_0: left allmulticast mode [ 721.561329][T21283] bridge_slave_0: left promiscuous mode [ 721.561619][T21283] bridge0: port 1(bridge_slave_0) entered disabled state [ 721.698290][T21300] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3561'. [ 721.877115][T21304] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3561'. [ 721.915066][T21313] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3561'. [ 722.060985][T21319] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3561'. [ 722.404524][T21339] xt_IDLETIMER: timeout value is zero [ 722.410072][T21329] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3563'. [ 722.447025][T21328] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3564'. [ 722.481899][T21334] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3564'. [ 722.481933][T21334] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3564'. [ 722.483555][T21331] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3563'. [ 722.584303][T21329] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 722.637126][T21329] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 722.693693][T21342] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 722.980423][T21360] netlink: 'syz.4.3570': attribute type 1 has an invalid length. [ 723.689638][T21390] batadv0: entered promiscuous mode [ 723.689669][T21390] batadv0: entered allmulticast mode [ 723.694607][T21390] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 723.957974][T21404] netlink: 'syz.0.3579': attribute type 1 has an invalid length. [ 723.962004][T21406] netlink: 'syz.3.3581': attribute type 1 has an invalid length. [ 723.965679][T21404] netlink: 'syz.0.3579': attribute type 11 has an invalid length. [ 724.039474][T21406] netlink: 'syz.3.3581': attribute type 2 has an invalid length. [ 724.570287][T21423] syzkaller1: entered promiscuous mode [ 724.570318][T21423] syzkaller1: entered allmulticast mode [ 724.781646][T21448] netlink: 'syz.3.3589': attribute type 21 has an invalid length. [ 724.797339][ T31] audit: type=1800 audit(1793275361.690:17): pid=21449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3589" name="blkio.bfq.time_recursive" dev="tmpfs" ino=226 res=0 errno=-22 [ 725.101555][T21457] macsec1: entered promiscuous mode [ 725.101927][T21457] bridge0: port 1(macsec1) entered blocking state [ 725.105092][T21457] bridge0: port 1(macsec1) entered disabled state [ 725.111345][T21457] macsec1: entered allmulticast mode [ 725.163924][T21457] macsec1: left allmulticast mode [ 725.328744][T21477] FAULT_INJECTION: forcing a failure. [ 725.328744][T21477] name failslab, interval 1, probability 0, space 0, times 0 [ 725.328786][T21477] CPU: 0 UID: 0 PID: 21477 Comm: syz.2.3593 Not tainted syzkaller #0 PREEMPT(full) [ 725.328812][T21477] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 725.328830][T21477] Call Trace: [ 725.328839][T21477] [ 725.328850][T21477] dump_stack_lvl+0xe8/0x150 [ 725.328894][T21477] should_fail_ex+0x410/0x560 [ 725.328935][T21477] should_failslab+0xa8/0x100 [ 725.328973][T21477] __kmalloc_node_track_caller_noprof+0xf6/0x720 [ 725.329006][T21477] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 725.329032][T21477] ? realloc_array+0x76/0x130 [ 725.329064][T21477] ? realloc_array+0x76/0x130 [ 725.329100][T21477] ? realloc_array+0x76/0x130 [ 725.329134][T21477] krealloc_node_align_noprof+0x19a/0x390 [ 725.329167][T21477] ? rcu_is_watching+0x16/0xb0 [ 725.329203][T21477] realloc_array+0x76/0x130 [ 725.329240][T21477] check_stack_access_within_bounds+0x6ef/0xb80 [ 725.329280][T21477] ? __pfx_check_stack_access_within_bounds+0x10/0x10 [ 725.329311][T21477] ? diag_append_history+0x12c/0x520 [ 725.329349][T21477] check_mem_access+0xa24/0x2700 [ 725.329392][T21477] ? __pfx_check_mem_access+0x10/0x10 [ 725.329433][T21477] ? number+0xc60/0xed0 [ 725.329474][T21477] ? __pfx_number+0x10/0x10 [ 725.329510][T21477] check_store_reg+0x664/0xe20 [ 725.329560][T21477] do_check_insn+0x919/0x17d00 [ 725.329599][T21477] ? vscnprintf+0x5c/0x90 [ 725.329630][T21477] ? bpf_verifier_vlog+0x3d1/0x900 [ 725.329663][T21477] ? format_decode+0xdc/0xda0 [ 725.329691][T21477] ? vsnprintf+0x3a0/0xef0 [ 725.329721][T21477] ? __asan_memcpy+0x40/0x70 [ 725.329752][T21477] ? __pfx_do_check_insn+0x10/0x10 [ 725.329798][T21477] ? vscnprintf+0x5c/0x90 [ 725.329828][T21477] ? bpf_verifier_vlog+0x3d1/0x900 [ 725.329868][T21477] ? verbose+0x11d/0x1a0 [ 725.329892][T21477] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 725.329923][T21477] ? __pfx_verbose+0x10/0x10 [ 725.329951][T21477] ? bpf_vlog_reset+0x1db/0x340 [ 725.329981][T21477] ? print_insn_state+0x106/0x170 [ 725.330011][T21477] do_check_common+0x363e/0x5660 [ 725.330086][T21477] ? __pfx_do_check_common+0x10/0x10 [ 725.330117][T21477] ? __pfx_verbose+0x10/0x10 [ 725.330138][T21477] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 725.330174][T21477] do_check_main+0xa2/0x1f0 [ 725.330205][T21477] bpf_check+0x2775/0x2ef0 [ 725.330249][T21477] ? __pfx_bpf_check+0x10/0x10 [ 725.330279][T21477] ? bpf_obj_name_cpy+0x194/0x1e0 [ 725.330304][T21477] bpf_prog_load+0x14d1/0x1c20 [ 725.330348][T21477] ? __pfx_bpf_prog_load+0x10/0x10 [ 725.330408][T21477] __sys_bpf+0xd0d/0xd90 [ 725.330458][T21477] ? __pfx___sys_bpf+0x10/0x10 [ 725.330501][T21477] ? __fget_files+0x2a/0x420 [ 725.330544][T21477] ? ksys_write+0x242/0x270 [ 725.330575][T21477] ? __pfx_ksys_write+0x10/0x10 [ 725.330608][T21477] __x64_sys_bpf+0xba/0xd0 [ 725.330639][T21477] do_syscall_64+0x166/0x520 [ 725.330661][T21477] ? trace_irq_disable+0x3b/0x140 [ 725.330688][T21477] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.330711][T21477] ? clear_bhb_loop+0x70/0xc0 [ 725.330739][T21477] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.330761][T21477] RIP: 0033:0x7f439bb9f559 [ 725.330784][T21477] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.330805][T21477] RSP: 002b:00007f439ca42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 725.330831][T21477] RAX: ffffffffffffffda RBX: 00007f439be25fa0 RCX: 00007f439bb9f559 [ 725.330848][T21477] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 725.330862][T21477] RBP: 00007f439ca42090 R08: 0000000000000000 R09: 0000000000000000 [ 725.330877][T21477] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 725.330891][T21477] R13: 00007f439be26038 R14: 00007f439be25fa0 R15: 00007ffe66436648 [ 725.330928][T21477] [ 725.828808][T21481] __nla_validate_parse: 9 callbacks suppressed [ 725.828835][T21481] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3595'. [ 725.862093][T21481] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3595'. [ 725.918378][T21488] netlink: 'syz.2.3595': attribute type 1 has an invalid length. [ 725.979250][T21486] ip_tables: iptables: counters copy to user failed while replacing table [ 726.346324][T21502] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3599'. [ 726.383161][T21504] xt_hashlimit: size too large, truncated to 1048576 [ 726.383795][T21505] xt_hashlimit: size too large, truncated to 1048576 [ 726.584675][T21512] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3603'. [ 726.803468][T21518] ip6gretap1: entered allmulticast mode [ 726.814611][T21518] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 726.831816][T21518] batman_adv: batadv0: Adding interface: ip6gretap1 [ 726.831841][T21518] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 726.831879][T21518] batman_adv: batadv0: Interface activated: ip6gretap1 [ 727.141740][T21527] FAULT_INJECTION: forcing a failure. [ 727.141740][T21527] name failslab, interval 1, probability 0, space 0, times 0 [ 727.141791][T21527] CPU: 1 UID: 0 PID: 21527 Comm: syz.0.3605 Not tainted syzkaller #0 PREEMPT(full) [ 727.141817][T21527] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 727.141832][T21527] Call Trace: [ 727.141841][T21527] [ 727.141852][T21527] dump_stack_lvl+0xe8/0x150 [ 727.141896][T21527] should_fail_ex+0x410/0x560 [ 727.141937][T21527] should_failslab+0xa8/0x100 [ 727.141976][T21527] __kmalloc_cache_noprof+0x9e/0x600 [ 727.142006][T21527] ? bpf_mark_reg_not_init+0x5f/0x1c0 [ 727.142034][T21527] ? bpf_is_state_visited+0x2e49/0x48b0 [ 727.142061][T21527] ? bpf_is_state_visited+0x2e49/0x48b0 [ 727.142098][T21527] bpf_is_state_visited+0x2e49/0x48b0 [ 727.142171][T21527] do_check_common+0x2272/0x5660 [ 727.142249][T21527] ? __pfx_do_check_common+0x10/0x10 [ 727.142282][T21527] ? __pfx_verbose+0x10/0x10 [ 727.142305][T21527] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 727.142346][T21527] do_check_main+0xa2/0x1f0 [ 727.142380][T21527] bpf_check+0x2775/0x2ef0 [ 727.142431][T21527] ? __pfx_bpf_check+0x10/0x10 [ 727.142464][T21527] ? bpf_obj_name_cpy+0x194/0x1e0 [ 727.142493][T21527] bpf_prog_load+0x14d1/0x1c20 [ 727.142539][T21527] ? __pfx_bpf_prog_load+0x10/0x10 [ 727.142601][T21527] __sys_bpf+0xd0d/0xd90 [ 727.142641][T21527] ? __pfx___sys_bpf+0x10/0x10 [ 727.142685][T21527] ? __fget_files+0x2a/0x420 [ 727.142730][T21527] ? ksys_write+0x242/0x270 [ 727.142771][T21527] ? __pfx_ksys_write+0x10/0x10 [ 727.142804][T21527] __x64_sys_bpf+0xba/0xd0 [ 727.142835][T21527] do_syscall_64+0x166/0x520 [ 727.142858][T21527] ? trace_irq_disable+0x3b/0x140 [ 727.142886][T21527] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.142909][T21527] ? clear_bhb_loop+0x70/0xc0 [ 727.142938][T21527] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.142961][T21527] RIP: 0033:0x7f158519f559 [ 727.142984][T21527] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.143005][T21527] RSP: 002b:00007f15860a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 727.143031][T21527] RAX: ffffffffffffffda RBX: 00007f1585425fa0 RCX: 00007f158519f559 [ 727.143049][T21527] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 727.143063][T21527] RBP: 00007f15860a5090 R08: 0000000000000000 R09: 0000000000000000 [ 727.143078][T21527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 727.143092][T21527] R13: 00007f1585426038 R14: 00007f1585425fa0 R15: 00007ffeb26ca228 [ 727.143129][T21527] [ 727.859139][T21546] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3611'. [ 727.918787][T21550] netlink: zone id is out of range [ 727.918816][T21550] netlink: zone id is out of range [ 727.918826][T21550] netlink: zone id is out of range [ 727.918836][T21550] netlink: zone id is out of range [ 727.918845][T21550] netlink: zone id is out of range [ 727.918854][T21550] netlink: zone id is out of range [ 727.918864][T21550] netlink: zone id is out of range [ 727.918872][T21550] netlink: zone id is out of range [ 727.918882][T21550] netlink: zone id is out of range [ 727.918890][T21550] netlink: zone id is out of range [ 728.821659][T21572] netlink: 'syz.4.3617': attribute type 23 has an invalid length. [ 728.823541][T21572] netlink: 'syz.4.3617': attribute type 9 has an invalid length. [ 728.823845][T21572] netlink: 296 bytes leftover after parsing attributes in process `syz.4.3617'. [ 728.825148][T21572] netlink: 'syz.4.3617': attribute type 23 has an invalid length. [ 728.857092][T21572] netlink: 296 bytes leftover after parsing attributes in process `syz.4.3617'. [ 728.858571][T21575] netlink: 'syz.4.3617': attribute type 9 has an invalid length. [ 730.689411][T21536] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 731.539011][T21621] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3627'. [ 732.094497][T21646] xt_CT: No such helper "snmp" [ 732.303082][T21658] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3636'. [ 732.398570][T21663] netlink: 'syz.2.3636': attribute type 1 has an invalid length. [ 732.533920][T21669] netlink: 'syz.4.3640': attribute type 1 has an invalid length. [ 732.642400][T21669] 8021q: adding VLAN 0 to HW filter on device bond5 [ 732.653162][T21667] syzkaller0: entered promiscuous mode [ 732.653191][T21667] syzkaller0: entered allmulticast mode [ 733.132526][T21699] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3647'. [ 733.179352][T21705] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3649'. [ 733.381956][T21723] ebt_among: wrong size: 2136 against expected 1092, rounded to 1096 [ 733.384587][T21725] ebt_among: wrong size: 2136 against expected 1092, rounded to 1096 [ 733.663945][T21719] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3653'. [ 734.127701][T21782] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3656'. [ 734.130650][T21796] netlink: 'syz.0.3657': attribute type 83 has an invalid length. [ 734.704477][T21826] xt_hashlimit: size too large, truncated to 1048576 [ 734.763541][T21822] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3662'. [ 736.271202][T21857] bridge_slave_0: left allmulticast mode [ 736.271242][T21857] bridge_slave_0: left promiscuous mode [ 736.271496][T21857] bridge0: port 1(bridge_slave_0) entered disabled state [ 736.605725][T21860] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3675'. [ 736.884264][T21845] lo speed is unknown, defaulting to 1000 [ 738.304074][T21925] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3691'. [ 738.427384][T21931] ip6t_rt: unknown flags 1F [ 738.564687][T21931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3692'. [ 738.618281][T21931] IPv6: sit1: Disabled Multicast RS [ 739.564050][T21971] netlink: 'syz.1.3702': attribute type 1 has an invalid length. [ 739.643904][T21974] netlink: 'syz.1.3702': attribute type 1 has an invalid length. [ 739.711416][T21977] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3705'. [ 740.635690][T21958] lo speed is unknown, defaulting to 1000 [ 740.991255][T22025] netlink: 'syz.1.3716': attribute type 1 has an invalid length. [ 740.992722][T22023] netlink: 'syz.4.3715': attribute type 1 has an invalid length. [ 741.054285][T22026] xt_hashlimit: size too large, truncated to 1048576 [ 741.194643][T22033] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3717'. [ 741.772231][T22059] FAULT_INJECTION: forcing a failure. [ 741.772231][T22059] name failslab, interval 1, probability 0, space 0, times 0 [ 741.772287][T22059] CPU: 0 UID: 0 PID: 22059 Comm: syz.4.3725 Not tainted syzkaller #0 PREEMPT(full) [ 741.772311][T22059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 741.772326][T22059] Call Trace: [ 741.772335][T22059] [ 741.772345][T22059] dump_stack_lvl+0xe8/0x150 [ 741.772386][T22059] should_fail_ex+0x410/0x560 [ 741.772427][T22059] should_failslab+0xa8/0x100 [ 741.772468][T22059] __kvmalloc_node_noprof+0x171/0x820 [ 741.772503][T22059] ? bpf_jit_binary_pack_alloc+0x10a/0x300 [ 741.772535][T22059] ? bpf_jit_binary_pack_alloc+0x10a/0x300 [ 741.772576][T22059] bpf_jit_binary_pack_alloc+0x10a/0x300 [ 741.772610][T22059] ? __pfx_jit_fill_hole+0x10/0x10 [ 741.772648][T22059] bpf_int_jit_compile+0xa11/0x17d0 [ 741.772700][T22059] ? __pfx_bpf_int_jit_compile+0x10/0x10 [ 741.772735][T22059] ? rcu_is_watching+0x16/0xb0 [ 741.772764][T22059] ? trace_kmalloc+0x2a/0xf0 [ 741.772824][T22059] __bpf_prog_select_runtime+0x53d/0xc30 [ 741.772847][T22059] ? convert_pseudo_ld_imm64+0x386/0x420 [ 741.772883][T22059] bpf_check+0x2527/0x2ef0 [ 741.772929][T22059] ? __pfx_bpf_check+0x10/0x10 [ 741.772959][T22059] ? bpf_obj_name_cpy+0x194/0x1e0 [ 741.772987][T22059] bpf_prog_load+0x14d1/0x1c20 [ 741.773032][T22059] ? __pfx_bpf_prog_load+0x10/0x10 [ 741.773092][T22059] __sys_bpf+0xd0d/0xd90 [ 741.773129][T22059] ? __pfx___sys_bpf+0x10/0x10 [ 741.773171][T22059] ? __fget_files+0x2a/0x420 [ 741.773224][T22059] ? ksys_write+0x242/0x270 [ 741.773255][T22059] ? __pfx_ksys_write+0x10/0x10 [ 741.773286][T22059] __x64_sys_bpf+0xba/0xd0 [ 741.773316][T22059] do_syscall_64+0x166/0x520 [ 741.773338][T22059] ? trace_irq_disable+0x3b/0x140 [ 741.773365][T22059] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.773389][T22059] ? clear_bhb_loop+0x70/0xc0 [ 741.773417][T22059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 741.773440][T22059] RIP: 0033:0x7f2b3399f559 [ 741.773461][T22059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 741.773482][T22059] RSP: 002b:00007f2b348da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 741.773508][T22059] RAX: ffffffffffffffda RBX: 00007f2b33c25fa0 RCX: 00007f2b3399f559 [ 741.773523][T22059] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 741.773537][T22059] RBP: 00007f2b348da090 R08: 0000000000000000 R09: 0000000000000000 [ 741.773551][T22059] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 741.773563][T22059] R13: 00007f2b33c26038 R14: 00007f2b33c25fa0 R15: 00007ffce91d1358 [ 741.773600][T22059] [ 743.341936][T22088] bond1: entered allmulticast mode [ 743.369504][T22098] macvlan2: entered promiscuous mode [ 743.369527][T22098] macvlan2: entered allmulticast mode [ 743.370555][T22098] bond1: entered promiscuous mode [ 743.373008][T22098] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 743.404218][T22098] bond1: left promiscuous mode [ 743.850392][T22101] netlink: 'syz.1.3738': attribute type 16 has an invalid length. [ 743.850424][T22101] netlink: 'syz.1.3738': attribute type 17 has an invalid length. [ 743.915206][T22122] xt_IDLETIMER: timeout value is too big [ 744.079868][T22101] ip6gretap1: left allmulticast mode [ 744.240809][T22130] bridge0: port 3(team0) entered blocking state [ 744.240914][T22130] bridge0: port 3(team0) entered disabled state [ 744.241166][T22130] team0: entered allmulticast mode [ 744.241189][T22130] team_slave_1: entered allmulticast mode [ 744.293214][T22130] team0: entered promiscuous mode [ 744.303845][T22130] team_slave_0: entered promiscuous mode [ 744.304092][T22130] team_slave_1: entered promiscuous mode [ 744.321086][T22130] bridge0: port 3(team0) entered blocking state [ 744.321191][T22130] bridge0: port 3(team0) entered forwarding state [ 744.447930][T19322] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 744.448222][T19322] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 744.476300][T10808] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 744.706722][T22146] gretap1: entered promiscuous mode [ 745.083382][T22161] net_ratelimit: 700 callbacks suppressed [ 745.091444][T22161] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 745.148112][T22161] netlink: 'syz.4.3752': attribute type 1 has an invalid length. [ 745.184291][T22164] netlink: 'syz.3.3753': attribute type 34 has an invalid length. [ 745.184319][T22164] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3753'. [ 745.214710][T22161] 8021q: adding VLAN 0 to HW filter on device bond7 [ 745.308261][T10810] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 745.333967][T22166] bond7: entered promiscuous mode [ 745.334000][T22166] bond7: entered allmulticast mode [ 745.466659][T10810] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 745.467618][T22177] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 745.545251][T22177] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 745.586686][T22177] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 745.609743][T22177] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 745.647805][T22177] bond0 (unregistering): Released all slaves [ 745.694151][T22178] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 745.917499][T22188] bridge1: entered promiscuous mode [ 745.917529][T22188] bridge1: entered allmulticast mode [ 746.384806][T22216] netlink: 'syz.2.3765': attribute type 1 has an invalid length. [ 746.759005][T22235] syz.4.3769 (22235) used obsolete PPPIOCDETACH ioctl [ 746.927125][T22244] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3770'. [ 747.031332][T22244] 8021q: adding VLAN 0 to HW filter on device bond2 [ 747.178952][T22259] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 747.322650][T22265] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3778'. [ 747.322686][T22265] netlink: 'syz.3.3778': attribute type 1 has an invalid length. [ 747.322704][T22265] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3778'. [ 747.324991][T22263] netlink: 'syz.0.3777': attribute type 1 has an invalid length. [ 747.325019][T22263] netlink: 'syz.0.3777': attribute type 2 has an invalid length. [ 747.403341][T22265] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3778'. [ 747.451252][T22268] ip_tables: iptables: counters copy to user failed while replacing table [ 747.679878][T22281] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3780'. [ 748.825811][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 748.900425][T22333] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3794'. [ 748.936017][T16385] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 748.941750][T19322] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 748.941913][T19322] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 748.942075][T19322] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.456999][T22274] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 750.458849][T22319] netlink: 'syz.3.3791': attribute type 12 has an invalid length. [ 750.612075][T22341] FAULT_INJECTION: forcing a failure. [ 750.612075][T22341] name failslab, interval 1, probability 0, space 0, times 0 [ 750.612148][T22341] CPU: 1 UID: 0 PID: 22341 Comm: syz.3.3797 Not tainted syzkaller #0 PREEMPT(full) [ 750.612172][T22341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 750.612186][T22341] Call Trace: [ 750.612194][T22341] [ 750.612204][T22341] dump_stack_lvl+0xe8/0x150 [ 750.612244][T22341] should_fail_ex+0x410/0x560 [ 750.612289][T22341] should_failslab+0xa8/0x100 [ 750.612323][T22341] ? radix_tree_node_alloc+0x82/0x3a0 [ 750.612346][T22341] kmem_cache_alloc_noprof+0x9c/0x600 [ 750.612371][T22341] ? __add_to_free_list+0x1ea/0x400 [ 750.612394][T22341] ? radix_tree_node_alloc+0x82/0x3a0 [ 750.612424][T22341] radix_tree_node_alloc+0x82/0x3a0 [ 750.612451][T22341] idr_get_free+0x28f/0xa10 [ 750.612484][T22341] idr_alloc_u32+0x18a/0x330 [ 750.612605][T22341] ? __pfx_idr_alloc_u32+0x10/0x10 [ 750.612634][T22341] ? do_raw_spin_lock+0x12b/0x2f0 [ 750.612675][T22341] idr_alloc_cyclic+0x9c/0x1b0 [ 750.612708][T22341] bpf_prog_alloc_id+0x42/0x100 [ 750.612745][T22341] bpf_prog_load+0x1509/0x1c20 [ 750.612790][T22341] ? __pfx_bpf_prog_load+0x10/0x10 [ 750.612851][T22341] __sys_bpf+0xd0d/0xd90 [ 750.612888][T22341] ? __pfx___sys_bpf+0x10/0x10 [ 750.612929][T22341] ? __fget_files+0x2a/0x420 [ 750.612972][T22341] ? ksys_write+0x242/0x270 [ 750.613002][T22341] ? __pfx_ksys_write+0x10/0x10 [ 750.613036][T22341] __x64_sys_bpf+0xba/0xd0 [ 750.613066][T22341] do_syscall_64+0x166/0x520 [ 750.613089][T22341] ? trace_irq_disable+0x3b/0x140 [ 750.613117][T22341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.613140][T22341] ? clear_bhb_loop+0x70/0xc0 [ 750.613169][T22341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.613191][T22341] RIP: 0033:0x7f41ad79f559 [ 750.613214][T22341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 750.613234][T22341] RSP: 002b:00007f41ae6d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 750.613267][T22341] RAX: ffffffffffffffda RBX: 00007f41ada25fa0 RCX: 00007f41ad79f559 [ 750.613284][T22341] RDX: 0000000000000094 RSI: 0000200000000b80 RDI: 0000000000000005 [ 750.613299][T22341] RBP: 00007f41ae6d0090 R08: 0000000000000000 R09: 0000000000000000 [ 750.613313][T22341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 750.613327][T22341] R13: 00007f41ada26038 R14: 00007f41ada25fa0 R15: 00007ffcc639edd8 [ 750.613365][T22341] [ 751.593882][T22372] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3807'. [ 751.593930][T22372] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3807'. [ 751.615124][T22370] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3805'. [ 752.063894][T22391] netlink: 45349 bytes leftover after parsing attributes in process `syz.3.3809'. [ 752.064095][T22391] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 752.129593][T22391] 0ªX¹¦Dö»: entered allmulticast mode [ 752.238236][T22390] bond3: option lp_interval: invalid value (0) [ 752.238267][T22390] bond3: option lp_interval: allowed values 1 - 2147483647 [ 752.264493][T22390] bond3 (unregistering): Released all slaves [ 752.454962][T22402] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3813'. [ 752.469783][T22402] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3813'. [ 752.486418][T22402] netlink: 868 bytes leftover after parsing attributes in process `syz.0.3813'. [ 752.756602][T22417] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3815'. [ 752.860638][T22419] netlink: 'syz.4.3814': attribute type 1 has an invalid length. [ 752.860699][T22419] netlink: 248 bytes leftover after parsing attributes in process `syz.4.3814'. [ 753.169136][T16385] IPVS: starting estimator thread 0... [ 753.171386][T22431] netlink: 'syz.2.3818': attribute type 1 has an invalid length. [ 753.236573][T22433] netlink: 'syz.2.3818': attribute type 1 has an invalid length. [ 753.237731][T22433] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3818'. [ 753.260557][T22432] IPVS: using max 29 ests per chain, 69600 per kthread [ 753.770836][T22452] bond8: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 753.789024][T22452] bond8 (unregistering): Released all slaves [ 754.074674][T22461] syzkaller0: entered promiscuous mode [ 754.081407][T22461] syzkaller0: entered allmulticast mode [ 754.105309][T22461] tipc: Started in network mode [ 754.107445][T22461] tipc: Node identity b6012432fc1, cluster identity 4711 [ 754.117065][T22461] tipc: Enabled bearer , priority 0 [ 754.667768][T22469] ip6t_srh: unknown srh invflags BA61 [ 754.675233][T22496] sctp: [Deprecated]: syz.4.3830 (pid 22496) Use of int in max_burst socket option deprecated. [ 754.675233][T22496] Use struct sctp_assoc_value instead [ 754.726241][T22499] ip_tables: iptables: counters copy to user failed while replacing table [ 755.226121][T18269] tipc: Node number set to 1242637362 [ 755.276978][ T54] Bluetooth: hci1: link tx timeout [ 755.277007][ T54] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 755.409081][T22520] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 755.426670][T22524] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 755.939869][T22533] openvswitch: netlink: Key type 7430 is out of range max 32 [ 757.305544][ T5641] Bluetooth: hci1: command 0x0406 tx timeout [ 757.555746][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 757.561018][T22487] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 757.620654][T22540] netlink: 'syz.3.3840': attribute type 12 has an invalid length. [ 757.671390][T22546] __nla_validate_parse: 38 callbacks suppressed [ 757.671418][T22546] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3841'. [ 757.765976][T22550] netlink: 'syz.1.3842': attribute type 15 has an invalid length. [ 757.766004][T22550] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3842'. [ 757.774748][T22550] netlink: 'syz.1.3842': attribute type 15 has an invalid length. [ 757.774774][T22550] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3842'. [ 757.917668][ T984] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 757.918093][ T984] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 757.918440][ T984] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 759.042780][ T5295] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 759.554078][T22618] syzkaller0: entered promiscuous mode [ 759.554109][T22618] syzkaller0: entered allmulticast mode [ 759.596451][T22623] ip6t_frag: unknown flags 4 [ 759.673179][T22630] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3863'. [ 759.932457][T22643] sctp: [Deprecated]: syz.0.3866 (pid 22643) Use of int in max_burst socket option. [ 759.932457][T22643] Use struct sctp_assoc_value instead [ 760.353215][T22661] 8021q: VLANs not supported on ip6tnl0 [ 760.473552][T22673] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3874'. [ 760.605889][T22679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3876'. [ 760.673286][T22679] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 760.732826][T22679] bond1 (unregistering): Released all slaves [ 760.999321][T22693] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3880'. [ 760.999363][T22693] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3880'. [ 761.049091][T22693] bond8: up delay (10) is not a multiple of miimon (7), value rounded to 7 ms [ 761.054830][T22693] bond8 (unregistering): Released all slaves [ 761.342749][T22711] netlink: 'syz.4.3887': attribute type 1 has an invalid length. [ 761.342779][T22711] netlink: 'syz.4.3887': attribute type 2 has an invalid length. [ 761.344809][T22711] netlink: del zone limit has 4 unknown bytes [ 761.406610][T22711] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3887'. [ 761.444144][T22703] ip_tables: iptables: counters copy to user failed while replacing table [ 762.826656][T22746] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3894'. [ 762.831998][T22746] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3894'. [ 762.855024][T22753] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3893'. [ 762.860907][T22746] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 762.956554][T22760] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3894'. [ 763.040836][T22763] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3894'. [ 763.250825][T22760] hsr_slave_1 (unregistering): left promiscuous mode [ 763.618720][T22788] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3899'. [ 763.622281][T22791] tipc: Enabling of bearer rejected, failed to enable media [ 764.029495][T22821] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3908'. [ 764.457777][ T7585] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 765.030392][T22863] netlink: 'syz.2.3916': attribute type 4 has an invalid length. [ 765.030425][T22863] netlink: 17 bytes leftover after parsing attributes in process `syz.2.3916'. [ 767.633684][T22840] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 768.015352][T22895] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3919'. [ 768.084622][T22887] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3919'. [ 768.084657][T22887] netlink: 120 bytes leftover after parsing attributes in process `syz.3.3919'. [ 768.084676][T22887] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3919'. [ 768.609255][T22908] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3928'. [ 768.609290][T22908] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3928'. [ 768.650384][T22908] netlink: 220 bytes leftover after parsing attributes in process `syz.1.3928'. [ 768.650415][T22908] tc_dump_action: action bad kind [ 768.835628][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 769.028030][T22915] netlink: 'syz.1.3929': attribute type 1 has an invalid length. [ 769.184995][T22915] 8021q: adding VLAN 0 to HW filter on device bond1 [ 769.719121][T22918] bond1: entered allmulticast mode [ 769.732176][T22918] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3929'. [ 770.967127][T22956] netlink: 165 bytes leftover after parsing attributes in process `syz.4.3939'. [ 771.030334][T22960] netlink: 165 bytes leftover after parsing attributes in process `syz.4.3939'. [ 771.999485][T22982] syzkaller0: left promiscuous mode [ 771.999515][T22982] syzkaller0: left allmulticast mode [ 772.060941][T22976] IPVS: persistence engine module ip_vs_pe_À not found [ 773.223013][T23006] netlink: 'syz.1.3956': attribute type 12 has an invalid length. [ 773.223045][T23006] netlink: 'syz.1.3956': attribute type 5 has an invalid length. [ 773.377948][T23007] bond0 (unregistering): Released all slaves [ 773.769334][T23021] __nla_validate_parse: 3 callbacks suppressed [ 773.769363][T23021] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3959'. [ 774.279431][T23033] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3962'. [ 774.937708][ C1] sched: DL replenish lagged too much [ 775.244690][T23055] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 775.466092][ C0] ip6_tunnel: syztnl1 xmit: Local address not yet configured! [ 775.606316][T23065] ip_tables: iptables: counters copy to user failed while replacing table [ 775.809967][ T54] Bluetooth: hci1: SCO packet too small [ 775.929911][T23069] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3969'. [ 775.974367][T23073] nbd: socks must be embedded in a SOCK_ITEM attr [ 776.318853][T23080] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3972'. [ 776.318903][T23080] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3972'. [ 776.471805][T23078] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3972'. [ 776.471852][T23078] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3972'. [ 777.044417][T23094] syzkaller0: entered promiscuous mode [ 777.044449][T23094] syzkaller0: entered allmulticast mode [ 777.973899][T23098] bond8: entered allmulticast mode [ 777.984066][T23098] 8021q: adding VLAN 0 to HW filter on device bond8 [ 778.014880][T23098] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3976'. [ 778.014928][T23098] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3976'. [ 778.034299][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 778.307755][T23107] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3978'. [ 778.713491][T23122] ip_tables: iptables: counters copy to user failed while replacing table [ 778.768028][T23123] netlink: 'syz.2.3980': attribute type 10 has an invalid length. [ 778.841957][T23123] dummy0: entered promiscuous mode [ 779.430679][T23125] netlink: 'syz.4.3981': attribute type 39 has an invalid length. [ 781.119930][T23161] tipc: Started in network mode [ 781.121762][T23161] tipc: Node identity ca3b66fdd7b1, cluster identity 4711 [ 781.121990][T23161] tipc: Enabled bearer , priority 0 [ 781.579240][ C1] af_packet: tpacket_rcv: packet too big, clamped from 58 to 4294967286. macoff=82 [ 782.459756][T10810] tipc: Node number set to 495609597 [ 782.618428][T23160] tipc: Disabling bearer [ 783.518720][T23193] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 784.135909][T23223] __nla_validate_parse: 3 callbacks suppressed [ 784.135935][T23223] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3998'. [ 784.464522][T23228] netlink: 'syz.0.4000': attribute type 10 has an invalid length. [ 784.507556][T23228] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 784.514612][T23228] team0: Port device netdevsim1 added [ 784.595083][T23232] netlink: 'syz.0.4000': attribute type 10 has an invalid length. [ 784.663987][T23232] team0: Port device netdevsim1 removed [ 784.685928][T23232] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 784.691320][T23232] bond0: (slave netdevsim1): Enslaving as an active interface with a down link [ 785.088803][T23243] netlink: 'syz.2.4004': attribute type 5 has an invalid length. [ 785.091799][T23243] netlink: 'syz.2.4004': attribute type 1 has an invalid length. [ 785.370881][T23247] syzkaller0: entered promiscuous mode [ 785.370952][T23247] syzkaller0: entered allmulticast mode [ 785.563612][T23250] syzkaller1: entered promiscuous mode [ 785.563643][T23250] syzkaller1: entered allmulticast mode [ 786.744152][T23266] IPVS: set_ctl: invalid protocol: 46 100.1.1.1:20000 [ 786.780814][T23266] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4012'. [ 787.224640][T23257] bond2: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 787.331151][T23257] bond2 (unregistering): Released all slaves [ 788.318103][T23288] xt_CT: No such helper "netbios-ns" [ 788.459407][T23294] netlink: 'syz.4.4017': attribute type 1 has an invalid length. [ 788.502763][T23294] 8021q: adding VLAN 0 to HW filter on device bond9 [ 788.604529][T23298] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4017'. [ 789.798109][T23313] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4019'. [ 790.013178][T23322] syzkaller0: entered promiscuous mode [ 790.013208][T23322] syzkaller0: entered allmulticast mode [ 792.339213][T23362] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4029'. [ 792.371531][T23362] ip6erspan0: entered promiscuous mode [ 792.810250][T23365] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.057959][T23365] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 793.945215][T23365] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 794.330226][T23374] netlink: 'syz.4.4033': attribute type 10 has an invalid length. [ 794.417071][T16386] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 794.417119][T16386] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.417174][T16386] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 794.417206][T16386] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.417252][T16386] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 794.417284][T16386] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 794.730475][T23384] netlink: 'syz.4.4036': attribute type 15 has an invalid length. [ 794.730616][T23384] netlink: 666 bytes leftover after parsing attributes in process `syz.4.4036'. [ 795.018343][T23392] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4037'. [ 795.018395][T23392] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4037'. [ 795.806910][T23400] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4040'. [ 796.591894][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 833.713274][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 885.001790][ T54] Bluetooth: hci1: command 0x0406 tx timeout [ 911.791881][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 942.285283][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 942.292320][ C0] rcu: (detected by 0, t=10502 jiffies, g=131273, q=968578 ncpus=2) [ 942.300463][ C0] rcu: All QSes seen, last rcu_preempt kthread activity 1780 (4295031275-4295029495), jiffies_till_next_fqs=1, root ->qsmask 0x0 [ 942.313927][ C0] rcu: rcu_preempt kthread starved for 1781 jiffies! g131273 f0x2 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=0 [ 942.325031][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 942.335062][ C0] rcu: RCU grace-period kthread stack dump: [ 942.341012][ C0] task:rcu_preempt state:R running task stack:27496 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 942.354590][ C0] Call Trace: [ 942.357919][ C0] [ 942.360925][ C0] __schedule+0x17dd/0x5820 [ 942.365541][ C0] ? __lock_acquire+0x747/0x2de0 [ 942.370566][ C0] ? do_raw_spin_unlock+0xf5/0x200 [ 942.375759][ C0] ? __pfx___schedule+0x10/0x10 [ 942.380772][ C0] ? lock_acquire+0x115/0x350 [ 942.385524][ C0] ? schedule+0x90/0x2b0 [ 942.389830][ C0] schedule+0x164/0x2b0 [ 942.394047][ C0] schedule_timeout+0x152/0x2c0 [ 942.399077][ C0] ? __pfx_schedule_timeout+0x10/0x10 [ 942.404520][ C0] ? __pfx_process_timeout+0x10/0x10 [ 942.409874][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 942.415746][ C0] ? prepare_to_swait_event+0x220/0x3e0 [ 942.421352][ C0] ? prepare_to_swait_event+0x35e/0x3e0 [ 942.426970][ C0] rcu_gp_fqs_loop+0x30c/0x1230 [ 942.431943][ C0] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 942.438162][ C0] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 942.443515][ C0] ? _raw_spin_unlock_irq+0x2e/0x50 [ 942.448806][ C0] rcu_gp_kthread+0x9c/0x340 [ 942.453461][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 942.458713][ C0] ? __kthread_parkme+0x71/0x1f0 [ 942.463750][ C0] ? __kthread_parkme+0x199/0x1f0 [ 942.468849][ C0] kthread+0x38b/0x480 [ 942.472968][ C0] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 942.478219][ C0] ? __pfx_kthread+0x10/0x10 [ 942.482866][ C0] ret_from_fork+0x514/0xb70 [ 942.487511][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 942.492685][ C0] ? __switch_to+0xc78/0x1410 [ 942.497440][ C0] ? __pfx_kthread+0x10/0x10 [ 942.502091][ C0] ret_from_fork_asm+0x1a/0x30 [ 942.506934][ C0] [ 942.509996][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 942.516417][ C0] CPU: 0 UID: 0 PID: 3231 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) [ 942.526295][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 942.536429][ C0] Workqueue: bat_events batadv_tt_purge [ 942.542175][ C0] RIP: 0010:lock_release+0x2e1/0x3c0 [ 942.547530][ C0] Code: e9 f7 12 00 00 00 00 eb b5 e8 4b 98 50 0a f7 c3 00 02 00 00 74 b9 65 48 8b 05 53 a2 f7 12 48 3b 44 24 28 75 48 fb 48 83 c4 30 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d a8 a4 db [ 942.567192][ C0] RSP: 0018:ffffc900000069a8 EFLAGS: 00000282 [ 942.573335][ C0] RAX: 9f7c502a2ab6bd00 RBX: 0000000000000206 RCX: 8000000000000101 [ 942.581404][ C0] RDX: ffffc90000006a01 RSI: ffffffff8e70fdbb RDI: ffffffff8c6e1780 [ 942.589433][ C0] RBP: ffff88803328ea38 R08: ffffc90000006f90 R09: 0000000000000000 [ 942.597466][ C0] R10: ffffc90000006ad8 R11: fffff52000000d5d R12: 0000000000000005 [ 942.605497][ C0] R13: 0000000000000005 R14: ffffffff8fd59ca0 R15: ffff88803328ddc0 [ 942.613525][ C0] FS: 0000000000000000(0000) GS:ffff888123a6b000(0000) knlGS:0000000000000000 [ 942.622598][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 942.629284][ C0] CR2: 00007f8a196df000 CR3: 000000000fb48000 CR4: 00000000003526f0 [ 942.637371][ C0] Call Trace: [ 942.640727][ C0] [ 942.643620][ C0] ? unwind_next_frame+0x8f/0x2550 [ 942.648806][ C0] unwind_next_frame+0x1baa/0x2550 [ 942.654017][ C0] ? ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 942.660461][ C0] ? unwind_next_frame+0x8f/0x2550 [ 942.665656][ C0] ? kmem_cache_alloc_noprof+0x151/0x600 [ 942.671435][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 942.677648][ C0] arch_stack_walk+0x11b/0x150 [ 942.682516][ C0] ? ip_route_output_key_hash+0x18d/0x2a0 [ 942.688357][ C0] ? dst_alloc+0x105/0x170 [ 942.692923][ C0] stack_trace_save+0xa9/0x100 [ 942.697756][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 942.703222][ C0] kasan_save_track+0x3e/0x80 [ 942.708034][ C0] ? kasan_save_track+0x3e/0x80 [ 942.712952][ C0] ? __kasan_slab_alloc+0x6c/0x80 [ 942.718041][ C0] ? kmem_cache_alloc_noprof+0x2b4/0x600 [ 942.723737][ C0] ? dst_alloc+0x105/0x170 [ 942.728217][ C0] ? ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 942.734609][ C0] __kasan_slab_alloc+0x6c/0x80 [ 942.739536][ C0] kmem_cache_alloc_noprof+0x2b4/0x600 [ 942.745059][ C0] ? dst_alloc+0x105/0x170 [ 942.749536][ C0] ? kmem_cache_alloc_noprof+0x151/0x600 [ 942.755260][ C0] ? dst_alloc+0x105/0x170 [ 942.759805][ C0] dst_alloc+0x105/0x170 [ 942.764123][ C0] ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 942.770275][ C0] ? ip_route_output_key_hash+0xd8/0x2a0 [ 942.775995][ C0] ip_route_output_key_hash+0x18d/0x2a0 [ 942.781615][ C0] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 942.787757][ C0] ? lock_acquire+0x115/0x350 [ 942.792511][ C0] ip_route_output_flow+0x2a/0x150 [ 942.797772][ C0] ? ip_route_me_harder+0x74b/0xfe0 [ 942.803151][ C0] ip_route_me_harder+0x762/0xfe0 [ 942.808305][ C0] ? __pfx_ip_route_me_harder+0x10/0x10 [ 942.813944][ C0] ? __alloc_skb+0x27a/0x7a0 [ 942.818609][ C0] ? __cookie_v4_init_sequence+0x273/0x510 [ 942.824482][ C0] ? kmem_cache_alloc_node_noprof+0x3b9/0x600 [ 942.830723][ C0] synproxy_send_tcp+0x332/0x670 [ 942.835821][ C0] synproxy_send_client_synack+0x89b/0xde0 [ 942.841708][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 942.848098][ C0] ? nft_synproxy_do_init+0x1a4/0x4c0 [ 942.853708][ C0] ? synproxy_pernet+0x45/0x270 [ 942.858641][ C0] nft_synproxy_eval_v4+0x362/0x4e0 [ 942.863918][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 942.869886][ C0] ? nf_ip_checksum+0x13c/0x510 [ 942.874903][ C0] nft_synproxy_do_eval+0x389/0x5d0 [ 942.880187][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 942.886261][ C0] nft_do_chain+0x48d/0x1b10 [ 942.890953][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 942.896055][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 942.901504][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 942.906890][ C0] nft_do_chain_ipv4+0x195/0x290 [ 942.911957][ C0] ? ipt_do_table+0x2b9/0x15d0 [ 942.916780][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 942.922306][ C0] ? iptable_mangle_hook+0x18a/0x4c0 [ 942.927678][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 942.933203][ C0] nf_hook_slow+0xc5/0x220 [ 942.937775][ C0] NF_HOOK+0x21f/0x3c0 [ 942.941912][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 942.948044][ C0] ? NF_HOOK+0x9e/0x3c0 [ 942.952299][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 942.956967][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 942.963024][ C0] ? ip_local_deliver+0x113/0x190 [ 942.968111][ C0] NF_HOOK+0x336/0x3c0 [ 942.972239][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 942.977409][ C0] ? NF_HOOK+0x9e/0x3c0 [ 942.981624][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 942.986294][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 942.991468][ C0] ? ip_rcv_core+0x88d/0xd50 [ 942.996113][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 943.000668][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 943.005583][ C0] process_backlog+0xa6b/0x18b0 [ 943.010601][ C0] ? process_backlog+0x3de/0x18b0 [ 943.015714][ C0] __napi_poll+0xaa/0x330 [ 943.020201][ C0] net_rx_action+0x61d/0xf50 [ 943.024873][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 943.030087][ C0] handle_softirqs+0x265/0x8d0 [ 943.034938][ C0] __irq_exit_rcu+0xc6/0x220 [ 943.039618][ C0] irq_exit_rcu+0x9/0x30 [ 943.043917][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 943.049627][ C0] [ 943.052694][ C0] [ 943.055672][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 943.061795][ C0] RIP: 0010:finish_task_switch+0x413/0xc60 [ 943.067755][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 d7 c1 60 0a e8 32 75 3a 00 fb 4c 8b 65 c8 <49> 8d bc 24 18 17 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 943.087446][ C0] RSP: 0018:ffffc9000e597760 EFLAGS: 00000206 [ 943.093575][ C0] RAX: 0000000000cb60d1 RBX: ffff8880b843cc60 RCX: 8000000000000001 [ 943.101605][ C0] RDX: 0000000000000006 RSI: ffffffff8e486f08 RDI: ffffffff8c6e1780 [ 943.109636][ C0] RBP: ffffc9000e5977b0 R08: ffffffff917c12bf R09: 1ffffffff22f8257 [ 943.117663][ C0] R10: dffffc0000000000 R11: fffffbfff22f8258 R12: ffff88803328ddc0 [ 943.125687][ C0] R13: ffff8880b843cc28 R14: dffffc0000000000 R15: 1ffff1101708798c [ 943.133745][ C0] __schedule+0x17e5/0x5820 [ 943.138359][ C0] ? __pfx___schedule+0x10/0x10 [ 943.143270][ C0] ? irqentry_exit+0x2a0/0x9b0 [ 943.148099][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 943.153355][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 943.158784][ C0] preempt_schedule_common+0x7f/0xd0 [ 943.164153][ C0] ? batadv_tt_purge+0x4ee/0xa40 [ 943.169150][ C0] preempt_schedule_thunk+0x16/0x40 [ 943.174411][ C0] __local_bh_enable_ip+0xe9/0x140 [ 943.179592][ C0] batadv_tt_purge+0x4ee/0xa40 [ 943.184428][ C0] ? process_scheduled_works+0x97a/0x1630 [ 943.190218][ C0] process_scheduled_works+0xc3d/0x1630 [ 943.195892][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 943.201943][ C0] ? assign_work+0x3af/0x5d0 [ 943.206602][ C0] rescuer_thread+0x84a/0x12a0 [ 943.211440][ C0] ? rescuer_thread+0xb8/0x12a0 [ 943.216381][ C0] kthread+0x38b/0x480 [ 943.220580][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 943.225827][ C0] ? __pfx_kthread+0x10/0x10 [ 943.230548][ C0] ret_from_fork+0x514/0xb70 [ 943.235212][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 943.240468][ C0] ? __switch_to+0xc78/0x1410 [ 943.245297][ C0] ? __pfx_kthread+0x10/0x10 [ 943.249936][ C0] ret_from_fork_asm+0x1a/0x30 [ 943.254770][ C0]