last executing test programs: 6.692663083s ago: executing program 0 (id=5156): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x1, @empty, 0x4000ca}, 0x1c) recvmmsg(r0, &(0x7f0000008500)=[{{0x0, 0x0, &(0x7f0000003640)=[{0x0}, {0x0}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002500)=""/234, 0xea}], 0x4}, 0x80000000}, {{0x0, 0x0, 0x0, 0xfffffffffffffda2}, 0x405}, {{0x0, 0x0, 0x0}, 0x6}], 0x3, 0x40000001, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendto$inet6(r1, &(0x7f0000000040), 0x3000, 0x0, 0x0, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000)=0x3, 0x4) 6.454795842s ago: executing program 0 (id=5160): r0 = socket$kcm(0x10, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r1, 0x10f, 0x84, 0x0, &(0x7f0000000840)) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv4_deladdr={0x20, 0x15, 0x1, 0xfffffffd, 0x0, {0x2, 0x18, 0x0, 0x0, r3}, [@IFA_ADDRESS={0x8, 0x1, @private=0xa010102}]}, 0x20}}, 0x0) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000540)={0x1f, 0x7, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x84}, 0x400, 0x1}, 0xe) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x5, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r5, 0x29, 0x11, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000077deff00850000008600000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r9, 0x21, 0xf89, 0x0, &(0x7f0000000540)="39bdeac368e4c4e87a7bfd439b9f4793bcb64f217eb9435d6b4e435770512f9a534ba988586c565c33b12ddb4c357728b463ae54ffa88f65c5bc96051eb279632efcc45cc6c9e2dc521020f9357b64ce3879ce30e3", 0x0, 0x0, 0x0, 0x0, 0x62, 0x0, 0x0, 0x6, 0x9, 0xffffffff}, 0x28) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) sendmsg$NFT_MSG_GETOBJ(r6, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)={0x118, 0x13, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0x5b, 0x8, "50fe3fcb22d2cda99b12a6c39c17c5620324599949b0f9f810968c60b72c8bfd8f8948e0822523ea41232e4d0b948b3cf2f851208744e9ad6930ef659dba57c365f7e5b23699a3cce9ea2daeb91dda54a6566086fbba20"}, @NFTA_OBJ_USERDATA={0x80, 0x8, "5dc6c6a22d89ac86d34fd0a7a537ec91d05de52c490a007ed4575df3667e29c0fab88429949253efa70fee278913c08873170f5fbb9dca3a8b6c31c67469903d22262f652596d15334f417cc18b2e78bbe767858eeaf3c895b2444a0a9e6351923b466920e9b7a1963c272c0b32dd8b6a3c585218bed5b5ec901dcb4"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}]}, 0x118}}, 0x20000001) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r11, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r11, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r11, 0x84, 0x22, &(0x7f0000000080)={0xe, 0xc208, 0x6, 0x3}, 0x10) setsockopt(r2, 0x6d6, 0x1, &(0x7f0000000440)="7a2aa0b3ec3a8ca355fb9b36daa7f958aaa9bd6ceb414dc2a714e3d3ba883980a95d186dfcd89820acc812636f9cc767d1ecc6e433e7668a2c7a9316921bceca79db20a9661e8c451ed8d7d08aadf5423d1dbcaf44ba14149073e001a916d260bb8b121aad094b62dc01a766a45f8165dc8f96b1caaab0582c0babd7566e00f02211685f9bf0bf57447a1e159e4e1e71729084767526bc9800c8c5a7a15f17eb6372e7cbd379b5a161ba91bcba0d46dd5151cd75eb9260687f299783765e6f27341faea8fe2b0257b8fef5ba5efa4c4bb264db747864", 0xd6) 5.807753376s ago: executing program 4 (id=5168): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000004c0), &(0x7f00000006c0), 0x20005, r0, 0x0, 0xffffffff00000000}, 0x38) 5.582377151s ago: executing program 2 (id=5170): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x20, 0x42}}, 0x10) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) (async) bind$tipc(r1, &(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x7}}, 0x10) (async) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10) sendmsg$tipc(r0, &(0x7f0000002340)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4080000}, 0x840) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x5000}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_RX={0x5}, @IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x20000890) 5.317705648s ago: executing program 4 (id=5172): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000000fa000000000000ac1e0001821501f63ed02a170000000000000000000000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b800000014"], 0xb8}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 5.166728212s ago: executing program 4 (id=5174): r0 = gettid() r1 = socket(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x10, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0xc, 0x2, [@TCA_HTB_DIRECT_QLEN={0x8, 0x5, 0x9}]}}]}, 0x38}}, 0x20040084) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r10, {0x700}, {0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x1, 0xb, 0x4, 0x10, 0x4], 0x3, [0xb, 0x101, 0x7fff, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x7, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'syzkaller0\x00', 0x0}) r12 = socket$kcm(0x11, 0x3, 0x0) r13 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r13) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r13, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r14 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r14, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a00)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r11, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xb, 0xf}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r12, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r12, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r15, 0x3e}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000180)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x300}], 0x2}, 0x5) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1800000016000100ffffffec02da7b270a0040", @ANYRES32=r0], 0x18}, 0x1, 0x0, 0x0, 0x400c000}, 0x24080) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) 5.11123745s ago: executing program 0 (id=5175): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000021c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01800000000000000000030202000900010053"], 0x20}, 0x1, 0x40030000000000}, 0x0) sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000000c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0x18, &(0x7f0000000380)={&(0x7f0000000300)={0x14, r3, 0x2, 0x70bd2d, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x18810) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000200), 0x0, 0x8020) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101401, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000800)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r10, {0x0, 0xd}, {0xffff, 0xb}, {0xe, 0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0x84e56105723e644b}, @TCA_TBF_BURST={0x8, 0x6, 0x20000000}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x2, 0x2, 0xa, 0x4}, {0x9c, 0x0, 0x7, 0x1, 0x6, 0x5}, 0x6, 0x71d, 0xa74}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {}, {0xe}}}, 0x24}}, 0x40004) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x2, 0x6, 0xfe, 0x0, 0x3, 0x0, 0x70bd2c, 0x25dfdbff, [@sadb_x_nat_t_type={0x1, 0x14, 0x81}]}, 0x18}}, 0x68f4f00d3aa7dce4) sendmsg$nl_route(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="280000001000010025bd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="140804000000000008001b000000"], 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="03000200"], 0x8) r11 = socket(0x2, 0x80805, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x40, &(0x7f0000000000)=0x5, 0x4) getsockopt$bt_hci(r11, 0x84, 0x70, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000016c0)='H', 0x1}], 0x1) 3.385015048s ago: executing program 2 (id=5176): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000004600)=[{{0x0, 0x0, &(0x7f0000002100)=[{&(0x7f0000001fc0)=""/217, 0xd9}, {&(0x7f00000020c0)=""/16, 0x10}], 0x2}, 0x3b83}], 0x1, 0x20001000, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001f40), 0xffffffffffffffff) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000021c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f0000002500)={0x0, 0x0, &(0x7f00000024c0)={&(0x7f0000000240)={0x24, r2, 0x1, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x8, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000015}, 0x20004800) 3.268542658s ago: executing program 3 (id=5179): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0xfffffffc) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x7d4165c9) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x7d4165c9) listen(r4, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r6, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000000fff00", 0x58}], 0x1) 3.0788543s ago: executing program 3 (id=5180): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a000004090001007350bdbaa800000008000540000000020900020073797a310000000008000a40fffffffc2c0000001d0a050000000000000000000a000005090001"], 0x90}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0x20008054) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000770000000800000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000080)=r0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f00000001c0)='%', 0x0}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000840)=@newqdisc={0x24, 0x14, 0xf0b, 0x70bd26, 0xfffffffe, {0x2, 0x0, 0x0, 0x0, {0xf, 0xc}, {0x0, 0x9}, {0xf, 0x8}}}, 0xffffffffffffff6c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000840)=ANY=[@ANYBLOB="3c0000002500010125bd7000fbfffffe0b00000008000300470000001f0050"], 0x3c}, 0x1, 0x0, 0x0, 0x4048957}, 0x28040) 2.784634405s ago: executing program 0 (id=5181): r0 = socket$inet(0x2, 0x2, 0x1) socket$kcm(0xa, 0x3, 0x87) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x8000000000000009, 0x8, 0xe1, 0xdd41, 0x10000000004, 0x3c, 0xfffffffffffffffe, 0x3}, 0x0, 0x0, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r4, 0x11, 0x65, &(0x7f0000000280)=0x80000000, 0x4) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r5, 0x107, 0x5, 0x0, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={0x0, 0x0}, 0x28) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r4, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r3, &(0x7f0000000200)={@val={0xa, 0x1b}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x18, 0x11, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], {0x4f19, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x3, 0xe}}}}}}}}, 0x52) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x15, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x800007d}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2a931f4e5d0566d1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xa8}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x56, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000003c0)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd1200e1fd0000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000002280)={0x2, &(0x7f0000000180)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000100)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000140)="08001efbb0", 0x5}, {&(0x7f0000000180)="d0849e", 0x3}], 0x2, 0x0, 0x0, 0x60000000}, 0x20040004) 1.108762847s ago: executing program 2 (id=5182): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) listen(r0, 0x0) shutdown(r0, 0x0) socket$unix(0x1, 0x1, 0x0) connect$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) socket$unix(0x1, 0x1, 0x0) (async) bind$unix(r0, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) (async) listen(r0, 0x0) (async) shutdown(r0, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) connect$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) (async) 1.096526466s ago: executing program 3 (id=5183): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="7a0af8ff75257000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b25952850a84a70002b2ab3d6ffaa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc44bc25fb591cf77b9dfb379a3f611dbc2a364916f098dab10b1a297cf528666d1ddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e9e54687d3c56d7bedb6b2f25ddb8c640bb321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0b6dd7356aa79d5fabb5c0d0da6d719d7e0efb2bb713d18242cd5df6ca53307a4cdd91be4587f90e317c8de5e5c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1786eda2b20"], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 1.078635086s ago: executing program 1 (id=5184): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x42, @initdev={0xfe, 0x88, '\x00', 0x20, 0x0}, 0x2}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x11, &(0x7f0000000040)=0x2, 0x4) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="1400000004000000080000000600000000000000", @ANYRES32=0x1, @ANYBLOB="010100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000900)={r4, &(0x7f00000006c0), 0x0}, 0x20) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="1400000020a51987148aacc21b250400679d"], 0x14}], 0x1, 0x0, 0x0, 0x20008001}, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r1, &(0x7f0000000280), &(0x7f0000001840)=@udp6=r3}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r1, &(0x7f0000000140), &(0x7f0000000000)=""/82}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x1, &(0x7f0000000080)=ANY=[@ANYRESOCT=r2], &(0x7f0000000200)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00}, 0x94) 960.018364ms ago: executing program 4 (id=5185): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176", 0x60}], 0x5}}], 0x1, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) sendmsg$inet(r2, &(0x7f0000000940)={&(0x7f0000000280)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000500)="4632313adf1dce6d596865b0b36be7bea03b16bb09ce9ff19be6b227de1d13242520c6ac5263a1f22a87fb109a2d66a179fc6b7f585acd2ee1dfa41c4ab5214383025628fe5ac1b6e4a6845a4ed3440059c977f111de77b4fb377c60c69634cc4b609a079d85edb5d9a5a4b4e3bcf9", 0x6f}, {&(0x7f0000000600)="1362194f29708ba27754b14234fd73364fa4416ee327045a7982f6d64ad024f559703e475c8ed71fbcc693fc565781bb8a6d01832607136ac91548365eb451ddf660619168b8504302277d69dafcb8f8b17ae1b0daaa0586159e3fd8ddc899e4f9a31dce48b9ecc5b239598b8257f1a6b0aa5e86406be1b040e9a772af153e0c085e0199f33c16b4d50d0a8aad6c1bfaf5092c9e18341fd3b32f87345a80eedc02810f73f4cee30ae87bef8b3f0f03de8fb3c113b159a00553695b072026dc5f9489bf56c3c1ecbb3be5eccfa396879d9a1357f1d3e7a8a2bfd219cbb8007a0a47404b", 0xe3}], 0x2, &(0x7f0000000880)=[@ip_retopts={{0x44, 0x0, 0x7, {[@ssrr={0x89, 0x13, 0x7b, [@dev={0xac, 0x14, 0x14, 0x24}, @private=0xa010100, @remote, @broadcast]}, @rr={0x7, 0x1f, 0x90, [@local, @loopback, @multicast2, @broadcast, @private=0xa010102, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x2b}]}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x9}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7c}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}], 0x90}, 0x4050) 951.587317ms ago: executing program 1 (id=5186): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@rxrpc=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e20, 0x257, @remote, 0xb6}}, 0x80, 0x0}, 0x4004090) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a118001500060014ea000000120800030043000040a8002b000a", 0x35}], 0x1}, 0x40008c0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfe33) 950.398803ms ago: executing program 3 (id=5187): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000280)={0x1, &(0x7f00000000c0)=[{0x6, 0x9, 0xc, 0xb6}]}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x9400, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) 868.613944ms ago: executing program 2 (id=5188): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8924, &(0x7f0000001300)={'nr0\x00'}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0x2c0, 0x60, 0xd0e0000, 0x2c0, 0x100, 0x390, 0x1d8, 0x1d8, 0x390, 0x1d8, 0x7fffffe, 0x0, {[{{@uncond, 0xee02, 0x2a0, 0x2c0, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @bytecode={0x0, 0xefff, 0x0, [{0x20, 0x77, 0x7, 0x2}, {0x6, 0x5d, 0x8, 0xf}, {0x0, 0x7, 0x4, 0x5}, {0x200, 0x10, 0x4, 0x401}, {0x2, 0x7, 0x9, 0x7}, {0x8, 0x2, 0x40, 0x80}, {0x7, 0x10, 0x4, 0xc27e}, {0x0, 0x8, 0x1, 0x9}, {0xa66, 0xf9, 0x2, 0x40}, {0xf207, 0x18, 0x1, 0x6}, {0x2, 0x8, 0x6, 0xb6}, {0x0, 0x5, 0x5, 0x4}, {0x9, 0x7f, 0x5, 0x2}, {0x5, 0x2, 0xf, 0xc00}, {0x1, 0x9, 0x2, 0x54}, {0x3, 0x2b, 0x2, 0x3}, {0xffff, 0x5, 0x6d, 0x7}, {0x6, 0xa, 0x5, 0x51d8}, {0x8, 0xe, 0x5}, {0x0, 0x40, 0x7, 0x88}, {0x7, 0x2, 0x6, 0x3}, {0x98d, 0x2, 0xff, 0x5}, {0x81, 0x1, 0x3, 0x7f}, {0x1, 0x2, 0xc0, 0x86f}, {0x8, 0x2, 0x9, 0x6}, {0x7, 0x75, 0x7, 0xd}, {0x6, 0x6, 0x6, 0x8001}, {0x120, 0x5, 0x2, 0x3dbd}, {0x5, 0x8, 0x9, 0x1}, {0x0, 0x3, 0x9, 0xff}, {0x0, 0x4, 0x0, 0xfffffff8}, {0x7, 0x1, 0x9, 0xd}, {0xfff, 0x7, 0x0, 0xbc}, {0x0, 0x4c, 0x8, 0xff}, {0x8, 0xc0, 0x80, 0x4}, {0x1, 0x1, 0x0, 0x508d}, {0x1ff, 0x5, 0x81, 0xd}, {0x0, 0x0, 0x2, 0x5}, {0x401, 0x3, 0x80, 0x9}, {0x9, 0x2, 0x0, 0x8}, {0x0, 0x1, 0xfb, 0x7}, {0xa, 0xff, 0x1, 0x7fffffff}, {0x7, 0x4, 0x7, 0x40}, {0xa, 0xc, 0x6, 0x5}, {0x9, 0x8, 0x7, 0x10000}, {0xe9, 0x6, 0x3, 0x3}, {0xb, 0x7, 0x7, 0x200}, {0xe, 0x5, 0x6, 0x2}, {0x9, 0x5, 0x0, 0x1}, {0x9, 0x1, 0x7, 0x1}, {0x1c0, 0x5, 0x2, 0x8e1}, {0x0, 0x5, 0x0, 0x7f07}, {0x6, 0x0, 0x1, 0x1ff}, {0x2, 0x28, 0xfc, 0x8}, {0x6, 0x3, 0x7, 0x2}, {0xa, 0xc5, 0x4, 0x3}, {0x3, 0x71, 0x8, 0x7}, {0x6e, 0x2, 0x0, 0x8}, {0x0, 0x7, 0x7, 0x10000}, {0x9, 0x7, 0x5, 0x7}, {0x100, 0x8, 0x3}, {0xd34, 0x7, 0x8}, {0x9, 0x9, 0x1, 0x80000001}, {0x6, 0xfe, 0x3, 0x3}], {0x1}}}]}, @unspec=@TRACE={0x20}}, {{@ip={@multicast2, @empty, 0xffffffff, 0xffffff00, 'veth1_virt_wifi\x00', 'xfrm0\x00', {}, {}, 0x1, 0x1, 0x6c}, 0x9400, 0x70, 0xd0, 0x94}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x0, 0x5, 0x0, 0x6, 0x4, 0x6], 0x0, 0x3}, {0x0, [0x5, 0x1, 0x6, 0x0, 0x3, 0x1]}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x488) r2 = socket$inet6(0xa, 0x80001, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xbc}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000180)=ANY=[], 0x110) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000000c0)={@val={0x3, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x1400, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0x3e) 847.6765ms ago: executing program 1 (id=5189): r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000840)=[{{&(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000000680)=[{&(0x7f00000001c0)="8dbe9de29a1823474186f72aea11678235a71ee4828c75d76df69110ae2b2baa4ca3f238a147af", 0x27}], 0x1, &(0x7f0000001500)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}], 0x20}}, {{0x0, 0x0, 0x0}}], 0x2, 0x20044000) 836.181254ms ago: executing program 4 (id=5190): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) write$tun(r3, &(0x7f0000000540)=ANY=[], 0x8b) read$alg(r2, &(0x7f00000003c0)=""/85, 0x55) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x10001) write(r0, 0x0, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x28) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800110000000000000000000000ca6c9500000000000000ffdb360734076d08000d0ba8897489c522ba66c5439753d3e0c9b47bef3c2879fc55ce1649fcc6cff6b7eddc1ae3947efadabc0399ee4099902841e1c394783c541a69c0b2af1dcd8598b5c388992876d8e7858aed8e2f5308e47d9b93e38f092f022e25a098b85645ea1b65d5b5e38355cb7d53cb83ed9d6bc2756c81b8692e12b1b572660c0d83d23e57f5ffa19bad8b1feca88786116725e92d6d6e399a37a38899d361337c02c04a0dbda849dc41b918a60e7830677446f3280ea4f0e5"], &(0x7f0000000000)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r4, 0xc, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfd90}, 0x90) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000080)=r5, 0x4) 768.987555ms ago: executing program 3 (id=5191): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) r2 = socket(0x10, 0x3, 0x8) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r5, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r5, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) socket(0x11, 0x3, 0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000100000028"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000008002b000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket(0x10, 0x80002, 0x2) connect$netlink(r7, 0x0, 0x0) unshare(0x22020400) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) connect$netlink(r2, &(0x7f0000000240)=@unspec, 0xc) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x44, r9, 0x1, 0x70bd2c, 0x8000, {0x34}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x73}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x5}]}, 0x44}}, 0x20000000) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="380000001000390400"/19, @ANYRES32=0x0, @ANYBLOB="00000000408000001800128008000100736974000c00028008000100", @ANYRES32=r10], 0x38}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000340)={'syztnl1\x00', r10, 0x1, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x9, 0x0, 0x0, @empty, @empty}}}}) 768.200645ms ago: executing program 0 (id=5192): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f00000004c0)=',8Zz', 0x4) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b00010067726574617000002400028008000700", @ANYRES32=r7], 0x5c}}, 0x40) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r8}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x4c}}, 0x884) 676.886387ms ago: executing program 1 (id=5193): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000840)=ANY=[@ANYBLOB="58010000100013070000000000000000fc020000000000000000000000000001fe8000000000000000000000000000aa00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141417000000000000000000000000000004d533000000e000000100000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000220000000000000000000000000000000200000000000000000000005c001400636d6163286165732900"/198, @ANYRES32=0x0, @ANYBLOB="06"], 0x158}}, 0x0) 581.968536ms ago: executing program 1 (id=5194): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)}, &(0x7f0000000240)=0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1007f}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22000000000000"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0x47, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)) (async) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)}, &(0x7f0000000240)=0x10) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1007f}, 0x94) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22000000000000"], 0xfdef) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x5, 0x47, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) 286.624226ms ago: executing program 2 (id=5195): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000001c0)) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000040)=0x2e, 0x4) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xfffc}, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x6) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10, 0x0) r3 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) r4 = socket$rxrpc(0x21, 0x2, 0xa) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000640)={'veth1_virt_wifi\x00', &(0x7f0000000280)=@ethtool_modinfo={0x42, 0x3, 0xbbc}}) setsockopt$sock_int(r0, 0x1, 0x1, &(0x7f0000000180)=0x6, 0x4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000ec0)={'wlan1\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000140)={0x1, 0x6}, 0x4) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000080)={0x2, 0x2007}, 0x4) r8 = accept$packet(r3, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) accept$packet(r8, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000480)=0x14) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x8000) sendmsg$NL80211_CMD_SET_KEY(0xffffffffffffffff, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000000)=ANY=[@ANYBLOB="20000000207e9cd028ed3b45136b38b1440198f51503c2e56c1d2ebfc52c341973d01e4c9369cf735b3922792606c2e6db71d6a61f86f2011a283609d952a0e49844fad37b00a2e10f6b3bab3b7a739802722845cf8538b3bd10f62f60e4745a40824d2e1a8c1b0d9d28eefd9df0218f1079", @ANYRES16=r5, @ANYRES32=r5, @ANYRES32=r6], 0x20}, 0x1, 0x0, 0x0, 0x4002011}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r9, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c000000020701080000000000000000030000090c00034000000000000003ff0900010073797a3000dd00000c00024000000000000000600c00034000000000000044090c00064010000000000000070900010073797a3000000000"], 0x5c}, 0x1, 0x0, 0x0, 0x20000004}, 0x8000) 271.414338ms ago: executing program 4 (id=5196): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000001d40)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x4}, 0x50) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001e80)={0xffffffffffffffff, 0x90bd, 0x18}, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001f40)={{0x1, 0xffffffffffffffff}, &(0x7f0000001ec0), &(0x7f0000001f00)='%+9llu \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000002040)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001fc0), &(0x7f0000002000)='%pI4 \x00'}, 0x20) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000845cd8d89c0a79c4d67206003abbc18cd36b20705a093ccf7f5d49145c222d7cf6c1ac7e1eb9c5f1", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1e, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000002000000000000000002000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70300000000000085000000ae000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002100)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000002080), &(0x7f00000020c0)}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002200)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000002180), &(0x7f00000021c0)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002300)={0x11, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0xfffffff7}}, &(0x7f0000000200)='GPL\x00', 0x2fe, 0x1000, &(0x7f0000000d40)=""/4096, 0x41100, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001d80)={0x405, 0x5}, 0x8, 0x10, &(0x7f0000001dc0)={0x4, 0x5, 0x402, 0xc5}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000002240)=[r6, r0, r1, r2, r3, r5, r5, r5, 0xffffffffffffffff, r6], &(0x7f0000002280)=[{0x2000004, 0x5, 0x4, 0x8}, {0x1, 0x2, 0x0, 0x9}, {0x0, 0x5, 0xa}, {0x1, 0x3, 0xb, 0x5}, {0x5, 0x5, 0x6, 0x1}, {0x4, 0x5, 0x8, 0xf}], 0x10, 0xffffff7a}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x8044) r8 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0xa00, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f848110000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x8000) r9 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$sock(r9, &(0x7f0000000cc0)=[{{&(0x7f0000000100)=@l2tp={0x2, 0x0, @broadcast, 0x3}, 0x80, 0x0}}, {{&(0x7f0000000700)=@in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0x18}, 0x60}, 0x80, 0x0}}], 0x2, 0x48094) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000000), 0xffffff6a) sendfile(r9, r10, 0x0, 0xffffffff000) ioctl$sock_inet_SIOCDELRT(r10, 0x890c, 0x0) socket$alg(0x26, 0x5, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$inet_sctp(r10, &(0x7f0000000140)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0x6, @loopback, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f00000000c0)="b7990747c06c83c186bd667e6a2c2ce1c51d6453dc94018d69c101eb5dccd0cf9aba7d241dc5b0e8", 0x28}], 0x1, 0x0, 0x0, 0x40}, 0x4001) 156.519451ms ago: executing program 1 (id=5197): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000001c0)) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000040)=0x2e, 0x4) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) recvfrom(r0, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x6) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10, 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) setsockopt$sock_int(r0, 0x1, 0x1, &(0x7f0000000180)=0x6, 0x4) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000ec0)={'wlan1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x8000) sendmsg$NL80211_CMD_SET_KEY(0xffffffffffffffff, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000000)=ANY=[@ANYBLOB="20000000207e9cd028ed3b45136b38b1440198f51503c2e56c1d2ebfc52c341973d01e4c9369cf735b3922792606c2e6db71d6a61f86f2011a283609d952a0e49844fad37b00a2e10f6b3bab3b7a739802722845cf8538b3bd10f62f60e4745a40824d2e1a8c1b0d9d28eefd9df0218f1079", @ANYRES16=r3, @ANYRES32=r3, @ANYRES32=r4], 0x20}, 0x1, 0x0, 0x0, 0x4002011}, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={0x5c, r3, 0x200, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xa85, 0x5f}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL={0x6, 0x19, 0x7}]}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_IE={0xa, 0x2a, [@ext_channel_switch={0x3c, 0x4, {0x1, 0x1, 0x80, 0xb}}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20040010}, 0x20) 101.94732ms ago: executing program 2 (id=5198): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0xfffffffc) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x7d4165c9) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x7d4165c9) listen(r4, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @empty}, 0x1c) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000a0c100000000000000fff00", 0x58}], 0x1) 51.732114ms ago: executing program 3 (id=5199): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@rxrpc=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e20, 0x257, @remote, 0xb6}}, 0x80, 0x0}, 0x4004090) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a118001500060014ea000000120800030043000040a8002b000a", 0x35}], 0x1}, 0x40008c0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfe33) 0s ago: executing program 0 (id=5200): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x4, 0xd, &(0x7f00000001c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x1000000b}, [@call={0x85, 0x0, 0x0, 0x29}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="12000000400000000400000002"], 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)) socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r1, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r3}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) kernel console output (not intermixed with test programs): ributes in process `syz.1.4211'. [ 603.074382][T20961] dummy0: left allmulticast mode [ 603.079495][T20961] dummy0: left promiscuous mode [ 603.087265][T20961] bridge0: port 3(dummy0) entered disabled state [ 603.098596][T20961] bridge_slave_1: left allmulticast mode [ 603.107201][T20961] bridge_slave_1: left promiscuous mode [ 603.115359][T20961] bridge0: port 2(bridge_slave_1) entered disabled state [ 603.129184][T20961] bridge_slave_0: left allmulticast mode [ 603.136198][T20961] bridge_slave_0: left promiscuous mode [ 603.142207][T20961] bridge0: port 1(bridge_slave_0) entered disabled state [ 603.511055][T20976] net_ratelimit: 263 callbacks suppressed [ 603.511074][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.527339][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.537100][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.546117][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.554892][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.565683][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.574493][T20976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.584484][T20975] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.756297][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.764842][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.886324][T20986] lo speed is unknown, defaulting to 1000 [ 603.896003][T20992] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 604.310760][T21002] netlink: 'syz.1.4225': attribute type 4 has an invalid length. [ 604.760038][T21025] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4232'. [ 604.774167][T21025] tipc: Started in network mode [ 604.780321][T21025] tipc: Node identity 9ae7e715d681, cluster identity 4711 [ 604.789265][T21025] tipc: Enabled bearer , priority 0 [ 604.797468][T21025] syzkaller0: entered promiscuous mode [ 604.804192][T21025] syzkaller0: entered allmulticast mode [ 604.833653][T21025] tipc: Resetting bearer [ 604.847370][T21024] tipc: Resetting bearer [ 604.867047][T21024] tipc: Disabling bearer [ 605.080339][T21037] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4236'. [ 605.243248][T21049] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4239'. [ 605.327475][T21051] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4241'. [ 605.491285][T21062] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4244'. [ 605.736673][T21066] syzkaller0: entered promiscuous mode [ 605.749442][T21066] syzkaller0: entered allmulticast mode [ 605.771428][T21081] netlink: 'syz.4.4248': attribute type 1 has an invalid length. [ 605.849428][T21084] netlink: 'syz.2.4249': attribute type 1 has an invalid length. [ 607.235902][T21081] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 607.237606][T21084] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 607.693302][T21113] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.4257'. [ 607.920490][T21120] netlink: 'syz.4.4260': attribute type 3 has an invalid length. [ 607.928765][T21120] netlink: 'syz.4.4260': attribute type 2 has an invalid length. [ 607.937188][T21120] netlink: 'syz.4.4260': attribute type 2 has an invalid length. [ 608.006935][T21127] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4261'. [ 608.083532][T21129] syzkaller0: entered promiscuous mode [ 608.089107][T21129] syzkaller0: entered allmulticast mode [ 608.505642][T21143] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4265'. [ 608.529040][T21143] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 608.536397][T21143] IPv6: NLM_F_CREATE should be set when creating new route [ 608.808875][ T12] net_ratelimit: 168 callbacks suppressed [ 608.808899][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.823530][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.957201][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.965660][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.974165][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.982983][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.277569][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.997419][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.005870][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.022029][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.084927][T21163] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4273'. [ 610.105727][T21163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4273'. [ 610.129106][T21166] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4272'. [ 610.137761][T21163] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4273'. [ 610.273269][T21174] netlink: 'syz.1.4277': attribute type 1 has an invalid length. [ 610.281357][T21174] netlink: 'syz.1.4277': attribute type 2 has an invalid length. [ 610.289823][T21174] netlink: 'syz.1.4277': attribute type 3 has an invalid length. [ 610.454394][ T127] nci: nci_rsp_packet: unsupported rsp opcode 0xf35 [ 611.428672][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807660f800: rx timeout, send abort [ 611.513916][ T5832] Bluetooth: hci4: command 0x0406 tx timeout [ 611.936998][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807660f800: abort rx timeout. Force session deactivation [ 612.245733][T21218] lo speed is unknown, defaulting to 1000 [ 612.347273][T21227] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not filter [ 612.456199][ T29] audit: type=1107 audit(1776172942.017:5): pid=21228 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 612.456951][T21230] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4294'. [ 612.649070][T21233] FAULT_INJECTION: forcing a failure. [ 612.649070][T21233] name failslab, interval 1, probability 0, space 0, times 0 [ 612.664468][T21233] CPU: 0 UID: 0 PID: 21233 Comm: syz.3.4295 Not tainted syzkaller #0 PREEMPT(full) [ 612.664500][T21233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 612.664516][T21233] Call Trace: [ 612.664526][T21233] [ 612.664543][T21233] dump_stack_lvl+0xe8/0x150 [ 612.664581][T21233] should_fail_ex+0x412/0x560 [ 612.664623][T21233] should_failslab+0xa8/0x100 [ 612.664654][T21233] ? alloc_empty_file+0x55/0x1d0 [ 612.664696][T21233] kmem_cache_alloc_noprof+0x87/0x650 [ 612.664732][T21233] alloc_empty_file+0x55/0x1d0 [ 612.664774][T21233] alloc_file_pseudo+0x155/0x240 [ 612.664812][T21233] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 612.664847][T21233] ? alloc_fd+0x64b/0x6c0 [ 612.664894][T21233] anon_inode_getfd+0xc8/0x1f0 [ 612.664929][T21233] map_create+0x1247/0x16a0 [ 612.664957][T21233] ? security_bpf+0x7e/0x2d0 [ 612.664993][T21233] __sys_bpf+0x6e1/0x950 [ 612.665019][T21233] ? __pfx___sys_bpf+0x10/0x10 [ 612.665059][T21233] ? ksys_write+0x242/0x270 [ 612.665089][T21233] ? __pfx_ksys_write+0x10/0x10 [ 612.665124][T21233] __x64_sys_bpf+0x7c/0x90 [ 612.665158][T21233] do_syscall_64+0x14d/0xf80 [ 612.665186][T21233] ? trace_irq_disable+0x3b/0x150 [ 612.665207][T21233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.665232][T21233] ? clear_bhb_loop+0x40/0x90 [ 612.665261][T21233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.665286][T21233] RIP: 0033:0x7fefc6f9c819 [ 612.665308][T21233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 612.665334][T21233] RSP: 002b:00007fefc7e89028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 612.665360][T21233] RAX: ffffffffffffffda RBX: 00007fefc7215fa0 RCX: 00007fefc6f9c819 [ 612.665379][T21233] RDX: 0000000000000050 RSI: 0000200000000040 RDI: 0000000000000000 [ 612.665395][T21233] RBP: 00007fefc7e89090 R08: 0000000000000000 R09: 0000000000000000 [ 612.665415][T21233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 612.665431][T21233] R13: 00007fefc7216038 R14: 00007fefc7215fa0 R15: 00007fff74c62828 [ 612.665467][T21233] [ 612.949517][T21235] netlink: 'syz.3.4296': attribute type 25 has an invalid length. [ 612.957844][T21235] netlink: 'syz.3.4296': attribute type 28 has an invalid length. [ 612.970186][T21235] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4296'. [ 613.027135][T21237] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4297'. [ 613.140303][T21237] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 613.386134][T21179] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 613.545421][T21257] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4303'. [ 613.651279][T21260] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4304'. [ 613.720130][T21266] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4304'. [ 613.964852][T21276] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4308'. [ 614.148846][T21279] net_ratelimit: 29 callbacks suppressed [ 614.148863][T21279] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.163573][T20651] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.171942][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.180433][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.189206][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.197698][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.249284][T21279] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.271462][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.292293][T21279] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.300881][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.645488][T21290] FAULT_INJECTION: forcing a failure. [ 614.645488][T21290] name failslab, interval 1, probability 0, space 0, times 0 [ 614.701633][T21290] CPU: 0 UID: 0 PID: 21290 Comm: syz.1.4314 Not tainted syzkaller #0 PREEMPT(full) [ 614.701666][T21290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 614.701681][T21290] Call Trace: [ 614.701691][T21290] [ 614.701701][T21290] dump_stack_lvl+0xe8/0x150 [ 614.701739][T21290] should_fail_ex+0x412/0x560 [ 614.701781][T21290] should_failslab+0xa8/0x100 [ 614.701822][T21290] __kvmalloc_node_noprof+0x178/0x8a0 [ 614.701853][T21290] ? rhashtable_init_noprof+0x52e/0xa70 [ 614.701880][T21290] ? rhashtable_init_noprof+0x12d/0xa70 [ 614.701916][T21290] rhashtable_init_noprof+0x52e/0xa70 [ 614.701948][T21290] nft_rhash_init+0x118/0x3b0 [ 614.701983][T21290] ? __pfx_nft_rhash_init+0x10/0x10 [ 614.702012][T21290] ? kasan_quarantine_put+0xbb/0x1f0 [ 614.702039][T21290] ? __pfx_nft_rhash_key+0x10/0x10 [ 614.702070][T21290] ? __pfx_nft_rhash_obj+0x10/0x10 [ 614.702106][T21290] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 614.702142][T21290] ? kfree+0x1c1/0x630 [ 614.702164][T21290] ? nf_tables_newset+0x13bf/0x2580 [ 614.702195][T21290] nf_tables_newset+0x1c2b/0x2580 [ 614.702235][T21290] ? __pfx_nf_tables_newset+0x10/0x10 [ 614.702284][T21290] ? __nla_parse+0x40/0x60 [ 614.702316][T21290] nfnetlink_rcv+0x1240/0x27b0 [ 614.702382][T21290] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 614.702430][T21290] ? ref_tracker_free+0x693/0x840 [ 614.702489][T21290] ? __netlink_deliver_tap+0x807/0x850 [ 614.702532][T21290] ? netlink_deliver_tap+0x2e/0x1b0 [ 614.702564][T21290] ? netlink_deliver_tap+0x2e/0x1b0 [ 614.702602][T21290] netlink_unicast+0x75c/0x8e0 [ 614.702643][T21290] netlink_sendmsg+0x813/0xb40 [ 614.702687][T21290] ? __pfx_netlink_sendmsg+0x10/0x10 [ 614.702725][T21290] ? aa_sock_msg_perm+0xf1/0x1b0 [ 614.702749][T21290] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 614.702782][T21290] ____sys_sendmsg+0x972/0x9f0 [ 614.702836][T21290] ? __pfx_____sys_sendmsg+0x10/0x10 [ 614.702882][T21290] ? import_iovec+0x73/0xa0 [ 614.702915][T21290] ___sys_sendmsg+0x2a5/0x360 [ 614.702956][T21290] ? __pfx____sys_sendmsg+0x10/0x10 [ 614.703032][T21290] ? __fget_files+0x2a/0x420 [ 614.703054][T21290] ? __fget_files+0x3a0/0x420 [ 614.703088][T21290] __x64_sys_sendmsg+0x1bd/0x2a0 [ 614.703128][T21290] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 614.703175][T21290] ? __pfx_ksys_write+0x10/0x10 [ 614.703215][T21290] do_syscall_64+0x14d/0xf80 [ 614.703242][T21290] ? trace_irq_disable+0x3b/0x150 [ 614.703264][T21290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.703289][T21290] ? clear_bhb_loop+0x40/0x90 [ 614.703318][T21290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 614.703343][T21290] RIP: 0033:0x7fb57259c819 [ 614.703364][T21290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 614.703382][T21290] RSP: 002b:00007fb573393028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 614.703409][T21290] RAX: ffffffffffffffda RBX: 00007fb572815fa0 RCX: 00007fb57259c819 [ 614.703428][T21290] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000007 [ 614.703443][T21290] RBP: 00007fb573393090 R08: 0000000000000000 R09: 0000000000000000 [ 614.703459][T21290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 614.703474][T21290] R13: 00007fb572816038 R14: 00007fb572815fa0 R15: 00007ffe808b8778 [ 614.703512][T21290] [ 615.201036][T21307] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4320'. [ 615.226272][T21301] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4318'. [ 615.304249][T20651] IPVS: starting estimator thread 0... [ 615.394037][T21324] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4323'. [ 615.403406][T21319] IPVS: using max 28 ests per chain, 67200 per kthread [ 615.445570][T21322] bond2 (unregistering): Released all slaves [ 615.525000][T21328] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4325'. [ 615.714677][T21338] FAULT_INJECTION: forcing a failure. [ 615.714677][T21338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 615.737524][T21338] CPU: 0 UID: 0 PID: 21338 Comm: syz.4.4327 Not tainted syzkaller #0 PREEMPT(full) [ 615.737558][T21338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 615.737574][T21338] Call Trace: [ 615.737584][T21338] [ 615.737595][T21338] dump_stack_lvl+0xe8/0x150 [ 615.737640][T21338] should_fail_ex+0x412/0x560 [ 615.737683][T21338] _copy_from_user+0x2d/0xb0 [ 615.737713][T21338] generic_map_update_batch+0x648/0x990 [ 615.737755][T21338] ? __pfx_generic_map_update_batch+0x10/0x10 [ 615.737788][T21338] ? __fget_files+0x2a/0x420 [ 615.737818][T21338] ? __pfx_generic_map_update_batch+0x10/0x10 [ 615.737848][T21338] bpf_map_do_batch+0x39b/0x630 [ 615.737880][T21338] __sys_bpf+0x7c1/0x950 [ 615.737905][T21338] ? __pfx___sys_bpf+0x10/0x10 [ 615.737943][T21338] ? ksys_write+0x242/0x270 [ 615.737972][T21338] ? __pfx_ksys_write+0x10/0x10 [ 615.738005][T21338] __x64_sys_bpf+0x7c/0x90 [ 615.738037][T21338] do_syscall_64+0x14d/0xf80 [ 615.738064][T21338] ? trace_irq_disable+0x3b/0x150 [ 615.738085][T21338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.738109][T21338] ? clear_bhb_loop+0x40/0x90 [ 615.738138][T21338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.738163][T21338] RIP: 0033:0x7fc6e5d9c819 [ 615.738185][T21338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 615.738205][T21338] RSP: 002b:00007fc6e6ce3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 615.738231][T21338] RAX: ffffffffffffffda RBX: 00007fc6e6015fa0 RCX: 00007fc6e5d9c819 [ 615.738249][T21338] RDX: 0000000000000038 RSI: 0000200000000400 RDI: 000000000000001a [ 615.738265][T21338] RBP: 00007fc6e6ce3090 R08: 0000000000000000 R09: 0000000000000000 [ 615.738281][T21338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 615.738296][T21338] R13: 00007fc6e6016038 R14: 00007fc6e6015fa0 R15: 00007ffec5673368 [ 615.738331][T21338] [ 615.751917][T21339] tipc: Failed to remove unknown binding: 66,0,0/0:893354047/893354048 [ 616.095074][T21339] tipc: Failed to remove unknown binding: 66,0,0/0:893354047/893354048 [ 616.214385][T21359] syzkaller0: entered promiscuous mode [ 616.219956][T21359] syzkaller0: entered allmulticast mode [ 616.514489][T21370] syzkaller1: entered promiscuous mode [ 616.521954][T21370] syzkaller1: entered allmulticast mode [ 616.683707][T21375] lo speed is unknown, defaulting to 1000 [ 617.091112][T21397] FAULT_INJECTION: forcing a failure. [ 617.091112][T21397] name failslab, interval 1, probability 0, space 0, times 0 [ 617.104122][T21397] CPU: 1 UID: 0 PID: 21397 Comm: syz.3.4346 Not tainted syzkaller #0 PREEMPT(full) [ 617.104153][T21397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 617.104169][T21397] Call Trace: [ 617.104180][T21397] [ 617.104190][T21397] dump_stack_lvl+0xe8/0x150 [ 617.104231][T21397] should_fail_ex+0x412/0x560 [ 617.104275][T21397] should_failslab+0xa8/0x100 [ 617.104308][T21397] ? skb_clone+0x212/0x3a0 [ 617.104332][T21397] kmem_cache_alloc_noprof+0x87/0x650 [ 617.104357][T21397] ? apparmor_capable+0x126/0x170 [ 617.104394][T21397] skb_clone+0x212/0x3a0 [ 617.104415][T21397] ? nfnetlink_rcv+0x4b0/0x27b0 [ 617.104447][T21397] nfnetlink_rcv+0x4e2/0x27b0 [ 617.104489][T21397] ? lockdep_hardirqs_on+0x7a/0x110 [ 617.104516][T21397] ? __dev_queue_xmit+0x2b6/0x3980 [ 617.104538][T21397] ? __local_bh_enable_ip+0xd0/0x130 [ 617.104568][T21397] ? __dev_queue_xmit+0x1fe5/0x3980 [ 617.104591][T21397] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 617.104632][T21397] ? __dev_queue_xmit+0x2b6/0x3980 [ 617.104661][T21397] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 617.104716][T21397] ? ref_tracker_free+0x693/0x840 [ 617.104744][T21397] ? __pfx_ref_tracker_free+0x10/0x10 [ 617.104787][T21397] ? skb_clone+0x246/0x3a0 [ 617.104813][T21397] ? __netlink_deliver_tap+0x807/0x850 [ 617.104845][T21397] ? netlink_deliver_tap+0x2e/0x1b0 [ 617.104885][T21397] ? netlink_deliver_tap+0x2e/0x1b0 [ 617.104915][T21397] ? netlink_deliver_tap+0x2e/0x1b0 [ 617.104953][T21397] netlink_unicast+0x75c/0x8e0 [ 617.104994][T21397] netlink_sendmsg+0x813/0xb40 [ 617.105036][T21397] ? __pfx_netlink_sendmsg+0x10/0x10 [ 617.105072][T21397] ? aa_sock_msg_perm+0xf1/0x1b0 [ 617.105098][T21397] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 617.105129][T21397] ____sys_sendmsg+0x972/0x9f0 [ 617.105172][T21397] ? __pfx_____sys_sendmsg+0x10/0x10 [ 617.105217][T21397] ? import_iovec+0x73/0xa0 [ 617.105249][T21397] ___sys_sendmsg+0x2a5/0x360 [ 617.105290][T21397] ? __pfx____sys_sendmsg+0x10/0x10 [ 617.105361][T21397] ? __fget_files+0x2a/0x420 [ 617.105383][T21397] ? __fget_files+0x3a0/0x420 [ 617.105417][T21397] __x64_sys_sendmsg+0x1bd/0x2a0 [ 617.105456][T21397] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 617.105501][T21397] ? __pfx_ksys_write+0x10/0x10 [ 617.105541][T21397] do_syscall_64+0x14d/0xf80 [ 617.105568][T21397] ? trace_irq_disable+0x3b/0x150 [ 617.105589][T21397] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.105613][T21397] ? clear_bhb_loop+0x40/0x90 [ 617.105641][T21397] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.105664][T21397] RIP: 0033:0x7fefc6f9c819 [ 617.105694][T21397] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 617.105716][T21397] RSP: 002b:00007fefc7e89028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 617.105742][T21397] RAX: ffffffffffffffda RBX: 00007fefc7215fa0 RCX: 00007fefc6f9c819 [ 617.105759][T21397] RDX: 0000000004000000 RSI: 0000200000000380 RDI: 0000000000000003 [ 617.105776][T21397] RBP: 00007fefc7e89090 R08: 0000000000000000 R09: 0000000000000000 [ 617.105791][T21397] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 617.105807][T21397] R13: 00007fefc7216038 R14: 00007fefc7215fa0 R15: 00007fff74c62828 [ 617.105843][T21397] [ 617.778761][T21414] netlink: 'syz.2.4350': attribute type 1 has an invalid length. [ 617.876484][T21414] macvlan2: entered promiscuous mode [ 617.882236][T21414] macvlan2: entered allmulticast mode [ 617.889152][T21414] bond8: entered promiscuous mode [ 617.896041][T21414] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 617.906863][T21414] bond8: left promiscuous mode [ 618.278976][T21439] syzkaller1: entered promiscuous mode [ 618.284800][T21439] syzkaller1: entered allmulticast mode [ 618.564886][T21452] __nla_validate_parse: 7 callbacks suppressed [ 618.564912][T21452] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4363'. [ 618.592413][T21452] ip6gretap0: entered promiscuous mode [ 618.598590][T21452] macvtap1: entered promiscuous mode [ 618.604860][T21452] macvtap1: entered allmulticast mode [ 618.610414][T21452] ip6gretap0: entered allmulticast mode [ 618.618698][T21454] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4363'. [ 618.629765][T21454] ip6gretap0: left allmulticast mode [ 618.636465][T21454] ip6gretap0: left promiscuous mode [ 618.721128][T21456] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4364'. [ 619.039295][T21469] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4369'. [ 619.506989][T21478] netlink: 'syz.2.4371': attribute type 1 has an invalid length. [ 619.516660][T21478] netlink: 'syz.2.4371': attribute type 2 has an invalid length. [ 619.525039][T21478] netlink: 'syz.2.4371': attribute type 1 has an invalid length. [ 619.533319][T21478] netlink: 'syz.2.4371': attribute type 3 has an invalid length. [ 619.596506][T20651] net_ratelimit: 132 callbacks suppressed [ 619.596529][T20651] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.610839][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.620070][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.628754][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.680489][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.689584][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.712656][T21480] netlink: 'syz.0.4372': attribute type 21 has an invalid length. [ 619.720781][T21480] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4372'. [ 619.732438][T21480] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 620.187891][T21495] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 620.313456][ T149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.321891][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.632535][ T7705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 621.067920][T21498] xt_hashlimit: size too large, truncated to 1048576 [ 621.118200][T21500] xt_hashlimit: size too large, truncated to 1048576 [ 621.126142][T21500] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 621.167193][T21439] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 621.395928][T21506] netlink: 120 bytes leftover after parsing attributes in process `syz.4.4380'. [ 621.407400][T21509] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4378'. [ 621.419438][T21506] netlink: 'syz.4.4380': attribute type 1 has an invalid length. [ 621.452749][T21506] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4380'. [ 621.532747][T21516] netlink: 'syz.1.4383': attribute type 21 has an invalid length. [ 621.540811][T21516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4383'. [ 621.550133][T21516] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 621.625611][T21524] syzkaller0: entered promiscuous mode [ 621.631306][T21524] syzkaller0: entered allmulticast mode [ 621.729875][T21526] netlink: 43 bytes leftover after parsing attributes in process `syz.1.4386'. [ 621.837672][T21532] syzkaller1: entered promiscuous mode [ 621.844334][T21532] syzkaller1: entered allmulticast mode [ 622.305673][T21540] FAULT_INJECTION: forcing a failure. [ 622.305673][T21540] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 622.323142][T21540] CPU: 1 UID: 0 PID: 21540 Comm: syz.0.4390 Not tainted syzkaller #0 PREEMPT(full) [ 622.323175][T21540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 622.323191][T21540] Call Trace: [ 622.323200][T21540] [ 622.323211][T21540] dump_stack_lvl+0xe8/0x150 [ 622.323249][T21540] should_fail_ex+0x412/0x560 [ 622.323291][T21540] prepare_alloc_pages+0x22a/0x650 [ 622.323330][T21540] __alloc_frozen_pages_noprof+0x12f/0x380 [ 622.323367][T21540] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 622.323403][T21540] ? __pfx_policy_nodemask+0x10/0x10 [ 622.323443][T21540] alloc_pages_mpol+0x232/0x4a0 [ 622.323481][T21540] alloc_pages_noprof+0xa8/0x1a0 [ 622.323514][T21540] bpf_prog_test_run_xdp+0xc69/0x1160 [ 622.323564][T21540] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 622.323602][T21540] ? __fget_files+0x2a/0x420 [ 622.323630][T21540] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 622.323663][T21540] bpf_prog_test_run+0x2c7/0x340 [ 622.323693][T21540] __sys_bpf+0x643/0x950 [ 622.323718][T21540] ? __pfx___sys_bpf+0x10/0x10 [ 622.323755][T21540] ? ksys_write+0x242/0x270 [ 622.323784][T21540] ? __pfx_ksys_write+0x10/0x10 [ 622.323819][T21540] __x64_sys_bpf+0x7c/0x90 [ 622.323853][T21540] do_syscall_64+0x14d/0xf80 [ 622.323879][T21540] ? trace_irq_disable+0x3b/0x150 [ 622.323899][T21540] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.323923][T21540] ? clear_bhb_loop+0x40/0x90 [ 622.323952][T21540] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 622.323983][T21540] RIP: 0033:0x7f9efeb9c819 [ 622.324004][T21540] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 622.324024][T21540] RSP: 002b:00007f9eff9ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 622.324049][T21540] RAX: ffffffffffffffda RBX: 00007f9efee15fa0 RCX: 00007f9efeb9c819 [ 622.324066][T21540] RDX: 0000000000000050 RSI: 0000200000000c80 RDI: 000000000000000a [ 622.324081][T21540] RBP: 00007f9eff9ec090 R08: 0000000000000000 R09: 0000000000000000 [ 622.324096][T21540] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 622.324114][T21540] R13: 00007f9efee16038 R14: 00007f9efee15fa0 R15: 00007fff1a2ee4b8 [ 622.324150][T21540] [ 622.575919][T21542] syz_tun: entered allmulticast mode [ 622.588457][T21538] syz_tun: left allmulticast mode [ 623.054168][T21563] syzkaller1: entered promiscuous mode [ 623.083153][T21563] syzkaller1: entered allmulticast mode [ 624.219953][T21588] lo speed is unknown, defaulting to 1000 [ 624.304884][T21584] __nla_validate_parse: 2 callbacks suppressed [ 624.304909][T21584] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4406'. [ 624.362589][T21584] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4406'. [ 624.779149][T21614] FAULT_INJECTION: forcing a failure. [ 624.779149][T21614] name failslab, interval 1, probability 0, space 0, times 0 [ 624.796143][ T5839] net_ratelimit: 31 callbacks suppressed [ 624.796166][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.810075][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.818557][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.824183][ T1300] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.828568][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.843380][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.852555][T21614] CPU: 1 UID: 0 PID: 21614 Comm: syz.2.4414 Not tainted syzkaller #0 PREEMPT(full) [ 624.852584][T21614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 624.852600][T21614] Call Trace: [ 624.852609][T21614] [ 624.852620][T21614] dump_stack_lvl+0xe8/0x150 [ 624.852681][T21614] should_fail_ex+0x412/0x560 [ 624.852723][T21614] should_failslab+0xa8/0x100 [ 624.852757][T21614] __kmalloc_cache_noprof+0x88/0x660 [ 624.852785][T21614] ? __asan_memset+0x22/0x50 [ 624.852808][T21614] ? alloc_netdev_mqs+0xbf8/0x11b0 [ 624.852832][T21614] ? __kmalloc_cache_noprof+0x15b/0x660 [ 624.852865][T21614] alloc_netdev_mqs+0xbf8/0x11b0 [ 624.852898][T21614] rtnl_create_link+0x31f/0xd70 [ 624.852930][T21614] rtnl_newlink_create+0x277/0xb70 [ 624.852969][T21614] ? __mutex_lock+0x5ac/0x1300 [ 624.853003][T21614] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 624.853038][T21614] ? __pfx___mutex_lock+0x10/0x10 [ 624.853076][T21614] ? ns_capable+0x89/0xe0 [ 624.853110][T21614] rtnl_newlink+0x166a/0x1bb0 [ 624.853157][T21614] ? __pfx_rtnl_newlink+0x10/0x10 [ 624.853185][T21614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.853246][T21614] ? kasan_quarantine_put+0xbb/0x1f0 [ 624.853273][T21614] ? lockdep_hardirqs_on+0x7a/0x110 [ 624.853303][T21614] ? kmem_cache_free+0x187/0x630 [ 624.853330][T21614] ? nlmon_xmit+0xb0/0x100 [ 624.853373][T21614] ? __lock_acquire+0x6b5/0x2cf0 [ 624.853410][T21614] ? __local_bh_enable_ip+0xd0/0x130 [ 624.853440][T21614] ? lockdep_hardirqs_on+0x7a/0x110 [ 624.853466][T21614] ? __dev_queue_xmit+0x2b6/0x3980 [ 624.853487][T21614] ? __local_bh_enable_ip+0xd0/0x130 [ 624.853516][T21614] ? __dev_queue_xmit+0x2b6/0x3980 [ 624.853566][T21614] ? __pfx_rtnl_newlink+0x10/0x10 [ 624.853595][T21614] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 624.853630][T21614] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 624.853658][T21614] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 624.853696][T21614] ? ref_tracker_free+0x693/0x840 [ 624.853724][T21614] ? __pfx_ref_tracker_free+0x10/0x10 [ 624.853760][T21614] netlink_rcv_skb+0x232/0x4b0 [ 624.853795][T21614] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 624.853841][T21614] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 624.853886][T21614] ? netlink_deliver_tap+0x2e/0x1b0 [ 624.853918][T21614] ? netlink_deliver_tap+0x2e/0x1b0 [ 624.853956][T21614] netlink_unicast+0x75c/0x8e0 [ 624.853964][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.853997][T21614] netlink_sendmsg+0x813/0xb40 [ 624.854151][T21614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.854263][T21614] ? aa_sock_msg_perm+0xf1/0x1b0 [ 624.854330][T21614] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 624.854424][T21614] ____sys_sendmsg+0x972/0x9f0 [ 624.854545][T21614] ? __pfx_____sys_sendmsg+0x10/0x10 [ 624.854665][T21614] ? import_iovec+0x73/0xa0 [ 624.854776][T21614] ___sys_sendmsg+0x2a5/0x360 [ 624.854885][T21614] ? __pfx____sys_sendmsg+0x10/0x10 [ 624.855087][T21614] ? __fget_files+0x2a/0x420 [ 624.855151][T21614] ? __fget_files+0x3a0/0x420 [ 624.855239][T21614] __x64_sys_sendmsg+0x1bd/0x2a0 [ 624.855348][T21614] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 624.855442][T21614] ? __pfx_ksys_write+0x10/0x10 [ 624.855567][T21614] do_syscall_64+0x14d/0xf80 [ 624.855648][T21614] ? trace_irq_disable+0x3b/0x150 [ 624.855711][T21614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.855776][T21614] ? clear_bhb_loop+0x40/0x90 [ 624.855859][T21614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.855927][T21614] RIP: 0033:0x7fbdeed9c819 [ 624.855992][T21614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 624.856047][T21614] RSP: 002b:00007fbdefbc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 624.856114][T21614] RAX: ffffffffffffffda RBX: 00007fbdef015fa0 RCX: 00007fbdeed9c819 [ 624.856167][T21614] RDX: 0000000000000010 RSI: 0000200000000280 RDI: 0000000000000004 [ 624.856211][T21614] RBP: 00007fbdefbc3090 R08: 0000000000000000 R09: 0000000000000000 [ 624.856255][T21614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 624.856290][T21614] R13: 00007fbdef016038 R14: 00007fbdef015fa0 R15: 00007ffd27d45d28 [ 624.856389][T21614] [ 625.299889][T21620] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.323094][T21620] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.350119][T21620] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.383393][T21623] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.669232][T21639] syzkaller0: entered promiscuous mode [ 625.680067][T21639] syzkaller0: entered allmulticast mode [ 625.875611][T21647] netlink: 43 bytes leftover after parsing attributes in process `syz.4.4423'. [ 625.894704][T21651] netlink: 43 bytes leftover after parsing attributes in process `syz.1.4422'. [ 626.118000][T21658] netlink: 'syz.4.4424': attribute type 10 has an invalid length. [ 626.429323][T21660] syzkaller1: entered promiscuous mode [ 626.435296][T21660] syzkaller1: entered allmulticast mode [ 626.624763][T21662] lo speed is unknown, defaulting to 1000 [ 626.909648][T21666] netlink: 'syz.0.4428': attribute type 22 has an invalid length. [ 626.934641][T21666] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4428'. [ 626.951762][T21666] bond0: option ad_select: unable to set because the bond device is up [ 628.408088][T21625] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 628.484469][T21686] netlink: 43 bytes leftover after parsing attributes in process `syz.3.4435'. [ 628.650106][T21692] syzkaller1: entered promiscuous mode [ 628.656125][T21692] syzkaller1: entered allmulticast mode [ 628.801700][T21705] sit1: entered promiscuous mode [ 628.813450][T21705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4442'. [ 628.907070][T21712] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4443'. [ 629.142643][T21722] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4448'. [ 629.238312][T21728] netlink: 43 bytes leftover after parsing attributes in process `syz.3.4450'. [ 629.333234][T21733] syzkaller0: entered promiscuous mode [ 629.339116][T21733] syzkaller0: entered allmulticast mode [ 629.592064][T21747] netlink: 'syz.1.4455': attribute type 4 has an invalid length. [ 629.640447][T21747] netlink: 'syz.1.4455': attribute type 4 has an invalid length. [ 629.746289][T21747] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4455'. [ 629.765452][T21754] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4460'. [ 629.769662][T21747] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4455'. [ 629.906312][T21762] FAULT_INJECTION: forcing a failure. [ 629.906312][T21762] name failslab, interval 1, probability 0, space 0, times 0 [ 629.924102][ C0] net_ratelimit: 124 callbacks suppressed [ 629.924126][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.942063][T21762] CPU: 1 UID: 0 PID: 21762 Comm: syz.4.4462 Not tainted syzkaller #0 PREEMPT(full) [ 629.942100][T21762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 629.942114][T21762] Call Trace: [ 629.942124][T21762] [ 629.942135][T21762] dump_stack_lvl+0xe8/0x150 [ 629.942174][T21762] should_fail_ex+0x412/0x560 [ 629.942216][T21762] should_failslab+0xa8/0x100 [ 629.942256][T21762] ? skb_clone+0x212/0x3a0 [ 629.942279][T21762] kmem_cache_alloc_noprof+0x87/0x650 [ 629.942305][T21762] ? __netlink_lookup+0xc6/0x8b0 [ 629.942345][T21762] skb_clone+0x212/0x3a0 [ 629.942371][T21762] __netlink_deliver_tap+0x404/0x850 [ 629.942417][T21762] ? netlink_deliver_tap+0x2e/0x1b0 [ 629.942450][T21762] netlink_deliver_tap+0x19c/0x1b0 [ 629.942484][T21762] netlink_unicast+0x730/0x8e0 [ 629.942524][T21762] netlink_sendmsg+0x813/0xb40 [ 629.942567][T21762] ? __pfx_netlink_sendmsg+0x10/0x10 [ 629.942604][T21762] ? aa_sock_msg_perm+0xf1/0x1b0 [ 629.942630][T21762] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 629.942661][T21762] ____sys_sendmsg+0x972/0x9f0 [ 629.942694][T21762] ? __lock_acquire+0x6b5/0x2cf0 [ 629.942734][T21762] ? __pfx_____sys_sendmsg+0x10/0x10 [ 629.942778][T21762] ? import_iovec+0x73/0xa0 [ 629.942811][T21762] ___sys_sendmsg+0x2a5/0x360 [ 629.942853][T21762] ? __pfx____sys_sendmsg+0x10/0x10 [ 629.942894][T21762] ? kstrtouint+0x6e/0xe0 [ 629.942957][T21762] ? __fget_files+0x2a/0x420 [ 629.942978][T21762] ? __fget_files+0x3a0/0x420 [ 629.943011][T21762] __sys_sendmmsg+0x27c/0x4e0 [ 629.943052][T21762] ? __pfx___sys_sendmmsg+0x10/0x10 [ 629.943085][T21762] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 629.943142][T21762] ? ksys_write+0x242/0x270 [ 629.943171][T21762] ? __pfx_ksys_write+0x10/0x10 [ 629.943206][T21762] __x64_sys_sendmmsg+0xa0/0xc0 [ 629.943249][T21762] do_syscall_64+0x14d/0xf80 [ 629.943275][T21762] ? trace_irq_disable+0x3b/0x150 [ 629.943296][T21762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.943320][T21762] ? clear_bhb_loop+0x40/0x90 [ 629.943348][T21762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.943372][T21762] RIP: 0033:0x7fc6e5d9c819 [ 629.943394][T21762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 629.943416][T21762] RSP: 002b:00007fc6e6ce3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 629.943441][T21762] RAX: ffffffffffffffda RBX: 00007fc6e6015fa0 RCX: 00007fc6e5d9c819 [ 629.943458][T21762] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 629.943475][T21762] RBP: 00007fc6e6ce3090 R08: 0000000000000000 R09: 0000000000000000 [ 629.943491][T21762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 629.943505][T21762] R13: 00007fc6e6016038 R14: 00007fc6e6015fa0 R15: 00007ffec5673368 [ 629.943541][T21762] [ 630.221665][ T7705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.234818][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.243281][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.251922][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.260344][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.283921][T21765] syzkaller0: entered promiscuous mode [ 630.289445][T21765] syzkaller0: entered allmulticast mode [ 630.299434][T21762] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4462'. [ 630.386098][ T1318] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.386453][T21762] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4462'. [ 630.395063][ T1318] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.455043][ T1318] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.514236][ T1318] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 630.537285][T21774] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 630.563983][T21773] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4468'. [ 630.577865][T21773] ip6gretap0: entered promiscuous mode [ 630.584339][T21773] ip6gretap0: entered allmulticast mode [ 630.595306][T21773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4468'. [ 630.614259][T21781] netlink: 'syz.4.4470': attribute type 4 has an invalid length. [ 630.624393][T21781] netlink: 152 bytes leftover after parsing attributes in process `syz.4.4470'. [ 630.625420][T21773] ip6gretap0: left allmulticast mode [ 630.648930][T21773] ip6gretap0: left promiscuous mode [ 630.872777][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.969925][T21800] syzkaller0: entered promiscuous mode [ 630.976143][T21800] syzkaller0: entered allmulticast mode [ 631.048260][T21803] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 631.058880][T21803] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 631.078147][T21798] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4475'. [ 631.087427][T21798] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4475'. [ 631.386660][T21822] veth0: entered allmulticast mode [ 631.392319][T21822] veth0: entered promiscuous mode [ 631.471436][T21822] veth0: left allmulticast mode [ 631.486000][T21822] veth0: left promiscuous mode [ 632.234981][T21859] netlink: 'syz.1.4495': attribute type 21 has an invalid length. [ 632.244523][T21859] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 632.374300][T21865] netlink: 'syz.1.4497': attribute type 22 has an invalid length. [ 632.384377][T21865] bond0: option ad_select: unable to set because the bond device is up [ 633.106892][T21894] tap0: tun_chr_ioctl cmd 1074025681 [ 633.146665][T21899] netlink: 'syz.0.4505': attribute type 4 has an invalid length. [ 633.443962][T21908] lo speed is unknown, defaulting to 1000 [ 633.653012][T21927] xt_hashlimit: size too large, truncated to 1048576 [ 633.697002][T21916] syzkaller0: entered promiscuous mode [ 633.715949][T21916] syzkaller0: entered allmulticast mode [ 634.321620][T21955] netlink: 'syz.1.4523': attribute type 1 has an invalid length. [ 635.436291][ T5839] net_ratelimit: 114 callbacks suppressed [ 635.436311][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.450429][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.554914][T21947] syzkaller1: entered promiscuous mode [ 635.560573][T21947] syzkaller1: entered allmulticast mode [ 635.568596][T21955] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 635.673224][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.690785][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.700511][ T7705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.913214][T21976] __nla_validate_parse: 9 callbacks suppressed [ 635.913237][T21976] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4528'. [ 636.160950][ T3015] bond2 (unregistering): (slave gretap1): Releasing active interface [ 636.313812][ T7705] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.322971][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.331321][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.376159][T21991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.384826][T21991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.598476][ T3015] bond0 (unregistering): Released all slaves [ 636.617436][ T3015] bond1 (unregistering): (slave veth3): Releasing backup interface [ 636.626645][ T3015] veth3: left promiscuous mode [ 636.631901][ T3015] veth3: left allmulticast mode [ 636.639929][ T3015] bond1 (unregistering): Released all slaves [ 636.664656][ T3015] bond2 (unregistering): Released all slaves [ 636.686936][ T3015] bond3 (unregistering): Released all slaves [ 636.716881][ T3015] bond4 (unregistering): Released all slaves [ 636.745364][ T3015] bond5 (unregistering): (slave wireguard0): Releasing backup interface [ 636.757010][ T3015] wireguard0: left promiscuous mode [ 636.765272][ T3015] bond5 (unregistering): Released all slaves [ 636.942863][ T3015] tipc: Disabling bearer [ 636.960115][ T3015] tipc: Left network mode [ 636.998501][T22001] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4535'. [ 637.011716][T22001] ip6gretap0: entered promiscuous mode [ 637.017566][T22001] ip6gretap0: entered allmulticast mode [ 637.038046][T22001] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4535'. [ 637.087583][T22001] ip6gretap0: left allmulticast mode [ 637.106974][T22001] ip6gretap0: left promiscuous mode [ 637.164926][T22007] netlink: 'syz.2.4537': attribute type 1 has an invalid length. [ 637.308997][T22009] bond9: (slave vxcan5): The slave device specified does not support setting the MAC address [ 637.320558][T22009] bond9: (slave vxcan5): Error -95 calling set_mac_address [ 637.442737][T22019] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4540'. [ 637.668077][ T3015] hsr_slave_0: left promiscuous mode [ 637.675029][ T3015] hsr_slave_1: left promiscuous mode [ 637.706291][ T3015] pim6reg (unregistering): left allmulticast mode [ 638.110873][T22068] netlink: 'syz.4.4547': attribute type 1 has an invalid length. [ 638.661384][T22048] syzkaller0: entered promiscuous mode [ 638.668315][T22048] syzkaller0: entered allmulticast mode [ 638.676152][T22063] syzkaller1: entered promiscuous mode [ 638.681661][T22063] syzkaller1: entered allmulticast mode [ 638.924695][T22086] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4549'. [ 640.153640][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 640.608475][T22098] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4552'. [ 640.642427][ T7698] net_ratelimit: 19 callbacks suppressed [ 640.642449][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.656624][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.793657][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.835408][T22096] lo speed is unknown, defaulting to 1000 [ 640.883427][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.956233][ T3015] IPVS: stop unused estimator thread 0... [ 641.353871][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.362273][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.433687][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.443350][ T127] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.659282][T22152] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4565'. [ 641.675689][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.684125][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.738891][T22149] syzkaller0: entered promiscuous mode [ 641.747912][T22156] netlink: 'syz.4.4566': attribute type 21 has an invalid length. [ 641.749142][T22149] syzkaller0: entered allmulticast mode [ 641.756995][T22156] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4566'. [ 641.792335][T22156] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 642.309664][T22176] lo speed is unknown, defaulting to 1000 [ 642.452835][T22186] netlink: 'syz.0.4575': attribute type 21 has an invalid length. [ 642.469795][T22186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4575'. [ 642.548851][T22186] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 642.590712][T22187] syzkaller1: entered promiscuous mode [ 642.596589][T22187] syzkaller1: entered allmulticast mode [ 643.190157][T22218] bridge0: port 1(syz_tun) entered blocking state [ 643.231681][T22218] bridge0: port 1(syz_tun) entered disabled state [ 643.247279][T22218] syz_tun: entered allmulticast mode [ 643.257702][T22218] syz_tun: entered promiscuous mode [ 643.277854][T22218] bridge0: port 1(syz_tun) entered blocking state [ 643.284662][T22218] bridge0: port 1(syz_tun) entered forwarding state [ 643.307918][T22226] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4581'. [ 643.369731][T22228] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4581'. [ 643.937947][T22250] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4585'. [ 644.173212][T22255] netlink: 220 bytes leftover after parsing attributes in process `syz.2.4588'. [ 644.302686][T22259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4586'. [ 644.318683][T22262] netlink: 'syz.0.4589': attribute type 1 has an invalid length. [ 644.340803][T22259] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4586'. [ 644.405753][T22230] lec:lec_atm_close: lec0: Shut down! [ 644.470680][T22269] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 644.485024][T22269] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 644.676380][T22277] syzkaller0: entered promiscuous mode [ 644.681937][T22277] syzkaller0: entered allmulticast mode [ 644.843817][T22289] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4594'. [ 644.913154][T22295] netlink: 'syz.4.4597': attribute type 21 has an invalid length. [ 644.921247][T22295] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 645.283831][ T35] pimreg: left allmulticast mode [ 645.414226][ T35] batman_adv: batadv0: Removing interface: gretap1 [ 645.435169][ T35] bond3 (unregistering): (slave gretap2): Releasing active interface [ 645.538263][ T35] bond0 (unregistering): Released all slaves [ 645.550266][ T35] bond1 (unregistering): Released all slaves [ 645.577057][ T35] bond2 (unregistering): Released all slaves [ 645.596895][ T35] bond3 (unregistering): Released all slaves [ 645.618484][ T35] bond4 (unregistering): Released all slaves [ 645.647740][ T35] bond5 (unregistering): Released all slaves [ 645.668947][ T35] bond6 (unregistering): Released all slaves [ 645.700362][ T35] bond7 (unregistering): Released all slaves [ 645.724644][ T35] bond8 (unregistering): Released all slaves [ 645.913063][ T1318] net_ratelimit: 357 callbacks suppressed [ 645.913088][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.938146][ T7706] lec:lec_start_xmit: lec0:No lecd attached [ 645.975805][ T35] tipc: Left network mode [ 646.091405][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.387711][T22340] netlink: 'syz.4.4608': attribute type 21 has an invalid length. [ 646.437731][T22340] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 646.489307][T22347] vcan0: tx address claim with different name [ 646.727561][ T35] hsr_slave_0: left promiscuous mode [ 646.770259][ T35] hsr_slave_1: left promiscuous mode [ 646.945702][T22370] __nla_validate_parse: 8 callbacks suppressed [ 646.945726][T22370] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4614'. [ 647.022436][T22370] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4614'. [ 647.118452][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 647.195754][ T137] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 647.204466][T22064] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 647.817210][T22372] tipc: Enabling of bearer rejected, failed to enable media [ 648.130944][ T35] IPVS: stop unused estimator thread 0... [ 648.139003][T22411] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4620'. [ 648.159509][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 648.234683][T22414] x_tables: unsorted underflow at hook 2 [ 648.514978][T22435] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 648.545970][T22438] netlink: 'syz.3.4631': attribute type 1 has an invalid length. [ 648.624894][T22438] bond8: entered promiscuous mode [ 648.631383][T22438] bond8: entered allmulticast mode [ 648.639446][T22438] 8021q: adding VLAN 0 to HW filter on device bond8 [ 648.686792][T22438] veth5: entered promiscuous mode [ 648.695994][T22438] veth5: entered allmulticast mode [ 648.703458][T22438] bond8: (slave veth5): Enslaving as a backup interface with a down link [ 648.741108][T22438] veth7: entered promiscuous mode [ 648.746817][T22438] veth7: entered allmulticast mode [ 648.753072][T22438] bond8: (slave veth7): Enslaving as a backup interface with a down link [ 649.196603][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.548963][T22477] netlink: 'syz.2.4643': attribute type 1 has an invalid length. [ 649.565755][T22477] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4643'. [ 649.603146][T22477] bridge3: entered promiscuous mode [ 649.608569][T22477] bridge3: entered allmulticast mode [ 649.622023][T22477] team0: Failed to send port change of device bridge3 via netlink (err -105) [ 649.631910][T22477] team0: Failed to send options change via netlink (err -105) [ 649.640115][T22477] team0: Port device bridge3 added [ 649.757622][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.766531][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.209140][T22512] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4651'. [ 650.225160][T22514] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4652'. [ 650.474681][T22528] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4656'. [ 650.557968][T22531] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4659'. [ 650.655013][T22536] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4660'. [ 650.867924][T22543] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4663'. [ 651.034301][ T7698] net_ratelimit: 6 callbacks suppressed [ 651.034325][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.044597][T22064] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.049128][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.273544][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.315442][T22555] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 651.352134][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5410 ms [ 651.362361][ C0] lec:lec_tx_timeout: lec0 [ 651.367696][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 651.456391][T22555] syzkaller0: entered promiscuous mode [ 651.467975][T22573] netlink: 'syz.3.4671': attribute type 1 has an invalid length. [ 651.497501][T22555] syzkaller0: entered allmulticast mode [ 651.655649][T22576] bond9: (slave vxcan5): The slave device specified does not support setting the MAC address [ 651.670792][T22576] bond9: (slave vxcan5): Error -95 calling set_mac_address [ 651.678641][T17630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.925938][T22594] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.952340][T22594] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.960853][T22594] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.988026][T22594] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.011598][T22594] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 652.305201][T22608] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4677'. [ 653.067444][T22645] netlink: 'syz.3.4687': attribute type 1 has an invalid length. [ 653.231995][T22652] bond10: (slave vxcan5): The slave device specified does not support setting the MAC address [ 653.307430][T22657] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4691'. [ 653.323409][T22652] bond10: (slave vxcan5): Error -95 calling set_mac_address [ 653.448329][T22658] macvlan5: entered promiscuous mode [ 653.457432][T22658] macvlan5: entered allmulticast mode [ 653.466570][T22658] bond10: entered promiscuous mode [ 653.472971][T22658] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 653.490736][T22658] bond10: left promiscuous mode [ 653.728095][T22673] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4694'. [ 654.105282][T22687] dvmrp1: entered allmulticast mode [ 654.147369][T22689] dvmrp1: left allmulticast mode [ 654.183207][T22691] netlink: 204 bytes leftover after parsing attributes in process `syz.4.4700'. [ 654.200645][T22691] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4700'. [ 654.230288][T22693] x_tables: duplicate underflow at hook 2 [ 654.244917][T22691] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4700'. [ 654.457424][T22704] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4703'. [ 654.642680][T22712] FAULT_INJECTION: forcing a failure. [ 654.642680][T22712] name failslab, interval 1, probability 0, space 0, times 0 [ 654.648876][T22719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4706'. [ 654.697918][T22712] CPU: 1 UID: 0 PID: 22712 Comm: syz.4.4707 Not tainted syzkaller #0 PREEMPT(full) [ 654.697951][T22712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 654.697965][T22712] Call Trace: [ 654.697975][T22712] [ 654.697984][T22712] dump_stack_lvl+0xe8/0x150 [ 654.698034][T22712] should_fail_ex+0x412/0x560 [ 654.698074][T22712] should_failslab+0xa8/0x100 [ 654.698103][T22712] ? skb_clone+0x212/0x3a0 [ 654.698126][T22712] kmem_cache_alloc_noprof+0x87/0x650 [ 654.698150][T22712] ? apparmor_capable+0x126/0x170 [ 654.698185][T22712] skb_clone+0x212/0x3a0 [ 654.698204][T22712] ? nfnetlink_rcv+0x4b0/0x27b0 [ 654.698237][T22712] nfnetlink_rcv+0x4e2/0x27b0 [ 654.698277][T22712] ? lockdep_hardirqs_on+0x7a/0x110 [ 654.698317][T22712] ? __dev_queue_xmit+0x2b6/0x3980 [ 654.698340][T22712] ? __local_bh_enable_ip+0xd0/0x130 [ 654.698371][T22712] ? __dev_queue_xmit+0x1fe5/0x3980 [ 654.698391][T22712] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 654.698431][T22712] ? __dev_queue_xmit+0x2b6/0x3980 [ 654.698458][T22712] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 654.698501][T22712] ? ref_tracker_free+0x693/0x840 [ 654.698526][T22712] ? __pfx_ref_tracker_free+0x10/0x10 [ 654.698567][T22712] ? skb_clone+0x246/0x3a0 [ 654.698593][T22712] ? __netlink_deliver_tap+0x807/0x850 [ 654.698626][T22712] ? netlink_deliver_tap+0x2e/0x1b0 [ 654.698661][T22712] ? netlink_deliver_tap+0x2e/0x1b0 [ 654.698693][T22712] ? netlink_deliver_tap+0x2e/0x1b0 [ 654.698728][T22712] netlink_unicast+0x75c/0x8e0 [ 654.698768][T22712] netlink_sendmsg+0x813/0xb40 [ 654.698809][T22712] ? __pfx_netlink_sendmsg+0x10/0x10 [ 654.698846][T22712] ? aa_sock_msg_perm+0xf1/0x1b0 [ 654.698872][T22712] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 654.698904][T22712] ____sys_sendmsg+0x972/0x9f0 [ 654.698950][T22712] ? __pfx_____sys_sendmsg+0x10/0x10 [ 654.698994][T22712] ? import_iovec+0x73/0xa0 [ 654.699045][T22712] ___sys_sendmsg+0x2a5/0x360 [ 654.699087][T22712] ? __pfx____sys_sendmsg+0x10/0x10 [ 654.699157][T22712] ? __fget_files+0x2a/0x420 [ 654.699177][T22712] ? __fget_files+0x3a0/0x420 [ 654.699210][T22712] __x64_sys_sendmsg+0x1bd/0x2a0 [ 654.699248][T22712] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 654.699293][T22712] ? __pfx_ksys_write+0x10/0x10 [ 654.699339][T22712] do_syscall_64+0x14d/0xf80 [ 654.699366][T22712] ? trace_irq_disable+0x3b/0x150 [ 654.699388][T22712] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.699413][T22712] ? clear_bhb_loop+0x40/0x90 [ 654.699442][T22712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.699466][T22712] RIP: 0033:0x7fc6e5d9c819 [ 654.699489][T22712] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.699510][T22712] RSP: 002b:00007fc6e6ce3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 654.699536][T22712] RAX: ffffffffffffffda RBX: 00007fc6e6015fa0 RCX: 00007fc6e5d9c819 [ 654.699553][T22712] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 654.699569][T22712] RBP: 00007fc6e6ce3090 R08: 0000000000000000 R09: 0000000000000000 [ 654.699583][T22712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 654.699598][T22712] R13: 00007fc6e6016038 R14: 00007fc6e6015fa0 R15: 00007ffec5673368 [ 654.699633][T22712] [ 655.413274][T22743] netlink: 'syz.1.4713': attribute type 1 has an invalid length. [ 655.421159][T22743] netlink: 'syz.1.4713': attribute type 3 has an invalid length. [ 655.459946][T22746] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4715'. [ 655.532459][T22743] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4713'. [ 655.541728][T22743] NCSI netlink: No device for ifindex 813332851 [ 656.072419][ C0] net_ratelimit: 118 callbacks suppressed [ 656.072443][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.087160][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.095686][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.104115][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.112624][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.120977][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.129504][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.138115][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.146646][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.155066][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.360792][T22772] syzkaller0: entered promiscuous mode [ 656.366764][T22772] syzkaller0: entered allmulticast mode [ 656.382138][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 656.390227][ C0] lec:lec_tx_timeout: lec0 [ 656.396051][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 657.502050][T22818] __nla_validate_parse: 3 callbacks suppressed [ 657.528839][T22818] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4741'. [ 657.639671][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.646609][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.659279][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.686958][T22821] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 657.735818][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.758759][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.787269][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.796736][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.807322][T22821] wlan0 speed is unknown, defaulting to 1000 [ 657.818065][T22821] wlan0 speed is unknown, defaulting to 1000 [ 658.124131][T22843] gretap2: entered promiscuous mode [ 658.130297][T22843] batman_adv: batadv0: Adding interface: gretap2 [ 658.147875][T22845] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4750'. [ 658.155519][T22843] batman_adv: batadv0: The MTU of interface gretap2 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 658.244696][T22843] batman_adv: batadv0: Not using interface gretap2 (retrying later): interface not active [ 658.384798][T22851] syzkaller0: entered promiscuous mode [ 658.390372][T22851] syzkaller0: entered allmulticast mode [ 658.483951][T22856] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth1_to_hsr, syncid = 2, id = 0 [ 658.729719][T22862] IPv6: NLM_F_CREATE should be specified when creating new route [ 658.737772][T22862] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 658.745075][T22862] IPv6: NLM_F_CREATE should be set when creating new route [ 658.752416][T22862] IPv6: NLM_F_CREATE should be set when creating new route [ 658.759711][T22862] IPv6: NLM_F_CREATE should be set when creating new route [ 658.875417][T22862] xt_connbytes: Forcing CT accounting to be enabled [ 659.143066][T22880] netlink: 'syz.0.4760': attribute type 6 has an invalid length. [ 659.187951][T22880] netlink: 14585 bytes leftover after parsing attributes in process `syz.0.4760'. [ 659.405088][T22888] bridge_slave_0: left allmulticast mode [ 659.411154][T22888] bridge_slave_0: left promiscuous mode [ 659.417144][T22888] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.441376][T22888] bridge_slave_1: left allmulticast mode [ 659.448063][T22888] bridge_slave_1: left promiscuous mode [ 659.456404][T22888] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.478920][T22888] bond0: (slave bond_slave_0): Releasing backup interface [ 659.530655][T22888] bond0: (slave bond_slave_1): Releasing backup interface [ 659.583515][T22888] team0: Port device team_slave_0 removed [ 659.679406][T22888] team0: Port device team_slave_1 removed [ 659.719136][T22888] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 659.761723][T22888] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 659.855472][T22888] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 659.876435][T22888] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 660.090714][T22907] syzkaller0: entered promiscuous mode [ 660.096319][T22907] syzkaller0: entered allmulticast mode [ 660.144502][T22910] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4765'. [ 660.732963][T22929] tipc: Started in network mode [ 660.742313][T22929] tipc: Node identity 6ab93117889e, cluster identity 4711 [ 660.749706][T22929] tipc: Enabled bearer , priority 0 [ 660.772606][T22929] syzkaller0: entered promiscuous mode [ 660.778223][T22929] syzkaller0: entered allmulticast mode [ 660.798839][T22929] tipc: Resetting bearer [ 660.836427][T22929] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4770'. [ 661.051581][T22929] veth9: entered promiscuous mode [ 661.076868][T22928] tipc: Resetting bearer [ 661.108910][T22928] tipc: Disabling bearer [ 661.205040][T22913] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4766'. [ 661.215651][T22947] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4772'. [ 661.273026][ T3015] net_ratelimit: 157 callbacks suppressed [ 661.273049][ T3015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.287282][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.402775][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 661.410889][ C0] lec:lec_tx_timeout: lec0 [ 661.415916][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 661.435804][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.444251][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.635634][T22961] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4777'. [ 661.838079][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.853462][T22970] syzkaller0: entered promiscuous mode [ 661.858993][T22970] syzkaller0: entered allmulticast mode [ 662.392903][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.479345][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.487839][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.558138][T17630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.566346][T17630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.586254][T22996] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4789'. [ 662.669916][T22998] ip_vti0: entered promiscuous mode [ 662.677302][T22998] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4790'. [ 662.825104][T23010] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4795'. [ 662.837563][T23010] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4795'. [ 662.912064][T23014] netlink: 'syz.0.4796': attribute type 1 has an invalid length. [ 663.093208][T23020] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4799'. [ 663.153105][T23023] netlink: 'syz.0.4800': attribute type 21 has an invalid length. [ 663.161155][T23023] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4800'. [ 663.183892][T23023] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 663.207142][T23025] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4801'. [ 663.369237][T23031] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4805'. [ 663.666427][T23052] netlink: 'syz.0.4810': attribute type 1 has an invalid length. [ 663.835189][T23052] macvlan0: entered promiscuous mode [ 663.840559][T23052] macvlan0: entered allmulticast mode [ 663.847769][T23052] bond3: entered promiscuous mode [ 663.855302][T23052] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 663.872817][T23052] bond3: left promiscuous mode [ 663.934276][T23056] bond3: (slave vxcan1): The slave device specified does not support setting the MAC address [ 664.046755][T23056] bond3: (slave vxcan1): Error -95 calling set_mac_address [ 664.470653][T23077] bridge_slave_0: left allmulticast mode [ 664.490903][T23077] bridge_slave_0: left promiscuous mode [ 664.497869][T23077] bridge0: port 1(bridge_slave_0) entered disabled state [ 664.509763][T23077] bridge_slave_1: left allmulticast mode [ 664.516078][T23077] bridge_slave_1: left promiscuous mode [ 664.523991][T23077] bridge0: port 2(bridge_slave_1) entered disabled state [ 664.708793][T23077] bond0: (slave bond_slave_0): Releasing backup interface [ 664.772723][T23077] bond0: (slave bond_slave_1): Releasing backup interface [ 664.784945][T23077] team0: Port device team_slave_0 removed [ 664.793665][T23077] team0: Port device team_slave_1 removed [ 664.799793][T23077] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 664.810969][T23077] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 664.822622][T23077] bond2: (slave gretap1): Releasing active interface [ 664.833147][T23077] bond8: (slave veth5): Releasing backup interface [ 664.839790][T23077] bond8: (slave veth5): the permanent HWaddr of slave - 7e:9b:98:e7:cb:fc - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 664.858072][T23077] veth5: left promiscuous mode [ 664.863642][T23077] veth5: left allmulticast mode [ 664.870978][T23077] bond8: (slave veth7): Releasing backup interface [ 664.885048][T23077] veth7: left promiscuous mode [ 664.889970][T23077] veth7: left allmulticast mode [ 665.431410][T23120] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4826'. [ 665.884226][T23130] netlink: 'syz.4.4828': attribute type 10 has an invalid length. [ 665.899140][T23130] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4828'. [ 665.953752][T23130] batadv0: entered promiscuous mode [ 665.959204][T23130] batadv0: entered allmulticast mode [ 665.995850][T23130] bridge0: port 2(batadv0) entered blocking state [ 666.018216][T23130] bridge0: port 2(batadv0) entered disabled state [ 666.059734][T23132] FAULT_INJECTION: forcing a failure. [ 666.059734][T23132] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 666.065689][T23130] bridge0: port 2(batadv0) entered blocking state [ 666.074383][T23132] CPU: 1 UID: 0 PID: 23132 Comm: syz.2.4829 Not tainted syzkaller #0 PREEMPT(full) [ 666.074494][T23132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 666.074536][T23132] Call Trace: [ 666.074567][T23132] [ 666.074590][T23132] dump_stack_lvl+0xe8/0x150 [ 666.074696][T23132] should_fail_ex+0x412/0x560 [ 666.074814][T23132] _copy_from_user+0x2d/0xb0 [ 666.074910][T23132] ___sys_sendmsg+0x1c6/0x360 [ 666.075032][T23132] ? __pfx____sys_sendmsg+0x10/0x10 [ 666.075240][T23132] ? __fget_files+0x2a/0x420 [ 666.075298][T23132] ? __fget_files+0x3a0/0x420 [ 666.075404][T23132] __x64_sys_sendmsg+0x1bd/0x2a0 [ 666.075506][T23132] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 666.075635][T23132] ? __pfx_ksys_write+0x10/0x10 [ 666.075742][T23132] do_syscall_64+0x14d/0xf80 [ 666.075817][T23132] ? trace_irq_disable+0x3b/0x150 [ 666.075885][T23132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.075979][T23132] ? clear_bhb_loop+0x40/0x90 [ 666.076089][T23132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.076153][T23132] RIP: 0033:0x7fbdeed9c819 [ 666.076210][T23132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 666.076264][T23132] RSP: 002b:00007fbdefbc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 666.076340][T23132] RAX: ffffffffffffffda RBX: 00007fbdef015fa0 RCX: 00007fbdeed9c819 [ 666.076385][T23132] RDX: 000000000000a004 RSI: 0000200000000300 RDI: 0000000000000004 [ 666.076428][T23132] RBP: 00007fbdefbc3090 R08: 0000000000000000 R09: 0000000000000000 [ 666.076471][T23132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 666.076514][T23132] R13: 00007fbdef016038 R14: 00007fbdef015fa0 R15: 00007ffd27d45d28 [ 666.076617][T23132] [ 666.257011][T23130] bridge0: port 2(batadv0) entered forwarding state [ 666.383214][ T58] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 666.393228][ T58] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 666.422147][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 666.430201][ C0] lec:lec_tx_timeout: lec0 [ 666.435027][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 666.645016][ T7698] net_ratelimit: 102 callbacks suppressed [ 666.645039][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.659298][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.701835][T23152] netlink: 'syz.0.4836': attribute type 1 has an invalid length. [ 666.916696][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.998954][T23158] bond4: (slave vxcan1): The slave device specified does not support setting the MAC address [ 667.032998][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.041544][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.060715][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.133260][T23158] bond4: (slave vxcan1): Error -95 calling set_mac_address [ 667.193844][T23162] macvlan0: entered promiscuous mode [ 667.199332][T23162] macvlan0: entered allmulticast mode [ 667.205744][T23162] bond4: entered promiscuous mode [ 667.211541][T23162] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 667.225947][T23162] bond4: left promiscuous mode [ 667.256816][T23167] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 667.386589][T23177] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 667.434208][T23181] openvswitch: netlink: Flow key attr not present in new flow. [ 667.592796][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.657458][T23195] bond0: option arp_validate: invalid value (55553) [ 667.674945][ T3015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.876770][T23205] __nla_validate_parse: 1 callbacks suppressed [ 667.876795][T23205] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4853'. [ 667.895111][T23205] bridge0: port 2(bridge_slave_1) entered disabled state [ 667.902739][T23205] bridge0: port 1(bridge_slave_0) entered disabled state [ 667.916268][T23207] netlink: 'syz.1.4854': attribute type 1 has an invalid length. [ 667.920183][T23205] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4853'. [ 667.950786][T23205] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.958108][T23205] bridge0: port 2(bridge_slave_1) entered forwarding state [ 667.966494][T23205] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.973689][T23205] bridge0: port 1(bridge_slave_0) entered forwarding state [ 667.986890][T23205] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4853'. [ 668.011193][T23207] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 668.023101][T23207] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 668.038218][ T5829] block nbd0: Receive control failed (result -32) [ 668.038485][ T5834] block nbd0: Receive control failed (result -32) [ 668.044777][T23211] block nbd0: Receive control failed (result -32) [ 668.057904][ T5832] block nbd0: Receive control failed (result -32) [ 668.064574][T23210] block nbd0: Receive control failed (result -32) [ 668.087879][T23205] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.095230][T23205] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.123049][T23212] macvlan2: entered promiscuous mode [ 668.128415][T23212] macvlan2: entered allmulticast mode [ 668.135627][T23212] bond4: entered promiscuous mode [ 668.144439][T23212] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 668.167583][T23212] bond4: left promiscuous mode [ 668.333620][T23228] tipc: Enabled bearer , priority 10 [ 668.503646][T23236] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4861'. [ 669.455317][T23275] netlink: 'syz.2.4871': attribute type 1 has an invalid length. [ 669.499172][T23275] bond10: (slave vxcan5): The slave device specified does not support setting the MAC address [ 669.510867][T23275] bond10: (slave vxcan5): Error -95 calling set_mac_address [ 669.566987][T23277] macvlan2: entered promiscuous mode [ 669.572579][T23277] macvlan2: entered allmulticast mode [ 669.578888][T23277] bond10: entered promiscuous mode [ 669.585533][T23277] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 669.602623][T23277] bond10: left promiscuous mode [ 670.178500][T23305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4883'. [ 670.196053][T23303] bond11: entered allmulticast mode [ 670.201895][T23305] veth0: entered allmulticast mode [ 670.207251][T23305] veth0: entered promiscuous mode [ 670.214047][T23305] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4883'. [ 670.223928][T23305] veth0: left allmulticast mode [ 670.228915][T23305] veth0: left promiscuous mode [ 670.297536][T23310] netlink: 71 bytes leftover after parsing attributes in process `syz.3.4884'. [ 671.442145][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 671.450203][ C0] lec:lec_tx_timeout: lec0 [ 671.455794][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 671.465885][T23236] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 671.661430][T23343] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4895'. [ 671.679309][T23343] bridge0: entered promiscuous mode [ 671.692565][T23343] macvtap1: entered promiscuous mode [ 671.710031][T23343] macvtap1: entered allmulticast mode [ 671.723758][T23350] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4895'. [ 671.751536][T23343] bridge0: entered allmulticast mode [ 671.765431][T23350] bridge0: left allmulticast mode [ 671.770683][T23350] bridge0: left promiscuous mode [ 671.844063][ T7698] net_ratelimit: 29 callbacks suppressed [ 671.844086][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.858562][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.869330][T23352] syzkaller0: entered promiscuous mode [ 671.885747][T23352] syzkaller0: entered allmulticast mode [ 671.919320][T23349] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4897'. [ 671.964446][T23347] wlan0 speed is unknown, defaulting to 1000 [ 671.992469][ T7698] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.418266][T23376] FAULT_INJECTION: forcing a failure. [ 672.418266][T23376] name failslab, interval 1, probability 0, space 0, times 0 [ 672.455888][T23378] xt_connbytes: Forcing CT accounting to be enabled [ 672.456664][T23376] CPU: 1 UID: 0 PID: 23376 Comm: syz.3.4904 Not tainted syzkaller #0 PREEMPT(full) [ 672.456747][T23376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 672.456789][T23376] Call Trace: [ 672.456812][T23376] [ 672.456843][T23376] dump_stack_lvl+0xe8/0x150 [ 672.456943][T23376] should_fail_ex+0x412/0x560 [ 672.457054][T23376] should_failslab+0xa8/0x100 [ 672.457149][T23376] __kmalloc_cache_noprof+0x88/0x660 [ 672.457227][T23376] ? nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 672.457343][T23376] nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 672.457464][T23376] notifier_call_chain+0x1be/0x400 [ 672.457627][T23376] blocking_notifier_call_chain+0x6a/0x90 [ 672.457698][T23376] netlink_release+0x123b/0x1ad0 [ 672.457817][T23376] ? netlink_release+0x101/0x1ad0 [ 672.457904][T23376] ? __pfx_netlink_release+0x10/0x10 [ 672.457988][T23376] ? down_write+0x16d/0x200 [ 672.458066][T23376] ? __pfx_down_write+0x10/0x10 [ 672.458152][T23376] ? locks_remove_posix+0x14f/0x6d0 [ 672.458258][T23376] sock_close+0xc3/0x240 [ 672.458333][T23376] ? __pfx_sock_close+0x10/0x10 [ 672.458399][T23376] __fput+0x44f/0xa70 [ 672.458547][T23376] fput_close_sync+0x11f/0x240 [ 672.458646][T23376] ? __pfx_fput_close_sync+0x10/0x10 [ 672.458711][T23376] __x64_sys_close+0x7e/0x110 [ 672.458777][T23376] do_syscall_64+0x14d/0xf80 [ 672.458865][T23376] ? trace_irq_disable+0x3b/0x150 [ 672.458948][T23376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.459013][T23376] ? clear_bhb_loop+0x40/0x90 [ 672.459091][T23376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 672.459156][T23376] RIP: 0033:0x7fefc6f9c819 [ 672.459220][T23376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 672.459274][T23376] RSP: 002b:00007fefc7e68028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 672.459347][T23376] RAX: ffffffffffffffda RBX: 00007fefc7216090 RCX: 00007fefc6f9c819 [ 672.459392][T23376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 672.459518][T23376] RBP: 00007fefc7e68090 R08: 0000000000000000 R09: 0000000000000000 [ 672.459555][T23376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 672.459597][T23376] R13: 00007fefc7216128 R14: 00007fefc7216090 R15: 00007fff74c62828 [ 672.459698][T23376] [ 672.793326][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.801750][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.810795][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.874027][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.882435][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.907101][T23392] __nla_validate_parse: 6 callbacks suppressed [ 672.907123][T23392] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4910'. [ 672.927946][T23389] bridge0: entered promiscuous mode [ 672.933737][T23389] bridge0: entered allmulticast mode [ 672.968155][T23392] bridge0: left allmulticast mode [ 672.993738][T23392] bridge0: left promiscuous mode [ 673.112588][ T3015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 673.152048][T23401] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4915'. [ 673.165209][T23404] openvswitch: netlink: Flow key attr not present in new flow. [ 673.229317][T23407] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4918'. [ 673.395149][T23416] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.4922'. [ 673.435094][T23416] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4922'. [ 673.460429][T23416] netlink: 'syz.2.4922': attribute type 30 has an invalid length. [ 673.475152][T23420] FAULT_INJECTION: forcing a failure. [ 673.475152][T23420] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 673.496265][T23420] CPU: 1 UID: 0 PID: 23420 Comm: syz.3.4923 Not tainted syzkaller #0 PREEMPT(full) [ 673.496298][T23420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 673.496314][T23420] Call Trace: [ 673.496323][T23420] [ 673.496342][T23420] dump_stack_lvl+0xe8/0x150 [ 673.496381][T23420] should_fail_ex+0x412/0x560 [ 673.496423][T23420] _copy_from_user+0x2d/0xb0 [ 673.496454][T23420] ___sys_sendmsg+0x1c6/0x360 [ 673.496496][T23420] ? __pfx____sys_sendmsg+0x10/0x10 [ 673.496569][T23420] ? __fget_files+0x2a/0x420 [ 673.496591][T23420] ? __fget_files+0x3a0/0x420 [ 673.496624][T23420] __x64_sys_sendmsg+0x1bd/0x2a0 [ 673.496664][T23420] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 673.496709][T23420] ? __pfx_ksys_write+0x10/0x10 [ 673.496749][T23420] do_syscall_64+0x14d/0xf80 [ 673.496775][T23420] ? trace_irq_disable+0x3b/0x150 [ 673.496796][T23420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.496821][T23420] ? clear_bhb_loop+0x40/0x90 [ 673.496850][T23420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.496884][T23420] RIP: 0033:0x7fefc6f9c819 [ 673.496906][T23420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 673.496927][T23420] RSP: 002b:00007fefc7e89028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 673.496953][T23420] RAX: ffffffffffffffda RBX: 00007fefc7215fa0 RCX: 00007fefc6f9c819 [ 673.496970][T23420] RDX: 000000000000c020 RSI: 0000200000000000 RDI: 0000000000000003 [ 673.496987][T23420] RBP: 00007fefc7e89090 R08: 0000000000000000 R09: 0000000000000000 [ 673.497003][T23420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 673.497018][T23420] R13: 00007fefc7216038 R14: 00007fefc7215fa0 R15: 00007fff74c62828 [ 673.497054][T23420] [ 673.687999][T23416] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4922'. [ 673.696991][T23416] netlink: 'syz.2.4922': attribute type 30 has an invalid length. [ 673.715741][T23423] FAULT_INJECTION: forcing a failure. [ 673.715741][T23423] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 673.729637][T23423] CPU: 0 UID: 0 PID: 23423 Comm: syz.0.4925 Not tainted syzkaller #0 PREEMPT(full) [ 673.729666][T23423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 673.729680][T23423] Call Trace: [ 673.729690][T23423] [ 673.729701][T23423] dump_stack_lvl+0xe8/0x150 [ 673.729739][T23423] should_fail_ex+0x412/0x560 [ 673.729779][T23423] _copy_from_iter+0x1d3/0x1670 [ 673.729809][T23423] ? rcu_is_watching+0x15/0xb0 [ 673.729847][T23423] ? __pfx__copy_from_iter+0x10/0x10 [ 673.729880][T23423] ? netlink_sendmsg+0x650/0xb40 [ 673.729910][T23423] ? skb_put+0x11b/0x210 [ 673.729945][T23423] netlink_sendmsg+0x6c0/0xb40 [ 673.729986][T23423] ? __pfx_netlink_sendmsg+0x10/0x10 [ 673.730021][T23423] ? aa_sock_msg_perm+0xf1/0x1b0 [ 673.730046][T23423] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 673.730076][T23423] ____sys_sendmsg+0x972/0x9f0 [ 673.730119][T23423] ? __pfx_____sys_sendmsg+0x10/0x10 [ 673.730162][T23423] ? import_iovec+0x73/0xa0 [ 673.730192][T23423] ___sys_sendmsg+0x2a5/0x360 [ 673.730232][T23423] ? __pfx____sys_sendmsg+0x10/0x10 [ 673.730302][T23423] ? __fget_files+0x2a/0x420 [ 673.730324][T23423] ? __fget_files+0x3a0/0x420 [ 673.730357][T23423] __x64_sys_sendmsg+0x1bd/0x2a0 [ 673.730394][T23423] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 673.730438][T23423] ? __pfx_ksys_write+0x10/0x10 [ 673.730477][T23423] do_syscall_64+0x14d/0xf80 [ 673.730503][T23423] ? trace_irq_disable+0x3b/0x150 [ 673.730523][T23423] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.730546][T23423] ? clear_bhb_loop+0x40/0x90 [ 673.730580][T23423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.730603][T23423] RIP: 0033:0x7f9efeb9c819 [ 673.730628][T23423] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 673.730648][T23423] RSP: 002b:00007f9eff9ec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 673.730672][T23423] RAX: ffffffffffffffda RBX: 00007f9efee15fa0 RCX: 00007f9efeb9c819 [ 673.730689][T23423] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 673.730704][T23423] RBP: 00007f9eff9ec090 R08: 0000000000000000 R09: 0000000000000000 [ 673.730719][T23423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 673.730733][T23423] R13: 00007f9efee16038 R14: 00007f9efee15fa0 R15: 00007fff1a2ee4b8 [ 673.730768][T23423] [ 673.964604][T17630] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 673.975124][T17630] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 673.984312][T17630] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 674.002344][T17630] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 674.096736][T23426] team0: Mode changed to "broadcast" [ 674.125986][T23428] FAULT_INJECTION: forcing a failure. [ 674.125986][T23428] name failslab, interval 1, probability 0, space 0, times 0 [ 674.169355][T23428] CPU: 1 UID: 0 PID: 23428 Comm: syz.4.4928 Not tainted syzkaller #0 PREEMPT(full) [ 674.169387][T23428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 674.169403][T23428] Call Trace: [ 674.169412][T23428] [ 674.169423][T23428] dump_stack_lvl+0xe8/0x150 [ 674.169471][T23428] should_fail_ex+0x412/0x560 [ 674.169509][T23428] ? sock_alloc_inode+0x28/0xc0 [ 674.169536][T23428] should_failslab+0xa8/0x100 [ 674.169575][T23428] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 674.169609][T23428] ? __pfx_sock_alloc_inode+0x10/0x10 [ 674.169635][T23428] sock_alloc_inode+0x28/0xc0 [ 674.169661][T23428] alloc_inode+0x6a/0x1b0 [ 674.169697][T23428] __sock_create+0x12d/0x9d0 [ 674.169736][T23428] __sys_socket+0xd6/0x1b0 [ 674.169769][T23428] __x64_sys_socket+0x7a/0x90 [ 674.169799][T23428] do_syscall_64+0x14d/0xf80 [ 674.169826][T23428] ? trace_irq_disable+0x3b/0x150 [ 674.169848][T23428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.169872][T23428] ? clear_bhb_loop+0x40/0x90 [ 674.169902][T23428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.169926][T23428] RIP: 0033:0x7fc6e5d9c819 [ 674.169948][T23428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.169968][T23428] RSP: 002b:00007fc6e6ce3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 674.169990][T23428] RAX: ffffffffffffffda RBX: 00007fc6e6015fa0 RCX: 00007fc6e5d9c819 [ 674.170007][T23428] RDX: 0000000000000003 RSI: 000000000000000a RDI: 0000000000000018 [ 674.170023][T23428] RBP: 00007fc6e6ce3090 R08: 0000000000000000 R09: 0000000000000000 [ 674.170038][T23428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 674.170053][T23428] R13: 00007fc6e6016038 R14: 00007fc6e6015fa0 R15: 00007ffec5673368 [ 674.170089][T23428] [ 674.613302][T23442] netlink: 'syz.1.4932': attribute type 21 has an invalid length. [ 674.625335][T23442] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4932'. [ 674.635618][T23442] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 674.944617][T23455] batadv_slave_1: entered promiscuous mode [ 674.951434][T23456] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4937'. [ 674.974985][T23456] batadv_slave_1 (unregistering): left promiscuous mode [ 675.105818][T23465] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4939'. [ 675.485362][T23481] netlink: 'syz.0.4944': attribute type 21 has an invalid length. [ 675.493320][T23481] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4944'. [ 675.502437][T23481] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 675.784885][T23489] wlan0 speed is unknown, defaulting to 1000 [ 675.928043][T23499] netlink: 'syz.0.4950': attribute type 1 has an invalid length. [ 676.012991][T23499] 8021q: adding VLAN 0 to HW filter on device bond5 [ 676.134459][T23504] bond5: (slave geneve3): making interface the new active one [ 676.146342][T23504] bond5: (slave geneve3): Enslaving as an active interface with an up link [ 676.381994][T23525] siw: device registration error -23 [ 676.462131][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 676.470345][ C0] lec:lec_tx_timeout: lec0 [ 676.475105][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 676.621517][T23535] netlink: 'syz.4.4958': attribute type 21 has an invalid length. [ 676.629573][T23535] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 676.868600][T23549] xt_time: unknown flags 0xf4 [ 677.113464][ T7697] net_ratelimit: 1052 callbacks suppressed [ 677.113487][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.127923][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.215105][T22064] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.593015][ T7706] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.756103][ T7697] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.917958][T22064] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.163191][T22064] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.172000][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.172990][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.243240][ T3015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.276042][T23607] bridge0: entered promiscuous mode [ 678.281311][T23607] bridge0: entered allmulticast mode [ 678.346091][T23618] netlink: 'syz.4.4973': attribute type 21 has an invalid length. [ 678.361912][T23618] __nla_validate_parse: 3 callbacks suppressed [ 678.361941][T23618] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4973'. [ 678.378380][T23618] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 678.937887][T23643] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4980'. [ 679.417021][T23648] macvtap0: entered promiscuous mode [ 679.427547][T23647] macvtap0: left promiscuous mode [ 679.538299][T23651] sctp: [Deprecated]: syz.0.4983 (pid 23651) Use of struct sctp_assoc_value in delayed_ack socket option. [ 679.538299][T23651] Use struct sctp_sack_info instead [ 679.707017][T23543] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 679.983101][T23660] netlink: 'syz.2.4986': attribute type 21 has an invalid length. [ 679.996598][T23660] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4986'. [ 680.045842][T23660] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 680.176443][T23671] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4992'. [ 680.652986][T23691] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4996'. [ 680.661933][T23691] bond0: option lp_interval: invalid value (18446744072210219584) [ 680.670713][T23691] bond0: option lp_interval: allowed values 1 - 2147483647 [ 681.209844][T23711] nftables ruleset with unbound chain [ 681.341598][T23709] syzkaller0: entered promiscuous mode [ 681.348394][T23709] syzkaller0: entered allmulticast mode [ 681.451603][T23718] wlan0 speed is unknown, defaulting to 1000 [ 681.482182][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 681.490363][ C0] lec:lec_tx_timeout: lec0 [ 681.496769][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 681.747626][T23732] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 681.761255][T23732] netlink: 356 bytes leftover after parsing attributes in process `syz.2.5008'. [ 682.275508][T23742] netlink: 156 bytes leftover after parsing attributes in process `syz.4.5009'. [ 682.360471][T23744] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5010'. [ 683.123709][T23729] netlink: 'syz.2.5008': attribute type 6 has an invalid length. [ 683.131495][T23729] netlink: 'syz.2.5008': attribute type 7 has an invalid length. [ 683.140337][T23729] netlink: 'syz.2.5008': attribute type 8 has an invalid length. [ 683.148376][T23729] netlink: 'syz.2.5008': attribute type 15 has an invalid length. [ 683.218088][T23744] 8021q: adding VLAN 0 to HW filter on device bond1 [ 683.357598][T23752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5014'. [ 683.441898][T23757] FAULT_INJECTION: forcing a failure. [ 683.441898][T23757] name failslab, interval 1, probability 0, space 0, times 0 [ 683.469964][T23763] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5016'. [ 683.534574][T23757] CPU: 1 UID: 0 PID: 23757 Comm: syz.3.5015 Not tainted syzkaller #0 PREEMPT(full) [ 683.534604][T23757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 683.534618][T23757] Call Trace: [ 683.534627][T23757] [ 683.534637][T23757] dump_stack_lvl+0xe8/0x150 [ 683.534667][T23757] should_fail_ex+0x412/0x560 [ 683.534698][T23757] should_failslab+0xa8/0x100 [ 683.534722][T23757] __kmalloc_noprof+0xe8/0x760 [ 683.534742][T23757] ? nft_set_elem_expr_alloc+0x1a5/0x5f0 [ 683.534772][T23757] nft_set_elem_expr_alloc+0x1a5/0x5f0 [ 683.534797][T23757] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 683.534829][T23757] ? nft_rhash_init+0x2c0/0x3b0 [ 683.534854][T23757] ? __pfx_nft_rhash_init+0x10/0x10 [ 683.534875][T23757] ? kasan_quarantine_put+0xbb/0x1f0 [ 683.534894][T23757] ? __pfx_nft_rhash_key+0x10/0x10 [ 683.534916][T23757] ? __pfx_nft_rhash_obj+0x10/0x10 [ 683.534938][T23757] ? __pfx_nft_rhash_cmp+0x10/0x10 [ 683.534964][T23757] nft_set_expr_alloc+0x68/0x760 [ 683.534985][T23757] ? nf_tables_newset+0x13bf/0x2580 [ 683.535006][T23757] nf_tables_newset+0x1c6b/0x2580 [ 683.535034][T23757] ? __pfx_nf_tables_newset+0x10/0x10 [ 683.535068][T23757] ? __nla_parse+0x40/0x60 [ 683.535090][T23757] nfnetlink_rcv+0x1240/0x27b0 [ 683.535137][T23757] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 683.535157][T23757] ? __lock_acquire+0x6b5/0x2cf0 [ 683.535187][T23757] ? ___sys_sendmsg+0x2a5/0x360 [ 683.535210][T23757] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 683.535234][T23757] ? do_syscall_64+0x14d/0xf80 [ 683.535253][T23757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.535304][T23757] ? netlink_deliver_tap+0x2e/0x1b0 [ 683.535327][T23757] ? netlink_deliver_tap+0x2e/0x1b0 [ 683.535355][T23757] netlink_unicast+0x75c/0x8e0 [ 683.535385][T23757] netlink_sendmsg+0x813/0xb40 [ 683.535416][T23757] ? __pfx_netlink_sendmsg+0x10/0x10 [ 683.535442][T23757] ? aa_sock_msg_perm+0xf1/0x1b0 [ 683.535460][T23757] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 683.535483][T23757] ____sys_sendmsg+0x972/0x9f0 [ 683.535521][T23757] ? __pfx_____sys_sendmsg+0x10/0x10 [ 683.535553][T23757] ? import_iovec+0x73/0xa0 [ 683.535576][T23757] ___sys_sendmsg+0x2a5/0x360 [ 683.535608][T23757] ? __pfx____sys_sendmsg+0x10/0x10 [ 683.535660][T23757] ? __fget_files+0x2a/0x420 [ 683.535675][T23757] ? __fget_files+0x3a0/0x420 [ 683.535699][T23757] __x64_sys_sendmsg+0x1bd/0x2a0 [ 683.535726][T23757] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 683.535760][T23757] ? __pfx_ksys_write+0x10/0x10 [ 683.535789][T23757] do_syscall_64+0x14d/0xf80 [ 683.535807][T23757] ? trace_irq_disable+0x3b/0x150 [ 683.535821][T23757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.535838][T23757] ? clear_bhb_loop+0x40/0x90 [ 683.535859][T23757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.535875][T23757] RIP: 0033:0x7fefc6f9c819 [ 683.535891][T23757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 683.535906][T23757] RSP: 002b:00007fefc7e89028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 683.535925][T23757] RAX: ffffffffffffffda RBX: 00007fefc7215fa0 RCX: 00007fefc6f9c819 [ 683.535937][T23757] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000007 [ 683.535948][T23757] RBP: 00007fefc7e89090 R08: 0000000000000000 R09: 0000000000000000 [ 683.535959][T23757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 683.535969][T23757] R13: 00007fefc7216038 R14: 00007fefc7215fa0 R15: 00007fff74c62828 [ 683.535995][T23757] [ 683.887770][ T10] net_ratelimit: 13 callbacks suppressed [ 683.887792][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.916744][T17630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.925386][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.093092][T23770] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 684.203769][T23775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5019'. [ 684.267746][T23779] netlink: 'syz.4.5022': attribute type 10 has an invalid length. [ 684.314829][ T127] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.323756][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 684.335258][T23779] team0: Port device dummy0 added [ 684.428408][T23788] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 684.463238][ T10] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 684.472978][ T127] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 684.638425][T23799] netlink: 'syz.4.5027': attribute type 10 has an invalid length. [ 684.646535][T23799] netlink: 152 bytes leftover after parsing attributes in process `syz.4.5027'. [ 684.867961][T23810] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5034'. [ 684.889718][T23810] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5034'. [ 684.903206][ T10] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 684.923447][T23810] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5034'. [ 685.065424][T23819] netlink: 'syz.1.5036': attribute type 10 has an invalid length. [ 685.078273][T23821] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5039'. [ 685.092635][T23819] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5036'. [ 685.101687][T23819] dummy0: entered promiscuous mode [ 685.134185][T23819] dummy0: entered allmulticast mode [ 685.160720][T23819] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 685.361957][T23833] netlink: 'syz.0.5045': attribute type 30 has an invalid length. [ 685.513414][ T127] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 685.542468][ T127] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 685.703282][T23853] bridge0: port 1(syz_tun) entered blocking state [ 685.732409][T23853] bridge0: port 1(syz_tun) entered disabled state [ 685.740748][T23853] syz_tun: entered allmulticast mode [ 685.751206][T23853] syz_tun: entered promiscuous mode [ 685.800028][T23858] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.819948][T23851] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.851692][T23851] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.870595][T23851] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.942441][ T7697] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 685.956454][ T7697] IPVS: starting estimator thread 0... [ 686.082435][T23865] IPVS: using max 27 ests per chain, 64800 per kthread [ 686.237635][ T1300] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.246797][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.493765][T23889] bridge0: port 3(syz_tun) entered blocking state [ 686.502694][T23889] bridge0: port 3(syz_tun) entered disabled state [ 686.509478][T23889] syz_tun: entered allmulticast mode [ 686.529600][T23889] syz_tun: entered promiscuous mode [ 686.578418][T23869] lec:lec_atm_close: lec0: Shut down! [ 686.861242][T23905] syzkaller0: entered promiscuous mode [ 686.867405][T23905] syzkaller0: entered allmulticast mode [ 686.955143][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.029326][T23911] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 687.133365][T23914] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 689.063601][T23873] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 689.248910][T23926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.259919][T23926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.272347][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 689.289870][T23924] syzkaller0: entered promiscuous mode [ 689.295849][T23924] syzkaller0: entered allmulticast mode [ 689.322813][T23930] openvswitch: netlink: nsh attribute has 881 unknown bytes. [ 689.433369][T17630] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.441767][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.518850][T23946] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 689.539121][T23946] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.548121][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.575497][T23946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5083'. [ 689.589605][T23946] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.642618][T23955] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.651380][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.682906][T23954] wlan0 speed is unknown, defaulting to 1000 [ 689.747841][T23946] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.861152][T23946] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 689.893566][T23962] netlink: 'syz.0.5088': attribute type 1 has an invalid length. [ 689.897291][T23965] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5089'. [ 690.023601][T23962] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5088'. [ 690.063872][T23967] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 690.085673][T23967] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 690.130181][T23977] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5092'. [ 690.148797][T23946] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 690.181641][T23978] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5092'. [ 690.209538][T23973] macvlan0: entered promiscuous mode [ 690.218539][T23973] macvlan0: entered allmulticast mode [ 690.227581][T23973] bond6: entered promiscuous mode [ 690.234701][T23973] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 690.246921][T23973] bond6: left promiscuous mode [ 690.272698][T23978] FAULT_INJECTION: forcing a failure. [ 690.272698][T23978] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 690.292174][T23978] CPU: 1 UID: 0 PID: 23978 Comm: syz.4.5092 Not tainted syzkaller #0 PREEMPT(full) [ 690.292205][T23978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 690.292221][T23978] Call Trace: [ 690.292231][T23978] [ 690.292242][T23978] dump_stack_lvl+0xe8/0x150 [ 690.292282][T23978] should_fail_ex+0x412/0x560 [ 690.292324][T23978] _copy_to_user+0x31/0xb0 [ 690.292355][T23978] simple_read_from_buffer+0xe1/0x170 [ 690.292396][T23978] proc_fail_nth_read+0x1bb/0x230 [ 690.292445][T23978] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.292482][T23978] ? rw_verify_area+0x2a6/0x4d0 [ 690.292507][T23978] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.292544][T23978] vfs_read+0x20c/0xa70 [ 690.292567][T23978] ? fdget_pos+0x246/0x320 [ 690.292593][T23978] ? __pfx___mutex_lock+0x10/0x10 [ 690.292623][T23978] ? __pfx_vfs_read+0x10/0x10 [ 690.292650][T23978] ? __fget_files+0x2a/0x420 [ 690.292676][T23978] ? __fget_files+0x3a0/0x420 [ 690.292696][T23978] ? __fget_files+0x2a/0x420 [ 690.292727][T23978] ksys_read+0x150/0x270 [ 690.292755][T23978] ? __pfx_ksys_read+0x10/0x10 [ 690.292792][T23978] do_syscall_64+0x14d/0xf80 [ 690.292818][T23978] ? trace_irq_disable+0x3b/0x150 [ 690.292839][T23978] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.292880][T23978] ? clear_bhb_loop+0x40/0x90 [ 690.292915][T23978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.292939][T23978] RIP: 0033:0x7fc6e5d5d04e [ 690.292961][T23978] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 690.292981][T23978] RSP: 002b:00007fc6e6cc1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 690.293005][T23978] RAX: ffffffffffffffda RBX: 00007fc6e6cc26c0 RCX: 00007fc6e5d5d04e [ 690.293023][T23978] RDX: 000000000000000f RSI: 00007fc6e6cc20a0 RDI: 0000000000000004 [ 690.293039][T23978] RBP: 00007fc6e6cc2090 R08: 0000000000000000 R09: 0000000000000000 [ 690.293054][T23978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 690.293069][T23978] R13: 00007fc6e6016128 R14: 00007fc6e6016090 R15: 00007ffec5673368 [ 690.293106][T23978] [ 690.676076][T23985] syzkaller1: entered promiscuous mode [ 690.681703][T23985] syzkaller1: entered allmulticast mode [ 690.690851][ T58] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.754508][ T58] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.879791][ T58] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.981512][T23991] syzkaller0: entered promiscuous mode [ 690.987506][T23991] syzkaller0: entered allmulticast mode [ 691.001542][ T58] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.322128][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 692.330366][ C0] lec:lec_tx_timeout: lec0 [ 692.337275][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 692.843983][T24018] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 692.867895][T24018] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.930571][T24020] tipc: New replicast peer: 255.255.255.255 [ 692.940925][T24020] tipc: Enabled bearer , priority 6 [ 692.959847][T24038] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5109'. [ 693.011054][T24043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5109'. [ 693.032614][T24038] veth0: entered allmulticast mode [ 693.037809][T24038] veth0: entered promiscuous mode [ 693.092049][T24043] veth0: left allmulticast mode [ 693.097763][T24043] veth0: left promiscuous mode [ 693.153848][T24018] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 693.182206][T24018] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.460339][T24018] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 693.474438][T24018] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.650486][T24018] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 693.672903][T24018] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.749077][T24077] wlan0 speed is unknown, defaulting to 1000 [ 693.827737][ T127] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 693.848676][ T127] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.917212][ T127] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 693.930936][ T127] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.950146][T24084] syzkaller0: entered promiscuous mode [ 693.974518][T24084] syzkaller0: entered allmulticast mode [ 694.023052][ T35] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 694.043921][ T35] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.186839][ T7697] tipc: Node number set to 1281812245 [ 694.216069][ T127] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 694.226580][ T127] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 694.252433][T24096] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5122'. [ 694.303602][T24098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5122'. [ 694.322825][T24096] team_slave_0: entered promiscuous mode [ 694.328702][T24096] team_slave_1: entered promiscuous mode [ 694.337868][T24096] team0: entered allmulticast mode [ 694.343813][T24096] team_slave_0: entered allmulticast mode [ 694.349840][T24096] team_slave_1: entered allmulticast mode [ 694.358171][T24096] team0: entered promiscuous mode [ 694.367829][T24096] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 694.394198][T24098] team0: left allmulticast mode [ 694.399520][T24098] team_slave_0: left allmulticast mode [ 694.405718][T24098] team_slave_1: left allmulticast mode [ 694.411552][T24098] team0: left promiscuous mode [ 694.417821][T24098] team_slave_0: left promiscuous mode [ 694.423464][T24098] team_slave_1: left promiscuous mode [ 694.555000][ T35] net_ratelimit: 12 callbacks suppressed [ 694.555026][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.569148][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 694.666937][T24110] openvswitch: netlink: nsh attribute has 1028 unknown bytes. [ 695.112607][ T127] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.121218][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.211093][T24129] wlan0 speed is unknown, defaulting to 1000 [ 695.405209][T24133] syzkaller0: entered promiscuous mode [ 695.405240][T24144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 695.405271][T24133] syzkaller0: entered allmulticast mode [ 695.507209][T24113] lec:lec_atm_close: lec0: Shut down! [ 695.531282][T24147] netlink: 'syz.1.5136': attribute type 29 has an invalid length. [ 695.544214][T24144] syzkaller0: entered promiscuous mode [ 695.557878][T24144] syzkaller0: entered allmulticast mode [ 695.578955][T24142] xt_hashlimit: max too large, truncated to 1048576 [ 695.629438][T24151] openvswitch: netlink: nsh attribute has 1028 unknown bytes. [ 695.906162][T24162] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 696.069211][T24168] delete_channel: no stack [ 696.084386][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.264167][T24182] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5145'. [ 696.301636][T24187] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5146'. [ 696.346761][T24183] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 696.473334][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 696.604055][T24196] syzkaller0: entered promiscuous mode [ 696.609694][T24196] syzkaller0: entered allmulticast mode [ 696.694846][T24202] wlan0 speed is unknown, defaulting to 1000 [ 696.771914][T24207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5151'. [ 697.034554][T24219] FAULT_INJECTION: forcing a failure. [ 697.034554][T24219] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 697.072209][T24219] CPU: 0 UID: 0 PID: 24219 Comm: syz.0.5154 Not tainted syzkaller #0 PREEMPT(full) [ 697.072242][T24219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 697.072257][T24219] Call Trace: [ 697.072267][T24219] [ 697.072277][T24219] dump_stack_lvl+0xe8/0x150 [ 697.072322][T24219] should_fail_ex+0x412/0x560 [ 697.072359][T24219] _copy_from_user+0x2d/0xb0 [ 697.072386][T24219] bpf_test_init+0xd8/0x150 [ 697.072419][T24219] bpf_prog_test_run_xdp+0x529/0x1160 [ 697.072467][T24219] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 697.072505][T24219] ? __fget_files+0x2a/0x420 [ 697.072532][T24219] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 697.072566][T24219] bpf_prog_test_run+0x2c7/0x340 [ 697.072595][T24219] __sys_bpf+0x643/0x950 [ 697.072620][T24219] ? __pfx___sys_bpf+0x10/0x10 [ 697.072659][T24219] ? ksys_write+0x242/0x270 [ 697.072688][T24219] ? __pfx_ksys_write+0x10/0x10 [ 697.072722][T24219] __x64_sys_bpf+0x7c/0x90 [ 697.072757][T24219] do_syscall_64+0x14d/0xf80 [ 697.072784][T24219] ? trace_irq_disable+0x3b/0x150 [ 697.072804][T24219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.072828][T24219] ? clear_bhb_loop+0x40/0x90 [ 697.072856][T24219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.072880][T24219] RIP: 0033:0x7f9efeb9c819 [ 697.072902][T24219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 697.072925][T24219] RSP: 002b:00007f9eff9ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 697.072951][T24219] RAX: ffffffffffffffda RBX: 00007f9efee15fa0 RCX: 00007f9efeb9c819 [ 697.072969][T24219] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 697.072985][T24219] RBP: 00007f9eff9ec090 R08: 0000000000000000 R09: 0000000000000000 [ 697.073000][T24219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 697.073015][T24219] R13: 00007f9efee16038 R14: 00007f9efee15fa0 R15: 00007fff1a2ee4b8 [ 697.073051][T24219] [ 697.661536][T24253] netlink: 'syz.2.5161': attribute type 2 has an invalid length. [ 697.735621][T24255] netlink: 'syz.4.5159': attribute type 29 has an invalid length. [ 697.804926][T24259] netlink: 'syz.0.5160': attribute type 21 has an invalid length. [ 697.816472][T24253] trusted_key: syz.2.5161 sent an empty control message without MSG_MORE. [ 697.910532][T24259] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5160'. [ 697.935353][T24259] netlink: 'syz.0.5160': attribute type 4 has an invalid length. [ 697.944050][T24259] netlink: 'syz.0.5160': attribute type 5 has an invalid length. [ 697.992390][T24259] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5160'. [ 698.005623][T24267] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.076262][T24278] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5164'. [ 698.115313][T24267] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5164'. [ 698.280122][T24269] syzkaller0: entered promiscuous mode [ 698.311911][T24269] syzkaller0: entered allmulticast mode [ 698.373305][T24293] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5169'. [ 698.726839][T24302] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5172'. [ 700.316166][ T35] net_ratelimit: 2 callbacks suppressed [ 700.316184][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.330084][ T35] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.339161][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.347625][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.513489][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 700.521575][ C0] lec:lec_tx_timeout: lec0 [ 700.526570][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 700.641512][T24311] syzkaller0: entered promiscuous mode [ 700.667714][T24311] syzkaller0: entered allmulticast mode [ 700.967504][T24336] geneve1: left promiscuous mode [ 700.992774][T24336] vti0: left promiscuous mode [ 701.015905][T24336] bridge1: left promiscuous mode [ 701.023217][T24336] bridge1: left allmulticast mode [ 701.030994][T24336] geneve2: left promiscuous mode [ 701.043574][T24336] macvtap1: left promiscuous mode [ 701.049020][T24336] macvtap1: left allmulticast mode [ 702.163007][T24363] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.843894][T22064] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.874581][T22064] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.982848][T22064] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.992165][T22064] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 703.267199][T24400] netlink: 'syz.0.5192': attribute type 1 has an invalid length. [ 703.348811][T24406] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5193'. [ 703.374693][T24400] bond7: (slave vxcan1): The slave device specified does not support setting the MAC address [ 703.387581][T24400] bond7: (slave vxcan1): Error -95 calling set_mac_address [ 703.398239][T24399] nbd3: detected capacity change from 0 to 63 [ 703.410661][T24407] block nbd3: NBD_DISCONNECT [ 703.435611][T24407] block nbd3: Disconnected due to user request. [ 703.445998][T24410] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5192'. [ 703.455222][T24407] block nbd3: shutting down sockets [ 703.487649][T24410] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5192'. [ 703.499495][ C1] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.509270][ C1] Buffer I/O error on dev nbd3, logical block 0, async page read [ 703.517174][ C1] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.526743][ C1] Buffer I/O error on dev nbd3, logical block 1, async page read [ 703.534605][ C1] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.544167][ C1] Buffer I/O error on dev nbd3, logical block 2, async page read [ 703.552015][ C1] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.561551][ C1] Buffer I/O error on dev nbd3, logical block 3, async page read [ 703.569468][T24409] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.579786][T24407] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5191'. [ 703.583695][T24409] Buffer I/O error on dev nbd3, logical block 0, async page read [ 703.598063][T24409] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.612919][T24409] Buffer I/O error on dev nbd3, logical block 1, async page read [ 703.620856][T24409] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.631870][T24409] Buffer I/O error on dev nbd3, logical block 2, async page read [ 703.640053][T24409] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.650413][T24409] Buffer I/O error on dev nbd3, logical block 3, async page read [ 703.670344][T24417] macvlan0: entered promiscuous mode [ 703.676187][T24409] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.689046][T24417] macvlan0: entered allmulticast mode [ 703.695142][T24409] Buffer I/O error on dev nbd3, logical block 0, async page read [ 703.707928][T24409] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 703.731379][T24417] bond7: entered promiscuous mode [ 703.736897][T24409] Buffer I/O error on dev nbd3, logical block 1, async page read [ 703.755140][T24409] ldm_validate_partition_table(): Disk read failed. [ 703.764637][T24417] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 703.774783][T24409] Dev nbd3: unable to read RDB block 0 [ 703.787769][T24409] nbd3: unable to read partition table [ 703.794299][T24417] bond7: left promiscuous mode [ 703.834165][T24409] ldm_validate_partition_table(): Disk read failed. [ 703.841463][T24409] Dev nbd3: unable to read RDB block 0 [ 703.848422][T24409] nbd3: unable to read partition table [ 703.861209][T24421] netlink: 'syz.4.5196': attribute type 10 has an invalid length. [ 703.894430][T24423] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.904023][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.923230][T24421] netlink: 'syz.4.5196': attribute type 10 has an invalid length. [ 703.953846][T24421] team0: Port device dummy0 removed [ 704.012858][T24409] [ 704.015243][T24409] ====================================================== [ 704.022402][T24409] WARNING: possible circular locking dependency detected [ 704.029455][T24409] syzkaller #0 Not tainted [ 704.033894][T24409] ------------------------------------------------------ [ 704.040948][T24409] udevd/24409 is trying to acquire lock: [ 704.046606][T24409] ffff88801bae5a20 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x71/0x180 [ 704.057198][T24409] [ 704.057198][T24409] but task is already holding lock: [ 704.064584][T24409] ffff88801bae5988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 704.074913][T24409] [ 704.074913][T24409] which lock already depends on the new lock. [ 704.074913][T24409] [ 704.085335][T24409] [ 704.085335][T24409] the existing dependency chain (in reverse order) is: [ 704.094375][T24409] [ 704.094375][T24409] -> #10 (&root->kernfs_rwsem){++++}-{4:4}: [ 704.102540][T24409] down_write+0x96/0x200 [ 704.107333][T24409] kernfs_add_one+0x41/0x5c0 [ 704.112468][T24409] kernfs_create_dir_ns+0xde/0x130 [ 704.118142][T24409] internal_create_group+0x425/0x1180 [ 704.124069][T24409] cpuhp_invoke_callback+0x445/0x860 [ 704.129905][T24409] cpuhp_issue_call+0x430/0x7a0 [ 704.135310][T24409] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 704.141936][T24409] __cpuhp_setup_state+0x3f/0x60 [ 704.147423][T24409] do_one_initcall+0x250/0x8d0 [ 704.152752][T24409] do_initcall_level+0x104/0x190 [ 704.158293][T24409] do_initcalls+0x59/0xa0 [ 704.163167][T24409] kernel_init_freeable+0x2a6/0x3e0 [ 704.168911][T24409] kernel_init+0x1d/0x1d0 [ 704.173791][T24409] ret_from_fork+0x51e/0xb90 [ 704.178938][T24409] ret_from_fork_asm+0x1a/0x30 [ 704.184259][T24409] [ 704.184259][T24409] -> #9 (cpuhp_state_mutex){+.+.}-{4:4}: [ 704.192111][T24409] [ 704.192111][T24409] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 704.199867][T24409] cpus_read_lock+0x42/0x160 [ 704.205002][T24409] static_key_slow_inc+0x12/0x30 [ 704.210492][T24409] tcp_md5_do_add+0x1d4/0x390 [ 704.215712][T24409] tcp_v6_parse_md5_keys+0x562/0x680 [ 704.221542][T24409] do_tcp_setsockopt+0x12ec/0x2060 [ 704.227209][T24409] do_sock_setsockopt+0x17c/0x1b0 [ 704.232790][T24409] __x64_sys_setsockopt+0x13d/0x1b0 [ 704.238543][T24409] do_syscall_64+0x14d/0xf80 [ 704.243686][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.250126][T24409] [ 704.250126][T24409] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 704.257880][T24409] lock_sock_nested+0x41/0x100 [ 704.263185][T24409] inet_shutdown+0x6a/0x390 [ 704.268322][T24409] nbd_mark_nsock_dead+0x2e9/0x560 [ 704.273983][T24409] sock_shutdown+0x15e/0x260 [ 704.279138][T24409] nbd_clear_sock+0x24/0x170 [ 704.284271][T24409] nbd_config_put+0x2dd/0x580 [ 704.289495][T24409] nbd_genl_connect+0x19d5/0x1cf0 [ 704.295069][T24409] genl_family_rcv_msg_doit+0x22a/0x330 [ 704.301157][T24409] genl_rcv_msg+0x61c/0x7a0 [ 704.306222][T24409] netlink_rcv_skb+0x232/0x4b0 [ 704.311554][T24409] genl_rcv+0x28/0x40 [ 704.316261][T24409] netlink_unicast+0x75c/0x8e0 [ 704.321571][T24409] netlink_sendmsg+0x813/0xb40 [ 704.326891][T24409] ____sys_sendmsg+0x972/0x9f0 [ 704.332221][T24409] ___sys_sendmsg+0x2a5/0x360 [ 704.337457][T24409] __x64_sys_sendmsg+0x1bd/0x2a0 [ 704.342949][T24409] do_syscall_64+0x14d/0xf80 [ 704.348171][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.354612][T24409] [ 704.354612][T24409] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 704.362403][T24409] __mutex_lock+0x19f/0x1300 [ 704.367535][T24409] nbd_queue_rq+0x37b/0x1100 [ 704.372674][T24409] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 704.378775][T24409] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 704.385649][T24409] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 704.392173][T24409] blk_mq_run_hw_queue+0x348/0x4f0 [ 704.397918][T24409] blk_mq_dispatch_list+0xd16/0xe10 [ 704.403693][T24409] blk_mq_flush_plug_list+0x48d/0x570 [ 704.409617][T24409] __blk_flush_plug+0x3ed/0x4d0 [ 704.415017][T24409] __submit_bio+0x28d/0x580 [ 704.420063][T24409] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 704.426245][T24409] block_read_full_folio+0x599/0x830 [ 704.432079][T24409] filemap_read_folio+0x137/0x3b0 [ 704.437656][T24409] do_read_cache_folio+0x358/0x590 [ 704.443312][T24409] read_part_sector+0xb6/0x2b0 [ 704.448624][T24409] adfspart_check_ICS+0xa5/0xa40 [ 704.454110][T24409] bdev_disk_changed+0x7ba/0x1550 [ 704.459685][T24409] blkdev_get_whole+0x380/0x510 [ 704.465102][T24409] bdev_open+0x31e/0xd30 [ 704.469895][T24409] blkdev_open+0x470/0x610 [ 704.474863][T24409] do_dentry_open+0x785/0x14e0 [ 704.480173][T24409] vfs_open+0x3b/0x340 [ 704.484795][T24409] path_openat+0x2e08/0x3860 [ 704.489933][T24409] do_file_open+0x23e/0x4a0 [ 704.494985][T24409] do_sys_openat2+0x113/0x200 [ 704.500227][T24409] __x64_sys_openat+0x138/0x170 [ 704.505640][T24409] do_syscall_64+0x14d/0xf80 [ 704.510783][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.517221][T24409] [ 704.517221][T24409] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 704.524462][T24409] __mutex_lock+0x19f/0x1300 [ 704.529614][T24409] nbd_queue_rq+0xc6/0x1100 [ 704.534675][T24409] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 704.540773][T24409] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 704.547647][T24409] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 704.554182][T24409] blk_mq_run_hw_queue+0x348/0x4f0 [ 704.559862][T24409] blk_mq_dispatch_list+0xd16/0xe10 [ 704.565610][T24409] blk_mq_flush_plug_list+0x48d/0x570 [ 704.571527][T24409] __blk_flush_plug+0x3ed/0x4d0 [ 704.576928][T24409] __submit_bio+0x28d/0x580 [ 704.582065][T24409] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 704.588242][T24409] block_read_full_folio+0x599/0x830 [ 704.594086][T24409] filemap_read_folio+0x137/0x3b0 [ 704.599652][T24409] do_read_cache_folio+0x358/0x590 [ 704.605312][T24409] read_part_sector+0xb6/0x2b0 [ 704.610617][T24409] adfspart_check_ICS+0xa5/0xa40 [ 704.616099][T24409] bdev_disk_changed+0x7ba/0x1550 [ 704.621763][T24409] blkdev_get_whole+0x380/0x510 [ 704.627175][T24409] bdev_open+0x31e/0xd30 [ 704.631971][T24409] blkdev_open+0x470/0x610 [ 704.636944][T24409] do_dentry_open+0x785/0x14e0 [ 704.642259][T24409] vfs_open+0x3b/0x340 [ 704.646881][T24409] path_openat+0x2e08/0x3860 [ 704.652048][T24409] do_file_open+0x23e/0x4a0 [ 704.657098][T24409] do_sys_openat2+0x113/0x200 [ 704.662416][T24409] __x64_sys_openat+0x138/0x170 [ 704.667925][T24409] do_syscall_64+0x14d/0xf80 [ 704.673067][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.679515][T24409] [ 704.679515][T24409] -> #4 (set->srcu){.+.+}-{0:0}: [ 704.686671][T24409] __synchronize_srcu+0xca/0x300 [ 704.692160][T24409] elevator_switch+0x1e8/0x7a0 [ 704.697474][T24409] elevator_change+0x2cc/0x450 [ 704.702785][T24409] elevator_set_default+0x36c/0x430 [ 704.708538][T24409] blk_register_queue+0x366/0x430 [ 704.714111][T24409] __add_disk+0x677/0xd50 [ 704.718996][T24409] add_disk_fwnode+0xfb/0x480 [ 704.724318][T24409] nbd_dev_add+0x72c/0xb50 [ 704.729278][T24409] nbd_init+0x168/0x1f0 [ 704.734039][T24409] do_one_initcall+0x250/0x8d0 [ 704.739356][T24409] do_initcall_level+0x104/0x190 [ 704.744877][T24409] do_initcalls+0x59/0xa0 [ 704.749847][T24409] kernel_init_freeable+0x2a6/0x3e0 [ 704.755602][T24409] kernel_init+0x1d/0x1d0 [ 704.760484][T24409] ret_from_fork+0x51e/0xb90 [ 704.765623][T24409] ret_from_fork_asm+0x1a/0x30 [ 704.771199][T24409] [ 704.771199][T24409] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 704.779069][T24409] __mutex_lock+0x19f/0x1300 [ 704.784209][T24409] elevator_change+0x1b3/0x450 [ 704.789550][T24409] elevator_set_none+0xb5/0x140 [ 704.794943][T24409] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 704.801299][T24409] nbd_start_device+0x17f/0xb10 [ 704.806691][T24409] nbd_genl_connect+0x165b/0x1cf0 [ 704.812633][T24409] genl_family_rcv_msg_doit+0x22a/0x330 [ 704.818718][T24409] genl_rcv_msg+0x61c/0x7a0 [ 704.823782][T24409] netlink_rcv_skb+0x232/0x4b0 [ 704.829106][T24409] genl_rcv+0x28/0x40 [ 704.833633][T24409] netlink_unicast+0x75c/0x8e0 [ 704.838941][T24409] netlink_sendmsg+0x813/0xb40 [ 704.844253][T24409] ____sys_sendmsg+0x972/0x9f0 [ 704.849571][T24409] ___sys_sendmsg+0x2a5/0x360 [ 704.854802][T24409] __x64_sys_sendmsg+0x1bd/0x2a0 [ 704.860292][T24409] do_syscall_64+0x14d/0xf80 [ 704.865436][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.871873][T24409] [ 704.871873][T24409] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 704.880681][T24409] blk_alloc_queue+0x546/0x680 [ 704.885998][T24409] __blk_mq_alloc_disk+0x197/0x390 [ 704.891664][T24409] nbd_dev_add+0x499/0xb50 [ 704.896647][T24409] nbd_init+0x168/0x1f0 [ 704.901355][T24409] do_one_initcall+0x250/0x8d0 [ 704.906668][T24409] do_initcall_level+0x104/0x190 [ 704.912159][T24409] do_initcalls+0x59/0xa0 [ 704.917045][T24409] kernel_init_freeable+0x2a6/0x3e0 [ 704.922792][T24409] kernel_init+0x1d/0x1d0 [ 704.927688][T24409] ret_from_fork+0x51e/0xb90 [ 704.932833][T24409] ret_from_fork_asm+0x1a/0x30 [ 704.938156][T24409] [ 704.938156][T24409] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 704.945400][T24409] fs_reclaim_acquire+0x71/0x100 [ 704.950889][T24409] kmem_cache_alloc_noprof+0x40/0x650 [ 704.956806][T24409] __kernfs_iattrs+0xdf/0x340 [ 704.962065][T24409] kernfs_iop_setattr+0xea/0x3f0 [ 704.967627][T24409] notify_change+0xc1a/0xf40 [ 704.972775][T24409] do_truncate+0x1c2/0x250 [ 704.977780][T24409] path_openat+0x2f89/0x3860 [ 704.983092][T24409] do_file_open+0x23e/0x4a0 [ 704.988144][T24409] do_sys_openat2+0x113/0x200 [ 704.993570][T24409] __x64_sys_openat+0x138/0x170 [ 704.999058][T24409] do_syscall_64+0x14d/0xf80 [ 705.004203][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.010681][T24409] [ 705.010681][T24409] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 705.019240][T24409] __lock_acquire+0x15a5/0x2cf0 [ 705.024658][T24409] lock_acquire+0xf0/0x2e0 [ 705.029626][T24409] down_write+0x96/0x200 [ 705.034418][T24409] kernfs_unlink_sibling+0x71/0x180 [ 705.040190][T24409] __kernfs_remove+0x3e7/0x660 [ 705.045495][T24409] kernfs_remove_by_name_ns+0xaf/0x130 [ 705.051601][T24409] nbd_config_put+0x1e6/0x580 [ 705.056847][T24409] nbd_release+0xfe/0x140 [ 705.061719][T24409] bdev_release+0x536/0x650 [ 705.067118][T24409] blkdev_release+0x15/0x20 [ 705.072172][T24409] __fput+0x44f/0xa70 [ 705.076721][T24409] fput_close_sync+0x11f/0x240 [ 705.082039][T24409] __x64_sys_close+0x7e/0x110 [ 705.087260][T24409] do_syscall_64+0x14d/0xf80 [ 705.092569][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.099190][T24409] [ 705.099190][T24409] other info that might help us debug this: [ 705.099190][T24409] [ 705.109435][T24409] Chain exists of: [ 705.109435][T24409] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 705.109435][T24409] [ 705.123889][T24409] Possible unsafe locking scenario: [ 705.123889][T24409] [ 705.131384][T24409] CPU0 CPU1 [ 705.136774][T24409] ---- ---- [ 705.142154][T24409] lock(&root->kernfs_rwsem); [ 705.146946][T24409] lock(cpuhp_state_mutex); [ 705.154259][T24409] lock(&root->kernfs_rwsem); [ 705.161565][T24409] lock(&root->kernfs_iattr_rwsem); [ 705.166870][T24409] [ 705.166870][T24409] *** DEADLOCK *** [ 705.166870][T24409] [ 705.175036][T24409] 3 locks held by udevd/24409: [ 705.179818][T24409] #0: ffff88802749a358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1a9/0x650 [ 705.189429][T24409] #1: ffff888027494a78 (&nbd->config_lock){+.+.}-{4:4}, at: refcount_dec_and_mutex_lock+0x30/0xa0 [ 705.200163][T24409] #2: ffff88801bae5988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 705.210897][T24409] [ 705.210897][T24409] stack backtrace: [ 705.216811][T24409] CPU: 1 UID: 0 PID: 24409 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 705.216833][T24409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 705.216845][T24409] Call Trace: [ 705.216855][T24409] [ 705.216866][T24409] dump_stack_lvl+0xe8/0x150 [ 705.216893][T24409] print_circular_bug+0x2e1/0x300 [ 705.216925][T24409] check_noncircular+0x12e/0x150 [ 705.216957][T24409] __lock_acquire+0x15a5/0x2cf0 [ 705.216985][T24409] ? __lock_acquire+0x6b5/0x2cf0 [ 705.217015][T24409] lock_acquire+0xf0/0x2e0 [ 705.217038][T24409] ? kernfs_unlink_sibling+0x71/0x180 [ 705.217064][T24409] down_write+0x96/0x200 [ 705.217088][T24409] ? kernfs_unlink_sibling+0x71/0x180 [ 705.217108][T24409] ? __pfx_down_write+0x10/0x10 [ 705.217132][T24409] ? kernfs_root+0x1c/0x230 [ 705.217159][T24409] ? kernfs_root+0x1c/0x230 [ 705.217187][T24409] ? kernfs_root+0x1ea/0x230 [ 705.217215][T24409] kernfs_unlink_sibling+0x71/0x180 [ 705.217237][T24409] __kernfs_remove+0x3e7/0x660 [ 705.217258][T24409] kernfs_remove_by_name_ns+0xaf/0x130 [ 705.217280][T24409] nbd_config_put+0x1e6/0x580 [ 705.217307][T24409] nbd_release+0xfe/0x140 [ 705.217330][T24409] ? __pfx_nbd_release+0x10/0x10 [ 705.217353][T24409] bdev_release+0x536/0x650 [ 705.217380][T24409] ? __pfx_blkdev_release+0x10/0x10 [ 705.217406][T24409] blkdev_release+0x15/0x20 [ 705.217431][T24409] __fput+0x44f/0xa70 [ 705.217464][T24409] fput_close_sync+0x11f/0x240 [ 705.217493][T24409] ? __pfx_fput_close_sync+0x10/0x10 [ 705.217527][T24409] __x64_sys_close+0x7e/0x110 [ 705.217546][T24409] do_syscall_64+0x14d/0xf80 [ 705.217566][T24409] ? trace_irq_disable+0x3b/0x150 [ 705.217584][T24409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.217603][T24409] ? clear_bhb_loop+0x40/0x90 [ 705.217624][T24409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 705.217644][T24409] RIP: 0033:0x7ffb902a7407 [ 705.217662][T24409] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 705.217679][T24409] RSP: 002b:00007ffeb4ac0300 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 705.217699][T24409] RAX: ffffffffffffffda RBX: 00007ffb90947880 RCX: 00007ffb902a7407 [ 705.217714][T24409] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 [ 705.217726][T24409] RBP: 00007ffb909476e8 R08: 0000000000000000 R09: 0000000000000000 [ 705.217738][T24409] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002 [ 705.217750][T24409] R13: 0000556baeacb190 R14: 0000000000000008 R15: 0000556baeb115a0 [ 705.217778][T24409] [ 705.630460][T24362] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.073010][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.081268][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.090025][T22064] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.098698][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.322220][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 706.330299][ C0] lec:lec_tx_timeout: lec0 [ 706.335330][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 708.632501][T24363] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.192265][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 711.200514][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.208950][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.352142][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 711.360302][ C0] lec:lec_tx_timeout: lec0 [ 711.365381][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 711.673322][T24362] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.833068][ C1] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:0c to non-existent VLAN 3 [ 711.834076][ T58] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.851384][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog