last executing test programs: 3.180460608s ago: executing program 1 (id=5060): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb7020000080000001d210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000002d00000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x1002, &(0x7f00000014c0)=""/4098, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 3.043714559s ago: executing program 1 (id=5062): r0 = socket$nl_generic(0x10, 0x3, 0x10) poll(&(0x7f00000002c0)=[{r0, 0x4008}, {r0, 0x400}], 0x2, 0x48000000) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a80), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000f90003050005000a0000000900020073797a3000000000050001"], 0x30}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r1) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) (async) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x68, r3, 0x8, 0x70bd25, 0x25dfdbfd, {{}, {}, {0x4c, 0x18, {0x6, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0xc005) 2.788914163s ago: executing program 3 (id=5067): bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0f000000040000000400000006000000020800", @ANYRES32, @ANYBLOB="060000000000000000", @ANYRES32], 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000240)=@pptp={0x18, 0x2, {0x1, @loopback}}, 0x80, 0x0}, 0x40) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="9402000021000100fcffffff00000000ac1414aae5fffff8b49ed9825133a900fc0100000000000000000000020000000000add500200000000000801aeaaec1", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000070000400706362632874776f666973682900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040010000dc06216ef2c68e9f6da05d886dbc3273ef99796b36698e2bd5179c3eea5474fc78c9720bfc4f90a708001f0001000000cc0111"], 0x294}}, 0x0) 2.634340064s ago: executing program 3 (id=5069): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000300)=0x2) (async) ioctl$PPPIOCSMRRU(r0, 0x4004743b, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x432}, [@generic={0x81, 0x1, 0x1, 0x85}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) 2.416070531s ago: executing program 3 (id=5071): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[@ANYBLOB="540000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="15020000fe0f00001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3, @ANYBLOB="080004"], 0x54}, 0x1, 0xba01, 0xa014000000000000, 0x4004}, 0x4000000) 2.324751812s ago: executing program 2 (id=5073): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000700)=ANY=[@ANYBLOB="b601000000000000bd110000000000008510000002000000850000007700000095000000000000009500a5050000000077d8f3b4000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f68a7d06d75357f21699cdc6751dfb265a0e3ccae669e173a649c1cfd6587d472d64e7cc955d77578f4c35235138d5421f9453559c35da860e8ef14142b2a3e314422b854421eed734ceb1efeecb9c66854c3b3ffe1b4ce25d7c983c005c03bf3a48dfe3e26e7a23129d6606fd28a697a9d552af6d9a9df2c3af333e2008e11bbec0727cb3f647535deb6277f5696833a71011a7d06602e2fd5234712596b696418f163d1a13ed38a682f87925bfa753f631cd027edd68149ee99eebc6f7d6dd4ae59af7588c8e1f4efab57644ccb1973d7879b70a70001040000000000000000d7900a820b63278f4e9a217b98ef7042ad2a923132f208fd8289eaf8cd00000000000009d27d753a300800000000000000a5686f2fccc33e3e34c3969c5ad781302d40e97a8ad10ce0cbe17366d5ac6af2fca2360a15b80400d52040ef7b28d300747877e176fe4c4b8e40dbf260f5a9f7eee30293c1b163b795d0aef4deb851a30000f569dc8f39943f889008e1ec914faa9e6cd0b3b4b3b5db666ebeb49d6a62019d76459e70b459543c4ac42e53b4ad4c77cff373ebd95848f01864e456969cd28000170996016aceb583df5ee4dd722e8c350af489f9a900000000a0dcc36b3d7c734a9cce0439f832a20d7cbdcda5dff3ba92dd66afb9d74aa222038994dcd3e7784dbea1e51a15b0f1a040cc63177f8fafa3192fc8e5552da1a982ab8dfe31ad1a0968faa47c2069d6bf09c3aa4f0fc128cb578d99b08a150b4cc4b22f6a464c6398c952519818a44a1b223ff502df87865c276588ea478e328e8277e811b99ce1acfecaf8e2c55ccc4b8eae0a61635514e99ffd438784060f23ba74c0b30b1180d935832deb686d789ba1d436d116394534e88492a42b8bf050c719661a2dc50b3a1dcfbc871e5c27e3d7260f6fa589e40000b89db451ff994845f6b49c12e89291398bcb3c06ef1289f74e0b0e2cab592d35f82a69e7284223a171c616b1f0fee6c4711d7aecb69746064d2c096554975d605ebe646302bf3d5cf32a9a09915ae3f3d4eb96615d7b237da56cd5e9904a19e145f25b6d98eb2c019967f553b61d0e80d6913cee9f8d18469a654a239a84a85debbc02846ac5791278f18c6759e3b513a68284d2efc30587e433431b2896a3bd48020af67e9ac071b2dd6dc3b9efae4ff03558fa619aea909c7f2416e7e7da1c51ccc7e6ac27412f728dc6d80da8adf317ca863ed683897321f8c8bb5a5d953d6783b7a06353ee496bbdff418de3e53234df87756eb99e330253cf5da4aa1a9648a38f07e2d302b4165983db4f7b8972923fffa8c03c288512a3a38fbd7c816a44634f7a03fab30811b7b93257bea4369ba46024dee5e9b0b2c3d3324e9b7c1f99ab9bb3f498b1485373b79ec84a67dad4e37575dab87ce55a9a69ed856a4c4410d1242ac1bd1539094a641cc086c2c53e363beafc74ab4e9ff320373705cbf5644586ffe60d293944fa2d9dc18b55f1af5c42f27747bef1ffd0c1766f062d47d61bf9f64e6ee288fa7fc12d48da526527b9f5c318c93ec447cb8b5eee7aa8a1e85696af3dfef96657c0545c8ebd96528d9c28828e5befd80d684b03b6d153da3e3cbd3bfbf4a9375b8ad04a1d241bcb5d5505cb6cc7a44e2e24bd0b1ca4879caaff59d0ce39dc7f3fea447f4e46967855208e63ec988bd2692afefbed2b001205e4b30ee8fe417defa566a73ace8f01f7181de0ef25f1744896a3c38859e6148c42454949cd64b1a888e7fe9c2d86bb01023b6ddeb67f5eb038af3e460c771518a4126c338b0390d459361e03adf6e6b558b3651a0e33d101b5febfff82794203da18db6fcf89715c2d338f78d8b9220171b41f528f857a7cb79ca990de1208777e13faaa9b9cb9e67797b07d9eb9e909410b50c5d981d9a72aa36498b630519d1530ef0000000000000000000037fcffffffffffffff8db8379bd2044c652dff399a9f8bfa4e9c507f049d18837464276830461ee203ba51f6102d262fc9a26bc3638ecce24e65c55da6efaa462f03d0e119c963a8c7a522b59f5a7b44d018cb2648383073d9e032492cae44350bc0a85697f431392eb22cae093e85954af97d6d7b2e6e8f43353062275ad1578a431594243452a2bfb89f91d8eaac038e9e17136e7c698f73faaabb3d00000000000080014573789425c4c32da528d89356aa6d2ae6da082e756c80cf39053431080ea6cbf9997a5a0ddad0b9d12bc3f880476ab32f0feaac5f16e61f7b72b8c9082eec423c6b3eaecfdcc9ec72795e7696421c83b76c2d6bac19bc875d009679778d8ef97d7e05329649d97b0dc54bea9b650873de2d3d702690176e0b23ee5cb5e469a8d1612d611722e6200e3a297d92f8e1de98326c5ef2b89d4e2d47767cd755783e5d865e373338e96ceb8399f296c59b2d70ca27735ecaff62982616d3ac1ab041733bce119d8002a6c8a2b08b32551b2313b1a2ff41b3f04af61c69c85cb2da48215727271bac2ffdeb62d9f5dc4845f1c3f63dc806e615ee8d28d6d7f181e30807afa27f41d0364c746a65a47464db68f3c433d88dd625db35fded2c86d75af88efaf20c8b37c644b6c4e773a9589200faa553bc92f916b75ddbfa18ab73979f46947b35914286d2499a0b8c970000000000000000f4fe74e0c26ab52329bd600627b256ca44dd121ffc8dbb6e5f70cbe03efccac70375b30cc927574d254d1b46c607e8b1ca7d1511568c3ef4b6b885f4582bdcef74e5e010627fc8e4fe00000000000000000000869d9640f06b11df2971909b90133983308ea4f033de613763f32d913bcbe9dd082a6fff197a20730269e6cfd31275395833f1c2b8a50a94c30cceae2a11fe9b9b835d0da73891c0b3ce22dea6bf31e7f51808cf72f44b4455b77a778440795e152dc1b7bb0a5636aa4742ce4d331a47de5836539cdf289176527277b70c8162aaf6f9475418b478329f3565450acfaf07000000eab8cabfa97e35081967bb92a264b07e8003d2f15537e72a1e4ca5ec1e2aaaf8236ecdefbaf512c75e636b6b6f518ad20521f909b12e9bc97e408e0dc82f950d12705f35708bc862196abb27e8d7991b5273987f38c4706289ff4f6130cee76465d487a07a74452f87da2029bd3debd9870335d58d3fe1ac80574fa3ea312997ab81bc6f569ffdb10ba3f20a86d95128d13e0c778998d3b3114bfb07bd61e4bff8a5e2ce4aa572c63e09b44ca4a181bcfe4eec3ce843c65c4948169fe639a186acc2b4a96c6b8d4d2e6d53ab97bea01eab953e6e89e3af34d4ada217bc6fda0fb2095c49195d0d6f365ca80a955b9ec81240a84ef672afa369fc8e3d444ba35d0f51a0065a3b982d09dfc6874fc0d8079b185447cb8a695e132d4d613a529d9c77e2a8f7320ecf698e8a2b170fd601dc1a9767a38b10788e92d1356f6a6c1bcfb2d31b46e735db13f1be80bac1b6be04fd98610000000000000000000000000000139af5493f74751c5e2501a4936bc4a0fa516117f4ccadc692003adee0a080eba2f1059660c0ee0e9aec72d4d0fe095632e4f641b0e34c611c5b3e0ba05fa36542d40837dda323910672a9097d68398fd3539686e4288db0d6bf7cb8a1835f46dfe11865a66ef47e736dada06677a5bca133d6cbc8fe5c4557e51b006bdccd7c5f32ff1d9e8b130f77df09236870fb3de5b87b4f8acc13df534eba329b86670000000000000000b27a2616c03cdf6c009447a652bca9b325e73c0737d5b717945e4fe7a169c5e2c54fc71a4104aa7cf0f5d30e2fcd9503650edbd8a5971a9a1fde5e5df37469ae204a6e899eacc1e63034cbabc5604739881cb82604bed3e53696a0606b26b879ef232a1a038291389593d1575cb79aa8284cf01a7e1a456acab9d8d608ad69d4c4b56492af7004e7ed9d47c5db3d76a00bea7c804f3a3638408bc1636f1009b7f185f51606918eaa0ab6bef11ae3d300"], &(0x7f0000000080)='GPL\x00', 0x9, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0xffe1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 2.251770192s ago: executing program 3 (id=5074): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x14, 0x4, 0x4, 0x22}, 0x50) r1 = socket$inet(0x2, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x4, &(0x7f00000000c0)=0x40000001, 0x4) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000b00)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='4\x00\x00\x00 \x00\x00I', @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES64=0x0], 0x20) bind$inet(r1, &(0x7f0000000200)={0x2, 0x3, @empty}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0xfffffedf, 0x10, &(0x7f0000000040), 0xffffff95, 0x0, 0xffffffffffffffff, 0xd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63ec068e46dc3f0adf33c9f7b986", 0x0, 0xc69a, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = accept$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000240)=0x14) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, &(0x7f0000000180)=[{{0x0, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}, {{0x4, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}}], 0x10) bind$can_raw(r5, &(0x7f0000000040), 0x10) setsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) r7 = accept4(r6, &(0x7f0000000100)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000180)=0x80, 0x800) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x58, 0x30, 0x871a15abc695fb3d, 0xffffffff, 0x25dfdc02, {}, [{0x44, 0x1, [@m_mpls={0x40, 0x1, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x6, 0x5, 0x8bc69}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x48050}, 0x20004800) connect$inet(r8, 0x0, 0x0) ioctl$sock_SIOCOUTQNSD(r8, 0x894b, &(0x7f0000000000)) sendmsg$IPSET_CMD_GET_BYNAME(r7, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000000e06000000000500000a0900020073797a310000000005000100070000000900020073797a3200000000"], 0x34}}, 0x80) sendmsg$NFT_BATCH(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010084deb62e000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000900000000001416010076657468315f746f5f627269646765000900020073797a30000000000900010073797a300000000014000000110001000000000000000000030000"], 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000003c0)={0x3, 0x2000}, 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r0, &(0x7f00000001c0), &(0x7f00000004c0)=@udp=r1}, 0x20) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x12, &(0x7f0000000000)=@framed={{}, [@generic={0x7a, 0xa, 0x0, 0xfffffff8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}, @map_fd={0x18, 0x2}, @generic={0xb7, 0x4}, @generic={0x3, 0x0, 0x0, 0x0, 0x35}, @generic={0xb7}]}, &(0x7f0000000280)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000900)=ANY=[@ANYBLOB="9feb010021"], 0x0, 0x26}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r10, 0x0, 0xe, 0xe, &(0x7f0000000340)='\x00'/14, &(0x7f0000000380)=""/14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.24803939s ago: executing program 0 (id=5075): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90b24fc60", 0x8c0}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000000d40)=""/204, 0xcc}], 0x1}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c00)=ANY=[@ANYBLOB="64010000100001000400000000000000fc010000000000000000000000000000000000000000000000000000000000000000ecdf00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414190000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000080ff0000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000a000100cd00000000000000480002006362632873657270656e7429000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020001700010000002abd7000000000002bbd7000000000000b000000080000000c001c00", @ANYRES32=r3], 0x164}}, 0x0) 2.102748338s ago: executing program 4 (id=5076): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001"], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r0, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b7002000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) 2.056175483s ago: executing program 2 (id=5077): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x28, r1, 0x6a98047402e98331, 0x4070bd29, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004110}, 0x28000) 2.028143739s ago: executing program 4 (id=5078): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) r2 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000140)={r2, &(0x7f0000000000)='{\x00', 0x442, &(0x7f0000000080)={@align=0x4, {0x9, 0x6, 0x1000, 0x9}}, 0xfffffff8, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000100)=0x8001}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x5, '\x00', r3, 0xffffffffffffffff, 0x0, 0x3, 0x2}, 0x50) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x28, r1, 0x6a98047402e98331, 0x4070bd29, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004110}, 0x28000) 1.95180659s ago: executing program 4 (id=5079): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtaction={0x44, 0x30, 0x9e54f29ff072a93b, 0x0, 0x0, {}, [{0x30, 0x1, [@m_nat={0x2c, 0x2, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000101050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e65740000000c00078008000640"], 0x5c}, 0x1, 0x8000000}, 0x0) 1.940390271s ago: executing program 0 (id=5080): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r0, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b700000000000000950000f9ffffffff"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) 1.887634723s ago: executing program 1 (id=5081): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0b0000000d000000cc0002000600000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = socket$packet(0x11, 0x2, 0x300) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000500)={r6, 0x4ac7}, &(0x7f0000000540)=0xc) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0xa}, @enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0xb, 0xd15}]}]}}, &(0x7f0000000f40)=""/4089, 0x3a, 0xff9, 0x8}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688634c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.779741485s ago: executing program 2 (id=5082): setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='vlan0\x00', 0x10) connect$inet(0xffffffffffffffff, 0x0, 0x0) unshare(0x26020480) unshare(0x20000400) r0 = socket$nl_route(0x10, 0x3, 0x0) read(r0, &(0x7f0000000240)=""/176, 0xb0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x56, 0x0, 0x0, &(0x7f0000000300), 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x2342, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000000000000000000001c00000000040000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0xb6) 1.724870813s ago: executing program 3 (id=5083): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a01432eb63400000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000500002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a4000000002b0000000060a010400000000000000000500000a0900010073797a30000000000900020073797a30000000008400048024000180090001006d6574610000000014000280080001400000000108000240000000012c00018008000100636d700020000280080001400000000108000240000000030c0003800500010000000000300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c000280080001"], 0x154}}, 0x0) 1.632069743s ago: executing program 0 (id=5084): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa10000000000000701ffb0f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a100000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x1009, &(0x7f0000002500)=""/4105, 0x0, 0x68}, 0x94) 1.631806053s ago: executing program 4 (id=5085): bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x101, 0x7fdf, 0xff}, 0x50) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = gettid() bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x45e], 0x0, 0x0, 0x1, 0x0, r1}}, 0x40) (async) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x5, 0x4, 0x4, 0x401, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x18}, 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) (async) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x4080) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0x20, 0x0, 0x0) (async) ioctl$F2FS_IOC_SEC_TRIM_FILE(r4, 0x4018f514, &(0x7f0000000000)={0x2, 0xffffffffffffff7f, 0x1}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, 0x0, 0x0) (async) socket$l2tp(0x2, 0x2, 0x73) (async) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYBLOB], 0x1c}}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, 0x0, 0x0) (async) sendmsg$nl_route(r6, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000540)=[@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x19}}], 0x10) (async) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) 1.454822858s ago: executing program 0 (id=5086): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x25) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x19, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008b00000000000000013e110018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014002000b7030000000000108500000086000000bf0900000000000055090100000000009500000000000000ad0a060000000000b500fffffffffff31801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050008008500000006000000bf91000000000000b702000003000000850000002a000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x9, 0x1001, &(0x7f0000001cc0)=""/4097, 0x40f00, 0x24}, 0x94) 1.284679241s ago: executing program 3 (id=5087): r0 = socket$nl_route(0x10, 0x3, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) (async) sendmsg$can_bcm(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001bc0)=ANY=[@ANYBLOB="010000000000000003000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYBLOB="0000000001"], 0x48}, 0x1, 0x0, 0x0, 0x48485}, 0x8890) sendmsg$can_bcm(r3, &(0x7f0000001b00)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000022c0)=ANY=[@ANYBLOB="01000000670f00"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="0000000001"], 0x80}, 0x1, 0x0, 0x0, 0xc080}, 0x11) r5 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r5, &(0x7f0000000080)={0x1d, r4, 0x1, {0x1, 0xff, 0x4}}, 0x18) (async) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r6, {0xb, 0xfff2}, {0xe, 0xffff}, {0xb, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000040) (async) socket$nl_generic(0x10, 0x3, 0x10) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async) r9 = socket(0x10, 0x3, 0x0) write$bt_hci(r9, &(0x7f0000000380)=ANY=[@ANYBLOB="59680a7a1099f1f947027a3826080730ee10454bf329c7f5364165901b989498e25a26f3272cbd4a02a9c95361da04f2aa78f5d88e43c4b56b2f2901c687c2a97f488ef5a0114ee3aacef1eccad5d87517f43ba28e9551f3a1cf588f82dc7640a0ed69bdd32fc8cf65e27c6096c5a2ed94108572e270c599a44d3118d7bac455e1851a9b94264990751c233a103d00000000000000"], 0xa) (async) accept4(r3, &(0x7f0000000480)=@hci, &(0x7f0000000500)=0x80, 0x1000) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=@newqdisc={0x24, 0x24, 0xf0b, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xffff, 0x3}}}, 0x24}}, 0x20000000) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f00000001c0)={@private1, 0x0}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8601000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)=@mpls_getnetconf={0xfffffffffffffcd0, 0x52, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r1}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x2}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x1}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0xc523}, @NETCONFA_IFINDEX={0x0, 0x1, r10}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x2}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x2}, @NETCONFA_IFINDEX={0x8, 0x1, r8}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x3}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8}]}, 0x64}, 0x1, 0x0, 0x0, 0x24004000}, 0x8000) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) (async) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000005000000080000000f"], 0x50) 1.208136971s ago: executing program 1 (id=5088): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x800005, 0x32, 0xffffffffffffffff, 0x852ac000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000ff003e851000000600000018000000", @ANYRES32, @ANYBLOB="00000003000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdffffff000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) 1.184000925s ago: executing program 0 (id=5089): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000001380)=@bridge_newneigh={0x28, 0x1c, 0x401, 0x0, 0x0, {0x7, 0x0, 0x0, 0x13, 0x80, 0x2}, [@NDA_LLADDR={0xa, 0x2, @random="aabbccddeeff"}]}, 0x28}}, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000380)={{r0, &(0x7f0000000040)='blkio.bfq.io_service_time_recursive\x00', 0x400501, &(0x7f0000000080)={@_ha_fsid={[0x3690, 0x3]}, {0xf, 0x3, 0x1, 0x7}}, 0x1, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f00000002c0)=0xb}, {[0x1, 0x0, 0x7, 0x9]}, 0x9, 0x72, &(0x7f0000000300)=""/114}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000180)={{{@in=@broadcast, @in6=@private1}}, {{@in6=@private2}, 0x0, @in6=@loopback}}, &(0x7f0000000280)=0xe8) sendfile(r0, r1, 0x0, 0xffffffff000) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000000)={0x0, 0x7, [@broadcast, @remote, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}, @local, @multicast, @random="17c1cac37ec5", @remote]}) 989.675802ms ago: executing program 1 (id=5090): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800180018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000002d00000095"], &(0x7f0000000300)='GPL\x00', 0x4, 0x1002, &(0x7f00000014c0)=""/4098, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) 880.100997ms ago: executing program 4 (id=5091): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f0000019100400014000200100011000400"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000003640)={0x0, 'hsr0\x00', {0x1}, 0x7}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'hsr0\x00', &(0x7f00000004c0)=@ethtool_sfeatures={0x3b, 0x2, [{0x200, 0x4a39b33c}, {0x2, 0xb}]}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r2) sendmsg$DEVLINK_CMD_SB_POOL_GET(r2, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r3, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x67, 0xb, 0x8001}, {0x6, 0x11, 0x6}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) r4 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000300)=ANY=[], 0x38}, 0x1, 0x1000000, 0x0, 0x810}, 0x20000000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1}, 0x28) r7 = accept$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @local}, &(0x7f0000000340)=0x10) ioctl$sock_inet_SIOCDARP(r7, 0x8953, &(0x7f0000000380)={{0x2, 0x4e22, @local}, {0x6, @multicast}, 0x0, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3b}}, 'pimreg1\x00'}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000500)={r6, 0xa7, &(0x7f0000000100)}, 0xd) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r5) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61106800000000006113740000000000bfa00000000000000700000008fffdffd50301000ee600c07b0000000000000069163a00000a0000bf67000000000000350607000fff072017060000201900001603faff0ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="e32ee982cb97253c52484828628abb96d627c29db665e4da5e1e591c3934c2e81c3d9964ffbf8ed42cd37c805100"/60, @ANYRES16=r8, @ANYBLOB="000826bd7000ffdbdf25140000000400018008000f0000000080"], 0x20}, 0x1, 0x0, 0x0, 0x920}, 0x4c860) 724.548807ms ago: executing program 2 (id=5092): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90b24fc60", 0x8c0}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000000d40)=""/204, 0xcc}], 0x1}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c00)=ANY=[@ANYBLOB="64010000100001000400000000000000fc010000000000000000000000000000000000000000000000000000000000000000ecdf00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414190000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000a000100cd00000000000000480002006362632873657270656e7429000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020001700010000002abd7000000000002bbd7000000000000b000000080000000c001c00", @ANYRES32=r3], 0x164}}, 0x0) 362.095616ms ago: executing program 1 (id=5093): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x14, 0x4, 0x4, 0x22}, 0x50) r1 = socket$inet(0x2, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x4, &(0x7f00000000c0)=0x40000001, 0x4) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000b00)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='4\x00\x00\x00 \x00\x00I', @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES64=0x0], 0x20) bind$inet(r1, &(0x7f0000000200)={0x2, 0x3, @empty}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000044000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85823d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2ba9c29faa38c409d32b6b7d6cf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e933119c5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247fa62fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120bed64069dcf82d3e5e0361e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a1000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e824d86869ec4ab392b0a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a412a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0daca8d4c1090000000000000084d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000004f9e02a3b51a97c4b1c1b411cc6bee2a56f29c55a6aac46a0cfc318fae02922a403431d4e5a4396cad2c8dd34037bc041a2ba1505ba2c4889122ca04e85881aad5f8bfc12e6741872aad21bf5301cd4c607ef50a991c410f7c60e45b5c193f813a36d841165b91b5e170f6ba24558df57145eb8142a6ed87c6d5cbae3e52d569996604669a6e9ca1a3689c795970b4bcd00881faff52a6766fafa07ed7d4a49f47d34fd76a394adcb33a270b6a14e74bca7c2ea92dd845d3f774fde1bbea911c1ea76d52f7912e2597e6a33380647ed44956730b5b84662b8e659124379c0d86b1d28fdfa3cd2013103e3048c4ad4f5a4dcd133b2fc8fae3b51e4433cee7c08e67c7d7ed4432045e10f8718e5c163b1704fa2c707b61a1a9f63edfceff1a0cd7baf4a15b2fd607a09d398d73243bdcc664fbd5f582e48af2a18b02f0184a7bdd95ac78241e6749e74b152702333c56588375f806f10578eaae329c4f8dfb83e5524e2c9aa59ce7828bd1f146b2a4150fb2a8ced08e2ffac81e921e8a6f0071361a0acdbd125fb5f5e9ffe98e38508582a496afd30ca460dbfca77915a18b7b9ef6c1d6e13bc12fe43063cfecfafb05bf2339ad61533fbf3e410b403182742fa2d40c402cb83c2fef46a36f17c1abf97b0e2d114bd1472ab4207aa060f9e5d91c4a4911b1a1df47b858be141ab3386f26f561df35678489dc1b9f10eee1b2ab3dfdaedd7e06ff8a127f1743fcb32d7f80d40aebc1ea72edc348f5f9ba4bace97db948c24c679c74cd4336a7233d836082bb0e8b013bd1ee3612cd43cd2a3cb83754bb3408"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000001c0), 0xfffffedf, 0x10, &(0x7f0000000040), 0xffffff95, 0x0, 0xffffffffffffffff, 0xd}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63ec068e46dc3f0adf33c9f7b986", 0x0, 0xc69a, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = accept$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000240)=0x14) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, &(0x7f0000000180)=[{{0x0, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}, {{0x4, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}}], 0x10) bind$can_raw(r5, &(0x7f0000000040), 0x10) setsockopt$CAN_RAW_FILTER(r5, 0x65, 0x1, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) r7 = accept4(r6, &(0x7f0000000100)=@pptp={0x18, 0x2, {0x0, @remote}}, &(0x7f0000000180)=0x80, 0x800) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x58, 0x30, 0x871a15abc695fb3d, 0xffffffff, 0x25dfdc02, {}, [{0x44, 0x1, [@m_mpls={0x40, 0x1, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x6, 0x5, 0x8bc69}, @TCA_MPLS_BOS={0x5, 0x8, 0x1}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x48050}, 0x20004800) connect$inet(r8, 0x0, 0x0) ioctl$sock_SIOCOUTQNSD(r8, 0x894b, &(0x7f0000000000)) sendmsg$IPSET_CMD_GET_BYNAME(r7, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000000e06000000000500000a0900020073797a310000000005000100070000000900020073797a3200000000"], 0x34}}, 0x80) sendmsg$NFT_BATCH(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010084deb62e000000000500000a5c000000180a0500000000000000000002000000300003802c00038014000100776732000000000000000900000000001416010076657468315f746f5f627269646765000900020073797a30000000000900010073797a300000000014000000110001000000000000000000030000"], 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000003c0)={0x3, 0x2000}, 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r0, &(0x7f00000001c0), &(0x7f00000004c0)=@udp=r1}, 0x20) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x12, &(0x7f0000000000)=@framed={{}, [@generic={0x7a, 0xa, 0x0, 0xfffffff8}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}}, @map_fd={0x18, 0x2}, @generic={0xb7, 0x4}, @generic={0x3, 0x0, 0x0, 0x0, 0x35}, @generic={0xb7}]}, &(0x7f0000000280)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000900)=ANY=[@ANYBLOB="9feb010021"], 0x0, 0x26}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r10, 0x0, 0xe, 0xe, &(0x7f0000000340)='\x00'/14, &(0x7f0000000380)=""/14, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 277.199642ms ago: executing program 2 (id=5094): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000611814000000000695"], &(0x7f0000000400)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 175.202834ms ago: executing program 4 (id=5095): socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0xf, 0x1, 0xa) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2a, 0x8000, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {}, {0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000884}, 0x20000000) close(r1) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r7, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0xfffd}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240408a4}, 0x4890) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="540000000101010400000000000000000700000a40000180060003400000000006000140"], 0x54}, 0x1, 0x0, 0x0, 0x20000010}, 0x20040800) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000002380)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r9, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) 56.790168ms ago: executing program 0 (id=5096): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r0, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000b5000000b7000000000000009500000000000000b7000000fffffff29500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) 0s ago: executing program 2 (id=5097): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x22d01, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22ffe6) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x80102, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x5, 0x2, 0x4, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffc}, 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x63, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x200000000000003b, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000300)=r6, 0x4) sendmsg$unix(r5, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) r7 = socket(0x2, 0x80002, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000040)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'fo\x00', 0x8, 0x3, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000000113010900000000000031000000000000"], 0x14}}, 0x20008800) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000040)=[{0x20, 0xde, 0x85, 0xfffff038}, {0x20, 0x0, 0x0, 0xfffff010}, {0x6, 0x0, 0x0, 0xffffffff}]}, 0x10) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000440)='syzkaller\x00', 0xd, 0xfffffffffffffe37, 0x0, 0x0, 0x2d}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x4000, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) setsockopt$inet_int(r8, 0x0, 0x32, &(0x7f0000000f00)=0x1000000, 0x4) socket$kcm(0xa, 0x3, 0x87) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r12 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2d}, 0x90) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00'}) kernel console output (not intermixed with test programs): pfx_check_and_resolve_insns+0x10/0x10 [ 396.942035][T16555] bpf_check+0x180a/0x2e10 [ 396.942065][T16555] ? ktime_get_with_offset+0x93/0x2d0 [ 396.942088][T16555] ? __pfx_bpf_check+0x10/0x10 [ 396.942110][T16555] ? bpf_obj_name_cpy+0x194/0x1e0 [ 396.942139][T16555] bpf_prog_load+0x14d6/0x1c20 [ 396.942171][T16555] ? __pfx_bpf_prog_load+0x10/0x10 [ 396.942215][T16555] __sys_bpf+0xd0d/0xd90 [ 396.942250][T16555] ? __pfx___sys_bpf+0x10/0x10 [ 396.942281][T16555] ? __fget_files+0x2a/0x420 [ 396.942320][T16555] ? ksys_write+0x242/0x270 [ 396.942349][T16555] ? __pfx_ksys_write+0x10/0x10 [ 396.942378][T16555] __x64_sys_bpf+0xba/0xd0 [ 396.942399][T16555] do_syscall_64+0x166/0x520 [ 396.942425][T16555] ? trace_irq_disable+0x3b/0x140 [ 396.942443][T16555] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.942461][T16555] ? clear_bhb_loop+0x70/0xc0 [ 396.942484][T16555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.942502][T16555] RIP: 0033:0x7fb08259e159 [ 396.942520][T16555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.942536][T16555] RSP: 002b:00007fb0807f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 396.942559][T16555] RAX: ffffffffffffffda RBX: 00007fb082825fa0 RCX: 00007fb08259e159 [ 396.942574][T16555] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 396.942587][T16555] RBP: 00007fb0807f6090 R08: 0000000000000000 R09: 0000000000000000 [ 396.942599][T16555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 396.942611][T16555] R13: 00007fb082826038 R14: 00007fb082825fa0 R15: 00007ffc397d74d8 [ 396.942640][T16555] [ 396.953452][T16555] warn_alloc: 1 callbacks suppressed [ 396.953469][T16555] syz.2.3491: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400cc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 396.953529][T16555] CPU: 0 UID: 0 PID: 16555 Comm: syz.2.3491 Not tainted syzkaller #0 PREEMPT(full) [ 396.953550][T16555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 396.953562][T16555] Call Trace: [ 396.953570][T16555] [ 396.953578][T16555] dump_stack_lvl+0xe8/0x150 [ 396.953606][T16555] warn_alloc+0x24d/0x270 [ 396.953640][T16555] ? __pfx_warn_alloc+0x10/0x10 [ 396.953672][T16555] ? __kmalloc_node_noprof+0x4d7/0x720 [ 396.953697][T16555] ? __get_vm_area_node+0x200/0x2f0 [ 396.953720][T16555] ? __get_vm_area_node+0x283/0x2f0 [ 396.953741][T16555] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.953766][T16555] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 396.953797][T16555] __vmalloc_node_range_noprof+0x969/0x1540 [ 396.953823][T16555] ? lock_acquire+0x115/0x350 [ 396.953865][T16555] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 396.953890][T16555] ? bpf_verifier_vlog+0x58d/0x900 [ 396.953924][T16555] ? bpf_prog_calc_tag+0x51/0x370 [ 396.953943][T16555] __vmalloc_noprof+0xd2/0x120 [ 396.953967][T16555] ? bpf_prog_calc_tag+0x51/0x370 [ 396.953990][T16555] bpf_prog_calc_tag+0x51/0x370 [ 396.954014][T16555] check_and_resolve_insns+0xbb/0x21d0 [ 396.954038][T16555] ? __pfx_bpf_check_btf_info+0x10/0x10 [ 396.954058][T16555] ? add_subprog+0x2e2/0x3f0 [ 396.954081][T16555] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 396.954111][T16555] bpf_check+0x180a/0x2e10 [ 396.954141][T16555] ? ktime_get_with_offset+0x93/0x2d0 [ 396.954164][T16555] ? __pfx_bpf_check+0x10/0x10 [ 396.954186][T16555] ? bpf_obj_name_cpy+0x194/0x1e0 [ 396.954225][T16555] bpf_prog_load+0x14d6/0x1c20 [ 396.954263][T16555] ? __pfx_bpf_prog_load+0x10/0x10 [ 396.954313][T16555] __sys_bpf+0xd0d/0xd90 [ 396.954345][T16555] ? __pfx___sys_bpf+0x10/0x10 [ 396.954382][T16555] ? __fget_files+0x2a/0x420 [ 396.954425][T16555] ? ksys_write+0x242/0x270 [ 396.954457][T16555] ? __pfx_ksys_write+0x10/0x10 [ 396.954489][T16555] __x64_sys_bpf+0xba/0xd0 [ 396.954511][T16555] do_syscall_64+0x166/0x520 [ 396.954538][T16555] ? trace_irq_disable+0x3b/0x140 [ 396.954558][T16555] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.954580][T16555] ? clear_bhb_loop+0x70/0xc0 [ 396.954605][T16555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 396.954625][T16555] RIP: 0033:0x7fb08259e159 [ 396.954644][T16555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 396.954662][T16555] RSP: 002b:00007fb0807f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 396.954684][T16555] RAX: ffffffffffffffda RBX: 00007fb082825fa0 RCX: 00007fb08259e159 [ 396.954699][T16555] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 396.954713][T16555] RBP: 00007fb0807f6090 R08: 0000000000000000 R09: 0000000000000000 [ 396.954726][T16555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 396.954739][T16555] R13: 00007fb082826038 R14: 00007fb082825fa0 R15: 00007ffc397d74d8 [ 396.954773][T16555] [ 396.966594][T16555] Mem-Info: [ 396.966607][T16555] active_anon:5626 inactive_anon:0 isolated_anon:0 [ 396.966607][T16555] active_file:0 inactive_file:43740 isolated_file:0 [ 396.966607][T16555] unevictable:0 dirty:127 writeback:0 [ 396.966607][T16555] slab_reclaimable:11627 slab_unreclaimable:132534 [ 396.966607][T16555] mapped:29768 shmem:522 pagetables:1207 [ 396.966607][T16555] sec_pagetables:0 bounce:0 [ 396.966607][T16555] kernel_misc_reclaimable:0 [ 396.966607][T16555] free:1254790 free_pcp:11466 free_cma:0 [ 396.966656][T16555] Node 0 active_anon:22504kB inactive_anon:0kB active_file:0kB inactive_file:174752kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119072kB dirty:508kB writeback:0kB shmem:2088kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14236kB pagetables:4684kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 396.966707][T16555] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 396.966769][T16555] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.966824][T16555] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 396.967429][T16555] Node 0 DMA32 free:1057152kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22504kB inactive_anon:0kB active_file:0kB inactive_file:174752kB unevictable:0kB writepending:508kB zspages:0kB present:3129332kB managed:2546712kB mlocked:0kB bounce:0kB free_pcp:45864kB local_pcp:26460kB free_cma:0kB [ 396.967485][T16555] lowmem_reserve[]: 0 0 0 0 0 [ 396.967517][T16555] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.967566][T16555] lowmem_reserve[]: 0 0 0 0 0 [ 396.967598][T16555] Node 1 Normal free:3946648kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 396.967650][T16555] lowmem_reserve[]: 0 0 0 0 0 [ 396.967682][T16555] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 396.967788][T16555] Node 0 DMA32: 206*4kB (UM) 31*8kB (UM) 221*16kB (UME) 278*32kB (UME) 114*64kB (UME) 38*128kB (UME) 7*256kB (ME) 5*512kB (UME) 3*1024kB (UM) 14*2048kB (UM) 243*4096kB (UM) = 1057088kB [ 396.967935][T16555] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 396.972947][T16555] Node 1 Normal: 2*4kB (M) 4*8kB (UM) 7*16kB (UM) 12*32kB (UM) 6*64kB (UM) 6*128kB (UM) 4*256kB (UM) 5*512kB (UM) 1*1024kB (M) 2*2048kB (U) 961*4096kB (M) = 3946648kB [ 396.973346][T16555] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 396.973362][T16555] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 396.973378][T16555] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 396.973393][T16555] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 396.973408][T16555] 44258 total pagecache pages [ 396.973416][T16555] 0 pages in swap cache [ 396.973423][T16555] Free swap = 124996kB [ 396.973430][T16555] Total swap = 124996kB [ 396.973439][T16555] 2097051 pages RAM [ 396.973445][T16555] 0 pages HighMem/MovableOnly [ 396.973452][T16555] 428757 pages reserved [ 396.973459][T16555] 0 pages cma reserved [ 397.079121][T16556] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3490'. [ 398.013746][T16570] syzkaller1: entered promiscuous mode [ 398.013801][T16570] syzkaller1: entered allmulticast mode [ 398.226193][T16582] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3498'. [ 398.587908][T16605] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3504'. [ 398.609299][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 398.624175][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 398.658394][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 398.690310][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 398.704432][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 398.714851][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 398.717112][T16607] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3503'. [ 399.023290][T16625] tipc: Enabling not permitted [ 399.029093][T16625] tipc: Enabling of bearer rejected, failed to enable media [ 399.165759][T16625] syzkaller0: entered promiscuous mode [ 399.165802][T16625] syzkaller0: entered allmulticast mode [ 399.591682][T16642] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 400.858322][T16695] vlan2: entered allmulticast mode [ 400.860982][T16695] bridge0: port 3(vlan2) entered blocking state [ 400.862000][T16695] bridge0: port 3(vlan2) entered disabled state [ 400.867682][T16695] vlan2: entered promiscuous mode [ 400.982918][T16694] bridge_slave_0: left allmulticast mode [ 400.982974][T16694] bridge_slave_0: left promiscuous mode [ 400.983170][T16694] bridge0: port 1(bridge_slave_0) entered disabled state [ 401.034737][T16694] bridge_slave_1: left allmulticast mode [ 401.040864][T16694] bridge_slave_1: left promiscuous mode [ 401.046747][T16694] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.107368][T16694] bond0: (slave bond_slave_0): Releasing backup interface [ 401.216007][T16694] bond0: (slave bond_slave_1): Releasing backup interface [ 401.353664][T16694] team0: Port device team_slave_0 removed [ 401.394900][T16694] team0: Port device team_slave_1 removed [ 401.402740][T16694] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.410581][T16694] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.434910][T16694] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.442875][T16694] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.461237][T16723] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 401.500372][T16694] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 401.708801][T16701] tipc: Enabled bearer , priority 0 [ 401.740325][T16704] syzkaller0: entered promiscuous mode [ 401.740369][T16704] syzkaller0: entered allmulticast mode [ 401.912624][T16696] tipc: Resetting bearer [ 402.017001][T16696] tipc: Disabling bearer [ 402.512003][T16749] __nla_validate_parse: 64 callbacks suppressed [ 402.518635][T16749] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3539'. [ 402.714631][T16756] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3540'. [ 402.718332][T16758] tipc: Enabled bearer , priority 10 [ 402.792296][T16757] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3540'. [ 402.857850][T16763] ip_tables: iptables: counters copy to user failed while replacing table [ 402.984669][ T5624] block nbd3: Receive control failed (result -32) [ 403.642435][T16778] netlink: 'syz.3.3545': attribute type 1 has an invalid length. [ 403.816021][T16782] gretap1: entered allmulticast mode [ 403.847683][T16782] bond1: (slave gretap1): making interface the new active one [ 403.863378][T16782] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 403.910429][ T5729] tipc: Node number set to 1546429106 [ 403.918417][T16784] tun0: tun_chr_ioctl cmd 1074025677 [ 403.918541][T16784] tun0: linktype set to 776 [ 404.303865][T16801] FAULT_INJECTION: forcing a failure. [ 404.303865][T16801] name failslab, interval 1, probability 0, space 0, times 0 [ 404.317850][T16801] CPU: 1 UID: 0 PID: 16801 Comm: syz.2.3553 Not tainted syzkaller #0 PREEMPT(full) [ 404.317881][T16801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 404.317894][T16801] Call Trace: [ 404.317903][T16801] [ 404.317913][T16801] dump_stack_lvl+0xe8/0x150 [ 404.317946][T16801] should_fail_ex+0x410/0x560 [ 404.317982][T16801] should_failslab+0xa8/0x100 [ 404.318006][T16801] __kvmalloc_node_noprof+0x176/0x820 [ 404.318029][T16801] ? bpf_compute_postorder+0x83/0x970 [ 404.318057][T16801] ? bpf_compute_postorder+0x83/0x970 [ 404.318092][T16801] bpf_compute_postorder+0x83/0x970 [ 404.318122][T16801] ? __pfx_check_and_resolve_insns+0x10/0x10 [ 404.318148][T16801] ? add_kfuncs+0x251/0x2e0 [ 404.318174][T16801] bpf_check+0x24d6/0x2e10 [ 404.318207][T16801] ? ktime_get_with_offset+0x93/0x2d0 [ 404.318233][T16801] ? __pfx_bpf_check+0x10/0x10 [ 404.318258][T16801] ? bpf_obj_name_cpy+0x194/0x1e0 [ 404.318290][T16801] bpf_prog_load+0x14d6/0x1c20 [ 404.318326][T16801] ? __pfx_bpf_prog_load+0x10/0x10 [ 404.318375][T16801] __sys_bpf+0xd0d/0xd90 [ 404.318407][T16801] ? __pfx___sys_bpf+0x10/0x10 [ 404.318440][T16801] ? __fget_files+0x2a/0x420 [ 404.318482][T16801] ? ksys_write+0x242/0x270 [ 404.318513][T16801] ? __pfx_ksys_write+0x10/0x10 [ 404.318544][T16801] __x64_sys_bpf+0xba/0xd0 [ 404.318568][T16801] do_syscall_64+0x166/0x520 [ 404.318609][T16801] ? trace_irq_disable+0x3b/0x140 [ 404.318626][T16801] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.318660][T16801] ? clear_bhb_loop+0x70/0xc0 [ 404.318685][T16801] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.318707][T16801] RIP: 0033:0x7fb08259e159 [ 404.318727][T16801] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.318745][T16801] RSP: 002b:00007fb0807f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 404.318770][T16801] RAX: ffffffffffffffda RBX: 00007fb082825fa0 RCX: 00007fb08259e159 [ 404.318786][T16801] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 404.318800][T16801] RBP: 00007fb0807f6090 R08: 0000000000000000 R09: 0000000000000000 [ 404.318813][T16801] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 404.318826][T16801] R13: 00007fb082826038 R14: 00007fb082825fa0 R15: 00007ffc397d74d8 [ 404.318858][T16801] [ 404.423784][T16805] xt_connbytes: Forcing CT accounting to be enabled [ 404.903535][T16817] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3556'. [ 404.914174][T16814] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3556'. [ 404.952233][T16813] gretap0: entered promiscuous mode [ 404.961060][T16813] macsec1: entered allmulticast mode [ 404.961104][T16813] gretap0: entered allmulticast mode [ 405.002793][T16813] gretap0: left allmulticast mode [ 405.002854][T16813] gretap0: left promiscuous mode [ 405.106052][T16823] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3561'. [ 405.910285][T16874] FAULT_INJECTION: forcing a failure. [ 405.910285][T16874] name failslab, interval 1, probability 0, space 0, times 0 [ 405.910338][T16874] CPU: 0 UID: 0 PID: 16874 Comm: syz.3.3576 Not tainted syzkaller #0 PREEMPT(full) [ 405.910364][T16874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 405.910377][T16874] Call Trace: [ 405.910385][T16874] [ 405.910394][T16874] dump_stack_lvl+0xe8/0x150 [ 405.910428][T16874] should_fail_ex+0x410/0x560 [ 405.910461][T16874] should_failslab+0xa8/0x100 [ 405.910485][T16874] __kvmalloc_node_noprof+0x176/0x820 [ 405.910506][T16874] ? bpf_compute_postorder+0x87c/0x970 [ 405.910535][T16874] ? bpf_stack_liveness_init+0x29/0x90 [ 405.910554][T16874] ? bpf_stack_liveness_init+0x29/0x90 [ 405.910580][T16874] bpf_stack_liveness_init+0x29/0x90 [ 405.910600][T16874] bpf_check+0x24f6/0x2e10 [ 405.910631][T16874] ? ktime_get_with_offset+0x93/0x2d0 [ 405.910655][T16874] ? __pfx_bpf_check+0x10/0x10 [ 405.910678][T16874] ? bpf_obj_name_cpy+0x194/0x1e0 [ 405.910707][T16874] bpf_prog_load+0x14d6/0x1c20 [ 405.910739][T16874] ? __pfx_bpf_prog_load+0x10/0x10 [ 405.910783][T16874] __sys_bpf+0xd0d/0xd90 [ 405.910811][T16874] ? __pfx___sys_bpf+0x10/0x10 [ 405.910841][T16874] ? __fget_files+0x2a/0x420 [ 405.910880][T16874] ? ksys_write+0x242/0x270 [ 405.910908][T16874] ? __pfx_ksys_write+0x10/0x10 [ 405.910938][T16874] __x64_sys_bpf+0xba/0xd0 [ 405.910959][T16874] do_syscall_64+0x166/0x520 [ 405.910985][T16874] ? trace_irq_disable+0x3b/0x140 [ 405.911003][T16874] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.911023][T16874] ? clear_bhb_loop+0x70/0xc0 [ 405.911046][T16874] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 405.911064][T16874] RIP: 0033:0x7f96c299e159 [ 405.911083][T16874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 405.911099][T16874] RSP: 002b:00007f96c394e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 405.911120][T16874] RAX: ffffffffffffffda RBX: 00007f96c2c25fa0 RCX: 00007f96c299e159 [ 405.911142][T16874] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 405.911154][T16874] RBP: 00007f96c394e090 R08: 0000000000000000 R09: 0000000000000000 [ 405.911167][T16874] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 405.911178][T16874] R13: 00007f96c2c26038 R14: 00007f96c2c25fa0 R15: 00007fffd6b2fd88 [ 405.911208][T16874] [ 406.439377][T16892] netlink: 204 bytes leftover after parsing attributes in process `syz.4.3582'. [ 406.446566][T16892] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3582'. [ 406.567540][T16897] netlink: 'syz.4.3584': attribute type 1 has an invalid length. [ 406.599007][T16897] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3584'. [ 407.446338][T16901] netlink: 'syz.4.3585': attribute type 1 has an invalid length. [ 408.227598][T16832] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 408.848298][T16926] lo speed is unknown, defaulting to 1000 [ 408.967519][T16935] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3598'. [ 409.225552][T16945] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 409.266378][T16945] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3602'. [ 409.327645][T16940] netlink: 'syz.3.3601': attribute type 1 has an invalid length. [ 409.704032][T16961] syzkaller0: entered promiscuous mode [ 409.704076][T16961] syzkaller0: entered allmulticast mode [ 409.741240][T16956] tipc: Enabled bearer , priority 0 [ 410.591472][T16955] tipc: Resetting bearer [ 412.407265][T16955] tipc: Disabling bearer [ 412.421951][T16965] kthread_run failed with err -4 [ 412.453955][ T10] tipc: Node number set to 741384170 [ 412.621044][T16973] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3611'. [ 413.079314][T16992] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3618'. [ 414.541219][T16989] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 414.603658][T16989] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 415.098921][T17000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3618'. [ 415.222778][ T7057] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.222840][ T7057] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.222881][ T7057] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.222906][ T7057] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.222939][ T7057] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.222962][ T7057] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.231948][T12657] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.231986][T12657] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.463848][T17038] syzkaller0: entered promiscuous mode [ 415.463890][T17038] syzkaller0: entered allmulticast mode [ 415.483491][T17038] tipc: Enabled bearer , priority 0 [ 415.496008][T17037] tipc: Resetting bearer [ 415.570861][T17037] tipc: Disabling bearer [ 415.572360][T17041] netlink: 'syz.4.3629': attribute type 1 has an invalid length. [ 415.572380][T17041] netlink: 9528 bytes leftover after parsing attributes in process `syz.4.3629'. [ 415.617542][T17044] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3634'. [ 415.960162][T17057] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3639'. [ 416.533804][T17081] vlan2: entered allmulticast mode [ 416.534110][T17081] bridge0: port 3(vlan2) entered blocking state [ 416.535885][T17081] bridge0: port 3(vlan2) entered disabled state [ 416.542437][T17081] vlan2: entered promiscuous mode [ 417.379560][T17117] netlink: 'syz.4.3657': attribute type 1 has an invalid length. [ 418.075178][T17138] syzkaller0: entered promiscuous mode [ 418.075217][T17138] syzkaller0: entered allmulticast mode [ 418.096060][T17144] tipc: Enabled bearer , priority 0 [ 418.103449][T17125] tipc: Resetting bearer [ 418.202993][T17125] tipc: Disabling bearer [ 418.827105][T17176] netlink: 580 bytes leftover after parsing attributes in process `syz.2.3675'. [ 418.897203][T17180] netlink: 'syz.1.3678': attribute type 1 has an invalid length. [ 418.897245][T17180] netlink: 'syz.1.3678': attribute type 3 has an invalid length. [ 418.897259][T17180] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3678'. [ 419.304382][T17199] netlink: NAT attributes may be specified only when CT COMMIT flag is also specified. [ 419.321136][T17199] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 419.335570][T12657] IPVS: starting estimator thread 0... [ 419.419740][T17201] IPVS: using max 24 ests per chain, 57600 per kthread [ 419.563215][T17207] FAULT_INJECTION: forcing a failure. [ 419.563215][T17207] name failslab, interval 1, probability 0, space 0, times 0 [ 419.563268][T17207] CPU: 0 UID: 0 PID: 17207 Comm: syz.3.3688 Not tainted syzkaller #0 PREEMPT(full) [ 419.563294][T17207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 419.563307][T17207] Call Trace: [ 419.563316][T17207] [ 419.563326][T17207] dump_stack_lvl+0xe8/0x150 [ 419.563362][T17207] should_fail_ex+0x410/0x560 [ 419.563400][T17207] should_failslab+0xa8/0x100 [ 419.563427][T17207] __kvmalloc_node_noprof+0x176/0x820 [ 419.563453][T17207] ? bpf_compute_scc+0xb8/0xb10 [ 419.563484][T17207] ? bpf_compute_scc+0xb8/0xb10 [ 419.563520][T17207] bpf_compute_scc+0xb8/0xb10 [ 419.563580][T17207] bpf_check+0x25c9/0x2e10 [ 419.563616][T17207] ? ktime_get_with_offset+0x93/0x2d0 [ 419.563643][T17207] ? __pfx_bpf_check+0x10/0x10 [ 419.563669][T17207] ? bpf_obj_name_cpy+0x194/0x1e0 [ 419.563702][T17207] bpf_prog_load+0x14d6/0x1c20 [ 419.563739][T17207] ? __pfx_bpf_prog_load+0x10/0x10 [ 419.563789][T17207] __sys_bpf+0xd0d/0xd90 [ 419.563826][T17207] ? __pfx___sys_bpf+0x10/0x10 [ 419.563859][T17207] ? __fget_files+0x2a/0x420 [ 419.563903][T17207] ? ksys_write+0x242/0x270 [ 419.563936][T17207] ? __pfx_ksys_write+0x10/0x10 [ 419.563971][T17207] __x64_sys_bpf+0xba/0xd0 [ 419.563996][T17207] do_syscall_64+0x166/0x520 [ 419.564026][T17207] ? trace_irq_disable+0x3b/0x140 [ 419.564071][T17207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.564093][T17207] ? clear_bhb_loop+0x70/0xc0 [ 419.564119][T17207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.564141][T17207] RIP: 0033:0x7f96c299e159 [ 419.564162][T17207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.564181][T17207] RSP: 002b:00007f96c394e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 419.564205][T17207] RAX: ffffffffffffffda RBX: 00007f96c2c25fa0 RCX: 00007f96c299e159 [ 419.564221][T17207] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 419.564236][T17207] RBP: 00007f96c394e090 R08: 0000000000000000 R09: 0000000000000000 [ 419.564250][T17207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 419.564264][T17207] R13: 00007f96c2c26038 R14: 00007f96c2c25fa0 R15: 00007fffd6b2fd88 [ 419.564298][T17207] [ 419.976944][T17226] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 420.076707][T17229] syzkaller0: entered promiscuous mode [ 420.076751][T17229] syzkaller0: entered allmulticast mode [ 420.102468][T17229] tipc: Enabled bearer , priority 0 [ 420.112190][T17224] tipc: Resetting bearer [ 420.152468][T17224] tipc: Disabling bearer [ 420.487756][T17252] netlink: 3568 bytes leftover after parsing attributes in process `syz.3.3707'. [ 420.549777][ T12] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.550998][ T59] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.551036][ T59] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.551067][ T59] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 420.661673][T16767] block nbd4: Receive control failed (result -32) [ 420.662370][ T5624] block nbd4: Receive control failed (result -32) [ 421.151394][T17273] netlink: Failed to add Ì helper -22 [ 421.157801][T17273] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 421.318870][T17282] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 421.332925][T17282] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3720'. [ 421.812109][T17298] FAULT_INJECTION: forcing a failure. [ 421.812109][T17298] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 421.829123][T17298] CPU: 0 UID: 0 PID: 17298 Comm: syz.1.3726 Not tainted syzkaller #0 PREEMPT(full) [ 421.829153][T17298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 421.829166][T17298] Call Trace: [ 421.829175][T17298] [ 421.829185][T17298] dump_stack_lvl+0xe8/0x150 [ 421.829222][T17298] should_fail_ex+0x410/0x560 [ 421.829265][T17298] _copy_to_user+0x31/0xb0 [ 421.829292][T17298] bpf_verifier_vlog+0x496/0x900 [ 421.829336][T17298] verbose+0x11d/0x1a0 [ 421.829366][T17298] ? rcu_is_watching+0x16/0xb0 [ 421.829396][T17298] ? __pfx_verbose+0x10/0x10 [ 421.829423][T17298] ? sort_subprogs_topo+0xf5/0xf20 [ 421.829449][T17298] ? __kvmalloc_node_noprof+0x345/0x820 [ 421.829472][T17298] ? sort_subprogs_topo+0xf5/0xf20 [ 421.829501][T17298] sort_subprogs_topo+0xdbf/0xf20 [ 421.829545][T17298] bpf_check+0x25a5/0x2e10 [ 421.829579][T17298] ? ktime_get_with_offset+0x93/0x2d0 [ 421.829605][T17298] ? __pfx_bpf_check+0x10/0x10 [ 421.829631][T17298] ? bpf_obj_name_cpy+0x194/0x1e0 [ 421.829664][T17298] bpf_prog_load+0x14d6/0x1c20 [ 421.829702][T17298] ? __pfx_bpf_prog_load+0x10/0x10 [ 421.829753][T17298] __sys_bpf+0xd0d/0xd90 [ 421.829785][T17298] ? __pfx___sys_bpf+0x10/0x10 [ 421.829820][T17298] ? __fget_files+0x2a/0x420 [ 421.829865][T17298] ? ksys_write+0x242/0x270 [ 421.829897][T17298] ? __pfx_ksys_write+0x10/0x10 [ 421.829932][T17298] __x64_sys_bpf+0xba/0xd0 [ 421.829957][T17298] do_syscall_64+0x166/0x520 [ 421.829986][T17298] ? trace_irq_disable+0x3b/0x140 [ 421.830006][T17298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.830028][T17298] ? clear_bhb_loop+0x70/0xc0 [ 421.830062][T17298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 421.830084][T17298] RIP: 0033:0x7feeeff9e159 [ 421.830105][T17298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 421.830124][T17298] RSP: 002b:00007feef0ef4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 421.830149][T17298] RAX: ffffffffffffffda RBX: 00007feef0225fa0 RCX: 00007feeeff9e159 [ 421.830166][T17298] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 421.830180][T17298] RBP: 00007feef0ef4090 R08: 0000000000000000 R09: 0000000000000000 [ 421.830194][T17298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 421.830208][T17298] R13: 00007feef0226038 R14: 00007feef0225fa0 R15: 00007ffd30be5ca8 [ 421.830242][T17298] [ 422.564937][T17318] vlan2: entered allmulticast mode [ 422.565278][T17318] bridge0: port 4(vlan2) entered blocking state [ 422.565715][T17318] bridge0: port 4(vlan2) entered disabled state [ 422.568678][T17318] vlan2: entered promiscuous mode [ 423.890201][T17363] bond2: option primary_reselect: invalid value (6) [ 423.905443][T17363] bond2 (unregistering): Released all slaves [ 424.010466][T17377] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 424.028392][T17377] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3762'. [ 424.198885][T17379] lo speed is unknown, defaulting to 1000 [ 424.489003][T17394] netlink: 'syz.0.3765': attribute type 362 has an invalid length. [ 424.931082][T17407] FAULT_INJECTION: forcing a failure. [ 424.931082][T17407] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 424.944404][T17407] CPU: 1 UID: 0 PID: 17407 Comm: syz.3.3770 Not tainted syzkaller #0 PREEMPT(full) [ 424.944434][T17407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 424.944447][T17407] Call Trace: [ 424.944457][T17407] [ 424.944466][T17407] dump_stack_lvl+0xe8/0x150 [ 424.944503][T17407] should_fail_ex+0x410/0x560 [ 424.944542][T17407] _copy_to_user+0x31/0xb0 [ 424.944568][T17407] bpf_verifier_vlog+0x496/0x900 [ 424.944627][T17407] verbose+0x11d/0x1a0 [ 424.944657][T17407] ? rcu_is_watching+0x16/0xb0 [ 424.944688][T17407] ? __pfx_verbose+0x10/0x10 [ 424.944716][T17407] ? sort_subprogs_topo+0xf5/0xf20 [ 424.944743][T17407] ? __kvmalloc_node_noprof+0x345/0x820 [ 424.944766][T17407] ? sort_subprogs_topo+0xf5/0xf20 [ 424.944797][T17407] sort_subprogs_topo+0xdbf/0xf20 [ 424.944842][T17407] bpf_check+0x25a5/0x2e10 [ 424.944876][T17407] ? ktime_get_with_offset+0x93/0x2d0 [ 424.944901][T17407] ? __pfx_bpf_check+0x10/0x10 [ 424.944924][T17407] ? bpf_obj_name_cpy+0x194/0x1e0 [ 424.944955][T17407] bpf_prog_load+0x14d6/0x1c20 [ 424.944990][T17407] ? __pfx_bpf_prog_load+0x10/0x10 [ 424.945040][T17407] __sys_bpf+0xd0d/0xd90 [ 424.945071][T17407] ? __pfx___sys_bpf+0x10/0x10 [ 424.945102][T17407] ? __fget_files+0x2a/0x420 [ 424.945147][T17407] ? ksys_write+0x242/0x270 [ 424.945178][T17407] ? __pfx_ksys_write+0x10/0x10 [ 424.945212][T17407] __x64_sys_bpf+0xba/0xd0 [ 424.945235][T17407] do_syscall_64+0x166/0x520 [ 424.945264][T17407] ? trace_irq_disable+0x3b/0x140 [ 424.945283][T17407] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.945304][T17407] ? clear_bhb_loop+0x70/0xc0 [ 424.945329][T17407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 424.945349][T17407] RIP: 0033:0x7f96c299e159 [ 424.945368][T17407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 424.945387][T17407] RSP: 002b:00007f96c394e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 424.945409][T17407] RAX: ffffffffffffffda RBX: 00007f96c2c25fa0 RCX: 00007f96c299e159 [ 424.945424][T17407] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 424.945437][T17407] RBP: 00007f96c394e090 R08: 0000000000000000 R09: 0000000000000000 [ 424.945450][T17407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 424.945462][T17407] R13: 00007f96c2c26038 R14: 00007f96c2c25fa0 R15: 00007fffd6b2fd88 [ 424.945495][T17407] [ 424.997544][T17403] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3768'. [ 424.997576][T17403] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 425.283315][T17409] xt_CT: No such helper "netbios-ns" [ 425.546436][T17422] ip_tables: iptables: counters copy to user failed while replacing table [ 425.560790][T17422] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3774'. [ 425.815795][T17426] syzkaller1: tun_chr_ioctl cmd 1074812117 [ 427.693211][T17399] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 427.964790][T17436] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3779'. [ 428.262783][T17452] bond0: (slave ip6gretap0): Enslaving as an active interface with an up link [ 428.322691][T17452] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.357557][T17452] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.386973][T17452] bond0 (unregistering): (slave ip6gretap0): Releasing backup interface [ 428.418017][T17452] bond0 (unregistering): Released all slaves [ 428.867488][T17478] X25: received unknown 00 with LCI 000 [ 428.966411][T17484] netlink: 'syz.0.3797': attribute type 1 has an invalid length. [ 429.031882][T17489] xt_connbytes: Forcing CT accounting to be enabled [ 429.073069][T17484] 8021q: adding VLAN 0 to HW filter on device bond2 [ 429.297088][T17504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3797'. [ 429.326701][T17484] bond2: (slave geneve3): making interface the new active one [ 429.342227][T17484] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 429.441739][ T7057] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.640954][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.642709][T12658] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.642750][T12658] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.691722][T17523] syzkaller0: entered promiscuous mode [ 429.691764][T17523] syzkaller0: entered allmulticast mode [ 429.736966][T17520] lo: entered promiscuous mode [ 429.752713][T17520] tunl0: entered promiscuous mode [ 429.832090][T17520] gre0: entered promiscuous mode [ 429.944606][T17520] gretap0: entered promiscuous mode [ 430.084292][T17520] erspan0: entered promiscuous mode [ 430.133567][T17520] ip_vti0: entered promiscuous mode [ 430.145086][T17541] netlink: 'syz.0.3811': attribute type 1 has an invalid length. [ 430.155516][T17520] ip6_vti0: entered promiscuous mode [ 430.163925][T17520] sit0: entered promiscuous mode [ 430.175400][T17520] ip6tnl0: entered promiscuous mode [ 430.178378][T17520] ip6gre0: entered promiscuous mode [ 430.186579][T17520] syz_tun: entered promiscuous mode [ 430.201350][T17520] ip6gretap0: entered promiscuous mode [ 430.207866][T17520] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.208577][T17520] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.224221][T17520] bridge0: entered promiscuous mode [ 430.243263][T17503] tipc: Enabled bearer , priority 0 [ 430.252033][T17501] tipc: Resetting bearer [ 430.340828][T17501] tipc: Disabling bearer [ 430.386105][T17541] bond3: entered promiscuous mode [ 430.395124][T17541] 8021q: adding VLAN 0 to HW filter on device bond3 [ 430.504715][T17548] 8021q: adding VLAN 0 to HW filter on device bond3 [ 430.513490][T17548] bond3: (slave xfrm1): The slave device specified does not support setting the MAC address [ 430.524951][T17548] bond3: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 430.542008][T17548] bond3: (slave xfrm1): making interface the new active one [ 430.550164][T17548] xfrm1: entered promiscuous mode [ 430.561671][T17548] xfrm1: left promiscuous mode [ 430.578723][T17555] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 430.626636][T17555] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3813'. [ 430.818418][T17563] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3815'. [ 431.495883][T17588] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3828'. [ 431.894499][T17603] ieee802154 phy0 wpan0: encryption failed: -22 [ 432.207371][T17620] batman_adv: batadv0: Adding interface: macvtap1 [ 432.214324][T17620] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 432.240318][T17620] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 432.307848][T17631] netlink: 'syz.0.3837': attribute type 11 has an invalid length. [ 432.307900][T17631] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3837'. [ 432.335998][T17621] batman_adv: batadv0: Removing interface: macvtap1 [ 432.419857][T17632] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3837'. [ 432.430263][T17632] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 432.924110][T17647] FAULT_INJECTION: forcing a failure. [ 432.924110][T17647] name failslab, interval 1, probability 0, space 0, times 0 [ 432.939230][T17647] CPU: 1 UID: 0 PID: 17647 Comm: syz.1.3842 Not tainted syzkaller #0 PREEMPT(full) [ 432.939261][T17647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 432.939273][T17647] Call Trace: [ 432.939282][T17647] [ 432.939291][T17647] dump_stack_lvl+0xe8/0x150 [ 432.939329][T17647] should_fail_ex+0x410/0x560 [ 432.939367][T17647] ? __alloc_skb+0x1db/0x7a0 [ 432.939401][T17647] should_failslab+0xa8/0x100 [ 432.939427][T17647] ? __alloc_skb+0x1db/0x7a0 [ 432.939454][T17647] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 432.939484][T17647] ? __alloc_skb+0x18d/0x7a0 [ 432.939514][T17647] ? __alloc_skb+0x1db/0x7a0 [ 432.939551][T17647] __alloc_skb+0x1db/0x7a0 [ 432.939585][T17647] alloc_skb_with_frags+0xc6/0x760 [ 432.939620][T17647] sock_alloc_send_pskb+0x878/0x990 [ 432.939665][T17647] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 432.939708][T17647] tun_get_user+0x8fb/0x44d0 [ 432.939850][T17647] ? aa_file_perm+0x18b/0x15f0 [ 432.939881][T17647] ? aa_file_perm+0x4ed/0x15f0 [ 432.939905][T17647] ? __pfx_tun_get_user+0x10/0x10 [ 432.939938][T17647] ? __lock_acquire+0x6df/0x2e50 [ 432.939964][T17647] ? kstrtoull+0x137/0x1d0 [ 432.940010][T17647] ? ref_tracker_alloc+0x341/0x4b0 [ 432.940031][T17647] ? lock_acquire+0x115/0x350 [ 432.940053][T17647] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 432.940078][T17647] ? lock_acquire+0x115/0x350 [ 432.940100][T17647] ? tun_get+0x1c/0x2f0 [ 432.940136][T17647] ? tun_get+0x1c/0x2f0 [ 432.940165][T17647] ? tun_get+0x1c/0x2f0 [ 432.940199][T17647] tun_chr_write_iter+0x113/0x200 [ 432.940231][T17647] vfs_write+0x612/0xba0 [ 432.940279][T17647] ? __pfx_vfs_write+0x10/0x10 [ 432.940320][T17647] ? __fget_files+0x2a/0x420 [ 432.940358][T17647] ksys_write+0x150/0x270 [ 432.940391][T17647] ? __pfx_ksys_write+0x10/0x10 [ 432.940433][T17647] do_syscall_64+0x166/0x520 [ 432.940462][T17647] ? trace_irq_disable+0x3b/0x140 [ 432.940482][T17647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.940503][T17647] ? clear_bhb_loop+0x70/0xc0 [ 432.940529][T17647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.940551][T17647] RIP: 0033:0x7feeeff9e159 [ 432.940572][T17647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 432.940591][T17647] RSP: 002b:00007feef0ef4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 432.940616][T17647] RAX: ffffffffffffffda RBX: 00007feef0225fa0 RCX: 00007feeeff9e159 [ 432.940632][T17647] RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004 [ 432.940645][T17647] RBP: 00007feef0ef4090 R08: 0000000000000000 R09: 0000000000000000 [ 432.940658][T17647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 432.940671][T17647] R13: 00007feef0226038 R14: 00007feef0225fa0 R15: 00007ffd30be5ca8 [ 432.940706][T17647] [ 433.204386][T17659] FAULT_INJECTION: forcing a failure. [ 433.204386][T17659] name failslab, interval 1, probability 0, space 0, times 0 [ 433.204419][T17659] CPU: 0 UID: 0 PID: 17659 Comm: syz.2.3845 Not tainted syzkaller #0 PREEMPT(full) [ 433.204441][T17659] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 433.204452][T17659] Call Trace: [ 433.204461][T17659] [ 433.204470][T17659] dump_stack_lvl+0xe8/0x150 [ 433.204501][T17659] should_fail_ex+0x410/0x560 [ 433.204535][T17659] should_failslab+0xa8/0x100 [ 433.204557][T17659] ? skb_clone+0x212/0x3a0 [ 433.204579][T17659] kmem_cache_alloc_noprof+0xa1/0x600 [ 433.204608][T17659] ? skb_clone+0x212/0x3a0 [ 433.204634][T17659] skb_clone+0x212/0x3a0 [ 433.204658][T17659] __netlink_deliver_tap+0x413/0x860 [ 433.204692][T17659] ? netlink_deliver_tap+0x2e/0x1b0 [ 433.204716][T17659] netlink_deliver_tap+0x19c/0x1b0 [ 433.204740][T17659] netlink_unicast+0x781/0x940 [ 433.204772][T17659] netlink_sendmsg+0x813/0xb40 [ 433.204803][T17659] ? __pfx_netlink_sendmsg+0x10/0x10 [ 433.204834][T17659] ? apparmor_socket_sendmsg+0x98/0x360 [ 433.204863][T17659] ? __pfx_netlink_sendmsg+0x10/0x10 [ 433.204884][T17659] sock_sendmsg_nosec+0x13a/0x180 [ 433.204912][T17659] ____sys_sendmsg+0x54e/0x850 [ 433.204937][T17659] ? __pfx_____sys_sendmsg+0x10/0x10 [ 433.204975][T17659] ? import_iovec+0x73/0xa0 [ 433.204999][T17659] ___sys_sendmsg+0x2a5/0x360 [ 433.205018][T17659] ? __lock_acquire+0x6df/0x2e50 [ 433.205043][T17659] ? __pfx____sys_sendmsg+0x10/0x10 [ 433.205097][T17659] ? __fget_files+0x2a/0x420 [ 433.205120][T17659] ? __fget_files+0x3a2/0x420 [ 433.205154][T17659] __x64_sys_sendmsg+0x1b1/0x290 [ 433.205177][T17659] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 433.205219][T17659] do_syscall_64+0x166/0x520 [ 433.205245][T17659] ? trace_irq_disable+0x3b/0x140 [ 433.205263][T17659] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.205283][T17659] ? clear_bhb_loop+0x70/0xc0 [ 433.205306][T17659] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.205324][T17659] RIP: 0033:0x7fb08259e159 [ 433.205343][T17659] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.205360][T17659] RSP: 002b:00007fb0807f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 433.205381][T17659] RAX: ffffffffffffffda RBX: 00007fb082825fa0 RCX: 00007fb08259e159 [ 433.205396][T17659] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 433.205408][T17659] RBP: 00007fb0807f6090 R08: 0000000000000000 R09: 0000000000000000 [ 433.205420][T17659] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.205435][T17659] R13: 00007fb082826038 R14: 00007fb082825fa0 R15: 00007ffc397d74d8 [ 433.205466][T17659] [ 433.695446][T17665] syzkaller0: entered promiscuous mode [ 433.695504][T17665] syzkaller0: entered allmulticast mode [ 433.705753][T17665] tipc: Enabled bearer , priority 0 [ 433.723376][T17662] tipc: Resetting bearer [ 433.736073][T17676] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.798662][T17662] tipc: Disabling bearer [ 433.839306][T17680] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3851'. [ 435.168167][T17737] FAULT_INJECTION: forcing a failure. [ 435.168167][T17737] name failslab, interval 1, probability 0, space 0, times 0 [ 435.181655][T17737] CPU: 1 UID: 0 PID: 17737 Comm: syz.4.3868 Not tainted syzkaller #0 PREEMPT(full) [ 435.181676][T17737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 435.181684][T17737] Call Trace: [ 435.181690][T17737] [ 435.181696][T17737] dump_stack_lvl+0xe8/0x150 [ 435.181719][T17737] should_fail_ex+0x410/0x560 [ 435.181742][T17737] should_failslab+0xa8/0x100 [ 435.181758][T17737] __kvmalloc_node_noprof+0x176/0x820 [ 435.181774][T17737] ? bpf_compute_subprog_arg_access+0x138/0x14d0 [ 435.181788][T17737] ? bpf_compute_subprog_arg_access+0x138/0x14d0 [ 435.181807][T17737] bpf_compute_subprog_arg_access+0x138/0x14d0 [ 435.181821][T17737] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 435.181896][T17737] ? bpf_get_trace_printk_proto+0x48/0x60 [ 435.181912][T17737] ? bpf_get_call_summary+0x9f8/0xfa0 [ 435.181927][T17737] ? __pfx_bpf_get_call_summary+0x10/0x10 [ 435.181949][T17737] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 435.181966][T17737] ? __kvmalloc_node_noprof+0x345/0x820 [ 435.181979][T17737] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 435.181998][T17737] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 435.182016][T17737] bpf_compute_live_registers+0x8d3/0x1ff0 [ 435.182041][T17737] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 435.182061][T17737] bpf_check+0x25ed/0x2e10 [ 435.182081][T17737] ? ktime_get_with_offset+0x93/0x2d0 [ 435.182097][T17737] ? __pfx_bpf_check+0x10/0x10 [ 435.182116][T17737] ? bpf_obj_name_cpy+0x194/0x1e0 [ 435.182148][T17737] bpf_prog_load+0x14d6/0x1c20 [ 435.182176][T17737] ? __pfx_bpf_prog_load+0x10/0x10 [ 435.182205][T17737] __sys_bpf+0xd0d/0xd90 [ 435.182223][T17737] ? __pfx___sys_bpf+0x10/0x10 [ 435.182243][T17737] ? __fget_files+0x2a/0x420 [ 435.182268][T17737] ? ksys_write+0x242/0x270 [ 435.182286][T17737] ? __pfx_ksys_write+0x10/0x10 [ 435.182306][T17737] __x64_sys_bpf+0xba/0xd0 [ 435.182320][T17737] do_syscall_64+0x166/0x520 [ 435.182343][T17737] ? trace_irq_disable+0x3b/0x140 [ 435.182355][T17737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.182367][T17737] ? clear_bhb_loop+0x70/0xc0 [ 435.182382][T17737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.182394][T17737] RIP: 0033:0x7f49ecb9e159 [ 435.182408][T17737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.182419][T17737] RSP: 002b:00007f49edb48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 435.182435][T17737] RAX: ffffffffffffffda RBX: 00007f49ece25fa0 RCX: 00007f49ecb9e159 [ 435.182444][T17737] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 435.182452][T17737] RBP: 00007f49edb48090 R08: 0000000000000000 R09: 0000000000000000 [ 435.182461][T17737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 435.182468][T17737] R13: 00007f49ece26038 R14: 00007f49ece25fa0 R15: 00007ffe327d3828 [ 435.182487][T17737] [ 435.402650][T17744] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3870'. [ 436.227486][T17778] FAULT_INJECTION: forcing a failure. [ 436.227486][T17778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 436.246951][T17778] CPU: 0 UID: 0 PID: 17778 Comm: syz.1.3877 Not tainted syzkaller #0 PREEMPT(full) [ 436.246992][T17778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 436.247006][T17778] Call Trace: [ 436.247015][T17778] [ 436.247024][T17778] dump_stack_lvl+0xe8/0x150 [ 436.247062][T17778] should_fail_ex+0x410/0x560 [ 436.247099][T17778] _copy_from_iter+0x1d3/0x1660 [ 436.247128][T17778] ? skb_set_owner_w+0x263/0x3d0 [ 436.247164][T17778] ? __pfx__copy_from_iter+0x10/0x10 [ 436.247203][T17778] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 436.247230][T17778] skb_copy_datagram_from_iter+0xe6/0x720 [ 436.247261][T17778] ? skb_put+0x112/0x210 [ 436.247284][T17778] tun_get_user+0xc7f/0x44d0 [ 436.247331][T17778] ? aa_file_perm+0x18b/0x15f0 [ 436.247362][T17778] ? aa_file_perm+0x4ed/0x15f0 [ 436.247385][T17778] ? __pfx_tun_get_user+0x10/0x10 [ 436.247417][T17778] ? __lock_acquire+0x6df/0x2e50 [ 436.247442][T17778] ? kstrtoull+0x137/0x1d0 [ 436.247475][T17778] ? ref_tracker_alloc+0x341/0x4b0 [ 436.247496][T17778] ? lock_acquire+0x115/0x350 [ 436.247518][T17778] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 436.247542][T17778] ? lock_acquire+0x115/0x350 [ 436.247562][T17778] ? tun_get+0x1c/0x2f0 [ 436.247597][T17778] ? tun_get+0x1c/0x2f0 [ 436.247626][T17778] ? tun_get+0x1c/0x2f0 [ 436.247661][T17778] tun_chr_write_iter+0x113/0x200 [ 436.247693][T17778] vfs_write+0x612/0xba0 [ 436.247736][T17778] ? __pfx_vfs_write+0x10/0x10 [ 436.247776][T17778] ? __fget_files+0x2a/0x420 [ 436.247810][T17778] ksys_write+0x150/0x270 [ 436.247841][T17778] ? __pfx_ksys_write+0x10/0x10 [ 436.247880][T17778] do_syscall_64+0x166/0x520 [ 436.247909][T17778] ? trace_irq_disable+0x3b/0x140 [ 436.247929][T17778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.247950][T17778] ? clear_bhb_loop+0x70/0xc0 [ 436.247986][T17778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.248005][T17778] RIP: 0033:0x7feeeff9e159 [ 436.248026][T17778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 436.248046][T17778] RSP: 002b:00007feef0ef4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 436.248069][T17778] RAX: ffffffffffffffda RBX: 00007feef0225fa0 RCX: 00007feeeff9e159 [ 436.248086][T17778] RDX: 0000000000000008 RSI: 0000200000000500 RDI: 0000000000000004 [ 436.248100][T17778] RBP: 00007feef0ef4090 R08: 0000000000000000 R09: 0000000000000000 [ 436.248115][T17778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 436.248128][T17778] R13: 00007feef0226038 R14: 00007feef0225fa0 R15: 00007ffd30be5ca8 [ 436.248162][T17778] [ 436.889018][T17811] syzkaller1: tun_chr_ioctl cmd 1074812117 [ 437.098392][T17821] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3891'. [ 437.113011][T17821] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3891'. [ 438.173531][T17859] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.334580][T17869] FAULT_INJECTION: forcing a failure. [ 438.334580][T17869] name failslab, interval 1, probability 0, space 0, times 0 [ 438.334636][T17869] CPU: 0 UID: 0 PID: 17869 Comm: syz.0.3901 Not tainted syzkaller #0 PREEMPT(full) [ 438.334666][T17869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 438.334679][T17869] Call Trace: [ 438.334688][T17869] [ 438.334698][T17869] dump_stack_lvl+0xe8/0x150 [ 438.334731][T17869] should_fail_ex+0x410/0x560 [ 438.334767][T17869] should_failslab+0xa8/0x100 [ 438.334796][T17869] __kvmalloc_node_noprof+0x176/0x820 [ 438.334821][T17869] ? __kvmalloc_node_noprof+0x345/0x820 [ 438.334843][T17869] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 438.334868][T17869] ? bpf_compute_subprog_arg_access+0x187/0x14d0 [ 438.334900][T17869] bpf_compute_subprog_arg_access+0x187/0x14d0 [ 438.334925][T17869] ? __pfx_lwt_seg6local_func_proto+0x10/0x10 [ 438.334970][T17869] ? bpf_get_trace_printk_proto+0x48/0x60 [ 438.335022][T17869] ? __pfx_bpf_compute_subprog_arg_access+0x10/0x10 [ 438.335052][T17869] ? __kvmalloc_node_noprof+0x345/0x820 [ 438.335074][T17869] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 438.335097][T17869] ? bpf_compute_live_registers+0x14f/0x1ff0 [ 438.335127][T17869] bpf_compute_live_registers+0x8d3/0x1ff0 [ 438.335172][T17869] ? __pfx_bpf_compute_live_registers+0x10/0x10 [ 438.335207][T17869] bpf_check+0x25ed/0x2e10 [ 438.335241][T17869] ? ktime_get_with_offset+0x93/0x2d0 [ 438.335269][T17869] ? __pfx_bpf_check+0x10/0x10 [ 438.335294][T17869] ? bpf_obj_name_cpy+0x194/0x1e0 [ 438.335326][T17869] bpf_prog_load+0x14d6/0x1c20 [ 438.335363][T17869] ? __pfx_bpf_prog_load+0x10/0x10 [ 438.335413][T17869] __sys_bpf+0xd0d/0xd90 [ 438.335443][T17869] ? __pfx___sys_bpf+0x10/0x10 [ 438.335478][T17869] ? __fget_files+0x2a/0x420 [ 438.335523][T17869] ? ksys_write+0x242/0x270 [ 438.335555][T17869] ? __pfx_ksys_write+0x10/0x10 [ 438.335589][T17869] __x64_sys_bpf+0xba/0xd0 [ 438.335614][T17869] do_syscall_64+0x166/0x520 [ 438.335644][T17869] ? trace_irq_disable+0x3b/0x140 [ 438.335665][T17869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.335687][T17869] ? clear_bhb_loop+0x70/0xc0 [ 438.335714][T17869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.335736][T17869] RIP: 0033:0x7fb01a59e159 [ 438.335758][T17869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 438.335777][T17869] RSP: 002b:00007fb01b430028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 438.335800][T17869] RAX: ffffffffffffffda RBX: 00007fb01a825fa0 RCX: 00007fb01a59e159 [ 438.335816][T17869] RDX: 0000000000000078 RSI: 0000200000000440 RDI: 0000000000000005 [ 438.335830][T17869] RBP: 00007fb01b430090 R08: 0000000000000000 R09: 0000000000000000 [ 438.335844][T17869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 438.335857][T17869] R13: 00007fb01a826038 R14: 00007fb01a825fa0 R15: 00007ffe3885cd48 [ 438.335889][T17869] [ 438.687636][T17872] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3902'. [ 438.687696][T17872] netlink: 'syz.4.3902': attribute type 30 has an invalid length. [ 438.687716][T17872] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3902'. [ 439.182855][T17895] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.201075][T17895] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3911'. [ 440.031794][ T1253] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.142726][T17935] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3924'. [ 440.191854][T17936] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3924'. [ 440.381827][ T7057] IPVS: starting estimator thread 0... [ 440.422930][T17950] ªªªªªª: renamed from vlan0 (while UP) [ 440.479924][T17949] IPVS: using max 30 ests per chain, 72000 per kthread [ 440.495700][T17952] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3928'. [ 440.736976][T17955] Bluetooth: hci0: unsupported parameter 5135 [ 440.737039][T17955] Bluetooth: hci0: invalid len left 4, exp >= 20 [ 441.154511][T17977] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3937'. [ 441.768700][T18006] netlink: 'syz.4.3948': attribute type 4 has an invalid length. [ 441.780324][T18006] netlink: 17 bytes leftover after parsing attributes in process `syz.4.3948'. [ 442.102650][T18021] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 442.229381][T18019] FAULT_INJECTION: forcing a failure. [ 442.229381][T18019] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 442.230798][T18019] CPU: 1 UID: 0 PID: 18019 Comm: syz.1.3952 Not tainted syzkaller #0 PREEMPT(full) [ 442.230825][T18019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 442.230838][T18019] Call Trace: [ 442.230847][T18019] [ 442.230857][T18019] dump_stack_lvl+0xe8/0x150 [ 442.230894][T18019] should_fail_ex+0x410/0x560 [ 442.230932][T18019] _copy_to_user+0x31/0xb0 [ 442.230959][T18019] simple_read_from_buffer+0xe1/0x170 [ 442.230992][T18019] proc_fail_nth_read+0x1bb/0x230 [ 442.231060][T18019] ? common_file_perm+0x20e/0x2b0 [ 442.231087][T18019] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 442.231122][T18019] ? rw_verify_area+0x24a/0x4c0 [ 442.231150][T18019] ? tun_chr_write_iter+0x18a/0x200 [ 442.231182][T18019] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 442.231213][T18019] vfs_read+0x213/0xa80 [ 442.231249][T18019] ? __pfx___mutex_lock+0x10/0x10 [ 442.231283][T18019] ? __pfx_vfs_read+0x10/0x10 [ 442.231312][T18019] ? __fget_files+0x2a/0x420 [ 442.231338][T18019] ? __fget_files+0x3a2/0x420 [ 442.231360][T18019] ? __fget_files+0x2a/0x420 [ 442.231391][T18019] ksys_read+0x150/0x270 [ 442.231419][T18019] ? __pfx_ksys_read+0x10/0x10 [ 442.231456][T18019] do_syscall_64+0x166/0x520 [ 442.231491][T18019] ? trace_irq_disable+0x3b/0x140 [ 442.231510][T18019] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.231530][T18019] ? clear_bhb_loop+0x70/0xc0 [ 442.231553][T18019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.231572][T18019] RIP: 0033:0x7feeeff5e98e [ 442.231591][T18019] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 442.231607][T18019] RSP: 002b:00007feef0ef3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 442.231629][T18019] RAX: ffffffffffffffda RBX: 00007feef0ef46c0 RCX: 00007feeeff5e98e [ 442.231643][T18019] RDX: 000000000000000f RSI: 00007feef0ef40a0 RDI: 0000000000000008 [ 442.231656][T18019] RBP: 00007feef0ef4090 R08: 0000000000000000 R09: 0000000000000000 [ 442.231668][T18019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.231680][T18019] R13: 00007feef0226038 R14: 00007feef0225fa0 R15: 00007ffd30be5ca8 [ 442.231712][T18019] [ 443.351871][T18068] rdma_op ffff88802b59da38 conn xmit_rdma 0000000000000000 [ 443.431333][T18068] __nla_validate_parse: 1 callbacks suppressed [ 443.431658][T18068] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3963'. [ 443.515334][T18078] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 443.523903][T18076] netlink: 252 bytes leftover after parsing attributes in process `syz.4.3963'. [ 443.590430][T18081] FAULT_INJECTION: forcing a failure. [ 443.590430][T18081] name failslab, interval 1, probability 0, space 0, times 0 [ 443.590489][T18081] CPU: 1 UID: 0 PID: 18081 Comm: syz.1.3970 Not tainted syzkaller #0 PREEMPT(full) [ 443.590513][T18081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 443.590524][T18081] Call Trace: [ 443.590531][T18081] [ 443.590540][T18081] dump_stack_lvl+0xe8/0x150 [ 443.590573][T18081] should_fail_ex+0x410/0x560 [ 443.590606][T18081] should_failslab+0xa8/0x100 [ 443.590632][T18081] ? skb_clone+0x212/0x3a0 [ 443.590654][T18081] kmem_cache_alloc_noprof+0xa1/0x600 [ 443.590683][T18081] ? skb_clone+0x212/0x3a0 [ 443.590710][T18081] skb_clone+0x212/0x3a0 [ 443.590734][T18081] __netlink_deliver_tap+0x413/0x860 [ 443.590768][T18081] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.590793][T18081] netlink_deliver_tap+0x19c/0x1b0 [ 443.590816][T18081] netlink_sendskb+0x68/0x140 [ 443.590840][T18081] netlink_rcv_skb+0x2a4/0x4a0 [ 443.590863][T18081] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 443.590968][T18081] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 443.591006][T18081] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.591028][T18081] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.591053][T18081] xfrm_netlink_rcv+0x79/0x90 [ 443.591078][T18081] netlink_unicast+0x7bd/0x940 [ 443.591110][T18081] netlink_sendmsg+0x813/0xb40 [ 443.591142][T18081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.591173][T18081] ? apparmor_socket_sendmsg+0x98/0x360 [ 443.591203][T18081] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.591224][T18081] sock_sendmsg_nosec+0x13a/0x180 [ 443.591252][T18081] ____sys_sendmsg+0x54e/0x850 [ 443.591278][T18081] ? __pfx_____sys_sendmsg+0x10/0x10 [ 443.591307][T18081] ? import_iovec+0x73/0xa0 [ 443.591332][T18081] ___sys_sendmsg+0x2a5/0x360 [ 443.591351][T18081] ? __lock_acquire+0x6df/0x2e50 [ 443.591376][T18081] ? __pfx____sys_sendmsg+0x10/0x10 [ 443.591439][T18081] ? __fget_files+0x2a/0x420 [ 443.591462][T18081] ? __fget_files+0x3a2/0x420 [ 443.591495][T18081] __x64_sys_sendmsg+0x1b1/0x290 [ 443.591519][T18081] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 443.591560][T18081] do_syscall_64+0x166/0x520 [ 443.591586][T18081] ? trace_irq_disable+0x3b/0x140 [ 443.591605][T18081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.591624][T18081] ? clear_bhb_loop+0x70/0xc0 [ 443.591647][T18081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.591665][T18081] RIP: 0033:0x7feeeff9e159 [ 443.591684][T18081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.591701][T18081] RSP: 002b:00007feef0ef4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.591724][T18081] RAX: ffffffffffffffda RBX: 00007feef0225fa0 RCX: 00007feeeff9e159 [ 443.591739][T18081] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 443.591751][T18081] RBP: 00007feef0ef4090 R08: 0000000000000000 R09: 0000000000000000 [ 443.591763][T18081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.591774][T18081] R13: 00007feef0226038 R14: 00007feef0225fa0 R15: 00007ffd30be5ca8 [ 443.591805][T18081] [ 443.938578][T18087] tipc: Enabled bearer , priority 0 [ 443.942239][T18092] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3974'. [ 444.001898][T18087] syzkaller0: entered promiscuous mode [ 444.007516][T18087] syzkaller0: entered allmulticast mode [ 444.016211][T18087] tipc: Resetting bearer [ 444.064991][T18087] tipc: Resetting bearer [ 444.107447][T18099] FAULT_INJECTION: forcing a failure. [ 444.107447][T18099] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 444.126740][T18099] CPU: 0 UID: 0 PID: 18099 Comm: syz.0.3977 Not tainted syzkaller #0 PREEMPT(full) [ 444.126770][T18099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 444.126782][T18099] Call Trace: [ 444.126792][T18099] [ 444.126801][T18099] dump_stack_lvl+0xe8/0x150 [ 444.126835][T18099] should_fail_ex+0x410/0x560 [ 444.126872][T18099] _copy_from_user+0x2d/0xb0 [ 444.126897][T18099] __sys_bpf+0x2e7/0xd90 [ 444.126929][T18099] ? __pfx___sys_bpf+0x10/0x10 [ 444.126964][T18099] ? __fget_files+0x2a/0x420 [ 444.127008][T18099] ? ksys_write+0x242/0x270 [ 444.127039][T18099] ? __pfx_ksys_write+0x10/0x10 [ 444.127072][T18099] __x64_sys_bpf+0xba/0xd0 [ 444.127097][T18099] do_syscall_64+0x166/0x520 [ 444.127127][T18099] ? trace_irq_disable+0x3b/0x140 [ 444.127146][T18099] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.127168][T18099] ? clear_bhb_loop+0x70/0xc0 [ 444.127193][T18099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 444.127214][T18099] RIP: 0033:0x7fb01a59e159 [ 444.127235][T18099] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 444.127252][T18099] RSP: 002b:00007fb01b430028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 444.127277][T18099] RAX: ffffffffffffffda RBX: 00007fb01a825fa0 RCX: 00007fb01a59e159 [ 444.127292][T18099] RDX: 0000000000000050 RSI: 00002000000000c0 RDI: 000000000000000a [ 444.127306][T18099] RBP: 00007fb01b430090 R08: 0000000000000000 R09: 0000000000000000 [ 444.127320][T18099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.127333][T18099] R13: 00007fb01a826038 R14: 00007fb01a825fa0 R15: 00007ffe3885cd48 [ 444.127367][T18099] [ 444.964278][T18134] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3979'. [ 446.943137][T18087] tipc: Disabling bearer [ 446.952934][T18101] tipc: Enabling of bearer rejected, failed to enable media [ 446.953572][T18105] syzkaller0: entered promiscuous mode [ 446.953593][T18105] syzkaller0: entered allmulticast mode [ 447.060772][T18134] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 447.061953][T18172] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3980'. [ 447.963534][ T969] bridge0: entered promiscuous mode [ 448.298012][T18227] netlink: 276 bytes leftover after parsing attributes in process `syz.2.4003'. [ 448.459200][T18234] netlink: 'syz.4.3998': attribute type 1 has an invalid length. [ 448.459272][T18234] netlink: 'syz.4.3998': attribute type 2 has an invalid length. [ 448.498834][T18229] syzkaller0: entered promiscuous mode [ 448.498903][T18229] syzkaller0: entered allmulticast mode [ 448.561276][T18231] tipc: Enabled bearer , priority 0 [ 448.568888][T18222] tipc: Resetting bearer [ 448.643061][T18236] netlink: 'syz.2.4005': attribute type 1 has an invalid length. [ 448.683029][T18222] tipc: Disabling bearer [ 448.879241][T18236] 8021q: adding VLAN 0 to HW filter on device bond1 [ 449.178269][T18236] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4005'. [ 449.178377][T18236] bond1: entered promiscuous mode [ 449.333696][T18256] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 449.370417][T18256] bond2: (slave lo): Enslaving as an active interface with an up link [ 449.372638][T18256] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 449.410976][T18238] bond1: (slave dummy0): making interface the new active one [ 449.411016][T18238] dummy0: entered promiscuous mode [ 449.426198][T18238] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 449.428369][T18258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4012'. [ 449.635402][T18263] X25: received unknown 00 with LCI 000 [ 449.778983][T18266] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4016'. [ 450.146934][T18289] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4026'. [ 450.342435][T18293] syzkaller0: entered promiscuous mode [ 450.342494][T18293] syzkaller0: entered allmulticast mode [ 450.350479][T18293] tipc: Enabled bearer , priority 0 [ 450.356447][T18292] tipc: Resetting bearer [ 450.446115][T18292] tipc: Disabling bearer [ 450.454343][T18305] ip6t_rpfilter: unknown options [ 450.808376][T18312] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4034'. [ 450.833557][T18312] netlink: 'syz.0.4034': attribute type 1 has an invalid length. [ 450.833620][T18312] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4034'. [ 451.811315][T18345] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4045'. [ 452.088205][T18359] FAULT_INJECTION: forcing a failure. [ 452.088205][T18359] name failslab, interval 1, probability 0, space 0, times 0 [ 452.101520][T18359] CPU: 0 UID: 0 PID: 18359 Comm: syz.4.4053 Not tainted syzkaller #0 PREEMPT(full) [ 452.101551][T18359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 452.101564][T18359] Call Trace: [ 452.101573][T18359] [ 452.101583][T18359] dump_stack_lvl+0xe8/0x150 [ 452.101619][T18359] should_fail_ex+0x410/0x560 [ 452.101657][T18359] should_failslab+0xa8/0x100 [ 452.101683][T18359] __kmalloc_noprof+0xfe/0x720 [ 452.101715][T18359] ? sk_prot_alloc+0xe7/0x210 [ 452.101736][T18359] ? sk_prot_alloc+0xe7/0x210 [ 452.101765][T18359] sk_prot_alloc+0xe7/0x210 [ 452.101784][T18359] ? sk_alloc+0x27/0x390 [ 452.101807][T18359] sk_alloc+0x3a/0x390 [ 452.101831][T18359] bpf_prog_test_run_skb+0x3a6/0x2230 [ 452.101925][T18359] ? lock_acquire+0x115/0x350 [ 452.101974][T18359] ? __fget_files+0x3a2/0x420 [ 452.102000][T18359] ? __fget_files+0x2a/0x420 [ 452.102032][T18359] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 452.102060][T18359] bpf_prog_test_run+0x2c5/0x340 [ 452.102089][T18359] __sys_bpf+0xa22/0xd90 [ 452.102121][T18359] ? __pfx___sys_bpf+0x10/0x10 [ 452.102157][T18359] ? __fget_files+0x2a/0x420 [ 452.102204][T18359] ? ksys_write+0x242/0x270 [ 452.102235][T18359] ? __pfx_ksys_write+0x10/0x10 [ 452.102271][T18359] __x64_sys_bpf+0xba/0xd0 [ 452.102296][T18359] do_syscall_64+0x166/0x520 [ 452.102326][T18359] ? trace_irq_disable+0x3b/0x140 [ 452.102346][T18359] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.102368][T18359] ? clear_bhb_loop+0x70/0xc0 [ 452.102400][T18359] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.102421][T18359] RIP: 0033:0x7f49ecb9e159 [ 452.102442][T18359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.102460][T18359] RSP: 002b:00007f49edb48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 452.102485][T18359] RAX: ffffffffffffffda RBX: 00007f49ece25fa0 RCX: 00007f49ecb9e159 [ 452.102501][T18359] RDX: 0000000000000050 RSI: 00002000000000c0 RDI: 000000000000000a [ 452.102516][T18359] RBP: 00007f49edb48090 R08: 0000000000000000 R09: 0000000000000000 [ 452.102530][T18359] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.102543][T18359] R13: 00007f49ece26038 R14: 00007f49ece25fa0 R15: 00007ffe327d3828 [ 452.102577][T18359] [ 452.375009][T18368] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 452.490899][T18375] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 453.406617][T18419] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4071'. [ 453.589231][T18426] xt_connbytes: Forcing CT accounting to be enabled [ 453.804106][T18434] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4077'. [ 453.805090][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 453.908664][T18445] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 454.192923][T18439] __nla_validate_parse: 24 callbacks suppressed [ 454.192990][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.213867][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.233341][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.257972][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.282071][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.298321][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.308660][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.309806][T18455] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4084'. [ 454.319061][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.330611][T18439] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4079'. [ 454.406213][T18455] ipvlan2: entered allmulticast mode [ 454.406253][T18455] syz_tun: entered allmulticast mode [ 454.566718][T18466] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 455.066120][T18470] syzkaller0: entered promiscuous mode [ 455.066173][T18470] syzkaller0: entered allmulticast mode [ 455.094590][T18491] macsec2: entered promiscuous mode [ 458.903759][T18561] tipc: Enabling of bearer rejected, failed to enable media [ 459.194544][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 459.236588][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 459.237624][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 459.820570][T18600] openvswitch: netlink: Unexpected mask (mask=4000010, allowed=10058) [ 460.040167][T18573] infiniband syz0: set active [ 460.040260][T17022] xfrm0 speed is unknown, defaulting to 1000 [ 460.050255][T18573] infiniband syz0: added xfrm0 [ 460.086045][T18573] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 460.086119][T18573] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 460.086159][T18573] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 460.197571][T18573] RDS/IB: syz0: added [ 460.197682][T18573] smc: adding ib device syz0 with port count 1 [ 460.197705][T18573] smc: ib device syz0 port 1 has no pnetid [ 460.262900][T18603] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.276555][T18603] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 461.258400][T17542] xfrm0 speed is unknown, defaulting to 1000 [ 461.260962][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 461.273043][ T12] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.273078][ T12] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.273133][ T12] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.273160][ T12] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.273195][ T12] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.273221][ T12] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.273254][ T12] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 461.273279][ T12] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 461.452485][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 461.588916][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 461.728245][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 461.865471][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 462.003518][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 462.140127][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 462.278334][T18587] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 462.297664][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 462.311980][T18576] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 462.740011][T18629] x_tables: duplicate underflow at hook 2 [ 463.020778][T18645] __nla_validate_parse: 35 callbacks suppressed [ 463.021079][T18645] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4134'. [ 463.141782][T18573] xfrm0 speed is unknown, defaulting to 1000 [ 463.742171][T18671] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4145'. [ 463.743390][T18671] smc: ib device syz2 ibport 1 applied user defined pnetid S [ 463.861954][T18675] netlink: 104 bytes leftover after parsing attributes in process `syz.0.4145'. [ 463.934541][T18679] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 464.237471][T18692] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4153'. [ 464.757755][T18709] syzkaller0: entered promiscuous mode [ 464.757808][T18709] syzkaller0: entered allmulticast mode [ 464.777911][T18709] tipc: Enabled bearer , priority 0 [ 464.790391][T18708] tipc: Resetting bearer [ 464.863457][T18708] tipc: Disabling bearer [ 464.864220][T18715] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4160'. [ 464.897876][T18713] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4159'. [ 465.318041][T18733] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4168'. [ 465.318087][T18733] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4168'. [ 465.544886][T18745] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4170'. [ 466.030066][T18769] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 466.038138][T18769] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4179'. [ 466.331486][T18780] syzkaller0: entered promiscuous mode [ 466.337309][T18780] syzkaller0: entered allmulticast mode [ 466.355707][T18780] tipc: Enabled bearer , priority 0 [ 466.368973][T18779] tipc: Resetting bearer [ 466.446424][T18779] tipc: Disabling bearer [ 466.611716][T18788] bond2: Unable to set peer notification delay as MII monitoring is disabled [ 466.628919][T18788] bond2 (unregistering): Released all slaves [ 467.394620][T18823] lo speed is unknown, defaulting to 1000 [ 467.501544][T18830] netlink: 'syz.2.4203': attribute type 2 has an invalid length. [ 467.709646][T16767] Bluetooth: hci4: command 0x0406 tx timeout [ 467.899044][T18843] netlink: 'syz.1.4207': attribute type 1 has an invalid length. [ 468.094904][T18843] 8021q: adding VLAN 0 to HW filter on device bond1 [ 468.157347][T18823] xfrm0 speed is unknown, defaulting to 1000 [ 468.194748][T18843] bridge0: port 3(dummy0) entered disabled state [ 468.235541][T18843] dummy0: left allmulticast mode [ 468.235617][T18843] dummy0: left promiscuous mode [ 468.235881][T18843] bridge0: port 3(dummy0) entered disabled state [ 468.305882][T18843] bond1: (slave dummy0): making interface the new active one [ 468.317695][T18843] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 468.404871][T18854] syz_tun: entered allmulticast mode [ 469.048741][T18865] __nla_validate_parse: 5 callbacks suppressed [ 469.048792][T18865] netlink: 580 bytes leftover after parsing attributes in process `syz.2.4214'. [ 469.082985][T18848] syz_tun: left allmulticast mode [ 469.287385][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4217'. [ 469.296954][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4217'. [ 469.307337][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4217'. [ 469.316706][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4217'. [ 469.326131][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4217'. [ 469.326157][T18871] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4217'. [ 469.451318][T18873] Unsupported ieee802154 address type: 0 [ 469.530755][T18875] batadv0: mtu less than device minimum [ 469.602395][T18877] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4219'. [ 469.886391][T18885] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4222'. [ 470.555242][T18919] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4238'. [ 470.574126][T18913] X25: received unknown 00 with LCI 000 [ 470.656515][T18917] lo: entered promiscuous mode [ 470.691437][T18917] tunl0: entered promiscuous mode [ 470.698268][T18917] gre0: entered promiscuous mode [ 470.787129][T18917] gretap0: entered promiscuous mode [ 470.843255][T18917] erspan0: entered promiscuous mode [ 470.866505][T18917] ip_vti0: entered promiscuous mode [ 470.874184][T18917] ip6_vti0: entered promiscuous mode [ 470.886494][T18917] sit0: entered promiscuous mode [ 470.924167][T18917] ip6tnl0: entered promiscuous mode [ 470.938246][T18917] ip6gre0: entered promiscuous mode [ 470.964875][T18917] syz_tun: entered promiscuous mode [ 470.996254][T18917] ip6gretap0: entered promiscuous mode [ 471.005960][T18917] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.006670][T18917] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.028301][T18917] vcan0: entered promiscuous mode [ 471.066504][T18917] bond0: entered promiscuous mode [ 471.066554][T18917] bond_slave_0: entered promiscuous mode [ 471.066780][T18917] bond_slave_1: entered promiscuous mode [ 471.100974][T18917] team0: entered promiscuous mode [ 471.101024][T18917] team_slave_0: entered promiscuous mode [ 471.101242][T18917] team_slave_1: entered promiscuous mode [ 471.117799][T18917] dummy0: entered promiscuous mode [ 471.139594][T18917] nlmon0: entered promiscuous mode [ 471.142747][T18917] batadv0: entered promiscuous mode [ 471.158749][T18917] vxcan0: entered promiscuous mode [ 471.168917][T18917] vxcan1: entered promiscuous mode [ 471.176503][T18917] veth0: entered promiscuous mode [ 471.192116][T18917] veth1: entered promiscuous mode [ 471.201803][T18917] wg0: entered promiscuous mode [ 471.207679][T18917] wg1: entered promiscuous mode [ 471.217473][T18917] wg2: entered promiscuous mode [ 471.224952][T18917] veth0_to_bridge: entered promiscuous mode [ 471.235741][T18917] veth1_to_bridge: entered promiscuous mode [ 471.248260][T18917] veth0_to_bond: entered promiscuous mode [ 471.258991][T18917] veth1_to_bond: entered promiscuous mode [ 471.269818][T18917] veth0_to_team: entered promiscuous mode [ 471.296079][T18917] veth1_to_team: entered promiscuous mode [ 471.320118][T18917] veth0_to_batadv: entered promiscuous mode [ 471.337573][T18917] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 471.349808][T18917] batadv_slave_0: entered promiscuous mode [ 471.366487][T18917] veth1_to_batadv: entered promiscuous mode [ 471.387604][T18917] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 471.387681][T18917] batadv_slave_1: entered promiscuous mode [ 471.406485][T18917] xfrm0: entered promiscuous mode [ 471.426143][T18917] veth0_to_hsr: entered promiscuous mode [ 471.456732][T18917] veth1_to_hsr: entered promiscuous mode [ 471.474657][T18917] hsr0: entered promiscuous mode [ 471.480877][T18917] veth1_virt_wifi: entered promiscuous mode [ 471.487617][T18917] veth0_virt_wifi: entered promiscuous mode [ 471.492421][T18917] virt_wifi0: entered promiscuous mode [ 471.508614][T18917] vlan0: entered promiscuous mode [ 471.530960][T18917] vlan1: entered promiscuous mode [ 471.537196][T18917] macvlan0: entered promiscuous mode [ 471.543769][T18917] macvlan1: entered promiscuous mode [ 471.548233][T18917] ipvlan0: entered promiscuous mode [ 471.548399][T18917] ipvlan1: entered promiscuous mode [ 471.563177][T18917] macvtap0: entered promiscuous mode [ 471.566131][T18917] macsec0: entered promiscuous mode [ 471.568670][T18917] geneve0: entered promiscuous mode [ 471.574291][T18917] geneve1: entered promiscuous mode [ 471.589326][T18917] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 471.601895][T18917] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 471.612304][T18917] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 471.621491][T18917] netdevsim netdevsim1 netdevsim3: entered promiscuous mode [ 471.624358][T18917] mac80211_hwsim hwsim36 wlan1: entered promiscuous mode [ 471.624523][T18917] mac80211_hwsim hwsim37 wlan2: entered promiscuous mode [ 471.624671][T18917] geneve2: entered promiscuous mode [ 471.624785][T18917] bridge1: entered promiscuous mode [ 471.625105][T18917] vxlan0: entered promiscuous mode [ 471.662463][T18917] erspan1: entered promiscuous mode [ 471.667486][T18917] macsec1: entered promiscuous mode [ 471.679318][T18917] bridge2: entered promiscuous mode [ 471.684955][T18917] bond1: entered promiscuous mode [ 471.745894][ T5750] xfrm0 speed is unknown, defaulting to 1000 [ 471.745943][ T5750] syz0: Port: 1 Link DOWN [ 471.746482][ T5750] xfrm0 speed is unknown, defaulting to 1000 [ 471.750234][T12658] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.750272][T12658] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.750306][T12658] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.750330][T12658] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.750361][T12658] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.750384][T12658] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.750414][T12658] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 471.750437][T12658] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 472.153171][T18967] 8021q: VLANs not supported on ip_vti0 [ 472.874498][T19004] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 472.997304][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.997486][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.997651][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.997788][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.997928][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.998057][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.998187][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.998316][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.998449][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 472.998579][T19011] netlink: 'syz.1.4259': attribute type 13 has an invalid length. [ 473.755351][T19055] x_tables: ip6_tables: SNAT target: used from hooks OUTPUT, but only usable from INPUT/POSTROUTING [ 473.854221][T19055] syzkaller0: entered promiscuous mode [ 473.854252][T19055] syzkaller0: entered allmulticast mode [ 474.715585][T19093] syzkaller0: entered promiscuous mode [ 474.715624][T19093] syzkaller0: entered allmulticast mode [ 475.111089][T19108] FAULT_INJECTION: forcing a failure. [ 475.111089][T19108] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 475.111156][T19108] CPU: 0 UID: 0 PID: 19108 Comm: syz.2.4285 Not tainted syzkaller #0 PREEMPT(full) [ 475.111182][T19108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 475.111195][T19108] Call Trace: [ 475.111204][T19108] [ 475.111215][T19108] dump_stack_lvl+0xe8/0x150 [ 475.111266][T19108] should_fail_ex+0x410/0x560 [ 475.111308][T19108] _copy_to_user+0x31/0xb0 [ 475.111337][T19108] simple_read_from_buffer+0xe1/0x170 [ 475.111375][T19108] proc_fail_nth_read+0x1bb/0x230 [ 475.111405][T19108] ? common_file_perm+0x20e/0x2b0 [ 475.111434][T19108] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 475.111470][T19108] ? rw_verify_area+0x24a/0x4c0 [ 475.111503][T19108] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 475.111533][T19108] vfs_read+0x213/0xa80 [ 475.111567][T19108] ? __pfx___mutex_lock+0x10/0x10 [ 475.111605][T19108] ? __pfx_vfs_read+0x10/0x10 [ 475.111636][T19108] ? __fget_files+0x2a/0x420 [ 475.111667][T19108] ? __fget_files+0x3a2/0x420 [ 475.111692][T19108] ? __fget_files+0x2a/0x420 [ 475.111727][T19108] ksys_read+0x150/0x270 [ 475.111758][T19108] ? __pfx_ksys_read+0x10/0x10 [ 475.111798][T19108] do_syscall_64+0x166/0x520 [ 475.111826][T19108] ? trace_irq_disable+0x3b/0x140 [ 475.111847][T19108] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.111868][T19108] ? clear_bhb_loop+0x70/0xc0 [ 475.111893][T19108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.111913][T19108] RIP: 0033:0x7fb08255e98e [ 475.111937][T19108] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 475.111956][T19108] RSP: 002b:00007fb0807f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 475.111980][T19108] RAX: ffffffffffffffda RBX: 00007fb0807f66c0 RCX: 00007fb08255e98e [ 475.111996][T19108] RDX: 000000000000000f RSI: 00007fb0807f60a0 RDI: 0000000000000006 [ 475.112009][T19108] RBP: 00007fb0807f6090 R08: 0000000000000000 R09: 0000000000000000 [ 475.112022][T19108] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 475.112034][T19108] R13: 00007fb082826038 R14: 00007fb082825fa0 R15: 00007ffc397d74d8 [ 475.112069][T19108] [ 475.738111][T19145] __nla_validate_parse: 34 callbacks suppressed [ 475.738169][T19145] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4293'. [ 476.224488][T19155] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4294'. [ 477.657962][T19103] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 477.889189][T19167] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4299'. [ 478.286923][T19185] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4307'. [ 478.474813][T19195] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 478.483865][T19195] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4311'. [ 479.168227][T19220] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4323'. [ 479.311801][T19234] validate_nla: 24 callbacks suppressed [ 479.321145][T19234] netlink: 'syz.3.4329': attribute type 2 has an invalid length. [ 479.346231][T19228] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4325'. [ 479.477520][T19236] X25: received unknown 00 with LCI 000 [ 479.959918][T19264] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4337'. [ 480.082986][T19271] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4340'. [ 480.096394][T19272] netlink: 'syz.4.4339': attribute type 4 has an invalid length. [ 481.003012][T19308] batadv0: entered promiscuous mode [ 481.378137][T19312] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4353'. [ 481.527391][T19306] batadv0: left promiscuous mode [ 481.656264][T19338] FAULT_INJECTION: forcing a failure. [ 481.656264][T19338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 481.671926][T19338] CPU: 1 UID: 0 PID: 19338 Comm: syz.3.4356 Not tainted syzkaller #0 PREEMPT(full) [ 481.671957][T19338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 481.671971][T19338] Call Trace: [ 481.671981][T19338] [ 481.671990][T19338] dump_stack_lvl+0xe8/0x150 [ 481.672026][T19338] should_fail_ex+0x410/0x560 [ 481.672061][T19338] _copy_to_iter+0x59c/0x1810 [ 481.672107][T19338] ? __pfx__copy_to_iter+0x10/0x10 [ 481.672140][T19338] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 481.672170][T19338] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 481.672197][T19338] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 481.672228][T19338] __skb_datagram_iter+0xf8/0x980 [ 481.672259][T19338] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 481.672288][T19338] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 481.672321][T19338] skb_copy_datagram_iter+0xb5/0x240 [ 481.672350][T19338] netlink_recvmsg+0x2b9/0xa50 [ 481.672388][T19338] ? __pfx_netlink_recvmsg+0x10/0x10 [ 481.672412][T19338] ? lock_acquire+0x115/0x350 [ 481.672437][T19338] ? aa_sock_msg_perm+0x144/0x210 [ 481.672465][T19338] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 481.672488][T19338] ? security_socket_recvmsg+0x7e/0x2c0 [ 481.672514][T19338] ? __pfx_netlink_recvmsg+0x10/0x10 [ 481.672537][T19338] sock_recvmsg+0x196/0x1e0 [ 481.672570][T19338] ____sys_recvmsg+0x1e6/0x4a0 [ 481.672603][T19338] ? __pfx_____sys_recvmsg+0x10/0x10 [ 481.672642][T19338] ? import_iovec+0x73/0xa0 [ 481.672668][T19338] ___sys_recvmsg+0x213/0x5a0 [ 481.672698][T19338] ? __pfx____sys_recvmsg+0x10/0x10 [ 481.672727][T19338] ? lock_acquire+0x115/0x350 [ 481.672767][T19338] ? __fget_files+0x3a2/0x420 [ 481.672806][T19338] do_recvmmsg+0x31a/0x7f0 [ 481.672839][T19338] ? __pfx_do_recvmmsg+0x10/0x10 [ 481.672877][T19338] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 481.672909][T19338] ? __fget_files+0x3a2/0x420 [ 481.672947][T19338] __x64_sys_recvmmsg+0x198/0x250 [ 481.672974][T19338] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 481.673011][T19338] do_syscall_64+0x166/0x520 [ 481.673040][T19338] ? trace_irq_disable+0x3b/0x140 [ 481.673060][T19338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.673082][T19338] ? clear_bhb_loop+0x70/0xc0 [ 481.673108][T19338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 481.673129][T19338] RIP: 0033:0x7f96c299e159 [ 481.673150][T19338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 481.673169][T19338] RSP: 002b:00007f96c394e028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 481.673192][T19338] RAX: ffffffffffffffda RBX: 00007f96c2c25fa0 RCX: 00007f96c299e159 [ 481.673209][T19338] RDX: 0000000000000004 RSI: 0000200000005000 RDI: 0000000000000003 [ 481.673222][T19338] RBP: 00007f96c394e090 R08: 0000000000000000 R09: 0000000000000000 [ 481.673235][T19338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 481.673257][T19338] R13: 00007f96c2c26038 R14: 00007f96c2c25fa0 R15: 00007fffd6b2fd88 [ 481.673291][T19338] [ 482.179928][T19355] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 482.183818][T19355] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4362'. [ 482.218316][T19358] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4361'. [ 482.277520][T19361] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 482.290196][T19361] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4364'. [ 482.328337][ T31] audit: type=1800 audit(1788558454.960:9): pid=19364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4365" name="blkio.bfq.time_recursive" dev="tmpfs" ino=1074 res=0 errno=0 [ 482.555257][T19371] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4368'. [ 482.862624][T19384] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4371'. [ 482.872299][T19385] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4371'. [ 482.994063][T19389] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4371'. [ 483.039514][T19391] dummy0: entered allmulticast mode [ 483.046123][T19385] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4371'. [ 483.064905][T19387] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4372'. [ 483.232490][T19404] netlink: 'syz.1.4377': attribute type 1 has an invalid length. [ 483.250132][T19407] xt_hashlimit: size too large, truncated to 1048576 [ 483.355600][T19404] 8021q: adding VLAN 0 to HW filter on device bond2 [ 483.594615][T19422] IPv6: NLM_F_CREATE should be specified when creating new route [ 483.614467][T19422] syzkaller1: entered allmulticast mode [ 484.232055][T19442] geneve4: entered promiscuous mode [ 484.591646][T19463] X25: received unknown 00 with LCI 000 [ 485.568469][T19481] openvswitch: netlink: Unknown key attributes 2 [ 486.361340][T19510] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 486.555224][T19518] __nla_validate_parse: 4 callbacks suppressed [ 486.555282][T19518] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4410'. [ 486.673662][T19522] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4413'. [ 487.027217][T19533] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4418'. [ 487.027273][T19533] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4418'. [ 488.086566][T19592] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4434'. [ 488.142318][T19595] RDS: rds_bind could not find a transport for fc02::, load rds_tcp or rds_rdma? [ 488.396025][T19602] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4435'. [ 488.428492][T19595] bond3: option resend_igmp: invalid value (396094) [ 488.428536][T19595] bond3: option resend_igmp: allowed values 0 - 255 [ 488.454263][T19595] bond3 (unregistering): Released all slaves [ 488.687542][T19612] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4437'. [ 489.214191][T19635] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.214570][T19635] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.324792][T19635] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 489.342440][T19642] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4446'. [ 489.345456][T19645] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4446'. [ 489.362108][T19635] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 489.468738][T19635] mac80211_hwsim hwsim33 wlan0: left promiscuous mode [ 489.477108][T19635] mac80211_hwsim hwsim33 wlan0: left allmulticast mode [ 489.491756][T19635] bond1: left promiscuous mode [ 489.496685][T19635] dummy0: left promiscuous mode [ 489.519534][T19544] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.519603][T19544] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.521749][ T7055] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.521889][ T7055] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 489.810510][T19657] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4449'. [ 490.160585][T19668] tipc: Invalid UDP bearer configuration [ 490.160691][T19668] tipc: Enabling of bearer rejected, failed to enable media [ 490.208467][T19671] openvswitch: netlink: IP tunnel attribute has 5365 unknown bytes. [ 492.163536][T19719] __nla_validate_parse: 2 callbacks suppressed [ 492.164194][T19719] netlink: 136 bytes leftover after parsing attributes in process `syz.2.4468'. [ 492.547547][T19731] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4473'. [ 492.702792][T19741] FAULT_INJECTION: forcing a failure. [ 492.702792][T19741] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 492.702848][T19741] CPU: 1 UID: 0 PID: 19741 Comm: syz.1.4477 Not tainted syzkaller #0 PREEMPT(full) [ 492.702877][T19741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 492.702891][T19741] Call Trace: [ 492.702900][T19741] [ 492.702909][T19741] dump_stack_lvl+0xe8/0x150 [ 492.702946][T19741] should_fail_ex+0x410/0x560 [ 492.702983][T19741] _copy_from_user+0x2d/0xb0 [ 492.703007][T19741] ___sys_recvmsg+0x173/0x5a0 [ 492.703039][T19741] ? __pfx____sys_recvmsg+0x10/0x10 [ 492.703069][T19741] ? lock_acquire+0x115/0x350 [ 492.703124][T19741] do_recvmmsg+0x31a/0x7f0 [ 492.703158][T19741] ? __pfx_do_recvmmsg+0x10/0x10 [ 492.703196][T19741] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 492.703230][T19741] ? __fget_files+0x3a2/0x420 [ 492.703268][T19741] __x64_sys_recvmmsg+0x198/0x250 [ 492.703297][T19741] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 492.703335][T19741] do_syscall_64+0x166/0x520 [ 492.703364][T19741] ? trace_irq_disable+0x3b/0x140 [ 492.703384][T19741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.703406][T19741] ? clear_bhb_loop+0x70/0xc0 [ 492.703433][T19741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.703455][T19741] RIP: 0033:0x7feeeff9e159 [ 492.703474][T19741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.703493][T19741] RSP: 002b:00007feef0ef4028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 492.703517][T19741] RAX: ffffffffffffffda RBX: 00007feef0225fa0 RCX: 00007feeeff9e159 [ 492.703534][T19741] RDX: 0000000000000004 RSI: 0000200000005000 RDI: 0000000000000003 [ 492.703548][T19741] RBP: 00007feef0ef4090 R08: 0000000000000000 R09: 0000000000000000 [ 492.703563][T19741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.703576][T19741] R13: 00007feef0226038 R14: 00007feef0225fa0 R15: 00007ffd30be5ca8 [ 492.703611][T19741] [ 492.997786][T19749] vti0: entered promiscuous mode [ 493.073007][T19758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 493.088044][T19759] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 493.195185][T19758] xt_CT: No such helper "snmp_trap" [ 493.222702][T19759] xt_CT: No such helper "snmp_trap" [ 493.722958][T19787] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4491'. [ 493.723026][T19787] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4491'. [ 493.817780][T19785] syzkaller0: entered promiscuous mode [ 493.817834][T19785] syzkaller0: entered allmulticast mode [ 493.825605][T19787] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4491'. [ 493.825636][T19787] netlink: 'syz.3.4491': attribute type 1 has an invalid length. [ 493.825650][T19787] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4491'. [ 493.948178][T19798] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4495'. [ 494.136796][T19810] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4497'. [ 494.136831][T19810] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4497'. [ 495.449675][T19852] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4516'. [ 495.449729][T19852] openvswitch: netlink: Missing key (keys=c0, expected=100) [ 496.830523][T19910] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 497.574573][T19923] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.706168][T19945] __nla_validate_parse: 2 callbacks suppressed [ 497.715714][T19945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4547'. [ 497.733602][T19939] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4546'. [ 497.745258][T19942] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 497.987396][T19923] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.218647][T19923] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.448242][T19923] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.506496][T19968] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 498.535134][T19968] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4559'. [ 498.934652][ T12] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.019724][T19551] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.084068][T19551] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.160366][ T43] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.166184][T19956] syz_tun: entered allmulticast mode [ 499.197198][T19953] syz_tun: left allmulticast mode [ 499.312452][T19995] netlink: 'syz.3.4565': attribute type 1 has an invalid length. [ 499.366880][T19995] bond4: (slave geneve2): making interface the new active one [ 499.377056][T19995] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 499.390763][T19995] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4565'. [ 499.403673][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 499.403968][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 499.404004][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 499.404035][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 499.992121][T20017] pimreg: entered allmulticast mode [ 500.256764][T20026] netlink: 316 bytes leftover after parsing attributes in process `syz.0.4576'. [ 500.756646][T20045] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4581'. [ 500.778633][T20044] syzkaller1: entered allmulticast mode [ 500.784859][T20045] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4581'. [ 500.792455][T20044] tipc: Enabling of bearer rejected, failed to enable media [ 501.278194][T20057] FAULT_INJECTION: forcing a failure. [ 501.278194][T20057] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 501.278246][T20057] CPU: 0 UID: 0 PID: 20057 Comm: syz.2.4587 Not tainted syzkaller #0 PREEMPT(full) [ 501.278272][T20057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 501.278284][T20057] Call Trace: [ 501.278294][T20057] [ 501.278303][T20057] dump_stack_lvl+0xe8/0x150 [ 501.278339][T20057] should_fail_ex+0x410/0x560 [ 501.278375][T20057] _copy_to_user+0x31/0xb0 [ 501.278401][T20057] simple_read_from_buffer+0xe1/0x170 [ 501.278435][T20057] proc_fail_nth_read+0x1bb/0x230 [ 501.278465][T20057] ? common_file_perm+0x20e/0x2b0 [ 501.278491][T20057] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 501.278524][T20057] ? rw_verify_area+0x24a/0x4c0 [ 501.278560][T20057] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 501.278589][T20057] vfs_read+0x213/0xa80 [ 501.278645][T20057] ? __pfx___mutex_lock+0x10/0x10 [ 501.278678][T20057] ? __pfx_vfs_read+0x10/0x10 [ 501.278708][T20057] ? __fget_files+0x2a/0x420 [ 501.278737][T20057] ? __fget_files+0x3a2/0x420 [ 501.278762][T20057] ? __fget_files+0x2a/0x420 [ 501.278797][T20057] ksys_read+0x150/0x270 [ 501.278828][T20057] ? __pfx_ksys_read+0x10/0x10 [ 501.278868][T20057] do_syscall_64+0x166/0x520 [ 501.278896][T20057] ? trace_irq_disable+0x3b/0x140 [ 501.278918][T20057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.278939][T20057] ? clear_bhb_loop+0x70/0xc0 [ 501.278965][T20057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.278986][T20057] RIP: 0033:0x7fb08255e98e [ 501.279007][T20057] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 501.279025][T20057] RSP: 002b:00007fb0807f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 501.279048][T20057] RAX: ffffffffffffffda RBX: 00007fb0807f66c0 RCX: 00007fb08255e98e [ 501.279064][T20057] RDX: 000000000000000f RSI: 00007fb0807f60a0 RDI: 0000000000000004 [ 501.279077][T20057] RBP: 00007fb0807f6090 R08: 0000000000000000 R09: 0000000000000000 [ 501.279091][T20057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 501.279104][T20057] R13: 00007fb082826038 R14: 00007fb082825fa0 R15: 00007ffc397d74d8 [ 501.279148][T20057] [ 501.298682][T20059] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4588'. [ 501.405431][T20059] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4588'. [ 501.476832][ T1253] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.446765][T20086] syzkaller0: entered promiscuous mode [ 502.446814][T20086] syzkaller0: entered allmulticast mode [ 502.656673][T20101] netlink: 276 bytes leftover after parsing attributes in process `syz.3.4603'. [ 503.009945][T20113] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4604'. [ 503.062523][T20118] netlink: 'syz.3.4605': attribute type 1 has an invalid length. [ 503.062563][T20118] netlink: 756 bytes leftover after parsing attributes in process `syz.3.4605'. [ 503.450980][T20120] bridge0: port 4(vlan2) entered disabled state [ 503.503325][T20120] bridge_slave_1: left allmulticast mode [ 503.505360][T20120] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.550342][T20120] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.840509][T20139] lo: left promiscuous mode [ 503.840740][T20139] tunl0: left promiscuous mode [ 503.840971][T20139] gre0: left promiscuous mode [ 503.841113][T20139] gretap0: left promiscuous mode [ 503.841244][T20139] erspan0: left promiscuous mode [ 503.841378][T20139] ip_vti0: left promiscuous mode [ 503.841574][T20139] ip6_vti0: left promiscuous mode [ 503.841722][T20139] sit0: left promiscuous mode [ 503.841855][T20139] ip6tnl0: left promiscuous mode [ 503.841986][T20139] ip6gre0: left promiscuous mode [ 503.900431][T20139] syz_tun: left promiscuous mode [ 503.900677][T20139] ip6gretap0: left promiscuous mode [ 503.911378][T20139] bridge0: left promiscuous mode [ 503.939937][T20139] gretap1: left allmulticast mode [ 503.941879][T20145] netlink: 276 bytes leftover after parsing attributes in process `syz.4.4615'. [ 504.019720][T19547] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 504.019801][T19547] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 504.019835][T19547] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 504.019867][T19547] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 504.538422][T20171] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4624'. [ 504.642692][T20171] 8021q: adding VLAN 0 to HW filter on device bond3 [ 504.665634][T20174] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 504.675307][T20174] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 504.721320][T20177] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4622'. [ 504.804108][T20180] netlink: 276 bytes leftover after parsing attributes in process `syz.3.4627'. [ 507.081021][T20178] syzkaller0: entered promiscuous mode [ 507.081068][T20178] syzkaller0: entered allmulticast mode [ 507.605794][T20223] pim6reg: entered allmulticast mode [ 507.615015][T20227] netlink: 276 bytes leftover after parsing attributes in process `syz.2.4638'. [ 507.622030][T20223] pim6reg: left allmulticast mode [ 507.622653][T20224] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4631'. [ 507.940876][T20234] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4639'. [ 508.448507][T20250] netlink: 'syz.1.4646': attribute type 40 has an invalid length. [ 508.841341][T20260] netlink: 276 bytes leftover after parsing attributes in process `syz.0.4649'. [ 509.500592][T20288] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4662'. [ 509.545151][T20289] Cannot find del_set index 17 as target [ 509.714404][T20289] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 510.089537][T20311] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4670'. [ 510.089965][T20314] syzkaller0: entered promiscuous mode [ 510.089984][T20314] syzkaller0: entered allmulticast mode [ 510.202199][T20321] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4672'. [ 510.280105][T20324] netlink: 276 bytes leftover after parsing attributes in process `syz.4.4674'. [ 510.329159][T20326] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 510.431898][T20330] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4677'. [ 510.793545][T20344] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4683'. [ 510.956214][T20350] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4683'. [ 511.166091][T20357] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4688'. [ 511.278819][T20360] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4689'. [ 512.006952][T20382] bond0: (slave bond_slave_1): Releasing backup interface [ 513.156577][T20420] syzkaller0: entered promiscuous mode [ 513.156619][T20420] syzkaller0: entered allmulticast mode [ 513.519071][T20433] dvmrp0: entered allmulticast mode [ 513.565417][T20433] dvmrp1: entered allmulticast mode [ 513.587840][T20433] dvmrp0: left allmulticast mode [ 513.587975][T20433] dvmrp1: left allmulticast mode [ 514.584377][T20468] __nla_validate_parse: 7 callbacks suppressed [ 514.590928][T20468] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4728'. [ 515.285958][T20499] netlink: 276 bytes leftover after parsing attributes in process `syz.4.4741'. [ 515.829047][T20520] xt_limit: Overflow, try lower: 6/2147483648 [ 516.378710][T20551] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 516.747553][T20570] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4766'. [ 516.795705][T20573] syzkaller0: entered promiscuous mode [ 516.795754][T20573] syzkaller0: entered allmulticast mode [ 516.811511][T20574] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4766'. [ 517.544856][T20583] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4770'. [ 519.029702][T20533] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 519.322528][T20603] openvswitch: netlink: Unknown key attributes 2 [ 519.547579][T20612] netlink: 276 bytes leftover after parsing attributes in process `syz.2.4781'. [ 520.419929][T20648] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4796'. [ 520.420170][T20647] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4796'. [ 520.440934][T20648] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 520.463830][T20650] netlink: 'syz.4.4795': attribute type 10 has an invalid length. [ 520.475981][T20652] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4797'. [ 520.477170][T20653] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4796'. [ 520.548510][T20650] team0: Port device dummy0 added [ 520.587134][T20653] vlan0: entered promiscuous mode [ 520.587181][T20653] gretap0: entered promiscuous mode [ 520.605295][T20658] netlink: 108 bytes leftover after parsing attributes in process `syz.3.4799'. [ 520.657771][T20658] netlink: 'syz.3.4799': attribute type 3 has an invalid length. [ 520.657832][T20658] netlink: 646 bytes leftover after parsing attributes in process `syz.3.4799'. [ 520.739870][T20660] trusted_key: syz.4.4800 sent an empty control message without MSG_MORE. [ 521.091332][T20683] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4808'. [ 521.743946][T20715] netlink: 276 bytes leftover after parsing attributes in process `syz.3.4821'. [ 522.663466][T20751] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4832'. [ 522.773402][T20722] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 522.782940][T20757] netlink: 'syz.1.4834': attribute type 1 has an invalid length. [ 522.816728][T20748] ipt_REJECT: ECHOREPLY no longer supported. [ 522.944969][T20764] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 523.030367][T20757] veth0_to_bond: left promiscuous mode [ 523.063724][T20757] bond4: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 523.066647][T20764] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4836'. [ 523.120542][T20757] macvlan2: entered promiscuous mode [ 523.126107][T20757] macvlan2: entered allmulticast mode [ 523.132539][T20757] bond4: entered promiscuous mode [ 523.140731][T20757] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 523.148573][T20757] bond4: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 523.170192][T20757] bond4: left promiscuous mode [ 524.191450][T20777] veth5: entered allmulticast mode [ 525.347477][T20838] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 525.362215][T20840] x_tables: duplicate underflow at hook 1 [ 525.677165][T20847] __nla_validate_parse: 5 callbacks suppressed [ 525.677213][T20847] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4867'. [ 525.773885][T20853] netlink: 276 bytes leftover after parsing attributes in process `syz.4.4869'. [ 525.908954][T20855] syzkaller0: entered promiscuous mode [ 525.908999][T20855] syzkaller0: entered allmulticast mode [ 526.954153][T20888] netlink: 276 bytes leftover after parsing attributes in process `syz.4.4881'. [ 528.284834][T20929] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 528.621291][T20936] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 528.690331][T20939] netlink: 276 bytes leftover after parsing attributes in process `syz.3.4895'. [ 528.800174][T20942] netlink: 156 bytes leftover after parsing attributes in process `syz.3.4896'. [ 529.802243][T20972] netlink: 276 bytes leftover after parsing attributes in process `syz.4.4906'. [ 529.970919][T20976] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.018318][T20976] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4908'. [ 530.620921][T20999] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4918'. [ 530.750690][T21008] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4922'. [ 530.835257][T21012] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4922'. [ 530.858276][T21011] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 531.164951][T21034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4927'. [ 531.169802][T21034] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 531.185261][T21034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4927'. [ 531.989115][T21051] lo speed is unknown, defaulting to 1000 [ 532.461791][T21051] xfrm0 speed is unknown, defaulting to 1000 [ 532.843542][T21081] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 532.963961][T21085] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4942'. [ 533.024619][T21088] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4942'. [ 534.037090][T21025] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 534.514651][T21116] netlink: 'syz.1.4952': attribute type 4 has an invalid length. [ 534.556106][T21116] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4952'. [ 534.556155][T21116] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4952'. [ 534.558838][T21116] netlink: 'syz.1.4952': attribute type 4 has an invalid length. [ 534.732846][T21125] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4953'. [ 534.803999][T21125] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4953'. [ 535.894842][T21164] syzkaller0: entered promiscuous mode [ 535.894888][T21164] syzkaller0: entered allmulticast mode [ 536.211488][T21185] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4974'. [ 536.374142][T21190] syzkaller0: entered promiscuous mode [ 536.380798][T21190] syzkaller0: entered allmulticast mode [ 536.395965][T21193] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 538.747595][T21165] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 539.271104][T21224] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4987'. [ 539.849988][T21236] tipc: Enabled bearer , priority 0 [ 539.939072][T21236] syzkaller0: entered promiscuous mode [ 539.939104][T21236] syzkaller0: entered allmulticast mode [ 539.940094][T21236] tipc: Resetting bearer [ 539.981497][T21239] syzkaller0: entered promiscuous mode [ 539.981547][T21239] syzkaller0: entered allmulticast mode [ 540.040129][T21247] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4997'. [ 540.157123][T21234] tipc: Resetting bearer [ 540.885736][T21278] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5008'. [ 541.020293][T21280] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5009'. [ 541.114889][T21285] netlink: 'syz.0.5011': attribute type 1 has an invalid length. [ 541.643158][T21303] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5018'. [ 541.643205][T21303] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5018'. [ 541.698008][T21304] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5018'. [ 541.705110][T21304] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5018'. [ 541.969227][T21308] SET target dimension over the limit! [ 543.280494][T21234] tipc: Disabling bearer [ 543.289856][ T5737] tipc: Node number set to 2581526757 [ 543.444146][T21285] 8021q: adding VLAN 0 to HW filter on device bond4 [ 543.495705][T21289] vlan4: entered promiscuous mode [ 543.495758][T21289] bond4: entered promiscuous mode [ 543.496264][T21289] vlan4: entered allmulticast mode [ 543.496281][T21289] bond4: entered allmulticast mode [ 543.524172][T21292] bond4: (slave bridge2): making interface the new active one [ 543.532324][T21292] bridge2: entered promiscuous mode [ 543.537962][T21292] bridge2: entered allmulticast mode [ 543.546978][T21292] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 543.707901][T19551] vlan3: left promiscuous mode [ 543.708393][T19551] bridge0: port 4(vlan3) entered disabled state [ 543.727399][T19551] vlan2: left promiscuous mode [ 543.727453][T19551] bridge_slave_0: left promiscuous mode [ 543.745189][T19551] bridge0: port 3(vlan2) entered disabled state [ 543.792828][T19551] pim6reg: left allmulticast mode [ 543.818814][T19551] mac80211_hwsim hwsim3 wlan1: left allmulticast mode [ 543.818882][T19551] mac80211_hwsim hwsim3 wlan1: left promiscuous mode [ 543.819074][T19551] bridge0: port 4(wlan1) entered disabled state [ 543.843670][T19551] vlan2: left allmulticast mode [ 543.843717][T19551] vlan2: left promiscuous mode [ 543.855969][T19551] bridge0: port 3(vlan2) entered disabled state [ 543.877029][T19551] bridge_slave_1: left allmulticast mode [ 543.877086][T19551] bridge_slave_1: left promiscuous mode [ 543.877501][T19551] bridge0: port 2(bridge_slave_1) entered disabled state [ 543.898938][T19551] bridge_slave_0: left allmulticast mode [ 543.898989][T19551] bridge_slave_0: left promiscuous mode [ 543.899183][T19551] bridge0: port 1(bridge_slave_0) entered disabled state [ 543.958836][T19551] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 543.958968][T19551] batman_adv: batadv0: Interface deactivated: gretap2 [ 544.168376][T19551] batman_adv: batadv0: Removing interface: ip6gretap0 [ 544.272009][T19551] batman_adv: batadv0: Removing interface: ip6gretap1 [ 544.522808][T19551] batman_adv: batadv0: Removing interface: gretap2 [ 544.574474][T19551] team0: Port device gtp1 removed [ 544.658181][T19551] bond0 (unregistering): Released all slaves [ 544.687325][T19551] bond1 (unregistering): (slave veth3): Releasing active interface [ 544.687372][T19551] batadv1: entered promiscuous mode [ 544.716168][T19551] bond1 (unregistering): (slave batadv1): Releasing active interface [ 544.716224][T19551] batadv1: left promiscuous mode [ 544.743502][T19551] bond1 (unregistering): Released all slaves [ 544.761544][ T1288] smbdirect: ib_dev[syz1] removed [ 544.796289][T19551] bond2 (unregistering): (slave veth7): Releasing active interface [ 544.815799][T19551] bond2 (unregistering): Released all slaves [ 544.841830][T19551] bond4 (unregistering): Released all slaves [ 545.244922][T19551] bond0 (unregistering): Released all slaves [ 545.262797][T19551] bond1 (unregistering): Released all slaves [ 545.436341][T19551] tipc: Left network mode [ 545.448652][ T43] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.450078][ T43] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.569761][ T977] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 545.599249][T19551] tipc: Left network mode [ 545.604745][T19544] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 546.127332][T21359] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5036'. [ 546.127378][T21359] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5036'. [ 546.127411][T21359] netlink: 'syz.3.5036': attribute type 6 has an invalid length. [ 546.127430][T21359] netlink: 'syz.3.5036': attribute type 5 has an invalid length. [ 546.127456][T21359] netlink: 43 bytes leftover after parsing attributes in process `syz.3.5036'. [ 546.553012][T21370] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5039'. [ 546.651416][T21366] syzkaller0: entered promiscuous mode [ 546.651461][T21366] syzkaller0: entered allmulticast mode [ 547.016631][T21394] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5046'. [ 547.897844][T21433] tipc: Enabling of bearer rejected, failed to enable media [ 547.973618][T21437] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5064'. [ 548.071713][T21441] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5066'. [ 548.129068][T21441] bridge0: port 1(ipvlan2) entered blocking state [ 548.129217][T21441] bridge0: port 1(ipvlan2) entered disabled state [ 548.142070][T21441] ipvlan2: entered allmulticast mode [ 548.142094][T21441] bridge0: entered allmulticast mode [ 548.213066][T21441] ipvlan2: left allmulticast mode [ 548.213107][T21441] bridge0: left allmulticast mode [ 548.654454][T21455] sctp: [Deprecated]: syz.4.5072 (pid 21455) Use of struct sctp_assoc_value in delayed_ack socket option. [ 548.654454][T21455] Use struct sctp_sack_info instead [ 549.719863][T21493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5087'. [ 550.347132][T21507] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 550.379204][T21507] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5091'. [ 550.453326][T19551] hsr_slave_0: left promiscuous mode [ 550.513750][T19551] hsr_slave_0: left promiscuous mode [ 550.525127][T19551] hsr_slave_1: left promiscuous mode [ 550.534411][T19551] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 550.554742][T19551] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 551.018925][ T43] IPVS: starting estimator thread 0... ** replaying previous printk message ** [ 551.081359][T21531] ------------[ cut here ]------------ [ 551.081398][T21531] verifier bug: backtracking misuse [ 551.081424][T21531] WARNING: kernel/bpf/backtrack.c:819 at bpf_mark_chain_precision+0x5c90/0x7c20, CPU#1: syz.0.5096/21531 [ 551.107547][T21531] Modules linked in: [ 551.111583][T21531] CPU: 1 UID: 0 PID: 21531 Comm: syz.0.5096 Not tainted syzkaller #0 PREEMPT(full) [ 551.119518][T21528] IPVS: using max 28 ests per chain, 67200 per kthread [ 551.127969][T21531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 551.138317][T21531] RIP: 0010:bpf_mark_chain_precision+0x5c90/0x7c20 [ 551.144953][T21531] Code: ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 16 ff ff ff 48 89 df e8 c1 7b 44 00 e9 09 ff ff ff e8 77 b2 d4 ff 48 8d 3d e0 0a 8b 0e <67> 48 0f b9 3a 48 8b 3c 24 48 81 c7 88 08 00 00 48 c7 c6 60 df 16 [ 551.165099][T21531] RSP: 0018:ffffc90005f6f220 EFLAGS: 00010287 [ 551.171452][T21531] RAX: ffffffff81f308a9 RBX: 0000000000000001 RCX: 0000000000080000 [ 551.179529][T21531] RDX: ffffc9001c201000 RSI: 00000000000048f9 RDI: ffffffff907e1390 [ 551.187567][T21531] RBP: 0000000000000003 R08: ffff88807ee98000 R09: 0000000000000003 [ 551.195808][T21531] R10: 0000000000000007 R11: 0000000000000002 R12: ffff88805e4f3050 [ 551.203908][T21531] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 551.212001][T21531] FS: 00007fb01b4306c0(0000) GS:ffff888124dd9000(0000) knlGS:0000000000000000 [ 551.221078][T21531] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 551.227694][T21531] CR2: 00007f60dfeba440 CR3: 0000000072156000 CR4: 00000000003526f0 [ 551.236361][T21531] Call Trace: [ 551.239788][T21531] [ 551.242780][T21531] ? update_loop_inline_state+0x22a/0x610 [ 551.248544][T21531] do_check_insn+0x12c6d/0x17d70 [ 551.253616][T21531] ? __pfx_do_check_insn+0x10/0x10 [ 551.259027][T21531] ? verbose+0x11d/0x1a0 [ 551.263560][T21531] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 551.269579][T21531] ? __pfx_verbose+0x10/0x10 [ 551.274213][T21531] ? bpf_vlog_reset+0x2aa/0x340 [ 551.279117][T21531] ? print_insn_state+0x106/0x170 [ 551.284267][T21531] do_check_common+0x3c19/0x5d30 [ 551.289276][T21531] ? __pfx_do_check_common+0x10/0x10 [ 551.294706][T21531] ? __pfx_verbose+0x10/0x10 [ 551.299342][T21531] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 551.305325][T21531] bpf_check+0x2639/0x2e10 [ 551.309990][T21531] ? ktime_get_with_offset+0x93/0x2d0 [ 551.315417][T21531] ? __pfx_bpf_check+0x10/0x10 [ 551.320358][T21531] ? bpf_obj_name_cpy+0x194/0x1e0 [ 551.325434][T21531] bpf_prog_load+0x14d6/0x1c20 [ 551.330496][T21531] ? __pfx_bpf_prog_load+0x10/0x10 [ 551.335671][T21531] ? do_raw_spin_lock+0x100/0x2f0 [ 551.340809][T21531] __sys_bpf+0xd0d/0xd90 [ 551.345108][T21531] ? do_raw_spin_lock+0x100/0x2f0 [ 551.350258][T21531] ? __pfx___sys_bpf+0x10/0x10 [ 551.355068][T21531] ? do_futex+0x3e7/0x4e0 [ 551.359566][T21531] ? do_raw_spin_lock+0x100/0x2f0 [ 551.364894][T21531] ? rcu_is_watching+0x16/0xb0 [ 551.370037][T21531] __x64_sys_bpf+0xba/0xd0 [ 551.374506][T21531] do_syscall_64+0x166/0x520 [ 551.379142][T21531] ? trace_irq_disable+0x3b/0x140 [ 551.384314][T21531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.390722][T21531] ? clear_bhb_loop+0x70/0xc0 [ 551.395446][T21531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.401523][T21531] RIP: 0033:0x7fb01a59e159 [ 551.405996][T21531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.425831][T21531] RSP: 002b:00007fb01b430028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 551.434360][T21531] RAX: ffffffffffffffda RBX: 00007fb01a825fa0 RCX: 00007fb01a59e159 [ 551.442488][T21531] RDX: 0000000000000080 RSI: 0000200000000300 RDI: 0000000000000005 [ 551.450581][T21531] RBP: 00007fb01a635024 R08: 0000000000000000 R09: 0000000000000000 [ 551.458596][T21531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 551.466965][T21531] R13: 00007fb01a826038 R14: 00007fb01a825fa0 R15: 00007ffe3885cd48 [ 551.475237][T21531] [ 551.478296][T21531] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 551.485617][T21531] CPU: 1 UID: 0 PID: 21531 Comm: syz.0.5096 Not tainted syzkaller #0 PREEMPT(full) [ 551.495017][T21531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 551.505099][T21531] Call Trace: [ 551.508413][T21531] [ 551.511369][T21531] vpanic+0x56d/0xa60 [ 551.515434][T21531] ? __pfx__printk+0x10/0x10 [ 551.520062][T21531] ? __pfx_vpanic+0x10/0x10 [ 551.524603][T21531] ? is_bpf_text_address+0x292/0x2b0 [ 551.529925][T21531] ? is_bpf_text_address+0x26/0x2b0 [ 551.535170][T21531] panic+0xc5/0xd0 [ 551.538935][T21531] ? __pfx_panic+0x10/0x10 [ 551.543417][T21531] __warn+0x315/0x4c0 [ 551.547447][T21531] ? bpf_mark_chain_precision+0x5c90/0x7c20 [ 551.553390][T21531] ? bpf_mark_chain_precision+0x5c90/0x7c20 [ 551.559318][T21531] __report_bug+0x276/0x570 [ 551.563985][T21531] ? bpf_mark_chain_precision+0x5c90/0x7c20 [ 551.569917][T21531] ? __pfx___report_bug+0x10/0x10 [ 551.574998][T21531] ? bpf_mark_chain_precision+0x5c95/0x7c20 [ 551.580940][T21531] report_bug_entry+0x19b/0x290 [ 551.585829][T21531] ? bpf_mark_chain_precision+0x5c90/0x7c20 [ 551.591741][T21531] ? bpf_mark_chain_precision+0x5c95/0x7c20 [ 551.597663][T21531] handle_bug+0xce/0x200 [ 551.601931][T21531] exc_invalid_op+0x1a/0x50 [ 551.606467][T21531] asm_exc_invalid_op+0x1a/0x20 [ 551.611344][T21531] RIP: 0010:bpf_mark_chain_precision+0x5c90/0x7c20 [ 551.617874][T21531] Code: ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 16 ff ff ff 48 89 df e8 c1 7b 44 00 e9 09 ff ff ff e8 77 b2 d4 ff 48 8d 3d e0 0a 8b 0e <67> 48 0f b9 3a 48 8b 3c 24 48 81 c7 88 08 00 00 48 c7 c6 60 df 16 [ 551.637502][T21531] RSP: 0018:ffffc90005f6f220 EFLAGS: 00010287 [ 551.643599][T21531] RAX: ffffffff81f308a9 RBX: 0000000000000001 RCX: 0000000000080000 [ 551.651595][T21531] RDX: ffffc9001c201000 RSI: 00000000000048f9 RDI: ffffffff907e1390 [ 551.659592][T21531] RBP: 0000000000000003 R08: ffff88807ee98000 R09: 0000000000000003 [ 551.667593][T21531] R10: 0000000000000007 R11: 0000000000000002 R12: ffff88805e4f3050 [ 551.675587][T21531] R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000 [ 551.683584][T21531] ? bpf_mark_chain_precision+0x5c89/0x7c20 [ 551.689546][T21531] ? update_loop_inline_state+0x22a/0x610 [ 551.695302][T21531] do_check_insn+0x12c6d/0x17d70 [ 551.700300][T21531] ? __pfx_do_check_insn+0x10/0x10 [ 551.705458][T21531] ? verbose+0x11d/0x1a0 [ 551.709734][T21531] ? __pfx_bpf_verifier_log_write+0x10/0x10 [ 551.715662][T21531] ? __pfx_verbose+0x10/0x10 [ 551.720270][T21531] ? bpf_vlog_reset+0x2aa/0x340 [ 551.725139][T21531] ? print_insn_state+0x106/0x170 [ 551.730175][T21531] do_check_common+0x3c19/0x5d30 [ 551.735178][T21531] ? __pfx_do_check_common+0x10/0x10 [ 551.740497][T21531] ? __pfx_verbose+0x10/0x10 [ 551.745127][T21531] ? __pfx_bpf_disasm_kfunc_name+0x10/0x10 [ 551.750980][T21531] bpf_check+0x2639/0x2e10 [ 551.755436][T21531] ? ktime_get_with_offset+0x93/0x2d0 [ 551.760823][T21531] ? __pfx_bpf_check+0x10/0x10 [ 551.765603][T21531] ? bpf_obj_name_cpy+0x194/0x1e0 [ 551.770662][T21531] bpf_prog_load+0x14d6/0x1c20 [ 551.775464][T21531] ? __pfx_bpf_prog_load+0x10/0x10 [ 551.781234][T21531] ? do_raw_spin_lock+0x100/0x2f0 [ 551.786295][T21531] __sys_bpf+0xd0d/0xd90 [ 551.790553][T21531] ? do_raw_spin_lock+0x100/0x2f0 [ 551.795596][T21531] ? __pfx___sys_bpf+0x10/0x10 [ 551.800392][T21531] ? do_futex+0x3e7/0x4e0 [ 551.804742][T21531] ? do_raw_spin_lock+0x100/0x2f0 [ 551.809824][T21531] ? rcu_is_watching+0x16/0xb0 [ 551.814611][T21531] __x64_sys_bpf+0xba/0xd0 [ 551.819036][T21531] do_syscall_64+0x166/0x520 [ 551.823641][T21531] ? trace_irq_disable+0x3b/0x140 [ 551.828669][T21531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.834741][T21531] ? clear_bhb_loop+0x70/0xc0 [ 551.839437][T21531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.845337][T21531] RIP: 0033:0x7fb01a59e159 [ 551.849771][T21531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.869389][T21531] RSP: 002b:00007fb01b430028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 551.877814][T21531] RAX: ffffffffffffffda RBX: 00007fb01a825fa0 RCX: 00007fb01a59e159 [ 551.885809][T21531] RDX: 0000000000000080 RSI: 0000200000000300 RDI: 0000000000000005 [ 551.893801][T21531] RBP: 00007fb01a635024 R08: 0000000000000000 R09: 0000000000000000 [ 551.901780][T21531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 551.909761][T21531] R13: 00007fb01a826038 R14: 00007fb01a825fa0 R15: 00007ffe3885cd48 [ 551.917756][T21531] [ 551.920981][T21531] Kernel Offset: disabled [ 551.925302][T21531] Rebooting in 86400 seconds..