last executing test programs: 3.714532186s ago: executing program 3 (id=7146): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) 3.597368173s ago: executing program 0 (id=7147): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0xfffe, 0x41aa, 0x6, 0x0, 0x8, 0x90, 0x8}, 0xc) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfff8}, 0xe) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x300) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r2) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r4, 0x800452d3, &(0x7f0000000100)) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000080)={r5, 0x808000}, 0x8) getsockopt$bt_hci(r2, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) 3.499830186s ago: executing program 3 (id=7148): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e6400"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0000001000030500000000000700", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 3.332665214s ago: executing program 4 (id=7151): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="48e4000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000900090073"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) 3.200739445s ago: executing program 4 (id=7153): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=@deltfilter={0x24, 0x2d, 0x400, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0x6}, {0x2, 0x3}, {0xb, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x100, 0x0, 0x25dfdbfb, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast2, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x2, 0x0, 0x2000000000000, 0x40, 0xfffffffffffffdfd, 0x50}, {0x5}, 0x6, 0x40000000, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$inet6(0xa, 0x805, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000080)={0xa09d, 0x0, 0x200, 0x3}, 0x10) getsockopt$bt_hci(r3, 0x84, 0x2, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0xb8}, 0x1, 0x0, 0x0, 0x88c0}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x300, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x80}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300f95aa4526b4c42d202efb048bb829241d17ff9a3e7d5aa022be3a40b1062f7834b64db5ad5062804d407f5f7cdadbe5d51d211a2463b18bada8e76b70217ee2ed82327457344e5d98198ec282189be373c34", @ANYRES32=0x0, @ANYBLOB="0000f33309000000008000450e00000a00010076786c616e00"], 0x50}}, 0x4008840) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e80), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000001600)={'wpan0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r9) sendmsg$IPVS_CMD_NEW_DAEMON(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, r10, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}]}]}, 0x34}}, 0x0) sendmsg$IPVS_CMD_DEL_DEST(r7, &(0x7f0000000a00)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000009c0)={&(0x7f0000000840)={0x144, r10, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8000}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7e2d}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={'\x00', '\xff\xff', @remote}}]}, @IPVS_CMD_ATTR_DAEMON={0x70, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010101}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x27}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x50, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x60}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private0}]}]}, 0x144}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newtfilter={0x24, 0x11, 0x1, 0x691522eb, 0x0, {0x0, 0x0, 0x74, r8, {0x10, 0x4}, {}, {0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x80}, 0x0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r4, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010065bd7000ffdbdf252100000008000300", @ANYRES32=r6, @ANYBLOB="24002d8005000100030000000500040000000000080002"], 0x40}, 0x1, 0x0, 0x0, 0x24880}, 0x4000880) r12 = syz_genetlink_get_family_id$nfc(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NFC_CMD_START_POLL(r4, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r12, 0x200, 0x70bd2b, 0x25dfdbfc, {}, [@NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x80}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) 2.939685847s ago: executing program 3 (id=7155): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000900090073"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) (fail_nth: 15) 2.296395644s ago: executing program 1 (id=7158): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x10) 2.295982313s ago: executing program 2 (id=7159): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x10, 0x11, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0xfffe}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPR={0x14, 0x7, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xe4}}, 0x0) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NFT_BATCH(r0, &(0x7f0000000a80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000940)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELTABLE={0x64, 0x2, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_USERDATA={0x44, 0x6, "06edc4228a9557572646da727062added621b55f419a978fa6d79c33a3f46f52e6226154e7da6bf387148aa9e4012ded62230dc74079089d0d73a7cd29b3f94e"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x44, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xd0}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000001c0), 0xffffffffffffffff) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000200)={@local, @multicast2, 0x0}, &(0x7f0000000240)=0xc) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x40, r2, 0x204, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7fffffff}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r3}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000900)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000008c0)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELFLOWTABLE={0x18c, 0x18, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_FLOWTABLE_HOOK={0x158, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pimreg\x00'}, {0x14, 0x1, 'veth0_to_hsr\x00'}, {0x14, 0x1, 'bond_slave_0\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'veth0_to_hsr\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}, {0x14, 0x1, 'veth0_to_team\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x54, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bridge0\x00'}, {0x14, 0x1, 'ip6erspan0\x00'}, {0x14, 0x1, 'veth1\x00'}, {0x14, 0x1, 'syz_tun\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team_slave_0\x00'}, {0x14, 0x1, 'netdevsim0\x00'}, {0x14, 0x1, 'dummy0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xe08}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bridge\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x4}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0xa}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, @NFT_OBJECT_COUNTER=@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x2}}, @NFT_MSG_DELFLOWTABLE={0x16c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x130, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'nr0\x00'}, {0x14, 0x1, 'ip6_vti0\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'caif0\x00'}, {0x14, 0x1, 'macsec0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'netpci0\x00'}, {0x14, 0x1, 'lo\x00'}, {0x14, 0x1, 'bridge_slave_0\x00'}, {0x14, 0x1, 'sit0\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'ip_vti0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELRULE={0x58, 0x8, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSET={0x74, 0xb, 0xa, 0xd00, 0x0, 0x0, {0x6, 0x0, 0x4}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0xfff}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_TIMEOUT={0xc, 0xb, 0x1, 0x0, 0x1}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x7}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x15}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x3}, @NFTA_SET_GC_INTERVAL={0x8, 0xc, 0x1, 0x0, 0x4}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x42c}, 0x1, 0x0, 0x0, 0x20000001}, 0x40084) 2.200891422s ago: executing program 3 (id=7160): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="0a000300010000", 0x7) 2.170503025s ago: executing program 0 (id=7161): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c0000811c00357428bd7000fed3df2502000000", @ANYRES32=r1, @ANYBLOB="1000a204080001"], 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x200080c0) 2.080799993s ago: executing program 4 (id=7162): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000d40)=ANY=[@ANYBLOB="61128c00000000006113850000000000bf20000000000000070000000f0000002d030100000000009500ffb1000000006926000000000000bf67000000000000150002000fff5d004507000007000000d60600000ee60000bf1600000000000040700000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c043a7bc4b29d2dc480dd7a0d981422b32d93bad720100010000000000b39d0af449deaa27ea949e8f9000d885dfea27834aa7eb8d33ac04060630e78a30fc835e29eb532ba8546fc020c196738b5f32b09f95f5d5b196b9ffc02f952ac53e817671d1000000008ba8583aa4c77097f1c75df9bdd8288fd2f8743924cd6dd4ed457183edc74ca79c79a3da0cea39dbacd0e4b608cece26817f0f53dde0d43388e8f92d0bfdd4b427ee5b708aa2685c735f840e055a163e38a276b7fd16492587edaec8bc43f312c7ddfa59a53c9e772832f527c0ae9afcf582413f6f8c442ce39039a64965facb4340f2249cc60a8dec5b8a9ac6d60e36f57dbe1664decf85b7cae19a1d0d7bce02902284aa9041366eed09c3baafb2a4c14a373f8ffdfe107d401b7b93866f8aadff4df0f226f411d43d579541275f0bacd2dc24faf2d4d992d9f8031a422f2a30cf35e9d00644acc1ff674781281c6b93447312cc93c738b6a83a2e83225af295e0776d033557913ac9096ee1e119a06a38fcd918a18f4c01f60692a1684c55086bec71e819f8b345a5f80d3e5bc7e6854e2ea7a035b975b96e9459382fafc5f6fd106fbbd3b014b5a546f523afd9c9bed9212d7bb745123259e8f46b413e633db1668ad038725e3e01bd6707aee08b267dcd54b961c4d56b608d903ae06cc23eb1d79b3384512f2c424739aba4297063005376b6b900f3416835151fb61f08dfb4ad3732fc0f5a05339608b003a80cce6b032f13b5f2890ec29130022ff6fa874ce885e91c8e4df772286210e5aca1a64dfb12f0a2c1e992aae6afb3514afd648230650e532e8ec540a25b65657a7259922602ffdd3375a4b0f864db09907c7b8e97abb824c1f3167cff71e96682f37f37b156833d729d7369af37345fb97f3ac3e9c01328a3d7f36ae6d48c94bcf630fe6e94c5a080fe3ccde9ff72f98bd0454203a5cbe34ab7df76e54ec26942835ca6b9e0db2b24d19de496bf22d5cac91b6deb25b5622ddd7bddad97d4850735df6fff37098b06d660e5d73efdce87be427bc79e67ad31d7768d65f811ed84f29db15b8456dc951dcb8be1da330fd0c1371dbbfcedaff57e29b95b4277b46aa41eab05a756d8556d4c14b570770bc0a3c9cdd688e3e583ee2284fc32c6eed47d70c6c22c8226ae8d4144fac10d2ca22673cbe55ee11b68bf18f4811cf943b9a7f30f07be34ae41ae192b1222ccc12000966d63ee0f75e73c0ae0cd660cc27583f3a7c81f652948c92569f0ca58d4c42e91000000000000000000000000d8e5c9a920c1418f62bf914bcac98ad06c42b86346d4cc4658abfdf3475a579337d1cf5529a14b64f14c478c0e390628c4702c3daf07d681e412c91484a6bc790ecdb597a461d9ac4d69a005f3fdf015d622c027c0e0181631a9f6d56361187e2076a14caf88c82a37248ff7b26d20a1ff7c1f1a31fe22ed64360c29124bf041f978042f5a23624447ee4d1612268c80e5c3b88a2a22264ad8012750997733121fcbaa2a094ef8ab27579d4daa10d9b42b9f75ef42df0c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)=@generic={&(0x7f0000000000)='./file0\x00', r0}, 0x18) 2.032976956s ago: executing program 0 (id=7163): sendmsg$sock(0xffffffffffffffff, 0x0, 0xc0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_wait_time_recursive\x00', 0x26e1, 0x0) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040), &(0x7f0000000080)=0x4) close(r0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) 2.032177152s ago: executing program 1 (id=7164): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)="89000000120081ae08060cdc030000007f03e3f7fe0000006ee2ffca1b1f3317000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f8", 0x67}], 0x1}, 0x4004010) 1.941099633s ago: executing program 3 (id=7165): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e6400"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c0000001000030500000000000700", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 1.904023309s ago: executing program 2 (id=7166): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010098000000000000000c0000000c000010ce5d61096a568a890000000604"], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="1800001900000000020000000000000f18400000020000000000000000000000950000000000000095"], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x14, &(0x7f0000000600), 0x10}, 0xc6) 1.845476881s ago: executing program 4 (id=7167): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)={0x14, 0x3a, 0x229, 0x3f, 0x25dfdbfa, {0x2}}, 0x14}}, 0x8000) 1.795773848s ago: executing program 1 (id=7168): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1711}]]}, 0x44}}, 0x40) (fail_nth: 3) 1.676981821s ago: executing program 0 (id=7169): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b40000000000000079b0900000000000620040000000000095"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r1}, 0x94) r2 = socket(0x1, 0x80802, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'veth0_to_batadv\x00', 0x0}) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "0200", 0x8, 0x0, 0x0, @local, @local, {[@srh={0x32}]}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000014001280090001007663616e000000000400028008000a"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x4008840) r5 = socket$packet(0x11, 0x2, 0x300) bind$packet(r5, &(0x7f00000001c0)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @link_local}, 0x14) r6 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$inet6(r6, 0x0, 0x0, 0x122, 0x0, 0x0) recvmsg(r6, 0x0, 0x40) bind$l2tp6(r6, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty}, 0x20) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000020c0)={&(0x7f0000000540)=@gettclass={0x24, 0x2a, 0x0, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x2, 0x9}, {0x13, 0xa}, {0xa, 0x1}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x8848}, 0x80) syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00', 0x48, 0x2f, 0x0, @private2, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x88a8, 0x0, 0x0, [0x0, 0x0]}, {}, {}, {0xa888, 0x88be, 0x81000000}}}}}}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'hsr0\x00', 0x0}) sendto$packet(r7, &(0x7f0000000200)="01154e000100445588fb0000892f", 0xe, 0x804, &(0x7f0000000040)={0x11, 0xf8, r8, 0x0, 0x0, 0x0}, 0x14) 1.62388176s ago: executing program 2 (id=7170): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_MPATH(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, r1, 0x100, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x24) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000140)) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xb0, r1, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x700000, 0x39}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "3928193ced1034615b4b1824abaa8ffa"}, @NL80211_ATTR_SSID={0x1a, 0x34, @random="af9f3e2d5ba9d06b153e5299b47dbd5063f99fda2aa7"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x2}, @NL80211_ATTR_SSID={0x1e, 0x34, @random="c759e513d40436f6c0b4499ed10b0ba49d894d4d12a97ce0f674"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_PMKID={0x14, 0x55, "3a13b23bb2717962c8a55bf386a17522"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="39ba5dbdb6c3"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="6dd6c6b89a67"}]}, 0xb0}}, 0x40844) (async) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000006c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000680)={&(0x7f0000000340)={0x314, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc4f4}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}]}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xba53}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA={0xd8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}]}, @TIPC_NLA_NODE={0xf0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x46, 0x4, {'gcm(aes)\x00', 0x1e, "aac8cfc4dde6c5485f61260ce75ea711ead79366592d48778f0e78339680"}}, @TIPC_NLA_NODE_KEY={0x4c, 0x4, {'gcm(aes)\x00', 0x24, "e44d53f5ebcd444ad91723bf7c1c6f14a017799f212b21c5f58edabcac0fc7a534c4d8bc"}}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "4d9cb35ed748b12bcfa0d5983aa70639242fb6ca20219da4"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7ff}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}]}, @TIPC_NLA_LINK={0xe4, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x11b3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x18000}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xad}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x314}, 0x1, 0x0, 0x0, 0x4000}, 0x20000011) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), r0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000780)={'wlan1\x00', 0x0}) (rerun: 64) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000840)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x3f2339364076b381}, 0xc, &(0x7f0000000800)={&(0x7f00000007c0)={0x40, r2, 0x800, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x6, 0x33}}}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0xbc}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000014}, 0x20000014) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000980)={r0, &(0x7f0000000880)='syz1\x00', 0x2, &(0x7f00000008c0)={@align=0x77caf41c, {0x0, 0xb6, 0x5, 0x3}}, 0x9, &(0x7f0000000900)={@_ha_fsid}, &(0x7f0000000940)=0xc}) sendmsg$NL80211_CMD_SET_COALESCE(r4, &(0x7f0000000b40)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a00)={0xd0, r1, 0x10, 0x70bd2b, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x7a}}}}, [@NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0xa0, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0xf8}}, {0x90, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0x8b, 0x1, "c22b447c78801741a342fb7291c31ae20587c3c1bfe9c66ed7fb78df998d7a604ab64b34cd3b8fe12dc3844349e0191611418b405113b3351d2570a11cbce09bbf7fe69a4b5c01825655c08f00cdc3ea743fb998c4702e535b86bf8bb566ce6a8cc2f9d5079c49b0226fe0c8cc3f3b2657b7902fd4c97154bba8ce0f016a156f8e1e85c05f18dc"}}]}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xf2}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0xd0}, 0x1, 0x0, 0x0, 0x884}, 0x40000) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x11, 0x10, &(0x7f0000000b80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@exit], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000c00)='syzkaller\x00', 0x6, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0xe, r4, 0x8, &(0x7f0000000c40)={0x1, 0x5}, 0x8, 0x10, &(0x7f0000000c80)={0x5, 0x2, 0x40463d3e, 0xfff}, 0x10, 0xffffffffffffffff, r4, 0x6, &(0x7f0000000cc0)=[r4, r4, r4, r4, r4], &(0x7f0000000d00)=[{0x5, 0x1, 0x6, 0x28578c2344c2f2dd}, {0x4, 0x2, 0x6, 0x5}, {0x3, 0x5, 0x3, 0xa}, {0x5, 0x3, 0xb, 0x7}, {0x1, 0x3, 0xb, 0x5}, {0x2, 0x1, 0x8, 0x5}], 0x10, 0x7}, 0x94) poll(&(0x7f0000000e40)=[{r4, 0x41}, {r0, 0xa8}, {r4, 0x1000}, {r5, 0x4}], 0x4, 0xc) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000ec0), r4) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f00000011c0)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001180)={&(0x7f0000000f00)={0x244, r6, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@WGDEVICE_A_PEERS={0x1fc, 0x8, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6}]}, {0x1ec, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x1bc, 0x9, 0x0, 0x1, [{0x130, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x12}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x40}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x1c}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}]}, {0x88, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "2b1ce992b4cb1c10bca13499ea2a8893642f0f146b739400a680268793dd159f"}, @WGPEER_A_FLAGS={0x8, 0x3, 0x1}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e20}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_IFINDEX={0x8}]}, 0x244}, 0x1, 0x0, 0x0, 0x4800}, 0x800) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001240), r0) (async) getpeername$packet(r4, &(0x7f0000001280)={0x11, 0x0, 0x0}, &(0x7f00000012c0)=0x14) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r7, &(0x7f0000001380)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x30, r8, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r9}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1e}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x48001}, 0x48080) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001400), r4) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000001500)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000014c0)={&(0x7f0000001440)={0x70, r10, 0x1, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x4, 0x44}}}}, [@NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1e0}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x78}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x3c}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x14}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x5a}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x37}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x14}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x168}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0xa}]}, 0x70}}, 0x44) (async, rerun: 64) ioctl$XFS_IOC_FREE_EOFBLOCKS(r4, 0x8080583a, &(0x7f0000001540)={0x5, 0xff, 0x5, 0x7fffffff, 0x6, 0x0, 0xfffffffffffffff7}) (async, rerun: 64) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r11, &(0x7f0000001700)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000016c0)={&(0x7f0000001600)={0xbc, r1, 0x2, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x80000000}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xa}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xf5}, @NL80211_ATTR_CENTER_FREQ2={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @NL80211_ATTR_MAC={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x138}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1a4}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xe}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x4}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x4}]}, 0xbc}, 0x1, 0x0, 0x0, 0x200080c0}, 0x24080800) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001a40)={r4, 0xe0, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001780)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, &(0x7f00000017c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001800)=[0x0, 0x0], 0x0, 0xca, &(0x7f0000001840)=[{}, {}], 0x10, 0x10, &(0x7f0000001880), &(0x7f00000018c0), 0x8, 0x34, 0x8, 0x8, &(0x7f0000001900)}}, 0x10) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001e00)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001a80)={0x31c, 0x0, 0x300, 0x70bd2a, 0x25dfdbfd, {}, [{{0x8, 0x1, r9}, {0x1fc, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r9}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r9}, {0xfc, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}, {0x44, 0x1, @name={{0x24}, {0x5}, {0x11, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xee5f}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}, {0x8, 0x6, r12}}}]}}]}, 0x31c}, 0x1, 0x0, 0x0, 0x10000000}, 0x20004011) (async) sendmsg$TIPC_NL_MON_GET(r7, &(0x7f0000002040)={&(0x7f0000001e40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000002000)={&(0x7f0000001e80)={0x17c, 0x0, 0x100, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x10c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @rand_addr=0x64010102}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x6, @private0, 0x1}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e22, @loopback}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0xff, @dev={0xfe, 0x80, '\x00', 0x3c}, 0x6}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x81}, @TIPC_NLA_BEARER_NAME={0xf, 0x1, @l2={'eth', 0x3a, 'nicvf0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x41ac}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x3, @remote, 0x7}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @private1, 0x1000}}}}]}, @TIPC_NLA_PUBL={0x54, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xfe51}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x800}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xb73}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3b000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}]}, @TIPC_NLA_NODE={0x8, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r13 = syz_genetlink_get_family_id$tipc2(&(0x7f00000020c0), r4) sendmsg$TIPC_NL_BEARER_SET(r4, &(0x7f00000021c0)={&(0x7f0000002080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002180)={&(0x7f0000002100)={0x6c, r13, 0x400, 0x80, 0x25dfdbfd, {}, [@TIPC_NLA_MEDIA={0x28, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}]}, @TIPC_NLA_SOCK={0x20, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2646}]}, @TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20040000}, 0x10) sendmsg$NL80211_CMD_SET_WDS_PEER(0xffffffffffffffff, &(0x7f0000002340)={&(0x7f0000002200)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000002300)={&(0x7f0000002280)={0x44, 0x0, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x45}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x20000001) 1.485637511s ago: executing program 4 (id=7171): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180200004f000000000000000000000085000000000000000000000000000000c4836233e37bc64aecc4f5f35f1ff50a7a8d619ac054e0459eef912453705f73e9fe9c28a4c78cb7e6b1c853aca59b22465fe9b765139a65f614279e748f83cd962ca0c78f5bcf459afe838c10bebc88ebd56f8ade93c950181fa186550987d9bc5c73d379ff5493f3a4533113745362217d229d1832928d1459ed62ec92df637be2"], &(0x7f0000000040)='syzkaller\x00', 0x2}, 0x90) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000080), 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r6, 0x1, 0xc000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c084}, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) r8 = socket(0x10, 0x803, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r8) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000020}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x48, r10, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x6040804) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}}, 0x80) sendmsg$can_bcm(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x1d, r7}, 0x10, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYRES32=r2], 0x48}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'syztnl0\x00', r7, 0x4, 0x3d, 0x4, 0x6, 0xc, @remote, @mcast1, 0x8, 0x80, 0xffff, 0x9a}}) 1.421047137s ago: executing program 1 (id=7172): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f00000000c0)) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r2, &(0x7f00000002c0)="f9", 0x1, 0x0, &(0x7f00000003c0)={0xa, 0x4e23, 0x0, @loopback, 0x2}, 0x1c) shutdown(r2, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x74, &(0x7f0000000200)={0x0, 0x0, 0x10}, &(0x7f0000000240)=0x18) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000180), &(0x7f00000001c0)=0x8) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001040)={0x14, 0x0, 0x300, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40050}, 0x4010) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xe}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x1c, r6, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x84) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000003880)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000038c0)=@newlink={0x3c, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4040, 0x820}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0xf, 0x0, 0x0, 0x1}]}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x0) close(r1) getsockname$tipc(r0, &(0x7f0000000280)=@name, &(0x7f0000000300)=0x10) 1.293020242s ago: executing program 3 (id=7173): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r2, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r1, @ANYBLOB="08000afcf10e2e9a1ec232a3eda2ba4f8fe4d3367514dbd13e8ab3e05940a9b279b14113f5f2af401fcae6178f2cf45e4e5ac90f95586547d4400d7e7e3fad080ce388fe540f6f3341b685f8efc22c5f6b308899e0cfe4063362ec09d4bacbc3ac1d299cdef9372c680112f33bcc895c9314df60082841719f34d3c52c7016979da7b48ae1acc4b1290e6fcb631fbb69ff72181c03dfdf9d80dbbccfd05ab36c3abf6efba28c6e85ccf5c9256a5d38f04cd1428e8ac08dcca25bf3679ab87f1e7d728d33fc53a42918265bd80fd4c94617827e9cf09cce66ef6d91d83911b192e944fc4d96b3a2feb5cb1954abd9a8490c0066507a4a1029671a6eb7abcd36040c753836d115", @ANYRESDEC=r0, @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.031337522s ago: executing program 2 (id=7174): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00fffd1c00357428bd7000fed3df2502000000", @ANYRES32=r1, @ANYBLOB="1000a204080001"], 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x200080c0) 805.29344ms ago: executing program 2 (id=7175): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="0a0003000100ff", 0x7) 630.047448ms ago: executing program 2 (id=7176): socket$phonet_pipe(0x23, 0x5, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) ioctl$SIOCGSTAMPNS(r1, 0x8907, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f0000000200), 0xe) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r3) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="1b0000001d0001000000000004086aa42d"], 0x30}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)=@newtaction={0x7c, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x68, 0x1, [@m_tunnel_key={0x64, 0x1, 0x0, 0x0, {{0xf}, {0x34, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @loopback={0x400000004000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f00000003c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000129bd7000ffdbdf25010099d0a6d3000007410000004c00180000000275647000"/98], 0x68}, 0x1, 0x0, 0x0, 0x20008000}, 0x4010) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000001500)=@raw={'raw\x00', 0x8, 0x3, 0xb20, 0x0, 0x43, 0xa0, 0x0, 0x98, 0xa88, 0x178, 0x178, 0xa88, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1a0, 0x1c0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@owner={{0x38}, {0xee01, 0x0, 0x0, 0x0, 0x1}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x888, 0x8c8, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x9}, {0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x4, 0x2}, {0xb1d}, {0x3}, {0x8}, {0x2, 0x3}, {0x3}, {0x103}], [{0xe8f3, 0x5}, {0x1d, 0x6}, {0x4, 0x8}, {0x0, 0x4}, {0x4, 0xc3e}, {0x1, 0x100}, {0x6, 0x7}, {0x3, 0x3}, {0xf2, 0x3}, {0x3ff, 0x8}, {0x10, 0x3}], 0x6, 0x6}, {[{0x80, 0x3}, {0x2}, {0x6, 0x1}, {0x355cbac3, 0x2}, {0x0, 0x2}, {0x0, 0x2}, {0x7}, {0xe7, 0x2}, {0x3, 0x3}, {0x5598e8fe, 0x2}, {0x6, 0x1}], [{0x9, 0x9097}, {0x7, 0x9}, {0x7, 0xa}, {0x6, 0x8}, {0x20080, 0x5}, {0x13, 0xc0000000}, {0x40, 0xb}, {0x9, 0x6}, {0x4, 0x2}, {0x6, 0x7fffffff}, {0x7fffffff, 0x400}], 0x7}, {[{0x84, 0x2}, {}, {0x0, 0x2}, {0xffffffff, 0x1}, {}, {0x5, 0x1}, {0x5, 0x2}, {0x8, 0x3}, {0x2, 0x3}, {0x8, 0x1}, {0x7}], [{0x9, 0x5}, {0x80, 0x32}, {0x0, 0xfffffff7}, {0xff, 0x1}, {0x7, 0x6}, {0xdb9, 0xff4}, {0x6, 0x3ff}, {0x3, 0x6}, {0x5, 0x10}, {0x9, 0x6}, {0x10000, 0x2}], 0x4, 0x2a}, {[{0x3, 0x2}, {0xa, 0x1}, {0x6, 0x1}, {0x10, 0x3}, {0x2, 0x2}, {0x2, 0x2}, {0x3, 0x1}, {0x2, 0x3}, {0x3, 0x1}, {0x2, 0x2}, {0x477d, 0x1}], [{0x4, 0xffffffff}, {0x200, 0x6}, {0x4be1, 0x4044}, {0x1}, {0x5, 0xc}, {0x3, 0x4}, {0x2, 0x4}, {0x800, 0x8000}, {0x8, 0x800}, {0x3, 0x2}, {0xe, 0x8000}], 0x4, 0xb}, {[{0x7, 0x1}, {0xd, 0x3}, {0x5}, {0x61}, {0x9}, {}, {0x2}, {0x1}, {0x0, 0x2}, {0x9, 0x3}, {0x5, 0x3}], [{0x58d, 0x3ff}, {0x0, 0x7f}, {0x6}, {0xfc9b, 0x80000001}, {0x101, 0x7}, {0x7, 0x1}, {0x7, 0x8001}, {0x2, 0x1}, {0x2, 0x2}, {0x9, 0x4cf}, {0x7, 0x10000}], 0x1}, {[{0x2}, {0x9}, {0x8, 0x1}, {0x2, 0x3}, {0x71, 0x3}, {0x0, 0x2}, {0xe, 0x2}, {0x6, 0x2}, {0x5}, {0x3000000, 0x3}, {0x6, 0x1}], [{0x9, 0x3}, {0x5, 0x7fffffff}, {0xffff, 0x4}, {0x0, 0x7}, {0x8, 0xb502}, {0x1ff, 0x86}, {0x6, 0xffffffff}, {0x3, 0x4}, {0x5, 0x6}, {0xf, 0xf93}, {0x5, 0x4}], 0x3, 0x3}, {[{0x7, 0x1}, {0x3, 0x1}, {0x45d7}, {0xfff, 0x3}, {0xc4f, 0x3}, {0x0, 0x2}, {0x400, 0x1}, {0x2, 0x1}, {0x4, 0x2}, {0xfffffffd}, {0x2}], [{0x3, 0x6}, {0xed, 0xd}, {0x80, 0xb81d}, {0x2ca, 0x80000000}, {0x8, 0xff}, {0x7, 0x45a8}, {0x8, 0x6}, {0x4, 0x1}, {0x2, 0x6}, {0xfc, 0x6}, {0xd, 0x138c}], 0x6}, {[{0x4, 0x1}, {0x800}, {0x9, 0x2}, {0xf0000000, 0x2}, {0x6, 0x3}, {0x3, 0x2}, {0x8, 0x2}, {}, {0x9}, {0x400, 0x2}, {0x8, 0x3}], [{0x7, 0xfffffffd}, {0x2}, {0x2, 0x2}, {0x8f, 0x6}, {0x7, 0x5}, {0x8, 0x7}, {0xb, 0x82c6}, {0xb1b}, {0xbd5c, 0xffff}, {0x1, 0x9b8d}, {0xec, 0x5}], 0x2, 0x6}, {[{0x8}, {0x0, 0x1}, {0xac000000}, {0x6, 0x2}, {0x2d8, 0x3}, {0x7e3ea4bc}, {0x8, 0x1}, {0x4f, 0x3}, {0x4, 0x2}, {0xfffffff7}, {0x3, 0x2}], [{0x5, 0x42}, {0x76a74689, 0x4}, {0x1}, {0x8000, 0x7}, {0x400, 0xdd}, {0xfff, 0x8}, {0x76b, 0xfffffffe}, {0xa6d00, 0xfffffff7}, {0x10001, 0xfc8d}, {0x0, 0x10001}, {0x4, 0x3}], 0x1, 0x9}, {[{0x8, 0x1}, {0x3, 0x3}, {0x18, 0x3}, {0x3ff, 0x3}, {0x7fffffff}, {0x8}, {0x1, 0x3}, {0x8, 0x3}, {0xf1b6}, {0x80, 0x3}, {0x4, 0x2}], [{0x2, 0x4}, {0x3, 0xf}, {0x9, 0x6}, {0x7f, 0x8}, {0x7, 0x273e1899}, {0x4, 0x1}, {0x6, 0x3}, {0x1, 0xb7}, {0x8, 0x3}, {0x3, 0x1}, {0x7ff, 0x63}], 0xb, 0x3}, {[{0x1, 0x2}, {0x6, 0x3}, {0xffff, 0x1}, {0x1}, {0x4, 0x3}, {0x4, 0x3}, {0xaa7}, {0x100, 0x3}, {0x2}, {0xfffffff7, 0xb90af65875a5dc08}, {0x4, 0x3}], [{0x3}, {0x8001, 0x7}, {0x10000, 0x7524}, {0x73d, 0x4}, {0x0, 0x280000}, {0x3, 0x3af}, {0x5, 0x2}, {0x101, 0xbf}, {0x10000, 0x6}, {0x3, 0x800}], 0x8, 0x5}], 0x3}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c29d381d41116000"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0xb80) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r8, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r8, 0x84, 0x15, &(0x7f0000000180)={0xff}, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r8, 0x84, 0x15, &(0x7f0000000040)={0x3}, 0x1) sendto$inet6(r8, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) r9 = syz_genetlink_get_family_id$team(&(0x7f0000000000), r3) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMP(r10, 0x1, 0x40, 0x0, &(0x7f0000000340)) syz_emit_ethernet(0x7e, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaa15687efec3d286dd60f81ecb00483a00fc000000000000000000000000000000ff0200000000000000000000000000010400907800000000604aa1d300000000fc01000000000000000000000000000000000000000000000000ffff5f0000013c0000000000000000"], 0x0) listen(r2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000100), 0x4) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYRES16=r9], 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) 603.246061ms ago: executing program 0 (id=7177): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000004000000000000001154d1ff85100000010000009500000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000005000000850000002300000018010000646c6c2500000000002020200600000000000000bf0600000000000007010000f8ffffffb702000008000000b703000059e70000a50000000600000095"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xc, 0xa}, {0x0, 0x9}, {0xffff, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_OPTS={0x8, 0x63, 0x0, 0x1, @TCA_FLOWER_KEY_MPLS_OPTS_LSE={0x4}}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x6}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4010}, 0xc014) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001180)={r1, 0xe0, &(0x7f0000001080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000ec0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000e00), &(0x7f0000000f40)=[0x0], 0x0, 0x4000003c, &(0x7f0000000f80)=[{}], 0x8, 0x10, &(0x7f0000000fc0), &(0x7f0000001000), 0x8, 0xb9, 0x8, 0x8, &(0x7f0000001040)}}, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000001240)={'ip6tnl0\x00', &(0x7f00000011c0)={'ip6tnl0\x00', 0x0, 0x4, 0x7, 0x38, 0x4, 0x20, @empty, @ipv4={'\x00', '\xff\xff', @loopback}, 0x700, 0x10, 0x10000, 0xfffffffa}}) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000001280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000012c0)=0x14) (async) r6 = socket$inet6_udp(0xa, 0x2, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f00000000c0)={@remote, r8}, 0x14) (async) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0xd}, r8}, 0x14) (async) sendmmsg$inet6(r6, &(0x7f0000000500)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x1, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="24000000000000002900000032000000fe8000001de9cb53ed00000000000000", @ANYRES32=r8], 0x28}}], 0x1, 0x0) (async) r9 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r9, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r9, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000001700)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000016c0)={&(0x7f00000018c0)=ANY=[@ANYBLOB="5916a48feef33f40851420089437a1095a3bd451a59bfe45891ef174b03e51b6ba7d0cb447e40b86e688a8af89d84bf0bd08ad509044ae0bdc40ac1e0694d66b0b08f09b6a00aed183be5aa6ba13ddb500b0951dc0aba778d94b2898302cd7eab2240f9d3cc1faf4a11d174157789bb50f35c0a3d64e56cb79cf8b37987825103960890ef8e6f71ca77cc05a9c70d367394744f1a32b55c27de18ed750789cd040e28a84f744919e23b103252e06abac8ef8dfa5edeab2d2464cda850575a59f49cb3419829861b28a91be0b00c06a09e24189", @ANYRES16=0x0, @ANYBLOB="00022dbd7000fbdbdf250200000008000100", @ANYRES32=0x0, @ANYRESHEX=r4, @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="e801028040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000500000008000600", @ANYRES32=r2, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r4, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004004000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b000000080004000400000008000700000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r5, @ANYBLOB="400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400ff03000008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="08000700000000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB], 0x3a4}, 0x1, 0x0, 0x0, 0x10}, 0x40000) (async) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000340)={&(0x7f0000000e40)=ANY=[@ANYBLOB="28f03a01be2c1d7226cd3662a4d8323c000000030601010000000000000000020000080900020073797a30000000000500010007000000"], 0x28}, 0x1, 0x0, 0x0, 0x4040}, 0x20040000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001c00114edb185eafed52650007000000", @ANYRES32=r11, @ANYBLOB="800202000a000200577f0000aabb000020000e80050001008f000000050001000100000004000200050001"], 0x48}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000780)={r1, 0xe0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000003c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, &(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000440)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x255, &(0x7f0000000480)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f00000004c0), &(0x7f0000000500), 0x8, 0xda, 0x8, 0x8, &(0x7f0000000540)}}, 0x10) r14 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000940)={'gretap0\x00', &(0x7f0000000880)={'gre0\x00', r13, 0x740, 0x20, 0xff, 0x4, {{0x1a, 0x4, 0x1, 0x28, 0x68, 0x66, 0x0, 0x47, 0x4, 0x0, @loopback, @rand_addr=0x64010101, {[@end, @timestamp_addr={0x44, 0x34, 0xea, 0x1, 0x4, [{@remote, 0x10}, {@multicast2, 0x3}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}, {@private=0xa010101, 0x10001}, {@remote, 0x7fff}]}, @generic={0x86, 0xf, "3cbefabed0599f345bdc141601"}, @timestamp={0x44, 0xc, 0xe6, 0x0, 0xc, [0x7, 0x5]}, @noop]}}}}}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000000ac0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a80)={&(0x7f0000000980)={0x14, r14, 0x200, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x48001}, 0x4802) (async) r15 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000007c0)={r12}, 0x4) r16 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x6, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000200ffff00000000000000008500000041000000850000000e00000095"], &(0x7f0000000e00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', r11, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, r15, 0x0, 0x0, 0x0, 0x10, 0x200000}, 0x94) (async) r17 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c00)={&(0x7f00000009c0)=ANY=[@ANYBLOB="9feb010018000000000000008800000088000000050000000f0000000300000502000000010000000500000000000000020000000200000004000000090000000100000006000000070000000000000b020000000300000000000010020000000a0000000000001101000000ffffffff01000000030000040b000c000100000002000000050000000e00000005000000040000000a0000000200000000000000005f615f00"], &(0x7f0000000b00)=""/222, 0xa5, 0xde, 0x0, 0xffffff9d}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000d80)={r17, 0x20, &(0x7f0000000d40)={&(0x7f0000000c40)=""/64, 0x40, 0x0, &(0x7f0000000c80)=""/178, 0xb2}}, 0x10) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r16, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 269.621247ms ago: executing program 1 (id=7178): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)="89000000120081ae08060cdc030000007f03e3f7fe0000006ee2ffca1b1f3317000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e", 0x78}], 0x1}, 0x4004010) 168.053941ms ago: executing program 4 (id=7179): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "1923ae89f71afa8a", "af0ad47ad4e18d2772a75979c48e7115f98cc4bf5d1f0860edb20c8eec6bdf31", "27543ce9", "e63f78dbceb62577"}, 0x38) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8983, &(0x7f00000000c0)={0x6, 'vlan1\x00', {0x80000001}, 0x3}) r2 = accept(r1, &(0x7f0000000100)=@isdn, &(0x7f0000000180)=0x80) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, 0x2, 0x3, 0x281, 0x0, 0x0, {0x1, 0x0, 0x9}, [@NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x21}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x19}, @NFQA_CFG_FLAGS={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x841}, 0x4040801) ioctl$F2FS_IOC_GET_FEATURES(r2, 0x8004f50c, &(0x7f00000002c0)) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r2, 0x110, 0x3) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000300)={r1}) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000340)={0x0, 0x401, 0x5, 0x1, 0x5, 0x400}, &(0x7f0000000380)=0x14) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000003c0)={0x8001, 0x1, 0x2, 0x3, 0x6, 0x10, 0x7, 0x9, r4}, &(0x7f0000000400)=0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000440)={r5, @in6={{0xa, 0x4e23, 0x9, @private2, 0xc}}}, &(0x7f0000000500)=0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000540)={r6, @in={{0x2, 0x4e20, @rand_addr=0x64010101}}, 0xffffff8b, 0x6, 0x0, 0x1, 0x9b, 0x2, 0x3}, 0x9c) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000600)={r7, 0x7, 0x9, 0x8001}) sendmsg$NFT_MSG_GETSET(r8, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x40, 0xa, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @synproxy={{0xd}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x4}]}}}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x9}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x8005}, 0x8840) sendmsg$nl_route_sched(r8, &(0x7f0000000800)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)=@deltclass={0x34, 0x29, 0x400, 0x7fffffff, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x6, 0x99e7bc4d3142e50f}, {0xfff2, 0x6}, {0x1, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x1, 0xc}}, @tclass_kind_options=@c_cbs={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$XFS_IOC_FSGETXATTRA(r1, 0x801c582d, &(0x7f0000000840)) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000880)={r6, 0xf, "835f301aecdeaca785b70f6a167a0e"}, &(0x7f00000008c0)=0x17) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000900), &(0x7f0000000940)=0x4) r9 = openat$cgroup_netprio_ifpriomap(r8, &(0x7f0000000980), 0x2, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, &(0x7f00000009c0)={"ac65cb7bf601449aab11b9e25a6fdd76", 0x0, 0x0, {0x100000000, 0x1}, {0x1, 0x4}, 0x4, [0x1, 0xad4, 0x3, 0x0, 0x1c15, 0xff, 0x5, 0x2c, 0x0, 0x4, 0x2, 0x4, 0xf7, 0x4, 0x9, 0x7]}) ioctl$BTRFS_IOC_START_SYNC(r7, 0x80089418, &(0x7f0000000ac0)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r9, 0xc0c89425, &(0x7f0000000b00)={"aa784aafbbae5030de54e999d20518b6", r10, r11, {0x1, 0xfff}, {0x62}, 0x3, [0x2, 0x4, 0xffffffffffff7fff, 0x0, 0xe, 0x3, 0x7, 0xfffffffffffffff7, 0x3, 0x9da8, 0x8000, 0xffffffffffffffff, 0x9, 0x9, 0x800, 0x1]}) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000c00), 0x3) r12 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000c80), r2) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x1c, r12, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0xa}]}, 0x1c}, 0x1, 0x0, 0x0, 0x801}, 0x9a5d7020a033d0b6) ioctl$FICLONE(r8, 0x40049409, r9) shutdown(r3, 0x1) 124.296965ms ago: executing program 0 (id=7180): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb010098000000000000000c0000000c000010ce5d61096a568a890000000604"], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="1800001900000000020000000000001118400000020000000000000000000000950000000000000095"], &(0x7f0000000580)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x14, &(0x7f0000000600), 0x10}, 0xc6) 0s ago: executing program 1 (id=7181): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'rose0\x00', 0x112}) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2040000, 0x0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) r4 = socket(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r4, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) connect$netlink(r4, &(0x7f00000005c0)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r4, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) sendmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000000c0)="7816", 0x2}], 0x1}}], 0x1, 0x20040020) syz_genetlink_get_family_id$team(&(0x7f0000000200), r4) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) sendmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000002080)=[{&(0x7f0000001d80)="16", 0x1}], 0x1}}], 0x1, 0x24008094) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r1, 0x8040942d, &(0x7f00000000c0)) sendmsg$nl_xfrm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYRES8=r3, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032"], 0xf8}, 0x1, 0x0, 0x0, 0xc010}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) close(0x3) close(0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000001140), 0xffffffffffffffff) kernel console output (not intermixed with test programs): a0 [ 595.083287][T22597] ? __alloc_skb+0x276/0x7a0 [ 595.083315][T22597] ? netlink_sendmsg+0x650/0xb40 [ 595.083341][T22597] ? skb_put+0x112/0x210 [ 595.083366][T22597] netlink_sendmsg+0x6c0/0xb40 [ 595.083402][T22597] ? __pfx_netlink_sendmsg+0x10/0x10 [ 595.083432][T22597] ? aa_sock_msg_perm+0xf1/0x1b0 [ 595.083470][T22597] ? __pfx_netlink_sendmsg+0x10/0x10 [ 595.083496][T22597] sock_sendmsg_nosec+0x13a/0x180 [ 595.083529][T22597] __sys_sendto+0x408/0x5a0 [ 595.083551][T22597] ? ksys_write+0x1e6/0x270 [ 595.083576][T22597] ? __pfx___sys_sendto+0x10/0x10 [ 595.083596][T22597] ? __mutex_unlock_slowpath+0x731/0x900 [ 595.083653][T22597] ? __pfx_ksys_write+0x10/0x10 [ 595.083679][T22597] __x64_sys_sendto+0xde/0x100 [ 595.083702][T22597] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.083725][T22597] do_syscall_64+0x174/0x580 [ 595.083750][T22597] ? trace_irq_disable+0x3b/0x140 [ 595.083783][T22597] ? clear_bhb_loop+0x40/0x90 [ 595.083810][T22597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.083832][T22597] RIP: 0033:0x7ff83f95e90e [ 595.083852][T22597] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 595.083871][T22597] RSP: 002b:00007ff83dbf4e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 595.083895][T22597] RAX: ffffffffffffffda RBX: 00007ff83dbf66c0 RCX: 00007ff83f95e90e [ 595.083911][T22597] RDX: 0000000000000024 RSI: 00007ff83dbf5000 RDI: 0000000000000003 [ 595.083925][T22597] RBP: 0000000000000000 R08: 00007ff83dbf4f04 R09: 000000000000000c [ 595.083939][T22597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 595.083952][T22597] R13: 00007ff83dbf4f58 R14: 00007ff83dbf5000 R15: 0000000000000000 [ 595.083986][T22597] [ 595.329677][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 595.344855][T18767] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 595.454683][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 595.485021][T18767] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 595.585765][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 595.742409][T22616] __nla_validate_parse: 2 callbacks suppressed [ 595.742430][T22616] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5924'. [ 596.011577][T22629] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5930'. [ 596.043075][T22632] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 596.172675][T22639] FAULT_INJECTION: forcing a failure. [ 596.172675][T22639] name failslab, interval 1, probability 0, space 0, times 0 [ 596.189252][T22639] CPU: 1 UID: 0 PID: 22639 Comm: syz.1.5933 Not tainted syzkaller #0 PREEMPT(full) [ 596.189284][T22639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 596.189300][T22639] Call Trace: [ 596.189309][T22639] [ 596.189319][T22639] dump_stack_lvl+0xe8/0x150 [ 596.189362][T22639] should_fail_ex+0x40c/0x560 [ 596.189401][T22639] should_failslab+0xa8/0x100 [ 596.189442][T22639] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 596.189475][T22639] ? skb_clone+0x212/0x3a0 [ 596.189501][T22639] ? skb_clone+0x212/0x3a0 [ 596.189537][T22639] skb_clone+0x212/0x3a0 [ 596.189573][T22639] __netlink_deliver_tap+0x413/0x860 [ 596.189618][T22639] ? netlink_deliver_tap+0x2e/0x1b0 [ 596.189648][T22639] netlink_deliver_tap+0x19c/0x1b0 [ 596.189678][T22639] netlink_unicast+0x77f/0x940 [ 596.189717][T22639] netlink_sendmsg+0x813/0xb40 [ 596.189758][T22639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.189795][T22639] ? aa_sock_msg_perm+0xf1/0x1b0 [ 596.189830][T22639] ? __pfx_netlink_sendmsg+0x10/0x10 [ 596.189858][T22639] sock_sendmsg_nosec+0x13a/0x180 [ 596.189896][T22639] __sys_sendto+0x408/0x5a0 [ 596.189921][T22639] ? ksys_write+0x1e6/0x270 [ 596.189960][T22639] ? __pfx___sys_sendto+0x10/0x10 [ 596.189983][T22639] ? __mutex_unlock_slowpath+0x731/0x900 [ 596.190050][T22639] ? __pfx_ksys_write+0x10/0x10 [ 596.190082][T22639] __x64_sys_sendto+0xde/0x100 [ 596.190107][T22639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.190134][T22639] do_syscall_64+0x174/0x580 [ 596.190163][T22639] ? trace_irq_disable+0x3b/0x140 [ 596.190195][T22639] ? clear_bhb_loop+0x40/0x90 [ 596.190225][T22639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.190250][T22639] RIP: 0033:0x7fbfc2f5e90e [ 596.190272][T22639] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 596.190293][T22639] RSP: 002b:00007fbfc3effe88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 596.190319][T22639] RAX: ffffffffffffffda RBX: 00007fbfc3f016c0 RCX: 00007fbfc2f5e90e [ 596.190337][T22639] RDX: 0000000000000024 RSI: 00007fbfc3f00000 RDI: 0000000000000003 [ 596.190353][T22639] RBP: 0000000000000000 R08: 00007fbfc3efff04 R09: 000000000000000c [ 596.190368][T22639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 596.190382][T22639] R13: 00007fbfc3efff58 R14: 00007fbfc3f00000 R15: 0000000000000000 [ 596.190420][T22639] [ 596.713943][T22653] pim6reg527: entered allmulticast mode [ 596.913853][T22668] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5945'. [ 596.988278][T22673] netlink: 'syz.1.5947': attribute type 1 has an invalid length. [ 597.022803][T22676] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5948'. [ 597.048797][T22676] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5948'. [ 597.192611][T22673] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5947'. [ 597.260712][T22681] veth15: entered promiscuous mode [ 597.300217][T22681] bond26: (slave veth15): Enslaving as a backup interface with a down link [ 597.352522][T22673] 8021q: adding VLAN 0 to HW filter on device bond26 [ 598.365626][T22751] netlink: 'syz.0.5970': attribute type 1 has an invalid length. [ 598.416842][T22754] netlink: 'syz.1.5974': attribute type 1 has an invalid length. [ 598.426105][T22751] 8021q: adding VLAN 0 to HW filter on device bond21 [ 598.452890][T22761] FAULT_INJECTION: forcing a failure. [ 598.452890][T22761] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 598.467168][T22761] CPU: 1 UID: 0 PID: 22761 Comm: syz.2.5975 Not tainted syzkaller #0 PREEMPT(full) [ 598.467198][T22761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 598.467211][T22761] Call Trace: [ 598.467219][T22761] [ 598.467228][T22761] dump_stack_lvl+0xe8/0x150 [ 598.467279][T22761] should_fail_ex+0x40c/0x560 [ 598.467313][T22761] _copy_to_user+0x31/0xb0 [ 598.467337][T22761] simple_read_from_buffer+0xe1/0x170 [ 598.467374][T22761] proc_fail_nth_read+0x1bb/0x230 [ 598.467409][T22761] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 598.467445][T22761] ? rw_verify_area+0x24a/0x4c0 [ 598.467467][T22761] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 598.467504][T22761] vfs_read+0x213/0xa80 [ 598.467530][T22761] ? __pfx___mutex_lock+0x10/0x10 [ 598.467560][T22761] ? __pfx_vfs_read+0x10/0x10 [ 598.467583][T22761] ? __fget_files+0x2a/0x420 [ 598.467618][T22761] ? __fget_files+0x3a2/0x420 [ 598.467646][T22761] ? __fget_files+0x2a/0x420 [ 598.467685][T22761] ksys_read+0x150/0x270 [ 598.467709][T22761] ? __pfx_ksys_read+0x10/0x10 [ 598.467728][T22761] ? fput+0xa0/0xd0 [ 598.467767][T22761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.467792][T22761] do_syscall_64+0x174/0x580 [ 598.467818][T22761] ? trace_irq_disable+0x3b/0x140 [ 598.467847][T22761] ? clear_bhb_loop+0x40/0x90 [ 598.467874][T22761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 598.467895][T22761] RIP: 0033:0x7fb6da35e90e [ 598.467916][T22761] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 598.467934][T22761] RSP: 002b:00007fb6db18bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 598.467958][T22761] RAX: ffffffffffffffda RBX: 00007fb6db18c6c0 RCX: 00007fb6da35e90e [ 598.467973][T22761] RDX: 000000000000000f RSI: 00007fb6db18c0a0 RDI: 0000000000000003 [ 598.467987][T22761] RBP: 00007fb6db18c090 R08: 0000000000000000 R09: 0000000000000000 [ 598.468001][T22761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 598.468014][T22761] R13: 00007fb6da626038 R14: 00007fb6da625fa0 R15: 00007ffe8d241b18 [ 598.468048][T22761] [ 598.700233][T22766] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5974'. [ 598.709324][T22766] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5974'. [ 598.791344][T22754] 8021q: adding VLAN 0 to HW filter on device bond27 [ 598.900153][T22758] bond21: (slave gretap3): making interface the new active one [ 598.917130][T22758] bond21: (slave gretap3): Enslaving as an active interface with an up link [ 599.340588][T22789] sctp: [Deprecated]: syz.2.5980 (pid 22789) Use of int in max_burst socket option. [ 599.340588][T22789] Use struct sctp_assoc_value instead [ 599.845485][ T3377] net_ratelimit: 90 callbacks suppressed [ 599.845510][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 599.884912][ T12] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 599.964578][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 599.995899][ T3373] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 600.076095][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 600.105573][ T35] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 600.184707][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 600.214670][ T12] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 600.305478][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 600.324614][ T3373] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 600.985566][T22728] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 601.399620][T22808] netlink: 'syz.0.5988': attribute type 19 has an invalid length. [ 602.137193][T22857] netlink: 'syz.0.6002': attribute type 2 has an invalid length. [ 602.202584][T22860] FAULT_INJECTION: forcing a failure. [ 602.202584][T22860] name failslab, interval 1, probability 0, space 0, times 0 [ 602.227732][T22860] CPU: 1 UID: 0 PID: 22860 Comm: syz.1.6003 Not tainted syzkaller #0 PREEMPT(full) [ 602.227763][T22860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 602.227777][T22860] Call Trace: [ 602.227785][T22860] [ 602.227794][T22860] dump_stack_lvl+0xe8/0x150 [ 602.227833][T22860] should_fail_ex+0x40c/0x560 [ 602.227867][T22860] should_failslab+0xa8/0x100 [ 602.227902][T22860] __kmalloc_cache_noprof+0xa8/0x660 [ 602.227934][T22860] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 602.228077][T22860] ? ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 602.228108][T22860] ovs_ct_limit_cmd_set+0x2f8/0xb00 [ 602.228146][T22860] genl_family_rcv_msg_doit+0x233/0x340 [ 602.228184][T22860] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 602.228223][T22860] ? bpf_lsm_capable+0x9/0x20 [ 602.228249][T22860] ? security_capable+0x7e/0x2c0 [ 602.228275][T22860] genl_rcv_msg+0x614/0x7a0 [ 602.228305][T22860] ? __pfx_genl_rcv_msg+0x10/0x10 [ 602.228329][T22860] ? __pfx_ovs_ct_limit_cmd_set+0x10/0x10 [ 602.228364][T22860] ? __pfx_ref_tracker_free+0x10/0x10 [ 602.228398][T22860] netlink_rcv_skb+0x226/0x4a0 [ 602.228421][T22860] ? __pfx_genl_rcv_msg+0x10/0x10 [ 602.228448][T22860] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 602.228483][T22860] ? down_read+0x2be/0x330 [ 602.228511][T22860] genl_rcv+0x28/0x40 [ 602.228536][T22860] netlink_unicast+0x7bb/0x940 [ 602.228564][T22860] netlink_sendmsg+0x813/0xb40 [ 602.228594][T22860] ? __pfx_netlink_sendmsg+0x10/0x10 [ 602.228620][T22860] ? aa_sock_msg_perm+0xf1/0x1b0 [ 602.228650][T22860] ? __pfx_netlink_sendmsg+0x10/0x10 [ 602.228669][T22860] sock_sendmsg_nosec+0x13a/0x180 [ 602.228697][T22860] ____sys_sendmsg+0x54e/0x850 [ 602.228723][T22860] ? __pfx_____sys_sendmsg+0x10/0x10 [ 602.228753][T22860] ? import_iovec+0x73/0xa0 [ 602.228774][T22860] ___sys_sendmsg+0x2a5/0x360 [ 602.228792][T22860] ? __lock_acquire+0x683/0x2cf0 [ 602.228823][T22860] ? __pfx____sys_sendmsg+0x10/0x10 [ 602.228878][T22860] ? __fget_files+0x2a/0x420 [ 602.228904][T22860] ? __fget_files+0x3a2/0x420 [ 602.228937][T22860] __x64_sys_sendmsg+0x1b1/0x290 [ 602.228962][T22860] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 602.229000][T22860] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.229024][T22860] do_syscall_64+0x174/0x580 [ 602.229045][T22860] ? trace_irq_disable+0x3b/0x140 [ 602.229069][T22860] ? clear_bhb_loop+0x40/0x90 [ 602.229091][T22860] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.229108][T22860] RIP: 0033:0x7fbfc2f9e0d9 [ 602.229126][T22860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 602.229141][T22860] RSP: 002b:00007fbfc3f01028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 602.229159][T22860] RAX: ffffffffffffffda RBX: 00007fbfc3225fa0 RCX: 00007fbfc2f9e0d9 [ 602.229171][T22860] RDX: 0000000004048856 RSI: 00002000000000c0 RDI: 0000000000000003 [ 602.229182][T22860] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 602.229193][T22860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 602.229203][T22860] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 602.229231][T22860] [ 602.591184][T22843] mac80211_hwsim hwsim4 wlan0: left promiscuous mode [ 602.702828][T22863] xt_CT: You must specify a L4 protocol and not use inversions on it [ 602.719043][T22843] 8021q: adding VLAN 0 to HW filter on device bond16 [ 602.731413][T22843] 8021q: adding VLAN 0 to HW filter on device bond17 [ 602.782071][T22863] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6004'. [ 602.961289][T22872] netlink: 'syz.1.6008': attribute type 1 has an invalid length. [ 603.056435][T22872] 8021q: adding VLAN 0 to HW filter on device bond28 [ 603.096951][T22873] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6009'. [ 603.284114][T22883] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6013'. [ 603.328245][T22883] netlink: 5688 bytes leftover after parsing attributes in process `syz.3.6013'. [ 603.680626][T22912] netlink: 'syz.1.6021': attribute type 3 has an invalid length. [ 603.703384][T22912] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6021'. [ 603.716097][T22912] netlink: 'syz.1.6021': attribute type 3 has an invalid length. [ 603.729110][T22912] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6021'. [ 603.831056][T22912] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6021'. [ 604.239187][T22933] FAULT_INJECTION: forcing a failure. [ 604.239187][T22933] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 604.283231][T22933] CPU: 0 UID: 0 PID: 22933 Comm: syz.1.6029 Not tainted syzkaller #0 PREEMPT(full) [ 604.283262][T22933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 604.283276][T22933] Call Trace: [ 604.283285][T22933] [ 604.283294][T22933] dump_stack_lvl+0xe8/0x150 [ 604.283334][T22933] should_fail_ex+0x40c/0x560 [ 604.283370][T22933] _copy_to_user+0x31/0xb0 [ 604.283395][T22933] simple_read_from_buffer+0xe1/0x170 [ 604.283432][T22933] proc_fail_nth_read+0x1bb/0x230 [ 604.283468][T22933] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 604.283503][T22933] ? rw_verify_area+0x24a/0x4c0 [ 604.283527][T22933] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 604.283558][T22933] vfs_read+0x213/0xa80 [ 604.283584][T22933] ? __pfx___mutex_lock+0x10/0x10 [ 604.283613][T22933] ? __pfx_vfs_read+0x10/0x10 [ 604.283636][T22933] ? __fget_files+0x2a/0x420 [ 604.283671][T22933] ? __fget_files+0x3a2/0x420 [ 604.283699][T22933] ? __fget_files+0x2a/0x420 [ 604.283737][T22933] ksys_read+0x150/0x270 [ 604.283762][T22933] ? __pfx_ksys_read+0x10/0x10 [ 604.283792][T22933] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.283816][T22933] do_syscall_64+0x174/0x580 [ 604.283841][T22933] ? trace_irq_disable+0x3b/0x140 [ 604.283869][T22933] ? clear_bhb_loop+0x40/0x90 [ 604.283895][T22933] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.283916][T22933] RIP: 0033:0x7fbfc2f5e90e [ 604.283943][T22933] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 604.283962][T22933] RSP: 002b:00007fbfc3f00fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 604.283985][T22933] RAX: ffffffffffffffda RBX: 00007fbfc3f016c0 RCX: 00007fbfc2f5e90e [ 604.284001][T22933] RDX: 000000000000000f RSI: 00007fbfc3f010a0 RDI: 0000000000000004 [ 604.284015][T22933] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 604.284028][T22933] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 604.284041][T22933] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 604.284075][T22933] [ 604.868763][ T3377] net_ratelimit: 107 callbacks suppressed [ 604.868786][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 604.954763][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.991196][T18767] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 605.025041][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 605.044654][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.053056][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.114690][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.123224][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.195229][ T3377] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.204319][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 605.431008][T22965] bond13: (slave lo): Releasing backup interface [ 605.450667][T22965] bond13: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 605.510123][T22965] syz_tun: left allmulticast mode [ 605.524134][T22965] syz_tun: left promiscuous mode [ 605.531658][T22965] bridge0: port 3(syz_tun) entered disabled state [ 605.566276][T22965] bridge_slave_0: left allmulticast mode [ 605.589012][T22965] bridge_slave_0: left promiscuous mode [ 605.607598][T22965] bridge0: port 1(bridge_slave_0) entered disabled state [ 605.665850][T22965] bridge_slave_1: left promiscuous mode [ 605.679560][T22965] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.801273][T22965] bond10: (slave veth0_to_bond): Releasing active interface [ 605.857425][T22965] bond0: (slave bond_slave_0): Releasing backup interface [ 605.892301][T22965] bond0: (slave bond_slave_1): Releasing backup interface [ 605.953219][T22990] netlink: 'syz.0.6038': attribute type 3 has an invalid length. [ 606.952822][T23048] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6063'. [ 607.168933][T23060] netlink: 'syz.3.6066': attribute type 2 has an invalid length. [ 607.210691][T23062] netlink: 'syz.1.6067': attribute type 21 has an invalid length. [ 607.287185][T23062] bond29: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 607.299262][T23062] bond29 (unregistering): Released all slaves [ 607.544319][T23082] syzkaller0: entered promiscuous mode [ 607.551369][T23082] syzkaller0: entered allmulticast mode [ 607.863885][T23092] FAULT_INJECTION: forcing a failure. [ 607.863885][T23092] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 607.879593][T23092] CPU: 1 UID: 0 PID: 23092 Comm: syz.4.6077 Not tainted syzkaller #0 PREEMPT(full) [ 607.879633][T23092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 607.879648][T23092] Call Trace: [ 607.879659][T23092] [ 607.879673][T23092] dump_stack_lvl+0xe8/0x150 [ 607.879705][T23092] should_fail_ex+0x40c/0x560 [ 607.879733][T23092] _copy_from_user+0x2d/0xb0 [ 607.879750][T23092] ___sys_sendmsg+0x1c6/0x360 [ 607.879770][T23092] ? __lock_acquire+0x683/0x2cf0 [ 607.879799][T23092] ? __pfx____sys_sendmsg+0x10/0x10 [ 607.879849][T23092] ? __fget_files+0x2a/0x420 [ 607.879872][T23092] ? __fget_files+0x3a2/0x420 [ 607.879905][T23092] __x64_sys_sendmsg+0x1b1/0x290 [ 607.879927][T23092] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 607.879963][T23092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.879981][T23092] do_syscall_64+0x174/0x580 [ 607.880002][T23092] ? trace_irq_disable+0x3b/0x140 [ 607.880031][T23092] ? clear_bhb_loop+0x40/0x90 [ 607.880053][T23092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 607.880070][T23092] RIP: 0033:0x7f75e779e0d9 [ 607.880086][T23092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 607.880105][T23092] RSP: 002b:00007f75e8680028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 607.880123][T23092] RAX: ffffffffffffffda RBX: 00007f75e7a26090 RCX: 00007f75e779e0d9 [ 607.880136][T23092] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000020 [ 607.880147][T23092] RBP: 00007f75e8680090 R08: 0000000000000000 R09: 0000000000000000 [ 607.880158][T23092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 607.880168][T23092] R13: 00007f75e7a26128 R14: 00007f75e7a26090 R15: 00007ffeb0d35578 [ 607.880195][T23092] [ 609.743643][T23039] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 609.920899][T23096] netlink: 524 bytes leftover after parsing attributes in process `syz.4.6079'. [ 609.938494][ T12] net_ratelimit: 100 callbacks suppressed [ 609.938517][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 609.996677][ T12] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 610.038095][T23100] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6078'. [ 610.084720][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 610.113439][T23107] netlink: Conntrack attr has 1 unknown bytes [ 610.121105][T23107] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 610.136661][T23109] openvswitch: netlink: IP tunnel attribute has 5417 unknown bytes. [ 610.154639][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.168921][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.199459][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.296111][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 610.485567][T23111] syzkaller0: entered promiscuous mode [ 610.500705][T23111] syzkaller0: entered allmulticast mode [ 610.577415][T23127] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6089'. [ 610.750710][T23133] FAULT_INJECTION: forcing a failure. [ 610.750710][T23133] name failslab, interval 1, probability 0, space 0, times 0 [ 610.807989][T23133] CPU: 0 UID: 0 PID: 23133 Comm: syz.2.6090 Not tainted syzkaller #0 PREEMPT(full) [ 610.808020][T23133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 610.808033][T23133] Call Trace: [ 610.808042][T23133] [ 610.808051][T23133] dump_stack_lvl+0xe8/0x150 [ 610.808090][T23133] should_fail_ex+0x40c/0x560 [ 610.808124][T23133] should_failslab+0xa8/0x100 [ 610.808159][T23133] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 610.808186][T23133] ? local_lock_release+0x9c/0x160 [ 610.808209][T23133] ? __alloc_skb+0x1d7/0x7a0 [ 610.808226][T23133] ? __alloc_skb+0x1d7/0x7a0 [ 610.808252][T23133] __alloc_skb+0x1d7/0x7a0 [ 610.808277][T23133] netlink_sendmsg+0x5d4/0xb40 [ 610.808315][T23133] ? __pfx_netlink_sendmsg+0x10/0x10 [ 610.808345][T23133] ? aa_sock_msg_perm+0xf1/0x1b0 [ 610.808375][T23133] ? __pfx_netlink_sendmsg+0x10/0x10 [ 610.808411][T23133] sock_sendmsg_nosec+0x13a/0x180 [ 610.808445][T23133] ____sys_sendmsg+0x54e/0x850 [ 610.808474][T23133] ? __pfx_____sys_sendmsg+0x10/0x10 [ 610.808509][T23133] ? import_iovec+0x73/0xa0 [ 610.808535][T23133] ___sys_sendmsg+0x2a5/0x360 [ 610.808558][T23133] ? __lock_acquire+0x683/0x2cf0 [ 610.808594][T23133] ? __pfx____sys_sendmsg+0x10/0x10 [ 610.808657][T23133] ? __fget_files+0x2a/0x420 [ 610.808686][T23133] ? __fget_files+0x3a2/0x420 [ 610.808727][T23133] __x64_sys_sendmsg+0x1b1/0x290 [ 610.808757][T23133] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 610.808802][T23133] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.808826][T23133] do_syscall_64+0x174/0x580 [ 610.808855][T23133] ? trace_irq_disable+0x3b/0x140 [ 610.808885][T23133] ? clear_bhb_loop+0x40/0x90 [ 610.808913][T23133] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.808935][T23133] RIP: 0033:0x7fb6da39e0d9 [ 610.808957][T23133] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.808977][T23133] RSP: 002b:00007fb6db18c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 610.809006][T23133] RAX: ffffffffffffffda RBX: 00007fb6da625fa0 RCX: 00007fb6da39e0d9 [ 610.809022][T23133] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000020 [ 610.809037][T23133] RBP: 00007fb6db18c090 R08: 0000000000000000 R09: 0000000000000000 [ 610.809050][T23133] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.809063][T23133] R13: 00007fb6da626038 R14: 00007fb6da625fa0 R15: 00007ffe8d241b18 [ 610.809099][T23133] [ 611.772384][T23168] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6099'. [ 612.234163][T23189] netlink: 72 bytes leftover after parsing attributes in process `syz.2.6104'. [ 612.404850][T23199] No such timeout policy "s" [ 612.409970][T23201] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6106'. [ 612.627807][T23192] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.6107'. [ 612.652032][T23199] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.6107'. [ 612.866376][T23222] netlink: 'syz.3.6116': attribute type 1 has an invalid length. [ 612.909444][T23222] 8021q: adding VLAN 0 to HW filter on device bond20 [ 612.998827][T23222] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6116'. [ 613.040222][T23233] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6118'. [ 613.850594][T23267] netlink: 'syz.2.6130': attribute type 1 has an invalid length. [ 613.887688][T23267] 8021q: adding VLAN 0 to HW filter on device bond27 [ 614.136577][T23281] Bluetooth: MGMT ver 1.23 [ 614.141504][T23281] Bluetooth: hci1: too big key_count value 53001 [ 614.809457][T23302] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.823130][T23302] bridge0: entered promiscuous mode [ 615.113480][T23308] __nla_validate_parse: 2 callbacks suppressed [ 615.113502][T23308] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6144'. [ 615.165470][ T1011] net_ratelimit: 83 callbacks suppressed [ 615.165495][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 615.215004][ T48] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 615.220868][T23305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6141'. [ 615.256148][T23315] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6143'. [ 615.354686][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.439623][ T1124] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.480242][T23305] bond28: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 615.536637][T23305] bond28 (unregistering): Released all slaves [ 615.628078][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 615.706417][ T1124] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 615.839069][ T1124] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 615.867900][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 615.954480][ T48] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 615.986840][ T1124] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.017068][T23344] bridge0: port 1(gretap0) entered blocking state [ 616.023905][T23344] bridge0: port 1(gretap0) entered listening state [ 616.348173][T23361] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6158'. [ 616.843803][T23382] syzkaller0: entered promiscuous mode [ 616.849483][T23382] syzkaller0: entered allmulticast mode [ 616.860735][T23384] bridge0: port 1(gretap0) entered disabled state [ 616.886493][T23384] bridge0: entered promiscuous mode [ 616.901962][T23384] bridge0: entered allmulticast mode [ 616.935808][T23390] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 616.948656][T23390] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 617.010281][T23392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6169'. [ 617.194768][ T50] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 617.202882][ T50] Bluetooth: hci2: command 0x0406 tx timeout [ 619.472953][T23409] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6174'. [ 619.718470][T23428] tipc: Failed to remove unknown binding: 66,1,1/133285077:121829109/121829111 [ 619.845437][T23431] FAULT_INJECTION: forcing a failure. [ 619.845437][T23431] name failslab, interval 1, probability 0, space 0, times 0 [ 619.885792][T23432] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6179'. [ 619.897515][T23431] CPU: 0 UID: 0 PID: 23431 Comm: syz.3.6180 Not tainted syzkaller #0 PREEMPT(full) [ 619.897545][T23431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 619.897557][T23431] Call Trace: [ 619.897565][T23431] [ 619.897575][T23431] dump_stack_lvl+0xe8/0x150 [ 619.897614][T23431] should_fail_ex+0x40c/0x560 [ 619.897648][T23431] should_failslab+0xa8/0x100 [ 619.897693][T23431] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 619.897721][T23431] ? local_lock_release+0x9c/0x160 [ 619.897744][T23431] ? __alloc_skb+0x1d7/0x7a0 [ 619.897761][T23431] ? __alloc_skb+0x1d7/0x7a0 [ 619.897788][T23431] __alloc_skb+0x1d7/0x7a0 [ 619.897815][T23431] pep_alloc_skb+0x33/0x370 [ 619.897981][T23431] ? do_raw_spin_lock+0x12b/0x2f0 [ 619.898006][T23431] ? lock_sock_nested+0x6a/0x100 [ 619.898040][T23431] pep_sock_connect+0x121/0x4e0 [ 619.898075][T23431] ? __pfx_pep_sock_connect+0x10/0x10 [ 619.898106][T23431] ? pn_socket_connect+0x29a/0xba0 [ 619.898137][T23431] ? __local_bh_enable_ip+0xd0/0x130 [ 619.898169][T23431] pn_socket_connect+0x445/0xba0 [ 619.898210][T23431] ? __pfx_pn_socket_connect+0x10/0x10 [ 619.898239][T23431] ? __pfx_aa_sk_perm+0x10/0x10 [ 619.898263][T23431] ? tomoyo_socket_connect_permission+0x199/0x270 [ 619.898291][T23431] ? hook_socket_connect+0x1f1/0x470 [ 619.898322][T23431] ? bpf_lsm_socket_connect+0x9/0x20 [ 619.898350][T23431] __sys_connect+0x323/0x460 [ 619.898376][T23431] ? __pfx___sys_connect+0x10/0x10 [ 619.898411][T23431] ? __pfx_ksys_write+0x10/0x10 [ 619.898438][T23431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.898461][T23431] __x64_sys_connect+0x7a/0x90 [ 619.898485][T23431] do_syscall_64+0x174/0x580 [ 619.898510][T23431] ? trace_irq_disable+0x3b/0x140 [ 619.898543][T23431] ? clear_bhb_loop+0x40/0x90 [ 619.898570][T23431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.898591][T23431] RIP: 0033:0x7f325599e0d9 [ 619.898612][T23431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 619.898631][T23431] RSP: 002b:00007f32567b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 619.898654][T23431] RAX: ffffffffffffffda RBX: 00007f3255c25fa0 RCX: 00007f325599e0d9 [ 619.898678][T23431] RDX: 0000000000000010 RSI: 0000200000000040 RDI: 0000000000000003 [ 619.898692][T23431] RBP: 00007f32567b0090 R08: 0000000000000000 R09: 0000000000000000 [ 619.898705][T23431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 619.898718][T23431] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 619.898753][T23431] [ 620.162656][T23436] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6179'. [ 620.171962][T23436] bridge0: port 2(bridge_slave_1) entered blocking state [ 620.179180][T23436] bridge0: port 2(bridge_slave_1) entered listening state [ 620.187029][T23436] bridge0: left promiscuous mode [ 620.194165][T23436] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6179'. [ 620.210228][ T3377] net_ratelimit: 38 callbacks suppressed [ 620.210247][ T3377] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.268470][T23436] bridge0: port 2(bridge_slave_1) entered disabled state [ 620.305881][ T48] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 620.313887][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 620.554916][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.568342][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.662332][T23444] syzkaller0: entered promiscuous mode [ 620.675429][T23444] syzkaller0: entered allmulticast mode [ 620.700123][ T3377] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 620.709422][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 620.767884][ T1124] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.781882][ T1124] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 621.064150][T23478] netlink: set zone limit has 4 unknown bytes [ 621.597398][T23495] netlink: 144 bytes leftover after parsing attributes in process `syz.4.6199'. [ 623.619366][T23508] xt_TPROXY: Can be used only with -p tcp or -p udp [ 623.879505][T23521] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6207'. [ 624.399385][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.620370][T23565] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6222'. [ 624.655499][T23566] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6222'. [ 624.786733][T23572] netlink: 'syz.3.6224': attribute type 3 has an invalid length. [ 624.818122][T23572] netlink: 666 bytes leftover after parsing attributes in process `syz.3.6224'. [ 625.312189][ T3377] net_ratelimit: 45 callbacks suppressed [ 625.312213][ T3377] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.343553][T23602] bond29: option fail_over_mac: invalid value (16) [ 625.355811][T18767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.385406][ T3377] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.398573][T23606] sctp: [Deprecated]: syz.0.6235 (pid 23606) Use of int in maxseg socket option. [ 625.398573][T23606] Use struct sctp_assoc_value instead [ 625.415818][T23602] bond29 (unregistering): Released all slaves [ 625.602209][T18767] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 625.622953][T23612] netlink: 'syz.2.6238': attribute type 3 has an invalid length. [ 625.631200][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 625.754745][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 625.787443][T23619] netlink: 'syz.0.6241': attribute type 24 has an invalid length. [ 625.810952][T23613] syzkaller0: entered promiscuous mode [ 625.817050][T23613] syzkaller0: entered allmulticast mode [ 625.830433][T23619] sctp: [Deprecated]: syz.0.6241 (pid 23619) Use of int in maxseg socket option. [ 625.830433][T23619] Use struct sctp_assoc_value instead [ 625.847319][ T3377] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 625.952833][T23616] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 626.009864][T23616] block nbd0: Unsupported socket: should be TCP or UNIX. [ 626.337606][T18767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 626.520661][ T3373] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.531311][T23695] netlink: 'syz.2.6260': attribute type 1 has an invalid length. [ 629.572013][T23695] bond29: entered promiscuous mode [ 629.580135][T23695] 8021q: adding VLAN 0 to HW filter on device bond29 [ 629.631127][T23695] macvtap2: entered allmulticast mode [ 629.665338][T23695] macvtap3: entered allmulticast mode [ 629.770560][T23688] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6257'. [ 630.315286][ T13] net_ratelimit: 33 callbacks suppressed [ 630.315308][ T13] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 630.370957][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 630.457087][T18767] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 630.497194][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 630.549118][T23718] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6268'. [ 630.562397][T23718] netlink: 19 bytes leftover after parsing attributes in process `syz.1.6268'. [ 630.695139][T18767] bond8: (slave ip6gretap2): failed to get link speed/duplex [ 630.735685][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 630.768613][T23728] netlink: 'syz.4.6271': attribute type 1 has an invalid length. [ 630.783328][T23727] netlink: 'syz.3.6270': attribute type 32 has an invalid length. [ 630.798761][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.831820][T23727] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6270'. [ 630.906336][T23736] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 630.932468][T23728] bond13: entered promiscuous mode [ 630.951460][T23728] 8021q: adding VLAN 0 to HW filter on device bond13 [ 630.964800][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.973784][T18767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 631.066843][T23732] macvtap1: entered allmulticast mode [ 631.161706][T23727] bond22: option coupled_control: invalid value (192) [ 631.184200][T23727] bond22 (unregistering): Released all slaves [ 631.277467][T23739] macvtap2: entered allmulticast mode [ 631.341466][T23759] netlink: 'syz.0.6279': attribute type 10 has an invalid length. [ 631.452467][T23763] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 631.503230][T23763] xt_l2tp: wrong L2TP version: 0 [ 631.516675][T23766] netlink: 'syz.3.6282': attribute type 33 has an invalid length. [ 631.718853][T23777] FAULT_INJECTION: forcing a failure. [ 631.718853][T23777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 631.735440][T23777] CPU: 1 UID: 0 PID: 23777 Comm: syz.1.6287 Not tainted syzkaller #0 PREEMPT(full) [ 631.735469][T23777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 631.735482][T23777] Call Trace: [ 631.735491][T23777] [ 631.735500][T23777] dump_stack_lvl+0xe8/0x150 [ 631.735543][T23777] should_fail_ex+0x40c/0x560 [ 631.735580][T23777] _copy_to_user+0x31/0xb0 [ 631.735605][T23777] simple_read_from_buffer+0xe1/0x170 [ 631.735643][T23777] proc_fail_nth_read+0x1bb/0x230 [ 631.735679][T23777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 631.735715][T23777] ? rw_verify_area+0x24a/0x4c0 [ 631.735739][T23777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 631.735770][T23777] vfs_read+0x213/0xa80 [ 631.735797][T23777] ? __pfx___mutex_lock+0x10/0x10 [ 631.735829][T23777] ? __pfx_vfs_read+0x10/0x10 [ 631.735852][T23777] ? __fget_files+0x2a/0x420 [ 631.735888][T23777] ? __fget_files+0x3a2/0x420 [ 631.735915][T23777] ? __fget_files+0x2a/0x420 [ 631.735968][T23777] ksys_read+0x150/0x270 [ 631.735991][T23777] ? __pfx_ksys_read+0x10/0x10 [ 631.736020][T23777] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 631.736045][T23777] do_syscall_64+0x174/0x580 [ 631.736070][T23777] ? trace_irq_disable+0x3b/0x140 [ 631.736099][T23777] ? clear_bhb_loop+0x40/0x90 [ 631.736127][T23777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 631.736148][T23777] RIP: 0033:0x7fbfc2f5e90e [ 631.736169][T23777] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 631.736187][T23777] RSP: 002b:00007fbfc3f00fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 631.736210][T23777] RAX: ffffffffffffffda RBX: 00007fbfc3f016c0 RCX: 00007fbfc2f5e90e [ 631.736227][T23777] RDX: 000000000000000f RSI: 00007fbfc3f010a0 RDI: 0000000000000004 [ 631.736241][T23777] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 631.736254][T23777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 631.736267][T23777] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 631.736303][T23777] [ 631.975680][T23779] netlink: 'syz.2.6288': attribute type 21 has an invalid length. [ 631.983665][T23779] netlink: 156 bytes leftover after parsing attributes in process `syz.2.6288'. [ 632.109530][T23781] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6289'. [ 632.222983][T23788] netlink: 'syz.2.6290': attribute type 1 has an invalid length. [ 632.372931][T23788] bond30: entered promiscuous mode [ 632.378710][T23788] 8021q: adding VLAN 0 to HW filter on device bond30 [ 632.424035][T23794] macvtap4: entered allmulticast mode [ 632.538080][T23799] macvtap5: entered allmulticast mode [ 632.552849][T23790] syzkaller0: entered promiscuous mode [ 632.559059][T23810] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6298'. [ 632.569789][T23790] syzkaller0: entered allmulticast mode [ 632.690731][T23813] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6300'. [ 633.007884][T23832] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6307'. [ 633.200716][T23839] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6310'. [ 633.237239][T23841] netlink: 'syz.0.6311': attribute type 1 has an invalid length. [ 633.309414][T23841] bond23: entered promiscuous mode [ 633.331902][T23841] 8021q: adding VLAN 0 to HW filter on device bond23 [ 633.360662][T23848] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 633.402553][T23847] macvtap0: entered allmulticast mode [ 633.488575][T23841] macvtap3: entered allmulticast mode [ 634.345270][T23882] netlink: 'syz.1.6324': attribute type 1 has an invalid length. [ 634.405631][T23882] bond29: entered promiscuous mode [ 634.411454][T23882] 8021q: adding VLAN 0 to HW filter on device bond29 [ 634.464112][T23889] netlink: 'syz.2.6327': attribute type 1 has an invalid length. [ 634.508948][T23889] bond31: entered promiscuous mode [ 634.514821][T23889] 8021q: adding VLAN 0 to HW filter on device bond31 [ 634.562220][T23882] 8021q: adding VLAN 0 to HW filter on device bond29 [ 634.576188][T23882] bond29: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 634.607237][T23882] bond29: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 634.622897][T23882] bond29: (slave ip6gre2): making interface the new active one [ 634.631358][T23882] ip6gre2: entered promiscuous mode [ 634.644032][T23882] bond29: (slave ip6gre2): Enslaving as an active interface with an up link [ 634.674731][T23889] macvtap6: entered allmulticast mode [ 634.696266][T23891] macvtap7: entered allmulticast mode [ 634.751368][T23893] bond5: (slave veth0_to_bond): Releasing active interface [ 634.778293][T23893] veth7: entered promiscuous mode [ 634.898486][T23893] bond5: (slave veth7): Releasing active interface [ 634.916559][T23893] veth7: left promiscuous mode [ 634.941532][T23893] bond6: (slave bridge2): Releasing active interface [ 634.959044][T23893] bridge2: left allmulticast mode [ 634.984304][T23893] bond7: (slave bridge3): Releasing backup interface [ 635.036583][T23893] bridge3: left allmulticast mode [ 635.076766][T23893] bond8: (slave ip6gretap2): Removing an active aggregator [ 635.096893][T23893] bond8: (slave ip6gretap2): Releasing backup interface [ 635.123893][T23893] mac80211_hwsim hwsim14 wlan1: left allmulticast mode [ 635.139361][T23893] mac80211_hwsim hwsim14 wlan1: left promiscuous mode [ 635.148760][T23893] bridge0: port 1(wlan1) entered disabled state [ 635.162472][T23893] bond9: (slave bridge4): Releasing backup interface [ 635.207167][T23893] bond10: (slave bridge5): Releasing backup interface [ 635.230594][T23893] bridge5: left allmulticast mode [ 635.301650][T23893] bond14: (slave bridge9): Releasing backup interface [ 635.313686][T23893] bridge9: left allmulticast mode [ 635.323587][T23920] FAULT_INJECTION: forcing a failure. [ 635.323587][T23920] name failslab, interval 1, probability 0, space 0, times 0 [ 635.338160][T23920] CPU: 0 UID: 0 PID: 23920 Comm: syz.0.6338 Not tainted syzkaller #0 PREEMPT(full) [ 635.338190][T23920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 635.338205][T23920] Call Trace: [ 635.338215][T23920] [ 635.338225][T23920] dump_stack_lvl+0xe8/0x150 [ 635.338263][T23920] should_fail_ex+0x40c/0x560 [ 635.338298][T23920] should_failslab+0xa8/0x100 [ 635.338334][T23920] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 635.338362][T23920] ? local_lock_release+0x9c/0x160 [ 635.338387][T23920] ? __alloc_skb+0x1d7/0x7a0 [ 635.338406][T23920] ? __alloc_skb+0x1d7/0x7a0 [ 635.338434][T23920] __alloc_skb+0x1d7/0x7a0 [ 635.338460][T23920] netlink_sendmsg+0x5d4/0xb40 [ 635.338500][T23920] ? __pfx_netlink_sendmsg+0x10/0x10 [ 635.338531][T23920] ? aa_sock_msg_perm+0xf1/0x1b0 [ 635.338563][T23920] ? __pfx_netlink_sendmsg+0x10/0x10 [ 635.338587][T23920] sock_sendmsg_nosec+0x13a/0x180 [ 635.338621][T23920] ____sys_sendmsg+0x54e/0x850 [ 635.338653][T23920] ? __pfx_____sys_sendmsg+0x10/0x10 [ 635.338687][T23920] ? import_iovec+0x73/0xa0 [ 635.338713][T23920] ___sys_sendmsg+0x2a5/0x360 [ 635.338735][T23920] ? __lock_acquire+0x683/0x2cf0 [ 635.338772][T23920] ? __pfx____sys_sendmsg+0x10/0x10 [ 635.338836][T23920] ? __fget_files+0x2a/0x420 [ 635.338864][T23920] ? __fget_files+0x3a2/0x420 [ 635.338905][T23920] __x64_sys_sendmsg+0x1b1/0x290 [ 635.338933][T23920] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 635.338988][T23920] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.339012][T23920] do_syscall_64+0x174/0x580 [ 635.339039][T23920] ? trace_irq_disable+0x3b/0x140 [ 635.339068][T23920] ? clear_bhb_loop+0x40/0x90 [ 635.339094][T23920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.339116][T23920] RIP: 0033:0x7ff83f99e0d9 [ 635.339136][T23920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 635.339156][T23920] RSP: 002b:00007ff83dbf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 635.339180][T23920] RAX: ffffffffffffffda RBX: 00007ff83fc25fa0 RCX: 00007ff83f99e0d9 [ 635.339196][T23920] RDX: 0000000030000040 RSI: 0000200000000000 RDI: 0000000000000003 [ 635.339210][T23920] RBP: 00007ff83dbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 635.339224][T23920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 635.339237][T23920] R13: 00007ff83fc26038 R14: 00007ff83fc25fa0 R15: 00007ffe41f996f8 [ 635.339272][T23920] [ 635.613729][T23893] bond15: (slave gretap2): Releasing active interface [ 635.666904][T23899] __nla_validate_parse: 3 callbacks suppressed [ 635.666925][T23899] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6330'. [ 635.720324][T23907] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6335'. [ 635.809141][ T1011] net_ratelimit: 62 callbacks suppressed [ 635.809161][ T1011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.842890][ T1011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.935933][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 635.952821][T23933] netlink: 'syz.0.6342': attribute type 1 has an invalid length. [ 636.093670][T23933] bond24: entered promiscuous mode [ 636.109666][T23933] 8021q: adding VLAN 0 to HW filter on device bond24 [ 636.154869][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.199879][T23937] macvtap4: entered allmulticast mode [ 636.252241][T23941] macvtap5: entered allmulticast mode [ 636.291877][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 636.363119][T23951] FAULT_INJECTION: forcing a failure. [ 636.363119][T23951] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 636.404089][T23953] FAULT_INJECTION: forcing a failure. [ 636.404089][T23953] name failslab, interval 1, probability 0, space 0, times 0 [ 636.413157][T23951] CPU: 1 UID: 0 PID: 23951 Comm: syz.1.6349 Not tainted syzkaller #0 PREEMPT(full) [ 636.413232][T23951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 636.413273][T23951] Call Trace: [ 636.413302][T23951] [ 636.413324][T23951] dump_stack_lvl+0xe8/0x150 [ 636.413421][T23951] should_fail_ex+0x40c/0x560 [ 636.413511][T23951] _copy_from_iter+0x1d3/0x1660 [ 636.413586][T23951] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 636.413668][T23951] ? rcu_is_watching+0x15/0xb0 [ 636.413730][T23951] ? trace_kmem_cache_alloc+0x29/0xe0 [ 636.413812][T23951] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 636.413888][T23951] ? __pfx__copy_from_iter+0x10/0x10 [ 636.413982][T23951] ? __alloc_skb+0x276/0x7a0 [ 636.414061][T23951] ? __alloc_skb+0x276/0x7a0 [ 636.414139][T23951] ? netlink_sendmsg+0x650/0xb40 [ 636.414203][T23951] ? skb_put+0x112/0x210 [ 636.414273][T23951] netlink_sendmsg+0x6c0/0xb40 [ 636.414415][T23951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 636.414542][T23951] ? aa_sock_msg_perm+0xf1/0x1b0 [ 636.414643][T23951] ? __pfx_netlink_sendmsg+0x10/0x10 [ 636.414715][T23951] sock_sendmsg_nosec+0x13a/0x180 [ 636.414821][T23951] ____sys_sendmsg+0x54e/0x850 [ 636.414853][T23951] ? __pfx_____sys_sendmsg+0x10/0x10 [ 636.414948][T23951] ? import_iovec+0x73/0xa0 [ 636.415026][T23951] ___sys_sendmsg+0x2a5/0x360 [ 636.415094][T23951] ? __lock_acquire+0x683/0x2cf0 [ 636.415193][T23951] ? __pfx____sys_sendmsg+0x10/0x10 [ 636.415409][T23951] ? __fget_files+0x2a/0x420 [ 636.415515][T23951] ? __fget_files+0x3a2/0x420 [ 636.415637][T23951] __x64_sys_sendmsg+0x1b1/0x290 [ 636.415724][T23951] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 636.415849][T23951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.415920][T23951] do_syscall_64+0x174/0x580 [ 636.416001][T23951] ? trace_irq_disable+0x3b/0x140 [ 636.416090][T23951] ? clear_bhb_loop+0x40/0x90 [ 636.416170][T23951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.416236][T23951] RIP: 0033:0x7fbfc2f9e0d9 [ 636.416295][T23951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.416370][T23951] RSP: 002b:00007fbfc3f01028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 636.416439][T23951] RAX: ffffffffffffffda RBX: 00007fbfc3225fa0 RCX: 00007fbfc2f9e0d9 [ 636.416486][T23951] RDX: 0000000030000040 RSI: 0000200000000000 RDI: 0000000000000003 [ 636.416531][T23951] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 636.416567][T23951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 636.416612][T23951] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 636.416707][T23951] [ 636.418702][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 636.607040][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 636.615472][ T1011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 636.744033][T23953] CPU: 0 UID: 0 PID: 23953 Comm: syz.4.6350 Not tainted syzkaller #0 PREEMPT(full) [ 636.744065][T23953] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 636.744079][T23953] Call Trace: [ 636.744089][T23953] [ 636.744099][T23953] dump_stack_lvl+0xe8/0x150 [ 636.744142][T23953] should_fail_ex+0x40c/0x560 [ 636.744181][T23953] should_failslab+0xa8/0x100 [ 636.744223][T23953] __kmalloc_noprof+0xfe/0x720 [ 636.744258][T23953] ? tomoyo_encode+0x2ad/0x570 [ 636.744285][T23953] ? tomoyo_encode+0x2ad/0x570 [ 636.744323][T23953] tomoyo_encode+0x2ad/0x570 [ 636.744363][T23953] tomoyo_realpath_from_path+0x5fa/0x640 [ 636.744407][T23953] ? tomoyo_path_number_perm+0x219/0x5f0 [ 636.744446][T23953] tomoyo_path_number_perm+0x246/0x5f0 [ 636.744488][T23953] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 636.744525][T23953] ? __lock_acquire+0x683/0x2cf0 [ 636.744579][T23953] ? hook_file_ioctl+0x1f0/0x5f0 [ 636.744630][T23953] ? __fget_files+0x2a/0x420 [ 636.744666][T23953] ? __fget_files+0x2a/0x420 [ 636.744698][T23953] ? __fget_files+0x3a2/0x420 [ 636.744729][T23953] ? __fget_files+0x2a/0x420 [ 636.744769][T23953] security_file_ioctl+0xc3/0x2a0 [ 636.744816][T23953] __se_sys_ioctl+0x47/0x170 [ 636.744842][T23953] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.744869][T23953] do_syscall_64+0x174/0x580 [ 636.744898][T23953] ? trace_irq_disable+0x3b/0x140 [ 636.744931][T23953] ? clear_bhb_loop+0x40/0x90 [ 636.744960][T23953] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 636.744985][T23953] RIP: 0033:0x7f75e779e0d9 [ 636.745008][T23953] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.745029][T23953] RSP: 002b:00007f75e86a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 636.745054][T23953] RAX: ffffffffffffffda RBX: 00007f75e7a25fa0 RCX: 00007f75e779e0d9 [ 636.745072][T23953] RDX: 0000200000000000 RSI: 0000000000008955 RDI: 0000000000000003 [ 636.745088][T23953] RBP: 00007f75e86a1090 R08: 0000000000000000 R09: 0000000000000000 [ 636.745103][T23953] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 636.745117][T23953] R13: 00007f75e7a26038 R14: 00007f75e7a25fa0 R15: 00007ffeb0d35578 [ 636.745158][T23953] [ 636.985696][T23960] openvswitch: netlink: IP tunnel attribute has 5417 unknown bytes. [ 637.001709][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 637.032165][T23953] ERROR: Out of memory at tomoyo_realpath_from_path. [ 637.127171][T23963] netlink: 120 bytes leftover after parsing attributes in process `syz.1.6355'. [ 637.231223][T23964] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6354'. [ 637.386664][T23970] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6359'. [ 637.462139][T23977] netlink: 'syz.0.6362': attribute type 4 has an invalid length. [ 637.470233][T23977] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6362'. [ 637.499217][T23978] netlink: 'syz.2.6361': attribute type 1 has an invalid length. [ 637.544868][T23978] bond32: entered promiscuous mode [ 637.552086][T23978] 8021q: adding VLAN 0 to HW filter on device bond32 [ 637.681968][T23978] macvtap8: entered allmulticast mode [ 637.718860][T23990] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6366'. [ 637.746785][T23989] macvtap9: entered allmulticast mode [ 637.997081][T24008] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6371'. [ 638.343154][T24025] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6373'. [ 638.472716][T24029] netlink: 'syz.3.6379': attribute type 49 has an invalid length. [ 638.697318][T24029] ip6gretap0: entered promiscuous mode [ 638.705846][T24029] ip6gretap0: entered allmulticast mode [ 638.744912][T24040] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6383'. [ 638.965696][T24048] netlink: 'syz.3.6387': attribute type 1 has an invalid length. [ 639.160221][T24048] veth11: entered promiscuous mode [ 639.182955][T24048] bond22: (slave veth11): Enslaving as a backup interface with a down link [ 639.300382][T24061] 8021q: adding VLAN 0 to HW filter on device bond22 [ 639.778027][T24085] FAULT_INJECTION: forcing a failure. [ 639.778027][T24085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 639.818114][T24085] CPU: 0 UID: 0 PID: 24085 Comm: syz.3.6398 Not tainted syzkaller #0 PREEMPT(full) [ 639.818154][T24085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 639.818167][T24085] Call Trace: [ 639.818176][T24085] [ 639.818186][T24085] dump_stack_lvl+0xe8/0x150 [ 639.818225][T24085] should_fail_ex+0x40c/0x560 [ 639.818260][T24085] _copy_from_user+0x2d/0xb0 [ 639.818282][T24085] kstrtouint_from_user+0xd6/0x180 [ 639.818316][T24085] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 639.818364][T24085] proc_fail_nth_write+0x8e/0x210 [ 639.818396][T24085] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 639.818437][T24085] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 639.818468][T24085] vfs_write+0x296/0xba0 [ 639.818500][T24085] ? __pfx_vfs_write+0x10/0x10 [ 639.818530][T24085] ? __fget_files+0x2a/0x420 [ 639.818566][T24085] ? __fget_files+0x3a2/0x420 [ 639.818594][T24085] ? __fget_files+0x2a/0x420 [ 639.818633][T24085] ksys_write+0x150/0x270 [ 639.818659][T24085] ? __pfx_ksys_write+0x10/0x10 [ 639.818690][T24085] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.818714][T24085] do_syscall_64+0x174/0x580 [ 639.818740][T24085] ? trace_irq_disable+0x3b/0x140 [ 639.818770][T24085] ? clear_bhb_loop+0x40/0x90 [ 639.818797][T24085] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 639.818819][T24085] RIP: 0033:0x7f325595e90e [ 639.818839][T24085] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 639.818858][T24085] RSP: 002b:00007f32567affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 639.818881][T24085] RAX: ffffffffffffffda RBX: 00007f32567b06c0 RCX: 00007f325595e90e [ 639.818898][T24085] RDX: 0000000000000001 RSI: 00007f32567b00a0 RDI: 0000000000000004 [ 639.818912][T24085] RBP: 00007f32567b0090 R08: 0000000000000000 R09: 0000000000000000 [ 639.818925][T24085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 639.818938][T24085] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 639.818975][T24085] [ 640.261095][T24102] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 640.906016][ T3373] net_ratelimit: 39 callbacks suppressed [ 640.906064][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 640.929876][T24130] __nla_validate_parse: 4 callbacks suppressed [ 640.929897][T24130] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6412'. [ 640.962933][T24134] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6411'. [ 641.037544][ T3373] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.124593][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 641.246214][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 641.354780][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.368049][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 641.468807][T24148] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6416'. [ 641.492104][T24148] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6416'. [ 641.584204][T24155] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6418'. [ 641.627166][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 641.756527][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 641.837196][ T1011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 641.905220][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 642.051018][T24172] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6423'. [ 642.158669][T20332] Bluetooth: hci4: command 0x0405 tx timeout [ 642.169964][T24181] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6424'. [ 642.452427][T24194] netlink: 35 bytes leftover after parsing attributes in process `syz.1.6429'. [ 642.599103][T24203] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6429'. [ 642.887031][T24215] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6438'. [ 643.318158][T24239] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 643.942619][T24265] 8021q: adding VLAN 0 to HW filter on device bond14 [ 644.238316][T24284] bond22: (slave veth0_to_bond): Releasing backup interface [ 644.275055][T24284] bond0: (slave bond_slave_0): Releasing backup interface [ 644.320515][T24284] bond0: (slave bond_slave_1): Releasing backup interface [ 644.398878][T24284] team0: Port device team_slave_1 removed [ 644.428527][T24284] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 644.464245][T24284] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 645.231826][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.268221][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.338189][T24324] x_tables: duplicate underflow at hook 1 [ 646.004556][ T1011] net_ratelimit: 54 callbacks suppressed [ 646.004579][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 646.136884][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 646.259382][T24375] syzkaller0: entered promiscuous mode [ 646.271706][T24375] syzkaller0: entered allmulticast mode [ 646.367479][ T1011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.392554][ T1011] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.414205][T24382] sctp: [Deprecated]: syz.4.6495 (pid 24382) Use of struct sctp_assoc_value in delayed_ack socket option. [ 646.414205][T24382] Use struct sctp_sack_info instead [ 646.546265][ T1011] bond7: (slave bridge5): failed to get link speed/duplex [ 646.555077][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.677049][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 646.795128][ T1124] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 646.817091][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 646.938016][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 647.061757][T24415] netlink: 'syz.1.6504': attribute type 1 has an invalid length. [ 647.205657][T24423] __nla_validate_parse: 10 callbacks suppressed [ 647.205677][T24423] netlink: 172 bytes leftover after parsing attributes in process `syz.2.6508'. [ 647.234049][T24415] bond30: entered promiscuous mode [ 647.239949][T24415] 8021q: adding VLAN 0 to HW filter on device bond30 [ 647.316816][T24418] macvtap2: entered allmulticast mode [ 647.322477][T24415] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6504'. [ 647.388624][T24427] macvtap3: entered allmulticast mode [ 647.862965][T24450] netlink: 148 bytes leftover after parsing attributes in process `syz.3.6513'. [ 647.891085][T24451] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6516'. [ 647.942185][T24455] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6518'. [ 647.963941][T24447] netlink: 'syz.0.6515': attribute type 13 has an invalid length. [ 647.988593][T24447] gretap0: refused to change device tx_queue_len [ 648.270606][T24458] netlink: 'syz.4.6517': attribute type 10 has an invalid length. [ 648.309960][T24458] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6517'. [ 648.336696][T24474] netlink: 256 bytes leftover after parsing attributes in process `syz.1.6522'. [ 648.693775][T24458] team0: Port device geneve1 added [ 649.045382][T24508] netlink: 'syz.3.6530': attribute type 3 has an invalid length. [ 649.318278][T24523] netlink: 'syz.3.6533': attribute type 7 has an invalid length. [ 649.761428][T24542] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6538'. [ 649.869944][T24555] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6544'. [ 649.889169][T24557] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6544'. [ 650.942297][T24625] netlink: 'syz.4.6565': attribute type 2 has an invalid length. [ 651.082866][T24625] : entered promiscuous mode [ 651.138505][T24634] net_ratelimit: 87 callbacks suppressed [ 651.138527][T24634] openvswitch: netlink: Tunnel attr 32 out of range max 16 [ 651.186077][T24611] bridge3: left promiscuous mode [ 651.234091][T24611] bridge5: left promiscuous mode [ 651.290474][T24611] bridge9: left promiscuous mode [ 651.339815][T24611] 8021q: adding VLAN 0 to HW filter on device bond21 [ 651.358623][T24643] nbd: must specify at least one socket [ 651.370298][T24611] veth11: left promiscuous mode [ 651.520828][T24638] 8021q: adding VLAN 0 to HW filter on device bond25 [ 651.551693][T24645] team0: Device ipvlan0 failed to register rx_handler [ 651.577609][T24653] openvswitch: netlink: IP tunnel attribute has 5417 unknown bytes. [ 651.627959][T24657] netlink: 'syz.3.6575': attribute type 1 has an invalid length. [ 651.727609][T24657] 8021q: adding VLAN 0 to HW filter on device bond23 [ 651.817028][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 651.904064][T24668] netlink: 'syz.3.6575': attribute type 10 has an invalid length. [ 651.972218][T24660] bond23: (slave veth13): Enslaving as a backup interface with a down link [ 652.031879][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 652.194900][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 652.272612][T24681] __nla_validate_parse: 7 callbacks suppressed [ 652.272634][T24681] netlink: 212936 bytes leftover after parsing attributes in process `syz.1.6581'. [ 652.318161][T24681] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 652.328840][ T13] bond22: (slave veth11): link status definitely up, 10000 Mbps full duplex [ 652.362610][T24691] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 652.383342][ T13] bond22: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 652.419342][ T13] bond22: active interface up! [ 652.576182][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 652.706024][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 653.400381][T24735] FAULT_INJECTION: forcing a failure. [ 653.400381][T24735] name failslab, interval 1, probability 0, space 0, times 0 [ 653.456151][T24735] CPU: 1 UID: 0 PID: 24735 Comm: syz.1.6595 Not tainted syzkaller #0 PREEMPT(full) [ 653.456181][T24735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 653.456195][T24735] Call Trace: [ 653.456204][T24735] [ 653.456214][T24735] dump_stack_lvl+0xe8/0x150 [ 653.456253][T24735] should_fail_ex+0x40c/0x560 [ 653.456287][T24735] should_failslab+0xa8/0x100 [ 653.456322][T24735] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 653.456351][T24735] ? skb_clone+0x212/0x3a0 [ 653.456375][T24735] ? skb_clone+0x212/0x3a0 [ 653.456409][T24735] skb_clone+0x212/0x3a0 [ 653.456439][T24735] __netlink_deliver_tap+0x413/0x860 [ 653.456479][T24735] ? netlink_deliver_tap+0x2e/0x1b0 [ 653.456506][T24735] netlink_deliver_tap+0x19c/0x1b0 [ 653.456534][T24735] __netlink_sendskb+0x47/0x90 [ 653.456558][T24735] netlink_dump+0xa8c/0xee0 [ 653.456583][T24735] ? __netlink_lookup+0xc6/0x8b0 [ 653.456621][T24735] ? __pfx_netlink_dump+0x10/0x10 [ 653.456660][T24735] ? netlink_lookup+0x30/0x200 [ 653.456684][T24735] ? netlink_lookup+0x30/0x200 [ 653.456715][T24735] __netlink_dump_start+0x589/0x7b0 [ 653.456748][T24735] rtnetlink_rcv_msg+0xa48/0xc00 [ 653.456903][T24735] ? __pfx_rtnl_dump_all+0x10/0x10 [ 653.456925][T24735] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 653.456947][T24735] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 653.456967][T24735] ? ref_tracker_free+0x689/0x830 [ 653.456996][T24735] ? __pfx_rtnl_dumpit+0x10/0x10 [ 653.457017][T24735] ? __pfx_rtnl_dump_all+0x10/0x10 [ 653.457054][T24735] netlink_rcv_skb+0x226/0x4a0 [ 653.457081][T24735] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 653.457105][T24735] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 653.457152][T24735] ? netlink_deliver_tap+0x2e/0x1b0 [ 653.457177][T24735] ? netlink_deliver_tap+0x2e/0x1b0 [ 653.457209][T24735] netlink_unicast+0x7bb/0x940 [ 653.457245][T24735] netlink_sendmsg+0x813/0xb40 [ 653.457283][T24735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 653.457314][T24735] ? aa_sock_msg_perm+0xf1/0x1b0 [ 653.457346][T24735] ? __pfx_netlink_sendmsg+0x10/0x10 [ 653.457371][T24735] sock_sendmsg_nosec+0x13a/0x180 [ 653.457407][T24735] sock_write_iter+0x2de/0x3e0 [ 653.457439][T24735] ? __pfx_sock_write_iter+0x10/0x10 [ 653.457477][T24735] ? bpf_lsm_file_permission+0x9/0x20 [ 653.457503][T24735] ? security_file_permission+0x75/0x260 [ 653.457545][T24735] vfs_write+0x612/0xba0 [ 653.457577][T24735] ? __pfx_vfs_write+0x10/0x10 [ 653.457611][T24735] ? __fget_files+0x2a/0x420 [ 653.457651][T24735] ksys_write+0x150/0x270 [ 653.457677][T24735] ? __pfx_ksys_write+0x10/0x10 [ 653.457708][T24735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.457733][T24735] do_syscall_64+0x174/0x580 [ 653.457759][T24735] ? trace_irq_disable+0x3b/0x140 [ 653.457788][T24735] ? clear_bhb_loop+0x40/0x90 [ 653.457815][T24735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 653.457837][T24735] RIP: 0033:0x7fbfc2f9e0d9 [ 653.457858][T24735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 653.457878][T24735] RSP: 002b:00007fbfc3f01028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 653.457901][T24735] RAX: ffffffffffffffda RBX: 00007fbfc3225fa0 RCX: 00007fbfc2f9e0d9 [ 653.457917][T24735] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000005 [ 653.457931][T24735] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 653.457945][T24735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 653.457959][T24735] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 653.457995][T24735] [ 654.086590][T24755] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 654.093912][T24755] IPv6: NLM_F_CREATE should be set when creating new route [ 654.223136][T24759] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6602'. [ 654.292771][T24759] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6602'. [ 654.469509][T24778] FAULT_INJECTION: forcing a failure. [ 654.469509][T24778] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 654.518374][T24778] CPU: 1 UID: 0 PID: 24778 Comm: syz.0.6609 Not tainted syzkaller #0 PREEMPT(full) [ 654.518407][T24778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 654.518420][T24778] Call Trace: [ 654.518428][T24778] [ 654.518438][T24778] dump_stack_lvl+0xe8/0x150 [ 654.518477][T24778] should_fail_ex+0x40c/0x560 [ 654.518512][T24778] _copy_to_user+0x31/0xb0 [ 654.518535][T24778] simple_read_from_buffer+0xe1/0x170 [ 654.518572][T24778] proc_fail_nth_read+0x1bb/0x230 [ 654.518607][T24778] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 654.518642][T24778] ? rw_verify_area+0x24a/0x4c0 [ 654.518665][T24778] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 654.518693][T24778] vfs_read+0x213/0xa80 [ 654.518720][T24778] ? __pfx___mutex_lock+0x10/0x10 [ 654.518749][T24778] ? __pfx_vfs_read+0x10/0x10 [ 654.518771][T24778] ? __fget_files+0x2a/0x420 [ 654.518804][T24778] ? __fget_files+0x3a2/0x420 [ 654.518832][T24778] ? __fget_files+0x2a/0x420 [ 654.518872][T24778] ksys_read+0x150/0x270 [ 654.518895][T24778] ? __pfx_ksys_read+0x10/0x10 [ 654.518925][T24778] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.518949][T24778] do_syscall_64+0x174/0x580 [ 654.518982][T24778] ? trace_irq_disable+0x3b/0x140 [ 654.519011][T24778] ? clear_bhb_loop+0x40/0x90 [ 654.519038][T24778] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.519059][T24778] RIP: 0033:0x7ff83f95e90e [ 654.519079][T24778] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 654.519102][T24778] RSP: 002b:00007ff83dbf5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 654.519126][T24778] RAX: ffffffffffffffda RBX: 00007ff83dbf66c0 RCX: 00007ff83f95e90e [ 654.519142][T24778] RDX: 000000000000000f RSI: 00007ff83dbf60a0 RDI: 0000000000000006 [ 654.519156][T24778] RBP: 00007ff83dbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 654.519170][T24778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 654.519183][T24778] R13: 00007ff83fc26038 R14: 00007ff83fc25fa0 R15: 00007ffe41f996f8 [ 654.519218][T24778] [ 654.774655][T18767] bond23: (slave veth13): link status definitely up, 10000 Mbps full duplex [ 654.790529][T18767] bond23: active interface up! [ 655.129623][T24801] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6613'. [ 655.156571][T24801] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6613'. [ 655.378816][T24811] netlink: 'syz.3.6613': attribute type 83 has an invalid length. [ 656.226130][ T3373] net_ratelimit: 30 callbacks suppressed [ 656.226153][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 656.418853][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 656.535654][T24864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6630'. [ 656.574922][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 656.608071][T24870] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.6632'. [ 656.633895][T24870] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.6632'. [ 656.745655][ T3373] bond7: (slave bridge5): failed to get link speed/duplex [ 656.855409][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 656.880375][T24884] netlink: zone id is out of range [ 656.889012][T24884] netlink: set zone limit has 4 unknown bytes [ 657.003700][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 657.125291][ T1124] bond7: (slave bridge5): failed to get link speed/duplex [ 657.152371][T24892] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6638'. [ 657.234489][ T12] bond7: (slave bridge5): failed to get link speed/duplex [ 657.578785][T24914] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6645'. [ 657.626043][T24916] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6645'. [ 657.643621][T24921] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6644'. [ 657.673306][T24916] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6645'. [ 657.724083][T24920] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6645'. [ 657.745410][T24920] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6645'. [ 657.778957][T24920] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6645'. [ 657.829699][T24920] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6645'. [ 658.160824][T24945] IPv6: NLM_F_CREATE should be specified when creating new route [ 658.191926][T24945] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6651'. [ 658.222521][T24938] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6650'. [ 658.332506][T24945] netlink: 'syz.1.6651': attribute type 7 has an invalid length. [ 658.380371][T24945] netlink: 'syz.1.6651': attribute type 8 has an invalid length. [ 658.732871][T24964] bond24: entered promiscuous mode [ 658.766588][T24964] 8021q: adding VLAN 0 to HW filter on device bond24 [ 659.103760][T24989] xt_CT: You must specify a L4 protocol and not use inversions on it [ 659.291126][T24997] netlink: 'syz.1.6671': attribute type 1 has an invalid length. [ 659.466838][T24997] bond31: entered promiscuous mode [ 659.475561][T24997] 8021q: adding VLAN 0 to HW filter on device bond31 [ 659.516364][T25003] macvtap4: entered allmulticast mode [ 659.538704][T25006] macvtap5: entered allmulticast mode [ 659.708612][T25019] netlink: 'syz.2.6678': attribute type 1 has an invalid length. [ 659.883675][T25023] 8021q: adding VLAN 0 to HW filter on device ipvlan1 [ 660.821314][T25095] netlink: 'syz.4.6690': attribute type 1 has an invalid length. [ 660.943188][T25095] bond15: entered promiscuous mode [ 660.952205][T25095] 8021q: adding VLAN 0 to HW filter on device bond15 [ 661.031364][T25100] macvtap3: entered allmulticast mode [ 661.117447][T25102] macvtap4: entered allmulticast mode [ 661.281589][ T3377] net_ratelimit: 32 callbacks suppressed [ 661.281610][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 661.378243][T25122] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 661.588436][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 661.729075][T25126] tipc: Enabled bearer , priority 0 [ 661.776426][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 661.886277][T25123] syzkaller0: entered promiscuous mode [ 661.895294][T25123] syzkaller0: entered allmulticast mode [ 661.924802][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 662.031911][T25159] syzkaller0: entered promiscuous mode [ 662.056449][T25159] syzkaller0: entered allmulticast mode [ 662.083452][T25119] tipc: Resetting bearer [ 662.122924][T25163] openvswitch: netlink: Multiple metadata blocks provided [ 662.150600][T25119] tipc: Disabling bearer [ 662.227627][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 662.354486][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 662.484490][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 662.636043][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 662.750472][T25198] openvswitch: netlink: Multiple metadata blocks provided [ 662.950320][T25202] netlink: 'syz.1.6719': attribute type 16 has an invalid length. [ 662.962545][T25202] netlink: 'syz.1.6719': attribute type 17 has an invalid length. [ 663.070463][T25212] __nla_validate_parse: 15 callbacks suppressed [ 663.070483][T25212] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6723'. [ 663.205850][T25202] gretap1: left allmulticast mode [ 663.532002][T25237] netlink: 'syz.3.6727': attribute type 32 has an invalid length. [ 663.540832][T25237] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6727'. [ 663.679106][T25237] bond25: Setting coupled_control to off (0) [ 664.051606][T25261] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6732'. [ 664.121836][T25270] syzkaller0: entered promiscuous mode [ 664.128962][T25270] syzkaller0: entered allmulticast mode [ 664.401109][T25277] xt_hashlimit: size too large, truncated to 1048576 [ 664.510738][T25288] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6742'. [ 664.557284][T25285] netlink: 'syz.2.6741': attribute type 7 has an invalid length. [ 664.570312][T25290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6743'. [ 664.585091][T25284] netlink: 'syz.2.6741': attribute type 7 has an invalid length. [ 664.727608][T25303] netlink: 'syz.3.6743': attribute type 9 has an invalid length. [ 664.958764][T25308] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 664.969560][T25308] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 665.208114][T25322] netlink: 'syz.2.6751': attribute type 49 has an invalid length. [ 665.303110][T25326] syzkaller0: entered promiscuous mode [ 665.321819][T25326] syzkaller0: entered allmulticast mode [ 665.341080][T25331] netlink: 524 bytes leftover after parsing attributes in process `syz.2.6756'. [ 665.713276][T25349] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6759'. [ 665.810146][T25349] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6759'. [ 665.965874][T25349] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6759'. [ 666.001564][T25366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6765'. [ 666.308932][ T57] net_ratelimit: 23 callbacks suppressed [ 666.308954][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 666.477017][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 666.488255][T25386] netlink: 'syz.1.6772': attribute type 2 has an invalid length. [ 666.571867][T25391] FAULT_INJECTION: forcing a failure. [ 666.571867][T25391] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 666.614831][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 666.625607][T25391] CPU: 1 UID: 0 PID: 25391 Comm: syz.2.6774 Not tainted syzkaller #0 PREEMPT(full) [ 666.625656][T25391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 666.625671][T25391] Call Trace: [ 666.625679][T25391] [ 666.625687][T25391] dump_stack_lvl+0xe8/0x150 [ 666.625729][T25391] should_fail_ex+0x40c/0x560 [ 666.625763][T25391] _copy_from_user+0x2d/0xb0 [ 666.625785][T25391] ___sys_recvmsg+0x173/0x5a0 [ 666.625823][T25391] ? __pfx____sys_recvmsg+0x10/0x10 [ 666.625854][T25391] ? __fget_files+0x2a/0x420 [ 666.625902][T25391] ? __fget_files+0x3a2/0x420 [ 666.625942][T25391] do_recvmmsg+0x31a/0x7f0 [ 666.625978][T25391] ? __pfx_do_recvmmsg+0x10/0x10 [ 666.626002][T25391] ? clockevents_program_event+0x491/0x630 [ 666.626024][T25391] ? __hrtimer_rearm_deferred+0x99/0x420 [ 666.626078][T25391] __x64_sys_recvmmsg+0x198/0x250 [ 666.626107][T25391] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 666.626143][T25391] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.626166][T25391] do_syscall_64+0x174/0x580 [ 666.626192][T25391] ? trace_irq_disable+0x3b/0x140 [ 666.626221][T25391] ? clear_bhb_loop+0x40/0x90 [ 666.626248][T25391] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.626270][T25391] RIP: 0033:0x7fb6da39e0d9 [ 666.626290][T25391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 666.626309][T25391] RSP: 002b:00007fb6db18c028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 666.626332][T25391] RAX: ffffffffffffffda RBX: 00007fb6da625fa0 RCX: 00007fb6da39e0d9 [ 666.626347][T25391] RDX: 0000000000000001 RSI: 0000200000006300 RDI: 0000000000000003 [ 666.626361][T25391] RBP: 00007fb6db18c090 R08: 0000000000000000 R09: 0000000000000000 [ 666.626374][T25391] R10: 0000000000000060 R11: 0000000000000246 R12: 0000000000000001 [ 666.626388][T25391] R13: 00007fb6da626038 R14: 00007fb6da625fa0 R15: 00007ffe8d241b18 [ 666.626423][T25391] [ 667.018053][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 667.145071][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 667.254729][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 667.365263][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 667.485998][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 667.615146][ T13] bond7: (slave bridge5): failed to get link speed/duplex [ 667.746224][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 667.937732][T25458] FAULT_INJECTION: forcing a failure. [ 667.937732][T25458] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 667.968254][T25458] CPU: 0 UID: 0 PID: 25458 Comm: syz.1.6794 Not tainted syzkaller #0 PREEMPT(full) [ 667.968285][T25458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 667.968298][T25458] Call Trace: [ 667.968307][T25458] [ 667.968316][T25458] dump_stack_lvl+0xe8/0x150 [ 667.968357][T25458] should_fail_ex+0x40c/0x560 [ 667.968391][T25458] _copy_from_iter+0x1d3/0x1660 [ 667.968421][T25458] ? kmem_cache_alloc_node_noprof+0x121/0x610 [ 667.968451][T25458] ? rcu_is_watching+0x15/0xb0 [ 667.968473][T25458] ? trace_kmem_cache_alloc+0x29/0xe0 [ 667.968503][T25458] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 667.968530][T25458] ? __pfx__copy_from_iter+0x10/0x10 [ 667.968560][T25458] ? __alloc_skb+0x276/0x7a0 [ 667.968580][T25458] ? __alloc_skb+0x276/0x7a0 [ 667.968607][T25458] ? netlink_sendmsg+0x650/0xb40 [ 667.968633][T25458] ? skb_put+0x112/0x210 [ 667.968657][T25458] netlink_sendmsg+0x6c0/0xb40 [ 667.968693][T25458] ? __pfx_netlink_sendmsg+0x10/0x10 [ 667.968725][T25458] ? aa_sock_msg_perm+0xf1/0x1b0 [ 667.968756][T25458] ? __pfx_netlink_sendmsg+0x10/0x10 [ 667.968781][T25458] sock_sendmsg_nosec+0x13a/0x180 [ 667.968815][T25458] ____sys_sendmsg+0x54e/0x850 [ 667.968847][T25458] ? __pfx_____sys_sendmsg+0x10/0x10 [ 667.968882][T25458] ? import_iovec+0x73/0xa0 [ 667.968907][T25458] ___sys_sendmsg+0x2a5/0x360 [ 667.968930][T25458] ? __lock_acquire+0x683/0x2cf0 [ 667.968973][T25458] ? __pfx____sys_sendmsg+0x10/0x10 [ 667.969038][T25458] ? __fget_files+0x2a/0x420 [ 667.969067][T25458] ? __fget_files+0x3a2/0x420 [ 667.969107][T25458] __x64_sys_sendmsg+0x1b1/0x290 [ 667.969135][T25458] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 667.969181][T25458] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.969205][T25458] do_syscall_64+0x174/0x580 [ 667.969230][T25458] ? trace_irq_disable+0x3b/0x140 [ 667.969259][T25458] ? clear_bhb_loop+0x40/0x90 [ 667.969286][T25458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.969308][T25458] RIP: 0033:0x7fbfc2f9e0d9 [ 667.969329][T25458] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 667.969348][T25458] RSP: 002b:00007fbfc3f01028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 667.969375][T25458] RAX: ffffffffffffffda RBX: 00007fbfc3225fa0 RCX: 00007fbfc2f9e0d9 [ 667.969391][T25458] RDX: 00000000200080c0 RSI: 0000200000000000 RDI: 0000000000000003 [ 667.969406][T25458] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 667.969419][T25458] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 667.969431][T25458] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 667.969466][T25458] [ 668.470072][T25477] netlink: 'syz.3.6802': attribute type 1 has an invalid length. [ 668.569536][T25477] bond26: entered promiscuous mode [ 668.576303][T25477] 8021q: adding VLAN 0 to HW filter on device bond26 [ 668.594098][T25486] netlink: 'syz.4.6804': attribute type 1 has an invalid length. [ 668.602559][T25486] netlink: 'syz.4.6804': attribute type 3 has an invalid length. [ 668.612334][T25486] __nla_validate_parse: 9 callbacks suppressed [ 668.612350][T25486] netlink: 172 bytes leftover after parsing attributes in process `syz.4.6804'. [ 668.628963][T25486] NCSI netlink: No device for ifindex 813332851 [ 668.686367][T25477] macvtap4: entered allmulticast mode [ 668.733818][T25477] macvtap5: entered allmulticast mode [ 668.746928][T25490] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.6806'. [ 669.117962][T25509] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6809'. [ 669.422556][T25530] netlink: 'syz.1.6817': attribute type 4 has an invalid length. [ 669.471398][T25534] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6815'. [ 669.565882][T25536] netlink: 'syz.4.6819': attribute type 1 has an invalid length. [ 669.722441][T25536] bond16: entered promiscuous mode [ 669.750530][T25536] 8021q: adding VLAN 0 to HW filter on device bond16 [ 669.845313][T25544] macvtap5: entered allmulticast mode [ 669.906897][T25549] macvtap6: entered allmulticast mode [ 669.980958][T25556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6825'. [ 670.579815][T25581] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6833'. [ 670.703710][T25586] tipc: Failed to remove unknown binding: 66,1,1/2886997007:2417842423/2417842425 [ 670.928115][T25592] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6839'. [ 671.369214][T25615] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6848'. [ 671.405103][T25615] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6848'. [ 671.436338][T25615] netlink: 'syz.3.6848': attribute type 4 has an invalid length. [ 671.474825][T18767] net_ratelimit: 27 callbacks suppressed [ 671.474848][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 671.626398][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 671.765521][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 671.884561][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 672.018694][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 672.100448][T25653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6864'. [ 672.154593][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 672.286209][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 672.309757][T25666] Unknown options in mask 4 [ 672.538590][T25670] bond27: entered promiscuous mode [ 672.545548][T25670] 8021q: adding VLAN 0 to HW filter on device bond27 [ 672.585074][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 672.704806][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 672.785847][T25685] netlink: 'syz.0.6880': attribute type 21 has an invalid length. [ 672.806115][T25685] IPv6: NLM_F_CREATE should be specified when creating new route [ 672.925748][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 673.260812][T25717] bond33: entered promiscuous mode [ 673.268240][T25717] 8021q: adding VLAN 0 to HW filter on device bond33 [ 673.480326][T25731] sch_tbf: peakrate 4 is lower than or equals to rate 24576 ! [ 673.515046][T25729] sch_tbf: peakrate 4 is lower than or equals to rate 24576 ! [ 673.831564][T25749] __nla_validate_parse: 3 callbacks suppressed [ 673.831586][T25749] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6895'. [ 673.926426][T25753] x_tables: unsorted entry at hook 3 [ 674.486686][T25773] netlink: 'syz.1.6904': attribute type 4 has an invalid length. [ 674.524933][T25773] netlink: 240 bytes leftover after parsing attributes in process `syz.1.6904'. [ 674.913006][T25788] netlink: 180 bytes leftover after parsing attributes in process `syz.2.6910'. [ 675.147876][T25797] syzkaller0: entered promiscuous mode [ 675.183938][T25797] syzkaller0: entered allmulticast mode [ 675.399481][T25809] sit0: entered promiscuous mode [ 675.452568][T25809] netlink: 'syz.1.6914': attribute type 1 has an invalid length. [ 675.480979][T25809] netlink: 1 bytes leftover after parsing attributes in process `syz.1.6914'. [ 675.829469][T25838] FAULT_INJECTION: forcing a failure. [ 675.829469][T25838] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 675.844038][T25838] CPU: 1 UID: 0 PID: 25838 Comm: syz.3.6923 Not tainted syzkaller #0 PREEMPT(full) [ 675.844065][T25838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 675.844079][T25838] Call Trace: [ 675.844088][T25838] [ 675.844097][T25838] dump_stack_lvl+0xe8/0x150 [ 675.844135][T25838] should_fail_ex+0x40c/0x560 [ 675.844168][T25838] prepare_alloc_pages+0x230/0x650 [ 675.844207][T25838] __alloc_frozen_pages_noprof+0x12f/0x380 [ 675.844240][T25838] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 675.844271][T25838] ? __pfx_policy_nodemask+0x10/0x10 [ 675.844298][T25838] ? __folio_batch_add_and_move+0x11a/0xc50 [ 675.844363][T25838] ? lock_acquire+0x106/0x350 [ 675.844397][T25838] alloc_pages_mpol+0x212/0x380 [ 675.844433][T25838] folio_alloc_mpol_noprof+0x39/0x160 [ 675.844465][T25838] vma_alloc_folio_noprof+0xe1/0x1e0 [ 675.844501][T25838] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 675.844546][T25838] do_wp_page+0x1163/0x4c70 [ 675.844599][T25838] ? __pfx_do_wp_page+0x10/0x10 [ 675.844620][T25838] ? do_raw_spin_lock+0x12b/0x2f0 [ 675.844648][T25838] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 675.844682][T25838] handle_mm_fault+0x1490/0x3080 [ 675.844716][T25838] ? handle_mm_fault+0xec/0x3080 [ 675.844750][T25838] ? __pfx_handle_mm_fault+0x10/0x10 [ 675.844775][ T3398] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 675.844787][T25838] ? __pfx___up_read+0x10/0x10 [ 675.844813][T25838] ? lock_mm_and_find_vma+0xa7/0x340 [ 675.844845][T25838] do_user_addr_fault+0x744/0x1340 [ 675.844889][T25838] exc_page_fault+0x6a/0xc0 [ 675.844912][T25838] asm_exc_page_fault+0x26/0x30 [ 675.844931][T25838] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 675.844960][T25838] Code: 63 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 675.844977][T25838] RSP: 0018:ffffc900020bf4f8 EFLAGS: 00050202 [ 675.845060][T25838] RAX: ffff888057b52001 RBX: ffff888057b521c5 RCX: 0000000000000c17 [ 675.845122][T25838] RDX: 0000000000000000 RSI: ffff888057b52245 RDI: 0000200000001000 [ 675.845166][T25838] RBP: ffffc900020bf670 R08: ffff888057b52e5b R09: 1ffff1100af6a5cb [ 675.845213][T25838] R10: dffffc0000000000 R11: ffffed100af6a5cc R12: dffffc0000000000 [ 675.845256][T25838] R13: 0000000000000c97 R14: 0000200000001c17 R15: 00007ffffffff000 [ 675.845343][T25838] _copy_to_iter+0x619/0x1810 [ 675.845469][T25838] ? __pfx__copy_to_iter+0x10/0x10 [ 675.845553][T25838] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 675.845625][T25838] ? lockdep_hardirqs_on+0x7a/0x110 [ 675.845693][T25838] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 675.845755][T25838] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 675.845848][T25838] __skb_datagram_iter+0xf8/0x980 [ 675.845921][T25838] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 675.846024][T25838] skb_copy_datagram_iter+0xb5/0x240 [ 675.846111][T25838] netlink_recvmsg+0x2b9/0xa50 [ 675.846226][T25838] ? __pfx_netlink_recvmsg+0x10/0x10 [ 675.846310][T25838] ? __lock_acquire+0x683/0x2cf0 [ 675.846393][T25838] ? aa_sock_msg_perm+0xf1/0x1b0 [ 675.846466][T25838] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 675.846541][T25838] ? security_socket_recvmsg+0x7e/0x2c0 [ 675.846665][T25838] ? __pfx_netlink_recvmsg+0x10/0x10 [ 675.846738][T25838] sock_recvmsg+0x196/0x1e0 [ 675.846832][T25838] ____sys_recvmsg+0x1e6/0x4a0 [ 675.846926][T25838] ? __pfx_____sys_recvmsg+0x10/0x10 [ 675.847039][T25838] ? import_iovec+0x73/0xa0 [ 675.847090][T25838] ___sys_recvmsg+0x213/0x5a0 [ 675.847174][T25838] ? __pfx____sys_recvmsg+0x10/0x10 [ 675.847256][T25838] ? __fget_files+0x2a/0x420 [ 675.847389][T25838] ? __fget_files+0x3a2/0x420 [ 675.847494][T25838] do_recvmmsg+0x31a/0x7f0 [ 675.847598][T25838] ? __pfx_do_recvmmsg+0x10/0x10 [ 675.847702][T25838] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 675.847775][T25838] ? __fget_files+0x3a2/0x420 [ 675.847947][T25838] __x64_sys_recvmmsg+0x198/0x250 [ 675.848038][T25838] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 675.848134][T25838] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.848199][T25838] do_syscall_64+0x174/0x580 [ 675.848264][T25838] ? trace_irq_disable+0x3b/0x140 [ 675.848343][T25838] ? clear_bhb_loop+0x40/0x90 [ 675.848410][T25838] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.848470][T25838] RIP: 0033:0x7f325599e0d9 [ 675.848523][T25838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.848578][T25838] RSP: 002b:00007f32567b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 675.848632][T25838] RAX: ffffffffffffffda RBX: 00007f3255c25fa0 RCX: 00007f325599e0d9 [ 675.848681][T25838] RDX: 0000000000000001 RSI: 0000200000006300 RDI: 0000000000000003 [ 675.848715][T25838] RBP: 00007f32567b0090 R08: 0000000000000000 R09: 0000000000000000 [ 675.848747][T25838] R10: 0000000000000060 R11: 0000000000000246 R12: 0000000000000001 [ 675.848786][T25838] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 675.848871][T25838] [ 676.371183][T25844] netlink: 'syz.0.6924': attribute type 3 has an invalid length. [ 676.403026][T25836] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6920'. [ 676.429954][T25848] netlink: 'syz.0.6924': attribute type 3 has an invalid length. [ 676.476623][T25854] FAULT_INJECTION: forcing a failure. [ 676.476623][T25854] name failslab, interval 1, probability 0, space 0, times 0 [ 676.497018][T25854] CPU: 0 UID: 0 PID: 25854 Comm: syz.3.6925 Not tainted syzkaller #0 PREEMPT(full) [ 676.497051][T25854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 676.497066][T25854] Call Trace: [ 676.497076][T25854] [ 676.497087][T25854] dump_stack_lvl+0xe8/0x150 [ 676.497130][T25854] should_fail_ex+0x40c/0x560 [ 676.497168][T25854] should_failslab+0xa8/0x100 [ 676.497207][T25854] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 676.497238][T25854] ? local_lock_release+0x9c/0x160 [ 676.497264][T25854] ? __alloc_skb+0x1d7/0x7a0 [ 676.497286][T25854] ? __alloc_skb+0x1d7/0x7a0 [ 676.497317][T25854] __alloc_skb+0x1d7/0x7a0 [ 676.497344][T25854] netlink_sendmsg+0x5d4/0xb40 [ 676.497398][T25854] ? __pfx_netlink_sendmsg+0x10/0x10 [ 676.497431][T25854] ? aa_sock_msg_perm+0xf1/0x1b0 [ 676.497465][T25854] ? __pfx_netlink_sendmsg+0x10/0x10 [ 676.497493][T25854] sock_sendmsg_nosec+0x13a/0x180 [ 676.497530][T25854] ____sys_sendmsg+0x54e/0x850 [ 676.497566][T25854] ? __pfx_____sys_sendmsg+0x10/0x10 [ 676.497604][T25854] ? import_iovec+0x73/0xa0 [ 676.497632][T25854] ___sys_sendmsg+0x2a5/0x360 [ 676.497658][T25854] ? __lock_acquire+0x683/0x2cf0 [ 676.497695][T25854] ? __pfx____sys_sendmsg+0x10/0x10 [ 676.497766][T25854] ? __fget_files+0x2a/0x420 [ 676.497798][T25854] ? __fget_files+0x3a2/0x420 [ 676.497842][T25854] __x64_sys_sendmsg+0x1b1/0x290 [ 676.497874][T25854] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 676.497925][T25854] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.497953][T25854] do_syscall_64+0x174/0x580 [ 676.497985][T25854] ? trace_irq_disable+0x3b/0x140 [ 676.498018][T25854] ? clear_bhb_loop+0x40/0x90 [ 676.498047][T25854] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.498071][T25854] RIP: 0033:0x7f325599e0d9 [ 676.498094][T25854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 676.498115][T25854] RSP: 002b:00007f32567b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 676.498141][T25854] RAX: ffffffffffffffda RBX: 00007f3255c25fa0 RCX: 00007f325599e0d9 [ 676.498159][T25854] RDX: 000000000000c040 RSI: 0000200000000100 RDI: 0000000000000003 [ 676.498175][T25854] RBP: 00007f32567b0090 R08: 0000000000000000 R09: 0000000000000000 [ 676.498191][T25854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 676.498206][T25854] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 676.498246][T25854] [ 676.753483][T18767] net_ratelimit: 26 callbacks suppressed [ 676.753506][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 676.770615][T25826] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 676.935805][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 677.048228][T25861] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 677.087370][T25861] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 677.134488][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 677.148287][T25870] No such timeout policy "s" [ 677.174653][T25870] netlink: Failed to associated timeout policy 's' [ 677.229138][T25872] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6935'. [ 677.245510][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 677.272296][T25872] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6935'. [ 677.362639][T25881] openvswitch: netlink: Multiple metadata blocks provided [ 677.428819][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 677.429034][T25874] netlink: 'syz.3.6934': attribute type 10 has an invalid length. [ 677.485961][T25874] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6934'. [ 677.513117][T25874] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 677.695105][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 677.787366][T25902] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6942'. [ 677.824922][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 677.909234][T25907] netlink: 'syz.3.6945': attribute type 1 has an invalid length. [ 677.966863][T25911] IPVS: set_ctl: invalid protocol: 94 10.1.1.0:20001 [ 677.978707][T25907] 8021q: adding VLAN 0 to HW filter on device bond28 [ 678.197492][T25925] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6952'. [ 678.481395][T25941] netlink: 'syz.4.6958': attribute type 28 has an invalid length. [ 678.482572][T25939] SET target dimension over the limit! [ 678.547781][T25941] netlink: 'syz.4.6958': attribute type 3 has an invalid length. [ 678.660679][T25953] No such timeout policy "s" [ 678.997634][T25968] netlink: 'syz.1.6966': attribute type 1 has an invalid length. [ 679.538482][T25994] __nla_validate_parse: 3 callbacks suppressed [ 679.538504][T25994] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6974'. [ 680.360922][T26029] netlink: 'syz.2.6988': attribute type 3 has an invalid length. [ 680.656689][T26048] FAULT_INJECTION: forcing a failure. [ 680.656689][T26048] name failslab, interval 1, probability 0, space 0, times 0 [ 680.679073][T26048] CPU: 1 UID: 0 PID: 26048 Comm: syz.1.6994 Not tainted syzkaller #0 PREEMPT(full) [ 680.679104][T26048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 680.679117][T26048] Call Trace: [ 680.679125][T26048] [ 680.679135][T26048] dump_stack_lvl+0xe8/0x150 [ 680.679175][T26048] should_fail_ex+0x40c/0x560 [ 680.679210][T26048] should_failslab+0xa8/0x100 [ 680.679247][T26048] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 680.679277][T26048] ? skb_clone+0x212/0x3a0 [ 680.679301][T26048] ? skb_clone+0x212/0x3a0 [ 680.679334][T26048] skb_clone+0x212/0x3a0 [ 680.679366][T26048] __netlink_deliver_tap+0x413/0x860 [ 680.679407][T26048] ? netlink_deliver_tap+0x2e/0x1b0 [ 680.679435][T26048] netlink_deliver_tap+0x19c/0x1b0 [ 680.679460][T26048] netlink_dump+0x95b/0xee0 [ 680.679499][T26048] ? __pfx_netlink_dump+0x10/0x10 [ 680.679538][T26048] ? netlink_recvmsg+0x5bf/0xa50 [ 680.679563][T26048] ? kmem_cache_free+0x182/0x650 [ 680.679611][T26048] netlink_recvmsg+0x683/0xa50 [ 680.679656][T26048] ? __pfx_netlink_recvmsg+0x10/0x10 [ 680.679689][T26048] ? __lock_acquire+0x683/0x2cf0 [ 680.679718][T26048] ? aa_sock_msg_perm+0xf1/0x1b0 [ 680.679745][T26048] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 680.679770][T26048] ? security_socket_recvmsg+0x7e/0x2c0 [ 680.679799][T26048] ? __pfx_netlink_recvmsg+0x10/0x10 [ 680.679826][T26048] sock_recvmsg+0x196/0x1e0 [ 680.679862][T26048] ____sys_recvmsg+0x1e6/0x4a0 [ 680.679899][T26048] ? __pfx_____sys_recvmsg+0x10/0x10 [ 680.679944][T26048] ? import_iovec+0x73/0xa0 [ 680.679971][T26048] ___sys_recvmsg+0x213/0x5a0 [ 680.679996][T26048] ? __pfx_clockevents_program_event+0x10/0x10 [ 680.680024][T26048] ? __pfx____sys_recvmsg+0x10/0x10 [ 680.680056][T26048] ? irqentry_exit+0x218/0x8f0 [ 680.680104][T26048] ? do_recvmmsg+0x2ee/0x7f0 [ 680.680137][T26048] do_recvmmsg+0x31a/0x7f0 [ 680.680174][T26048] ? __pfx_do_recvmmsg+0x10/0x10 [ 680.680213][T26048] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 680.680243][T26048] ? __fget_files+0x3a2/0x420 [ 680.680285][T26048] __x64_sys_recvmmsg+0x198/0x250 [ 680.680313][T26048] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 680.680349][T26048] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.680374][T26048] do_syscall_64+0x174/0x580 [ 680.680398][T26048] ? trace_irq_disable+0x3b/0x140 [ 680.680425][T26048] ? clear_bhb_loop+0x40/0x90 [ 680.680454][T26048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 680.680476][T26048] RIP: 0033:0x7fbfc2f9e0d9 [ 680.680498][T26048] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 680.680515][T26048] RSP: 002b:00007fbfc3f01028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 680.680537][T26048] RAX: ffffffffffffffda RBX: 00007fbfc3225fa0 RCX: 00007fbfc2f9e0d9 [ 680.680554][T26048] RDX: 0000000000000001 RSI: 0000200000006300 RDI: 0000000000000003 [ 680.680569][T26048] RBP: 00007fbfc3f01090 R08: 0000000000000000 R09: 0000000000000000 [ 680.680583][T26048] R10: 0000000000000060 R11: 0000000000000246 R12: 0000000000000002 [ 680.680607][T26048] R13: 00007fbfc3226038 R14: 00007fbfc3225fa0 R15: 00007ffd7e5d9648 [ 680.680643][T26048] [ 681.409968][T26070] bridge0: left allmulticast mode [ 681.470099][T26070] bridge0: port 2(vlan1) entered blocking state [ 681.506729][T26070] bridge0: port 2(vlan1) entered disabled state [ 681.543733][T26070] vlan1: entered allmulticast mode [ 681.600436][T26070] geneve0: entered allmulticast mode [ 681.618136][T26070] vlan1: entered promiscuous mode [ 681.623377][T26079] FAULT_INJECTION: forcing a failure. [ 681.623377][T26079] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 681.629472][T26070] geneve0: entered promiscuous mode [ 681.677862][T26079] CPU: 1 UID: 0 PID: 26079 Comm: syz.3.7006 Not tainted syzkaller #0 PREEMPT(full) [ 681.677895][T26079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 681.677909][T26079] Call Trace: [ 681.677919][T26079] [ 681.677928][T26079] dump_stack_lvl+0xe8/0x150 [ 681.677966][T26079] should_fail_ex+0x40c/0x560 [ 681.677998][T26079] _copy_from_user+0x2d/0xb0 [ 681.678018][T26079] kstrtouint_from_user+0xd6/0x180 [ 681.678048][T26079] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 681.678090][T26079] proc_fail_nth_write+0x8e/0x210 [ 681.678123][T26079] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 681.678165][T26079] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 681.678197][T26079] vfs_write+0x296/0xba0 [ 681.678230][T26079] ? __pfx_vfs_write+0x10/0x10 [ 681.678254][T26079] ? __fget_files+0x2a/0x420 [ 681.678289][T26079] ? __fget_files+0x3a2/0x420 [ 681.678318][T26079] ? __fget_files+0x2a/0x420 [ 681.678359][T26079] ksys_write+0x150/0x270 [ 681.678386][T26079] ? __pfx_ksys_write+0x10/0x10 [ 681.678419][T26079] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.678444][T26079] do_syscall_64+0x174/0x580 [ 681.678481][T26079] ? trace_irq_disable+0x3b/0x140 [ 681.678510][T26079] ? clear_bhb_loop+0x40/0x90 [ 681.678538][T26079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 681.678561][T26079] RIP: 0033:0x7f325595e90e [ 681.678583][T26079] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 681.678602][T26079] RSP: 002b:00007f32567affe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 681.678626][T26079] RAX: ffffffffffffffda RBX: 00007f32567b06c0 RCX: 00007f325595e90e [ 681.678643][T26079] RDX: 0000000000000001 RSI: 00007f32567b00a0 RDI: 0000000000000004 [ 681.678658][T26079] RBP: 00007f32567b0090 R08: 0000000000000000 R09: 0000000000000000 [ 681.678672][T26079] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 681.678685][T26079] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 681.678721][T26079] [ 681.892226][ T3377] net_ratelimit: 35 callbacks suppressed [ 681.892250][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 682.018332][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 682.134580][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 682.244558][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 682.356357][T26093] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7013'. [ 682.405138][T26092] block nbd0: Unsupported socket: should be TCP or UNIX. [ 682.539292][T26093] bond29: entered promiscuous mode [ 682.585779][T26093] 8021q: adding VLAN 0 to HW filter on device bond29 [ 682.635098][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 682.755560][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 682.897945][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 683.035665][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 683.109485][T26120] netlink: 256 bytes leftover after parsing attributes in process `syz.2.7022'. [ 683.154564][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 683.163631][T26120] netlink: 'syz.2.7022': attribute type 9 has an invalid length. [ 683.297005][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 683.612663][T26137] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7029'. [ 683.863083][T26137] bond30: entered promiscuous mode [ 683.897862][T26137] 8021q: adding VLAN 0 to HW filter on device bond30 [ 684.070968][T26152] xt_NFQUEUE: number of total queues is 0 [ 684.135336][T26152] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7034'. [ 684.169446][T26155] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7036'. [ 684.612791][T26166] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7041'. [ 685.131826][T26190] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 685.184392][T26190] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 685.316094][T26190] tipc: Resetting bearer [ 685.521915][T26198] syzkaller0: entered promiscuous mode [ 685.565017][T26198] syzkaller0: entered allmulticast mode [ 685.667001][T26205] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7054'. [ 685.839680][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.457775][T26228] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7062'. [ 686.672732][T26235] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7066'. [ 686.709548][T26235] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7066'. [ 686.983488][T26242] syzkaller0: entered promiscuous mode [ 687.019671][T26242] syzkaller0: entered allmulticast mode [ 687.055438][ T57] net_ratelimit: 23 callbacks suppressed [ 687.055459][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 687.248987][T26254] netlink: 'syz.0.7072': attribute type 7 has an invalid length. [ 687.264606][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 687.297875][T26254] netlink: 'syz.0.7072': attribute type 8 has an invalid length. [ 687.527654][T26249] syzkaller0: entered promiscuous mode [ 687.557325][T26249] syzkaller0: entered allmulticast mode [ 687.774695][T26274] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7076'. [ 687.822063][T26274] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7076'. [ 688.562074][T26298] FAULT_INJECTION: forcing a failure. [ 688.562074][T26298] name failslab, interval 1, probability 0, space 0, times 0 [ 688.585657][T26298] CPU: 1 UID: 0 PID: 26298 Comm: syz.2.7083 Not tainted syzkaller #0 PREEMPT(full) [ 688.585687][T26298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 688.585709][T26298] Call Trace: [ 688.585718][T26298] [ 688.585728][T26298] dump_stack_lvl+0xe8/0x150 [ 688.585768][T26298] should_fail_ex+0x40c/0x560 [ 688.585802][T26298] should_failslab+0xa8/0x100 [ 688.585839][T26298] __kmalloc_node_track_caller_noprof+0x100/0x730 [ 688.585872][T26298] ? ovs_nla_get_match+0x3b1/0x1840 [ 688.585988][T26298] ? ovs_nla_get_match+0x3b1/0x1840 [ 688.586023][T26298] kmemdup_noprof+0x2b/0x70 [ 688.586068][T26298] ovs_nla_get_match+0x3b1/0x1840 [ 688.586110][T26298] ? __pfx_ovs_nla_get_match+0x10/0x10 [ 688.586169][T26298] ? __kmalloc_cache_noprof+0x32d/0x660 [ 688.586203][T26298] ? __asan_memset+0x22/0x50 [ 688.586235][T26298] ovs_flow_cmd_new+0x3a5/0xea0 [ 688.586270][T26298] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 688.586346][T26298] ? __kmalloc_noprof+0x396/0x720 [ 688.586379][T26298] ? __nla_parse+0x40/0x60 [ 688.586416][T26298] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 688.586450][T26298] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 688.586491][T26298] genl_family_rcv_msg_doit+0x233/0x340 [ 688.586533][T26298] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 688.586584][T26298] ? bpf_lsm_capable+0x9/0x20 [ 688.586613][T26298] ? security_capable+0x7e/0x2c0 [ 688.586639][T26298] genl_rcv_msg+0x614/0x7a0 [ 688.586671][T26298] ? __pfx_genl_rcv_msg+0x10/0x10 [ 688.586704][T26298] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 688.586735][T26298] netlink_rcv_skb+0x226/0x4a0 [ 688.586757][T26298] ? __pfx_genl_rcv_msg+0x10/0x10 [ 688.586785][T26298] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 688.586818][T26298] ? down_read+0x2be/0x330 [ 688.586846][T26298] genl_rcv+0x28/0x40 [ 688.586870][T26298] netlink_unicast+0x7bb/0x940 [ 688.586899][T26298] netlink_sendmsg+0x813/0xb40 [ 688.586928][T26298] ? __pfx_netlink_sendmsg+0x10/0x10 [ 688.586957][T26298] ? aa_sock_msg_perm+0xf1/0x1b0 [ 688.586982][T26298] ? __pfx_netlink_sendmsg+0x10/0x10 [ 688.587002][T26298] sock_sendmsg_nosec+0x13a/0x180 [ 688.587033][T26298] ____sys_sendmsg+0x54e/0x850 [ 688.587058][T26298] ? __pfx_____sys_sendmsg+0x10/0x10 [ 688.587087][T26298] ? import_iovec+0x73/0xa0 [ 688.587107][T26298] ___sys_sendmsg+0x2a5/0x360 [ 688.587127][T26298] ? __lock_acquire+0x683/0x2cf0 [ 688.587157][T26298] ? __pfx____sys_sendmsg+0x10/0x10 [ 688.587210][T26298] ? __fget_files+0x2a/0x420 [ 688.587234][T26298] ? __fget_files+0x3a2/0x420 [ 688.587268][T26298] __x64_sys_sendmsg+0x1b1/0x290 [ 688.587291][T26298] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 688.587328][T26298] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.587348][T26298] do_syscall_64+0x174/0x580 [ 688.587369][T26298] ? trace_irq_disable+0x3b/0x140 [ 688.587393][T26298] ? clear_bhb_loop+0x40/0x90 [ 688.587415][T26298] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.587433][T26298] RIP: 0033:0x7fb6da39e0d9 [ 688.587450][T26298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 688.587467][T26298] RSP: 002b:00007fb6db18c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 688.587486][T26298] RAX: ffffffffffffffda RBX: 00007fb6da625fa0 RCX: 00007fb6da39e0d9 [ 688.587503][T26298] RDX: 000000000000c040 RSI: 0000200000000100 RDI: 0000000000000003 [ 688.587518][T26298] RBP: 00007fb6db18c090 R08: 0000000000000000 R09: 0000000000000000 [ 688.587529][T26298] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 688.587540][T26298] R13: 00007fb6da626038 R14: 00007fb6da625fa0 R15: 00007ffe8d241b18 [ 688.587568][T26298] [ 692.141063][T26302] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7084'. [ 692.163063][T26311] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 692.171353][T26311] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 692.189018][T26311] tipc: Resetting bearer [ 692.214544][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 692.325477][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 692.434565][ T3347] bond7: (slave bridge5): failed to get link speed/duplex [ 692.574643][ T3377] bond7: (slave bridge5): failed to get link speed/duplex [ 692.643364][T26323] syzkaller1: entered promiscuous mode [ 692.675658][T26323] syzkaller1: entered allmulticast mode [ 692.705603][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 692.718050][T26323] openvswitch: netlink: Missing key (keys=c0, expected=500) [ 692.917617][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 693.065154][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 693.232338][T26341] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7094'. [ 693.302649][T26341] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7094'. [ 693.360971][T26343] netlink: Conntrack attr has 1 unknown bytes [ 693.383126][T26343] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 693.794146][T26357] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.7099'. [ 693.884429][T26355] syzkaller0: entered promiscuous mode [ 693.902731][T26355] syzkaller0: entered allmulticast mode [ 693.966775][T26364] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7101'. [ 694.103688][ T3347] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 694.140975][T13399] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 694.151551][ T3347] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 694.455023][ T5646] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 694.654898][T26378] netlink: 'syz.2.7107': attribute type 1 has an invalid length. [ 694.664904][ T5646] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 694.759678][T26378] 8021q: adding VLAN 0 to HW filter on device bond34 [ 694.796638][T26378] bond34: (slave geneve3): making interface the new active one [ 694.810200][T26378] bond34: (slave geneve3): Enslaving as an active interface with an up link [ 694.966689][T26391] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7110'. [ 695.209456][T26391] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7110'. [ 695.442157][T26398] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7113'. [ 696.086698][T26412] syzkaller1: entered promiscuous mode [ 696.107153][T26412] syzkaller1: entered allmulticast mode [ 696.137117][T26417] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7120'. [ 696.171123][T26414] syzkaller0: entered promiscuous mode [ 696.215196][T26414] syzkaller0: entered allmulticast mode [ 696.222948][T26420] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7120'. [ 696.385677][T26417] bond31: entered promiscuous mode [ 696.403749][T26417] 8021q: adding VLAN 0 to HW filter on device bond31 [ 697.268822][ T57] net_ratelimit: 24 callbacks suppressed [ 697.268845][ T57] bond7: (slave bridge5): failed to get link speed/duplex [ 697.437551][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 697.541892][T26465] __nla_validate_parse: 3 callbacks suppressed [ 697.541916][T26465] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7134'. [ 697.632097][T26465] bond33: entered promiscuous mode [ 697.640699][T26465] 8021q: adding VLAN 0 to HW filter on device bond33 [ 697.642123][T26472] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7134'. [ 697.785381][ T1163] bond7: (slave bridge5): failed to get link speed/duplex [ 697.936410][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 698.070977][T26483] FAULT_INJECTION: forcing a failure. [ 698.070977][T26483] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 698.102756][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 698.111480][T26483] CPU: 0 UID: 0 PID: 26483 Comm: syz.0.7139 Not tainted syzkaller #0 PREEMPT(full) [ 698.111510][T26483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 698.111525][T26483] Call Trace: [ 698.111534][T26483] [ 698.111544][T26483] dump_stack_lvl+0xe8/0x150 [ 698.111582][T26483] should_fail_ex+0x40c/0x560 [ 698.111617][T26483] _copy_from_user+0x2d/0xb0 [ 698.111641][T26483] ___sys_sendmsg+0x1c6/0x360 [ 698.111666][T26483] ? __lock_acquire+0x683/0x2cf0 [ 698.111702][T26483] ? __pfx____sys_sendmsg+0x10/0x10 [ 698.111768][T26483] ? __fget_files+0x2a/0x420 [ 698.111798][T26483] ? __fget_files+0x3a2/0x420 [ 698.111841][T26483] __x64_sys_sendmsg+0x1b1/0x290 [ 698.111871][T26483] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 698.111922][T26483] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.111948][T26483] do_syscall_64+0x174/0x580 [ 698.111976][T26483] ? trace_irq_disable+0x3b/0x140 [ 698.112006][T26483] ? clear_bhb_loop+0x40/0x90 [ 698.112033][T26483] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.112056][T26483] RIP: 0033:0x7ff83f99e0d9 [ 698.112076][T26483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 698.112095][T26483] RSP: 002b:00007ff83dbf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 698.112119][T26483] RAX: ffffffffffffffda RBX: 00007ff83fc25fa0 RCX: 00007ff83f99e0d9 [ 698.112144][T26483] RDX: 0000000000000040 RSI: 00002000000001c0 RDI: 0000000000000003 [ 698.112158][T26483] RBP: 00007ff83dbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 698.112173][T26483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 698.112187][T26483] R13: 00007ff83fc26038 R14: 00007ff83fc25fa0 R15: 00007ffe41f996f8 [ 698.112222][T26483] [ 698.304626][ T3398] bond7: (slave bridge5): failed to get link speed/duplex [ 698.394549][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 698.448167][T26493] netlink: 1044 bytes leftover after parsing attributes in process `syz.4.7141'. [ 698.461769][T26493] netlink: 'syz.4.7141': attribute type 1 has an invalid length. [ 698.481165][ T35] bond7: (slave bridge5): failed to get link speed/duplex [ 698.602493][T26493] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7141'. [ 698.625635][T18767] bond7: (slave bridge5): failed to get link speed/duplex [ 698.632921][T26493] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7141'. [ 698.664940][T26499] netlink: Conntrack attr has 1 unknown bytes [ 698.683794][T26499] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 698.777156][T26493] gretap3: entered promiscuous mode [ 698.813204][T26493] gretap3: entered allmulticast mode [ 698.967076][T26509] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7148'. [ 699.032954][T26512] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7148'. [ 699.110081][T26516] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7150'. [ 699.155806][T26516] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7150'. [ 699.250080][T26509] bond32: entered promiscuous mode [ 699.271021][T26509] 8021q: adding VLAN 0 to HW filter on device bond32 [ 699.280827][T26522] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7153'. [ 699.330605][T26522] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 699.360006][T26522] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 699.493170][T26531] No such timeout policy "s" [ 699.509423][T26531] FAULT_INJECTION: forcing a failure. [ 699.509423][T26531] name failslab, interval 1, probability 0, space 0, times 0 [ 699.558353][T26531] CPU: 0 UID: 0 PID: 26531 Comm: syz.3.7155 Not tainted syzkaller #0 PREEMPT(full) [ 699.558384][T26531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 699.558398][T26531] Call Trace: [ 699.558407][T26531] [ 699.558417][T26531] dump_stack_lvl+0xe8/0x150 [ 699.558456][T26531] should_fail_ex+0x40c/0x560 [ 699.558491][T26531] should_failslab+0xa8/0x100 [ 699.558527][T26531] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 699.558555][T26531] ? local_lock_release+0x9c/0x160 [ 699.558579][T26531] ? __alloc_skb+0x1d7/0x7a0 [ 699.558598][T26531] ? __alloc_skb+0x1d7/0x7a0 [ 699.558627][T26531] __alloc_skb+0x1d7/0x7a0 [ 699.558652][T26531] netlink_ack+0x136/0xb30 [ 699.558676][T26531] ? __pfx_genl_rcv_msg+0x10/0x10 [ 699.558716][T26531] ? __pfx_ref_tracker_free+0x10/0x10 [ 699.558758][T26531] netlink_rcv_skb+0x2a4/0x4a0 [ 699.558786][T26531] ? __pfx_genl_rcv_msg+0x10/0x10 [ 699.558819][T26531] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 699.558862][T26531] ? down_read+0x2be/0x330 [ 699.558898][T26531] genl_rcv+0x28/0x40 [ 699.558930][T26531] netlink_unicast+0x7bb/0x940 [ 699.558967][T26531] netlink_sendmsg+0x813/0xb40 [ 699.559005][T26531] ? __pfx_netlink_sendmsg+0x10/0x10 [ 699.559039][T26531] ? aa_sock_msg_perm+0xf1/0x1b0 [ 699.559073][T26531] ? __pfx_netlink_sendmsg+0x10/0x10 [ 699.559100][T26531] sock_sendmsg_nosec+0x13a/0x180 [ 699.559137][T26531] ____sys_sendmsg+0x54e/0x850 [ 699.559170][T26531] ? __pfx_____sys_sendmsg+0x10/0x10 [ 699.559208][T26531] ? import_iovec+0x73/0xa0 [ 699.559235][T26531] ___sys_sendmsg+0x2a5/0x360 [ 699.559261][T26531] ? __lock_acquire+0x683/0x2cf0 [ 699.559328][T26531] ? __pfx____sys_sendmsg+0x10/0x10 [ 699.559411][T26531] ? __fget_files+0x2a/0x420 [ 699.559443][T26531] ? __fget_files+0x3a2/0x420 [ 699.559487][T26531] __x64_sys_sendmsg+0x1b1/0x290 [ 699.559518][T26531] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 699.559566][T26531] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.559592][T26531] do_syscall_64+0x174/0x580 [ 699.559618][T26531] ? trace_irq_disable+0x3b/0x140 [ 699.559655][T26531] ? clear_bhb_loop+0x40/0x90 [ 699.559684][T26531] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.559708][T26531] RIP: 0033:0x7f325599e0d9 [ 699.559729][T26531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 699.559749][T26531] RSP: 002b:00007f32567b0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 699.559772][T26531] RAX: ffffffffffffffda RBX: 00007f3255c25fa0 RCX: 00007f325599e0d9 [ 699.559789][T26531] RDX: 000000000000c040 RSI: 0000200000000100 RDI: 0000000000000003 [ 699.559804][T26531] RBP: 00007f32567b0090 R08: 0000000000000000 R09: 0000000000000000 [ 699.559818][T26531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 699.559831][T26531] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 699.559867][T26531] [ 700.787914][T26557] bond33: entered promiscuous mode [ 700.819679][T26557] 8021q: adding VLAN 0 to HW filter on device bond33 [ 701.927945][T26586] vlan4: entered promiscuous mode [ 701.933933][T26586] gretap0: entered promiscuous mode [ 702.384417][T26582] tipc: Resetting bearer [ 702.442006][T26582] ------------[ cut here ]------------ [ 702.449234][T26582] sdata->crypto_tx_tailroom_needed_cnt != master->crypto_tx_tailroom_needed_cnt [ 702.449276][T26582] WARNING: net/mac80211/key.c:1172 at ieee80211_free_keys+0x56e/0x680, CPU#1: syz.3.7173/26582 [ 702.469209][T26582] Modules linked in: [ 702.473631][T26582] CPU: 1 UID: 0 PID: 26582 Comm: syz.3.7173 Not tainted syzkaller #0 PREEMPT(full) [ 702.483137][T26582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 702.494701][T26582] RIP: 0010:ieee80211_free_keys+0x56e/0x680 [ 702.500956][T26582] Code: 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 17 57 86 00 cc e8 71 c3 78 f6 90 0f 0b 90 e9 22 fc ff ff e8 63 c3 78 f6 90 <0f> 0b 90 e9 30 fe ff ff e8 55 c3 78 f6 e9 1b fe ff ff 48 c7 c1 40 [ 702.521378][T26582] RSP: 0018:ffffc90004df7580 EFLAGS: 00010287 [ 702.527621][T26582] RAX: ffffffff8b4e509d RBX: ffff888055818ec0 RCX: 0000000000080000 [ 702.536012][T26582] RDX: ffffc90006c15000 RSI: 000000000003e254 RDI: 000000000003e255 [ 702.544098][T26582] RBP: ffffc90004df7650 R08: ffffc90004df7367 R09: 1ffff920009bee6c [ 702.553107][T26582] R10: dffffc0000000000 R11: fffff520009bee6d R12: dffffc0000000000 [ 702.562365][T26582] R13: 1ffff920009beeb8 R14: 0000000000000002 R15: 0000000000000001 [ 702.570493][T26582] FS: 00007f32567b06c0(0000) GS:ffff88812504d000(0000) knlGS:0000000000000000 [ 702.580227][T26582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 702.587260][T26582] CR2: 0000200000010000 CR3: 0000000074d5a000 CR4: 00000000003526f0 [ 702.595457][T26582] Call Trace: [ 702.598788][T26582] [ 702.601873][T26582] ? __pfx_ieee80211_free_keys+0x10/0x10 [ 702.608383][T26582] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 702.614260][T26582] ieee80211_do_stop+0x11fd/0x2410 [ 702.619985][T26582] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 702.625822][T26582] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 702.631678][T26582] ieee80211_stop+0x1ab/0x200 [ 702.637500][T26582] ? __pfx_ieee80211_stop+0x10/0x10 [ 702.642768][T26582] __dev_close_many+0x366/0x6e0 [ 702.648198][T26582] ? __pfx___dev_close_many+0x10/0x10 [ 702.653634][T26582] ? __mutex_trylock_common+0x15f/0x270 [ 702.659292][T26582] ? __pfx___mutex_trylock_common+0x10/0x10 [ 702.666160][T26582] netif_close_many+0x222/0x410 [ 702.671134][T26582] ? __pfx_netif_close_many+0x10/0x10 [ 702.676993][T26582] ? __mutex_lock+0x30d/0x1550 [ 702.681840][T26582] ? rfkill_fill_event+0x29c/0x3f0 [ 702.687276][T26582] netif_close+0x160/0x220 [ 702.691839][T26582] ? __pfx_netif_close+0x10/0x10 [ 702.697567][T26582] ? __pfx___mutex_lock+0x10/0x10 [ 702.702659][T26582] ? do_raw_spin_lock+0x12b/0x2f0 [ 702.708277][T26582] dev_close+0xf7/0x210 [ 702.712578][T26582] cfg80211_shutdown_all_interfaces+0xb0/0x220 [ 702.719168][T26582] ? __pfx_cfg80211_rfkill_set_block+0x10/0x10 [ 702.726181][T26582] cfg80211_rfkill_set_block+0x2d/0x50 [ 702.731706][T26582] rfkill_set_block+0x19f/0x4d0 [ 702.737035][T26582] rfkill_fop_write+0x43b/0x560 [ 702.741944][T26582] ? apparmor_file_permission+0x1f4/0x300 [ 702.747901][T26582] ? __pfx_rfkill_fop_write+0x10/0x10 [ 702.753844][T26582] ? security_kernfs_init_security+0x250/0x270 [ 702.760862][T26582] ? rw_verify_area+0x203/0x4c0 [ 702.766198][T26582] ? __pfx_rfkill_fop_write+0x10/0x10 [ 702.771627][T26582] vfs_write+0x296/0xba0 [ 702.776037][T26582] ? __pfx_vfs_write+0x10/0x10 [ 702.780957][T26582] ? __fget_files+0x2a/0x420 [ 702.786401][T26582] ? __fget_files+0x2a/0x420 [ 702.791191][T26582] ? __fget_files+0x3a2/0x420 [ 702.796361][T26582] ? __fget_files+0x2a/0x420 [ 702.801052][T26582] ksys_write+0x150/0x270 [ 702.805564][T26582] ? __pfx_ksys_write+0x10/0x10 [ 702.810512][T26582] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 702.816723][T26582] do_syscall_64+0x174/0x580 [ 702.822142][T26582] ? trace_irq_disable+0x3b/0x140 [ 702.827350][T26582] ? clear_bhb_loop+0x40/0x90 [ 702.832477][T26582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 702.838554][T26582] RIP: 0033:0x7f325599e0d9 [ 702.843112][T26582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 702.863737][T26582] RSP: 002b:00007f32567b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 702.872330][T26582] RAX: ffffffffffffffda RBX: 00007f3255c25fa0 RCX: 00007f325599e0d9 [ 702.880842][T26582] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000006 [ 702.889763][T26582] RBP: 00007f3255a35024 R08: 0000000000000000 R09: 0000000000000000 [ 702.897889][T26582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 702.906112][T26582] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 702.914181][T26582] [ 702.918352][T26582] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 702.925683][T26582] CPU: 1 UID: 0 PID: 26582 Comm: syz.3.7173 Not tainted syzkaller #0 PREEMPT(full) [ 702.935093][T26582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 702.945183][T26582] Call Trace: [ 702.948505][T26582] [ 702.951463][T26582] vpanic+0x56c/0xa60 [ 702.955536][T26582] ? __pfx__printk+0x10/0x10 [ 702.960265][T26582] ? __pfx_vpanic+0x10/0x10 [ 702.964834][T26582] ? is_bpf_text_address+0x292/0x2b0 [ 702.970168][T26582] ? is_bpf_text_address+0x26/0x2b0 [ 702.975441][T26582] panic+0xc5/0xd0 [ 702.979202][T26582] ? __pfx_panic+0x10/0x10 [ 702.983668][T26582] __warn+0x315/0x4c0 [ 702.987713][T26582] ? ieee80211_free_keys+0x56e/0x680 [ 702.993470][T26582] ? ieee80211_free_keys+0x56e/0x680 [ 702.998789][T26582] __report_bug+0x276/0x570 [ 703.003408][T26582] ? ieee80211_free_keys+0x56e/0x680 [ 703.008742][T26582] ? __pfx___report_bug+0x10/0x10 [ 703.013800][T26582] ? schedule+0x16e/0x2b0 [ 703.018154][T26582] ? synchronize_rcu_expedited+0x663/0x770 [ 703.023989][T26582] ? __pfx_synchronize_rcu_expedited+0x10/0x10 [ 703.030175][T26582] ? ieee80211_free_keys+0x56e/0x680 [ 703.035499][T26582] report_bug+0x16a/0x220 [ 703.039865][T26582] ? ieee80211_free_keys+0x56e/0x680 [ 703.045189][T26582] ? ieee80211_free_keys+0x570/0x680 [ 703.050512][T26582] handle_bug+0x9c/0x200 [ 703.054794][T26582] exc_invalid_op+0x1a/0x50 [ 703.059335][T26582] asm_exc_invalid_op+0x1a/0x20 [ 703.064210][T26582] RIP: 0010:ieee80211_free_keys+0x56e/0x680 [ 703.070147][T26582] Code: 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 17 57 86 00 cc e8 71 c3 78 f6 90 0f 0b 90 e9 22 fc ff ff e8 63 c3 78 f6 90 <0f> 0b 90 e9 30 fe ff ff e8 55 c3 78 f6 e9 1b fe ff ff 48 c7 c1 40 [ 703.089782][T26582] RSP: 0018:ffffc90004df7580 EFLAGS: 00010287 [ 703.095877][T26582] RAX: ffffffff8b4e509d RBX: ffff888055818ec0 RCX: 0000000000080000 [ 703.103872][T26582] RDX: ffffc90006c15000 RSI: 000000000003e254 RDI: 000000000003e255 [ 703.111863][T26582] RBP: ffffc90004df7650 R08: ffffc90004df7367 R09: 1ffff920009bee6c [ 703.119870][T26582] R10: dffffc0000000000 R11: fffff520009bee6d R12: dffffc0000000000 [ 703.127885][T26582] R13: 1ffff920009beeb8 R14: 0000000000000002 R15: 0000000000000001 [ 703.136169][T26582] ? ieee80211_free_keys+0x56d/0x680 [ 703.141949][T26582] ? __pfx_ieee80211_free_keys+0x10/0x10 [ 703.147795][T26582] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 703.153896][T26582] ieee80211_do_stop+0x11fd/0x2410 [ 703.159062][T26582] ? __pfx_ieee80211_do_stop+0x10/0x10 [ 703.164594][T26582] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 703.170449][T26582] ieee80211_stop+0x1ab/0x200 [ 703.175156][T26582] ? __pfx_ieee80211_stop+0x10/0x10 [ 703.180397][T26582] __dev_close_many+0x366/0x6e0 [ 703.185289][T26582] ? __pfx___dev_close_many+0x10/0x10 [ 703.190694][T26582] ? __mutex_trylock_common+0x15f/0x270 [ 703.196270][T26582] ? __pfx___mutex_trylock_common+0x10/0x10 [ 703.202280][T26582] netif_close_many+0x222/0x410 [ 703.207169][T26582] ? __pfx_netif_close_many+0x10/0x10 [ 703.212659][T26582] ? __mutex_lock+0x30d/0x1550 [ 703.217450][T26582] ? rfkill_fill_event+0x29c/0x3f0 [ 703.222591][T26582] netif_close+0x160/0x220 [ 703.227038][T26582] ? __pfx_netif_close+0x10/0x10 [ 703.232031][T26582] ? __pfx___mutex_lock+0x10/0x10 [ 703.237173][T26582] ? do_raw_spin_lock+0x12b/0x2f0 [ 703.242224][T26582] dev_close+0xf7/0x210 [ 703.246438][T26582] cfg80211_shutdown_all_interfaces+0xb0/0x220 [ 703.252616][T26582] ? __pfx_cfg80211_rfkill_set_block+0x10/0x10 [ 703.258792][T26582] cfg80211_rfkill_set_block+0x2d/0x50 [ 703.264271][T26582] rfkill_set_block+0x19f/0x4d0 [ 703.269151][T26582] rfkill_fop_write+0x43b/0x560 [ 703.274158][T26582] ? apparmor_file_permission+0x1f4/0x300 [ 703.280000][T26582] ? __pfx_rfkill_fop_write+0x10/0x10 [ 703.285400][T26582] ? security_kernfs_init_security+0x250/0x270 [ 703.291587][T26582] ? rw_verify_area+0x203/0x4c0 [ 703.296477][T26582] ? __pfx_rfkill_fop_write+0x10/0x10 [ 703.302053][T26582] vfs_write+0x296/0xba0 [ 703.306339][T26582] ? __pfx_vfs_write+0x10/0x10 [ 703.311210][T26582] ? __fget_files+0x2a/0x420 [ 703.315858][T26582] ? __fget_files+0x2a/0x420 [ 703.320479][T26582] ? __fget_files+0x3a2/0x420 [ 703.325186][T26582] ? __fget_files+0x2a/0x420 [ 703.329818][T26582] ksys_write+0x150/0x270 [ 703.334260][T26582] ? __pfx_ksys_write+0x10/0x10 [ 703.339136][T26582] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.345231][T26582] do_syscall_64+0x174/0x580 [ 703.349938][T26582] ? trace_irq_disable+0x3b/0x140 [ 703.354992][T26582] ? clear_bhb_loop+0x40/0x90 [ 703.359711][T26582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.365824][T26582] RIP: 0033:0x7f325599e0d9 [ 703.370351][T26582] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.389976][T26582] RSP: 002b:00007f32567b0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 703.398441][T26582] RAX: ffffffffffffffda RBX: 00007f3255c25fa0 RCX: 00007f325599e0d9 [ 703.406434][T26582] RDX: 0000000000000008 RSI: 0000200000000080 RDI: 0000000000000006 [ 703.414429][T26582] RBP: 00007f3255a35024 R08: 0000000000000000 R09: 0000000000000000 [ 703.422513][T26582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 703.430510][T26582] R13: 00007f3255c26038 R14: 00007f3255c25fa0 R15: 00007fff5ffd6dd8 [ 703.438521][T26582] [ 703.442186][T26582] Kernel Offset: disabled [ 703.446538][T26582] Rebooting in 86400 seconds..