last executing test programs: 4.889721597s ago: executing program 4 (id=7065): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r6, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) sendto$packet(r7, 0x0, 0x0, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r6, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) 4.889381893s ago: executing program 1 (id=7066): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x110, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x4e23, 0x1900, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @mark={0xc, 0x15, {0x35075b, 0x3b}}]}, 0x110}}, 0x0) 4.846553135s ago: executing program 1 (id=7068): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.508668665s ago: executing program 1 (id=7071): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4002, 0x5, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x0, 0x48, 0x0, @wg=@cookie={0x3, 0x4, "96597d00c5c0577eec4f99e3a24dd89fb66655d7b05291cb", "af6af5116bf52dbb91d30ae25aab828a961858f6c338a29f34c53e0526788e16"}}}}}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000080)={r2, 0x3, 0x6, @random="7c6a97bead69"}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) bind$packet(r1, &(0x7f0000000040)={0x11, 0x1, r2, 0x1, 0x9}, 0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0xfffffffe, 0x2000001, {0x0, 0x0, 0x0, r2, {0x7, 0xa}, {0xd, 0x9}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) (fail_nth: 3) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0xffbf}], 0x1) r7 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r7, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000001a0001ff80000000000000000a0080"], 0x38}}, 0x0) 4.265964974s ago: executing program 4 (id=7074): r0 = socket(0x25, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a000000030000000400000008"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x8901, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110c23003f) ioctl$PPPIOCSFLAGS1(r3, 0x40047459, &(0x7f0000000000)=0x100) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000009c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000006000000000000000200913487fa08ddf96b6a000d0000000006000000dd7f323e6e00000000000800000005000000002ee846dd2a2d40fa78d302f002fbdb92516511dc8e345f74a9a7191ab3c6bb31208f25b8f8ad33ed0840a2a1274a99dfdd7bde22b3cc08e9f2c997f71c0eca24132a954cc3ce435a4c61b1055fac79c81335b280da"], 0x0, 0x3a, 0x0, 0x1, 0x5767}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0xfffffffffffffda3, &(0x7f0000000180)={&(0x7f0000000200)=@delnexthop={0x20, 0x69, 0xb, 0x0, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000) ioctl$sock_SIOCETHTOOL(r0, 0x89ff, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000400)=@ethtool_ringparam={0x6, 0x0, 0x20040001, 0xfffffffd}}) r5 = accept4$alg(r0, 0x0, 0x0, 0x80400) listen(r5, 0x2) tee(r5, r3, 0x7030420f, 0xc) 1.64509016s ago: executing program 0 (id=7080): sendmsg$ETHTOOL_MSG_LINKMODES_SET(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="a0000000", @ANYRES16, @ANYBLOB="050424bd7000fedbdf2501000000080001"], 0xa0}, 0x1, 0x0, 0x0, 0xaddf11c998560ddf}, 0x24040084) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)=ANY=[@ANYBLOB="180100002f00"], 0x118}], 0x1, 0x0, 0x0, 0x4000}, 0x0) (fail_nth: 5) 1.565781733s ago: executing program 1 (id=7081): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.558210317s ago: executing program 4 (id=7082): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x1c, 0x46, 0x107, 0x70bd28, 0x0, {0x1, 0x7c}, [@nested={0x7, 0x4, 0x0, 0x1, [@generic='6dy']}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r1, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x128, r5, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}, {@pci={{0x8}, {0x11}}, {0xd}, {0x5}}]}, 0x128}, 0x1, 0x0, 0x0, 0x1}, 0x1) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_QUANTUM={0x8, 0x3, 0x748}, @TCA_FQ_FLOW_PLIMIT={0x8, 0x2, 0xda}]}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10001, 0x1, 0x3, 0x8, 0xffffffc0}, 0x4, 0x1, 0x8, 0x0, 0x3, 0x0, 0x16, 0x13, 0x3, 0xca, {0x0, 0x8, 0x3, 0x5, 0x84, 0x8}}}}]}, 0x78}}, 0x0) 1.186894195s ago: executing program 0 (id=7084): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000002500090122bd7008f9ffffff0200000008003f80000000000800030047"], 0x2c}, 0x1, 0x0, 0x0, 0x4000001}, 0x10) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000f01000000000000", 0x20}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000005c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a40)=@delchain={0x254, 0x65, 0x2, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb4bb54943a379556, 0x10}, {0xe, 0x8}, {0x3, 0xfff3}}, [@filter_kind_options=@f_flow={{0x9}, {0x1a4, 0x2, [@TCA_FLOW_DIVISOR={0x8, 0x8, 0xe}, @TCA_FLOW_DIVISOR={0x8}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x3}, @TCA_FLOW_KEYS={0x8, 0x1, 0x85d1}, @TCA_FLOW_ACT={0x168, 0x9, 0x0, 0x1, [@m_tunnel_key={0xf4, 0x20, 0x0, 0x0, {{0xf}, {0x68, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x41}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xfffffff3, 0x2, 0x10000000, 0x800000, 0xd}, 0x2}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @empty}]}, {0x5f, 0x6, "725425e0db74b580307b428f6ecdc2c5fb9a0700000005ef3b9a0246307e79add659181b585be595a308d895f999637a3fb40939c54d9ac77962d45c4af459a3f93b1d59d1d316542820c02bf2668a724000000000000000002eb1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x70, 0x12, 0x0, 0x0, {{0x7}, {0x4}, {0x47, 0x6, "e48c5dbdbda34416f988f89b697cdad84c18eb5a19610816d67b342e6b7619e9b339a411ff47455357650607c763c5750b7fce01fe0ef9a87f50208b6e07f3f7d16b14"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0xfff2, 0x4}}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0x6}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1d121}]}}, @filter_kind_options=@f_flower={{0xb}, {0x4c, 0x2, [@TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, @TCA_FLOWER_KEY_SCTP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_CT_ZONE_MASK={0x6, 0x5e, 0x187}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}, @TCA_FLOWER_KEY_CVLAN_ID={0x6, 0x4d, 0x197}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @multicast2}, @TCA_FLOWER_KEY_ETH_SRC={0xa, 0x6, @broadcast}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @empty}]}}, @TCA_CHAIN={0x8, 0xb, 0x80}, @TCA_RATE={0x6, 0x5, {0x5, 0x8}}, @filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_MODE={0x8}]}}]}, 0x254}}, 0x24000040) r3 = socket(0x10, 0x3, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1b, &(0x7f0000000480)=0xe69b, 0x4) getsockname$packet(r3, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001300)=@newtaction={0x17d4, 0x30, 0x9e54f29ff072a93b, 0x0, 0x25dfdbfc, {}, [{0x17c0, 0x1, [@m_mirred={0x1b4, 0x2, 0x0, 0x0, {{0xb}, {0xc4, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x35b1, 0x8, 0xffffffffffffffff, 0xffff8914, 0x3}, 0x2, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0xc7f, 0x20000000, 0x80000001, 0xee9b}, 0x3, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x2f3, 0x7, 0x7, 0xfffffffa}, 0x3, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x79, 0x1, 0x5, 0xf9f}, 0x4, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x2, 0x7, 0x10000000, 0x5, 0x1}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0xa, 0x0, 0x2, 0xff}, 0x3, r2}}]}, {0xc8, 0x6, "eeac71678583dfc5d7f486af564b98c14db3e43ff2472212b8d20014baccb7f4d2c18394e2d15ad52c24f2e6626969612892b33eb7e3cb823258cfec4256e795a3539a1f84bf4c7c7fce7253fef1344660bb4a04f21fda668102f3518650012f82b0b620f6b3571a1707d65bf7a802492759a7c8e64d0836d78f0c8ae1627c0b6c2aa4a81d8f307ad316da381e50ef81316fbef6547534e9d86a2d2c661c93e7f25d552c4d62979b6ce1501879845421e17c2000e2e66c365c03e0066301459463e705bc"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_connmark={0x1b0, 0xf, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0xa, 0x5, 0x1, 0xfff}, 0x6}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x5, 0x2b75d1642658f9d9, 0x9f, 0x3}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x58b80000, 0x517a0, 0x10000000, 0x6, 0x7}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x3, 0xffffffffffffffff, 0xffff, 0xd}, 0xa397}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1000, 0x5, 0x35b7d1f5e359e05, 0x0, 0x86}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xaf6, 0x1, 0x8, 0x3, 0xbd}, 0x6}}]}, {0xd6, 0x6, "c9964c55fedbe2715ee9412917bf84782563a277dcd9ca86330f1a7c5983233a4b9d02990191d322ef485a6f20f53d2bef1d10435c9dba90694ec59782aa65dabb4a4b37d3505d9488fb1402a79058af30a311bca73e85bae33491b8d5e686c0524e07b7b8a00bc6f3221be02316b19fd5fd0f343289770f0087a0e5c000df19792f9aa04ab83461b3f93c59fe3f00ea3bf9b38a7ae417a24736e7a2738b3621c1f5b89ba75ebe468ea175523bd33fe4fc2860d2a66ae9820f769b18ac33765792bbe0f47f206136f03f9f5b235b0ee02819"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_gact={0xc0, 0x6, 0x0, 0x0, {{0x9}, {0x4}, {0x94, 0x6, "545a9810c451fba8c8a958a3d6376058eddd888eea47a6f0ff4c3c3eda952dc84cb7a2ce10d0cfb70c12b6ca2f001e25ba154c9d87bc838cd897d06d28bde1f1dc71e56fc57a68179c36be2b529ad495f2f77000d1a3d57129df6cadddd29fc795de24e7d6ee64da92c23061ef98a4501f828dc9c5efe1acfed13249ec8483a1df17f957cbd60fd76b12b43b316ec1ae"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x6}}}}, @m_nat={0xcc, 0x19, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xc55c, 0x8, 0x5, 0x8, 0x9}, @local, @private=0xa010101, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x10000, 0x0, 0x5, 0x8}, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4f, 0x6, 0x2, 0x2, 0x6}, @rand_addr=0x64010101, @rand_addr=0x64010102, 0xfffffefe, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xde, 0x0, 0x1, 0x6, 0x8}, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x50, 0x10, 0x0, 0x0, {{0x8}, {0x10, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @local}]}, {0x1b, 0x6, "bb6cd8c43bdfa0896020f07e405b141948bcf6f770c244"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x78, 0x9, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, @TCA_IFE_METALST={0x20, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x1}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x8}, @IFE_META_SKBMARK={0x8, 0x1, @val=0xffff}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}]}, {0x23, 0x6, "b1dcfaf5ca81a726dc8c0563ba6d4805a36c890a33887a1b85ef9da10a428d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_csum={0x108, 0x20, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0xa, 0x3, 0x8, 0x1}, 0x6c}}]}, {0xc0, 0x6, "00a5711033f28f522b2ef3e43d1331b6001718f3fe2aa17acdcfb6c676485d15c4a90ca8e53d06105ad8427aa5d32a768a8dbce5a0a4312bab2cf195b5b7c844bb1a8d0c208b3dfc12ed9e4169c0ceba317f50b7d720a4430338137e37123b2d495199fbd5c1be59711e35a498ff0ae3e9fbfdbee29bc3415c845de4ccdc39520977ac36a648c46f0bb38a74f50b0c1d71c589693c3fe38463811709dc3ed77558d73cb6965de2b4f3395e249077a4809ae352642193c0fb9caa60f3"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_mirred={0x1070, 0x9, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0x7fff, 0x20000000, 0x2, 0x8}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xf, 0x9, 0x20000000, 0x4, 0x4}, 0x2, r2}}]}, {0x1004, 0x6, "da8ca520d9c171c6648ceb260dd207e7723887edcfbf4dcf1a3e8a3846aad5d7297ee1f321eeaab0c0accbf068603afaa9d5c2b29e1172a766f48579cd1df3a70903172cc7ef6a6a60f18293bea3285a003cb6f3bf4ee222fb601e6dddad154e077658e07f40cbb029c010d0db4d4bef7a72aea8273b149ab05cffd9a88db73deac8c04473f76b8993ebaab2e307180a72b526e2d315ec60a6e1fcb197666d4c8a02a9231787934a55b1f2e2418d117de044d7882feef88bf8d56ab68a4657bf8a24eabe56a5d2b9516ef8eb49c85e1f069f11e275191495c39a1d61049cfcebf76383bd199451059df7435488ba541cf70224835024f254140165e58f58f24c4d053216a830f05d1394a82a6eb4ce22f133a2a6acb7c37fb6778d5e6f25b772c09d6850aacf64bee04d30198b72d9c8bb679112a92106c3a3bed76c6a3530f1c11f1e1fc762bb7f504b318c8a28f63621aed741a3527d26500096b4be69cf19f0b6f37e387a69702e1cec5c69f09ab48f7137269ab1bf1c6700e1b413de865f6eb285ead6718dae95861ebe331aacede182c7ca275cf2694776866ef33f8b75ee3f915f35dc8c99974d29c121a319f8c1800eb541884c1db492f1d667a40f2986bc83affd87c634418f324c6a7d80b5e41b9c8f3ef188241e7302b9e6e672bf12475a18f9f2861f3829a6fc642da9967139bc8929c916379c0681527c29fd25e90f21015c2b40cdc9000a0516725612d351ef8fe2be15d54bca56f56d08cbcf92c9652ee321287ceb9199119d0d74db803a5511499be85ca9aa5ba341d4f1fe69787bc05b4d13620ac43370a70c7c368238be0547183434637734da8718d1d0c3c7cfb1031418e1b23b27a387c650415277a3c33e854a83afb95432073ec8c43271645815456180c832f14a154ed92f35306423fc4918f3a21bffecdc26c1b5f1f9af8fba91c7525aca0944111c9a8cb1a53250ae18fe88fab6ba076e37f1216f19608ef50c3876dec462cc24b3948a9b3465aaeb122276904168dbda22bb6a7ea45f0f86aa7a1c10c826e5c0fff0e57438292e2de6532d0035da3d63d27a34991a5cd311bd136ce98ee9c2df8da6de6ac19851ef54b738a234b7954c6e32e037bd0f4634b478674344b59fbdcc27d16fa4acdb47f7b6ec1609f39ead9af86b3e03f76fa69ba18654edfee45e95f0e8008dfbcce44ea1276470a9c2c89a59c93bb54e6735377647c90ca2a28f553ac303656d7b69c794ce593f9a96c93e3811dfbac74d92a2442ad1dfd3e0a4e007832bc3840e791b08053e9f9f5b80453f9b4f544f2c85b7c8693fd4a88914d25de364c93a52e137b71853f17fc8aee0368a42a5246aca17892da4e61224f809eb8192a73ffb3fb5289f77bf7976aaaa12023c201f3b1b78c0b7fcafff9cf586109ded456f876c7813c292963619254c74de2506985f0aba7fea7a2af7fce07cca3bb4a7cf9d5b5edac7feda655067efb62c9aed7096d8b588f8c8d4812213cd2317fbd34c4e37bcd996db45fd9c85308c3a18cabda6cdce17ef15bd0657cc563069a5fb8d2139bcd23d8dd63f7b0d5cbbdaf8228e57f7241b6b286f76bf351fac2c1b2a4531254a0dc1111f0110aa5a25cc8c6994509c91437f60f25138a33d19b94b34cc10e97bffedd42c8314b496df71fba784df5b8c7d13c971104668fc7bc2d30d599745b9ec2ce073af2fa1e6a220aa337a3d66fa196a547a95068efe228801e66862f0149b38e6f9191a62c0ce1df2f6ff5540a035f1d268098ec484da4732a0441b84346c63d3fc9bdbc3b63c01969cd5291834cb6e8d9cdb4836bfd826835756467709437aa034326533d29d3a551535c5aa94d4b98c61a68904fb795261ff985ba8fa2c193a30af5b45ce38a2bc5ae3d2f8b2d9e95f012bbe9b7616007242f8ea8c21fb1824f0fb6929468ac98401ce9edf4c28bccc76981f08b43a269b90747eabae5dbda0df04c32d68ffe3e92b707ae69db15005c7bfbfdcd22c94703944db48537e5a895390fed39ca958bc43a372ab8a0153dbd311e1aaa57ee0fff774692efdb4e2837334d9e1c2c6b67821758ecfbb01b53883163e85dca9a68518afe304fbc972aaee115e44c60f0142c934fb04343f6c18b9dabefb6a44f9e17704797148a6749172c489d3041f299c82cdc9d24d9dab377c85afae2099a0cad1eeb660d04c1e5f0c6489296c491bcca7c2215e0037e860b3582a6f1e5430e19510757ad3344c7805d7513416feb572813bb4d368b229c839cda5e2556c25e72be2504b0c746b80961b500b10543b060ba202a50c0b76421becdce6f4823f71539f29fcba14279632c7000ebfe1d4130b264c3434a7259221011790517ffbb73679a837bf348d96036345f0680c455f2ddf12aa5f4293178fab5c5504064f534a65dc2e7ec88e291a4f1f3d657f77028e4e6b8e4969dc51fa326af88deee1e1be529ad8dc7c12d53a93c198aaa8360f19694c75477a2965fb27b59c5e7f5b360fda1d76032214999bce8e54dadb40a165576006ef5c6fe6a1b92d864ec6f237f51a1283be7a7e1fe6ab2795504044d4450e55b17a3ba199f412f2884bf54b023509b236f9381de27acdbbea3d3c4626e0ea5015b0c406b582939cd60f5e3156b69cc0e83fcb86256315905c1f5702c2bd54fa85167a02085bde510fe336d8925d52190ce987abaa748120ae842ed754a6184abed173a1883dbccbfc881143d4ac67ce47604de256427d46e5c8f33b559a08725a10a9938ec1c1ffbb06697f8857186c34a677668312f8d4a3e0ce8a5021e84429573a9505c23957d3788c1b07770cfa1aeb0709bc55bd60d2f770d80c513838388a2d82da95fa7093c53f196f54f5b19ff3a2047df6f9fa5246b63c9eda8185a87857fde8ab7c7833d3bada3715cf855ebad1dfe21a7a9aef4c053f14ac83e9cd8474b301352530033ff6c65c842813507aece58fab5257b9984d381536300ee6756651d7bc38c8252e371dbe2a5a5b99bc245578790c67a0f539fab423806f0e86eb0302aa13c3b1f6bf22d3b074b5cbd135d90e6ce507bd59ff0280557eb01a43d1e75f039ff03f02b4106c651b931df21deca65f8ef0e2fa3d84c410603a37f989151b23e7609c51eedb6637eb547ecf7c2a29a911cc0f1042708a2a5abe793f1cba8170eedec9251f3fdef04be5ff3e7ed1c7ccc24717b54ca0262dc3402ec2119a2bbd6c4db251f2270e86f96ff86d17c3853edaead99f0a9e474f67a011e186b99329524eff58950a8604b7b0047106801737cabadeb34abd6885815dcfc79722da15857227dd2ee6fd66475cc54a974aee95f6bddbac7506e0c5d09d5acba451e0b760efb539f38347ef54a712088affeca54b8ca3016fd983158b604af52b0af731a793b567e870efce36032e88040aeaadd2a914f13a9467e206252f0672cfcd215f6e52b3a501378a07b4a95361b4622cbf8a2e7b49daf157b63143e2f8d26f3afc6500402b943b60d1497a027fae7931b4437ff454b199bb32706bf8d1848607fa21b046e8d5cddc4467a700ebc72f03909c62f8fd74e6f73a0ab672e0060e8398becf28f8214c8dfc0aa17ba468dca8045216a68d48c217f95480a100a684473d96f1431f92f660bb9b4689470acb8cfdf62ecde3e62c6f48e0073f060b43508f9e326ace5134757f9c49d6d053779776576a97b63b37369e80e7f2cd71dfe8058a821ac6e45ad6777091fdcf2247dab2b2356c76925dc975fd1f690572aa691e7e605ddca6ee529ae91b1bd50e2571cb96e0baa7fc1d73b70487a33b06400fded6e80bb7971990f5569f1bec027a20781906a0ebba386898ee2a10a438709af5e4b9669908054bb34fee6837714c7ca19d5a393bdfb8bbd0dfcf650681598cf4653a3f1628610d70fe42a0d2e0f16b0fb87ab048692a4c8d5eaa79e84acacef3cf9f170869d9028a58fcd45f86669d747ab90dadbc32acc833042b91c08cc409a1a40582f380ae6b7823fccc2a4f96134ca633b3a9bd501e34da6244c97ab96ac71c4e0cc1d67854481f8610ced80598a6537f0af57ff8b6ae5e5a70fc11e4e528a95dbfc4c231a697edfeb653afb9d3de2a8db90d33c176895118b6634b9a28b10bca76fc961479796e26e91da97523fc32aa1b452b70b06ab0b33eaf23abe4f2740ea1a56265cf7d4e1fed299b36cdba825d11985ce92e5022446dccbada102d52fa2332a98c10aaf6b40f90debb2798e6283f1c1d90acfd4519732fa3f30f570542a92badeebffe67d470f02f2c35095774d47e0a68339f05b56fa00151d9626b1fb180f3310137b20c2d4a778959224ae9f1f9c18f34ce3af5a6cfc1620274bbe5a2e81d03f5423683da0bf140088895f8b61baeb31ed771f581523249b7c4928f08818601b8c634c62974cc0b56cdbf19c2f2b811820bbbff8c1f5270c468cf4ba156837c02582903c34da41636fccf36a682dbbb852639eda43b9aec4fc4224920af6def5cbd13992281ef4991577eeeb0a26cdff581b975322c6d3813566600fc4fbbab0cf9408106b5479a024f8a2a49d9db01e5b6701c90cc12a1c150d449416c6ed459bf4df266b5a66c8d4599c88d81fb1e8a3014fc27baf9fc3a87f6c3ce2d6fb87ac7191b2899a06e8aef12ac3fc79e65f347a2a3dab0000e021d140f0bed0effbfd3bbf1b8eac1796be00257d9e9e98c1f2c4756449de46c6e1288e3f1f74474df22367267f34b63005dadf7c55aa4ede2c5a83c053498e6a642c7ab2018281fb2617743d573bd41023274dbf832ce1360623f1d10f443c0daf6e4c8839cf4436a7edf1a86f3bdc6eb7e757c07d3034bb00784bbc44f11adb7da02512a27304734a9230517f4d2ae39f6f8d5f3dd008c23372057629c3a5a10ada68aaf871ac0271507c9430b3206df67d571f57c4771596b54b17d189a2dc2abac4aef0b0a8198d3b5266f4086e580ebdd8e57752ee55dabd70355b150cf1e981010c524967598f856fd19d02f1df86d321108fa9e1f222a7a58cb4c448561fffeb351a12c6ee241668fcd76e7cdc8857b26a768d63d4fe11729be72c4d1a7bdda26898376f93716e056e723590c05553ac7000f88f072243baaa10ae75abb05a05722724963ec4a99182d3560cdeffdb69c2a2a805bbfb716e7e4d7c497a36e52265cec64cf4a126e6c67887e9ce325dfd6c1442b2811a57486e94856bf3ba663186524d6f98ee78a5ec6b68f1a364dd3b86cd9da4f1ea59ea557493e8973cc85005779dfb85258fe4acb2fa89127d0c6687d68999ccce31494e9957cf76eaeb276c879f84ac9836e17ff222ed02a91e252cdcac790a7d2c05a610a2dd6aaa234fd3dc5648ba27144fa8444fae1279c86c1b232038cf7516e892a870943735f6d2e61c3a6aa1863ab810d12e646d4ec2a488c2ca31225525ef65cdf17a81e9dcebd92163d30fc9cd37ddf64df5217418667a885a2002a4b130711e0209493fb1808f56fc702b88c3f64434278724acdb1df1fc1d83caa8eed74c82d4362eb040dc289392a402f7ba9ced1a5503077a6c52c10467984fb9169b30a4cf4edae6b09d1ce06b80a4a4817db7935ab561de99d28720912b8bf362390925e9c365cfef8f4d195f88cb096e97418158b40bce7a87e33258d3f1b92750f3e0ef082870c984a0471ab041babfd9b88a65c6775e42bba49ccc5a9514d3f336611d0e6ab2ce20c79fd12fb3acad7d84e33b866cda27727db3e5188c3c2c8a797bf9e0b8fcd263649cdf32ba1fe1bb1945d8de8aa48d163aaa8"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x4}}}}, @m_gact={0x8c, 0xd, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xfff, 0x10, 0x7, 0xfffffffa, 0xfffffffd}}]}, {0x45, 0x6, "9676f8ee51cd4faf8640b19adce850d76458fa42e8330ae056f62a2f86f2b9e5608f675cbd41c09bbc6dff03594e51c5f32c8c34139a231f52f1b744c67ecd4bdd"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x4}}}}]}]}, 0x17d4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000202070250000000000202020c31af8ffa1000000bfa10000000000000701000000feffffb702000008000000b703000000000000a6000000ca00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BTRFS_IOC_SEND(r5, 0x40489426, &(0x7f0000000340)={{r5}, 0x3, &(0x7f0000000180)=[0x0, 0x7ff, 0x1], 0xe1, 0x2}) r6 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x104, 0x4, 0x408, 0x0, 0x0, 0x0, 0x320, 0x320, 0x320, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@random, @rand_addr, @rand_addr, 0x8}}}, {{@arp={@multicast1, @dev={0xac, 0x14, 0x14, 0x25}, 0xffffffff, 0xff000000, 0x3, 0x10, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0x0, 0x181, 0x0, 0x0, 0xff, 0xff]}}, 0x1, 0xc147, 0x8000, 0x8, 0x0, 0x7ff, 'veth1_macvtap\x00', 'caif0\x00', {0xff}, {}, 0x0, 0x348}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "00fc6318467e3c83c37e66cec1e44eb18a67f9ab80f453c14b046598b980"}}, {{@arp={@remote, @private, 0x0, 0x0, 0x0, 0x0, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x652b910927df25be]}}, {@empty, {[0x0, 0xff]}}, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 'gre0\x00', 'pimreg\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @mac=@random="0400", @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, 0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x2}}}}, 0x458) accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000040)=0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008d7460001"], 0x48) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000004c0), &(0x7f0000000500)=0xc) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000010880)=ANY=[@ANYBLOB="0200000004000000080000000c"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r8, r7}, 0xc) unshare(0x400) socket$inet_smc(0x2b, 0x1, 0x0) r9 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f0000000280)=[{0x28, 0x8, 0x0, 0xbfffdffe}, {0x80000006, 0x9, 0x9, 0x5}]}, 0x10) 1.186010522s ago: executing program 3 (id=7085): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000500), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000580)) sendmsg$NFC_CMD_SE_IO(r1, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r3) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000005000), 0x0, 0x60, 0x0) listen(r3, 0x40000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x403, 0x2, 0x2, {0x0, 0x0, 0x4, 0x0, 0x4300, 0x1000000}}, 0x20}, 0x1, 0x1000000, 0x0, 0x20000044}, 0x14) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$rxrpc(0x21, 0x2, 0xa) ioctl$int_in(r6, 0x5452, &(0x7f0000000040)=0x400000000000009) setsockopt$sock_int(r6, 0x1, 0x7, &(0x7f0000000240), 0x4) r7 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) r9 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x3fe3aa0262d8c583, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {}, {0x6, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x40022}, 0x2000400c) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r5, 0x84, 0x17, &(0x7f0000000080)={r8, 0x2, 0x1, "fa"}, 0x9) 1.128070623s ago: executing program 1 (id=7086): pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x2, 0xa, 0x300) r2 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000040)) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x53, &(0x7f00000002c0)={0x0, 0x0}, 0x10) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) socket$netlink(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0700000004000000000900000100000028"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000002000000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r4, r3}, 0xc) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c000500080005"], 0x3}, 0x1, 0x0, 0x0, 0x40900}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010026bd7000000000001d00000008000300", @ANYRES32=r7, @ANYBLOB="30002f800c0002000000000000000000080001000000000018000380080001"], 0x4c}, 0x1, 0x0, 0x0, 0x4811}, 0x0) 964.105404ms ago: executing program 2 (id=7087): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newlink={0xa8, 0x10, 0x401, 0x5, 0x3, {0x0, 0x0, 0x0, 0x0, 0x503}, [@IFLA_LINKINFO={0x88, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x78, 0x2, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x10, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x308, {0x10005, 0xb}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x2, 0x9}}, @IFLA_VLAN_EGRESS_QOS={0x1c, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xfffffffa}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x2, 0x49b}}]}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x8, 0xf}}, @IFLA_VLAN_INGRESS_QOS={0x28, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x6}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0xffffffff}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4590, 0x6}}]}]}}}]}, 0xa8}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000) 962.124295ms ago: executing program 3 (id=7088): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000"], 0x7c}}, 0x20004450) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001ec0)=ANY=[@ANYBLOB="340000003e0007012bbd700000000000010100080400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="080002"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$PPPIOCGMRU(r6, 0x80047453, &(0x7f0000000200)) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x108, 0x6, 0xa, 0x41f, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_USERDATA={0xd9, 0x7, 0x1, 0x0, "b80b2a674eb2310e7c76af09acb4c43e5e30a8ffa69465b9cc2b60c0ca93516bcddeb6df4ed59d589a22590e190e2480dac171f3ccf08082e57a9e7ff377ba2007657d7f41f76da0f79de2e4cdb35fad888664d1b549c90b6ba9bfc65dcf9e963f16fcfd7cb094264219f8b4bde01f0aaa4fee9805b5687d0073c7447e403f495c3bdd29d770837480bf5fa06e283c93efeb45206b3b82d237560dd27b86743a02b68fc72c70268e30e8a6f0b53bc3c1498941da60c8a2d84b7a1200985e3726aefd04b8776731bf4139a4a68be359501542718798"}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x130}, 0x1, 0x0, 0x0, 0x14040001}, 0x24000840) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r3, 0x852ac000) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000002c0)={'bond0\x00', 0x20}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xfa, &(0x7f0000000f40)=""/250, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa}, 0x94) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001000000000000000000050000083c"], 0xfc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x1c, r1, 0x1}, 0x1c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, 0x0, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000600)={&(0x7f00000003c0)={0xc0, r8, 0x100, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x7, 0x4e}}}}, [@NL80211_ATTR_TID_CONFIG={0x18, 0x11d, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x44, 0x11d, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x10000}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xd}]}, {0x1c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x4}]}]}, @NL80211_ATTR_TID_CONFIG={0x2c, 0x11d, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}]}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x40}, 0xcdda48e8b32cdd86) ioctl$sock_ifreq(r7, 0x8917, &(0x7f0000000080)={'bridge_slave_1\x00', @ifru_hwaddr=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}) 800.135631ms ago: executing program 1 (id=7089): bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0300000004000000040000000100000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="18"], 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={'syztnl2\x00', r0, 0x8000, 0x700, 0x8000000, 0x4, {{0x16, 0x4, 0x0, 0x0, 0x58, 0x65, 0x0, 0x7, 0x4, 0x0, @empty, @multicast1, {[@cipso={0x86, 0x44, 0x1, [{0x5, 0xe, "34d29f74d5e8ba51faae3df7"}, {0x2, 0x11, "0de8ca4279bb271de36543f935ee5c"}, {0x5, 0x10, "c654bebfc6418f722b63e12ef752"}, {0x2, 0xf, "3be0eb5d455ea2086e14a53851"}]}]}}}}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(r2, &(0x7f0000000000), 0xffffff98) splice(r1, 0x0, r2, 0x0, 0xc, 0x4) sendmsg$TCPDIAG_GETSOCK(r2, &(0x7f0000001c00)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001c40)={0x1148, 0x12, 0x200, 0x70bd29, 0x25dfdbfd, {0x15, 0x6, 0x8, 0x5, {0x4e21, 0x4e21, [0x3, 0x9, 0x4, 0x3], [0x3, 0x8, 0xd5c3, 0xfffff001], 0x0, [0x10000, 0x6]}, 0x1000, 0x800}, [@INET_DIAG_REQ_BYTECODE={0x80, 0x1, "ffe19e9be648f9e13608477e718a1a18bf7719ca1227e82cf089eea348ee1eaa94fbb9442f20db1f54eb6ba20330b320977a01f533aa14acc374d5d671376ba1a17beff967d2d29b828e44eabe2511d849b7b87c9d9331b297ea493af978ce3397c9f13d79a391d3515127844eeb5e99cda6db04e90180196dbe8ebf"}, @INET_DIAG_REQ_BYTECODE={0x4b, 0x1, "061d0afadf46270c28cf723b3e5727bf457ef3d59ecf6cf82217d82e45f8cc60ae53bd1839b2020e867bb3f93a66970ddc833ea48e60d949577bc1c87e3856af8e52421d80d243"}, @INET_DIAG_REQ_BYTECODE={0x102e, 0x1, "51d9f74786bade6dd843816763066b36464e3ae2da07ce4d99bf7ebf1ccaaeac73690910076d12aa3f938951f9191b49f5c808283dc584c7bfe3174fc5f5cbd9f35bef921c41564721fee94c9b3a07ceff15e53d486ef87e1b57597b1e31686b8aec238f270b73aac4fdff0aee469a9077aabec10bd4abdeda6e46090a9214d2dd3efd266bd045de2c54a8068be1a5e6089eaaf9a99e69198332e7949a863b070bc5de17c44bc89ae0441e3ef0b3caf1223f6a32dbca1c4c3204a4f77d0a7c57f40cb54dbb1d24ab201910271c1d6685991e0a8592ebd11e88d75a2c27d0ec7c3049131459bdac9b82c070dad6584ea171ec3998ff6295e8ce2be565c16b6b60ebf3e3e9a0f9840bb1e955a3f3c957fa2c59a53f20d79db960052a0aa01d82984bbcbd89940a3d2fb8ee1f9b555e3e81ca0ec4f0795a237316560622699b145c90ebda73ab21d3122ac317d0c9a86d9a1747fac9141295ec0da1a6cec6392efd6ff115d82dffe64659d863311db1c29825fa52e201a1c1db61e37f18dc3e797660018726127e636184a747edbdcb2491d1bedd990db4ca2714359c277815fcbda680b7740cd08695090d218add89a5e69b067e2347e527e7efccb0c0422166eb899d405f6585dec910a6da7a68b5751ef870fcaeb48df0bf2daf5efae6412f3ecf51d68623261c83b6722194259f9f2013f93b508dfd4f7fedd4e8f428c1b6e86f17c83e8201e2af568cbaa4a2573e2b6c32fa01f39ad9ca33bd1224162f08af21ec9e2332f5756d25582742e2ce627a65ab6a1046ac44ef31c7759a4e4e98a519d7eb482e1ee8834c60ad82e4311a4db23f792db6c8a2a6559cbc2083543fbe740e8f8084f3806d2f8f0809d53170754baad3f0dffb4c8005d7977ffbcc5d36022e0a5a50144c006eea347932f8886e3e6829c5eb964523459bf70de388a417edc051f9da64fbec25fd8137617fe4fbd38cbd00e3054fa1ed63893fbc45f42fd3be96a52eba8febe4efd79e07dcb2de96475e4c331064b93757b0e50d7d87535df697677ffa6b1c13d6b6e9db8b2838dd7a4b80258d3f9fb69d07bc1b61a6aae5f211ff9c559830c40b12d8a7f3b3d927d949a3089f4e15b4fa8437af1faf32372280b51f1745fae443e52e417cb5a2cd2b72310f0314fd4480844f12cf4a93c478c0c4cef248c6b0a2a14cf39cef0991526feaaac306b7ae32c56fed5092054095291a263bd4538faa3fb0e9db4e6c18194daf5721ace0725a99a82757cabb31093368fa1d2a056e2573edde3a4d2844c61e84b573876257750d9e154754185a19dcd5e6bea96fe65d6bc0b55023bc5fe78a650b6f50098dcbcc4871907c54ece964ea00c94ba97a5195a6f17ede192a26a19847f096f1ce6408b4dc815312df1d6d70ca9772e8607f446db1310e59113a8fa41c49218051affd2effd749cfb894ef5750ab2349add728e445c04742b1641558e5c33d88fc74cc54fa0edf3c766839af29e7685fbb8e75eced253ea8a333d034420fd773a9423dcb7071bb85f3a4b296582b87ca706615a9eeb1ef5e8cffc94dc11d72359b9896ca0eaa855f215991f2ec8c735d4369d767c62c7cfe383a971db5ff050711a1cf55e0f18a6f59b63d7fa4cc8ed2389a9d7c768ad22f679c1a7a153f0d5ccde4c0c13c76df66ff2f0f4da29ef7d4c204f7f2d02f940658d446939e8864ff0ba37def14f50e97caee670e598cdd809896d5a27ae106c8fec0d944e54c4a518112d090724fb5e0483481f1ac93f005db03de3aac65f0927b08e2590710bbb783588c27f55549fb1a63336a091735467ed3e75eade4d31d5b7594d25ca04d10ac3616e52a3aef1b014809441375ae2177d412d431acec7584d5b46dc08da0a0b66c73826a75789b9e3a9b502fae2ceb495f2c195799a998ff3f24d72397cb3d687822300a945cd4509dff65a3594d3641ad713ebdc183ac386bfd9a913ba22757c7a08687765fb321b8f0b635fbfaea4bf6d010d29594579bcbe84c83b8cad353bce9af4bc11d97a82760e96c5e06befe6e30b35e2c8071b96f1ab910a955a5068773e5436234d49b81ee6dcf72dcf4a94b5366ca626126b1189dbe30056c50db323ffcf9449d38d23229d4611052b976f4ffafcbc077f9a767b8366433f6487ae9a1f381007d4aab58dec918b07fa114ef1841771912a8e3a5c93fda5920c2124a1c59ef2938c006c060949ca749c86141dc076409541a41a2e05135a9667c867f88ef5584becc93f1457f053276011ffad924b478ce8ad52edfb899502e7d9a478e2bf1a068622def96758346e07814915d68f152d70e3966f6e528e0e24aaa0d026b4d9dfefa15711b2681f99a5eb6cdb48eabc51e02e7f2ed32c50c6ea32c89c141828e1a87fb4e6140780a833b396866d8613a1fa99672752106df94a15695383e5de38ba2cb4a6106468406980fddef3a11bf616d0f339fa36dd47aed9679a1335854d2baddef98428bbfd8a5ea78aeb686cc7404d4ecac3f136f6d1f9d36b53c25ab267628b6b45bd55b07b84c72db72221506d61ff2eb7c527caf8b4592de2d3686b0dd974ab422cbb7d9b959e8ec963af5f23781e00446e1e6f8cada32d24f5619ea9c4ec2948de426ae428064ba345445173ad5764b4d8fc0eaf95aac21cf7afd74e8ed0998e8cfce96ac5182a63b10c4bdc4d8c1c1f315d1578dae2b7688a2e16dd85643aa095ad702591ebde234183a1282d0c9dfdbb4229a50ca294f1e032361bc3c83421ce1f2f7b80358a218da2b2619c6202585d84347ebb35c99716dbe0f6f4796d8187b5415d54fc8d3f600e190c30ec9e5f242e8ab5e60af6477b070728226ffe9d49f67bec6e3678974c9ecac6e86c63b1bfb55922b61d427f977a4631c2b34d5199d192d6b8ecdea1368a61ce0e5426fc5042a010e40c0571ed457eaa2570d60baef2e7159d799f9a99098ad62f53409e4283707b5ec98e4e6dad82dc46aaab46657349f6fbed9e19d0fcd12920407f9f8c0da6e292b22583c34d290c292b33f63fd0f62ffe972ed99e88ca5588db6487341f091a9f76ddb95654884c48438565e9a5e99b8cf8a32da92f7fbaf7a3794dfb2c05489d9a6ad37b9d706a5741649e40e2a24ba4ba44e0397d1ae37eb1b3bdb6d10709200928494b9438e53095d95a9ccb9bb5c7c11c48ac344cc48d63d7b01f95d9ec0e351342193fedca53529ef66ecdc46612b143e103dcf725a741332afe10e0beb4fa4a80c02e374a8bce807b4267e90cc94c8ad8934974dfa8fa056dcf832bb8401c70c48f7f448e82b4649b6490ac310ec2ffb69de36c5f9d5f6b1cd8f691b08d279cc51fd62538b518e7794a400ddf22d9a4e6bb24fdc01b116eac8d5c4543ca57416074836443b48b962ce54c893ba9b07947a513aa8afb57d2f92e0ad9aa791c7a0241f996a3da241d8142a1baaea91e404168a588005a4897f3844932973eba2da89f47c944a710ec479066103d4ee94da017cd011db1cbf63d8a4f9247e666c74c9010cba9b4084030baa03bcc115a6cd945876076615cb50aa7a23476a87f299676c311c238b8146d6d8fcb7bd7dc5864c5ba580ac6f1405a489862c118b7a3241349e8bafddb63013a1d9c60f44f2bd823729fd3bc8e26edff76d6944282d391a484407949067b9d1300e070a4dd5bd0c2987b857b110398b9ef56823c050a7acd951b9ebf9bfcb50354e2fff6f5cee953ea9d1d9518da972ea362c3fc75594c60f156c0836873088e20330e30a90887ead6516297eb87e66f856d7d37bf32669d23cdd00bd15381fc1510672408a7030bccdfc6072ac26014c32d0968376cbdfeeb71ceab058f0d66de302e84dcc40e956070e98516b078554748a2ef746d00fd40c93a38f5b2260e707f90df154065c56a764485189f745fc3badb42ff03b33dddc3a8b9f6c29eb0914dc16f4bacd2b5e67e0975b2061f9972c8591632afc3f24614bf5c2b8f914ceae4077b5da7eca13e2d577ca19929d23116bc6a1c88676c5c67c06995d8b3a99b3cae655edb8fd5e158dddd20c68b22fcfceeb5b81f6500a062dee80a1772568e5579337ff60e47b4cab2dff2b6eac5e41397fa41768f079b3518dc25941cff17a03c00774dec95d5d0ffba98c6428ba9d8731aa16d87f73f64e4170c86ec871bc67c303775c049f9736b2f76ee3c888dd59d9ec0ddc6e930f584deee940ca012925fd31d2e27d2ecab9ce009a21c69bc220a85c63d489209b425751b4395c4ee72e26368bc1224a7dbc4821beee020d82af8ad5917926f6c0e406892a9d2260a6263e983307c58b5de2df151ea56d7e3287c7b8cf44c2a8f2b152a61f99675a9a0174253e2c790f353c67b425919e0ef32ca7e429a37fd6ce7d16fbce243ca1e0d3806d6f5ddeedcd2c92d1e908065ee01d52d9ef54242e7b38195e18e241afe78c4cb0e1ce51f68bb29c02864500ac95f6e20e6a41948307fb89e42f3f0f8525507e72619aa01976ef1a6f3038393d5abf2bee418e260d64f2a063625e9437c2a7d406672301072b4d0052a9540dbdd9df2814aa23365559832f72c3bf1816b8dcc935daa31b1864e9a9db985c2a012e68ed52c598f1939ad3f055312303c9cba52b38e5e281ee36c4c110d01b32b225bbaa1a5cf5945e277e795e59ddaf5414f5f01546c235f3f32056b2b02bea55303ca9b56312f57da847923805f51251811ad594f8b99bc9b68b03bdada4eddbe5c9f8baf54e0186a2d8cbc3d68678a507001efbeb86f9263a16cfa0f21320784e940271a8a23abb2859cbfefbd4111b3af6120ca61ab38c0f129339bf117a6e3578f077ad21f2b242807455fc9b14aeec0dacbc8d345477587ec6a277cd6321f1ecf246f8d86066967d8878fb6ad2ec08401419a73eed3b9a42c4adcb158e6405ad0356fdb82e073419cea1c9cfbcf2156d1627758f9e830086825ae06f1e59503880e19eca1dcf6af1ab031c674da504ee7061318ef64fa3957c7cb95adda051fd4f42106455783d7835897f988dee1ae9be217760952b94da75e84121668caeede1fdf2b455454c400e3ff37b2d137a2e6e7c97e141c03776482d59cb90d4722a77386881d9360c0edcb8f709f3d50a0cff847b17987f42ebfa8ab1d894fb5592d6b074127dba0b41a0fa3d1574c69f8d2d36786d2d979d076eeaa3695344a202afe15169c2a53d61b8b3d3266c1470a99e2fa4273028efaa359ae69aa908db93f2d6600d0a23f46f7a95c6b46f43f4725961a3d7c62d93294f728001c9b20a5a1a036dcc6d6874b4a1dd900dc475f0525de5254eafbabad11c55e7ca7b51e9f77c81680a12a67f896bb29af0f544aaceaae27c3ee493bf8461db3b56a5a86430ddb1f0589c5b4144f8dfdb4e919f472603b765126c81c63dcadfdd8c5667ce43fd6945aeb6eeafc34c38a85a381f687723bba10eccb92ff61ba79c1e7c5c7c678133148974db9327cc79505c955b799d635d1bea7010facd1eacd32abc1890b4265c790f76c0fdbc495368612ca8f045a81c72aa0570da61f45126286aa503494291496eebd5df304074dfb6bbd55f7897a89bec327931411f6658c10252de6863947da5add301bb6d0b205f40b008fa8fdd5c5934453ac40f6da8e62cbed8f7e40103de93ee875e274a47921d04a81c67c01e21587c7b08ed60ef0a7bf9eee1c90b061801f13b2f2618f0fc78685f95b40ab5bd816b25462ce380fd12e7319c15a2badca57b1148fc5c460e42ade9794a84efde94379d06f1c4f469b2964c4a7c0170941aa09b94de0e3b0a9a72a48a75cfeddb96d2439bd0c7f051b1e9a1e8cc533be5d371c5d9738a2e224c275d993f708a"}]}, 0x1148}, 0x1, 0x0, 0x0, 0x4004}, 0x4) connect$llc(r2, &(0x7f0000000180)={0x1a, 0x55e201c9da05f8a5, 0x7, 0xec, 0x9, 0x4b, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) 790.231257ms ago: executing program 2 (id=7090): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x2, 0xa, 0x0, 0x0, 0x2}, 0x10}}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000c80), r1) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="640000001000370403000000ffffffff00000000", @ANYRES32=r3, @ANYBLOB="0b1b050000000000440012800b00010069703667726500003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000000000000000000000000000aa1400070000000000000000000000000000bb"], 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001800)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmmsg(r4, &(0x7f0000002b00)=[{{0x0, 0x0, 0x0}, 0xfffffffd}, {{0x0, 0x0, 0x0}, 0x75}, {{0x0, 0x0, 0x0}, 0xfb}], 0x3, 0x102, 0x0) sendmmsg$inet(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="100000000000000000000000070000001c000000000000000000000008000000", @ANYRES32=r3], 0x30}}], 0x1, 0xc0) 709.721943ms ago: executing program 4 (id=7091): socket(0x40000000015, 0x805, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="11000000040000000400000005"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xe, 0x0, &(0x7f0000000040)="259f8863a9a34400000200000021", 0x0, 0x0, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 700.532838ms ago: executing program 0 (id=7092): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000c00)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400200142603600e122f00160006000500a8000600200006400600027c035c9cc652bdcea3ea5a7134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdfb8951f215ce3bbce81ed0bffece0b42a9ecb84ec95ee5de6ccd40dd6e4f1ef3d93452a92782f9ffcdb020e6f3baf432b25a55e08", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x4040051) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff00000040080000", @ANYRES32=0x1, @ANYBLOB="0014000000001f0db8a3c20c9490ffffff00b8bb", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = accept4(r0, 0x0, 0x0, 0x80800) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000940)=0x1000008, 0x4) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000bc0), r2) bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x10004}, 0x50) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r4, 0x891d, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e00)={0x3, 0xd, &(0x7f00000004c0)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x19, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4f06}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$NFC_CMD_DEP_LINK_UP(r2, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000d00)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010026bd7000fddbdf250400000008000100", @ANYRES32=0x0, @ANYBLOB="05000a0001000096"], 0x24}, 0x1, 0x0, 0x0, 0x20000881}, 0x4000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x10448) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r7, 0x84, 0x12, &(0x7f0000000540)=0x4, 0x4) recvmsg$can_raw(r1, &(0x7f0000000b00)={&(0x7f0000000300)=@un=@abs, 0x80, &(0x7f0000000a40)=[{&(0x7f00000006c0)=""/221, 0xdd}, {&(0x7f00000007c0)=""/116, 0x74}, {&(0x7f0000000840)=""/216, 0xd8}, {&(0x7f0000000980)=""/165, 0xa5}], 0x4, &(0x7f0000000a80)=""/84, 0x54}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x20040001}, 0x8000) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@generic={&(0x7f00000004c0)='./file0\x00', 0x0, 0x10}, 0x18) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r8, 0x0, 0x94, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0b16000000000000000002000008400004800c000180080001006f73660030000180080001006e6174002400028008000240000000020800034000000014080001400000f79ce04a0540000000140900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x94}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) socket$netlink(0x10, 0x3, 0x0) 650.773523ms ago: executing program 4 (id=7093): pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x2, 0xa, 0x300) r2 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000040)) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x53, &(0x7f00000002c0)={0x0, 0x0}, 0x10) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32, @ANYBLOB="000024000000000024001200140001006272696467655f736c617665800000000c000500080005"], 0x3}, 0x1, 0x0, 0x0, 0x40900}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000180)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010026bd7000000000001d00000008000300", @ANYRES32=r5, @ANYBLOB="30002f800c0002000000000000000000080001000000000018000380080001"], 0x4c}, 0x1, 0x0, 0x0, 0x4811}, 0x0) 590.353547ms ago: executing program 2 (id=7094): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 507.446835ms ago: executing program 3 (id=7095): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="4800000010000507000000000000000016000000", @ANYRES32=r2, @ANYBLOB="0000000200000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) r3 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) getsockname$packet(r3, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f000001cb80)=@delchain={0x48, 0x2c, 0xf31, 0x80, 0x2000, {0x0, 0x0, 0x0, r4, {0xa}, {0xfff1, 0x6}, {0xffff, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xd, 0xffff}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4008844}, 0x40000) 482.798383ms ago: executing program 0 (id=7096): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, &(0x7f0000000000)=0x4000003, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c0001801400030000000000000000000000ffffac1414aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300ff02000000000000000000b8ee00000114000400fe8000000000000000000000000000aa0c000280040001"], 0x98}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c0017"], 0x38}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r3, 0x100, 0x70bd2a, 0x25dfdbff, {{}, {}, {0x4c, 0x18, {0x71e8, @media='udp\x00'}}}, ["", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x44}, 0x20) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="34000000400007012dbd7000ffdbdf25017c0000040042800c00018006000600800a0000100002800c00038008003a00", @ANYRES32=0x0, @ANYBLOB="0b8a04f61ff835"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 481.735282ms ago: executing program 4 (id=7097): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, 0x0, 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000100000000000a20000000000a01010000000000000000010000000900010073797a300000000068000000090a010400000000000000000100000008000a4000000000200011800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30000000000900020073797a3200000000080005400000001f0c"], 0xb0}}, 0x20000004) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) 476.017834ms ago: executing program 2 (id=7098): epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) syz_genetlink_get_family_id$tipc2(0x0, r0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'dvmrp1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x2c, 0x24, 0xd0f, 0x70bd2a, 0x0, {0x60, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x54}, 0x1, 0x0, 0x0, 0x8080}, 0x24008040) r3 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="e03f030025"], 0x33fe0) 257.168204ms ago: executing program 3 (id=7099): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000002500090122bd7008f9ffffff0200000008003f80000000000800030047"], 0x2c}, 0x1, 0x0, 0x0, 0x4000001}, 0x10) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000f01000000000000", 0x20}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000005c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a40)=@delchain={0x254, 0x65, 0x2, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb4bb54943a379556, 0x10}, {0xe, 0x8}, {0x3, 0xfff3}}, [@filter_kind_options=@f_flow={{0x9}, {0x1a4, 0x2, [@TCA_FLOW_DIVISOR={0x8, 0x8, 0xe}, @TCA_FLOW_DIVISOR={0x8}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x3}, @TCA_FLOW_KEYS={0x8, 0x1, 0x85d1}, @TCA_FLOW_ACT={0x168, 0x9, 0x0, 0x1, [@m_tunnel_key={0xf4, 0x20, 0x0, 0x0, {{0xf}, {0x68, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x41}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xfffffff3, 0x2, 0x10000000, 0x800000, 0xd}, 0x2}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e24}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @empty}]}, {0x5f, 0x6, "725425e0db74b580307b428f6ecdc2c5fb9a0700000005ef3b9a0246307e79add659181b585be595a308d895f999637a3fb40939c54d9ac77962d45c4af459a3f93b1d59d1d316542820c02bf2668a724000000000000000002eb1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_xt={0x70, 0x12, 0x0, 0x0, {{0x7}, {0x4}, {0x47, 0x6, "e48c5dbdbda34416f988f89b697cdad84c18eb5a19610816d67b342e6b7619e9b339a411ff47455357650607c763c5750b7fce01fe0ef9a87f50208b6e07f3f7d16b14"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0xfff2, 0x4}}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0x6}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1d121}]}}, @filter_kind_options=@f_flower={{0xb}, {0x4c, 0x2, [@TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}}, @TCA_FLOWER_KEY_SCTP_SRC_MASK={0x6}, @TCA_FLOWER_KEY_CT_ZONE_MASK={0x6, 0x5e, 0x187}, @TCA_FLOWER_KEY_ENC_UDP_DST_PORT={0x6}, @TCA_FLOWER_KEY_CVLAN_ID={0x6, 0x4d, 0x197}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @multicast2}, @TCA_FLOWER_KEY_ETH_SRC={0xa, 0x6, @broadcast}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @empty}]}}, @TCA_CHAIN={0x8, 0xb, 0x80}, @TCA_RATE={0x6, 0x5, {0x5, 0x8}}, @filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_MODE={0x8}]}}]}, 0x254}}, 0x24000040) r3 = socket(0x10, 0x3, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x1b, &(0x7f0000000480)=0xe69b, 0x4) getsockname$packet(r3, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001300)=@newtaction={0x17d4, 0x30, 0x9e54f29ff072a93b, 0x0, 0x25dfdbfc, {}, [{0x17c0, 0x1, [@m_mirred={0x1b4, 0x2, 0x0, 0x0, {{0xb}, {0xc4, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x35b1, 0x8, 0xffffffffffffffff, 0xffff8914, 0x3}, 0x2, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0xc7f, 0x20000000, 0x80000001, 0xee9b}, 0x3, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x2f3, 0x7, 0x7, 0xfffffffa}, 0x3, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x9, 0x79, 0x1, 0x5, 0xf9f}, 0x4, r2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x2, 0x7, 0x10000000, 0x5, 0x1}, 0x3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0xa, 0x0, 0x2, 0xff}, 0x3, r2}}]}, {0xc8, 0x6, "eeac71678583dfc5d7f486af564b98c14db3e43ff2472212b8d20014baccb7f4d2c18394e2d15ad52c24f2e6626969612892b33eb7e3cb823258cfec4256e795a3539a1f84bf4c7c7fce7253fef1344660bb4a04f21fda668102f3518650012f82b0b620f6b3571a1707d65bf7a802492759a7c8e64d0836d78f0c8ae1627c0b6c2aa4a81d8f307ad316da381e50ef81316fbef6547534e9d86a2d2c661c93e7f25d552c4d62979b6ce1501879845421e17c2000e2e66c365c03e0066301459463e705bc"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_connmark={0x1b0, 0xf, 0x0, 0x0, {{0xd}, {0xac, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0xa, 0x5, 0x1, 0xfff}, 0x6}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x0, 0x5, 0x2b75d1642658f9d9, 0x9f, 0x3}, 0x5}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x58b80000, 0x517a0, 0x10000000, 0x6, 0x7}, 0x9}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x3, 0xffffffffffffffff, 0xffff, 0xd}, 0xa397}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1000, 0x5, 0x35b7d1f5e359e05, 0x0, 0x86}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xaf6, 0x1, 0x8, 0x3, 0xbd}, 0x6}}]}, {0xd6, 0x6, "c9964c55fedbe2715ee9412917bf84782563a277dcd9ca86330f1a7c5983233a4b9d02990191d322ef485a6f20f53d2bef1d10435c9dba90694ec59782aa65dabb4a4b37d3505d9488fb1402a79058af30a311bca73e85bae33491b8d5e686c0524e07b7b8a00bc6f3221be02316b19fd5fd0f343289770f0087a0e5c000df19792f9aa04ab83461b3f93c59fe3f00ea3bf9b38a7ae417a24736e7a2738b3621c1f5b89ba75ebe468ea175523bd33fe4fc2860d2a66ae9820f769b18ac33765792bbe0f47f206136f03f9f5b235b0ee02819"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_gact={0xc0, 0x6, 0x0, 0x0, {{0x9}, {0x4}, {0x94, 0x6, "545a9810c451fba8c8a958a3d6376058eddd888eea47a6f0ff4c3c3eda952dc84cb7a2ce10d0cfb70c12b6ca2f001e25ba154c9d87bc838cd897d06d28bde1f1dc71e56fc57a68179c36be2b529ad495f2f77000d1a3d57129df6cadddd29fc795de24e7d6ee64da92c23061ef98a4501f828dc9c5efe1acfed13249ec8483a1df17f957cbd60fd76b12b43b316ec1ae"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x6}}}}, @m_nat={0xcc, 0x19, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xc55c, 0x8, 0x5, 0x8, 0x9}, @local, @private=0xa010101, 0xffffffff}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x10000, 0x0, 0x5, 0x8}, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0x4f, 0x6, 0x2, 0x2, 0x6}, @rand_addr=0x64010101, @rand_addr=0x64010102, 0xfffffefe, 0x1}}, @TCA_NAT_PARMS={0x28, 0x1, {{0xde, 0x0, 0x1, 0x6, 0x8}, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ife={0x50, 0x10, 0x0, 0x0, {{0x8}, {0x10, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @local}]}, {0x1b, 0x6, "bb6cd8c43bdfa0896020f07e405b141948bcf6f770c244"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2}}}}, @m_ife={0x78, 0x9, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_IFE_DMAC={0xa, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, @TCA_IFE_METALST={0x20, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x1}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x8}, @IFE_META_SKBMARK={0x8, 0x1, @val=0xffff}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}]}, {0x23, 0x6, "b1dcfaf5ca81a726dc8c0563ba6d4805a36c890a33887a1b85ef9da10a428d"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_csum={0x108, 0x20, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x9, 0xa, 0x3, 0x8, 0x1}, 0x6c}}]}, {0xc0, 0x6, "00a5711033f28f522b2ef3e43d1331b6001718f3fe2aa17acdcfb6c676485d15c4a90ca8e53d06105ad8427aa5d32a768a8dbce5a0a4312bab2cf195b5b7c844bb1a8d0c208b3dfc12ed9e4169c0ceba317f50b7d720a4430338137e37123b2d495199fbd5c1be59711e35a498ff0ae3e9fbfdbee29bc3415c845de4ccdc39520977ac36a648c46f0bb38a74f50b0c1d71c589693c3fe38463811709dc3ed77558d73cb6965de2b4f3395e249077a4809ae352642193c0fb9caa60f3"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_mirred={0x1070, 0x9, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0x7fff, 0x20000000, 0x2, 0x8}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xf, 0x9, 0x20000000, 0x4, 0x4}, 0x2, r2}}]}, {0x1004, 0x6, "da8ca520d9c171c6648ceb260dd207e7723887edcfbf4dcf1a3e8a3846aad5d7297ee1f321eeaab0c0accbf068603afaa9d5c2b29e1172a766f48579cd1df3a70903172cc7ef6a6a60f18293bea3285a003cb6f3bf4ee222fb601e6dddad154e077658e07f40cbb029c010d0db4d4bef7a72aea8273b149ab05cffd9a88db73deac8c04473f76b8993ebaab2e307180a72b526e2d315ec60a6e1fcb197666d4c8a02a9231787934a55b1f2e2418d117de044d7882feef88bf8d56ab68a4657bf8a24eabe56a5d2b9516ef8eb49c85e1f069f11e275191495c39a1d61049cfcebf76383bd199451059df7435488ba541cf70224835024f254140165e58f58f24c4d053216a830f05d1394a82a6eb4ce22f133a2a6acb7c37fb6778d5e6f25b772c09d6850aacf64bee04d30198b72d9c8bb679112a92106c3a3bed76c6a3530f1c11f1e1fc762bb7f504b318c8a28f63621aed741a3527d26500096b4be69cf19f0b6f37e387a69702e1cec5c69f09ab48f7137269ab1bf1c6700e1b413de865f6eb285ead6718dae95861ebe331aacede182c7ca275cf2694776866ef33f8b75ee3f915f35dc8c99974d29c121a319f8c1800eb541884c1db492f1d667a40f2986bc83affd87c634418f324c6a7d80b5e41b9c8f3ef188241e7302b9e6e672bf12475a18f9f2861f3829a6fc642da9967139bc8929c916379c0681527c29fd25e90f21015c2b40cdc9000a0516725612d351ef8fe2be15d54bca56f56d08cbcf92c9652ee321287ceb9199119d0d74db803a5511499be85ca9aa5ba341d4f1fe69787bc05b4d13620ac43370a70c7c368238be0547183434637734da8718d1d0c3c7cfb1031418e1b23b27a387c650415277a3c33e854a83afb95432073ec8c43271645815456180c832f14a154ed92f35306423fc4918f3a21bffecdc26c1b5f1f9af8fba91c7525aca0944111c9a8cb1a53250ae18fe88fab6ba076e37f1216f19608ef50c3876dec462cc24b3948a9b3465aaeb122276904168dbda22bb6a7ea45f0f86aa7a1c10c826e5c0fff0e57438292e2de6532d0035da3d63d27a34991a5cd311bd136ce98ee9c2df8da6de6ac19851ef54b738a234b7954c6e32e037bd0f4634b478674344b59fbdcc27d16fa4acdb47f7b6ec1609f39ead9af86b3e03f76fa69ba18654edfee45e95f0e8008dfbcce44ea1276470a9c2c89a59c93bb54e6735377647c90ca2a28f553ac303656d7b69c794ce593f9a96c93e3811dfbac74d92a2442ad1dfd3e0a4e007832bc3840e791b08053e9f9f5b80453f9b4f544f2c85b7c8693fd4a88914d25de364c93a52e137b71853f17fc8aee0368a42a5246aca17892da4e61224f809eb8192a73ffb3fb5289f77bf7976aaaa12023c201f3b1b78c0b7fcafff9cf586109ded456f876c7813c292963619254c74de2506985f0aba7fea7a2af7fce07cca3bb4a7cf9d5b5edac7feda655067efb62c9aed7096d8b588f8c8d4812213cd2317fbd34c4e37bcd996db45fd9c85308c3a18cabda6cdce17ef15bd0657cc563069a5fb8d2139bcd23d8dd63f7b0d5cbbdaf8228e57f7241b6b286f76bf351fac2c1b2a4531254a0dc1111f0110aa5a25cc8c6994509c91437f60f25138a33d19b94b34cc10e97bffedd42c8314b496df71fba784df5b8c7d13c971104668fc7bc2d30d599745b9ec2ce073af2fa1e6a220aa337a3d66fa196a547a95068efe228801e66862f0149b38e6f9191a62c0ce1df2f6ff5540a035f1d268098ec484da4732a0441b84346c63d3fc9bdbc3b63c01969cd5291834cb6e8d9cdb4836bfd826835756467709437aa034326533d29d3a551535c5aa94d4b98c61a68904fb795261ff985ba8fa2c193a30af5b45ce38a2bc5ae3d2f8b2d9e95f012bbe9b7616007242f8ea8c21fb1824f0fb6929468ac98401ce9edf4c28bccc76981f08b43a269b90747eabae5dbda0df04c32d68ffe3e92b707ae69db15005c7bfbfdcd22c94703944db48537e5a895390fed39ca958bc43a372ab8a0153dbd311e1aaa57ee0fff774692efdb4e2837334d9e1c2c6b67821758ecfbb01b53883163e85dca9a68518afe304fbc972aaee115e44c60f0142c934fb04343f6c18b9dabefb6a44f9e17704797148a6749172c489d3041f299c82cdc9d24d9dab377c85afae2099a0cad1eeb660d04c1e5f0c6489296c491bcca7c2215e0037e860b3582a6f1e5430e19510757ad3344c7805d7513416feb572813bb4d368b229c839cda5e2556c25e72be2504b0c746b80961b500b10543b060ba202a50c0b76421becdce6f4823f71539f29fcba14279632c7000ebfe1d4130b264c3434a7259221011790517ffbb73679a837bf348d96036345f0680c455f2ddf12aa5f4293178fab5c5504064f534a65dc2e7ec88e291a4f1f3d657f77028e4e6b8e4969dc51fa326af88deee1e1be529ad8dc7c12d53a93c198aaa8360f19694c75477a2965fb27b59c5e7f5b360fda1d76032214999bce8e54dadb40a165576006ef5c6fe6a1b92d864ec6f237f51a1283be7a7e1fe6ab2795504044d4450e55b17a3ba199f412f2884bf54b023509b236f9381de27acdbbea3d3c4626e0ea5015b0c406b582939cd60f5e3156b69cc0e83fcb86256315905c1f5702c2bd54fa85167a02085bde510fe336d8925d52190ce987abaa748120ae842ed754a6184abed173a1883dbccbfc881143d4ac67ce47604de256427d46e5c8f33b559a08725a10a9938ec1c1ffbb06697f8857186c34a677668312f8d4a3e0ce8a5021e84429573a9505c23957d3788c1b07770cfa1aeb0709bc55bd60d2f770d80c513838388a2d82da95fa7093c53f196f54f5b19ff3a2047df6f9fa5246b63c9eda8185a87857fde8ab7c7833d3bada3715cf855ebad1dfe21a7a9aef4c053f14ac83e9cd8474b301352530033ff6c65c842813507aece58fab5257b9984d381536300ee6756651d7bc38c8252e371dbe2a5a5b99bc245578790c67a0f539fab423806f0e86eb0302aa13c3b1f6bf22d3b074b5cbd135d90e6ce507bd59ff0280557eb01a43d1e75f039ff03f02b4106c651b931df21deca65f8ef0e2fa3d84c410603a37f989151b23e7609c51eedb6637eb547ecf7c2a29a911cc0f1042708a2a5abe793f1cba8170eedec9251f3fdef04be5ff3e7ed1c7ccc24717b54ca0262dc3402ec2119a2bbd6c4db251f2270e86f96ff86d17c3853edaead99f0a9e474f67a011e186b99329524eff58950a8604b7b0047106801737cabadeb34abd6885815dcfc79722da15857227dd2ee6fd66475cc54a974aee95f6bddbac7506e0c5d09d5acba451e0b760efb539f38347ef54a712088affeca54b8ca3016fd983158b604af52b0af731a793b567e870efce36032e88040aeaadd2a914f13a9467e206252f0672cfcd215f6e52b3a501378a07b4a95361b4622cbf8a2e7b49daf157b63143e2f8d26f3afc6500402b943b60d1497a027fae7931b4437ff454b199bb32706bf8d1848607fa21b046e8d5cddc4467a700ebc72f03909c62f8fd74e6f73a0ab672e0060e8398becf28f8214c8dfc0aa17ba468dca8045216a68d48c217f95480a100a684473d96f1431f92f660bb9b4689470acb8cfdf62ecde3e62c6f48e0073f060b43508f9e326ace5134757f9c49d6d053779776576a97b63b37369e80e7f2cd71dfe8058a821ac6e45ad6777091fdcf2247dab2b2356c76925dc975fd1f690572aa691e7e605ddca6ee529ae91b1bd50e2571cb96e0baa7fc1d73b70487a33b06400fded6e80bb7971990f5569f1bec027a20781906a0ebba386898ee2a10a438709af5e4b9669908054bb34fee6837714c7ca19d5a393bdfb8bbd0dfcf650681598cf4653a3f1628610d70fe42a0d2e0f16b0fb87ab048692a4c8d5eaa79e84acacef3cf9f170869d9028a58fcd45f86669d747ab90dadbc32acc833042b91c08cc409a1a40582f380ae6b7823fccc2a4f96134ca633b3a9bd501e34da6244c97ab96ac71c4e0cc1d67854481f8610ced80598a6537f0af57ff8b6ae5e5a70fc11e4e528a95dbfc4c231a697edfeb653afb9d3de2a8db90d33c176895118b6634b9a28b10bca76fc961479796e26e91da97523fc32aa1b452b70b06ab0b33eaf23abe4f2740ea1a56265cf7d4e1fed299b36cdba825d11985ce92e5022446dccbada102d52fa2332a98c10aaf6b40f90debb2798e6283f1c1d90acfd4519732fa3f30f570542a92badeebffe67d470f02f2c35095774d47e0a68339f05b56fa00151d9626b1fb180f3310137b20c2d4a778959224ae9f1f9c18f34ce3af5a6cfc1620274bbe5a2e81d03f5423683da0bf140088895f8b61baeb31ed771f581523249b7c4928f08818601b8c634c62974cc0b56cdbf19c2f2b811820bbbff8c1f5270c468cf4ba156837c02582903c34da41636fccf36a682dbbb852639eda43b9aec4fc4224920af6def5cbd13992281ef4991577eeeb0a26cdff581b975322c6d3813566600fc4fbbab0cf9408106b5479a024f8a2a49d9db01e5b6701c90cc12a1c150d449416c6ed459bf4df266b5a66c8d4599c88d81fb1e8a3014fc27baf9fc3a87f6c3ce2d6fb87ac7191b2899a06e8aef12ac3fc79e65f347a2a3dab0000e021d140f0bed0effbfd3bbf1b8eac1796be00257d9e9e98c1f2c4756449de46c6e1288e3f1f74474df22367267f34b63005dadf7c55aa4ede2c5a83c053498e6a642c7ab2018281fb2617743d573bd41023274dbf832ce1360623f1d10f443c0daf6e4c8839cf4436a7edf1a86f3bdc6eb7e757c07d3034bb00784bbc44f11adb7da02512a27304734a9230517f4d2ae39f6f8d5f3dd008c23372057629c3a5a10ada68aaf871ac0271507c9430b3206df67d571f57c4771596b54b17d189a2dc2abac4aef0b0a8198d3b5266f4086e580ebdd8e57752ee55dabd70355b150cf1e981010c524967598f856fd19d02f1df86d321108fa9e1f222a7a58cb4c448561fffeb351a12c6ee241668fcd76e7cdc8857b26a768d63d4fe11729be72c4d1a7bdda26898376f93716e056e723590c05553ac7000f88f072243baaa10ae75abb05a05722724963ec4a99182d3560cdeffdb69c2a2a805bbfb716e7e4d7c497a36e52265cec64cf4a126e6c67887e9ce325dfd6c1442b2811a57486e94856bf3ba663186524d6f98ee78a5ec6b68f1a364dd3b86cd9da4f1ea59ea557493e8973cc85005779dfb85258fe4acb2fa89127d0c6687d68999ccce31494e9957cf76eaeb276c879f84ac9836e17ff222ed02a91e252cdcac790a7d2c05a610a2dd6aaa234fd3dc5648ba27144fa8444fae1279c86c1b232038cf7516e892a870943735f6d2e61c3a6aa1863ab810d12e646d4ec2a488c2ca31225525ef65cdf17a81e9dcebd92163d30fc9cd37ddf64df5217418667a885a2002a4b130711e0209493fb1808f56fc702b88c3f64434278724acdb1df1fc1d83caa8eed74c82d4362eb040dc289392a402f7ba9ced1a5503077a6c52c10467984fb9169b30a4cf4edae6b09d1ce06b80a4a4817db7935ab561de99d28720912b8bf362390925e9c365cfef8f4d195f88cb096e97418158b40bce7a87e33258d3f1b92750f3e0ef082870c984a0471ab041babfd9b88a65c6775e42bba49ccc5a9514d3f336611d0e6ab2ce20c79fd12fb3acad7d84e33b866cda27727db3e5188c3c2c8a797bf9e0b8fcd263649cdf32ba1fe1bb1945d8de8aa48d163aaa8"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x4}}}}, @m_gact={0x8c, 0xd, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0xfff, 0x10, 0x7, 0xfffffffa, 0xfffffffd}}]}, {0x45, 0x6, "9676f8ee51cd4faf8640b19adce850d76458fa42e8330ae056f62a2f86f2b9e5608f675cbd41c09bbc6dff03594e51c5f32c8c34139a231f52f1b744c67ecd4bdd"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x4}}}}]}]}, 0x17d4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000202070250000000000202020c31af8ffa1000000bfa10000000000000701000000feffffb702000008000000b703000000000000a6000000ca00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BTRFS_IOC_SEND(r5, 0x40489426, &(0x7f0000000340)={{r5}, 0x3, &(0x7f0000000180)=[0x0, 0x7ff, 0x1], 0xe1, 0x2}) r6 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x104, 0x4, 0x408, 0x0, 0x0, 0x0, 0x320, 0x320, 0x320, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @mac=@random, @rand_addr, @rand_addr, 0x8}}}, {{@arp={@multicast1, @dev={0xac, 0x14, 0x14, 0x25}, 0xffffffff, 0xff000000, 0x3, 0x10, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0x0, 0x181, 0x0, 0x0, 0xff, 0xff]}}, 0x1, 0xc147, 0x8000, 0x8, 0x0, 0x7ff, 'veth1_macvtap\x00', 'caif0\x00', {0xff}, {}, 0x0, 0x348}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "00fc6318467e3c83c37e66cec1e44eb18a67f9ab80f453c14b046598b980"}}, {{@arp={@remote, @private, 0x0, 0x0, 0x0, 0x0, {@empty, {[0x0, 0x0, 0x0, 0x0, 0x652b910927df25be]}}, {@empty, {[0x0, 0xff]}}, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 'gre0\x00', 'pimreg\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @mac=@random="0400", @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, 0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x2}}}}, 0x458) accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000040)=0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008d7460001"], 0x48) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000004c0), &(0x7f0000000500)=0xc) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000010880)=ANY=[@ANYBLOB="0200000004000000080000000c"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x5}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r8, r7}, 0xc) unshare(0x400) socket$inet_smc(0x2b, 0x1, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) 252.500026ms ago: executing program 0 (id=7100): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000c00, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 233.351556ms ago: executing program 2 (id=7101): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xe, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x200000, 0xe, 0x7, 0x7, 0x9, 0x40, 0xffffffff, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040098}, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r6, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) sendto$packet(r7, &(0x7f0000000480)="c1858aec1d0a21", 0x7, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r6, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) 160.189216ms ago: executing program 0 (id=7102): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x403, 0x70bd29, 0x2, {}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @gre={{0x8}, {0x4}}}, @IFLA_GROUP={0x8, 0x1b, 0x9}, @IFLA_LINKMODE={0x5, 0x11, 0x8e}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000e001400400000004000000041"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)="f3d34c328eb9fb9244ebdcdf956468ce26b69ae785f6c17430d58cded19b380965a2ad0ab7089071b11b9dfb66cae0895fa8b21930489a9961f4ad4a82be40a89a9e84aea1e75fe0ec5c857c38595519c45f517be4a51ebad720e9aa33c9962a5b112b8e70dee09aa758a9b3d8c7eafd2f42e868a98f7353badf", &(0x7f0000000040), 0x1006, r1}, 0x38) bpf$PROG_LOAD(0x5, 0x0, 0x0) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x3, 0x0, 0x6, 0x0, 0xa, 0xfffffffffffffffe, 0x1}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r4 = openat$cgroup_ro(r2, &(0x7f0000000180)='blkio.bfq.io_serviced\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000240)={0x0, 0x1}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={r5, 0x2, 0x8}, 0xc) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f00000000c0)="bb", 0x1}], 0x1, 0x3) close(r3) r6 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r6, &(0x7f0000000000)={0xa, 0x0, 0xc, @empty, 0x101}, 0x20) connect$l2tp6(r6, &(0x7f0000000100)={0xa, 0x0, 0x3, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x20) splice(r2, 0x0, r3, 0x0, 0x10500, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000340)={'wlan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r12 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000002c0)='ns/net\x00') sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r9, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x24, r10, 0xd66771a5e8224ded, 0x0, 0x0, {{}, {@void, @void, @void}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r11}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r12}]}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r3, &(0x7f0000000580)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0xbc, 0x0, 0x100, 0x70bd2c, 0x3b70000, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0xc8}}}}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x41}, @NL80211_ATTR_MESH_CONFIG={0x2c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0x7a}, @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT={0x8, 0x17, 0x8ce2}, @NL80211_MESHCONF_MAX_PEER_LINKS={0x6, 0x4, 0x7f}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0x10}, @NL80211_MESHCONF_PLINK_TIMEOUT={0x8, 0x1c, 0x6}]}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r11}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r13}, @NL80211_ATTR_MESH_CONFIG={0x34, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT={0x6, 0xa, 0x2}, @NL80211_MESHCONF_PLINK_TIMEOUT={0x8, 0x1c, 0x8}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5, 0x11, 0x1}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0x3}, @NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0x7d}]}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x2, 0x33}}]}, 0xbc}, 0x1, 0x0, 0x0, 0x40000}, 0x40) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000040)={r1, &(0x7f00000000c0), &(0x7f0000000080)=""/17}, 0x20) 100.915704ms ago: executing program 3 (id=7103): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x27, &(0x7f0000000000)=0x4, 0x4) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x20400) pipe(&(0x7f0000000100)={0xffffffffffffffff}) tee(r3, 0xffffffffffffffff, 0x3, 0x3) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000000c0)={0x18, r4, 0x301, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0xc000}, 0x880) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="02030003100000002cbd7000ffdbdf2502000900080000001c0000000000000005000600000000000a004e2400000008ff01000000000000000000000000000100000000000000000200010000000000000006180100000005000500000000000a"], 0x80}, 0x1, 0x7}, 0x48004) 6.71069ms ago: executing program 3 (id=7104): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @private=0xa010100}, {0x2, 0x0, @local}, {0x2, 0x0, @broadcast}, 0x230, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x20400) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg(r3, &(0x7f0000009640)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1073eedab59a32", 0x7}, {&(0x7f0000000240)="02a2f97a177137003d", 0x9}], 0x2}}], 0x1, 0x8810) recvmsg$unix(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001f00)=""/4096, 0x1000}], 0x1}, 0x12060) close(0x4) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000100)=ANY=[@ANYRES32], 0x1d) r5 = socket$igmp6(0xa, 0x3, 0x2) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r5, 0x80089419, &(0x7f0000000280)) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0xde, 0x81, 0xfffff034}, {0x20, 0x0, 0x0, 0xfffff010}, {0x6, 0x0, 0x0, 0xffffffff}]}, 0x10) write$tun(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6eec00be844484"], 0xfdef) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sendmsg$can_bcm(r3, &(0x7f00000004c0)={&(0x7f00000000c0), 0x10, &(0x7f0000000500)={&(0x7f00000003c0)=ANY=[@ANYBLOB="05000000200000000700000000000000", @ANYRES64=0x0, @ANYRES64=0xea60, @ANYRES64=r9, @ANYRES64=r10/1000+60000, @ANYBLOB="000000800100000003000080200000335815a443c62e523b2a73bcf7638ba0a7d3d09e07c2082149be8b44d14601b8a0bddce6f58e9bdb85b3ce539ede00584cf50e17b70be0e983f5ab03b960d60000"], 0x80}, 0x1, 0x0, 0x0, 0x8880}, 0x140) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000180)=0x6, 0x4) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="17090010000000000000010000000500070000000000080009000000000008000a0000000000060002000000000014001f0000000002000000000000000000000000140020"], 0x64}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00042cbd7000fedbdf2502000000080026008009000008006900f4000000080061006b190000323e58b26828b603542c0d5fc082d010fdd2f8667e44b5aa405ee8497bc5b63d8a3d7f"], 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000) 0s ago: executing program 2 (id=7105): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) kernel console output (not intermixed with test programs): 87][T26071] netlink: zone id is out of range [ 775.241578][T26071] netlink: zone id is out of range [ 775.247289][T26071] netlink: zone id is out of range [ 775.252617][T26071] netlink: zone id is out of range [ 775.258745][T26071] netlink: zone id is out of range [ 775.264191][T26071] netlink: zone id is out of range [ 775.269568][T26071] netlink: zone id is out of range [ 775.275103][T26071] netlink: zone id is out of range [ 775.280324][T26071] netlink: zone id is out of range [ 775.289293][T26071] netlink: zone id is out of range [ 776.536888][ T2470] block nbd0: Possible stuck request ffff8880265ce000: control (read@0,1024B). Runtime 480 seconds [ 776.547738][ T2470] block nbd0: Possible stuck request ffff8880265ce1c0: control (read@1024,1024B). Runtime 480 seconds [ 776.558847][ T2470] block nbd0: Possible stuck request ffff8880265ce380: control (read@2048,1024B). Runtime 480 seconds [ 776.570525][ T2470] block nbd0: Possible stuck request ffff8880265ce540: control (read@3072,1024B). Runtime 480 seconds [ 777.289637][T26096] netlink: 208240 bytes leftover after parsing attributes in process `syz.2.6097'. [ 777.379671][T26106] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6098'. [ 777.662573][T26118] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6102'. [ 777.683990][T26122] netlink: 'syz.3.6104': attribute type 4 has an invalid length. [ 777.701677][T26122] netlink: 152 bytes leftover after parsing attributes in process `syz.3.6104'. [ 777.815896][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 777.981632][T26134] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6108'. [ 778.057865][T26146] netlink: 208240 bytes leftover after parsing attributes in process `syz.0.6110'. [ 778.171421][T26151] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6114'. [ 780.636313][T26122] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 780.661817][T26154] netlink: 'syz.2.6115': attribute type 11 has an invalid length. [ 780.682757][T26154] netlink: 199828 bytes leftover after parsing attributes in process `syz.2.6115'. [ 780.778382][T26160] Cannot find del_set index 1 as target [ 780.809979][T26160] IPv6: NLM_F_REPLACE set, but no existing node found! [ 780.929761][T26169] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6118'. [ 780.943875][T26172] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6121'. [ 781.103151][T26175] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6122'. [ 781.234300][T26188] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6128'. [ 781.317484][T26191] netlink: 208240 bytes leftover after parsing attributes in process `syz.4.6129'. [ 781.334450][T26196] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 781.411840][T26200] netlink: 'syz.0.6131': attribute type 11 has an invalid length. [ 781.434924][T26196] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 781.443844][T26200] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.6131'. [ 781.482487][T26202] bridge0: port 3(syz_tun) entered blocking state [ 781.515639][T26202] bridge0: port 3(syz_tun) entered disabled state [ 781.530228][T26202] syz_tun: entered allmulticast mode [ 781.553996][T26202] syz_tun: entered promiscuous mode [ 781.580079][T26202] bridge0: port 3(syz_tun) entered blocking state [ 781.586715][T26202] bridge0: port 3(syz_tun) entered forwarding state [ 781.769291][T26217] netlink: 'syz.0.6137': attribute type 1 has an invalid length. [ 781.805374][T26214] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6135'. [ 782.023897][T26227] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6139'. [ 782.244050][T26241] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6144'. [ 782.272781][T26243] netlink: 'syz.1.6147': attribute type 11 has an invalid length. [ 782.810447][T26279] net_ratelimit: 337 callbacks suppressed [ 782.810468][T26279] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 782.911608][T26278] syzkaller0: entered promiscuous mode [ 782.917474][T26278] syzkaller0: entered allmulticast mode [ 782.962641][T26278] netlink: zone id is out of range [ 783.002963][T26278] netlink: zone id is out of range [ 783.031585][T26278] netlink: zone id is out of range [ 783.047957][T26278] netlink: zone id is out of range [ 783.085472][T26278] netlink: zone id is out of range [ 783.091313][T26278] netlink: zone id is out of range [ 783.106687][T26278] netlink: zone id is out of range [ 783.112192][T26278] netlink: zone id is out of range [ 783.118938][T26278] netlink: zone id is out of range [ 785.027269][ T5634] Bluetooth: hci3: command 0x0406 tx timeout [ 785.084069][T26286] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 785.094309][T26286] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 785.240347][T26309] netlink: 'syz.2.6168': attribute type 11 has an invalid length. [ 785.563074][T26325] bridge0: port 4(team0) entered blocking state [ 785.614937][T26325] bridge0: port 4(team0) entered disabled state [ 785.638683][T26325] team0: entered allmulticast mode [ 785.645464][T26325] team_slave_0: entered allmulticast mode [ 785.651583][T26325] team_slave_1: entered allmulticast mode [ 785.662635][T26325] team0: entered promiscuous mode [ 785.668182][T26325] team_slave_0: entered promiscuous mode [ 785.674196][T26325] team_slave_1: entered promiscuous mode [ 785.681476][T26325] bridge0: port 4(team0) entered blocking state [ 785.687924][T26325] bridge0: port 4(team0) entered forwarding state [ 785.803220][T26329] syzkaller0: entered promiscuous mode [ 785.816687][T26329] syzkaller0: entered allmulticast mode [ 785.839462][T26334] syzkaller0: entered promiscuous mode [ 785.870175][T26334] syzkaller0: entered allmulticast mode [ 785.912357][T26339] netdevsim netdevsim0: Direct firmware load for . failed with error -2 [ 785.944991][T26339] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 785.957034][T26344] __nla_validate_parse: 10 callbacks suppressed [ 785.957053][T26344] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6179'. [ 787.219254][T26371] netlink: 'syz.0.6184': attribute type 11 has an invalid length. [ 787.227421][T26371] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.6184'. [ 788.855619][T26379] netlink: 112 bytes leftover after parsing attributes in process `syz.1.6187'. [ 789.140047][T26393] net_ratelimit: 683 callbacks suppressed [ 789.140067][T26393] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 789.195380][T26395] netdevsim netdevsim4: Direct firmware load for . failed with error -2 [ 789.278364][T26399] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6195'. [ 789.295034][T26395] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 789.664114][T26410] syzkaller0: entered promiscuous mode [ 789.680311][T26410] syzkaller0: entered allmulticast mode [ 789.697545][T26412] syzkaller0: entered promiscuous mode [ 789.706350][T26412] syzkaller0: entered allmulticast mode [ 789.813701][T26416] netlink: zone id is out of range [ 789.832134][T26416] netlink: zone id is out of range [ 789.848061][T26416] netlink: zone id is out of range [ 789.857961][T26416] netlink: zone id is out of range [ 789.876970][T26416] netlink: zone id is out of range [ 789.885557][T26416] netlink: zone id is out of range [ 789.898834][T26416] netlink: zone id is out of range [ 789.916060][T26416] netlink: zone id is out of range [ 789.944956][T26416] netlink: zone id is out of range [ 790.316649][T26428] netlink: 112 bytes leftover after parsing attributes in process `syz.4.6201'. [ 792.046368][T26440] netlink: 'syz.0.6204': attribute type 11 has an invalid length. [ 792.055717][T26438] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6203'. [ 792.064913][T26440] netlink: 199828 bytes leftover after parsing attributes in process `syz.0.6204'. [ 792.330989][T26455] syzkaller0: entered promiscuous mode [ 792.350252][T26455] syzkaller0: entered allmulticast mode [ 792.508272][T26462] netlink: 208240 bytes leftover after parsing attributes in process `syz.1.6211'. [ 792.735760][T26474] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 792.771603][T26474] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 793.080985][T26488] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6221'. [ 793.118473][T26488] ip6gre1: entered promiscuous mode [ 793.123799][T26488] ip6gre1: entered allmulticast mode [ 793.356427][T26504] Cannot find del_set index 1 as target [ 793.368946][T26504] IPv6: NLM_F_REPLACE set, but no existing node found! [ 793.708963][T26516] Cannot find del_set index 1 as target [ 793.723653][T26516] IPv6: NLM_F_REPLACE set, but no existing node found! [ 794.519357][T26537] net_ratelimit: 337 callbacks suppressed [ 794.519375][T26537] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 794.849720][T26558] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 794.921019][T26561] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6247'. [ 794.932390][T26559] lo speed is unknown, defaulting to 1000 [ 794.939480][T26561] openvswitch: : Dropping previously announced user features [ 794.973504][T26561] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6247'. [ 795.002372][T26561] openvswitch: : Dropping previously announced user features [ 795.201355][T26578] Cannot find del_set index 1 as target [ 795.229403][T26578] IPv6: NLM_F_REPLACE set, but no existing node found! [ 795.329676][T26582] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6251'. [ 795.366641][T26574] syzkaller0: entered promiscuous mode [ 795.388408][T26574] syzkaller0: entered allmulticast mode [ 795.448846][T26559] dummy0 speed is unknown, defaulting to 1000 [ 795.745690][T26597] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 796.027376][T26607] Cannot find del_set index 1 as target [ 796.062891][T26607] IPv6: NLM_F_REPLACE set, but no existing node found! [ 796.400250][T26624] netlink: 'syz.2.6267': attribute type 4 has an invalid length. [ 796.435569][T26624] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6267'. [ 797.422113][T26668] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6277'. [ 797.431374][T26668] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6277'. [ 797.441831][T26668] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6277'. [ 797.454651][T26668] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6277'. [ 797.530471][T26671] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6278'. [ 797.545302][T26671] ip6gre1: entered promiscuous mode [ 797.550539][T26671] ip6gre1: entered allmulticast mode [ 797.837504][T26681] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6282'. [ 799.280469][T26641] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 799.484586][T26694] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6287'. [ 799.500369][T26695] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6286'. [ 799.517922][T26694] openvswitch: : Dropping previously announced user features [ 799.571008][T26694] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6287'. [ 799.622986][T26705] netdevsim netdevsim4: Direct firmware load for . failed with error -2 [ 799.631724][T26694] openvswitch: : Dropping previously announced user features [ 799.654541][T26695] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 799.659904][T26705] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 800.182010][T26729] netlink: 'syz.2.6299': attribute type 11 has an invalid length. [ 800.209449][T26729] netlink: 199828 bytes leftover after parsing attributes in process `syz.2.6299'. [ 800.665771][T26744] syzkaller0: entered promiscuous mode [ 800.671349][T26744] syzkaller0: entered allmulticast mode [ 800.692294][T26759] netlink: 'syz.0.6308': attribute type 4 has an invalid length. [ 800.821464][T26769] netlink: zone id is out of range [ 800.844443][T26769] netlink: zone id is out of range [ 800.872356][T26769] netlink: zone id is out of range [ 800.912612][T26769] netlink: zone id is out of range [ 800.918267][T26769] netlink: zone id is out of range [ 800.923565][T26769] netlink: zone id is out of range [ 800.931254][T26769] netlink: zone id is out of range [ 800.936948][T26769] netlink: zone id is out of range [ 800.942170][T26769] netlink: zone id is out of range [ 802.843011][T26759] .`: renamed from bond0 (while UP) [ 803.508836][T26817] __nla_validate_parse: 5 callbacks suppressed [ 803.508849][T26817] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6320'. [ 803.596369][T26749] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 803.710268][T26820] Cannot find del_set index 1 as target [ 803.745962][T26820] IPv6: NLM_F_REPLACE set, but no existing node found! [ 804.006019][T26836] Cannot find del_set index 1 as target [ 804.031326][T26836] IPv6: NLM_F_REPLACE set, but no existing node found! [ 804.074693][T26830] syzkaller0: entered promiscuous mode [ 804.097801][T26830] syzkaller0: entered allmulticast mode [ 804.107463][T26840] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6329'. [ 804.466182][T26863] Cannot find del_set index 1 as target [ 804.478746][T26863] IPv6: NLM_F_REPLACE set, but no existing node found! [ 804.496620][T26861] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 804.540974][T26861] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 805.500307][ T4943] Bluetooth: hci1: command 0x0406 tx timeout [ 806.318016][T26888] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6342'. [ 806.440567][T26893] net_ratelimit: 337 callbacks suppressed [ 806.440581][T26893] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 806.620710][ T2470] block nbd0: Possible stuck request ffff8880265ce000: control (read@0,1024B). Runtime 510 seconds [ 806.631493][ T2470] block nbd0: Possible stuck request ffff8880265ce1c0: control (read@1024,1024B). Runtime 510 seconds [ 806.642619][ T2470] block nbd0: Possible stuck request ffff8880265ce380: control (read@2048,1024B). Runtime 510 seconds [ 806.653744][ T2470] block nbd0: Possible stuck request ffff8880265ce540: control (read@3072,1024B). Runtime 510 seconds [ 807.312268][T26859] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 807.593919][T26901] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6345'. [ 807.908016][T26914] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6350'. [ 808.001038][T26919] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 808.032108][T26919] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 810.755057][T26973] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6362'. [ 810.983342][T26986] netlink: 'syz.0.6366': attribute type 4 has an invalid length. [ 810.991408][T26986] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6366'. [ 811.117303][T26997] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 811.648830][T27003] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 811.657809][T27003] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 812.148053][T27007] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6371'. [ 813.445655][T27022] syzkaller0: entered promiscuous mode [ 813.451140][T27022] syzkaller0: entered allmulticast mode [ 813.545719][T27028] Cannot find del_set index 1 as target [ 813.556310][T27028] IPv6: NLM_F_REPLACE set, but no existing node found! [ 813.598525][T27030] netlink: 'syz.3.6377': attribute type 1 has an invalid length. [ 813.784267][T27034] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6378'. [ 813.797198][T27034] syzkaller0: entered promiscuous mode [ 813.802787][T27034] syzkaller0: entered allmulticast mode [ 813.931794][T26986] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 814.181239][T27052] netlink: 364 bytes leftover after parsing attributes in process `syz.0.6385'. [ 814.196977][T27052] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 814.333258][T27061] netdevsim netdevsim4: Direct firmware load for . failed with error -2 [ 814.366510][T27062] syzkaller0: entered promiscuous mode [ 814.387358][T27062] syzkaller0: entered allmulticast mode [ 814.393346][T27061] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 814.441189][T27065] netlink: 128 bytes leftover after parsing attributes in process `syz.0.6387'. [ 814.589376][T27070] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 815.006977][T27087] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6395'. [ 815.023685][T27087] openvswitch: : Dropping previously announced user features [ 815.039533][T27087] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6395'. [ 815.057089][T27087] openvswitch: : Dropping previously announced user features [ 815.079430][T27090] netlink: 'syz.2.6396': attribute type 3 has an invalid length. [ 815.100576][T27090] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6396'. [ 815.247685][T27090] tipc: Enabling of bearer rejected, failed to enable media [ 815.269990][T27099] netlink: 392 bytes leftover after parsing attributes in process `syz.4.6397'. [ 815.294707][T27099] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 815.428775][T27102] openvswitch: : Dropping previously announced user features [ 815.470439][T27102] openvswitch: : Dropping previously announced user features [ 815.783375][T27120] __nla_validate_parse: 2 callbacks suppressed [ 815.783395][T27120] netlink: 128 bytes leftover after parsing attributes in process `syz.4.6403'. [ 815.831508][T27126] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6405'. [ 815.854319][T27126] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6405'. [ 815.939297][T27130] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6407'. [ 815.995760][T27137] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6410'. [ 816.006111][T27137] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6410'. [ 816.017085][T27134] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6408'. [ 816.045268][T27134] openvswitch: : Dropping previously announced user features [ 816.074554][T27139] netlink: 392 bytes leftover after parsing attributes in process `syz.1.6411'. [ 816.108175][T27139] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 816.115474][T27144] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6413'. [ 816.118224][T27134] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6408'. [ 816.159039][T27134] openvswitch: : Dropping previously announced user features [ 816.410195][T27149] syzkaller0: entered promiscuous mode [ 816.418782][T27149] syzkaller0: entered allmulticast mode [ 816.432385][T27152] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 816.562376][T27163] netlink: zone id is out of range [ 816.580336][T27163] netlink: zone id is out of range [ 816.599984][T27163] netlink: zone id is out of range [ 816.635522][T27163] netlink: zone id is out of range [ 816.660226][T27163] netlink: zone id is out of range [ 818.578847][T27164] netdevsim netdevsim3: Direct firmware load for . failed with error -2 [ 818.587709][T27157] openvswitch: : Dropping previously announced user features [ 818.607095][T27156] openvswitch: : Dropping previously announced user features [ 818.616530][T27164] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 818.815916][T27185] netlink: 'syz.0.6423': attribute type 3 has an invalid length. [ 818.985949][T27193] tipc: Enabling of bearer rejected, failed to enable media [ 819.203018][T27201] netlink: 'syz.3.6429': attribute type 3 has an invalid length. [ 819.308003][T27211] netdevsim netdevsim4: Direct firmware load for . failed with error -2 [ 819.327494][T27211] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 819.339191][T27201] tipc: Enabling of bearer rejected, failed to enable media [ 819.366533][T27213] netlink: 'syz.0.6432': attribute type 11 has an invalid length. [ 819.712755][T27221] ip6gre1: entered promiscuous mode [ 819.718689][T27221] ip6gre1: entered allmulticast mode [ 819.869040][T27235] syzkaller0: entered promiscuous mode [ 819.885774][T27235] syzkaller0: entered allmulticast mode [ 820.012256][T27236] syzkaller0: entered promiscuous mode [ 820.018099][T27236] syzkaller0: entered allmulticast mode [ 820.071166][T27236] net_ratelimit: 342 callbacks suppressed [ 820.071184][T27236] netlink: zone id is out of range [ 820.089524][T27236] netlink: zone id is out of range [ 820.099571][T27236] netlink: zone id is out of range [ 820.112087][T27236] netlink: zone id is out of range [ 820.120806][T27236] netlink: zone id is out of range [ 820.127677][T27236] netlink: zone id is out of range [ 820.132931][T27236] netlink: zone id is out of range [ 820.140211][T27236] netlink: zone id is out of range [ 820.156446][T27236] netlink: zone id is out of range [ 820.171467][T27236] netlink: zone id is out of range [ 820.657377][T27266] netlink: 'syz.3.6447': attribute type 11 has an invalid length. [ 820.892283][T27273] netlink: 'syz.4.6448': attribute type 4 has an invalid length. [ 820.900444][T27273] __nla_validate_parse: 20 callbacks suppressed [ 820.900461][T27273] netlink: 152 bytes leftover after parsing attributes in process `syz.4.6448'. [ 823.803691][T27275] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 823.995788][T27304] netlink: 388 bytes leftover after parsing attributes in process `syz.0.6458'. [ 824.176171][T27309] syzkaller0: entered promiscuous mode [ 824.181815][T27309] syzkaller0: entered allmulticast mode [ 824.268452][T27323] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6464'. [ 825.248974][T27337] netlink: 'syz.4.6467': attribute type 1 has an invalid length. [ 826.957764][T27360] lo speed is unknown, defaulting to 1000 [ 827.237221][T27377] netlink: 'syz.2.6479': attribute type 1 has an invalid length. [ 827.520153][T27360] dummy0 speed is unknown, defaulting to 1000 [ 827.824144][T27386] netlink: 'syz.2.6481': attribute type 3 has an invalid length. [ 827.846441][T27386] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6481'. [ 827.995676][T27388] tipc: Enabling of bearer rejected, failed to enable media [ 828.139682][T27391] netlink: 'syz.1.6482': attribute type 11 has an invalid length. [ 828.162152][T27391] netlink: 199828 bytes leftover after parsing attributes in process `syz.1.6482'. [ 828.201348][T27393] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6483'. [ 828.307435][T27396] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6484'. [ 828.989900][T27417] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6489'. [ 829.035184][T27417] openvswitch: : Dropping previously announced user features [ 829.088784][T27417] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6489'. [ 829.092797][T27422] netlink: 'syz.2.6490': attribute type 4 has an invalid length. [ 829.098797][T27417] openvswitch: : Dropping previously announced user features [ 829.117136][T27422] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6490'. [ 829.331465][T27434] netlink: 388 bytes leftover after parsing attributes in process `syz.1.6492'. [ 829.784252][T27451] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6496'. [ 829.793578][T27451] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6496'. [ 830.716946][T27464] Cannot find del_set index 1 as target [ 830.728869][T27464] IPv6: NLM_F_REPLACE set, but no existing node found! [ 831.096495][ T4943] Bluetooth: hci2: command 0x0406 tx timeout [ 831.233689][T27477] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 831.243583][T27477] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 832.036032][T27427] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 832.267926][T27491] Cannot find del_set index 1 as target [ 832.290839][ T7465] IPVS: starting estimator thread 0... [ 832.302678][T27491] IPv6: NLM_F_REPLACE set, but no existing node found! [ 832.406508][T27496] IPVS: using max 31 ests per chain, 74400 per kthread [ 832.628681][T27513] lo speed is unknown, defaulting to 1000 [ 832.971924][T27515] lo speed is unknown, defaulting to 1000 [ 832.979382][T27513] dummy0 speed is unknown, defaulting to 1000 [ 833.626376][T27515] dummy0 speed is unknown, defaulting to 1000 [ 833.979526][T27530] ip6gre2: entered promiscuous mode [ 833.987205][T27530] ip6gre2: entered allmulticast mode [ 834.027293][T27528] lo speed is unknown, defaulting to 1000 [ 834.413751][T27528] dummy0 speed is unknown, defaulting to 1000 [ 835.922515][T27546] __nla_validate_parse: 3 callbacks suppressed [ 835.922535][T27546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6524'. [ 836.003230][T27546] openvswitch: : Dropping previously announced user features [ 836.018611][T27546] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6524'. [ 836.050071][T27546] openvswitch: : Dropping previously announced user features [ 836.314281][T27564] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6527'. [ 836.346024][T27564] syzkaller0: entered promiscuous mode [ 836.356408][T27564] syzkaller0: entered allmulticast mode [ 836.677635][T27572] lo speed is unknown, defaulting to 1000 [ 836.697732][ T2470] block nbd0: Possible stuck request ffff8880265ce000: control (read@0,1024B). Runtime 540 seconds [ 836.709240][ T2470] block nbd0: Possible stuck request ffff8880265ce1c0: control (read@1024,1024B). Runtime 540 seconds [ 836.720525][ T2470] block nbd0: Possible stuck request ffff8880265ce380: control (read@2048,1024B). Runtime 540 seconds [ 836.734533][ T2470] block nbd0: Possible stuck request ffff8880265ce540: control (read@3072,1024B). Runtime 540 seconds [ 836.864771][T27578] netlink: 'syz.0.6533': attribute type 5 has an invalid length. [ 836.873753][T27578] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6533'. [ 837.170680][T27572] dummy0 speed is unknown, defaulting to 1000 [ 837.228493][T27588] netlink: 'syz.3.6535': attribute type 1 has an invalid length. [ 837.458931][T27597] netlink: 'syz.0.6538': attribute type 1 has an invalid length. [ 837.478249][T27597] net_ratelimit: 683 callbacks suppressed [ 837.478268][T27597] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 837.715280][T27610] netlink: 'syz.4.6544': attribute type 5 has an invalid length. [ 837.731410][T27610] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6544'. [ 838.240730][T27636] Unsupported ieee802154 address type: 0 [ 838.653110][T27646] netlink: 'syz.3.6555': attribute type 3 has an invalid length. [ 838.696390][T27646] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6555'. [ 838.711707][ T29] audit: type=1800 audit(1777570074.752:7): pid=27655 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.6557" name="memory.events" dev="tmpfs" ino=833 res=0 errno=0 [ 838.796250][T27646] tipc: Enabling of bearer rejected, failed to enable media [ 839.145498][T27670] netlink: 208240 bytes leftover after parsing attributes in process `syz.0.6563'. [ 839.603093][T27701] netlink: 'syz.2.6572': attribute type 3 has an invalid length. [ 839.626499][T27701] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6572'. [ 839.780586][T27716] netlink: 420 bytes leftover after parsing attributes in process `syz.3.6577'. [ 839.823030][T27716] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 839.955638][T27701] tipc: Enabling of bearer rejected, failed to enable media [ 840.354248][T27749] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6585'. [ 840.725877][T27724] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 840.854333][T27768] : entered promiscuous mode [ 840.902677][T27769] openvswitch: : Dropping previously announced user features [ 840.943834][T27775] __nla_validate_parse: 3 callbacks suppressed [ 840.943852][T27775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6593'. [ 840.993873][T27775] openvswitch: : Dropping previously announced user features [ 841.134306][T27775] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6593'. [ 841.205494][T27775] openvswitch: : Dropping previously announced user features [ 841.246563][T27796] netlink: 108 bytes leftover after parsing attributes in process `syz.0.6597'. [ 841.349102][ T5634] Bluetooth: hci4: command 0x0406 tx timeout [ 841.436996][T27802] lo speed is unknown, defaulting to 1000 [ 841.940683][T27802] dummy0 speed is unknown, defaulting to 1000 [ 842.479831][T27825] netdevsim netdevsim4: Direct firmware load for . failed with error -2 [ 842.488532][T27825] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 843.019932][T27833] FAULT_INJECTION: forcing a failure. [ 843.019932][T27833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 843.034030][T27833] CPU: 0 UID: 0 PID: 27833 Comm: syz.3.6605 Not tainted syzkaller #0 PREEMPT(full) [ 843.034054][T27833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 843.034066][T27833] Call Trace: [ 843.034071][T27833] [ 843.034076][T27833] dump_stack_lvl+0xe8/0x150 [ 843.034094][T27833] should_fail_ex+0x412/0x560 [ 843.034109][T27833] _copy_from_user+0x2d/0xb0 [ 843.034124][T27833] __sys_bpf+0x229/0x950 [ 843.034148][T27833] ? __pfx___sys_bpf+0x10/0x10 [ 843.034171][T27833] ? ksys_write+0x242/0x270 [ 843.034196][T27833] ? __pfx_ksys_write+0x10/0x10 [ 843.034225][T27833] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.034245][T27833] __x64_sys_bpf+0x7c/0x90 [ 843.034264][T27833] do_syscall_64+0x15f/0xf80 [ 843.034276][T27833] ? trace_irq_disable+0x3b/0x140 [ 843.034290][T27833] ? clear_bhb_loop+0x40/0x90 [ 843.034303][T27833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.034313][T27833] RIP: 0033:0x7f64ddf9cdd9 [ 843.034327][T27833] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 843.034343][T27833] RSP: 002b:00007f64dee0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 843.034362][T27833] RAX: ffffffffffffffda RBX: 00007f64de215fa0 RCX: 00007f64ddf9cdd9 [ 843.034376][T27833] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 843.034388][T27833] RBP: 00007f64dee0f090 R08: 0000000000000000 R09: 0000000000000000 [ 843.034398][T27833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.034405][T27833] R13: 00007f64de216038 R14: 00007f64de215fa0 R15: 00007fffc2d86a48 [ 843.034423][T27833] [ 843.392539][T27843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6609'. [ 843.402278][T27843] openvswitch: : Dropping previously announced user features [ 843.414195][T27843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6609'. [ 843.424250][T27843] openvswitch: : Dropping previously announced user features [ 844.471497][T27812] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 844.482026][T27816] netlink: 'syz.2.6601': attribute type 11 has an invalid length. [ 844.490479][T27816] netlink: 199828 bytes leftover after parsing attributes in process `syz.2.6601'. [ 844.704293][T27858] netlink: 'syz.2.6614': attribute type 31 has an invalid length. [ 844.716804][T27859] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6614'. [ 844.766007][T27859] bond0: entered promiscuous mode [ 844.771620][T27859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 844.873204][T27857] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6613'. [ 844.944377][T27857] syzkaller0: entered promiscuous mode [ 844.975819][T27857] syzkaller0: entered allmulticast mode [ 845.112603][T27876] sctp: [Deprecated]: syz.3.6618 (pid 27876) Use of struct sctp_assoc_value in delayed_ack socket option. [ 845.112603][T27876] Use struct sctp_sack_info instead [ 845.183901][T27880] smc: removing ib device syz0 [ 845.293214][T27886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6622'. [ 845.313399][T27886] openvswitch: : Dropping previously announced user features [ 845.335764][T27880] smbdirect: ib_dev[syz0] removed [ 845.350996][T27886] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6622'. [ 845.375831][T27886] openvswitch: : Dropping previously announced user features [ 845.536867][T27897] Cannot find del_set index 1 as target [ 845.558144][T27897] IPv6: NLM_F_REPLACE set, but no existing node found! [ 845.961994][ T4943] block nbd5: Receive control failed (result -1) [ 846.051922][T27922] __nla_validate_parse: 1 callbacks suppressed [ 846.051943][T27922] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6633'. [ 846.268788][T27913] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6632'. [ 846.325716][T27913] syzkaller0: entered promiscuous mode [ 846.366572][T27913] syzkaller0: entered allmulticast mode [ 846.940462][T27950] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6639'. [ 846.976906][T27950] openvswitch: : Dropping previously announced user features [ 847.012850][T27950] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6639'. [ 847.075920][T27958] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 847.108917][T27958] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 847.328151][T27950] openvswitch: : Dropping previously announced user features [ 847.883457][T27982] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6646'. [ 847.933313][T27982] syzkaller0: entered promiscuous mode [ 847.952159][T27982] syzkaller0: entered allmulticast mode [ 848.103727][T27987] ip6gre1: entered promiscuous mode [ 848.109369][T27987] ip6gre1: entered allmulticast mode [ 848.660077][T27995] bond0: option ad_user_port_key: invalid value (65535) [ 848.676479][T27995] bond0: option ad_user_port_key: allowed values 0 - 1023 [ 848.700445][T27995] bond0 (unregistering): Released all slaves [ 848.874152][T28018] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6656'. [ 848.959023][T28004] netlink: zone id is out of range [ 848.989049][T28004] netlink: zone id is out of range [ 849.007014][T28020] netlink: zone id is out of range [ 849.030214][T28020] netlink: zone id is out of range [ 849.034013][T28004] netlink: zone id is out of range [ 849.045987][T28020] netlink: zone id is out of range [ 849.062371][T28020] netlink: zone id is out of range [ 849.064356][T28004] netlink: zone id is out of range [ 849.253432][T28032] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6657'. [ 849.371314][T28019] bridge1: port 1(veth3) entered blocking state [ 849.394297][T28019] bridge1: port 1(veth3) entered disabled state [ 849.408925][T28019] veth3: entered allmulticast mode [ 849.435361][T28019] veth3: entered promiscuous mode [ 849.539488][T28015] syzkaller0: entered promiscuous mode [ 849.557927][T28015] syzkaller0: entered allmulticast mode [ 852.067794][T28042] ip6gretap0: entered promiscuous mode [ 852.225950][T28054] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6662'. [ 852.314449][T28078] lo speed is unknown, defaulting to 1000 [ 852.332349][T28081] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6666'. [ 852.356836][T28081] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6666'. [ 852.379815][T28081] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6666'. [ 852.422129][T28081] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6666'. [ 852.452392][T28087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6669'. [ 852.470648][T28081] IPv6: sit1: Disabled Multicast RS [ 852.489704][T28087] openvswitch: : Dropping previously announced user features [ 852.522544][T28091] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6669'. [ 852.613388][T28088] syzkaller0: entered promiscuous mode [ 852.619233][T28088] syzkaller0: entered allmulticast mode [ 852.628477][T28091] openvswitch: : Dropping previously announced user features [ 852.636534][T28098] net_ratelimit: 684 callbacks suppressed [ 852.636550][T28098] netlink: zone id is out of range [ 852.732871][T28098] netlink: zone id is out of range [ 852.750537][T28098] netlink: zone id is out of range [ 852.791694][T28098] netlink: zone id is out of range [ 852.817819][T28098] netlink: zone id is out of range [ 852.843527][T28098] netlink: zone id is out of range [ 852.846191][T28108] netlink: 23 bytes leftover after parsing attributes in process `syz.1.6671'. [ 852.865604][T28098] netlink: zone id is out of range [ 852.874568][T28108] netlink: 23 bytes leftover after parsing attributes in process `syz.1.6671'. [ 852.891724][T28098] netlink: zone id is out of range [ 852.925886][T28098] netlink: zone id is out of range [ 852.944878][T28098] netlink: zone id is out of range [ 853.439561][T28120] netlink: 92 bytes leftover after parsing attributes in process `syz.3.6673'. [ 855.007599][T28103] pim6reg1: entered promiscuous mode [ 855.012972][T28103] pim6reg1: entered allmulticast mode [ 855.162701][T28125] x_tables: duplicate underflow at hook 2 [ 855.200704][T28127] FAULT_INJECTION: forcing a failure. [ 855.200704][T28127] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 855.215021][T28127] CPU: 1 UID: 0 PID: 28127 Comm: syz.4.6676 Not tainted syzkaller #0 PREEMPT(full) [ 855.215045][T28127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 855.215058][T28127] Call Trace: [ 855.215066][T28127] [ 855.215074][T28127] dump_stack_lvl+0xe8/0x150 [ 855.215101][T28127] should_fail_ex+0x412/0x560 [ 855.215129][T28127] _copy_from_user+0x2d/0xb0 [ 855.215155][T28127] do_sock_getsockopt+0x200/0x7e0 [ 855.215183][T28127] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 855.215230][T28127] ? __fget_files+0x3a0/0x420 [ 855.215251][T28127] ? __fget_files+0x2a/0x420 [ 855.215279][T28127] __x64_sys_getsockopt+0x1a4/0x240 [ 855.215306][T28127] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.215325][T28127] do_syscall_64+0x15f/0xf80 [ 855.215344][T28127] ? trace_irq_disable+0x3b/0x140 [ 855.215370][T28127] ? clear_bhb_loop+0x40/0x90 [ 855.215393][T28127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.215411][T28127] RIP: 0033:0x7f97f4f9cdd9 [ 855.215430][T28127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 855.215444][T28127] RSP: 002b:00007f97f5ecb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 855.215463][T28127] RAX: ffffffffffffffda RBX: 00007f97f5215fa0 RCX: 00007f97f4f9cdd9 [ 855.215476][T28127] RDX: 0000000000000001 RSI: 0000000000000084 RDI: 0000000000000003 [ 855.215486][T28127] RBP: 00007f97f5ecb090 R08: 0000200000000000 R09: 0000000000000000 [ 855.215498][T28127] R10: 0000200000002100 R11: 0000000000000246 R12: 0000000000000001 [ 855.215509][T28127] R13: 00007f97f5216038 R14: 00007f97f5215fa0 R15: 00007ffd38405718 [ 855.215539][T28127] [ 855.224899][T28122] lo speed is unknown, defaulting to 1000 [ 855.554856][T28130] FAULT_INJECTION: forcing a failure. [ 855.554856][T28130] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 855.578831][T28130] CPU: 0 UID: 0 PID: 28130 Comm: syz.4.6678 Not tainted syzkaller #0 PREEMPT(full) [ 855.578857][T28130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 855.578867][T28130] Call Trace: [ 855.578874][T28130] [ 855.578882][T28130] dump_stack_lvl+0xe8/0x150 [ 855.578907][T28130] should_fail_ex+0x412/0x560 [ 855.578942][T28130] _copy_from_user+0x2d/0xb0 [ 855.578967][T28130] ___sys_sendmsg+0x1c6/0x360 [ 855.578989][T28130] ? __lock_acquire+0x6b5/0x2cf0 [ 855.579012][T28130] ? __pfx____sys_sendmsg+0x10/0x10 [ 855.579061][T28130] ? __fget_files+0x2a/0x420 [ 855.579082][T28130] ? __fget_files+0x3a0/0x420 [ 855.579112][T28130] __x64_sys_sendmsg+0x1bd/0x2a0 [ 855.579136][T28130] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 855.579170][T28130] ? __pfx_ksys_write+0x10/0x10 [ 855.579203][T28130] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.579223][T28130] do_syscall_64+0x15f/0xf80 [ 855.579243][T28130] ? clear_bhb_loop+0x40/0x90 [ 855.579264][T28130] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 855.579282][T28130] RIP: 0033:0x7f97f4f9cdd9 [ 855.579300][T28130] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 855.579314][T28130] RSP: 002b:00007f97f5ecb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 855.579334][T28130] RAX: ffffffffffffffda RBX: 00007f97f5215fa0 RCX: 00007f97f4f9cdd9 [ 855.579347][T28130] RDX: 0000000020048054 RSI: 0000200000000200 RDI: 0000000000000005 [ 855.579359][T28130] RBP: 00007f97f5ecb090 R08: 0000000000000000 R09: 0000000000000000 [ 855.579369][T28130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 855.579381][T28130] R13: 00007f97f5216038 R14: 00007f97f5215fa0 R15: 00007ffd38405718 [ 855.579411][T28130] [ 855.918024][T28133] syzkaller0: entered promiscuous mode [ 855.929025][T28133] syzkaller0: entered allmulticast mode [ 855.951731][T28138] tipc: Started in network mode [ 855.956835][T28138] tipc: Node identity e62f02ed431f, cluster identity 4711 [ 855.969619][T28138] tipc: Enabled bearer , priority 0 [ 855.998911][T28141] netdevsim netdevsim2: Direct firmware load for . failed with error -2 [ 856.036107][T28141] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 857.381147][T28150] __nla_validate_parse: 1 callbacks suppressed [ 857.381195][T28150] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6682'. [ 857.439545][T28151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6682'. [ 858.111895][T28136] tipc: Disabling bearer [ 858.129173][ T7464] tipc: Node number set to 2771387117 [ 858.141183][T28150] openvswitch: : Dropping previously announced user features [ 858.172864][T28151] openvswitch: : Dropping previously announced user features [ 858.251947][T28160] netlink: 92 bytes leftover after parsing attributes in process `syz.1.6684'. [ 858.273380][T28158] Cannot find del_set index 1 as target [ 858.320130][T28158] IPv6: NLM_F_REPLACE set, but no existing node found! [ 858.353449][T28164] netlink: 420 bytes leftover after parsing attributes in process `syz.2.6685'. [ 858.402965][T28164] net_ratelimit: 336 callbacks suppressed [ 858.402984][T28164] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 858.753974][T28186] FAULT_INJECTION: forcing a failure. [ 858.753974][T28186] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 858.801130][T28186] CPU: 0 UID: 0 PID: 28186 Comm: syz.1.6693 Not tainted syzkaller #0 PREEMPT(full) [ 858.801157][T28186] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 858.801169][T28186] Call Trace: [ 858.801177][T28186] [ 858.801186][T28186] dump_stack_lvl+0xe8/0x150 [ 858.801213][T28186] should_fail_ex+0x412/0x560 [ 858.801242][T28186] _copy_from_user+0x2d/0xb0 [ 858.801268][T28186] ___sys_sendmsg+0x1c6/0x360 [ 858.801291][T28186] ? __lock_acquire+0x6b5/0x2cf0 [ 858.801317][T28186] ? __pfx____sys_sendmsg+0x10/0x10 [ 858.801375][T28186] ? __fget_files+0x2a/0x420 [ 858.801396][T28186] ? __fget_files+0x3a0/0x420 [ 858.801427][T28186] __x64_sys_sendmsg+0x1bd/0x2a0 [ 858.801453][T28186] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 858.801486][T28186] ? __pfx_ksys_write+0x10/0x10 [ 858.801521][T28186] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 858.801542][T28186] do_syscall_64+0x15f/0xf80 [ 858.801567][T28186] ? trace_irq_disable+0x3b/0x140 [ 858.801636][T28186] ? clear_bhb_loop+0x40/0x90 [ 858.801660][T28186] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 858.801678][T28186] RIP: 0033:0x7f03c5f9cdd9 [ 858.801696][T28186] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 858.801713][T28186] RSP: 002b:00007f03c6d8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 858.801733][T28186] RAX: ffffffffffffffda RBX: 00007f03c6215fa0 RCX: 00007f03c5f9cdd9 [ 858.801747][T28186] RDX: 0000000000008001 RSI: 0000200000000040 RDI: 0000000000000003 [ 858.801759][T28186] RBP: 00007f03c6d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 858.801771][T28186] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 858.801782][T28186] R13: 00007f03c6216038 R14: 00007f03c6215fa0 R15: 00007ffe71710998 [ 858.801814][T28186] [ 859.040616][T28192] FAULT_INJECTION: forcing a failure. [ 859.040616][T28192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 859.056302][T28192] CPU: 0 UID: 0 PID: 28192 Comm: syz.1.6695 Not tainted syzkaller #0 PREEMPT(full) [ 859.056333][T28192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 859.056345][T28192] Call Trace: [ 859.056353][T28192] [ 859.056362][T28192] dump_stack_lvl+0xe8/0x150 [ 859.056389][T28192] should_fail_ex+0x412/0x560 [ 859.056418][T28192] _copy_from_user+0x2d/0xb0 [ 859.056444][T28192] ___sys_sendmsg+0x1c6/0x360 [ 859.056467][T28192] ? __lock_acquire+0x6b5/0x2cf0 [ 859.056497][T28192] ? __pfx____sys_sendmsg+0x10/0x10 [ 859.056556][T28192] ? __fget_files+0x2a/0x420 [ 859.056575][T28192] ? __fget_files+0x3a0/0x420 [ 859.056611][T28192] __x64_sys_sendmsg+0x1bd/0x2a0 [ 859.056638][T28192] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 859.056670][T28192] ? __pfx_ksys_write+0x10/0x10 [ 859.056705][T28192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.056726][T28192] do_syscall_64+0x15f/0xf80 [ 859.056746][T28192] ? trace_irq_disable+0x3b/0x140 [ 859.056772][T28192] ? clear_bhb_loop+0x40/0x90 [ 859.056796][T28192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.056815][T28192] RIP: 0033:0x7f03c5f9cdd9 [ 859.056838][T28192] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 859.056854][T28192] RSP: 002b:00007f03c6d8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 859.056874][T28192] RAX: ffffffffffffffda RBX: 00007f03c6215fa0 RCX: 00007f03c5f9cdd9 [ 859.056888][T28192] RDX: 0000000000008001 RSI: 0000200000000040 RDI: 0000000000000003 [ 859.056900][T28192] RBP: 00007f03c6d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 859.056912][T28192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 859.056924][T28192] R13: 00007f03c6216038 R14: 00007f03c6215fa0 R15: 00007ffe71710998 [ 859.056956][T28192] [ 859.420318][T28194] netlink: 'syz.4.6696': attribute type 3 has an invalid length. [ 859.449143][T28194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6696'. [ 859.487147][T28201] netlink: 388 bytes leftover after parsing attributes in process `syz.0.6698'. [ 859.618493][T28208] tipc: Enabling of bearer rejected, failed to enable media [ 859.692227][T28209] lo speed is unknown, defaulting to 1000 [ 859.732065][T28213] netlink: 'syz.0.6702': attribute type 3 has an invalid length. [ 859.766580][T28213] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6702'. [ 859.922977][T28224] netlink: 420 bytes leftover after parsing attributes in process `syz.3.6704'. [ 859.961834][T28224] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 860.047487][T28232] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6703'. [ 860.093270][T28232] syzkaller0: entered promiscuous mode [ 860.114825][T28232] syzkaller0: entered allmulticast mode [ 860.496871][T28254] geneve2: entered promiscuous mode [ 860.553461][T28237] lo speed is unknown, defaulting to 1000 [ 860.559821][T21725] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 860.573250][T21725] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 860.698902][T21725] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 860.726770][T21725] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 860.801201][T28264] Bluetooth: MGMT ver 1.23 [ 861.090677][T28272] netlink: 'syz.2.6717': attribute type 3 has an invalid length. [ 861.118941][T28272] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6717'. [ 861.874537][T28302] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 861.900803][T28302] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 862.157202][T28286] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 862.204268][T28317] netlink: 'syz.0.6730': attribute type 3 has an invalid length. [ 862.394584][T28323] __nla_validate_parse: 1 callbacks suppressed [ 862.394602][T28323] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6732'. [ 862.516663][T28328] FAULT_INJECTION: forcing a failure. [ 862.516663][T28328] name failslab, interval 1, probability 0, space 0, times 0 [ 862.535054][T28328] CPU: 1 UID: 0 PID: 28328 Comm: syz.3.6734 Not tainted syzkaller #0 PREEMPT(full) [ 862.535079][T28328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 862.535090][T28328] Call Trace: [ 862.535098][T28328] [ 862.535106][T28328] dump_stack_lvl+0xe8/0x150 [ 862.535136][T28328] should_fail_ex+0x412/0x560 [ 862.535163][T28328] should_failslab+0xa8/0x100 [ 862.535193][T28328] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 862.535218][T28328] ? ethnl_default_set_doit+0x59d/0xad0 [ 862.535240][T28328] ? __kmalloc_noprof+0x37d/0x760 [ 862.535268][T28328] kmemdup_noprof+0x2b/0x70 [ 862.535289][T28328] ethnl_default_set_doit+0x59d/0xad0 [ 862.535324][T28328] genl_family_rcv_msg_doit+0x22a/0x330 [ 862.535351][T28328] ? __asan_memcpy+0x40/0x70 [ 862.535376][T28328] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 862.535416][T28328] ? bpf_lsm_capable+0x9/0x20 [ 862.535433][T28328] ? security_capable+0x7e/0x2c0 [ 862.535462][T28328] genl_rcv_msg+0x61c/0x7a0 [ 862.535501][T28328] ? __pfx_genl_rcv_msg+0x10/0x10 [ 862.535525][T28328] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 862.535551][T28328] ? __pfx_ref_tracker_free+0x10/0x10 [ 862.535585][T28328] netlink_rcv_skb+0x232/0x4b0 [ 862.535608][T28328] ? __pfx_genl_rcv_msg+0x10/0x10 [ 862.535635][T28328] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 862.535674][T28328] ? down_read+0x270/0x2e0 [ 862.535696][T28328] ? genl_rcv+0xd/0x40 [ 862.535722][T28328] genl_rcv+0x28/0x40 [ 862.535745][T28328] netlink_unicast+0x75c/0x8e0 [ 862.535776][T28328] netlink_sendmsg+0x813/0xb40 [ 862.535809][T28328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 862.535835][T28328] ? aa_sock_msg_perm+0xf1/0x1b0 [ 862.535860][T28328] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 862.535888][T28328] ____sys_sendmsg+0x972/0x9f0 [ 862.535912][T28328] ? __might_fault+0xaf/0x130 [ 862.535942][T28328] ? __pfx_____sys_sendmsg+0x10/0x10 [ 862.535976][T28328] ? import_iovec+0x73/0xa0 [ 862.536005][T28328] ___sys_sendmsg+0x2a5/0x360 [ 862.536027][T28328] ? __lock_acquire+0x6b5/0x2cf0 [ 862.536052][T28328] ? __pfx____sys_sendmsg+0x10/0x10 [ 862.536114][T28328] ? __fget_files+0x2a/0x420 [ 862.536135][T28328] ? __fget_files+0x3a0/0x420 [ 862.536167][T28328] __x64_sys_sendmsg+0x1bd/0x2a0 [ 862.536194][T28328] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 862.536228][T28328] ? __pfx_ksys_write+0x10/0x10 [ 862.536262][T28328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.536283][T28328] do_syscall_64+0x15f/0xf80 [ 862.536304][T28328] ? trace_irq_disable+0x3b/0x140 [ 862.536330][T28328] ? clear_bhb_loop+0x40/0x90 [ 862.536353][T28328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 862.536371][T28328] RIP: 0033:0x7f64ddf9cdd9 [ 862.536389][T28328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 862.536404][T28328] RSP: 002b:00007f64dee0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 862.536422][T28328] RAX: ffffffffffffffda RBX: 00007f64de215fa0 RCX: 00007f64ddf9cdd9 [ 862.536435][T28328] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000006 [ 862.536446][T28328] RBP: 00007f64dee0f090 R08: 0000000000000000 R09: 0000000000000000 [ 862.536457][T28328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 862.536467][T28328] R13: 00007f64de216038 R14: 00007f64de215fa0 R15: 00007fffc2d86a48 [ 862.536505][T28328] [ 862.957736][T28332] ip6gre2: entered promiscuous mode [ 862.963432][T28332] ip6gre2: entered allmulticast mode [ 863.032554][T28338] SET target dimension over the limit! [ 863.045088][T28338] IPv6: NLM_F_REPLACE set, but no existing node found! [ 863.069898][T28337] ip6gre1: entered promiscuous mode [ 863.076361][T28337] ip6gre1: entered allmulticast mode [ 863.089207][T28339] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6739'. [ 863.251056][T28348] netlink: 'syz.3.6743': attribute type 3 has an invalid length. [ 863.262254][T28348] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6743'. [ 863.473706][T28364] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6747'. [ 863.485797][T28364] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6747'. [ 863.698039][T28376] syzkaller0: entered promiscuous mode [ 863.711772][T28376] syzkaller0: entered allmulticast mode [ 863.722557][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.730345][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.736855][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.743299][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.749777][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.756238][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.762681][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.769135][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.775592][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.782012][T28376] tc action pedit 'at' offset 32289 out of bounds [ 863.788532][T28376] TC_ACT_REPEAT abuse ? [ 863.872731][T28382] netlink: 212916 bytes leftover after parsing attributes in process `syz.3.6753'. [ 864.108374][T28394] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6758'. [ 864.209028][T28398] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6760'. [ 864.338154][T28402] lo speed is unknown, defaulting to 1000 [ 864.382992][T28367] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 864.393450][T28408] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6763'. [ 864.407084][T28408] openvswitch: : Dropping previously announced user features [ 864.454540][T28406] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6763'. [ 864.497606][T28406] openvswitch: : Dropping previously announced user features [ 864.615936][ T5634] Bluetooth: hci2: command 0x0406 tx timeout [ 864.617068][ T4943] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 864.931064][T28430] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 864.952142][T28426] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 865.068119][T28442] vlan0: entered promiscuous mode [ 865.112660][T28442] bridge0: entered promiscuous mode [ 865.171960][T28450] netlink: 'syz.3.6773': attribute type 11 has an invalid length. [ 865.315743][T28451] syzkaller0: entered promiscuous mode [ 865.321349][T28451] syzkaller0: entered allmulticast mode [ 865.416420][T28446] tipc: Enabled bearer , priority 0 [ 865.480596][T28444] tipc: Resetting bearer [ 865.548685][T28444] tipc: Disabling bearer [ 865.591214][T28464] Cannot find del_set index 1 as target [ 865.632285][T28464] IPv6: NLM_F_REPLACE set, but no existing node found! [ 866.141013][T28456] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 866.178031][T28484] netlink: 'syz.3.6783': attribute type 3 has an invalid length. [ 866.283168][T28488] lo speed is unknown, defaulting to 1000 [ 866.297240][T28491] FAULT_INJECTION: forcing a failure. [ 866.297240][T28491] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 866.357591][T28491] CPU: 1 UID: 0 PID: 28491 Comm: syz.2.6785 Not tainted syzkaller #0 PREEMPT(full) [ 866.357617][T28491] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 866.357628][T28491] Call Trace: [ 866.357637][T28491] [ 866.357645][T28491] dump_stack_lvl+0xe8/0x150 [ 866.357672][T28491] should_fail_ex+0x412/0x560 [ 866.357701][T28491] _copy_to_user+0x31/0xb0 [ 866.357728][T28491] simple_read_from_buffer+0xe1/0x170 [ 866.357757][T28491] proc_fail_nth_read+0x1bb/0x230 [ 866.357784][T28491] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 866.357808][T28491] ? rw_verify_area+0x2a6/0x4d0 [ 866.357830][T28491] ? __fget_files+0x2a/0x420 [ 866.357849][T28491] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 866.357871][T28491] vfs_read+0x20c/0xa70 [ 866.357913][T28491] ? __pfx___mutex_lock+0x10/0x10 [ 866.357936][T28491] ? __pfx_vfs_read+0x10/0x10 [ 866.357962][T28491] ? __fget_files+0x2a/0x420 [ 866.357988][T28491] ? __fget_files+0x3a0/0x420 [ 866.358007][T28491] ? __fget_files+0x2a/0x420 [ 866.358035][T28491] ksys_read+0x150/0x270 [ 866.358062][T28491] ? __pfx_ksys_read+0x10/0x10 [ 866.358094][T28491] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 866.358113][T28491] do_syscall_64+0x15f/0xf80 [ 866.358132][T28491] ? trace_irq_disable+0x3b/0x140 [ 866.358156][T28491] ? clear_bhb_loop+0x40/0x90 [ 866.358178][T28491] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 866.358196][T28491] RIP: 0033:0x7f892c95d60e [ 866.358213][T28491] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 866.358227][T28491] RSP: 002b:00007f892d7aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 866.358246][T28491] RAX: ffffffffffffffda RBX: 00007f892d7ab6c0 RCX: 00007f892c95d60e [ 866.358260][T28491] RDX: 000000000000000f RSI: 00007f892d7ab0a0 RDI: 0000000000000006 [ 866.358272][T28491] RBP: 00007f892d7ab090 R08: 0000000000000000 R09: 0000000000000000 [ 866.358283][T28491] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 866.358293][T28491] R13: 00007f892cc16038 R14: 00007f892cc15fa0 R15: 00007ffe314bdbe8 [ 866.358322][T28491] [ 866.662473][T28499] Cannot find del_set index 1 as target [ 866.712863][T28499] IPv6: NLM_F_REPLACE set, but no existing node found! [ 866.777314][ T2470] block nbd0: Possible stuck request ffff8880265ce000: control (read@0,1024B). Runtime 570 seconds [ 866.810281][ T2470] block nbd0: Possible stuck request ffff8880265ce1c0: control (read@1024,1024B). Runtime 570 seconds [ 866.836082][ T2470] block nbd0: Possible stuck request ffff8880265ce380: control (read@2048,1024B). Runtime 570 seconds [ 866.847376][ T2470] block nbd0: Possible stuck request ffff8880265ce540: control (read@3072,1024B). Runtime 570 seconds [ 867.006726][T28509] xt_bpf: check failed: parse error [ 867.303604][T28531] openvswitch: : Dropping previously announced user features [ 867.346683][T28526] openvswitch: : Dropping previously announced user features [ 867.858753][T28545] FAULT_INJECTION: forcing a failure. [ 867.858753][T28545] name failslab, interval 1, probability 0, space 0, times 0 [ 867.872223][T28545] CPU: 1 UID: 0 PID: 28545 Comm: syz.1.6802 Not tainted syzkaller #0 PREEMPT(full) [ 867.872248][T28545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 867.872260][T28545] Call Trace: [ 867.872268][T28545] [ 867.872276][T28545] dump_stack_lvl+0xe8/0x150 [ 867.872304][T28545] should_fail_ex+0x412/0x560 [ 867.872333][T28545] should_failslab+0xa8/0x100 [ 867.872359][T28545] ? skb_clone+0x212/0x3a0 [ 867.872382][T28545] kmem_cache_alloc_noprof+0x87/0x650 [ 867.872417][T28545] skb_clone+0x212/0x3a0 [ 867.872443][T28545] __netlink_deliver_tap+0x404/0x850 [ 867.872479][T28545] ? netlink_deliver_tap+0x2e/0x1b0 [ 867.872503][T28545] netlink_deliver_tap+0x19c/0x1b0 [ 867.872525][T28545] netlink_sendskb+0x68/0x140 [ 867.872547][T28545] netlink_rcv_skb+0x2b6/0x4b0 [ 867.872569][T28545] ? __pfx_genl_rcv_msg+0x10/0x10 [ 867.872596][T28545] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 867.872633][T28545] ? down_read+0x270/0x2e0 [ 867.872654][T28545] ? genl_rcv+0xd/0x40 [ 867.872680][T28545] genl_rcv+0x28/0x40 [ 867.872703][T28545] netlink_unicast+0x75c/0x8e0 [ 867.872733][T28545] netlink_sendmsg+0x813/0xb40 [ 867.872764][T28545] ? __pfx_netlink_sendmsg+0x10/0x10 [ 867.872790][T28545] ? aa_sock_msg_perm+0xf1/0x1b0 [ 867.872816][T28545] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 867.872844][T28545] ____sys_sendmsg+0x972/0x9f0 [ 867.872867][T28545] ? __might_fault+0xaf/0x130 [ 867.872897][T28545] ? __pfx_____sys_sendmsg+0x10/0x10 [ 867.872929][T28545] ? import_iovec+0x73/0xa0 [ 867.872959][T28545] ___sys_sendmsg+0x2a5/0x360 [ 867.872980][T28545] ? __lock_acquire+0x6b5/0x2cf0 [ 867.873011][T28545] ? __pfx____sys_sendmsg+0x10/0x10 [ 867.873071][T28545] ? __fget_files+0x2a/0x420 [ 867.873092][T28545] ? __fget_files+0x3a0/0x420 [ 867.873125][T28545] __x64_sys_sendmsg+0x1bd/0x2a0 [ 867.873150][T28545] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 867.873183][T28545] ? __pfx_ksys_write+0x10/0x10 [ 867.873218][T28545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.873239][T28545] do_syscall_64+0x15f/0xf80 [ 867.873259][T28545] ? trace_irq_disable+0x3b/0x140 [ 867.873285][T28545] ? clear_bhb_loop+0x40/0x90 [ 867.873308][T28545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.873329][T28545] RIP: 0033:0x7f03c5f9cdd9 [ 867.873348][T28545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 867.873363][T28545] RSP: 002b:00007f03c6d6e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 867.873382][T28545] RAX: ffffffffffffffda RBX: 00007f03c6216090 RCX: 00007f03c5f9cdd9 [ 867.873396][T28545] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 0000000000000003 [ 867.873408][T28545] RBP: 00007f03c6d6e090 R08: 0000000000000000 R09: 0000000000000000 [ 867.873419][T28545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 867.873430][T28545] R13: 00007f03c6216128 R14: 00007f03c6216090 R15: 00007ffe71710998 [ 867.873462][T28545] [ 868.177903][T28520] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 868.395195][T28550] Cannot find del_set index 1 as target [ 868.442268][T28550] IPv6: NLM_F_REPLACE set, but no existing node found! [ 868.507539][T28554] __nla_validate_parse: 13 callbacks suppressed [ 868.507560][T28554] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6804'. [ 868.585943][T28557] netlink: 'syz.2.6806': attribute type 3 has an invalid length. [ 868.609943][T28557] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6806'. [ 869.711282][T28601] netlink: 420 bytes leftover after parsing attributes in process `syz.2.6819'. [ 869.732446][T28601] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 869.973119][T28609] lo speed is unknown, defaulting to 1000 [ 870.065503][T28618] FAULT_INJECTION: forcing a failure. [ 870.065503][T28618] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 870.109827][T28618] CPU: 0 UID: 0 PID: 28618 Comm: syz.2.6825 Not tainted syzkaller #0 PREEMPT(full) [ 870.109854][T28618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 870.109865][T28618] Call Trace: [ 870.109873][T28618] [ 870.109882][T28618] dump_stack_lvl+0xe8/0x150 [ 870.109909][T28618] should_fail_ex+0x412/0x560 [ 870.109938][T28618] _copy_to_user+0x31/0xb0 [ 870.109965][T28618] simple_read_from_buffer+0xe1/0x170 [ 870.109993][T28618] proc_fail_nth_read+0x1bb/0x230 [ 870.110020][T28618] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 870.110046][T28618] ? rw_verify_area+0x2a6/0x4d0 [ 870.110071][T28618] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 870.110095][T28618] vfs_read+0x20c/0xa70 [ 870.110125][T28618] ? __pfx___mutex_lock+0x10/0x10 [ 870.110148][T28618] ? __pfx_vfs_read+0x10/0x10 [ 870.110175][T28618] ? __fget_files+0x2a/0x420 [ 870.110201][T28618] ? __fget_files+0x3a0/0x420 [ 870.110221][T28618] ? __fget_files+0x2a/0x420 [ 870.110252][T28618] ksys_read+0x150/0x270 [ 870.110279][T28618] ? __pfx_ksys_read+0x10/0x10 [ 870.110312][T28618] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.110333][T28618] do_syscall_64+0x15f/0xf80 [ 870.110353][T28618] ? trace_irq_disable+0x3b/0x140 [ 870.110379][T28618] ? clear_bhb_loop+0x40/0x90 [ 870.110402][T28618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.110424][T28618] RIP: 0033:0x7f892c95d60e [ 870.110442][T28618] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 870.110458][T28618] RSP: 002b:00007f892d7aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 870.110477][T28618] RAX: ffffffffffffffda RBX: 00007f892d7ab6c0 RCX: 00007f892c95d60e [ 870.110490][T28618] RDX: 000000000000000f RSI: 00007f892d7ab0a0 RDI: 0000000000000004 [ 870.110502][T28618] RBP: 00007f892d7ab090 R08: 0000000000000000 R09: 0000000000000000 [ 870.110514][T28618] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 870.110525][T28618] R13: 00007f892cc16038 R14: 00007f892cc15fa0 R15: 00007ffe314bdbe8 [ 870.110558][T28618] [ 870.575837][T28621] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6826'. [ 870.965764][T28635] netlink: 124 bytes leftover after parsing attributes in process `syz.1.6830'. [ 870.976762][T28639] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6832'. [ 871.008401][T28635] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6830'. [ 871.103934][T28641] vlan0: entered promiscuous mode [ 871.124837][T28641] bridge0: entered promiscuous mode [ 871.191060][T28635] veth5: entered allmulticast mode [ 871.200613][T28635] bond1: (slave veth5): Enslaving as an active interface with an up link [ 871.238312][T28643] bond1 (unregistering): (slave veth5): Releasing backup interface [ 871.262568][T28643] bond1 (unregistering): Released all slaves [ 871.390784][T28649] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6834'. [ 871.617389][T28660] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 871.720596][T28652] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6834'. [ 871.748834][T28660] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 872.007680][T28661] lo speed is unknown, defaulting to 1000 [ 872.051889][T28668] netlink: 388 bytes leftover after parsing attributes in process `syz.2.6838'. [ 872.483706][T28680] FAULT_INJECTION: forcing a failure. [ 872.483706][T28680] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 872.534804][T28680] CPU: 0 UID: 0 PID: 28680 Comm: syz.2.6842 Not tainted syzkaller #0 PREEMPT(full) [ 872.534830][T28680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 872.534841][T28680] Call Trace: [ 872.534849][T28680] [ 872.534857][T28680] dump_stack_lvl+0xe8/0x150 [ 872.534881][T28680] should_fail_ex+0x412/0x560 [ 872.534907][T28680] _copy_from_user+0x2d/0xb0 [ 872.534932][T28680] __copy_msghdr+0x3c5/0x5b0 [ 872.534957][T28680] ___sys_sendmsg+0x213/0x360 [ 872.534978][T28680] ? __lock_acquire+0x6b5/0x2cf0 [ 872.535001][T28680] ? __pfx____sys_sendmsg+0x10/0x10 [ 872.535054][T28680] ? __fget_files+0x2a/0x420 [ 872.535076][T28680] ? __fget_files+0x3a0/0x420 [ 872.535107][T28680] __x64_sys_sendmsg+0x1bd/0x2a0 [ 872.535133][T28680] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 872.535165][T28680] ? __pfx_ksys_write+0x10/0x10 [ 872.535200][T28680] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.535221][T28680] do_syscall_64+0x15f/0xf80 [ 872.535244][T28680] ? trace_irq_disable+0x3b/0x140 [ 872.535278][T28680] ? clear_bhb_loop+0x40/0x90 [ 872.535301][T28680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 872.535319][T28680] RIP: 0033:0x7f892c99cdd9 [ 872.535337][T28680] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 872.535352][T28680] RSP: 002b:00007f892d7ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 872.535371][T28680] RAX: ffffffffffffffda RBX: 00007f892cc15fa0 RCX: 00007f892c99cdd9 [ 872.535384][T28680] RDX: 0000000024000008 RSI: 00002000000000c0 RDI: 0000000000000003 [ 872.535397][T28680] RBP: 00007f892d7ab090 R08: 0000000000000000 R09: 0000000000000000 [ 872.535409][T28680] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 872.535420][T28680] R13: 00007f892cc16038 R14: 00007f892cc15fa0 R15: 00007ffe314bdbe8 [ 872.535450][T28680] [ 873.631210][T28700] __nla_validate_parse: 3 callbacks suppressed [ 873.631230][T28700] netlink: 420 bytes leftover after parsing attributes in process `syz.4.6849'. [ 873.706196][T28700] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 873.912200][T28709] SET target dimension over the limit! [ 873.933195][T28709] IPv6: NLM_F_REPLACE set, but no existing node found! [ 873.990205][T28711] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6853'. [ 874.110689][T28718] netlink: 420 bytes leftover after parsing attributes in process `syz.3.6855'. [ 874.144346][T28718] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 874.442894][T28731] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6856'. [ 874.528923][T28731] syzkaller0: entered promiscuous mode [ 874.534321][T28734] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6859'. [ 874.550054][T28731] syzkaller0: entered allmulticast mode [ 874.705207][T28739] FAULT_INJECTION: forcing a failure. [ 874.705207][T28739] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 874.721441][T28739] CPU: 0 UID: 0 PID: 28739 Comm: syz.0.6861 Not tainted syzkaller #0 PREEMPT(full) [ 874.721465][T28739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 874.721476][T28739] Call Trace: [ 874.721483][T28739] [ 874.721491][T28739] dump_stack_lvl+0xe8/0x150 [ 874.721518][T28739] should_fail_ex+0x412/0x560 [ 874.721544][T28739] _copy_from_user+0x2d/0xb0 [ 874.721568][T28739] __copy_msghdr+0x3c5/0x5b0 [ 874.721593][T28739] ___sys_sendmsg+0x213/0x360 [ 874.721614][T28739] ? __lock_acquire+0x6b5/0x2cf0 [ 874.721638][T28739] ? __pfx____sys_sendmsg+0x10/0x10 [ 874.721692][T28739] ? __fget_files+0x2a/0x420 [ 874.721713][T28739] ? __fget_files+0x3a0/0x420 [ 874.721741][T28739] __x64_sys_sendmsg+0x1bd/0x2a0 [ 874.721774][T28739] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 874.721804][T28739] ? __pfx_ksys_write+0x10/0x10 [ 874.721837][T28739] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.721856][T28739] do_syscall_64+0x15f/0xf80 [ 874.721876][T28739] ? trace_irq_disable+0x3b/0x140 [ 874.721901][T28739] ? clear_bhb_loop+0x40/0x90 [ 874.721923][T28739] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 874.721940][T28739] RIP: 0033:0x7f9303d9cdd9 [ 874.721957][T28739] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 874.721972][T28739] RSP: 002b:00007f9304beb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 874.721991][T28739] RAX: ffffffffffffffda RBX: 00007f9304015fa0 RCX: 00007f9303d9cdd9 [ 874.722005][T28739] RDX: 0000000000000000 RSI: 0000200000001180 RDI: 0000000000000003 [ 874.722017][T28739] RBP: 00007f9304beb090 R08: 0000000000000000 R09: 0000000000000000 [ 874.722028][T28739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 874.722039][T28739] R13: 00007f9304016038 R14: 00007f9304015fa0 R15: 00007ffd481e5228 [ 874.722074][T28739] [ 874.992188][T28737] syzkaller0: entered promiscuous mode [ 875.008552][T28737] syzkaller0: entered allmulticast mode [ 875.120937][T28747] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6866'. [ 875.319177][T28758] FAULT_INJECTION: forcing a failure. [ 875.319177][T28758] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 875.350497][T28760] FAULT_INJECTION: forcing a failure. [ 875.350497][T28760] name failslab, interval 1, probability 0, space 0, times 0 [ 875.364958][T28758] CPU: 0 UID: 0 PID: 28758 Comm: syz.1.6867 Not tainted syzkaller #0 PREEMPT(full) [ 875.364982][T28758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 875.364993][T28758] Call Trace: [ 875.365001][T28758] [ 875.365009][T28758] dump_stack_lvl+0xe8/0x150 [ 875.365035][T28758] should_fail_ex+0x412/0x560 [ 875.365064][T28758] _copy_from_user+0x2d/0xb0 [ 875.365090][T28758] __copy_msghdr+0x3c5/0x5b0 [ 875.365118][T28758] ___sys_sendmsg+0x213/0x360 [ 875.365140][T28758] ? __lock_acquire+0x6b5/0x2cf0 [ 875.365164][T28758] ? __pfx____sys_sendmsg+0x10/0x10 [ 875.365222][T28758] ? __fget_files+0x2a/0x420 [ 875.365250][T28758] ? __fget_files+0x3a0/0x420 [ 875.365281][T28758] __x64_sys_sendmsg+0x1bd/0x2a0 [ 875.365307][T28758] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 875.365339][T28758] ? __pfx_ksys_write+0x10/0x10 [ 875.365372][T28758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.365392][T28758] do_syscall_64+0x15f/0xf80 [ 875.365412][T28758] ? trace_irq_disable+0x3b/0x140 [ 875.365438][T28758] ? clear_bhb_loop+0x40/0x90 [ 875.365464][T28758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.365482][T28758] RIP: 0033:0x7f03c5f9cdd9 [ 875.365499][T28758] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 875.365514][T28758] RSP: 002b:00007f03c6d8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 875.365534][T28758] RAX: ffffffffffffffda RBX: 00007f03c6215fa0 RCX: 00007f03c5f9cdd9 [ 875.365547][T28758] RDX: 0000000000000000 RSI: 0000200000001180 RDI: 0000000000000003 [ 875.365559][T28758] RBP: 00007f03c6d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 875.365570][T28758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 875.365580][T28758] R13: 00007f03c6216038 R14: 00007f03c6215fa0 R15: 00007ffe71710998 [ 875.365610][T28758] [ 875.379506][T28760] CPU: 1 UID: 0 PID: 28760 Comm: syz.0.6871 Not tainted syzkaller #0 PREEMPT(full) [ 875.379531][T28760] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 875.379542][T28760] Call Trace: [ 875.379550][T28760] [ 875.379557][T28760] dump_stack_lvl+0xe8/0x150 [ 875.379586][T28760] should_fail_ex+0x412/0x560 [ 875.379614][T28760] should_failslab+0xa8/0x100 [ 875.379642][T28760] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 875.379667][T28760] ? __alloc_skb+0x1d0/0x7d0 [ 875.379685][T28760] ? __local_bh_enable_ip+0xd0/0x130 [ 875.379709][T28760] __alloc_skb+0x1d0/0x7d0 [ 875.379733][T28760] __ip6_append_data+0x2c7c/0x3e90 [ 875.379768][T28760] ? __lock_acquire+0x6b5/0x2cf0 [ 875.379789][T28760] ? __pfx_raw6_getfrag+0x10/0x10 [ 875.379811][T28760] ? ip6_mtu+0x7d/0x490 [ 875.379840][T28760] ? ip6_mtu+0x7d/0x490 [ 875.379863][T28760] ? __pfx___ip6_append_data+0x10/0x10 [ 875.379883][T28760] ? ip6_setup_cork+0x544/0xf30 [ 875.379904][T28760] ? ip6_append_data+0x1b7/0x280 [ 875.379926][T28760] ip6_append_data+0x10f/0x280 [ 875.379949][T28760] ? __pfx_raw6_getfrag+0x10/0x10 [ 875.379972][T28760] rawv6_sendmsg+0x12d3/0x18e0 [ 875.380015][T28760] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 875.380049][T28760] ? aa_sk_perm+0x6d5/0x900 [ 875.380076][T28760] ? __pfx_aa_sk_perm+0x10/0x10 [ 875.380099][T28760] ? __fget_files+0x3a0/0x420 [ 875.380118][T28760] ? sock_rps_record_flow+0x19/0x350 [ 875.380141][T28760] ? __pfx_inet_sendmsg+0x10/0x10 [ 875.380164][T28760] ? inet_sendmsg+0x2f4/0x370 [ 875.380185][T28760] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 875.380208][T28760] ? __pfx_inet_sendmsg+0x10/0x10 [ 875.380231][T28760] __sys_sendto+0x5de/0x710 [ 875.380255][T28760] ? __pfx___sys_sendto+0x10/0x10 [ 875.380272][T28760] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 875.380305][T28760] ? __fget_files+0x3a0/0x420 [ 875.380336][T28760] ? ksys_write+0x242/0x270 [ 875.380362][T28760] ? __pfx_ksys_write+0x10/0x10 [ 875.380391][T28760] __x64_sys_sendto+0xde/0x100 [ 875.380412][T28760] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.380431][T28760] do_syscall_64+0x15f/0xf80 [ 875.380450][T28760] ? trace_irq_disable+0x3b/0x140 [ 875.380474][T28760] ? clear_bhb_loop+0x40/0x90 [ 875.380495][T28760] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.380513][T28760] RIP: 0033:0x7f9303d9cdd9 [ 875.380530][T28760] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 875.380545][T28760] RSP: 002b:00007f9304beb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 875.380563][T28760] RAX: ffffffffffffffda RBX: 00007f9304015fa0 RCX: 00007f9303d9cdd9 [ 875.380576][T28760] RDX: 0000000000000004 RSI: 00002000000002c0 RDI: 0000000000000003 [ 875.380587][T28760] RBP: 00007f9304beb090 R08: 0000000000000000 R09: 0000000000000000 [ 875.380598][T28760] R10: 0000000000003b00 R11: 0000000000000246 R12: 0000000000000001 [ 875.380609][T28760] R13: 00007f9304016038 R14: 00007f9304015fa0 R15: 00007ffd481e5228 [ 875.380639][T28760] [ 876.045770][T28775] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6873'. [ 876.510508][T28801] hmó3)ó: entered promiscuous mode [ 876.572510][T28804] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6882'. [ 876.594286][T28796] lo speed is unknown, defaulting to 1000 [ 876.599215][T28808] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6885'. [ 876.624325][T28804] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6882'. [ 876.682686][ T7464] hsr0: entered promiscuous mode [ 876.776600][T28815] geneve2: entered promiscuous mode [ 876.787374][ T1121] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 876.805293][ T1121] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 876.816279][ T1121] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 876.842680][ T1121] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 876.918204][T28817] syzkaller0: entered promiscuous mode [ 876.934025][T28817] syzkaller0: entered allmulticast mode [ 877.051303][T28817] tipc: Enabling of bearer rejected, failed to enable media [ 877.182777][T28827] FAULT_INJECTION: forcing a failure. [ 877.182777][T28827] name failslab, interval 1, probability 0, space 0, times 0 [ 877.207390][T28827] CPU: 1 UID: 0 PID: 28827 Comm: syz.1.6891 Not tainted syzkaller #0 PREEMPT(full) [ 877.207417][T28827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 877.207428][T28827] Call Trace: [ 877.207436][T28827] [ 877.207445][T28827] dump_stack_lvl+0xe8/0x150 [ 877.207471][T28827] should_fail_ex+0x412/0x560 [ 877.207500][T28827] should_failslab+0xa8/0x100 [ 877.207528][T28827] __kmalloc_noprof+0xe8/0x760 [ 877.207554][T28827] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 877.207588][T28827] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 877.207624][T28827] genl_family_rcv_msg_doit+0xd9/0x330 [ 877.207657][T28827] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 877.207717][T28827] ? apparmor_capable+0x126/0x170 [ 877.207746][T28827] ? bpf_lsm_capable+0x9/0x20 [ 877.207764][T28827] ? security_capable+0x7e/0x2c0 [ 877.207793][T28827] genl_rcv_msg+0x61c/0x7a0 [ 877.207831][T28827] ? __pfx_genl_rcv_msg+0x10/0x10 [ 877.207856][T28827] ? __pfx_ip_vs_genl_set_cmd+0x10/0x10 [ 877.207883][T28827] ? __pfx_ref_tracker_free+0x10/0x10 [ 877.207918][T28827] netlink_rcv_skb+0x232/0x4b0 [ 877.207940][T28827] ? __pfx_genl_rcv_msg+0x10/0x10 [ 877.207967][T28827] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 877.208004][T28827] ? down_read+0x270/0x2e0 [ 877.208025][T28827] ? genl_rcv+0xd/0x40 [ 877.208051][T28827] genl_rcv+0x28/0x40 [ 877.208074][T28827] netlink_unicast+0x75c/0x8e0 [ 877.208105][T28827] netlink_sendmsg+0x813/0xb40 [ 877.208137][T28827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 877.208167][T28827] ? aa_sock_msg_perm+0xf1/0x1b0 [ 877.208191][T28827] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 877.208217][T28827] ____sys_sendmsg+0x972/0x9f0 [ 877.208239][T28827] ? __might_fault+0xaf/0x130 [ 877.208269][T28827] ? __pfx_____sys_sendmsg+0x10/0x10 [ 877.208301][T28827] ? import_iovec+0x73/0xa0 [ 877.208333][T28827] ___sys_sendmsg+0x2a5/0x360 [ 877.208355][T28827] ? __lock_acquire+0x6b5/0x2cf0 [ 877.208380][T28827] ? __pfx____sys_sendmsg+0x10/0x10 [ 877.208441][T28827] ? __fget_files+0x2a/0x420 [ 877.208462][T28827] ? __fget_files+0x3a0/0x420 [ 877.208494][T28827] __x64_sys_sendmsg+0x1bd/0x2a0 [ 877.208520][T28827] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 877.208552][T28827] ? __pfx_ksys_write+0x10/0x10 [ 877.208587][T28827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 877.208606][T28827] do_syscall_64+0x15f/0xf80 [ 877.208626][T28827] ? trace_irq_disable+0x3b/0x140 [ 877.208651][T28827] ? clear_bhb_loop+0x40/0x90 [ 877.208674][T28827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 877.208692][T28827] RIP: 0033:0x7f03c5f9cdd9 [ 877.208709][T28827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 877.208724][T28827] RSP: 002b:00007f03c6d8f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 877.208743][T28827] RAX: ffffffffffffffda RBX: 00007f03c6215fa0 RCX: 00007f03c5f9cdd9 [ 877.208755][T28827] RDX: 0000000000040000 RSI: 00002000000018c0 RDI: 0000000000000003 [ 877.208767][T28827] RBP: 00007f03c6d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 877.208778][T28827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 877.208789][T28827] R13: 00007f03c6216038 R14: 00007f03c6215fa0 R15: 00007ffe71710998 [ 877.208827][T28827] [ 877.541800][T28829] netlink: 'syz.2.6890': attribute type 30 has an invalid length. [ 878.057023][T28847] openvswitch: netlink: Tunnel attr 333 out of range max 16 [ 878.436985][T28873] xt_addrtype: ipv6 does not support BROADCAST matching [ 878.449483][T28869] ip6gretap0: entered promiscuous mode [ 878.561048][T28875] can: request_module (can-proto-0) failed. [ 878.734042][T28882] __nla_validate_parse: 7 callbacks suppressed [ 878.734062][T28882] netlink: 120 bytes leftover after parsing attributes in process `syz.2.6905'. [ 878.754661][T28883] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6906'. [ 878.774501][T28882] netlink: 'syz.2.6905': attribute type 1 has an invalid length. [ 878.796256][T28882] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6905'. [ 878.837853][T28883] netlink: 120 bytes leftover after parsing attributes in process `syz.1.6906'. [ 878.855790][T28883] netlink: 'syz.1.6906': attribute type 1 has an invalid length. [ 878.886382][T28883] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6906'. [ 878.940539][T28887] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6907'. [ 878.979507][T28891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6909'. [ 878.990266][T28889] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6908'. [ 879.005864][T28889] openvswitch: : Dropping previously announced user features [ 879.081070][T28889] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6908'. [ 879.114463][T28889] openvswitch: : Dropping previously announced user features [ 879.139044][T28899] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6910'. [ 879.291983][T28904] openvswitch: : Dropping previously announced user features [ 879.304081][T28906] FAULT_INJECTION: forcing a failure. [ 879.304081][T28906] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 879.338813][T28906] CPU: 1 UID: 0 PID: 28906 Comm: syz.0.6913 Not tainted syzkaller #0 PREEMPT(full) [ 879.338838][T28906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 879.338849][T28906] Call Trace: [ 879.338865][T28906] [ 879.338873][T28906] dump_stack_lvl+0xe8/0x150 [ 879.338901][T28906] should_fail_ex+0x412/0x560 [ 879.338929][T28906] _copy_from_user+0x2d/0xb0 [ 879.338956][T28906] kstrtouint_from_user+0xd6/0x180 [ 879.338981][T28906] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 879.339021][T28906] proc_fail_nth_write+0x8e/0x210 [ 879.339046][T28906] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 879.339075][T28906] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 879.339100][T28906] vfs_write+0x29a/0xb90 [ 879.339133][T28906] ? __pfx_vfs_write+0x10/0x10 [ 879.339159][T28906] ? __fget_files+0x2a/0x420 [ 879.339185][T28906] ? __fget_files+0x3a0/0x420 [ 879.339206][T28906] ? __fget_files+0x2a/0x420 [ 879.339235][T28906] ksys_write+0x150/0x270 [ 879.339262][T28906] ? __pfx_ksys_write+0x10/0x10 [ 879.339296][T28906] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.339316][T28906] do_syscall_64+0x15f/0xf80 [ 879.339335][T28906] ? trace_irq_disable+0x3b/0x140 [ 879.339360][T28906] ? clear_bhb_loop+0x40/0x90 [ 879.339381][T28906] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 879.339398][T28906] RIP: 0033:0x7f9303d5d60e [ 879.339417][T28906] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 879.339432][T28906] RSP: 002b:00007f9304beafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 879.339449][T28906] RAX: ffffffffffffffda RBX: 00007f9304beb6c0 RCX: 00007f9303d5d60e [ 879.339461][T28906] RDX: 0000000000000001 RSI: 00007f9304beb0a0 RDI: 0000000000000007 [ 879.339473][T28906] RBP: 00007f9304beb090 R08: 0000000000000000 R09: 0000000000000000 [ 879.339484][T28906] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 879.339494][T28906] R13: 00007f9304016038 R14: 00007f9304015fa0 R15: 00007ffd481e5228 [ 879.339526][T28906] [ 879.343044][T28904] openvswitch: : Dropping previously announced user features [ 879.602909][T28912] netlink: 'syz.4.6915': attribute type 11 has an invalid length. [ 879.678679][T28918] netlink: 'syz.0.6917': attribute type 1 has an invalid length. [ 879.782514][T28918] 8021q: adding VLAN 0 to HW filter on device bond0 [ 879.821475][T28924] 8021q: adding VLAN 0 to HW filter on device bond0 [ 879.829371][T28924] bond0: (slave vcan1): The slave device specified does not support setting the MAC address [ 879.841221][T28924] bond0: (slave vcan1): Error -95 calling set_mac_address [ 879.924953][T28918] netlink: 'syz.0.6917': attribute type 1 has an invalid length. [ 879.932894][T28918] netlink: 'syz.0.6917': attribute type 1 has an invalid length. [ 880.240652][T28952] xt_TCPMSS: Only works on TCP SYN packets [ 880.698393][T28971] syz_tun: left allmulticast mode [ 880.712279][T28971] syz_tun: left promiscuous mode [ 880.721841][T28971] bridge0: port 3(syz_tun) entered disabled state [ 880.736077][T28971] bridge_slave_1: left allmulticast mode [ 880.742149][T28971] bridge_slave_1: left promiscuous mode [ 880.762337][T28971] bridge0: port 2(bridge_slave_1) entered disabled state [ 880.781551][T28971] bridge_slave_0: left allmulticast mode [ 880.790318][T28971] bridge_slave_0: left promiscuous mode [ 880.799461][T28971] bridge0: port 1(bridge_slave_0) entered disabled state [ 880.944184][T28976] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 881.184348][T28996] tc_dump_action: action bad kind [ 881.598913][T29020] bridge0: port 3(syz_tun) entered disabled state [ 881.606264][T29020] syz_tun: left allmulticast mode [ 881.611510][T29020] syz_tun: left promiscuous mode [ 881.621232][T29019] netlink: zone id is out of range [ 881.629258][T29019] netlink: zone id is out of range [ 881.634700][T29020] bridge0: port 3(syz_tun) entered disabled state [ 881.638956][T29026] netlink: zone id is out of range [ 881.642187][T29019] netlink: zone id is out of range [ 881.653743][T29019] netlink: zone id is out of range [ 881.661398][T29019] netlink: zone id is out of range [ 881.664694][T29026] netlink: zone id is out of range [ 881.674117][T29019] netlink: zone id is out of range [ 881.680209][T29026] netlink: zone id is out of range [ 881.682121][T29020] bridge0: port 2(bridge_slave_1) entered disabled state [ 881.693025][T29020] bridge0: port 1(bridge_slave_0) entered disabled state [ 881.812804][T29020] bridge_slave_0: left allmulticast mode [ 881.820102][T29020] bridge_slave_0: left promiscuous mode [ 881.826518][T29020] bridge0: port 1(bridge_slave_0) entered disabled state [ 881.840069][T29020] bridge_slave_1: left allmulticast mode [ 881.845953][T29020] bridge_slave_1: left promiscuous mode [ 881.851621][T29020] bridge0: port 2(bridge_slave_1) entered disabled state [ 881.870492][T29020] bond0: (slave bond_slave_0): Releasing backup interface [ 881.882995][T29020] bond0: (slave bond_slave_1): Releasing backup interface [ 881.897499][T29020] team0: Port device team_slave_0 removed [ 881.908394][T29020] team0: Port device team_slave_1 removed [ 881.918820][T29020] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 881.929156][T29020] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 881.939820][T29020] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 881.949208][T29020] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 882.016640][T29020] veth3: left allmulticast mode [ 882.021645][T29020] veth3: left promiscuous mode [ 882.026886][T29020] bridge1: port 1(veth3) entered disabled state [ 882.038450][T29020] ip6gre1: left promiscuous mode [ 882.043444][T29020] ip6gre1: left allmulticast mode [ 882.053283][T29020] vlan0: left promiscuous mode [ 882.058772][T29020] bridge0: left promiscuous mode [ 882.064150][T29020] veth5: left allmulticast mode [ 882.069849][T29020] geneve2: left promiscuous mode [ 882.091674][T29025] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 882.132971][ T88] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 882.187082][ T88] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.208458][ T88] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 882.230562][ T88] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 882.240593][ T88] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.248885][T29039] FAULT_INJECTION: forcing a failure. [ 882.248885][T29039] name failslab, interval 1, probability 0, space 0, times 0 [ 882.250876][ T88] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 882.262798][T29039] CPU: 0 UID: 0 PID: 29039 Comm: syz.0.6952 Not tainted syzkaller #0 PREEMPT(full) [ 882.262820][T29039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 882.262830][T29039] Call Trace: [ 882.262838][T29039] [ 882.262845][T29039] dump_stack_lvl+0xe8/0x150 [ 882.262872][T29039] should_fail_ex+0x412/0x560 [ 882.262900][T29039] should_failslab+0xa8/0x100 [ 882.262923][T29039] ? dst_alloc+0x105/0x170 [ 882.262946][T29039] kmem_cache_alloc_noprof+0x87/0x650 [ 882.262979][T29039] dst_alloc+0x105/0x170 [ 882.263001][T29039] ? ip_check_mc_rcu+0x4c7/0x680 [ 882.263019][T29039] ip_route_output_key_hash_rcu+0x14d0/0x25d0 [ 882.263053][T29039] ? ip_route_output_key_hash+0xd8/0x2a0 [ 882.263079][T29039] ip_route_output_key_hash+0x18d/0x2a0 [ 882.263106][T29039] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 882.263128][T29039] ? __vlan_get_protocol_offset+0x339/0x3d0 [ 882.263159][T29039] ? __asan_memset+0x22/0x50 [ 882.263185][T29039] ip_route_output_flow+0x2a/0x150 [ 882.263211][T29039] ip_tunnel_xmit+0x75d/0x1f20 [ 882.263253][T29039] ? __pfx_ip_tunnel_xmit+0x10/0x10 [ 882.263281][T29039] ? __pfx_gre_build_header+0x10/0x10 [ 882.263299][T29039] ? skb_network_protocol+0x23d/0x400 [ 882.263320][T29039] ? iptunnel_handle_offloads+0x2fd/0x630 [ 882.263363][T29039] ipgre_xmit+0x8e6/0xc70 [ 882.263393][T29039] ? __pfx_ipgre_xmit+0x10/0x10 [ 882.263423][T29039] dev_hard_start_xmit+0x2cd/0x830 [ 882.263464][T29039] __dev_queue_xmit+0x14d9/0x3950 [ 882.263486][T29039] ? bpf_test_run+0x354/0x830 [ 882.263509][T29039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.263530][T29039] ? __dev_queue_xmit+0x2b6/0x3950 [ 882.263569][T29039] ? __pfx___dev_queue_xmit+0x10/0x10 [ 882.263632][T29039] __bpf_redirect+0x9a6/0x12a0 [ 882.263662][T29039] bpf_clone_redirect+0x313/0x4b0 [ 882.263691][T29039] ? bpf_test_run+0x1d1/0x830 [ 882.263712][T29039] bpf_prog_cfa4bf6e1e03aea2+0x5f/0x68 [ 882.263734][T29039] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 882.263760][T29039] ? arch_stack_walk+0xfb/0x150 [ 882.263791][T29039] ? ktime_get+0x45/0x220 [ 882.263823][T29039] ? ktime_get+0x45/0x220 [ 882.263850][T29039] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 882.263876][T29039] ? lockdep_hardirqs_on+0x7a/0x110 [ 882.263895][T29039] ? ktime_get+0x45/0x220 [ 882.263917][T29039] ? seqcount_lockdep_reader_access+0xea/0x100 [ 882.263942][T29039] ? bpf_test_run+0x1d1/0x830 [ 882.263965][T29039] ? bpf_test_timer_continue+0x10c/0x320 [ 882.263991][T29039] bpf_test_run+0x354/0x830 [ 882.264032][T29039] ? __pfx_bpf_test_run+0x10/0x10 [ 882.264071][T29039] ? eth_type_trans+0x348/0x7e0 [ 882.264100][T29039] ? skb_dst_set+0x72/0x140 [ 882.264123][T29039] bpf_prog_test_run_skb+0xe2c/0x2260 [ 882.264164][T29039] ? __fget_files+0x3a0/0x420 [ 882.264185][T29039] ? __fget_files+0x2a/0x420 [ 882.264210][T29039] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 882.264235][T29039] bpf_prog_test_run+0x2c7/0x340 [ 882.264257][T29039] __sys_bpf+0x643/0x950 [ 882.264284][T29039] ? __pfx___sys_bpf+0x10/0x10 [ 882.264331][T29039] ? ksys_write+0x242/0x270 [ 882.264357][T29039] ? __pfx_ksys_write+0x10/0x10 [ 882.264385][T29039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.264405][T29039] __x64_sys_bpf+0x7c/0x90 [ 882.264430][T29039] do_syscall_64+0x15f/0xf80 [ 882.264448][T29039] ? trace_irq_disable+0x3b/0x140 [ 882.264472][T29039] ? clear_bhb_loop+0x40/0x90 [ 882.264495][T29039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.264512][T29039] RIP: 0033:0x7f9303d9cdd9 [ 882.264530][T29039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 882.264544][T29039] RSP: 002b:00007f9304beb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 882.264563][T29039] RAX: ffffffffffffffda RBX: 00007f9304015fa0 RCX: 00007f9303d9cdd9 [ 882.264576][T29039] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 882.264588][T29039] RBP: 00007f9304beb090 R08: 0000000000000000 R09: 0000000000000000 [ 882.264599][T29039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 882.264609][T29039] R13: 00007f9304016038 R14: 00007f9304015fa0 R15: 00007ffd481e5228 [ 882.264640][T29039] [ 882.565119][ T4943] Bluetooth: hci2: command 0x0406 tx timeout [ 882.567173][ T88] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 882.579298][ T5634] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 882.583150][ T88] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.723866][ T88] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 882.751207][ T88] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 882.776464][ T88] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 882.804917][ T88] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 883.159931][T29068] lo speed is unknown, defaulting to 1000 [ 883.282029][T29077] net_ratelimit: 392 callbacks suppressed [ 883.282045][T29077] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 883.607614][T29088] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 883.680964][T29091] syzkaller0: entered promiscuous mode [ 883.686995][T29091] syzkaller0: entered allmulticast mode [ 884.143058][T29103] __nla_validate_parse: 15 callbacks suppressed [ 884.143077][T29103] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6971'. [ 884.208944][T29105] netlink: 'syz.0.6972': attribute type 10 has an invalid length. [ 884.280999][T29112] netlink: 388 bytes leftover after parsing attributes in process `syz.3.6973'. [ 884.396984][T29116] netdevsim netdevsim2: Direct firmware load for . failed with error -2 [ 884.416638][T29116] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 884.623851][T29126] syzkaller0: entered promiscuous mode [ 884.651750][T29126] syzkaller0: entered allmulticast mode [ 884.763902][T29136] netlink: 830 bytes leftover after parsing attributes in process `syz.4.6980'. [ 885.030230][T29147] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6985'. [ 885.190898][T29154] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 885.444811][T29164] netlink: 'syz.0.6992': attribute type 1 has an invalid length. [ 885.510787][T29164] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 885.525794][T29164] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 885.550644][T29171] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6992'. [ 885.565670][T29170] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6994'. [ 885.636145][T29171] bond1: (slave bridge1): Enslaving as an active interface with a down link [ 885.698997][T29175] ip6gretap1: entered promiscuous mode [ 885.704541][T29175] ip6gretap1: entered allmulticast mode [ 885.749004][T29175] bond1: (slave ip6gretap1): making interface the new active one [ 885.767411][T29175] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 886.099602][T29191] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7002'. [ 886.128369][T29191] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7002'. [ 886.230585][T29202] lo speed is unknown, defaulting to 1000 [ 886.230921][T29201] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7002'. [ 886.413616][T29209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7008'. [ 886.935247][ T5634] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 886.941527][ T4943] Bluetooth: hci2: command 0x0406 tx timeout [ 887.000839][T29228] FAULT_INJECTION: forcing a failure. [ 887.000839][T29228] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 887.015187][T29228] CPU: 1 UID: 0 PID: 29228 Comm: syz.3.7014 Not tainted syzkaller #0 PREEMPT(full) [ 887.015214][T29228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 887.015225][T29228] Call Trace: [ 887.015232][T29228] [ 887.015240][T29228] dump_stack_lvl+0xe8/0x150 [ 887.015267][T29228] should_fail_ex+0x412/0x560 [ 887.015295][T29228] _copy_from_iter+0x1d3/0x1670 [ 887.015321][T29228] ? rcu_is_watching+0x15/0xb0 [ 887.015349][T29228] ? __pfx__copy_from_iter+0x10/0x10 [ 887.015369][T29228] ? __kmalloc_node_track_caller_noprof+0x4f9/0x7b0 [ 887.015403][T29228] ? netlink_sendmsg+0x650/0xb40 [ 887.015423][T29228] ? skb_put+0x11b/0x210 [ 887.015447][T29228] netlink_sendmsg+0x6c0/0xb40 [ 887.015478][T29228] ? __pfx_netlink_sendmsg+0x10/0x10 [ 887.015504][T29228] ? aa_sock_msg_perm+0xf1/0x1b0 [ 887.015529][T29228] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 887.015556][T29228] ____sys_sendmsg+0x972/0x9f0 [ 887.015579][T29228] ? __might_fault+0xaf/0x130 [ 887.015607][T29228] ? __pfx_____sys_sendmsg+0x10/0x10 [ 887.015640][T29228] ? import_iovec+0x73/0xa0 [ 887.015668][T29228] ___sys_sendmsg+0x2a5/0x360 [ 887.015689][T29228] ? __lock_acquire+0x6b5/0x2cf0 [ 887.015713][T29228] ? __pfx____sys_sendmsg+0x10/0x10 [ 887.015769][T29228] ? __fget_files+0x2a/0x420 [ 887.015791][T29228] ? __fget_files+0x3a0/0x420 [ 887.015820][T29228] __x64_sys_sendmsg+0x1bd/0x2a0 [ 887.015846][T29228] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 887.015873][T29228] ? __pfx_ksys_write+0x10/0x10 [ 887.015905][T29228] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 887.015926][T29228] do_syscall_64+0x15f/0xf80 [ 887.015946][T29228] ? trace_irq_disable+0x3b/0x140 [ 887.015972][T29228] ? clear_bhb_loop+0x40/0x90 [ 887.015994][T29228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 887.016011][T29228] RIP: 0033:0x7f64ddf9cdd9 [ 887.016028][T29228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 887.016048][T29228] RSP: 002b:00007f64dee0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 887.016068][T29228] RAX: ffffffffffffffda RBX: 00007f64de215fa0 RCX: 00007f64ddf9cdd9 [ 887.016081][T29228] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 887.016099][T29228] RBP: 00007f64dee0f090 R08: 0000000000000000 R09: 0000000000000000 [ 887.016111][T29228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 887.016122][T29228] R13: 00007f64de216038 R14: 00007f64de215fa0 R15: 00007fffc2d86a48 [ 887.016154][T29228] [ 887.365245][T29236] syz_tun: left allmulticast mode [ 887.370442][T29236] syz_tun: left promiscuous mode [ 887.376054][T29236] bridge0: port 3(syz_tun) entered disabled state [ 887.400732][T29236] bridge_slave_1: left allmulticast mode [ 887.407190][T29236] bridge_slave_1: left promiscuous mode [ 887.412976][T29236] bridge0: port 2(bridge_slave_1) entered disabled state [ 887.425717][T29236] bridge_slave_0: left allmulticast mode [ 887.431393][T29236] bridge_slave_0: left promiscuous mode [ 887.438270][T29236] bridge0: port 1(bridge_slave_0) entered disabled state [ 887.959465][T29249] netlink: zone id is out of range [ 887.965532][T29249] netlink: zone id is out of range [ 887.972370][T29249] netlink: zone id is out of range [ 887.992547][T29249] netlink: zone id is out of range [ 888.011307][T29249] netlink: zone id is out of range [ 888.025678][T29249] netlink: zone id is out of range [ 888.038836][T29249] netlink: zone id is out of range [ 888.083841][T29249] netlink: zone id is out of range [ 888.093766][T29249] netlink: zone id is out of range [ 888.179071][T29276] team0: left allmulticast mode [ 888.188682][T29276] team_slave_0: left allmulticast mode [ 888.211495][T29276] team_slave_1: left allmulticast mode [ 888.231941][T29276] team0: left promiscuous mode [ 888.251897][T29276] team_slave_1: left promiscuous mode [ 888.266842][T29276] bridge0: port 4(team0) entered disabled state [ 888.316826][T29276] syz_tun: left allmulticast mode [ 888.326459][T29276] syz_tun: left promiscuous mode [ 888.344416][T29276] bridge0: port 3(syz_tun) entered disabled state [ 888.373468][T29281] net_ratelimit: 337 callbacks suppressed [ 888.373487][T29281] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 888.442382][T29276] bridge_slave_1: left allmulticast mode [ 888.488061][T29276] bridge_slave_1: left promiscuous mode [ 888.506525][T29276] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.546034][T29276] bridge_slave_0: left allmulticast mode [ 888.553326][T29276] bridge_slave_0: left promiscuous mode [ 888.560983][T29276] bridge0: port 1(bridge_slave_0) entered disabled state [ 888.753198][T29291] FAULT_INJECTION: forcing a failure. [ 888.753198][T29291] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 888.815245][T29291] CPU: 0 UID: 0 PID: 29291 Comm: syz.0.7034 Not tainted syzkaller #0 PREEMPT(full) [ 888.815271][T29291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 888.815282][T29291] Call Trace: [ 888.815290][T29291] [ 888.815298][T29291] dump_stack_lvl+0xe8/0x150 [ 888.815325][T29291] should_fail_ex+0x412/0x560 [ 888.815353][T29291] _copy_from_user+0x2d/0xb0 [ 888.815379][T29291] copy_from_sockptr_offset+0x66/0xa0 [ 888.815410][T29291] do_ipt_set_ctl+0x934/0xe00 [ 888.815438][T29291] ? rcu_is_watching+0x15/0xb0 [ 888.815461][T29291] ? trace_contention_end+0x3d/0x140 [ 888.815486][T29291] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 888.815529][T29291] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 888.815554][T29291] ? __pfx___mutex_lock+0x10/0x10 [ 888.815576][T29291] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 888.815602][T29291] ? __pfx_aa_sk_perm+0x10/0x10 [ 888.815630][T29291] nf_setsockopt+0x26f/0x290 [ 888.815657][T29291] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 888.815678][T29291] do_sock_setsockopt+0x17c/0x1b0 [ 888.815704][T29291] __x64_sys_setsockopt+0x13d/0x1b0 [ 888.815728][T29291] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 888.815749][T29291] do_syscall_64+0x15f/0xf80 [ 888.815768][T29291] ? trace_irq_disable+0x3b/0x140 [ 888.815793][T29291] ? clear_bhb_loop+0x40/0x90 [ 888.815814][T29291] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 888.815831][T29291] RIP: 0033:0x7f9303d9cdd9 [ 888.815847][T29291] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 888.815863][T29291] RSP: 002b:00007f9304beb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 888.815882][T29291] RAX: ffffffffffffffda RBX: 00007f9304015fa0 RCX: 00007f9303d9cdd9 [ 888.815895][T29291] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000006 [ 888.815906][T29291] RBP: 00007f9304beb090 R08: 0000000000000428 R09: 0000000000000000 [ 888.815918][T29291] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 888.815938][T29291] R13: 00007f9304016038 R14: 00007f9304015fa0 R15: 00007ffd481e5228 [ 888.815968][T29291] [ 889.043167][T29301] FAULT_INJECTION: forcing a failure. [ 889.043167][T29301] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 889.057324][T29301] CPU: 0 UID: 0 PID: 29301 Comm: syz.2.7037 Not tainted syzkaller #0 PREEMPT(full) [ 889.057350][T29301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 889.057361][T29301] Call Trace: [ 889.057369][T29301] [ 889.057378][T29301] dump_stack_lvl+0xe8/0x150 [ 889.057404][T29301] should_fail_ex+0x412/0x560 [ 889.057433][T29301] _copy_from_user+0x2d/0xb0 [ 889.057459][T29301] ___sys_sendmsg+0x1c6/0x360 [ 889.057483][T29301] ? __lock_acquire+0x6b5/0x2cf0 [ 889.057508][T29301] ? __pfx____sys_sendmsg+0x10/0x10 [ 889.057567][T29301] ? __fget_files+0x2a/0x420 [ 889.057588][T29301] ? __fget_files+0x3a0/0x420 [ 889.057620][T29301] __x64_sys_sendmsg+0x1bd/0x2a0 [ 889.057646][T29301] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 889.057679][T29301] ? __pfx_ksys_write+0x10/0x10 [ 889.057712][T29301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.057733][T29301] do_syscall_64+0x15f/0xf80 [ 889.057753][T29301] ? trace_irq_disable+0x3b/0x140 [ 889.057777][T29301] ? clear_bhb_loop+0x40/0x90 [ 889.057800][T29301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.057818][T29301] RIP: 0033:0x7f892c99cdd9 [ 889.057836][T29301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 889.057851][T29301] RSP: 002b:00007f892d7ab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 889.057870][T29301] RAX: ffffffffffffffda RBX: 00007f892cc15fa0 RCX: 00007f892c99cdd9 [ 889.057884][T29301] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 0000000000000003 [ 889.057895][T29301] RBP: 00007f892d7ab090 R08: 0000000000000000 R09: 0000000000000000 [ 889.057912][T29301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 889.057923][T29301] R13: 00007f892cc16038 R14: 00007f892cc15fa0 R15: 00007ffe314bdbe8 [ 889.057954][T29301] [ 889.304462][T29305] __nla_validate_parse: 6 callbacks suppressed [ 889.304479][T29305] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7038'. [ 889.460896][T29313] netlink: 388 bytes leftover after parsing attributes in process `syz.0.7040'. [ 889.517577][T29312] lo speed is unknown, defaulting to 1000 [ 889.838022][T29338] FAULT_INJECTION: forcing a failure. [ 889.838022][T29338] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 889.855108][T29338] CPU: 0 UID: 0 PID: 29338 Comm: syz.4.7046 Not tainted syzkaller #0 PREEMPT(full) [ 889.855133][T29338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 889.855144][T29338] Call Trace: [ 889.855151][T29338] [ 889.855159][T29338] dump_stack_lvl+0xe8/0x150 [ 889.855184][T29338] should_fail_ex+0x412/0x560 [ 889.855212][T29338] _copy_to_iter+0x589/0x17d0 [ 889.855248][T29338] ? __pfx__copy_to_iter+0x10/0x10 [ 889.855270][T29338] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 889.855291][T29338] ? lockdep_hardirqs_on+0x7a/0x110 [ 889.855311][T29338] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 889.855330][T29338] ? __skb_try_recv_datagram+0x3d4/0x4d0 [ 889.855361][T29338] __skb_datagram_iter+0xf8/0x980 [ 889.855387][T29338] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 889.855419][T29338] skb_copy_datagram_iter+0xb5/0x240 [ 889.855447][T29338] netlink_recvmsg+0x2c3/0xa50 [ 889.855477][T29338] ? __pfx_netlink_recvmsg+0x10/0x10 [ 889.855501][T29338] ? __lock_acquire+0x6b5/0x2cf0 [ 889.855521][T29338] ? aa_sock_msg_perm+0xf1/0x1b0 [ 889.855546][T29338] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 889.855568][T29338] ? security_socket_recvmsg+0x7e/0x2c0 [ 889.855594][T29338] ? __pfx_netlink_recvmsg+0x10/0x10 [ 889.855617][T29338] sock_recvmsg+0x172/0x1b0 [ 889.855647][T29338] ____sys_recvmsg+0x1e6/0x4a0 [ 889.855680][T29338] ? __pfx_____sys_recvmsg+0x10/0x10 [ 889.855719][T29338] ? import_iovec+0x73/0xa0 [ 889.855747][T29338] ___sys_recvmsg+0x215/0x590 [ 889.855776][T29338] ? __pfx____sys_recvmsg+0x10/0x10 [ 889.855804][T29338] ? __fget_files+0x2a/0x420 [ 889.855851][T29338] ? __fget_files+0x3a0/0x420 [ 889.855882][T29338] do_recvmmsg+0x334/0x800 [ 889.855914][T29338] ? __pfx_do_recvmmsg+0x10/0x10 [ 889.855950][T29338] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 889.855990][T29338] __x64_sys_recvmmsg+0x198/0x250 [ 889.856016][T29338] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 889.856049][T29338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.856070][T29338] do_syscall_64+0x15f/0xf80 [ 889.856089][T29338] ? trace_irq_disable+0x3b/0x140 [ 889.856116][T29338] ? clear_bhb_loop+0x40/0x90 [ 889.856138][T29338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 889.856156][T29338] RIP: 0033:0x7f97f4f9cdd9 [ 889.856174][T29338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 889.856189][T29338] RSP: 002b:00007f97f5ecb028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 889.856208][T29338] RAX: ffffffffffffffda RBX: 00007f97f5215fa0 RCX: 00007f97f4f9cdd9 [ 889.856221][T29338] RDX: 0000000000000004 RSI: 0000200000002b00 RDI: 0000000000000003 [ 889.856231][T29338] RBP: 00007f97f5ecb090 R08: 0000000000000000 R09: 0000000000000000 [ 889.856242][T29338] R10: 0000000000000102 R11: 0000000000000246 R12: 0000000000000001 [ 889.856252][T29338] R13: 00007f97f5216038 R14: 00007f97f5215fa0 R15: 00007ffd38405718 [ 889.856282][T29338] [ 890.149099][T19528] Bluetooth: hci2: command 0x0406 tx timeout [ 890.157348][ T4943] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 890.318782][T29354] FAULT_INJECTION: forcing a failure. [ 890.318782][T29354] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 890.332198][T29354] CPU: 0 UID: 0 PID: 29354 Comm: syz.4.7050 Not tainted syzkaller #0 PREEMPT(full) [ 890.332222][T29354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 890.332234][T29354] Call Trace: [ 890.332242][T29354] [ 890.332249][T29354] dump_stack_lvl+0xe8/0x150 [ 890.332276][T29354] should_fail_ex+0x412/0x560 [ 890.332304][T29354] _copy_from_user+0x2d/0xb0 [ 890.332328][T29354] ___sys_sendmsg+0x1c6/0x360 [ 890.332347][T29354] ? __lock_acquire+0x6b5/0x2cf0 [ 890.332370][T29354] ? __pfx____sys_sendmsg+0x10/0x10 [ 890.332388][T29354] ? __lock_acquire+0x6b5/0x2cf0 [ 890.332409][T29354] ? kstrtouint+0x6e/0xe0 [ 890.332463][T29354] __sys_sendmmsg+0x27c/0x4e0 [ 890.332490][T29354] ? __pfx___sys_sendmmsg+0x10/0x10 [ 890.332509][T29354] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 890.332554][T29354] ? ksys_write+0x242/0x270 [ 890.332581][T29354] ? __pfx_ksys_write+0x10/0x10 [ 890.332611][T29354] __x64_sys_sendmmsg+0xa0/0xc0 [ 890.332633][T29354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.332653][T29354] do_syscall_64+0x15f/0xf80 [ 890.332673][T29354] ? trace_irq_disable+0x3b/0x140 [ 890.332699][T29354] ? clear_bhb_loop+0x40/0x90 [ 890.332722][T29354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.332740][T29354] RIP: 0033:0x7f97f4f9cdd9 [ 890.332759][T29354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 890.332783][T29354] RSP: 002b:00007f97f5ecb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 890.332803][T29354] RAX: ffffffffffffffda RBX: 00007f97f5215fa0 RCX: 00007f97f4f9cdd9 [ 890.332816][T29354] RDX: 0000000000000299 RSI: 0000200000003dc0 RDI: 0000000000000006 [ 890.332828][T29354] RBP: 00007f97f5ecb090 R08: 0000000000000000 R09: 0000000000000000 [ 890.332840][T29354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 890.332851][T29354] R13: 00007f97f5216038 R14: 00007f97f5215fa0 R15: 00007ffd38405718 [ 890.332882][T29354] [ 890.364649][T29357] netlink: 388 bytes leftover after parsing attributes in process `syz.1.7052'. [ 890.753505][T29371] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7055'. [ 890.898120][T29375] FAULT_INJECTION: forcing a failure. [ 890.898120][T29375] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 890.926093][T29375] CPU: 1 UID: 0 PID: 29375 Comm: syz.1.7056 Not tainted syzkaller #0 PREEMPT(full) [ 890.926122][T29375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 890.926133][T29375] Call Trace: [ 890.926141][T29375] [ 890.926150][T29375] dump_stack_lvl+0xe8/0x150 [ 890.926176][T29375] should_fail_ex+0x412/0x560 [ 890.926204][T29375] _copy_to_user+0x31/0xb0 [ 890.926232][T29375] simple_read_from_buffer+0xe1/0x170 [ 890.926257][T29375] proc_fail_nth_read+0x1bb/0x230 [ 890.926283][T29375] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 890.926308][T29375] ? rw_verify_area+0x2a6/0x4d0 [ 890.926347][T29375] ? tun_chr_write_iter+0x18a/0x200 [ 890.926367][T29375] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 890.926391][T29375] vfs_read+0x20c/0xa70 [ 890.926419][T29375] ? __pfx___mutex_lock+0x10/0x10 [ 890.926442][T29375] ? __pfx_vfs_read+0x10/0x10 [ 890.926467][T29375] ? __fget_files+0x2a/0x420 [ 890.926499][T29375] ? __fget_files+0x3a0/0x420 [ 890.926518][T29375] ? __fget_files+0x2a/0x420 [ 890.926546][T29375] ksys_read+0x150/0x270 [ 890.926571][T29375] ? __pfx_ksys_read+0x10/0x10 [ 890.926604][T29375] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.926624][T29375] do_syscall_64+0x15f/0xf80 [ 890.926642][T29375] ? trace_irq_disable+0x3b/0x140 [ 890.926669][T29375] ? clear_bhb_loop+0x40/0x90 [ 890.926692][T29375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 890.926711][T29375] RIP: 0033:0x7f03c5f5d60e [ 890.926728][T29375] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 890.926743][T29375] RSP: 002b:00007f03c6d8efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 890.926763][T29375] RAX: ffffffffffffffda RBX: 00007f03c6d8f6c0 RCX: 00007f03c5f5d60e [ 890.926776][T29375] RDX: 000000000000000f RSI: 00007f03c6d8f0a0 RDI: 000000000000000b [ 890.926788][T29375] RBP: 00007f03c6d8f090 R08: 0000000000000000 R09: 0000000000000000 [ 890.926800][T29375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 890.926811][T29375] R13: 00007f03c6216038 R14: 00007f03c6215fa0 R15: 00007ffe71710998 [ 890.926841][T29375] [ 891.648058][T29406] FAULT_INJECTION: forcing a failure. [ 891.648058][T29406] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 891.685950][T29407] syzkaller0: entered promiscuous mode [ 891.696596][T29407] syzkaller0: entered allmulticast mode [ 891.705298][T29406] CPU: 1 UID: 0 PID: 29406 Comm: syz.2.7064 Not tainted syzkaller #0 PREEMPT(full) [ 891.705321][T29406] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 891.705331][T29406] Call Trace: [ 891.705339][T29406] [ 891.705346][T29406] dump_stack_lvl+0xe8/0x150 [ 891.705373][T29406] should_fail_ex+0x412/0x560 [ 891.705409][T29406] _copy_from_user+0x2d/0xb0 [ 891.705436][T29406] kstrtouint_from_user+0xd6/0x180 [ 891.705460][T29406] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 891.705499][T29406] proc_fail_nth_write+0x8e/0x210 [ 891.705522][T29406] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 891.705550][T29406] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 891.705575][T29406] vfs_write+0x29a/0xb90 [ 891.705609][T29406] ? __pfx_vfs_write+0x10/0x10 [ 891.705635][T29406] ? __fget_files+0x2a/0x420 [ 891.705661][T29406] ? __fget_files+0x3a0/0x420 [ 891.705681][T29406] ? __fget_files+0x2a/0x420 [ 891.705713][T29406] ksys_write+0x150/0x270 [ 891.705739][T29406] ? __pfx_ksys_write+0x10/0x10 [ 891.705773][T29406] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.705794][T29406] do_syscall_64+0x15f/0xf80 [ 891.705815][T29406] ? trace_irq_disable+0x3b/0x140 [ 891.705841][T29406] ? clear_bhb_loop+0x40/0x90 [ 891.705864][T29406] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 891.705882][T29406] RIP: 0033:0x7f892c95d60e [ 891.705900][T29406] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 891.705916][T29406] RSP: 002b:00007f892d7aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 891.705935][T29406] RAX: ffffffffffffffda RBX: 00007f892d7ab6c0 RCX: 00007f892c95d60e [ 891.705949][T29406] RDX: 0000000000000001 RSI: 00007f892d7ab0a0 RDI: 0000000000000003 [ 891.705960][T29406] RBP: 00007f892d7ab090 R08: 0000000000000000 R09: 0000000000000000 [ 891.705972][T29406] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 891.705983][T29406] R13: 00007f892cc16038 R14: 00007f892cc15fa0 R15: 00007ffe314bdbe8 [ 891.706016][T29406] [ 891.934046][ T4943] Bluetooth: hci4: command 0x0406 tx timeout [ 892.116276][T29428] tipc: Enabled bearer , priority 0 [ 892.125833][T29423] xt_TCPMSS: Only works on TCP SYN packets [ 892.271502][T29417] syzkaller0: entered promiscuous mode [ 892.277313][T29417] syzkaller0: entered allmulticast mode [ 892.283570][T29417] tipc: Resetting bearer [ 892.345931][ T13] tipc: Resetting bearer [ 892.352208][T29416] tipc: Resetting bearer [ 894.771547][T29416] tipc: Disabling bearer [ 894.884188][T29465] FAULT_INJECTION: forcing a failure. [ 894.884188][T29465] name failslab, interval 1, probability 0, space 0, times 0 [ 894.906665][T29465] CPU: 0 UID: 0 PID: 29465 Comm: syz.0.7080 Not tainted syzkaller #0 PREEMPT(full) [ 894.906692][T29465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 894.906703][T29465] Call Trace: [ 894.906711][T29465] [ 894.906719][T29465] dump_stack_lvl+0xe8/0x150 [ 894.906746][T29465] should_fail_ex+0x412/0x560 [ 894.906775][T29465] should_failslab+0xa8/0x100 [ 894.906803][T29465] __kmalloc_noprof+0xe8/0x760 [ 894.906828][T29465] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 894.906862][T29465] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 894.906897][T29465] genl_family_rcv_msg_doit+0xd9/0x330 [ 894.906928][T29465] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 894.906960][T29465] ? __pfx_genl_get_cmd+0x10/0x10 [ 894.906983][T29465] ? stack_trace_save+0xa9/0x100 [ 894.907007][T29465] ? __pfx_hwsim_get_radio_nl+0x10/0x10 [ 894.907029][T29465] ? __pfx_hwsim_dump_radio_nl+0x10/0x10 [ 894.907051][T29465] ? __lock_acquire+0x6b5/0x2cf0 [ 894.907080][T29465] genl_rcv_msg+0x61c/0x7a0 [ 894.907112][T29465] ? __pfx_genl_rcv_msg+0x10/0x10 [ 894.907137][T29465] ? __pfx_hwsim_get_radio_nl+0x10/0x10 [ 894.907175][T29465] netlink_rcv_skb+0x232/0x4b0 [ 894.907198][T29465] ? __pfx_genl_rcv_msg+0x10/0x10 [ 894.907225][T29465] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 894.907262][T29465] ? down_read+0x270/0x2e0 [ 894.907284][T29465] ? genl_rcv+0xd/0x40 [ 894.907311][T29465] genl_rcv+0x28/0x40 [ 894.907334][T29465] netlink_unicast+0x75c/0x8e0 [ 894.907373][T29465] netlink_sendmsg+0x813/0xb40 [ 894.907406][T29465] ? __pfx_netlink_sendmsg+0x10/0x10 [ 894.907432][T29465] ? aa_sock_msg_perm+0xf1/0x1b0 [ 894.907457][T29465] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 894.907486][T29465] ____sys_sendmsg+0x972/0x9f0 [ 894.907513][T29465] ? __might_fault+0xaf/0x130 [ 894.907544][T29465] ? __pfx_____sys_sendmsg+0x10/0x10 [ 894.907577][T29465] ? import_iovec+0x73/0xa0 [ 894.907607][T29465] ___sys_sendmsg+0x2a5/0x360 [ 894.907629][T29465] ? __lock_acquire+0x6b5/0x2cf0 [ 894.907654][T29465] ? __pfx____sys_sendmsg+0x10/0x10 [ 894.907713][T29465] ? __fget_files+0x2a/0x420 [ 894.907733][T29465] ? __fget_files+0x3a0/0x420 [ 894.907765][T29465] __x64_sys_sendmsg+0x1bd/0x2a0 [ 894.907792][T29465] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 894.907827][T29465] ? __pfx_ksys_write+0x10/0x10 [ 894.907863][T29465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.907884][T29465] do_syscall_64+0x15f/0xf80 [ 894.907904][T29465] ? trace_irq_disable+0x3b/0x140 [ 894.907931][T29465] ? clear_bhb_loop+0x40/0x90 [ 894.907955][T29465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 894.907974][T29465] RIP: 0033:0x7f9303d9cdd9 [ 894.907993][T29465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 894.908010][T29465] RSP: 002b:00007f9304beb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 894.908029][T29465] RAX: ffffffffffffffda RBX: 00007f9304015fa0 RCX: 00007f9303d9cdd9 [ 894.908042][T29465] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004 [ 894.908054][T29465] RBP: 00007f9304beb090 R08: 0000000000000000 R09: 0000000000000000 [ 894.908065][T29465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 894.908076][T29465] R13: 00007f9304016038 R14: 00007f9304015fa0 R15: 00007ffd481e5228 [ 894.908109][T29465] [ 895.249658][ T4943] Bluetooth: hci2: command 0x0406 tx timeout [ 895.256102][ T5634] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 895.362749][T29477] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7084'. [ 895.408792][T29477] bridge_slave_1: left allmulticast mode [ 895.421682][T29477] bridge_slave_1: left promiscuous mode [ 895.443662][T29477] bridge0: port 2(bridge_slave_1) entered disabled state [ 895.469957][T29477] bridge_slave_0: left allmulticast mode [ 895.482182][T29477] bridge_slave_0: left promiscuous mode [ 895.489060][T29477] bridge0: port 1(bridge_slave_0) entered disabled state [ 895.582190][T29483] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7086'. [ 895.610372][T29491] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7088'. [ 895.640693][T29491] openvswitch: : Dropping previously announced user features [ 895.904529][T29511] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7093'. [ 896.052071][T29521] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7095'. [ 896.055224][T29520] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7096'. [ 896.085791][T29520] netlink: 'syz.0.7096': attribute type 1 has an invalid length. [ 896.112146][T29520] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 896.124544][T29524] netlink: 212916 bytes leftover after parsing attributes in process `syz.2.7098'. [ 896.233263][T29528] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7099'. [ 896.276078][T29532] syzkaller0: entered promiscuous mode [ 896.281682][T29532] syzkaller0: entered allmulticast mode [ 896.485986][T29539] [ 896.488357][T29539] ====================================================== [ 896.495378][T29539] WARNING: possible circular locking dependency detected [ 896.502415][T29539] syzkaller #0 Not tainted [ 896.506829][T29539] ------------------------------------------------------ [ 896.513842][T29539] syz.0.7102/29539 is trying to acquire lock: [ 896.519897][T29539] ffffffff8ea85460 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x4a/0x690 [ 896.529767][T29539] [ 896.529767][T29539] but task is already holding lock: [ 896.537126][T29539] ffff888055eb89e0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: l2tp_ip6_sendmsg+0x131f/0x18d0 [ 896.546708][T29539] [ 896.546708][T29539] which lock already depends on the new lock. [ 896.546708][T29539] [ 896.557186][T29539] [ 896.557186][T29539] the existing dependency chain (in reverse order) is: [ 896.566187][T29539] [ 896.566187][T29539] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 896.573911][T29539] lock_sock_nested+0x41/0x100 [ 896.579199][T29539] inet_shutdown+0x6a/0x390 [ 896.584219][T29539] nbd_mark_nsock_dead+0x2e9/0x560 [ 896.589843][T29539] recv_work+0x1c2e/0x1d40 [ 896.594772][T29539] process_scheduled_works+0xb5d/0x1860 [ 896.600832][T29539] worker_thread+0xa53/0xfc0 [ 896.605931][T29539] kthread+0x388/0x470 [ 896.610509][T29539] ret_from_fork+0x514/0xb70 [ 896.615609][T29539] ret_from_fork_asm+0x1a/0x30 [ 896.620888][T29539] [ 896.620888][T29539] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 896.628520][T29539] __mutex_lock+0x1a3/0x1550 [ 896.633633][T29539] nbd_queue_rq+0x37b/0x1100 [ 896.638750][T29539] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 896.644820][T29539] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 896.651670][T29539] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 896.658176][T29539] blk_mq_run_hw_queue+0x348/0x4f0 [ 896.663811][T29539] blk_mq_dispatch_list+0xd16/0xe10 [ 896.669531][T29539] blk_mq_flush_plug_list+0x48d/0x570 [ 896.675422][T29539] __blk_flush_plug+0x3ed/0x4d0 [ 896.680789][T29539] __submit_bio+0x28d/0x580 [ 896.685826][T29539] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 896.691977][T29539] block_read_full_folio+0x599/0x830 [ 896.697771][T29539] filemap_read_folio+0x137/0x3b0 [ 896.703313][T29539] do_read_cache_folio+0x358/0x590 [ 896.708942][T29539] read_part_sector+0xb6/0x2b0 [ 896.714222][T29539] adfspart_check_ICS+0xb1/0x960 [ 896.719676][T29539] bdev_disk_changed+0x817/0x1770 [ 896.725217][T29539] blkdev_get_whole+0x380/0x510 [ 896.730585][T29539] bdev_open+0x31e/0xd30 [ 896.735344][T29539] blkdev_open+0x470/0x610 [ 896.740270][T29539] do_dentry_open+0x785/0x14e0 [ 896.746067][T29539] vfs_open+0x3b/0x340 [ 896.750647][T29539] path_openat+0x2e08/0x3860 [ 896.755751][T29539] do_file_open+0x23e/0x4a0 [ 896.760768][T29539] do_sys_openat2+0x113/0x200 [ 896.765955][T29539] __x64_sys_openat+0x138/0x170 [ 896.771314][T29539] do_syscall_64+0x15f/0xf80 [ 896.776418][T29539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.782824][T29539] [ 896.782824][T29539] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 896.790028][T29539] __mutex_lock+0x1a3/0x1550 [ 896.795145][T29539] nbd_queue_rq+0xc6/0x1100 [ 896.800174][T29539] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 896.806261][T29539] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 896.813124][T29539] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 896.819622][T29539] blk_mq_run_hw_queue+0x348/0x4f0 [ 896.825252][T29539] blk_mq_dispatch_list+0xd16/0xe10 [ 896.830966][T29539] blk_mq_flush_plug_list+0x48d/0x570 [ 896.836855][T29539] __blk_flush_plug+0x3ed/0x4d0 [ 896.842229][T29539] __submit_bio+0x28d/0x580 [ 896.847244][T29539] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 896.853390][T29539] block_read_full_folio+0x599/0x830 [ 896.859184][T29539] filemap_read_folio+0x137/0x3b0 [ 896.864724][T29539] do_read_cache_folio+0x358/0x590 [ 896.870355][T29539] read_part_sector+0xb6/0x2b0 [ 896.875632][T29539] adfspart_check_ICS+0xb1/0x960 [ 896.881086][T29539] bdev_disk_changed+0x817/0x1770 [ 896.886622][T29539] blkdev_get_whole+0x380/0x510 [ 896.891997][T29539] bdev_open+0x31e/0xd30 [ 896.896778][T29539] blkdev_open+0x470/0x610 [ 896.901708][T29539] do_dentry_open+0x785/0x14e0 [ 896.906989][T29539] vfs_open+0x3b/0x340 [ 896.911572][T29539] path_openat+0x2e08/0x3860 [ 896.916678][T29539] do_file_open+0x23e/0x4a0 [ 896.921697][T29539] do_sys_openat2+0x113/0x200 [ 896.926891][T29539] __x64_sys_openat+0x138/0x170 [ 896.932257][T29539] do_syscall_64+0x15f/0xf80 [ 896.937357][T29539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.943760][T29539] [ 896.943760][T29539] -> #3 (set->srcu){.+.+}-{0:0}: [ 896.950882][T29539] __synchronize_srcu+0xca/0x300 [ 896.956338][T29539] elevator_switch+0x1e8/0x7a0 [ 896.961614][T29539] elevator_change+0x2cc/0x450 [ 896.966890][T29539] elevator_set_default+0x36c/0x430 [ 896.972612][T29539] blk_register_queue+0x3e9/0x4e0 [ 896.978161][T29539] __add_disk+0x677/0xd50 [ 896.983023][T29539] add_disk_fwnode+0xfb/0x480 [ 896.988235][T29539] nbd_dev_add+0x72c/0xb50 [ 896.993180][T29539] nbd_init+0x168/0x1f0 [ 896.997859][T29539] do_one_initcall+0x250/0x870 [ 897.003140][T29539] do_initcall_level+0x104/0x190 [ 897.008600][T29539] do_initcalls+0x59/0xa0 [ 897.013439][T29539] kernel_init_freeable+0x2a6/0x3e0 [ 897.019150][T29539] kernel_init+0x1d/0x1d0 [ 897.023993][T29539] ret_from_fork+0x514/0xb70 [ 897.029090][T29539] ret_from_fork_asm+0x1a/0x30 [ 897.034381][T29539] [ 897.034381][T29539] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 897.042189][T29539] __mutex_lock+0x1a3/0x1550 [ 897.047294][T29539] elevator_change+0x1b3/0x450 [ 897.052577][T29539] elevator_set_none+0xb5/0x140 [ 897.057942][T29539] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 897.064262][T29539] nbd_start_device+0x17f/0xb10 [ 897.069624][T29539] nbd_genl_connect+0x165b/0x1cf0 [ 897.075167][T29539] genl_family_rcv_msg_doit+0x22a/0x330 [ 897.081231][T29539] genl_rcv_msg+0x61c/0x7a0 [ 897.086250][T29539] netlink_rcv_skb+0x232/0x4b0 [ 897.091703][T29539] genl_rcv+0x28/0x40 [ 897.096283][T29539] netlink_unicast+0x75c/0x8e0 [ 897.101553][T29539] netlink_sendmsg+0x813/0xb40 [ 897.106825][T29539] ____sys_sendmsg+0x972/0x9f0 [ 897.112102][T29539] ___sys_sendmsg+0x2a5/0x360 [ 897.117294][T29539] __x64_sys_sendmsg+0x1bd/0x2a0 [ 897.122743][T29539] do_syscall_64+0x15f/0xf80 [ 897.127851][T29539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.134265][T29539] [ 897.134265][T29539] -> #1 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 897.142879][T29539] blk_alloc_queue+0x546/0x680 [ 897.148171][T29539] __blk_mq_alloc_disk+0x197/0x390 [ 897.153813][T29539] nbd_dev_add+0x499/0xb50 [ 897.158737][T29539] nbd_init+0x168/0x1f0 [ 897.163406][T29539] do_one_initcall+0x250/0x870 [ 897.168682][T29539] do_initcall_level+0x104/0x190 [ 897.174132][T29539] do_initcalls+0x59/0xa0 [ 897.178976][T29539] kernel_init_freeable+0x2a6/0x3e0 [ 897.184682][T29539] kernel_init+0x1d/0x1d0 [ 897.189528][T29539] ret_from_fork+0x514/0xb70 [ 897.194627][T29539] ret_from_fork_asm+0x1a/0x30 [ 897.199902][T29539] [ 897.199902][T29539] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 897.207105][T29539] __lock_acquire+0x15a5/0x2cf0 [ 897.212465][T29539] lock_acquire+0x106/0x350 [ 897.217473][T29539] fs_reclaim_acquire+0x71/0x100 [ 897.222925][T29539] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 897.229243][T29539] __alloc_skb+0x1d0/0x7d0 [ 897.234171][T29539] alloc_skb_with_frags+0xc8/0x760 [ 897.239806][T29539] sock_alloc_send_pskb+0x878/0x990 [ 897.245595][T29539] __ip6_append_data+0x2baf/0x3e90 [ 897.251225][T29539] ip6_append_data+0x10f/0x280 [ 897.256501][T29539] l2tp_ip6_sendmsg+0x1393/0x18d0 [ 897.262045][T29539] sock_sendmsg+0x379/0x450 [ 897.267070][T29539] splice_to_socket+0xae2/0x11f0 [ 897.272526][T29539] do_splice+0xee3/0x1910 [ 897.277465][T29539] __se_sys_splice+0x353/0x490 [ 897.282761][T29539] do_syscall_64+0x15f/0xf80 [ 897.287883][T29539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.294298][T29539] [ 897.294298][T29539] other info that might help us debug this: [ 897.294298][T29539] [ 897.304515][T29539] Chain exists of: [ 897.304515][T29539] fs_reclaim --> &nsock->tx_lock --> sk_lock-AF_INET6 [ 897.304515][T29539] [ 897.317195][T29539] Possible unsafe locking scenario: [ 897.317195][T29539] [ 897.324629][T29539] CPU0 CPU1 [ 897.329975][T29539] ---- ---- [ 897.335325][T29539] lock(sk_lock-AF_INET6); [ 897.339818][T29539] lock(&nsock->tx_lock); [ 897.346744][T29539] lock(sk_lock-AF_INET6); [ 897.353760][T29539] lock(fs_reclaim); [ 897.357735][T29539] [ 897.357735][T29539] *** DEADLOCK *** [ 897.357735][T29539] [ 897.365862][T29539] 2 locks held by syz.0.7102/29539: [ 897.371047][T29539] #0: ffff888057948c60 (&pipe->mutex){+.+.}-{4:4}, at: splice_to_socket+0x15f/0x11f0 [ 897.380618][T29539] #1: ffff888055eb89e0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: l2tp_ip6_sendmsg+0x131f/0x18d0 [ 897.390617][T29539] [ 897.390617][T29539] stack backtrace: [ 897.396495][T29539] CPU: 0 UID: 0 PID: 29539 Comm: syz.0.7102 Not tainted syzkaller #0 PREEMPT(full) [ 897.396516][T29539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 897.396526][T29539] Call Trace: [ 897.396535][T29539] [ 897.396543][T29539] dump_stack_lvl+0xe8/0x150 [ 897.396564][T29539] print_circular_bug+0x2e1/0x300 [ 897.396588][T29539] check_noncircular+0x12e/0x150 [ 897.396612][T29539] __lock_acquire+0x15a5/0x2cf0 [ 897.396631][T29539] ? lockdep_unlock+0x5d/0xd0 [ 897.396645][T29539] ? __lock_acquire+0x146e/0x2cf0 [ 897.396664][T29539] ? trace_sched_exit_tp+0x3a/0x130 [ 897.396683][T29539] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 897.396704][T29539] lock_acquire+0x106/0x350 [ 897.396720][T29539] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 897.396743][T29539] ? lock_acquire+0x106/0x350 [ 897.396762][T29539] fs_reclaim_acquire+0x71/0x100 [ 897.396785][T29539] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 897.396806][T29539] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 897.396828][T29539] ? __alloc_skb+0x1d0/0x7d0 [ 897.396849][T29539] ? __local_bh_enable_ip+0xd0/0x130 [ 897.396867][T29539] __alloc_skb+0x1d0/0x7d0 [ 897.396889][T29539] ? rcu_is_watching+0x15/0xb0 [ 897.396910][T29539] alloc_skb_with_frags+0xc8/0x760 [ 897.396930][T29539] ? is_bpf_text_address+0x26/0x2b0 [ 897.396945][T29539] ? rcu_is_watching+0x15/0xb0 [ 897.396963][T29539] ? __kasan_check_byte+0x12/0x40 [ 897.396987][T29539] ? rcu_is_watching+0x15/0xb0 [ 897.397006][T29539] sock_alloc_send_pskb+0x878/0x990 [ 897.397036][T29539] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 897.397057][T29539] ? arch_stack_walk+0xfb/0x150 [ 897.397083][T29539] __ip6_append_data+0x2baf/0x3e90 [ 897.397108][T29539] ? __lock_acquire+0x146e/0x2cf0 [ 897.397126][T29539] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 897.397148][T29539] ? ip6_mtu+0x7d/0x490 [ 897.397168][T29539] ? ip6_mtu+0x7d/0x490 [ 897.397186][T29539] ? __pfx___ip6_append_data+0x10/0x10 [ 897.397204][T29539] ? ip6_setup_cork+0x544/0xf30 [ 897.397223][T29539] ? ip6_append_data+0x1b7/0x280 [ 897.397241][T29539] ip6_append_data+0x10f/0x280 [ 897.397261][T29539] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 897.397283][T29539] l2tp_ip6_sendmsg+0x1393/0x18d0 [ 897.397310][T29539] ? __pfx_l2tp_ip6_sendmsg+0x10/0x10 [ 897.397339][T29539] ? __pfx_aa_sk_perm+0x10/0x10 [ 897.397357][T29539] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 897.397382][T29539] ? __pfx_inet_sendmsg+0x10/0x10 [ 897.397404][T29539] ? inet_sendmsg+0x2f4/0x370 [ 897.397424][T29539] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 897.397445][T29539] ? __pfx_inet_sendmsg+0x10/0x10 [ 897.397466][T29539] sock_sendmsg+0x379/0x450 [ 897.397495][T29539] ? __pfx_sock_sendmsg+0x10/0x10 [ 897.397523][T29539] ? __asan_memset+0x22/0x50 [ 897.397542][T29539] ? iov_iter_bvec+0xb8/0x180 [ 897.397565][T29539] splice_to_socket+0xae2/0x11f0 [ 897.397594][T29539] ? __pfx_splice_to_socket+0x10/0x10 [ 897.397631][T29539] ? bpf_lsm_file_permission+0x9/0x20 [ 897.397654][T29539] ? security_file_permission+0x75/0x260 [ 897.397671][T29539] ? rw_verify_area+0x255/0x4d0 [ 897.397693][T29539] ? __pfx_splice_to_socket+0x10/0x10 [ 897.397712][T29539] do_splice+0xee3/0x1910 [ 897.397742][T29539] ? __pfx_do_splice+0x10/0x10 [ 897.397766][T29539] __se_sys_splice+0x353/0x490 [ 897.397789][T29539] ? __pfx___se_sys_splice+0x10/0x10 [ 897.397812][T29539] ? __x64_sys_splice+0x21/0xf0 [ 897.397833][T29539] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.397850][T29539] do_syscall_64+0x15f/0xf80 [ 897.397868][T29539] ? trace_irq_disable+0x3b/0x140 [ 897.397909][T29539] ? clear_bhb_loop+0x40/0x90 [ 897.397927][T29539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.397943][T29539] RIP: 0033:0x7f9303d9cdd9 [ 897.397959][T29539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 897.397973][T29539] RSP: 002b:00007f9304bca028 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 897.397991][T29539] RAX: ffffffffffffffda RBX: 00007f9304016090 RCX: 00007f9303d9cdd9 [ 897.398003][T29539] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000005 [ 897.398013][T29539] RBP: 00007f9303e32d69 R08: 0000000000010500 R09: 0000000000000000 [ 897.398024][T29539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 897.398035][T29539] R13: 00007f9304016128 R14: 00007f9304016090 R15: 00007ffd481e5228 [ 897.398053][T29539] [ 897.855733][ T2470] block nbd0: Possible stuck request ffff8880265ce000: control (read@0,1024B). Runtime 600 seconds [ 897.867187][ T2470] block nbd0: Possible stuck request ffff8880265ce1c0: control (read@1024,1024B). Runtime 600 seconds [ 897.878843][ T2470] block nbd0: Possible stuck request ffff8880265ce380: control (read@2048,1024B). Runtime 600 seconds [ 897.889834][ T2470] block nbd0: Possible stuck request ffff8880265ce540: control (read@3072,1024B). Runtime 600 seconds [ 900.974441][ T4993] udevd[4993]: worker [5636] /devices/virtual/block/nbd0 timeout; kill it [ 900.983101][ T4993] udevd[4993]: seq 17387 '/devices/virtual/block/nbd0' killed